Harden frontend backend proxy and build workflow health checks (#101)

* chore: verify CI lint workflow and apply black/lint updates

* Overhaul autonomy docs and harden CPU chaos validation

- Add comprehensive autonomy core package (contracts, map/twin state, planner, predictor, readiness) with tests and integration points.

- Extend backend with autonomy insight endpoints and align OpenAPI coverage.

- Expand HUD and C2 surfaces with autonomy KPI, safety, recommendation, and timeline overlays.

- Normalize drone telemetry ingest confidence/health metadata and map query contract support.

- Switch node-agent to CPU-only PyTorch wheels to reduce container footprint in CI/dev runs.

- Harden chaos suite fallback by passing admin auth headers for trigger_fl.

- Fix monitoring package integration script/test wiring and refresh repository docs with a full autonomy operations guide plus updated README/C2/monitoring/changelog.

* Add concrete AI interaction implementation plan

- Turn the AI usability recommendations into a phased, ticketable plan.

- Cover command bar, structured recommendations, approval flow, model routing, metadata, mission context, and search.

- Define rollout criteria, validation strategy, and first-branch execution order for the new feature branch.

* Add shared AI interaction summary and operator UX

- add the /ai/interaction/summary backend payload with quick actions and recommendations
- wire the HUD and C2 surfaces to the shared interaction summary
- fix the app-shell fetch path, add focused C2 coverage, and refresh docs
- update the AI interaction plan to record completed work and follow-up items

* Complete AI interaction review workflow

- add interaction history and decision logging endpoints on the backend
- wire the HUD review drawer with approve, edit, reject, and undo flows
- pass review metadata through the app shell and action callbacks
- update C2, docs, and API specs to reflect the completed interaction plan

* Enhance HUD digital twin lens

Add digital twin lens panels for map freshness, route candidates, replay context, and envelope assumptions to strengthen operator twin perspective.

* Add phase 4 AI interaction concrete execution plan

* Potential fix for pull request finding 'CodeQL / Unreachable code'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Ryan <221235059+rwilliamspbg-ops@users.noreply.github.com>

* Execute phase 4 interaction auth, replay UX, and contracts

* Fix PR check failures: dedupe interaction routes and format Python

* Harden frontend backend proxy and main workflow health checks

* Fix duplicate AI interaction routes and black formatting in backend

Agent-Logs-Url: https://github.com/rwilliamspbg-ops/Sovereign_Map_Federated_Learning/sessions/5439c336-47b4-4fb8-81d8-f9f5373ac766

Co-authored-by: rwilliamspbg-ops <221235059+rwilliamspbg-ops@users.noreply.github.com>

---------

Signed-off-by: Ryan <221235059+rwilliamspbg-ops@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: 3 people

.github/workflows/build.yml

@@ -72,10 +72,32 @@ jobs:
       - name: Start services
         run: docker compose -f docker-compose.full.yml up -d --scale node-agent=5
 
-      - name: Wait for backend health
+      - name: Wait for backend and proxy health
         run: |
-          echo "Waiting for federated learning nodes to initialize..."
-          sleep 45
+          set -euo pipefail
+          echo "Waiting for backend container health and frontend proxy readiness..."
+
+          # Wait for backend container to report healthy.
+          for i in $(seq 1 30); do
+            status=$(docker inspect -f '{{.State.Health.Status}}' sovereign-backend 2>/dev/null || true)
+            if [ "$status" = "healthy" ]; then
+              echo "backend health check passed"
+              break
+            fi
+            if [ "$i" -eq 30 ]; then
+              echo "backend did not become healthy"
+              docker compose -f docker-compose.full.yml logs backend || true
+              exit 1
+            fi
+            echo "backend health: ${status:-unknown} (attempt $i/30)"
+            sleep 5
+          done
+
+          # Validate direct backend endpoint and frontend reverse-proxy endpoint.
+          curl -fsS --retry 10 --retry-all-errors --retry-delay 3 \
+            http://127.0.0.1:8000/ops/health >/dev/null
+          curl -fsS --retry 10 --retry-all-errors --retry-delay 3 \
+            http://127.0.0.1:3000/backend/ops/health >/dev/null
 
