- Add -pix_fmt yuv420p to multi_res_output.py libx264 path so browsers
can decode CPU-encoded segments (was producing yuv444p / High 4:4:4).
- Switch silent auth check and coop fragment middlewares from opt-out
blocklists to opt-in: only run for GET requests with Accept: text/html.
Prevents unnecessary nav-tree/auth-menu HTTP calls on every HLS segment,
IPFS proxy, and API request.
- Add opaque grant token verification to L1/L2 dependencies.
- Migrate client CLI to device authorization flow.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The StreamInterpreter was created without use_jax=True, so the JAX
compiler was never activated for production rendering. Desktop testing
had this enabled but the celery task path did not.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When CUDA fused kernels aren't available, the fused-pipeline primitive
now uses JAX ops (jax_rotate, jax_scale, jax_shift_hue, etc.) instead
of falling back to one-by-one CuPy/GPUFrame operations. Legacy GPUFrame
path retained as last resort when JAX is also unavailable.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The hardcoded h264_nvenc encoder fails on CPU-only workers. Now uses
check_nvenc_available() to auto-detect and falls back to libx264.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CPU workers can now run GPU-queue rendering tasks via JAX on CPU.
GPU image overrides with jax[cuda12] for full CUDA acceleration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When user has artdag_session cookie, periodically (every 30s) check
account's /auth/internal/check-device endpoint. If account says the
device is no longer active (SSO logout), clear the cookie immediately.
Prevents stale sign-in after logging out from another app.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add /health endpoint (returns 200, skips auth middleware)
- Healthcheck now hits /health instead of / (which 302s to OAuth)
- Advisory lock in db.init_pool() prevents deadlock when 4 uvicorn
workers race to run schema DDL
- CI: --resolve-image always on docker stack deploy to force re-pull
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The server-to-server token exchange was hitting the external URL
(https://account.rose-ash.com/...) which can fail from inside Docker
due to DNS/hairpin NAT. Now uses INTERNAL_URL_ACCOUNT (already set in
both docker-compose files) for the POST. Adds logging at all three
failure points so silent redirects are diagnosable.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The max-w-screen-2xl wrapper now only constrains the header/nav,
matching blog layout. Dark content area goes full-width with its
own inner max-w constraint.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Existing sessions have email=None since the field was just added.
Username IS the email in Art-DAG (OAuth returns user.email as username).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Wrap content block in bg-dark-800 so all existing dark-themed
templates render correctly without per-file migration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Dockerfiles use monorepo root as build context
- common/ and core/ installed as local packages (no git+https)
- Client tarball built from local client/ dir
- Unified CI with change detection: common/core -> rebuild both
- Per-repo CI workflows removed
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
