Merge pull request #26 from OmniBioAI/release/v0.7.0-production-stabilization

release(studio): prepare v0.7.0-beta production release

Author: man4ish

.env.web

@@ -3,5 +3,5 @@
 # ignored by the Electron scripts (dev, build:ui, build:linux, etc.),
 # which never pass --mode.
 VITE_WEB_MODE=true
-VITE_VERSION=0.5.0-beta
+VITE_VERSION=0.7.0
 VITE_APP_NAME=OmniBioAI Studio Web

CHANGELOG.md

@@ -9,7 +9,38 @@ Format: [Keep a Changelog](https://keepachangelog.com)
 - 🌐 Public web domain moved from app.omnibioai.org to webstudio.omnibioai.org (old domain kept working during the transition period)
 
 ---
-## v0.7.0-beta (2026-07-18)
+## v0.7.0 (2026-08-07)
+
+### New Features
+- 🔐 Unified license key system (OMNI-XXXX-XXXX-XXXX-XXXX)
+  → One key works for web + desktop
+  → Auto-creates user on first validation
+  → Same JWT as OAuth login
+- 🌐 webstudio.omnibioai.org fully working
+  → License key login enforced
+  → All workbench pages loading correctly
+  → Service worker fixed
+  → nginx routes fixed (/license/, /roles/)
+  → Control Center JWT cookie fallback
+- 👥 Team expansion
+  → Dr. Rajnish Kumar (Scientific Consultant, SR University)
+  → Praveen C.V. Raghavulu (Scientific Advisor, KUMC)
+  → About page restructured as company team page
+- 🛠 12,110 bioinformatics tools (up from 11,577)
+  → 100+ new HTTP API tools added
+  → All tools validated (100% clean)
+  → 0 duplicates, 0 ToolSpec errors
+- 🤖 Tool selection AI improved
+  → GPU enabled for Ollama (57x faster: 120s → 2.1s)
+  → Accuracy: 0% → 60%
+  → Recall@K: 60% → 85%
+- 📦 1,000 ARM64 SIF images
+- 🔧 Control Center web service added
+- 💰 Billing service integrated
+- 🔧 Admin Console at admin.omnibioai.org
+
+---
+## v0.6.0-beta (2026-07-18)
 
 ### New Features
 - 🌐 Web version at app.omnibioai.org
@@ -131,34 +162,3 @@ Format: [Keep a Changelog](https://keepachangelog.com)
 - LLM configuration: Ollama + Claude API + OpenAI
 - Cloud execution: AWS/Azure/GCP Batch + Kubernetes
 - HPC execution: Slurm / PBS / LSF via TES
-
-
-## v0.7.0 (2026-08-07)
-
-### New Features
-- 🔐 Unified license key system (OMNI-XXXX-XXXX-XXXX-XXXX)
-  → One key works for web + desktop
-  → Auto-creates user on first validation
-  → Same JWT as OAuth login
-- 🌐 webstudio.omnibioai.org fully working
-  → License key login enforced
-  → All workbench pages loading correctly
-  → Service worker fixed
-  → nginx routes fixed (/license/, /roles/)
-  → Control Center JWT cookie fallback
-- 👥 Team expansion
-  → Dr. Rajnish Kumar (Scientific Consultant, SR University)
-  → Praveen C.V. Raghavulu (Scientific Advisor, KUMC)
-  → About page restructured as company team page
-- 🛠 12,110 bioinformatics tools (up from 11,577)
-  → 100+ new HTTP API tools added
-  → All tools validated (100% clean)
-  → 0 duplicates, 0 ToolSpec errors
-- 🤖 Tool selection AI improved
-  → GPU enabled for Ollama (57x faster: 120s → 2.1s)
-  → Accuracy: 0% → 60%
-  → Recall@K: 60% → 85%
-- 📦 1,000 ARM64 SIF images
-- 🔧 Control Center web service added
-- 💰 Billing service integrated
-- 🔧 Admin Console at admin.omnibioai.org

DEPLOYMENT.md

@@ -77,6 +77,17 @@ AUTH_SECRET_KEY=<generate: python3 -c "import secrets; print(secrets.token_urlsa
 
 # ── Container registry ────────────────────────────────────────────────────────
 GITHUB_TOKEN=<PAT with read:packages scope — for ghcr.io pull>
+GHCR_PULL_TOKEN=<PAT with read:packages scope — BuildKit secret for image builds that need @man4ish/ui, and for license-server/tes/model-registry/lims/rag image pulls>
+
+# ── License (unified OMNI-XXXX flow) ───────────────────────────────────────────
+LICENSE_SECRET=<random-token — used by the legacy standalone license-server, :8099>
+
+# ── Neo4j (RAG knowledge graph) ─────────────────────────────────────────────────
+NEO4J_PASSWORD=<strong-password>  # defaults to "omnibioai" if unset — override in production
+
+# ── Telemetry ────────────────────────────────────────────────────────────────
+# SENTRY_RELEASE is set automatically per-service to the app version (currently "0.7.0")
+# in docker-compose.yml / docker-compose.release.yml; no action needed unless overriding.
 
