GRIP onboarding V3: identify gateway users, route model calls through the LLM proxy, explain SMB access

.chainlit/config.toml

@@ -128,7 +128,8 @@ cot = "full"
 
 # Specify a CSS file that can be used to customize the user interface.
 # The CSS file can be served from the public directory or via an external link.
-# custom_css = "/public/test.css"
+# biomni.css lets the settings dialog's help text keep its paragraph breaks.
+custom_css = "/public/biomni.css"
 
 # Specify additional attributes for a custom CSS file
 # custom_css_attributes = "media=\"print\""
@@ -157,6 +158,9 @@ alert_style = "classic"
 # custom_meta_image_url = "https://chainlit-cloud.s3.eu-west-3.amazonaws.com/logo/chainlit_banner.png"
 
 # Load assistant logo directly from URL.
+# Only a signed-in browser is sent this setting. The sign-in page shows
+# public/logo_dark.png or logo_light.png instead - copies of the same image,
+# there so that page does not fall back to the Chainlit logo.
 logo_file_url = "/public/avatars/ad1_256.png"
 
 # Load assistant avatar image directly from URL.

.env.example

@@ -28,8 +28,18 @@ AWS_BEARER_TOKEN_BEDROCK=your_bedrock_api_key_here
 AWS_REGION=us-east-1
 
 # Optional: Custom model serving configuration
-# CUSTOM_MODEL_BASE_URL=http://localhost:8000/v1
-# CUSTOM_MODEL_API_KEY=your_custom_api_key_here
+# BIOMNI_CUSTOM_BASE_URL=http://localhost:8000/v1
+# BIOMNI_CUSTOM_API_KEY=your_custom_api_key_here
+
+# Optional: the platform LLM proxy (AD Workbench / GRIP; see docs/grip_deployment.md).
+# When set, every model call goes through it and the provider keys above are
+# unused. Each request carries the proxy's token as a bearer token and the
+# session's user and workspace ids as X-User-Id / X-Workspace-Id - ids that come
+# from the authentication gateway, so this needs BIOMNI_TRUST_AUTH_HEADERS below.
+# BIOMNI_LLM_PROXY_URL=https://<proxy-host>/v1
+# BIOMNI_LLM_PROXY_API_KEY=
+# BIOMNI_LLM_PROXY_SCHEMA=openai   # or anthropic, for /v1/messages
+# BIOMNI_LLM=<name of the model the proxy serves>
 
 # Optional: Biomni data path (defaults to ~/.biomni/data)
 # BIOMNI_DATA_PATH=/path/to/your/data
@@ -52,7 +62,9 @@ AWS_REGION=us-east-1
 # Optional: put a sign-in in front of a deployment that has no authentication
 # gateway (a demo box on a public IP). One shared password, any username - and
 # the username becomes the identity, so each person gets their own conversation
-# history. Leave unset wherever a gateway already authenticates.
+# history. Separate, not private: anyone with the password can sign in under a
+# username someone else used. Leave unset wherever a gateway already
+# authenticates.
 # BIOMNI_DEMO_PASSWORD=
 
 # Optional: address the container publishes on. Set to 127.0.0.1 when a TLS
@@ -97,7 +109,10 @@ AWS_REGION=us-east-1
 # BIOMNI_AUTH_WORKSPACE_CONTEXT_HEADER=ai-app-workspace-context
 #
 # Single-value headers, for other gateways (oauth2-proxy, Envoy/ext_authz, ...).
-# Used for any field the context headers above did not supply.
+# Read only for a request that carries neither context header above, so a
+# client cannot fill in a field the gateway left out. GRIP needs none of these:
+# pointing one at an Ai-App-* header has no effect (those are parsed field by
+# field), and the app logs a warning at startup saying so.
 # BIOMNI_AUTH_USER_ID_HEADER=x-auth-request-user-id
 # BIOMNI_AUTH_EMAIL_HEADER=x-auth-request-email
 # BIOMNI_AUTH_WORKSPACE_HEADER=x-workspace-id

.github/workflows/ci.yml

@@ -90,4 +90,13 @@ jobs:
             biomni/config.py \
             biomni/credentials.py \
             biomni/env_probe.py \
-            biomni/llm.py
+            biomni/health.py \
+            biomni/identity.py \
+            biomni/llm.py \
+            biomni/llm_proxy.py \
+            biomni/observability.py \
+            biomni/status.py \
+            biomni/tool/availability.py \
+            biomni/workspace_prefs.py \
+            chainlit_ui/graph_stream.py \
+            chainlit_ui/llm_failures.py

.github/workflows/docker.yml

@@ -188,12 +188,13 @@ jobs:
       # Tag strategy:
       #   - branch name        (refs/heads/main → :main; / in feat branches
       #                         sanitised to - per Docker tag rules)
-      #   - git SHA short      (always - primary content-addressed tag,
-      #                         what production should pin to)
+      #   - git SHA short      (always, as :sha-<7 hex> - primary
+      #                         content-addressed tag, what production should
+      #                         pin to)
       #   - :latest            (only when pushing the default branch -
       #                         conventional "newest published" alias)
       #   - semver aliases     (v1.2.3 git tag → :1.2.3 and :1.2)
-      # Branch and :latest tags are convenience aliases; the :<sha> tag
+      # Branch and :latest tags are convenience aliases; the :sha-<short> tag
       # is the canonical immutable pointer.
       - name: Extract image metadata
         id: meta

.pre-commit-config.yaml

@@ -29,6 +29,8 @@ repos:
           - id: check-added-large-files
           - id: check-toml
           - id: check-yaml
+            # Kubernetes manifests hold several documents separated by ---.
+            args: [--allow-multiple-documents]
           - id: check-merge-conflict
           - id: no-commit-to-branch
             args: ["--branch=main"]