realtime: IRC EventBus bridge with per-user (hybrid) identity

.env.example

@@ -37,5 +37,17 @@ EMAIL_RECUP_ADMIN_VAULT=
 # Optional. Fly.io operator token used only for owner-managed Vault deployment or recovery commands. If omitted: the related integration is disabled, reducing local secret sprawl.
 FLY_API_TOKEN=
 
+# Optional. LiveKit API key shared by the livekit SFU container and the osionos bridge video-token endpoint (Docker default: devkey). If omitted: the related integration is disabled, reducing local secret sprawl.
+LIVEKIT_API_KEY=
+
+# Optional. LiveKit API secret used to sign HS256 video access tokens, 32+ chars (Docker default is a dev-only value). If omitted: the related integration is disabled, reducing local secret sprawl.
+LIVEKIT_API_SECRET=
+
+# Optional. Browser-facing LiveKit WebSocket URL returned by the bridge token endpoint. If omitted: the related integration is disabled, reducing local secret sprawl.
+LIVEKIT_CLIENT_URL=ws://127.0.0.1:7880
+
+# Optional. In-network LiveKit server URL used by the bridge for admin (twirp) API calls. If omitted: the related integration is disabled, reducing local secret sprawl.
+LIVEKIT_URL=http://livekit:7880
+
 # Optional. Runtime configuration key for this service. If omitted: the related integration is disabled, reducing local secret sprawl.
 SONAR_TOK=

.gitignore

@@ -42,3 +42,6 @@ apps/osionos-desktop/src-tauri/target/
 
 # Vault root-token retrieval runbook — operational, keep out of the repo
 wiki/security/retrieve_fly_seed_admin_right.md
+
+# generated seeder state (uuids/emails from seed_agency_people.sh)
+tools/seeds/.agency-people.env

.gitmodules

@@ -28,3 +28,6 @@
 [submodule "apps/vite-gourmand"]
 	path = apps/vite-gourmand
 	url = git@github.com:LESdylan/vite-gourmand.git
+[submodule "apps/opposite-osiris"]
+	path = apps/opposite-osiris
+	url = git@github.com:Univers42/prismatica.git

Makefile

@@ -43,5 +43,6 @@ include $(MAKE_DIR)/playground.mk
 include $(MAKE_DIR)/mail.mk
 include $(MAKE_DIR)/calendar.mk
 include $(MAKE_DIR)/baas.mk
+include $(MAKE_DIR)/agency.mk
 include $(MAKE_DIR)/baas-release.mk
 include $(MAKE_DIR)/baas-verify.mk

apps/baas/.dockerignore

@@ -0,0 +1,8 @@
+# The kong image (apps/baas/Dockerfile) needs exactly two config files, but
+# its build context is this whole directory — which contains mini-baas-infra
+# (~3GB of sources, SDK, wiki). Allowlist style: exclude everything, then
+# re-include only what the Dockerfile COPYs.
+*
+!Dockerfile
+!config/mini-baas-infra.conf
+!config/kong.track-binocle.yml

apps/baas/.env.example

@@ -81,6 +81,9 @@ GOTRUE_URI_ALLOW_LIST=https://localhost:4322/**,https://localhost:3001/**
 # Recommended. Runtime configuration key for this service. If omitted: Docker defaults are used, which is fine for local dev but less explicit for the team.
 PROJECT_INIT_MARKER=track_binocle_20260504
 
+# Recommended. Cloudflare Turnstile anti-abuse setting. If omitted: Docker defaults are used, which is fine for local dev but less explicit for the team.
+TURNSTILE_SECRET_KEY=replace-with-turnstile-secret-key
+
 # OPTIONAL: Optional. Leave empty to disable the integration and gain a smaller local attack surface.
 # Optional. SMTP setting used when local email delivery is enabled. If omitted: the related integration is disabled, reducing local secret sprawl.
 GOTRUE_SMTP_ADMIN_EMAIL=noreply@mini-baas.local

apps/baas/mini-baas-infra/.gitignore

@@ -380,3 +380,6 @@ certs/*
 
 # Parity gate (G10) run artifacts — verdicts are per-run; route-sets + goldens stay tracked.
 .parity/
+
+# generated tenant/key state from scripts/seed/agency-tenant.sh (live API key)
+.agency-tenant.env

apps/baas/mini-baas-infra/Makefile

@@ -299,6 +299,9 @@ migrate-status: ## Show applied migration versions
 seed-mongo: _require-compose ## Seed MongoDB demo data
 	@bash scripts/seed-mongo.sh
 
