fix: security, parallelization, observability, and DX overhaul

.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+    branches: [master, main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: backend/requirements.txt
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Lint
+        run: ruff check app tests
+
+      - name: Test
+        env:
+          AUTH_DISABLED: "true"
+          DATA_DIR: ./data
+        run: pytest -q
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image
+        run: docker build -t chainsentinel-api:ci backend

.gitignore

@@ -7,3 +7,9 @@ dist/
 build/
 token_usage.jsonl
 .venv/
+.pytest_cache/
+.ruff_cache/
+
+# Runtime data dir (token_usage.jsonl persistence)
+backend/data/
+data/

backend/.env.example

@@ -4,6 +4,30 @@ MIMO_BASE_URL=https://api.xiaomimimo.com/v1
 MIMO_MODEL=mimo-v2.5-pro
 
 # Application
-APP_ENV=production
+APP_ENV=development
 APP_PORT=8000
 LOG_LEVEL=info
+
+# Security — REQUIRED in production
+# Comma-separated list. In dev, leaving API_KEYS empty allows requests with a warning.
+API_KEYS=
+AUTH_DISABLED=false
+# Comma-separated allowed origins. Use specific origins; "*" disables credentials.
+ALLOWED_ORIGINS=http://localhost:3000
+
+# Rate limits (slowapi format: N/period)
+RATE_LIMIT_ANALYZE=10/minute
+RATE_LIMIT_BATCH=2/minute
+RATE_LIMIT_CHAT=30/minute
+RATE_LIMIT_STATS=60/minute
+
+# Token budget
+DAILY_TOKEN_BUDGET=10000000
+BUDGET_ENFORCE=true
+
+# Upload limits
+MAX_CONTRACT_SIZE_KB=500
+MAX_CONTRACT_LOC=5000
+
+# Storage
+DATA_DIR=./data

backend/Dockerfile

@@ -0,0 +1,33 @@
+# syntax=docker/dockerfile:1.6
+FROM python:3.12-slim AS base
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+WORKDIR /app
+
+# System deps
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app ./app
+
+# Non-root user
+RUN useradd --uid 10001 --create-home --shell /bin/bash chainsentinel \
+ && mkdir -p /app/data \
+ && chown -R chainsentinel:chainsentinel /app
+USER chainsentinel
+
+ENV DATA_DIR=/app/data
+EXPOSE 8000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD curl -fsS http://127.0.0.1:8000/api/health || exit 1
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

backend/app/__init__.py

@@ -1,6 +1,6 @@
 # ChainSentinel Backend
 
-from app.main import app
 from app.core.config import settings
+from app.main import app
 
 __all__ = ["app", "settings"]