 # ── Paths ─────────────────────────────────────────────────────────────────────
 HOST_IP=0.0.0.0                # or specific NIC IP
@@ -244,6 +255,33 @@ Expected dashboard titles: `OmniBioAI Platform Overview`, `OmniBioAI LIMS`, `Omn
 
 ---
 
+## Production Domains
+
+The steps above describe the local/on-prem docker-compose runbook (everything on
+`localhost:<port>`). In the hosted production deployment, the same stack sits behind
+`docker/nginx-router.conf` and is reachable at three public domains:
+
+| Domain | Serves | Notes |
+|---|---|---|
+| `webstudio.omnibioai.org` | Web build of Studio (`web-ui` service, built via `Dockerfile.web` / `npm run web:build`) | License-key login (`OMNI-XXXX-XXXX-XXXX-XXXX`) enforced; same backend as desktop |
+| `workbench.omnibioai.org` | Same nginx-router stack, workbench-focused entry point | Routes `/api`, `/_tes`, `/_svc/rag`, `/_svc/modelregistry`, `/_svc/workflows` etc. through to their respective upstreams — see `docker/nginx-router.conf` |
+| `admin.omnibioai.org` | Control Center Admin Console (`/_svc/control`, JWT-gated except a small public health/summary allowlist) | Port 7070 upstream; bound to localhost on the container host, only reachable externally through the nginx router |
+
+Health verification against the public domains (adjust for your DNS/TLS setup):
+
+```bash
+curl -sf https://webstudio.omnibioai.org/           && echo "webstudio reachable"
+curl -sf https://workbench.omnibioai.org/api/health && echo "workbench API reachable"
+curl -sf https://admin.omnibioai.org/_svc/control/health && echo "admin console reachable"
+```
+
+**Known gap:** the Billing/Subscriptions/Entitlements/Usage/Invoices UI (`control-center-web`,
+the `cc-ui` frontend) is not currently served by any production compose file or routed by
+`nginx-router.conf` — see Known Issues in `README.md`. The `billing-service` backend itself
+is deployed and reachable only indirectly through Control Center's own backend proxy.
+
+---
+
 ## Rollback Procedure
 
 ### Using Git Tags
@@ -271,6 +309,36 @@ docker compose up -d
 docker compose up -d --no-deps <service-name>
 ```
 
+### Locally-built services (e.g. web-ui): tag-based rollback
+
+`web-ui` (and other services using `build:` rather than `image:` in `docker-compose.yml`)
+have no registry digest to pin — they're built and tagged locally
+(`<compose-project>-<service>:latest`, e.g. `omnibioai-studio-web-ui:latest`), so digest
+pinning doesn't apply. Before rebuilding one of these, tag the currently-running image
+so it survives the rebuild (which overwrites `:latest` in place):
+
+```bash
+# Before rebuilding — capture a named rollback point
+docker tag omnibioai-studio-web-ui:latest omnibioai-studio-web-ui:rollback
+
+# Rebuild + redeploy (only this service; --no-deps avoids restarting anything else)
+docker compose -f docker-compose.yml build web-ui
+docker compose -f docker-compose.yml up -d --no-deps --force-recreate web-ui
+
+# If it needs to be rolled back:
+docker tag omnibioai-studio-web-ui:rollback omnibioai-studio-web-ui:latest
+docker compose -f docker-compose.yml up -d --no-deps --force-recreate web-ui
+```
+
+**Note**: recreating a service changes its container IP on the Docker bridge network.
+`nginx-router`'s `upstream` blocks cache that IP at nginx's own startup (see the
+"nginx-router returning 502" entry under Troubleshooting) — Docker *may* hand the
+recreated container back its previous IP if nothing else claimed it in the meantime, in
+which case no further action is needed (verify with `docker inspect <container>
+--format '{{json .NetworkSettings.Networks}}'` before assuming so), but this is not
+guaranteed. If the IP changes, `nginx-router` needs `--no-deps --force-recreate` too, or
+that route will 502 again.
+
 ---
 
 ## Backup and Restore
@@ -420,6 +488,39 @@ docker compose restart control-center
 docker compose exec control-center curl -sf http://workbench:8000/health/
 ```
 
