Repository navigation
Docs/production positioning - #16
Merged
Merged
Conversation
- Updated the last modified date to 2026-10-26 across multiple documentation files. - Enhanced the security model description in `security-and-validators.md` to include the new admin-only `checkpointer:import` scope. - Clarified the API server's handling of thread state and message history in `serving-agents.md`, including new endpoints for managing messages. - Added details about the `checkpointer:import` scope in `authorization-scopes.md` and its implications for message handling. - Expanded the section on prompt injection validation in `protect-against-prompt-injection.md` to include limitations and recommendations for tool outputs. - Introduced new guidelines for client-side state management in `use-custom-state.md`, emphasizing security and validation. - Deprecated the `addThreadMessages` method in the TypeScript client reference, requiring admin scope for message imports. - Updated REST API documentation to reflect new permissions and input validation rules, particularly for message handling and state management. - Enhanced WebSocket documentation to clarify requirements for resuming after remote tool calls.
- Updated the last modified date to 2026-10-26 across multiple files. - Added a new section on deleting files in the files-and-multimodal documentation. - Expanded the media and files documentation to include new methods and security measures. - Enhanced the authorization scopes documentation to include the new `files:delete` scope. - Updated prebuilt tools documentation to clarify file access and security measures. - Added details on file lifecycle management and deletion in the server documentation. - Improved error handling descriptions for file operations in the API reference. - Clarified the handling of external media URLs and their security checks.
- Changed the updated date in multiple documentation files to 2026-10-27. - Added new error codes: `INTERRUPT_001` for `InterruptMismatchError` and `INTERRUPT_002` for `ResumeValidationError`. - Documented the behavior and context for `InterruptMismatchError` and `ResumeValidationError` in the exceptions reference. - Enhanced AG-UI and REST API documentation to clarify the handling of concurrent runs and request limits. - Updated the production checklist to include details on thread locking and error handling in production mode. - Improved WebSocket documentation to reflect changes in handling resumes and thread management.
- Revised CORS and security headers documentation to clarify the implications of using wildcard origins and credentials in production. - Added details about strict production checks that prevent server startup with wildcard origins and hosts. - Updated deployment documentation to emphasize the need for explicit origins and allowed hosts in production environments. - Clarified thread management in the invoke and stream documentation, emphasizing the importance of using the returned thread_id for continuity. - Enhanced troubleshooting guides to address common issues related to CORS, thread continuity, and production mode configurations. - General updates to timestamps across multiple documentation files to reflect the latest changes.
- Changed the update date for the threads and memory tutorial. - Revised explanations in the "What is agent memory" glossary entry to clarify memory retrieval processes. - Updated the prebuilt tools guide to reflect the removal of the legacy memory_tool and emphasize the use of MemoryConfig for memory management. - Enhanced the memory tools documentation to clarify the functionality of user_memory_tool and agent_memory_tool, and removed references to the deprecated memory_tool. - Adjusted the use-memory-store guide to clarify memory retrieval modes and their implications. - Updated the memory stores reference to reflect changes in memory retrieval functions and the removal of MemoryIntegration. - Revised the prebuilt tools reference to remove the legacy memory_tool and clarify the current memory tool factories.
…ent memory configurations
… enhancements - Updated the `updated` date in multiple documents to 2026-10-27. - Replaced custom math evaluation function with `safe_calculator` in state graph examples to enhance security. - Added `user_id_mode` configuration option to control how user IDs are handled in traces, with options for raw, hash, and mask. - Enhanced Kubernetes and Docker deployment documentation with security best practices and updated image naming conventions. - Clarified observability settings and their implications in production, including recommendations for using TLS. - Improved readiness and liveness probe configurations in Kubernetes manifests. - Added details about the handling of sensitive information in traces and event publishers.
…API error handling
- Introduced a comprehensive security model documentation outlining the protections and trust boundaries of the 10xGraph server. - Added a "Test before production" guide detailing unit tests, evals, environment audits, production mode checks, and smoke tests for server validation. - Released version 0.8.0 with significant security and scalability improvements, including stricter ownership checks and production defaults. - Released version 0.9.0, consolidating server commands and adding guided initialization for WebSocket streaming and AI provider selection. - Released core updates (0.10.1, 0.10.2, 0.10.3) focusing on state cache fixes, optional Pillow dependency, and support for Python 3.14 and 3.15.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The docs now lead with one message: you build the agent, and
10xgraph-apiserves it production ready, secure and scalable. Every claim is shown with the mechanism behind it and checked against the code. The PR also documents the security hardening from the recent review and fixes stale content across the site.12 commits, 211 files. The homepage (
src/pages/index.astro) is not changed.What's new
Production section (
/docs/production/*, second in the sidebar)auth: nullin production starts an open server.First-time reader path
/docsand Get started open with the promise and a 5-page path: quickstart, production readiness, security model, production checklist, build guide.get-started/security-in-five-minutes: turn on JWT, get a 401 without a token, and get a 403 when one user reads another user's thread.Proof
/build: three new guides,multi-tenant-support-agent,refund-with-human-approvalandship-to-kubernetes.serve-with-auth,payment-tool-replay-safe,human-approval-over-api,multi-user-isolation,safe-file-and-web-tools,security-regression-evals. The old "Production" group is renamed "Testing and operations".draft: true, to schedule later: approval step, SSRF-safe tools, bounded runs, safe logs.Repositioned pages
client/secure-your-frontendandtesting/before-production.Security hardening documented