G
--:--:--

Operações e Implantação

Infraestrutura de produção, histórico de versões, fila de processamento, saúde dos workers externos, incidentes e backups.

PRODUCTIONv1.3.0
Status dos serviços

Somente estados que esta implantação consegue observar de fato são exibidos.

FrontendONLINE

v1.3.0 · PRODUCTION

DatabaseNOT CONFIGURED

Cloud backend not yet enabled

AuthNOT CONFIGURED

Cloud backend not yet enabled

StorageNOT CONFIGURED

Cloud backend not yet enabled

RealtimeNOT CONFIGURED

Cloud backend not yet enabled

Edge FunctionsNOT CONFIGURED

12 contracts defined, none deployed

GPR WorkerOFFLINE

external component required

Remote WorkerOFFLINE

external component required

Fusion WorkerOFFLINE

external component required

AI ProviderNOT CONFIGURED

LIMITED INTELLIGENCE MODE active

Processing QueueDEGRADED

2 queued · 1 retrying · 1 dead-letter

WebhooksNOT CONFIGURED

no endpoints registered

Edge GatewaysOFFLINE

no agent heartbeat received

Métricas

Valores com traço exigem o backend habilitado.

Request count (24 h)requires backend telemetry
Error raterequires backend telemetry
p95 latencyrequires backend telemetry
Queue depth2processing_jobs
Failed jobs1processing_jobs
Job duration (avg)no completed jobs
Storage usagerequires storage provider
Gateway heartbeatnoneedge_gateways
Telemetry rate0 msg/stelemetry-ingest
AI request failures0no provider configured
Fila de processamento

Processamento pesado nunca roda em edge function — os jobs são registrados e reivindicados por workers externos.

JOBSERVICEMISSIONPRIOATTEMPTMODELSTATUSERROR
job-2210governit-gpr-aiRP-00291P11gpr-net 2.2.0QUEUED
job-2211governit-remote-aiRP-00291P21remote-net 1.8.0QUEUED
job-2205governit-fusion-aiRP-00291P12subterra-fusion 2.4.1RETRYINGworker unreachable
job-2198governit-gpr-aiRP-00284P35gpr-net 2.2.0DEAD_LETTERmax attempts exceeded — no worker registered
Workers de IA externos

Um worker nunca é exibido como saudável sem uma resposta real de /health.

governit-gpr-aiexternal required

radargram · hyperbola detection · depth estimation

version unknown · health UNKNOWN · last check never

governit-remote-aiexternal required

multispectral · hyperspectral · thermal · change detection

version unknown · health UNKNOWN · last check never

governit-fusion-aiexternal required

multimodal fusion · uncertainty · information gain

version unknown · health UNKNOWN · last check never

future-model-serviceexternal required

reserved

version unknown · health UNKNOWN · last check never

GET /health  -> 200 {"status":"ok","queue":"governit-gpr-ai","uptime_s":1284}
GET /version -> 200 {"service":"governit-gpr-ai","version":"1.4.0","model_version":"gpr-net 2.2.0"}

POST {SUBTERRA}/functions/v1/worker-callback
  X-GovernIT-Signature: sha256=<hmac(WORKER_CALLBACK_SECRET, body)>
  { "job_id":"job-2210", "status":"COMPLETED", "processing_version":"1.4.0",
    "model_version":"gpr-net 2.2.0", "artifacts":[{"path":"…","sha256":"…"}] }
Contratos de edge functions

Endpoint, modelo de autenticação e status de implantação.

edge-heartbeatEdge Agent liveness + agent versiongateway credentialNOT_CONFIGURED
telemetry-ingestnormalized vehicle telemetrygateway credentialNOT_CONFIGURED
sensor-ingestsensor observation recordsgateway credentialNOT_CONFIGURED
edge-telemetry-batchbuffered offline telemetry replaygateway credentialNOT_CONFIGURED
create-sensor-uploadsigned upload URL + expected SHA-256gateway credentialNOT_CONFIGURED
gpr-analysis-startenqueue GPR job (no compute in-function)user JWTNOT_CONFIGURED
remote-analysis-startenqueue remote-sensing jobuser JWTNOT_CONFIGURED
fusion-analysis-startenqueue fusion jobuser JWTNOT_CONFIGURED
worker-callbackworker result callbackWORKER_CALLBACK_SECRET (HMAC)NOT_CONFIGURED
core-toolsIntelligence Core retriever + tool routeruser JWT + RBACNOT_CONFIGURED
report-generationversioned report renderinguser JWTNOT_CONFIGURED
webhook-deliverysigned outbound webhooks with retryWEBHOOK_SIGNING_SECRETNOT_CONFIGURED
Incidentes
INC-0007 · SEV3OPEN

Fusion jobs cannot be claimed — no worker registered

Processing Queue, Fusion Worker · owner platform@governit.com.br

  • 10:05Z — job-2205 retry threshold reached
  • 10:20Z — No governit-fusion-ai instance has registered a health endpoint

No resolution recorded.