+### nginx-router returning 502 for a service that's actually healthy
+
+`nginx-router.conf`'s `upstream { server <name>:<port>; }` blocks resolve each backend
+hostname to a Docker bridge-network IP **once**, at nginx startup/reload — not per
+request. If a backend container is later recreated (redeploy, rebuild, crash-restart),
+it gets a new IP from Docker, but `nginx-router` keeps sending traffic to the old one
+until it is itself reloaded or recreated. The symptom is `502 Bad Gateway` with
+`connect() failed (111: Connection refused)` in `nginx-router`'s logs, naming an IP that
+`docker inspect <backend-container> --format '{{.NetworkSettings.Networks}}'` shows no
+longer belongs to that service (sometimes it now belongs to a *different* container
+entirely — the stale IP got reassigned). This can affect one route or many at once,
+depending on how many backends were recreated since `nginx-router`'s last (re)start.
+
+```bash
+# Confirm: does the IP in the error log match the backend's current IP?
+docker logs --tail 50 omnibioai-studio-nginx-router-1 | grep "Connection refused"
+docker inspect omnibioai-studio-<service>-1 \
+  --format '{{.NetworkSettings.Networks.omnibioai-studio_default.IPAddress}}'
+
+# Fix: force nginx-router to re-resolve every upstream hostname and pick up the
+# current on-disk config (a plain `nginx -s reload` is not reliable here — see the
+# bind-mount inode GOTCHA documented at the top of docker/nginx-router.conf, which
+# can leave a running container serving a config file from days earlier even after
+# a reload). Recreating only nginx-router does not restart or otherwise affect any
+# other service:
+docker compose -f docker-compose.yml up -d --no-deps --force-recreate nginx-router
+```
+
+Root-caused and fixed this way for the `webstudio.omnibioai.org` 502 incident,
+2026-08-08 (PR G) — `nginx-router` had not been restarted since 2026-08-07, while
+`web-ui` and several other services had been recreated since then and picked up new
+IPs nginx-router never learned about.
+
 ### Celery workers not picking up tasks
 
 ```bash

README.md

@@ -18,7 +18,7 @@
 - 💰 **Billing service** integrated
 - 🛡️ **Admin Console** live at admin.omnibioai.org
 
-### v0.7.0-beta ✅
+### v0.6.0-beta ✅
 - 🌐 Web version at webstudio.omnibioai.org — no installation required
 - 🔐 SSO & OAuth2 — Google, GitHub, and Microsoft sign-in
 - 🛡️ Cloudflare Access — secure invite-only email whitelist
@@ -632,7 +632,7 @@ Reports are sent to our dashboard. Response within 24 hours during beta. Disable
 | v0.3.0-beta     | ✅ Released    | IDE Services, Grafana observability, auto-secrets, npm security                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | v0.4.0-beta     | ✅ Released    | Version unification, 23 services, 7 execution servers, Claude Sonnet 4                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | v0.5.0-beta     | ✅ Released    | 225+ plugins, 36M-abstract RAG index, 1,120+ container images, full beta launch                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| v0.7.0-beta     | ✅ Released    | Web version (`webstudio.omnibioai.org`), SSO/OAuth2 (Google/GitHub/Microsoft), Cloudflare Access, 800 ARM64 SIF images, 12,000+ tools, Hugging Face integration, Model Registry HF push button                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| v0.6.0-beta     | ✅ Released    | Web version (`webstudio.omnibioai.org`), SSO/OAuth2 (Google/GitHub/Microsoft), Cloudflare Access, 800 ARM64 SIF images, 12,000+ tools, Hugging Face integration, Model Registry HF push button                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | **v0.7.0**      | ✅ **Current** | Unified License Key (one `OMNI-XXXX` key for web + desktop, auto-creates user, same JWT as OAuth login), `webstudio.omnibioai.org` fully working end-to-end, 12,110 tools (100+ new HTTP API tools), Tool Selection AI 57x faster with GPU-enabled Ollama (accuracy 0%→60%, Recall@K 60%→85%), 1,000 ARM64 SIF images, Control Center web service, Billing service integrated, **Admin Console** at `admin.omnibioai.org`, team expansion (Dr. Rajnish Kumar, Praveen C.V. Raghavulu) |
 | **v0.8.0**      | 🔜 Planned    | **Enterprise Platform** — expand the ML portfolio to **20 trained ML models on Hugging Face**, HIPAA compliance reporting, SAML/enterprise SSO, multi-user workspaces, team management, usage analytics, mobile-responsive UI, and **Omni Assistant v2** (tool-aware responses, agentic workflow suggestions, multi-step reasoning, context-aware analysis)                                                                                                                                                                                                                                                                     |