+seed-live-demo: _require-compose ## Seed the live-database demo across pg+mysql+mongo (owned by the osionos app key; RESEED=1 wipes first)
+	@bash scripts/seed-live-demo.sh
+
 # ========================================================================== #
 ##@ Secrets & Vault
 # ========================================================================== #
@@ -322,17 +325,46 @@ vault-rotate: _require-compose ## Rotate Vault secrets (GROUP=jwt|postgres|mongo
 # ========================================================================== #
 ##@ Language tiers (TypeScript / Rust / Go)
 # ========================================================================== #
-nestjs-ci: ## TS: install + typecheck + lint + test
-	@cd src && corepack enable && pnpm install && npx tsc --noEmit && npx eslint 'apps/**/*.ts' 'libs/**/*.ts' && npx jest --passWithNoTests
-nestjs-build-%: ## TS: build one app (e.g. make nestjs-build-query-router)
-	@cd src && npx nest build $*
-rust-data-plane-check: ## Rust: cargo check the data-plane workspace
-	@cd docker/services/data-plane-router && cargo check --workspace
-rust-data-plane-build: ## Rust: build the data-plane release binary
-	@cd docker/services/data-plane-router && cargo build --release --bin data-plane-router
-go-control-plane-check: ## Go: vet + test the control-plane module
-	@if command -v go >/dev/null 2>&1; then cd go/control-plane && go vet ./... && go test ./...; \
-	else docker run --rm -v "$(PWD)/go/control-plane":/src -w /src golang:1.23-bookworm sh -c 'go mod tidy && go vet ./... && go test ./...'; fi
+# Node also runs INSIDE Docker (no node/npm on the host); node_modules lives
+# in a named volume so the host tree stays clean and installs stay warm.
+NODE_IMAGE := public.ecr.aws/docker/library/node:20-alpine
+NODE_RUN    = docker run --rm -v "$(PWD)/src":/app -w /app \
+	-v mini-baas-src-node-modules:/app/node_modules \
+	-v mini-baas-npm-cache:/root/.npm \
+	$(NODE_IMAGE)
+
+nestjs-ci: ## TS: install + typecheck + lint + test (in Docker)
+	@$(NODE_RUN) sh -c 'npm ci --ignore-scripts --prefer-offline --no-audit --no-fund \
+		&& npx tsc --noEmit && npx eslint "apps/**/*.ts" "libs/**/*.ts" && npx jest --passWithNoTests'
+nestjs-build-%: ## TS: build one app in Docker (e.g. make nestjs-build-query-router)
+	@$(NODE_RUN) sh -c '[ -x node_modules/.bin/nest ] || npm ci --ignore-scripts --prefer-offline --no-audit --no-fund; npx nest build $*'
+# Cargo runs INSIDE Docker (no rustc/cargo on the host). The registry and the
+# per-workspace target dirs live in named volumes, so dependency downloads and
+# incremental build state persist across runs while the host stays clean.
+RUST_IMAGE          := public.ecr.aws/docker/library/rust:1.89-slim-bookworm
+RUST_TOOLCHAIN_IMG  := mini-baas-rust-toolchain
+CARGO_VOLS           = -v mini-baas-cargo-registry:/usr/local/cargo/registry -v mini-baas-cargo-git:/usr/local/cargo/git
+CARGO_DPR            = docker run --rm -v "$(PWD)/docker/services/data-plane-router":/work -w /work $(CARGO_VOLS) -v mini-baas-dpr-target:/work/target $(RUST_TOOLCHAIN_IMG)
+CARGO_REALTIME       = docker run --rm -v "$(PWD)/docker/services/realtime/realtime-agnostic":/work -w /work $(CARGO_VOLS) -v mini-baas-realtime-target:/work/target $(RUST_TOOLCHAIN_IMG)
+
+_rust-toolchain: ## (internal) cargo-in-docker image: rust + pkg-config/libssl (layer-cached)
+	@printf 'FROM $(RUST_IMAGE)\nRUN apt-get update && apt-get install -y --no-install-recommends pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*\n' \
+		| docker build -q -t $(RUST_TOOLCHAIN_IMG) - >/dev/null
+
+rust-data-plane-check: _rust-toolchain ## Rust: cargo check the data-plane workspace (in Docker)
+	@$(CARGO_DPR) cargo check --workspace
+rust-data-plane-build: _rust-toolchain ## Rust: build the data-plane release binary (in Docker)
+	@$(CARGO_DPR) cargo build --release --bin data-plane-router
+rust-realtime-check: _rust-toolchain ## Rust: cargo check the realtime workspace (in Docker)
+	@$(CARGO_REALTIME) cargo check --workspace
+rust-realtime-test: _rust-toolchain ## Rust: run the realtime unit tests (in Docker)
+	@$(CARGO_REALTIME) cargo test --workspace
+rust-realtime-build: _rust-toolchain ## Rust: build the realtime-server release binary (in Docker)
+	@$(CARGO_REALTIME) cargo build --release --bin realtime-server
+go-control-plane-check: ## Go: vet + test the control-plane module (in Docker, cached modules)
+	@docker run --rm -v "$(PWD)/go/control-plane":/src -w /src \
+		-v mini-baas-gomod:/go/pkg/mod -v mini-baas-gobuild:/root/.cache/go-build \
+		golang:1.23-bookworm sh -c 'GOFLAGS=-mod=mod go vet ./... && GOFLAGS=-mod=mod go test ./...'
 go-control-plane-build: ## Go: build the control-plane images
 	@$(DC) --profile go-control-plane build
 
