Operações e Implantação
Infraestrutura de produção, histórico de versões, fila de processamento, saúde dos workers externos, incidentes e backups.
Somente estados que esta implantação consegue observar de fato são exibidos.
v1.3.0 · PRODUCTION
Cloud backend not yet enabled
Cloud backend not yet enabled
Cloud backend not yet enabled
Cloud backend not yet enabled
12 contracts defined, none deployed
external component required
external component required
external component required
LIMITED INTELLIGENCE MODE active
2 queued · 1 retrying · 1 dead-letter
no endpoints registered
no agent heartbeat received
Valores com traço exigem o backend habilitado.
| Request count (24 h) | — | requires backend telemetry |
| Error rate | — | requires backend telemetry |
| p95 latency | — | requires backend telemetry |
| Queue depth | 2 | processing_jobs |
| Failed jobs | 1 | processing_jobs |
| Job duration (avg) | — | no completed jobs |
| Storage usage | — | requires storage provider |
| Gateway heartbeat | none | edge_gateways |
| Telemetry rate | 0 msg/s | telemetry-ingest |
| AI request failures | 0 | no provider configured |
Processamento pesado nunca roda em edge function — os jobs são registrados e reivindicados por workers externos.
| JOB | SERVICE | MISSION | PRIO | ATTEMPT | MODEL | STATUS | ERROR |
|---|---|---|---|---|---|---|---|
| job-2210 | governit-gpr-ai | RP-00291 | P1 | 1 | gpr-net 2.2.0 | QUEUED | — |
| job-2211 | governit-remote-ai | RP-00291 | P2 | 1 | remote-net 1.8.0 | QUEUED | — |
| job-2205 | governit-fusion-ai | RP-00291 | P1 | 2 | subterra-fusion 2.4.1 | RETRYING | worker unreachable |
| job-2198 | governit-gpr-ai | RP-00284 | P3 | 5 | gpr-net 2.2.0 | DEAD_LETTER | max attempts exceeded — no worker registered |
Um worker nunca é exibido como saudável sem uma resposta real de /health.
radargram · hyperbola detection · depth estimation
version unknown · health UNKNOWN · last check never
multispectral · hyperspectral · thermal · change detection
version unknown · health UNKNOWN · last check never
multimodal fusion · uncertainty · information gain
version unknown · health UNKNOWN · last check never
reserved
version unknown · health UNKNOWN · last check never
GET /health -> 200 {"status":"ok","queue":"governit-gpr-ai","uptime_s":1284}
GET /version -> 200 {"service":"governit-gpr-ai","version":"1.4.0","model_version":"gpr-net 2.2.0"}
POST {SUBTERRA}/functions/v1/worker-callback
X-GovernIT-Signature: sha256=<hmac(WORKER_CALLBACK_SECRET, body)>
{ "job_id":"job-2210", "status":"COMPLETED", "processing_version":"1.4.0",
"model_version":"gpr-net 2.2.0", "artifacts":[{"path":"…","sha256":"…"}] }Endpoint, modelo de autenticação e status de implantação.
| edge-heartbeat | Edge Agent liveness + agent version | gateway credential | NOT_CONFIGURED |
| telemetry-ingest | normalized vehicle telemetry | gateway credential | NOT_CONFIGURED |
| sensor-ingest | sensor observation records | gateway credential | NOT_CONFIGURED |
| edge-telemetry-batch | buffered offline telemetry replay | gateway credential | NOT_CONFIGURED |
| create-sensor-upload | signed upload URL + expected SHA-256 | gateway credential | NOT_CONFIGURED |
| gpr-analysis-start | enqueue GPR job (no compute in-function) | user JWT | NOT_CONFIGURED |
| remote-analysis-start | enqueue remote-sensing job | user JWT | NOT_CONFIGURED |
| fusion-analysis-start | enqueue fusion job | user JWT | NOT_CONFIGURED |
| worker-callback | worker result callback | WORKER_CALLBACK_SECRET (HMAC) | NOT_CONFIGURED |
| core-tools | Intelligence Core retriever + tool router | user JWT + RBAC | NOT_CONFIGURED |
| report-generation | versioned report rendering | user JWT | NOT_CONFIGURED |
| webhook-delivery | signed outbound webhooks with retry | WEBHOOK_SIGNING_SECRET | NOT_CONFIGURED |
Fusion jobs cannot be claimed — no worker registered
Processing Queue, Fusion Worker · owner platform@governit.com.br
- 10:05Z — job-2205 retry threshold reached
- 10:20Z — No governit-fusion-ai instance has registered a health endpoint
No resolution recorded.
