Files
John SmithandClaude a6af1c91e0 feat(gateway): Foundry module zip upload with hardening (iteration 40)
Replaces the multipart-transport 501: gm/admin-gated upload, zip-slip/
absolute-path/symlink rejection, double-enforced size+expansion caps
(413), manifest-root discovery delegating to the fail-loud importer.
501 reasons list updated to only still-true limitations. 10 tests
red-first; pytest 806 passed / 27 skipped.

Co-Authored-By: Claude <[email protected]>
2026-08-25 09:32:35 -04:00

43 lines
1.3 KiB
TOML

[build-system]
requires = ["setuptools>=61.0"]
build-backend = "setuptools.build_meta"
[project]
name = "vtt-orchestrator"
version = "0.1.0"
description = "Multi-Agent Narrative Orchestration and Invariant Auditing Engine for AI VTT"
readme = "README.md"
requires-python = ">=3.10"
dependencies = [
"pydantic>=2.6.0",
"fastapi>=0.110.0",
# Required by FastAPI for multipart/form-data parsing (Foundry module
# upload route); plain fastapi does not pull it in.
"python-multipart>=0.0.20",
"uvicorn>=0.28.0",
"httpx>=0.27.0",
"redis>=5.0.0",
"asyncpg>=0.30.0",
"numpy>=1.26.0",
"reportlab>=4.0.0",
"pytest>=8.0.0",
"pytest-asyncio>=0.23.0",
]
[project.optional-dependencies]
# Real semantic embeddings for the Qdrant compendium RAG (see
# vtt_orchestrator/lore/compendium_rag.py). Deliberately NOT a core
# dependency: fastembed pulls ONNX runtime and downloads model weights from
# HuggingFace on first use, which offline CI must never do — without it the
# index degrades to the honest "qdrant-hash-fallback" embedder.
embeddings = [
"fastembed>=0.6",
]
[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
markers = [
"live: requires the configured external LLM endpoint and network (opt-in via LLM_KEY + RUN_LIVE_LLM=1; never runs in CI)",
]