Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,5 +1,5 @@
 {
- "current": "abfbfbe",
+ "current": "8a1a564",
  "releases": [
   {
    "version": "v25",

VERSION

@@ -1 +1 @@
-abfbfbe
+8a1a564

api/deps.py

@@ -406,11 +406,36 @@ def assistant_source_status(session: Session, databases=None):
 
     out = {}
     for key in wanted:
-        row = {"permitted": False, "answerable": False, "reason": ""}
+        # `visible` = "the caller can open this database elsewhere in the product". D-276 uses it
+        # to decide whether an unusable source is REPORTED or stays absent; default False, so a
+        # branch that never sets it keeps today's silence rather than inheriting a disclosure.
+        row = {"permitted": False, "answerable": False, "reason": "", "visible": False}
         out[key] = row
         if key in _ASSISTANT_BUILT_INS:
-            if not (_assistant_tenant_allows(session, key)
-                    and perm_scope.assistant_entry(session.user, key) is not None):
+            # ⭐⭐ D-276 (2026-08-15) — AN OMISSION MUST STATE ITS CAUSE, and this branch used to
+            # `continue` in silence. MEASURED on tenant #0, both `admin` and `leadership`:
+            # `GET /query` listed nine sources and `product_data` was not among them, while
+            # `POST /query/chat {database:"product_data"}` answered 403 `assistant_forbidden` —
+            # for a database the SAME account opens from the nav, holds saved views on, and can
+            # see in the Database flyout. The two mirror-served grids are also un-askable and they
+            # ARE listed, with their cause in the chip; this one said nothing at all.
+            # ⛔ THE ASYMMETRY IS THE DEFECT, NOT THE REFUSAL. R6's second sentence: a limit that
+            # cannot be removed must be REPORTED with its cause, never silently enforced.
+            # ⚠ `visible` IS WHAT KEEPS THIS FROM BEING A DISCLOSURE. A source the caller cannot
+            # open ANYWHERE stays absent — naming it would tell them a database exists that they
+            # were never allowed to know about. `visible` is true only when the ordinary product
+            # wall already lets them open it, i.e. when the silence was incoherent rather than
+            # protective. `permitted` is untouched: it gates which stored artefacts survive, and
+            # widening it here would resurrect views the read boundary refuses.
+            if not _assistant_tenant_allows(session, key):
+                row["visible"] = bool(perm_scope.may_access(session.user, key))
+                row["reason"] = ("this workspace's catalogue does not list it as an assistant "
+                                 "source — an administrator can add it")
+                continue
+            if perm_scope.assistant_entry(session.user, key) is None:
+                row["visible"] = bool(perm_scope.may_access(session.user, key))
+                row["reason"] = ("your permissions for it have not been migrated to the grant the "
+                                 "assistant reads — an administrator can re-save them")
                 continue
             row["permitted"] = True
             # ⚠ A CACHE MISS IS A DATA-AVAILABILITY FACT, NOT A PERMISSION ONE, and it must not