@@ -367,8 +399,9 @@ help: ## Show this help
 .PHONY: all all-full clean fclean re up down restart ps logs pull build health \
         bench-startup observe planes editions doctor tests test-postgres \
         verify-all parity waf-test migrate migrate-mongo migrate-mysql migrate-all \
-        migrate-status seed-mongo secrets secrets-validate secrets-rotate \
+        migrate-status seed-mongo seed-live-demo secrets secrets-validate secrets-rotate \
         check-secrets env vault-init vault-status vault-rotate nestjs-ci \
         rust-data-plane-check rust-data-plane-build go-control-plane-check \
+        rust-realtime-check rust-realtime-test rust-realtime-build _rust-toolchain \
         go-control-plane-build preflight hooks update help \
         _require-docker _require-compose _rm-stale

apps/baas/mini-baas-infra/docker-compose.yml

@@ -148,6 +148,12 @@ services:
     image: trinodb/trino:467
     container_name: mini-baas-trino
     profiles: [analytics, data-plane, extras]
+    # Trino's jvm.config sizes the heap as 80% of visible RAM
+    # (Initial/MaxRAMPercentage=80): without a limit it reserves against the
+    # whole HOST (~25GB on a 32GB machine, ~900MB RSS idle). The cap makes the
+    # JVM size itself for the local analytics workload instead.
+    mem_limit: 2g
+    cpus: 2.0
     env_file: [.env]
     environment:
       MYSQL_USER: ${MYSQL_USER:-mini_baas}
@@ -742,6 +748,12 @@ services:
       QUERY_ROUTER_ASYNC_EVENT_FLUSH_MS: ${QUERY_ROUTER_ASYNC_EVENT_FLUSH_MS:-1000}
       QUERY_ROUTER_ASYNC_EVENT_BATCH_SIZE: ${QUERY_ROUTER_ASYNC_EVENT_BATCH_SIZE:-25}
       QUERY_ROUTER_ASYNC_EVENT_MAX_ENTRIES: ${QUERY_ROUTER_ASYNC_EVENT_MAX_ENTRIES:-1000}
+      # Realtime fan-out (Phase 6): successful writes publish best-effort
+      # `row_changed` (and DDL publishes `schema_changed`) events on
+      # `table:<dbId>:<table>` via the realtime service's internal ingest.
+      # Same contract + switch semantics as outbox-relay (empty URL disables).
+      REALTIME_PUBLISH_URL: ${REALTIME_PUBLISH_URL:-http://realtime:4000/v1/publish}
+      REALTIME_PUBLISH_TIMEOUT_MS: ${QUERY_ROUTER_REALTIME_PUBLISH_TIMEOUT_MS:-1500}
       JWT_SECRET: ${JWT_SECRET}
       ADAPTER_REGISTRY_SERVICE_TOKEN: ${ADAPTER_REGISTRY_SERVICE_TOKEN:-${JWT_SECRET:-dev-service-token-change-me}}
       LOG_LEVEL: ${LOG_LEVEL:-info}
@@ -791,6 +803,7 @@ services:
       DATA_PLANE_ROUTER_PRODUCT_MODE: ${DATA_PLANE_ROUTER_PRODUCT_MODE:-enabled}
       DATA_PLANE_ADAPTER_REGISTRY_URL: ${DATA_PLANE_ADAPTER_REGISTRY_URL:-http://adapter-registry-go:3021}
       DATA_PLANE_PERMISSION_BUNDLE_URL: http://permission-engine:3050/permissions/bundles/latest
+      DATA_PLANE_PERMISSION_MODE: ${DATA_PLANE_PERMISSION_MODE:-abac}
       DATA_PLANE_MOUNTS: ${DATA_PLANE_MOUNTS:-}
       RUST_LOG: ${RUST_LOG:-info}
     ports:

apps/baas/mini-baas-infra/docker/services/data-plane-router/Dockerfile

@@ -1,3 +1,10 @@
+# syntax=docker/dockerfile:1.7
+# Two complementary caches keep rebuilds fast:
+#  - layer cache: the stub-manifest stage pre-compiles all dependencies, so the
+#    expensive dep build is reused as long as no Cargo.toml/lock changes;
+#  - BuildKit cache mounts: the crates registry and the target dir persist
+#    ACROSS builds, so a manifest change no longer re-downloads the registry,
+#    and a source change only recompiles the crates that actually changed.
 FROM public.ecr.aws/docker/library/rust:1.89-slim-bookworm AS deps
 WORKDIR /build
 
@@ -6,7 +13,10 @@ COPY crates/data-plane-core/Cargo.toml crates/data-plane-core/Cargo.toml
 COPY crates/data-plane-pool/Cargo.toml crates/data-plane-pool/Cargo.toml
 COPY crates/data-plane-server/Cargo.toml crates/data-plane-server/Cargo.toml
 
-RUN for dir in crates/data-plane-core crates/data-plane-pool crates/data-plane-server; do \
+RUN --mount=type=cache,id=cargo-registry,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,id=cargo-git,target=/usr/local/cargo/git,sharing=locked \
+    --mount=type=cache,id=dpr-target,target=/build/target,sharing=locked \
+    for dir in crates/data-plane-core crates/data-plane-pool crates/data-plane-server; do \
       mkdir -p "$dir/src"; \
       echo "pub fn placeholder() {}" > "$dir/src/lib.rs"; \
     done && \
@@ -15,13 +25,17 @@ RUN for dir in crates/data-plane-core crates/data-plane-pool crates/data-plane-s
 
 FROM deps AS builder
 COPY crates/ crates/
-RUN touch crates/data-plane-core/src/*.rs crates/data-plane-pool/src/*.rs crates/data-plane-server/src/*.rs && \
-    cargo build --release --bin data-plane-router
+RUN --mount=type=cache,id=cargo-registry,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,id=cargo-git,target=/usr/local/cargo/git,sharing=locked \
+    --mount=type=cache,id=dpr-target,target=/build/target,sharing=locked \
+    touch crates/data-plane-core/src/*.rs crates/data-plane-pool/src/*.rs crates/data-plane-server/src/*.rs && \
+    cargo build --release --bin data-plane-router && \
+    cp /build/target/release/data-plane-router /data-plane-router
 
 FROM gcr.io/distroless/cc-debian12:nonroot AS runtime
 WORKDIR /app
 
-COPY --from=builder --chown=nonroot:nonroot /build/target/release/data-plane-router /app/data-plane-router
+COPY --from=builder --chown=nonroot:nonroot /data-plane-router /app/data-plane-router
 
 USER nonroot:nonroot
 EXPOSE 4011