app.osint-api

OSINT API

REST/OpenAPI composition root for scoped OSINT and governed self-improvement operation handlers. This app owns no domain rules. OSINT_PORT defaults to 3108.

By default the standalone service uses the managed composition: OIDC/JWKS verification, a fresh authority decision, FORCE-RLS PostgreSQL reads, and the durable mutation queue. Configure OSINT_DATABASE_URL, OSINT_AUTHOS_ISSUER, OSINT_AUTHOS_AUDIENCE, OSINT_AUTHOS_JWKS_URL, and OSINT_AUTHORITY_URL. Deployments may instead set an allowlisted OSINT_API_COMPOSITION_MODULE matching @lssm-tech/integration.osint-api-*. Set OSINT_DEPLOYMENT_PROFILE_ID for an explicit managed profile. Known data-isolated deployment IDs, including Hirly France, are also recognized from the authenticated scope and enforced even when the optional environment value is absent; disallowed vertical reads fail before SQL.

The managed composition polls the canonical append-only outbox for scope-isolated, replayable SSE and WebSocket sessions. OSINT_STREAM_POLL_INTERVAL_MS and OSINT_STREAM_BATCH_SIZE tune bounded delivery without changing authority.

The composition supplies the authenticated context resolver, shared headless operation handler, dependency readiness probe, optional scoped stream broker, and graceful shutdown hook. /livez reports process liveness while /readyz fails closed on dependency health. Authenticated SSE and WebSocket sessions both bind replay cursors to the exact resolved scope; WebSocket upgrades are accepted only at the generated event path and detach from the scoped broker on close. Browser WebSocket origins default to the request origin; deployments with a separate console origin set the explicit comma-separated OSINT_ALLOWED_ORIGINS.

An allowlisted composition may also supply selfImprovement with its own authenticated context, headless handler, and scoped broker. The host then serves the generated /api/self-improvement/v1 REST/OpenAPI surface plus program-bound SSE and WebSocket replay. The generated OpenAPI remains discoverable when the runtime is absent, but every call and stream fails closed with 503; production qualification requires a concrete governed module/store/authority composition.

The managed host now supplies that composition when SELF_IMPROVEMENT_CONTROL_URL and SELF_IMPROVEMENT_WORKLOAD_TOKEN are both set. SELF_IMPROVEMENT_AUTHORITY_URL may select a separate fresh-authority endpoint and otherwise uses OSINT_AUTHORITY_URL. HTTP callers provide the explicit x-self-improvement-* ecosystem, tenant, workspace, optional program, jurisdiction, and purpose headers. Readiness remains red until the FORCE-RLS self_improvement_* tables have been migrated; the app never auto-migrates a runtime database role. The managed composition also supplies the program-scoped event broker and publishes declared lifecycle events only after successful headless mutations.