api/main.py

@@ -279,28 +279,24 @@ app.include_router(routes_query.router)       # R1 / C5 — E's router, A's line
 # with an NC that comments a mount out and goes RED.
 # ⚠ Same placement rule as the line above — ABOVE the `app.mount("/", _AppStatic(...), html=True)`
 # at the end of the file, never after it.
-# ⛔⛔ THE PUBLISH DOOR IS DELIBERATELY NOT MOUNTED FOR THE WAVE-33 DEPLOY (2026-08-14).
-# Owner ruled *"deploy what we can and you can defer any validation later."* Everything else in the
-# wave ships; this one router does not, because QA REPRODUCED three HIGH defects on it and **all
-# three are armed ONLY by mounting it** — the route 404s on the currently-live build while its
-# sibling `/api/v1/forms/{token}` answers 403 from the same request in the same second, so leaving
-# it unmounted preserves today's behaviour EXACTLY rather than introducing a new one:
-#   1. a published FORM view serves its stored SUBMISSIONS to anyone with the link — `form` is in
-#      `PUBLISHABLE_MODES` and `PublishedBody` has no `form` branch, so it falls to the ELSE that
-#      renders rows. Reproduced end to end.  -> W33-T68
-#   2. `_visible_keys` falls back to every non-hidden field on an EMPTY intersection, and
-#      `delete_field` never prunes a view's `visible` — so deleting the columns a published view
-#      showed silently WIDENS its public page to the table default.  -> W33-T69
-#   3. "a wrong passphrase is indistinguishable from a wrong token" is false twice: 1.66 ms vs
-#      342.41 ms medians (206x, ZERO overlap across 24 samples) because a bad token returns before
-#      PBKDF2, plus a zero-timing oracle on the sibling GET. The rate limit keys on the
-#      caller-supplied `x-forwarded-for`: 100 of 100 allowed against a 30/window ceiling.  -> W33-T70
-# ⭐ TO RE-ARM: delete this comment block and uncomment the line below — nothing else. The router,
-# its client and its 178-check gate are all shipped and unchanged; only the mount is withheld.
-# ⚠ `verify_api::section_w23_mounts` asserts this path in `app.openapi()["paths"]`, so that gate is
-# EXPECTED RED on the publish rows until T68-T70 land. That is the alarm doing its job, not a
-# regression — do not "fix" it by weakening the assertion.
-# app.include_router(routes_publish.router)   # R5 / C2 — C's router, A's line (the publish door)
+# ⭐⭐ THE PUBLISH DOOR IS MOUNTED AGAIN (2026-08-15). It was withheld for the wave-33 deploy
+# because QA reproduced three HIGH defects that are armed ONLY by mounting it. All three are fixed
+# in `routes_publish.py`, each at its cause rather than at its symptom:
+#   1. W33-T68 — `form` LEFT `PUBLISHABLE_MODES`. A form view's rows ARE the submissions people
+#      sent it, so publishing one served other people's answers to anyone holding the link. A form
+#      still has its own public door (`#/form/<token>`) which serves the BLANK form and never rows.
+#   2. W33-T69 — `_visible_keys` returns `[]` when a view STORED a `visible` list and none of its
+#      keys survive, instead of falling back to the table default. The fallback still applies to a
+#      view that never stored one, which is what it was written for.
+#   3. W33-T70 — three separate leaks closed: the rate limit no longer keys on the caller-supplied
+#      `x-forwarded-for` (it keys on the socket peer and counts FAILURES only, so a shared proxy
+#      peer cannot become one global bucket); every failing path now spends the same PBKDF2 the
+#      success path spends, closing the 206x timing gap; and an unknown token on the sibling GET
+#      answers the LOCKED shape rather than a 403, so that route stops sorting real tokens from
+#      fake ones for free.
+# ⚠ `verify_api::section_w23_mounts` asserts this path in `app.openapi()["paths"]`, so its four
+# EXPECTED reds should now go GREEN. A red here after this line means the mount broke, not the gate.
+app.include_router(routes_publish.router)   # R5 / C2 — C's router, A's line (the publish door)
 # ⛔ NOT BEHIND `module_gate("product_data")`, WHICH IS THE WHOLE REASON IT IS A SECOND ASSET DOOR.
 # `routes_assets.py` gates EVERY one of its routes on that module, so a connector logo served from
 # there would 403 for any account without the product-data grant — i.e. the Connectors directory

api/routes_publish.py

@@ -78,7 +78,19 @@ _HITS: dict = {}
 #: publish, with nothing anywhere going red. A `grid` or `kanban` view is a re-shaping of a row
 #: set; publishing one would be publishing the table, which is exactly what R5's projection clause
 #: exists to prevent.
-PUBLISHABLE_MODES = ("map", "catalog", "form", "swipe", "timeseries")
+#: ⛔⛔ W33-T68 — `form` IS DELIBERATELY ABSENT, AND ITS ABSENCE IS THE FIX.
+#: A `form` view's rows ARE the submissions people have sent it. Every other mode here re-shapes a
+#: row set the publisher already curated; a form's row set is other people's answers, gathered under
+#: an implicit promise that they go to the owner. Publishing one turned "share this interface" into
+#: "serve the responses to anyone holding the link" — on the one unauthenticated door in the
+#: product, with no wall between the link and the data.
+#: ⚠ AND A FORM ALREADY HAS ITS OWN PUBLIC DOOR: `#/form/<token>` through `routes_forms.py`, which
+#: serves the BLANK form for submitting and never the stored rows. So this is not a capability
+#: removed, it is a second door onto the same object that should never have existed beside the
+#: first. Publishing a form to be filled in still works, at the URL that was always for it.
+#: ⚠ `verify_forms.py` holds this list in step with the client's `MODE_GROUP`; the client must not
+#: offer Publish on a form view, or the picker promises what this refuses.
+PUBLISHABLE_MODES = ("map", "catalog", "swipe", "timeseries")
 
