kyle/sift
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

plan: Makefile for non-Nix hosts (source of truth for build flags)

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-22 21:15:29 -07:00
co-authored by Claude Opus 5.5
parent e9aea1829e
commit 1e915ce715
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PLAN.md
+10 -1
View File
@@ -55,6 +55,15 @@ JSON). Speaking the Firecrawl v2 wire shape means **no Hermes code changes on an
- `modernc.org/sqlite` (pure Go, no cgo) for cache/metrics;
- stdlib `net/http` server (or `chi`), `log/slog`, `context` timeouts.
Single static binary; Nix packaging via `buildGoModule`.
- **Makefile for non-Nix hosts** (Kyle, 2026-09-22: in case the infrastructure substrate ever
changes). Targets: `build` (`CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X
main.version=$(VERSION)"`), `test` (`go test -race ./...`), `lint` (`go vet`, plus
`staticcheck` if present), `contract` (the Hermes contract-test harness), `install`
(binary → `$(PREFIX)/bin`, `PREFIX ?= /usr/local`; example config → `/etc/sift/`;
a plain systemd unit from `dist/sift.service` with the same hardening as the NixOS module),
and `clean`. The Makefile is the source of truth for build flags; the flake's
`buildGoModule` uses the same `-trimpath`/`ldflags`, and CI/`nix flake check` runs
`make test lint`, so the two paths can't drift. Nothing in the service may assume Nix paths.
- Bind `127.0.0.1:8890`; expose on the tailnet with `tailscale serve --bg --https=8443
http://127.0.0.1:8890` → `https://orion.scylla-hammerhead.ts.net:8443`. No firewall hole
(same pattern as SearXNG).
@@ -221,7 +230,7 @@ tests + one live `web_extract`).
| Phase | Scope | Done when |
|---|---|---|
| **P0** skeleton | repo, flake, NixOS module, `/healthz`, URL guard + exhaustive unit tests (table of private/tailnet/rebinding/redirect cases incl. `http://100.95.252.120:8000`, `http://dixie:11434`, `http://[fd7a:115c:a1e0::1]`, decimal/octal IPs, redirect-to-private) | tests green; Claude security review of the guard passes |
| **P0** skeleton | repo, flake, NixOS module, Makefile (+ `dist/sift.service`), `/healthz`, URL guard + exhaustive unit tests (table of private/tailnet/rebinding/redirect cases incl. `http://100.95.252.120:8000`, `http://dixie:11434`, `http://[fd7a:115c:a1e0::1]`, decimal/octal IPs, redirect-to-private) | tests green; Claude security review of the guard passes |
| **P1** clean fetch | `/v2/scrape` (html/json/text → clean), limits, auth, logging; deployed on orion; talos wired | `web_extract` works on talos; contract tests pass for 0.19 and 0.21; guard blocks verified live from talos |
| **P2** digest + context | `/v1/fetch` modes, Dixie digest (thinking on vs off measured), Honcho search context, token metrics | on 50 real fetches: median `returned/raw` ≤ 0.2 with spot-checked quality; p90 latency ≤ 30 s with digest; no guardian-star access possible |
| **P3** search | `/v2/search` + `/v1/search`: SearXNG + Brave LLM Context, dedupe, honcho-embed rerank | search quality spot-check vs SearXNG alone; cost per query known |