Initial commit

.dockerignore

@@ -0,0 +1,9 @@
+.git
+.gitignore
+.dockerignore
+README.md
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.DS_Store

Dockerfile

@@ -0,0 +1,46 @@
+# ── Base image ────────────────────────────────────────────────────────────────
+FROM python:3.10.12-slim-bookworm
+
+WORKDIR /app
+
+# ── System dependencies ───────────────────────────────────────────────────────
+# build toolchain for packages with C/Fortran extensions; OpenMP and BLAS for
+# the numerical stack; pango/cairo/gdk-pixbuf/fontconfig for the PDF engine —
+# without these the PDF renderer fails to import and downloads degrade to
+# Markdown; curl for the health check; git for the hub client.
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    libgomp1 \
+    libopenblas-dev \
+    gfortran \
+    curl \
+    git \
+    libpango-1.0-0 \
+    libpangoft2-1.0-0 \
+    libpangocairo-1.0-0 \
+    libcairo2 \
+    libgdk-pixbuf-2.0-0 \
+    shared-mime-info \
+    fontconfig \
+    fonts-dejavu-core \
+    && rm -rf /var/lib/apt/lists/*
+
+# ── Python dependencies ───────────────────────────────────────────────────────
+# pip check fails the build on a dependency conflict; the version assert fails
+# it if the base image is ever not exactly 3.10.12.
+COPY requirements.txt .
+RUN python -m pip install --no-cache-dir --default-timeout=120 -r requirements.txt \
+    && python -m pip check \
+    && python -c "import sys; assert sys.version_info[:3] == (3, 10, 12), sys.version; print('Verified Python:', sys.version)"
+
+# ── Bootstrap ─────────────────────────────────────────────────────────────────
+# Only the launcher is baked into the image. The application and its artefacts
+# are fetched at runtime from private repositories identified by secrets.
+COPY bootstrap.py .
+
+EXPOSE 8501
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=120s --retries=3 \
+    CMD curl --fail http://localhost:8501/_stcore/health || exit 1
+
+ENTRYPOINT ["python", "bootstrap.py"]

README.md

@@ -0,0 +1,18 @@
+---
+title: Audit Accrual Anomaly Screening System
+emoji: 🏦
+colorFrom: blue
+colorTo: indigo
+sdk: docker
+python_version: 3.10.12
+app_port: 8501
+pinned: false
+---
+
+# AAAS — Accrual Anomaly Audit Screening
+
+Forensic screening for audit prioritisation.
+
+*Screening signals only — not audit evidence. Human review required.*
+
+https://cappross.com

bootstrap.py

@@ -0,0 +1,51 @@
+import contextlib
+import io
+import logging
+import os
+import sys
+from urllib.parse import quote
+
+# Silence the HTTP stack before it is imported. It does not print by default —
+# urllib3 logs at DEBUG and the root logger sits at WARNING — but any dependency
+# that calls logging.basicConfig() at DEBUG or INFO turns that on, and what it
+# then emits is the full request URL, which carries the private repository path.
+# Space container logs are public on a public Space, so this cannot rest on a
+# default staying put.
+for _n in ("urllib3", "requests", "urllib3.connectionpool", "charset_normalizer"):
+    logging.getLogger(_n).setLevel(logging.CRITICAL)
+    logging.getLogger(_n).propagate = False
+
+import requests
+
+try:
+    token = os.environ["HF_TOKEN"]
+    source = os.environ["AAAS_SOURCE"]
+    revision = os.environ.get("AAAS_SOURCE_REVISION", "main")
+
+    url = (
+        f"https://huggingface.co/datasets/{quote(source, safe='/')}"
+        f"/resolve/{quote(revision, safe='')}/start.py"
+    )
+
+    # The request is made with stdout and stderr captured. Nothing the HTTP
+    # stack writes is safe to forward to a public log: on a failed lookup it can
+    # carry the full request URL, and that URL contains the private repository
+    # path. Anything captured here is discarded, not printed.
+    _sink_out, _sink_err = io.StringIO(), io.StringIO()
+    with contextlib.redirect_stdout(_sink_out), contextlib.redirect_stderr(_sink_err):
+        response = requests.get(
+            url,
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=60,
+        )
+        response.raise_for_status()
+
+    path = "/tmp/.aaas_start.py"
+    with open(path, "wb") as f:
+        f.write(response.content)
+
+    os.execve(sys.executable, [sys.executable, path], os.environ.copy())
+
+except Exception:
+    print("ERROR: application bootstrap unavailable.", flush=True)
+    sys.exit(1)

requirements.txt

@@ -0,0 +1,52 @@
+# AAAS — runtime deps for the inference app.
+# FULLY PINNED to the verified reference environment. Do not unpin: an unpinned
+# file was the root cause of local-vs-deployment drift, because every rebuild
+# silently installed different latest versions.
+# The previous unpinned file was the root cause of the local-vs-Space drift:
+# every rebuild silently installed different latest versions. Do not unpin.
+
+# ── UI (pin => identical widget DOM + CSS behaviour to local) ────────────────
+streamlit==1.50.0
+
+# ── numerics / ML (training stack; unpickle-compatible with the models) ──────
+numpy==1.26.4
+pandas==2.3.3
+scikit-learn==1.7.2
+xgboost==2.1.4
+optbinning==0.20.1
+
+# ── optbinning / mathematical optimization chain
+# Verified in the working Python 3.10.12 reference environment
+ropwr==1.1.0
+cvxpy==1.6.5
+scipy==1.11.4
+ortools==9.9.3963
+
+# ── CVXPY solver stack
+clarabel==0.10.0
+osqp==1.0.3
+scs==3.2.7.post2
+
+
+minisom==2.3.6
+joblib==1.4.2
+
+# ── Arrow (21.0.0 verified with numpy 1.26.4; pyarrow 25.x SEGFAULTS in the
+#    st.dataframe conversion under numpy 1.26 — never unpin) ──────────────────
+pyarrow==21.0.0
+
+# ── plotting / runtime shims ─────────────────────────────────────────────────
+matplotlib==3.7.3
+ipython==8.36.0
+
+# ── Advisory Report PDF engine (was MISSING → "PDF engine unavailable") ──────
+weasyprint==66.0          # requires the pango/cairo system libs (see Dockerfile)
+markdown==3.8
+reportlab==4.4.5          # secondary path; markdown download is the last resort
+
+# ── runtime artefact download from the private HF repos ──────────────────────
+huggingface_hub==0.34.4
+# bootstrap.py imports requests directly. It is also a dependency of
+# huggingface_hub, so it installs today either way — pinned here so a future
+# rebuild cannot drop it and leave the loader failing on an import.
+requests==2.32.3