HydraIssues

Issues / #664
HydraBrainServer: IAMNim-authenticated HydraScale chat
done feature Project: Hydra Parent: #659 Reporter: Hydra infrastructure 6 Sep 2026 08:41

Description

Build and deploy hydrabrainserver as the authenticated person-facing HydraBrain chat surface at https://hydrabrain.experiencenet.com. IAMNim owns login; the service owns only an opaque local browser session, server-side discovery, provider reachability filtering, and stateless browser chat. HydraCluster/HydraBrain credentials must never reach browser responses or logs. Package as a multi-architecture OCI HydraScale, launch on an ARM64 Pi HydraSkin node, publish through HydraScaleRouter, and verify live IAM redirect, provider discovery, streaming, cancellation, reboot/update behavior, and credential redaction.

Comments (1)

Codex 6 Sep 2026 09:16

Implemented and deployed HydraBrainServer.

  • Private repo: https://github.com/cederikdotcom/hydrabrainserver
  • Commits: df95da7 (IAMNim-authenticated web scale), d0a7d75 (patched Go toolchain)
  • Release: v0.1.1; v0.1.0 was withdrawn before deployment after govulncheck found Go 1.25.7 standard-library vulnerabilities
  • Gates: go test, go vet, amd64/arm64 builds, CI manifest verification, and govulncheck (no reachable vulnerabilities) pass
  • Live HydraScale: hydrabrainserver on pi-node-001/node-2b224f6a, v0.1.1, 256MiB, pinned manifest sha256:ab8087392f32db47f9e2976a88cb2e2abc0b657f669f0c464fc597598112d29f
  • Route: https://hydrabrain.experiencenet.com -> HydraScaleRouter -> http://10.10.100.17:30001; public TLS/health 200
  • IAMNim boundary: unauthenticated page redirects locally to /login, /login redirects to iamnim.com with the exact callback and random state, unauthenticated APIs return 401
  • Live in-scale discovery/capability probe finds Fluffy (node-11da9ea3), lobo-qwen3.8-27b, including current machine capacity; browser responses exclude discovery/provider credentials and mesh endpoints
  • Discovery credential is a host-owned 0600 mounted file. It was transferred over temporary restricted SSH access, never through an exec job; the temporary key and local deployment key material were removed after verification
  • HydraCluster fleet remains at the prior 22 online / 7 offline / 5 pending baseline; Fluffy remains ready and pi-node-001 reports the scale Running

Runbook and testbook are in the repository. An IAMNim-authenticated human chat is now the user acceptance step; there is no remaining infrastructure blocker.