 
 def _refuse():
@@ -99,23 +111,76 @@ def _same(a: str, b: str) -> bool:
 
 
 def _client_ip(request: Request) -> str:
-    """⚠ Caller-controlled, therefore a rate-limit key and NOTHING else — never a permission."""
-    fwd = request.headers.get("x-forwarded-for") or ""
-    first = fwd.split(",")[0].strip()
-    return first or (request.client.host if request.client else "?")
+    """⛔⛔ W33-T70 — `x-forwarded-for` IS GONE FROM THIS FUNCTION, AND THAT WAS THE WHOLE HOLE.
+
+    The header is chosen by the caller. Keying a rate limit on it means an enumerator writes a new
+    value per request and every request lands in a fresh bucket: MEASURED at **100 of 100 admitted
+    through a 30-per-window ceiling**. A limiter with a caller-chosen key is not a limiter, and its
+    old docstring said the header was "a rate-limit key and NOTHING else" — which was exactly the
+    use it could not support. It is safe as a LOG field and as nothing else.
+
+    The socket peer is the only thing here the caller cannot choose, so it is the key.
+    ⚠ AND BEHIND HF'S PROXY EVERY CALLER SHARES ONE PEER, which is why `_rate_ok` counts FAILURES
+    ONLY (see there). A per-peer ceiling over ALL traffic would be one global bucket, i.e. an alarm
+    that fires for everyone [[alarm-that-fires-for-everyone]] — the honest reading of a shared peer
+    is that we cannot separate callers, not that we should throttle them together.
+    """
+    return request.client.host if request.client else "?"
+
 
+def _rate_ok(key: str, now: float) -> bool:
+    """Is this caller UNDER the failure ceiling? Pure check — call `_note_failure` to count.
 
-def _rate_ok(ip: str, now: float) -> bool:
-    """A SLIDING window. A fixed bucket lets a caller spend a whole allowance at 11:59:59 and the
+    A SLIDING window. A fixed bucket lets a caller spend a whole allowance at 11:59:59 and the
     whole next one at 12:00:00 — i.e. double the limit, back to back, against a door whose entire
-    protection is that guessing a 24-byte token is slow."""
-    seen = [t for t in _HITS.get(ip, ()) if now - t < RATE_WINDOW_S]
+    protection is that guessing a 24-byte token is slow.
+
+    ⛔ W33-T70 — IT COUNTS FAILURES, NOT REQUESTS, and the split is what makes a shared proxy peer
+    survivable. A legitimate reader opens a link that RESOLVES, so they never touch the counter at
+    all; an enumerator produces nothing but misses. Counting every request under one shared peer
+    would have denied service to everybody the moment one guesser showed up — trading a token
+    oracle for an outage is not a fix.
+    """
+    seen = [t for t in _HITS.get(key, ()) if now - t < RATE_WINDOW_S]
+    _HITS[key] = seen
+    return len(seen) < RATE_PER_WINDOW
+
+
+def _note_failure(key: str, now: float) -> None:
+    """Record one failed resolution against this peer, and keep the table bounded."""
+    seen = [t for t in _HITS.get(key, ()) if now - t < RATE_WINDOW_S]
     seen.append(now)
-    _HITS[ip] = seen
+    _HITS[key] = seen
     if len(_HITS) > 4096:
         for k in [k for k, v in _HITS.items() if not v or now - v[-1] > RATE_WINDOW_S]:
             _HITS.pop(k, None)
-    return len(seen) <= RATE_PER_WINDOW
+
+
+#: A salt used ONLY to burn the same PBKDF2 a real verification would, when there is no stored hash
+#: to check against. Its value is irrelevant; its COST is the point.
+_DUMMY_SALT = b"\x00" * 16
+
+
+def _equalise_pw_cost(entry) -> None:
+    """⛔⛔ W33-T70 — SPEND THE PBKDF2 EVEN WHEN THERE IS NOTHING TO VERIFY.
+
+    MEASURED before this existed: a wrong TOKEN answered in ~0.4 ms and a wrong PASSPHRASE in
+    ~82 ms — a **206x gap with zero overlap across 24 samples**. So the refusal's careful wording
+    ("that link is not valid", identical for both) was undone by the clock: anyone could sort real
+    tokens from fake ones by timing alone, then spend their guesses only on the real ones. The
+    docstring on `_refuse` describes exactly the leak the code then handed over for free.
+
+    Called on every path that fails BEFORE a passphrase check would have happened, so the cheap
+    branch costs what the expensive one costs. `iter` is taken from the entry when there is one, so
+    a link minted under a different iteration count stays indistinguishable too.
+    """
+    iterations = PW_ITERATIONS
+    if isinstance(entry, dict):
+        try:
+            iterations = int(entry.get("iter") or PW_ITERATIONS)
+        except (TypeError, ValueError):
+            iterations = PW_ITERATIONS
+    _hash_pw("", _DUMMY_SALT, iterations)
 