GPR bench sample timeout during lab validation
Hardware Lab · owner lab@governit.com.br
- 14:24Z — Bench step 'Sensor Sample' failed for GPR-01
Adapter re-configuration scheduled; asset held in BENCH_TEST.
Apenas estado confirmado pelo provedor — backups bem-sucedidos nunca são simulados.
Enable the Cloud backend to read provider-confirmed backup state.
No storage provider connected.
Retention policy defined; no provider confirmation available.
| VERSION | ENV | COMMIT | DEPLOYED | STATUS | NOTES |
|---|---|---|---|---|---|
| 1.3.0 | DEVELOPMENT | — | 2026-08-12 12:00Z | SUCCESS | Modules 10–12: Intelligence Core, Production Infrastructure, Hardware Lab |
| 1.2.0 | DEVELOPMENT | — | 2026-08-11 09:00Z | SUCCESS | i18n + Documentation Center |
| 1.0.0 | DEVELOPMENT | — | 2026-08-10 09:00Z | SUCCESS | Initial mission-control platform |
Estas vão no pacote do cliente.
| VITE_APP_ENV | DEVELOPMENT | STAGING | PRODUCTION |
| VITE_APP_VERSION | semantic version shown in About and reports |
| VITE_SUPABASE_URL | project URL (publishable) |
| VITE_SUPABASE_PUBLISHABLE_KEY | publishable/anon key — RLS enforced |
| VITE_MAP_STYLE_URL | MapLibre style document URL |
| SUPABASE_SERVICE_ROLE_KEY | privileged database access — server only |
| OPENAI_API_KEY | AI provider adapter |
| ANTHROPIC_API_KEY | AI provider adapter |
| GOOGLE_AI_API_KEY | AI provider adapter |
| WORKER_CALLBACK_SECRET | authenticates external worker callbacks |
| WEBHOOK_SIGNING_SECRET | HMAC signing of outbound webhooks |
| EDGE_GATEWAY_SIGNING_SECRET | signs Edge Agent credential material |
Nunca referenciados no código cliente. O .env.example contém apenas espaços reservados vazios.
governit-subterra/ ├── web/ # this application (React + TypeScript + Vite) ├── supabase/ # migrations, policies, edge functions ├── workers/ # external GovernIT AI workers (Python / FastAPI) │ ├── gpr-ai/ │ ├── remote-ai/ │ └── fusion-ai/ ├── edge/ # GovernIT Edge Agent (Linux, systemd) ├── mobile/ # field companion (optional) ├── docs/ # product + deployment documentation ├── infrastructure/ # IaC, docker-compose, deployment manifests └── .github/workflows/ # CI/CD pipelinesDomínios
| subterra.governit.com.br | Production web application | NOT_CONFIGURED |
| staging-subterra.governit.com.br | Staging (optional) | NOT_CONFIGURED |
| api.subterra.governit.com.br | Ingest / worker callback API (optional) | NOT_CONFIGURED |
Dockerfile de referência: Python, FastAPI, logs estruturados, usuário não-root, endpoints de health e version, sem segredos embutidos.
# GovernIT external AI worker — reference image
FROM python:3.12-slim AS base
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
RUN useradd -m -u 10001 governit
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY app/ ./app/
USER governit
EXPOSE 8080
# Structured JSON logs, no embedded secrets — inject via environment.
HEALTHCHECK --interval=30s --timeout=5s CMD python -c "import urllib.request;urllib.request.urlopen('http://127.0.0.1:8080/health')"
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080"]| RLS on every tenant table | Contract defined — activate with the Cloud backend |
| RBAC via separate user_roles table | Contract defined — never store roles on profiles |
| Private storage buckets | Signed URLs only, no public evidence buckets |
| Organization isolation | organization_id scoping on every query path |
| Mission isolation | mission membership checked before mission reads |
| Edge Function auth | user JWT or gateway credential on every endpoint |
| Device auth | unique per-gateway credential, rotation + revocation |
| Service callback auth | HMAC with WORKER_CALLBACK_SECRET |
| CORS | allow-list of configured product domains |
| Input validation | schema validation on every ingest endpoint |
| Secret exposure | no server secret referenced in client bundles |
Nunca registrado em log: passwords, tokens, private keys, raw sensitive evidence payloads.