1445043649
dce5e9598b
Add 7 ADRs and a phase-0 plan covering the multi-tenant redesign of DeerFlow, plus an architecture-overview snapshot of the current state. ADRs: - 001 data isolation: row-level tenant_id + Postgres RLS, including LangGraph-owned checkpoint tables (subquery RLS or column upgrade path). - 002 sandbox isolation: K8s namespace + gVisor + NetworkPolicy default- deny, threat model and pod spec defaults. - 003 LLM key & billing: hybrid platform/BYO with pessimistic reservation to handle the "ghost token" overflow on the last call, plus a usage category split for memory/title/summarization charges. - 004 RBAC: two-level (owner/admin/member), JWT-with-role + 30s LRU cache for reads, strict DB lookup for sensitive writes, token_version bump as the single revocation path. - 005 storage topology: Postgres (structured) + S3-compatible object store (large objects) + emptyDir (ephemeral); explicit treatment of the extensions_config.json migration's downstream effects. - 006 runtime & channel tenancy: per-tenant MCP cache, dual-track skills loader, sandbox provider routing by namespace, internal LLM call billing, IM channel-to-tenant binding model. - 007 routing & frontend: path-slug URL form, JWT-only API auth, TenantProvider, hard-reload tenant switch, Better Auth integration. These docs are decision records; no code changes are included.
66 lines
825 B
Plaintext
66 lines
825 B
Plaintext
# DeerFlow docker image cache
|
|
docker/.cache/
|
|
# oh-my-claudecode state
|
|
.omc/
|
|
# OS generated files
|
|
.DS_Store
|
|
*.local
|
|
._*
|
|
.Spotlight-V100
|
|
.Trashes
|
|
ehthumbs.db
|
|
Thumbs.db
|
|
|
|
# Python cache
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
|
|
# Virtual environments
|
|
.venv
|
|
venv/
|
|
|
|
# Environment variables
|
|
.env
|
|
|
|
# Configuration files
|
|
config.yaml
|
|
mcp_config.json
|
|
extensions_config.json
|
|
|
|
# IDE
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Coverage report
|
|
coverage.xml
|
|
coverage/
|
|
.deer-flow/
|
|
.claude/
|
|
skills/custom/*
|
|
logs/
|
|
log/
|
|
debug.log
|
|
|
|
# Local git hooks (keep only on this machine, do not push)
|
|
.githooks/
|
|
|
|
# pnpm
|
|
.pnpm-store
|
|
sandbox_image_cache.tar
|
|
|
|
# ignore the legacy `web` folder
|
|
web/
|
|
|
|
# Deployment artifacts
|
|
backend/Dockerfile.langgraph
|
|
config.yaml.bak
|
|
.playwright-mcp
|
|
/frontend/test-results/
|
|
/frontend/playwright-report/
|
|
.gstack/
|
|
.worktrees
|
|
skills/gstack
|
|
skills/superpowers
|
|
CLAUDE.md
|