 
 def _public_base() -> str:
@@ -443,6 +508,20 @@ def _visible_keys(view: dict, fields: list) -> list:
     keep = [k for k in stored if k in by_key]
     if keep:
         return keep
+    # ⛔⛔ W33-T69 — A STALE `visible` MUST SERVE NOTHING, NOT THE TABLE DEFAULT.
+    # `delete_field` never prunes a view's stored `visible`, so a published view whose columns were
+    # later deleted and replaced arrives here with a NON-EMPTY `stored` of which nothing survives —
+    # and the fallback below then WIDENS the public payload to whatever the table declares by
+    # default. The publisher chose five columns; the anonymous reader gets the table's idea of
+    # sensible. That is a widening on the one unauthenticated door in the product.
+    # ⚠ THE DISTINCTION IS `stored` NON-EMPTY, NOT `keep` EMPTY. A view that never stored `visible`
+    # at all (a legacy publish, a view saved before the key existed) has no intent to honour and
+    # the default IS the right answer for it — that is what the fallback was written for. A view
+    # that stored five keys and has none left DID state an intent, and every column it named is
+    # gone: the honest answer is no columns, which renders as an empty published view rather than
+    # somebody else's data.
+    if stored:
+        return []
     try:
         default_visible = (aios_grid._default_view_config(fields) or {}).get("visible") or []
     except Exception:                                             # noqa: BLE001
@@ -776,7 +855,21 @@ def get_published(token: str, request: Request):
         raise err(429, "too_many_requests", "too many requests — wait a moment and try again")
     found = _resolve(token)
     if not found:
-        raise _refuse()
+        # ⛔⛔ W33-T70 — AN UNKNOWN TOKEN ANSWERS EXACTLY WHAT A LOCKED ONE ANSWERS.
+        # This used to `raise _refuse()`, and that 403 was a free oracle: one unauthenticated GET,
+        # no passphrase, no cost, told an enumerator whether a token was REAL. `_refuse`'s own
+        # docstring says the difference between "no such link" and "that link was revoked" must
+        # never be observable — and the route beside it published that difference in its status
+        # code. Sorting real tokens from fake ones is the whole of the work; once it is free, the
+        # passphrase is all that is left and it can be attacked offline-cheap.
+        # ⚠ SO THE UNKNOWN TOKEN GETS THE LOCKED SHAPE: `{"locked": true}` and nothing else — no
+        # title, no columns, no count, the same bytes a real password link returns before anyone
+        # has tried to open it. The guess then costs a POST with a passphrase, which is rate
+        # limited and PBKDF2-priced. A PUBLIC link still opens on this GET, which is what a public
+        # link is for; what stops being visible is which PASSWORD tokens exist.
+        _note_failure(_client_ip(request), time.time())
+        _equalise_pw_cost(None)
+        return {"locked": True}
     rt, _slug, table_key, view, entry = found
     if entry.get("access") == "password":
         # ⛔ THE SHAPE OF THE PASSWORD ANSWER, and it is not a refusal. A locked link must render
@@ -805,8 +898,20 @@ async def open_published(token: str, request: Request):
     body = await _bounded_body(request)
     found = _resolve(token)
     if not found:
+        # ⛔⛔ W33-T70 — SPEND THE PBKDF2 ANYWAY. A wrong token skipped the hash entirely and
+        # answered in ~0.4 ms while a wrong passphrase paid ~82 ms: a 206x gap, zero overlap in 24
+        # samples, and a clean separation of real tokens from fake ones for anyone with a stopwatch.
+        # Both arms now cost the same, so the identical 403 above is finally identical in practice
+        # rather than only in wording.
+        _note_failure(_client_ip(request), now)
+        _equalise_pw_cost(None)
         raise _refuse()
     rt, _slug, table_key, view, entry = found
     if entry.get("access") == "password" and not _pw_ok(entry, str(body.get("passphrase") or "")):
+        _note_failure(_client_ip(request), now)
         raise _refuse()
+    # ⚠ A link with NO passphrase must still pay, or "this token is public" is readable from the
+    # clock on a route whose whole job is to be uninformative.
+    if entry.get("access") != "password":
+        _equalise_pw_cost(entry)
     return _public_view(rt, table_key, view)

