- Pin numpy to 1.26.4 (2.x breaks pandas/bottleneck/numexpr)
- Add pyotp>=2.9.0 (2FA endpoints returned 503)
- Fix scanner/token/wallet routers missing /api/v1/ prefix
These three bugs caused 90%% of API routes to return 404/503 in prod.
Copied pinned freeze from running rmi-backend container (c49a129b1602)
so Docker builds include bcrypt, structlog, prometheus_client, aiofiles,
faiss-cpu, and all transitive deps the runtime needs. Added the
--extra-index-url for pytorch cpu wheels required by torch==2.12.1+cpu.
P1.1 — Implement real ai_router.chat_completion / stream_chat_completion
using Ollama Cloud primary + OpenRouter fallback. Fixes AttributeError on
/api/v1/chat and /api/v1/wallet-clusters.
P1.2 — Fix broken RAG call paths: telegram bot now hits /api/v1/rag/v2/search
then ai_router.chat_completion; unified_wallet_scanner._rag_enrich uses
async httpx + correct path. Mount app.domains.databus.router.
P1.3 — Implement setup_otel / shutdown_otel in core/tracing.py and create
core/langfuse.py with init_langfuse / flush_langfuse as safe no-ops when
SDK is missing or env vars unset.
P1.4 — Fix Prometheus alert rule metric name drift:
rmi_requests_total -> rmi_http_requests_total (matches metrics.py).
P1.5 — Move dead admin_backend.py (1691 LOC) to app/domains/admin/router.py
and mount it. Admin login endpoint now reachable.
P2.1 — Rename app/domains/auth/__init__.py (507 LOC router file that broke
mypy) -> app/domains/auth/router.py. Mount app.domains.auth.router so
/register, /login, /wallet/*, /user/me, /2fa/*, OAuth, Telegram are live.
P2.1b — Add pyotp + qrcode to requirements.txt so 2FA endpoints don't 503.
The reported symptom (AttributeError: module 'bcrypt' has no attribute
'__about__') was misleading. passlib 1.7.4 (the latest released version
— the project is unmaintained) actually traps that AttributeError with
a bare `except:` and continues. The real failure occurs later in
`passlib.handlers.bcrypt._finalize_backend_mixin`:
detect_wrap_bug -> verify(secret, bug_hash)
where secret = (b"0123456789"*26)[:255] # 255-byte test secret
bcrypt 4.0+ removed silent 72-byte truncation and now raises
`ValueError: password cannot be longer than 72 bytes`, breaking the
backend probe and crashing every `pwd_context.hash()/verify()` call.
Three options were considered:
A. Upgrade passlib — impossible, 1.7.4 is the latest PyPI release.
B. Pin bcrypt<4.0 — conflicts with chromadb 1.1.1 (>=4.0.1 required),
even though chromadb's bcrypt usage is optional and still works
at runtime in practice.
C. Shim bcrypt.__about__ — doesn't fix the actual truncation error.
Chosen: refactor app/auth.py to use bcrypt directly for backup-code
hashing too (the main `hash_password`/`verify_password` already did).
Drops the passlib dependency entirely, restoring bcrypt 5.x for chromadb
compatibility and eliminating the unmaintained passlib pin.
Verified:
* hash_password / verify_password round-trip OK
* _hash_backup_code / _verify_backup_code round-trip OK on
freshly generated 8-digit backup codes
* `pytest tests/unit` -> 717 passed, 32 warnings, 60 subtests passed