 | **v0.9.0**      | 🔜 Planned    | **Enterprise Admin Console expansion** — advanced organization administration, enterprise governance, deeper billing and subscription management, advanced usage analytics, administrative workflows, platform operations, security administration, and enterprise-scale management capabilities                                                                                                                                                                                                                                                                                                                                |
@@ -650,6 +650,8 @@ Reports are sent to our dashboard. Response within 24 hours during beta. Disable
 - cAdvisor requires privileged mode and `/dev/kmsg` device access
 - Prometheus not exposed directly — access only via `/_svc/prometheus`
 - Control Center (`/_svc/control`) requires valid JWT; port 7070 bound to localhost only
+- Billing service backend (`billing-service`, :8005) is deployed and DB-backed, but has no served production frontend — `control-center-web` (the billing/subscriptions/entitlements UI) is not wired into any docker-compose file or nginx route in this deployment yet
+- Two license-validation backends currently coexist: the legacy standalone `license_server.py` (`license-server`, :8099, its own MySQL DB) and the unified `/license/validate` endpoint on `omnibioai-auth` (:8001), which is what web and desktop actually call for the OMNI-XXXX login flow. The legacy server is still built and deployed but appears superseded — pending a decision on formal decommission
 
 ---
 

docker-compose-release.yml

@@ -628,6 +628,10 @@ services:
       - prometheus
     restart: unless-stopped
 
+  web-ui:
+    image: ghcr.io/omnibioai/omnibioai-web:latest
+    restart: unless-stopped
+
   # ---------------------------------------------------------------------------
   # Router
   # ---------------------------------------------------------------------------
@@ -640,6 +644,7 @@ services:
       - ./docker/nginx-router.conf:/etc/nginx/conf.d/default.conf:ro
     depends_on:
       - workbench
+      - web-ui
       - lims
       - rag
       - api-gateway

docker-compose.release.yml

@@ -1,6 +1,6 @@
 # OmniBioAI Studio - Release configuration
 # Uses pre-built images from ghcr.io
-# Version: v0.4.0-beta
+# Version: v0.7.0
 #
 # Setup:
 #   cp .env.example .env
@@ -128,6 +128,13 @@ services:
     environment:
       PYTHONUNBUFFERED: "1"
       REDIS_URL: redis://redis:6379
+      # SSO Phase 2 PR2 (JWT consumer audit): same shared secret
+      # auth-service signs with and api-gateway/control-center already
+      # verify with (all AUTH_SECRET_KEY) -- previously unset here, so
+      # api/deps.py::require_platform_admin and
+      # audit/identity.py::validate_identity_token both fell back to the
+      # public literal "change-me" instead of the real secret.
+      JWT_SECRET: ${AUTH_SECRET_KEY:-change-me-in-production}
     depends_on:
       redis:
         condition: service_healthy
@@ -210,7 +217,7 @@ services:
       SINGULARITY_TMPDIR: /tmp/singularity_tmp
       SENTRY_DSN: ${SENTRY_DSN:-}
       SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT:-beta}
-      SENTRY_RELEASE: "0.4.0-beta"
+      SENTRY_RELEASE: "0.7.0"
     volumes:
       - ${WORKSPACE_HOST}:/workspace
       - /var/run/docker.sock:/var/run/docker.sock
@@ -278,7 +285,7 @@ services:
       LIMS_API_TOKEN: ""
       SENTRY_DSN: ${SENTRY_DSN:-}
       SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT:-beta}
-      SENTRY_RELEASE: "0.4.0-beta"
+      SENTRY_RELEASE: "0.7.0"
     volumes:
       - ${WORKSPACE_HOST}:/workspace
       - ${WORK_DIR}/runs:/app/work/runs
@@ -419,7 +426,14 @@ services:
       TOOL_IMAGES_BASE: /workspace/tool-images
       SENTRY_DSN: ${SENTRY_DSN:-}
       SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT:-beta}
-      SENTRY_RELEASE: "0.4.0-beta"
+      SENTRY_RELEASE: "0.7.0"
+      # SSO Phase 2 PR1: same shared secret auth-service signs with and
+      # api-gateway already verifies with (both above, AUTH_SECRET_KEY) --
+      # this was previously unset here, so core/auth.py::require_admin's
+      # os.environ.get("JWT_SECRET", "change-me") fallback silently
+      # verified tokens against the public literal "change-me" instead of
+      # the real secret.
+      JWT_SECRET: ${AUTH_SECRET_KEY:-change-me-in-production}
     volumes:
       - ${DATA_DIR}:/workspace
       - /var/run/docker.sock:/var/run/docker.sock