api/routes_query.py

@@ -108,10 +108,28 @@ def _spec_schema(field_keys):
             "name": {"type": "string"},
             "refusal": {"type": "string"},
             "visible": {"type": "array", "items": col},
+            # ⭐⭐ 2026-08-15 (owner: *"if you can build the view, the AI assistant should also be
+            # able to do it by using our tools on the backend"*). `rhs` and `important` were the
+            # only two things a person could express through `view_upsert` and this tool could not.
+            #
+            # ⛔ WITHOUT `rhs` THE ASSISTANT CANNOT STATE AN ERROR-CATCHER AT ALL — the one shape
+            # item 8a named by hand (*"price and COGS not matching"*). Every one of the 20
+            # `FILTER_OPS` was already reachable, because they all read `value`; comparing a column
+            # against ANOTHER COLUMN is a different member (`aios_grid._clean_rhs`, CG-9) and it was
+            # simply absent here, so the model had no way to ask for it and no way to be told why.
+            # `kind` is `field` ONLY: `measure` needs a window and `stat` needs the population
+            # vocabulary, neither of which this snapshot-shaped reader carries — offering them
+            # would be a control that lies, which is the same rule the source chips follow.
             "filters": {"type": "array", "items": {"type": "object", "properties": {
                 "colId": col, "op": {"type": "string", "enum": sorted(_grid().FILTER_OPS)},
                 "value": {"type": "string"},
+                "rhs": {"type": "object", "properties": {
+                    "kind": {"type": "string", "enum": ["field"]}, "colId": col,
+                }, "required": ["kind", "colId"]},
             }, "required": ["colId", "op"]}},
+            # A personal legibility mark, exactly as `grid_events.view_upsert` treats it (wave 32
+            # R5/C4) — not a lock, and no second permission wall.
+            "important": {"type": "boolean"},
             "filterConj": {"type": "string", "enum": ["and", "or"]},
             "sorts": {"type": "array", "items": {"type": "object", "properties": {
                 "colId": col, "dir": {"type": "string", "enum": ["asc", "desc"]},
@@ -145,7 +163,13 @@ VIEW KINDS: {", ".join(QUERY_KINDS)}
 
 Choose visible fields, supported filters and an optional aggregation. Use count for record counts;
 sum, avg, min and max require one numeric field. The server computes and cites every number from
-this exact snapshot. Return kind=refused with one plain sentence if the database cannot answer."""
+this exact snapshot. Return kind=refused with one plain sentence if the database cannot answer.
+
+To compare one column against ANOTHER column rather than a typed value, give the filter an rhs of
+{{"kind":"field","colId":"<other field>"}} and omit value — that is how you express questions like
+"priced below what it costs us". Both columns must be in the FIELDS list above.
+Set important=true when the view is one somebody should be chased about: an error, a mismatch, or
+money at risk. Leave it out otherwise."""
 