INC-0006 · SEV4MITIGATED

GPR bench sample timeout during lab validation

Hardware Lab · owner lab@governit.com.br

  • 14:24Z — Bench step 'Sensor Sample' failed for GPR-01

Adapter re-configuration scheduled; asset held in BENCH_TEST.

Backups

Apenas estado confirmado pelo provedor — backups bem-sucedidos nunca são simulados.

Database (PITR)UNCONFIRMED

Enable the Cloud backend to read provider-confirmed backup state.

Storage bucketsUNCONFIRMED

No storage provider connected.

Evidence archiveUNCONFIRMED

Retention policy defined; no provider confirmation available.

Versões
VERSIONENVCOMMITDEPLOYEDSTATUSNOTES
1.3.0DEVELOPMENT2026-08-12 12:00ZSUCCESSModules 10–12: Intelligence Core, Production Infrastructure, Hardware Lab
1.2.0DEVELOPMENT2026-08-11 09:00ZSUCCESSi18n + Documentation Center
1.0.0DEVELOPMENT2026-08-10 09:00ZSUCCESSInitial mission-control platform
Variáveis seguras para o frontend

Estas vão no pacote do cliente.

VITE_APP_ENVDEVELOPMENT | STAGING | PRODUCTION
VITE_APP_VERSIONsemantic version shown in About and reports
VITE_SUPABASE_URLproject URL (publishable)
VITE_SUPABASE_PUBLISHABLE_KEYpublishable/anon key — RLS enforced
VITE_MAP_STYLE_URLMapLibre style document URL
Segredos exclusivos do servidor
SUPABASE_SERVICE_ROLE_KEYprivileged database access — server only
OPENAI_API_KEYAI provider adapter
ANTHROPIC_API_KEYAI provider adapter
GOOGLE_AI_API_KEYAI provider adapter
WORKER_CALLBACK_SECRETauthenticates external worker callbacks
WEBHOOK_SIGNING_SECRETHMAC signing of outbound webhooks
EDGE_GATEWAY_SIGNING_SECRETsigns Edge Agent credential material

Nunca referenciados no código cliente. O .env.example contém apenas espaços reservados vazios.

Pipeline CI/CD
PULL REQUESTINSTALLLINTTYPECHECKTESTBUILDSECURITY REVIEWSTAGINGACCEPTANCEPRODUCTION
Estrutura do repositório
governit-subterra/
├── web/               # this application (React + TypeScript + Vite)
├── supabase/          # migrations, policies, edge functions
├── workers/           # external GovernIT AI workers (Python / FastAPI)
│   ├── gpr-ai/
│   ├── remote-ai/
│   └── fusion-ai/
├── edge/              # GovernIT Edge Agent (Linux, systemd)
├── mobile/            # field companion (optional)
├── docs/              # product + deployment documentation
├── infrastructure/    # IaC, docker-compose, deployment manifests
└── .github/workflows/ # CI/CD pipelines
Domínios
subterra.governit.com.brProduction web applicationNOT_CONFIGURED
staging-subterra.governit.com.brStaging (optional)NOT_CONFIGURED
api.subterra.governit.com.brIngest / worker callback API (optional)NOT_CONFIGURED
Imagem do worker externo

Dockerfile de referência: Python, FastAPI, logs estruturados, usuário não-root, endpoints de health e version, sem segredos embutidos.

# GovernIT external AI worker — reference image
FROM python:3.12-slim AS base
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
RUN useradd -m -u 10001 governit
WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY app/ ./app/
USER governit
EXPOSE 8080

# Structured JSON logs, no embedded secrets — inject via environment.
HEALTHCHECK --interval=30s --timeout=5s CMD python -c "import urllib.request;urllib.request.urlopen('http://127.0.0.1:8080/health')"
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080"]
Revisão de segurança de produção
RLS on every tenant tableContract defined — activate with the Cloud backend
RBAC via separate user_roles tableContract defined — never store roles on profiles
Private storage bucketsSigned URLs only, no public evidence buckets
Organization isolationorganization_id scoping on every query path
Mission isolationmission membership checked before mission reads
Edge Function authuser JWT or gateway credential on every endpoint
Device authunique per-gateway credential, rotation + revocation
Service callback authHMAC with WORKER_CALLBACK_SECRET
CORSallow-list of configured product domains
Input validationschema validation on every ingest endpoint
Secret exposureno server secret referenced in client bundles

Nunca registrado em log: passwords, tokens, private keys, raw sensitive evidence payloads.