feat: krater v1 with proposal review, weave sign-in, skypilot budgets, slack and gallery

[Adambomb210]

First full version of Krater, the Project Ganymede portal. The spec is docs/SPEC.md. Start with docs/HANDOFF.md.

This PR stays a draft until the maintainer approves it. The last step before that is the staging run in docs/dev/staging.md.

What is in it

• Stack: FastAPI and Jinja2, SQLAlchemy 2 and Alembic, Postgres, and procrastinate for background jobs. There is no Redis.
• Sign-in and roles: Weave OIDC with PKCE. Weave owns roles. Krater reads the roles claim (member, reviewer, admin) and checks it again through the Weave directory API before each state change. A stub mode gives fake users for development.
• Workflow: draft, submit, review, then approve or reject. Amendments keep an approved project running during review. A completion review comes before the gallery. The approval policy is configuration. The budget is an append-only ledger. Admin overrides are audited.
• SkyPilot: a launch gate on every command that provisions compute, and a reconcile job. The reconcile job makes one private, Vast-only workspace per project, records spend, warns at 80% and tears down compute at 100%.
• Slack: a private channel per project with Approve and Reject buttons, a feed channel and budget alerts.
• Gallery and pricing: a public gallery of completed projects with screenshot uploads to S3-compatible storage, a /pricing page and a budget estimator.
• Hardening: CSP and security headers, rate limits, JSON logs with secret scrubbing, and production config guards.
• Deployment: Docker Compose with the portal, worker, Postgres and SeaweedFS. The skypilot profile adds the SkyPilot 0.13.0 API server and oauth2-proxy.

flowchart LR
  W[Weave] -- "OIDC: roles, groups, slack_id" --> K[Krater]
  K -- "directory API re-check" --> W
  K -- "workspaces, spend, teardown" --> S[SkyPilot API server]
  S -- "launch gate" --> K
  K -- "review channels" --> SL[Slack]
  K -- "screenshots" --> ST[S3 storage]

Loading

Depends on Weave

All Weave support for roles is merged on Weave main and deployed to Weave staging (tracking issue patchworklabsorg/weave#151):

1. feat: add groups and group memberships with admin ui weave#156: groups and group memberships
2. feat: sync system groups from user attributes weave#157: system groups
3. feat: restrict oauth apps to granted users and groups weave#158: per-app access policy
4. feat: revoke oauth tokens when app access is lost weave#160: token revocation when access is lost
5. feat: add groups scope and claim for oauth clients weave#161: the groups scope and claim
6. feat: add app-defined roles and roles claim for oauth apps weave#165: app-defined roles and the roles claim
7. feat: add directory api for oauth apps weave#166: the directory API

Setup still to do on each Weave instance:

• A superadmin creates the roles member, reviewer and admin on the Krater app page.
• An admin adds directory to the Krater app's scopes.

Krater uses the slack scope that Weave already has. It identifies every user by the PWL id (sub).

Verification

• 622 tests pass against real Postgres. ruff and alembic check are clean. CI is green. pip-audit found no known vulnerabilities.
• A security review found seven issues. All are fixed, and each has a regression test.
• Live tests (marked live, skipped in CI) ran against a real Weave, a real SkyPilot 0.13.0 server and a real SeaweedFS. The live Weave tests now cover app roles and the directory API: 9 of 9 pass against Weave main.
• The Docker Compose stack ran on Docker Desktop, including the skypilot profile.

Not verified yet

All of these are steps in docs/dev/staging.md:

• a real Weave sign-in through the Dockerized portal;
• a full oauth2-proxy and sky api login round trip;
• a real Vast launch and billing drift;
• spot machines and their recovery;
• real Slack.