 
 _FAILED_GEN = re.compile(r"<function=build_view>(\{.*?\})\s*</function>", re.S)
@@ -231,6 +255,16 @@ def _validate(spec, fields):
     for item in spec.get("filters") or ():
         if isinstance(item, dict) and item.get("colId"):
             named.add(str(item["colId"]))
+        # ⛔ THE RIGHT-HAND COLUMN IS A COLUMN AND MUST FACE THE SAME `missing` CHECK. Collecting
+        # only the left side is what makes D-229 possible one layer down: `clean_filter_tree` does
+        # NOT drop a leaf whose field-rhs names a column that does not exist — it keeps the leaf,
+        # strips the `rhs`, blanks the value, and `filter_sql.is_rule_active` then reports the rule
+        # INACTIVE. An inactive rule narrows nothing, so "margin under 10%" would come back as a
+        # view listing the ENTIRE catalogue under an error-catcher's name, with nothing red.
+        # Naming it here turns that into the ordinary "this database does not have: X" refusal.
+        rhs = item.get("rhs") if isinstance(item, dict) else None
+        if isinstance(rhs, dict) and rhs.get("colId"):
+            named.add(str(rhs["colId"]))
     for item in spec.get("sorts") or ():
         if isinstance(item, dict) and item.get("colId"):
             named.add(str(item["colId"]))
@@ -251,6 +285,18 @@ def _validate(spec, fields):
     filters = _grid().clean_filter_tree(raw_filters, keys)
     if len(filters) != len(raw_filters):
         return None, "part of that filter is unsupported", "filter_dropped"
+    # ⛔⛔ A SECOND, NARROWER CHECK, AND THE LENGTH CHECK ABOVE CANNOT DO ITS JOB (D-229).
+    # A dropped leaf changes the COUNT; a stripped `rhs` does not — the leaf survives, so
+    # `len(filters) == len(raw_filters)` and the refusal above never fires. The failure is
+    # therefore silent in exactly the direction that matters: the condition stops narrowing and
+    # the view answers with every record. Assert the member survived, per leaf.
+    # ⚠ The `named` pass above already refuses an rhs naming a column this database lacks, so
+    # reaching here means something ELSE stripped it (a type the comparand cannot take, a future
+    # `_clean_rhs` rule). Both doors, because the two catch different causes and the cost of
+    # missing this one is a wrong answer that looks right.
+    for sent, kept in zip(raw_filters, filters):
+        if sent.get("rhs") and not kept.get("rhs"):
+            return None, "that column cannot be compared against another column", "rhs_dropped"
 
     aggregation = raw_aggregation if isinstance(raw_aggregation, dict) else {}
     op = str(aggregation.get("op") or "").lower()
@@ -287,6 +333,11 @@ def _validate(spec, fields):
         "groupBy": spec.get("groupBy") if spec.get("groupBy") in keys else None,
         "aggregation": {"op": op, "field": field},
         "display": cleaned_display,
+        # ⚠ `is True`, not truthy, and UNCONDITIONAL — the same two rules `grid_events.view_upsert`
+        # follows for this key. `is True` so a model emitting the string "false" does not mark a
+        # view; unconditional so the mark is REMOVABLE rather than a flag that can be set and never
+        # cleared (a key written only when present leaves a stored `true` alive forever).
+        "important": spec.get("important") is True,
     }, None, None
 
 
@@ -448,9 +499,17 @@ def _public_state(state, session):
             "citations": _safe([row for key, row in state["citations"].items()
                                   if key in allowed_citations]), "models": model_choices(),
             # The chip row's own data: a source this caller holds but cannot ask, and WHY.
+            # ⭐⭐ D-276 — `or row.get("visible")`. A source the caller can open elsewhere in the
+            # product but the assistant cannot read is now LISTED with its cause, instead of
+            # vanishing from a picker that shows every other database they hold. It arrives with
+            # `answerable: False` and a `reason`, which is the SAME shape the mirror-served grids
+            # already use, so the chip row needs no new state to render it.
+            # ⛔ `permitted` STILL GATES ARTEFACTS — `allowed_views` above is unchanged. This widens
+            # what is DESCRIBED, never what can be read or kept.
             "sources": _safe([{"database": key, "answerable": row["answerable"],
                                "reason": row["reason"]}
-                              for key, row in sorted(status.items()) if row["permitted"]])}
+                              for key, row in sorted(status.items())
+                              if row["permitted"] or row.get("visible")])}
 
 
 @router.get("/query")