From c2775087e70b3a437f0de6f2a9c056cd2ead2be8 Mon Sep 17 00:00:00 2001 From: Louis Choquel Date: Wed, 30 Sep 2026 18:36:02 +0200 Subject: [PATCH 1/3] =?UTF-8?q?fix/Callback-description=20=C2=B7=20L-26092?= =?UTF-8?q?8-ad0699=20(#102)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `callback_urls` description said a completion webhook carried the run's results, and it does not: the body holds the run id, its state, the storage key prefix of the stored results and any error. The schema description, the pipe-run guide and the committed OpenAPI document now say what the body carries, that `result_url` is a storage key rather than a fetchable URL, and that the `X-Completion-Signature` header signs the run id rather than the body. Closes L-260928-ad0699 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- ## Summary by cubic Clarifies that `callback_urls` completion webhooks carry a completion notice, not the run's output — the body holds `pipeline_run_id`, `state` (with its legacy `status` alias), the `result_url` storage key prefix, and `error` on failure — and that the `X-Completion-Signature` header signs the run id, not the body. Updates the schema description, the pipe-run guide, and the committed OpenAPI document, and adds a changelog entry. Closes L-260928-ad0699. Written for commit 642bd9d6c3b5699f2d48a1897eab419b5f07d65f. Summary will update on new commits. Review in cubic --------- Co-authored-by: Claude Opus 5.5 --- CHANGELOG.md | 6 ++++++ api/schemas/models.py | 7 +++++-- docs/openapi/pipelex-api.openapi.yaml | 7 +++++-- docs/pipe-run.md | 2 +- 4 files changed, 17 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2f4bbcb..e915bc8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## [Unreleased] + +### Fixed + +- **The `callback_urls` description says what a completion webhook carries**: the OpenAPI description and the run docs said the runner posts the run's result to each callback URL; they now say the body is a completion notice (`pipeline_run_id`, `state` with its legacy `status` alias, the `result_url` storage key prefix and `error`), and that the results themselves stay in storage under that prefix. The description also says that the `X-Completion-Signature` header signs the run id, not the body. + ## [v0.33.1] - 2026-09-30 ### Fixed diff --git a/api/schemas/models.py b/api/schemas/models.py index 0f8d12c..5e275ed 100644 --- a/api/schemas/models.py +++ b/api/schemas/models.py @@ -431,8 +431,11 @@ class PipelexApiStartRequest(StartRequest): default=None, description=( "PIPELEX-API EXTENSION (not part of the MTHDS Protocol) — completion webhooks. " - "When the run finishes, the runner POSTs the RunResult to each URL, HMAC-SHA256-signed " - "via the X-Completion-Signature header. http/https only; private, loopback, link-local " + "When the run finishes, the runner POSTs a completion notice to each URL, with an " + "X-Completion-Signature header holding the HMAC-SHA256 of the run id (not of the body). " + "The body carries `pipeline_run_id`, `state` (with the legacy `status` alias), `result_url` " + "(the storage key prefix of the stored results, when results were stored) and `error` on " + "failure; it does not carry the run's output. http/https only; private, loopback, link-local " "and cloud-metadata hosts are rejected." ), ) diff --git a/docs/openapi/pipelex-api.openapi.yaml b/docs/openapi/pipelex-api.openapi.yaml index 7a1b1d7..3125ddf 100644 --- a/docs/openapi/pipelex-api.openapi.yaml +++ b/docs/openapi/pipelex-api.openapi.yaml @@ -746,8 +746,11 @@ paths: - type: 'null' title: Callback Urls description: PIPELEX-API EXTENSION (not part of the MTHDS Protocol) — completion webhooks. When the run - finishes, the runner POSTs the RunResult to each URL, HMAC-SHA256-signed via the X-Completion-Signature - header. http/https only; private, loopback, link-local and cloud-metadata hosts are rejected. + finishes, the runner POSTs a completion notice to each URL, with an X-Completion-Signature header holding + the HMAC-SHA256 of the run id (not of the body). The body carries `pipeline_run_id`, `state` (with the + legacy `status` alias), `result_url` (the storage key prefix of the stored results, when results were + stored) and `error` on failure; it does not carry the run's output. http/https only; private, loopback, + link-local and cloud-metadata hosts are rejected. orchestration_mode: anyOf: - type: string diff --git a/docs/pipe-run.md b/docs/pipe-run.md index 137390b..c887536 100644 --- a/docs/pipe-run.md +++ b/docs/pipe-run.md @@ -177,7 +177,7 @@ Start a pipeline execution and get its `pipeline_run_id` back with a `202` ack. When the pipeline completes, each URL in the list receives a POST carrying: -- The completion payload in the body: `pipeline_run_id` (the protocol field), the delivery `status` (`"COMPLETED"` or `"FAILED"`), `result_url` (when results were stored), `error` (the raw `ErrorReport` dict on failure), plus the runtime's legacy `pipeline_run_id` key +- A completion notice in the body, not the run's output: `pipeline_run_id`, the delivery `state` (`"COMPLETED"` or `"FAILED"`, also sent under the legacy `status` key), `result_url` (when results were stored: the storage key prefix under which the result files sit, not a fetchable URL) and `error` (the raw `ErrorReport` dict on failure). The receiver reads the results from storage under that prefix. - An **`X-Completion-Signature`** header — `HMAC-SHA256(secret, pipeline_run_id)` rendered as a hex digest **Verifying the signature on the receiver side** From feabfa4546d0e6c7bf760ff898eafb7180a01aac Mon Sep 17 00:00:00 2001 From: Louis Choquel Date: Thu, 1 Oct 2026 00:03:41 +0200 Subject: [PATCH 2/3] =?UTF-8?q?feature/Fold-freeze-point=20=C2=B7=20L-2609?