       - name: Debug on failure
         if: failure()

docker-compose.full.yml

@@ -13,7 +13,8 @@ services:
     environment:
       - NODE_ENV=production
     depends_on:
-      - backend
+      backend:
+        condition: service_healthy
     networks:
       - sovereign-network
     restart: always
@@ -31,7 +32,8 @@ services:
     environment:
       - NODE_ENV=production
     depends_on:
-      - backend
+      backend:
+        condition: service_healthy
     networks:
       - sovereign-network
     restart: always

frontend/nginx.conf

@@ -4,6 +4,11 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Resolve Docker service names at request time so proxying survives
+    # backend container restarts/IP churn on the compose network.
+    resolver 127.0.0.11 valid=10s ipv6=off;
+    resolver_timeout 5s;
+
     location / {
         add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0" always;
         add_header Pragma "no-cache" always;
@@ -22,29 +27,35 @@ server {
     }
 
     location /backend/ {
-        proxy_pass http://backend:8000/;
+        set $backend_upstream http://backend:8000;
+        rewrite ^/backend/(.*)$ /$1 break;
+        proxy_pass $backend_upstream;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection 'upgrade';
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
         proxy_cache_bypass $http_upgrade;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;
     }
 
     location = /api {
         return 301 /api/;
     }
 
     location /api/ {
-        proxy_pass http://backend:8000/;
+        set $backend_upstream http://backend:8000;
+        rewrite ^/api/(.*)$ /$1 break;
+        proxy_pass $backend_upstream;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection 'upgrade';
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
         proxy_cache_bypass $http_upgrade;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;
     }
 
     error_page 500 502 503 504 /50x.html;

frontend/src/HUD.test.jsx

@@ -270,5 +270,4 @@ describe('HUD AI interaction console', () => {
     expect(within(replayArticle).getByText(/reason maintenance window fit/i)).toBeInTheDocument();
     expect(within(replayArticle).getByText(/prompt replan corridor alpha/i)).toBeInTheDocument();
   });
-
 });

sovereignmap_production_backend_v2.py

@@ -450,6 +450,7 @@ def _enforce_rate_limit(req: Request) -> Optional[Response]:
         bucket.append(now)
     return None
 
+
 @app.before_request
 def _security_guardrails():
     if request.method == "OPTIONS":
@@ -3955,53 +3956,6 @@ def runtime_profile_view():
     return jsonify({"status": "ok", "active_profile": applied}), 200
 
 
-@app.route("/ai/interaction/history", methods=["GET"])
-def ai_interaction_history_view():
-    try:
-        limit = int(request.args.get("limit", 50))
-    except (TypeError, ValueError):
-        limit = 50
-    limit = max(1, min(limit, 200))
-    history = _interaction_review_history(limit=limit)
-    return jsonify({"count": len(history), "decisions": history}), 200
-
-
-@app.route("/ai/interaction/decision", methods=["POST"])
-def ai_interaction_decision_view():
-    body = request.get_json(silent=True) or {}
-    if not isinstance(body, dict):
-        return jsonify({"error": "invalid_payload", "message": "JSON object required"}), 400
-
-    decision = str(body.get("decision", "")).strip().lower()
-    if decision not in {"approve", "edit", "reject", "undo"}:
-        return jsonify({"error": "invalid_decision"}), 400
-
-    review_entry = _append_interaction_review_entry(
-        {
-            "review_id": body.get("review_id"),
-            "ts": time.time(),
-            "action_id": body.get("action_id"),
-            "action_label": body.get("action_label"),
-            "action_kind": body.get("action_kind"),
-            "model_route": body.get("model_route"),
-            "decision": decision,
-            "reason": body.get("reason"),
-            "prompt": body.get("prompt"),
-            "command": body.get("command"),
-            "parameters": body.get("parameters") or {},
-            "reversible": bool(body.get("reversible", False)),
-            "source_action_id": body.get("source_action_id"),
-            "override_prompt": body.get("override_prompt"),
-            "rollback_of": body.get("rollback_of"),
-            "reviewed_by": _sanitize_swarm_token(
-                request.headers.get("X-API-Role", "operator"), max_len=24
-            ).lower()
-            or "operator",
-        }
-    )
-    return jsonify({"status": "recorded", "decision": review_entry}), 200
-
-
 @app.route("/verification_policy", methods=["POST"])
 def update_verification_policy():
     data = request.get_json(silent=True) or {}