= =?UTF-8?q?30-086ad8=20(#114)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The server is moving into `Pipelex/pipelex` as its `api/` member, released in lockstep with the library. This puts a notice at the top of the README and a `Changed` entry in the changelog, so the release that sets the freeze point carries both to `main` and to the release notes. Advances L-260930-086ad8 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01UdzDdXuwBjpWUuLbnniziE --- ## Summary by cubic Adds a notice announcing that the server is moving into `Pipelex/pipelex` as its `api/` directory, to be released from the next version on in lockstep with the library and under the library's version number. The notice is placed at the top of the README, the docs site's Overview page, and as a `Changed` changelog entry, so the release that sets the freeze point carries it to `main` and to the release notes. From the next release, the `pipelex/pipelex-api` image tag will be a pipelex version rather than the next `0.33.x`; the image keeps its name, port, and `/root/.pipelex` mount. This repository takes no new changes and will be archived once the move lands. Advances L-260930-086ad8 Written for commit 29a15f1e10430caa3114ab009cd3d2a68848b248. Summary will update on new commits. Review in cubic --------- Co-authored-by: Claude Opus 5.5 --- CHANGELOG.md | 4 ++++ README.md | 3 +++ docs/index.md | 3 +++ 3 files changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e915bc8..3879f44 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ ## [Unreleased] +### Changed + +- **The server is moving into `Pipelex/pipelex`**: from the next release, the server ships from the pipelex repository's `api/` directory together with the pipelex library and under its version number, so the next `pipelex/pipelex-api` image tag is a pipelex version; the image name, its port and its `/root/.pipelex` mount do not change, and this repository will be archived once the move lands. + ### Fixed - **The `callback_urls` description says what a completion webhook carries**: the OpenAPI description and the run docs said the runner posts the run's result to each callback URL; they now say the body is a completion notice (`pipeline_run_id`, `state` with its legacy `status` alias, the `result_url` storage key prefix and `error`), and that the results themselves stay in storage under that prefix. The description also says that the `X-Completion-Signature` header signs the run id, not the body. diff --git a/README.md b/README.md index 28f541b..fa60ce9 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,9 @@ The official REST API server for building and executing Pipelex pipelines. Deplo --- +> [!IMPORTANT] +> **This server is moving into [`Pipelex/pipelex`](https://github.com/Pipelex/pipelex).** It will live there as the repository's `api/` directory and be released together with the pipelex library, under the library's version number, so the next tag of the `pipelex/pipelex-api` image will be a pipelex version rather than the next `0.33.x`. The image keeps its name, its port and its `/root/.pipelex` configuration mount. This repository takes no new changes and will be archived once the move lands; please open new issues on `Pipelex/pipelex`. + # 📑 Table of Contents - [Introduction](#introduction) diff --git a/docs/index.md b/docs/index.md index f9c0f29..44c3229 100644 --- a/docs/index.md +++ b/docs/index.md @@ -1,5 +1,8 @@ # Pipelex API Documentation +!!! important "This server is moving into [`Pipelex/pipelex`](https://github.com/Pipelex/pipelex)" + It will live there as the repository's `api/` directory and be released together with the pipelex library, under the library's version number, so the next tag of the `pipelex/pipelex-api` image will be a pipelex version rather than the next `0.33.x`. The image keeps its name, its port and its `/root/.pipelex` configuration mount. This repository takes no new changes and will be archived once the move lands; please open new issues on `Pipelex/pipelex`. + Welcome to the Pipelex API documentation. The API provides programmatic access to the Pipelex system. ## The three-layer contract From d1a4614b5f39f4c82cc21642638e5178a3e1c549 Mon Sep 17 00:00:00 2001 From: Louis Choquel Date: Thu, 1 Oct 2026 00:06:02 +0200 Subject: [PATCH 3/3] Release v0.33.2 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UdzDdXuwBjpWUuLbnniziE --- CHANGELOG.md | 2 +- docs/openapi/pipelex-api.openapi.yaml | 2 +- pyproject.toml | 2 +- uv.lock | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3879f44..5232cef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## [Unreleased] +## [v0.33.2] - 2026-10-01 ### Changed diff --git a/docs/openapi/pipelex-api.openapi.yaml b/docs/openapi/pipelex-api.openapi.yaml index 3125ddf..abd8cf6 100644 --- a/docs/openapi/pipelex-api.openapi.yaml +++ b/docs/openapi/pipelex-api.openapi.yaml @@ -11,7 +11,7 @@ info: license: name: Elastic License 2.0 identifier: Elastic-2.0 - version: 0.33.1 + version: 0.33.2 paths: /health: get: diff --git a/pyproject.toml b/pyproject.toml index 7e73ab7..0e899bb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "pipelex-api" -version = "0.33.1" +version = "0.33.2" description = "Pipelex API" authors = [{ name = "Evotis S.A.S.", email = "oss@pipelex.com" }] maintainers = [{ name = "Pipelex staff", email = "oss@pipelex.com" }] diff --git a/uv.lock b/uv.lock index 6acd6aa..1a6af76 100644 --- a/uv.lock +++ b/uv.lock @@ -2367,7 +2367,7 @@ mistralai = [ [[package]] name = "pipelex-api" -version = "0.33.1" +version = "0.33.2" source = { editable = "." } dependencies = [ { name = "fastapi" },