feat(oie): RQ A→B→C fan-out and Admin OIE queue tab

.dockerignore

@@ -5,6 +5,11 @@ tmp
 .vscode
 .github
 .git
+.harvester_cache/
+logs/
+.cursor/
+.cursorignore
+*.nohup.out
 
 # This file specifies files that are *not* uploaded to Google Cloud
 # using gcloud. It follows the same syntax as .gitignore, with the addition of

Dockerfile

@@ -10,7 +10,10 @@ FROM python:3.11 as run
 COPY --from=build /code /code
 WORKDIR /code
 COPY ./scripts/prod-docker-entrypoint.sh /code
-RUN pip install -r requirements.txt gunicorn
+# Staging Compose may pass requirements-dev.txt (Librarian ML / OIE Module C.2).
+# Default stays prod requirements.txt for Heroku slug size.
+ARG REQUIREMENTS_FILE=requirements.txt
+RUN pip install -r "${REQUIREMENTS_FILE}" gunicorn
 
 ENV INSECURE_REQUESTS=1
 ENV FLASK_CONFIG="production"

Makefile

@@ -70,8 +70,24 @@ docker-postgres:
 
 start-containers: docker-neo4j docker-redis
 
+# RQ work-horses fork after Flask/torch load. On macOS, unset device → MPS and
+# CrashReporter popups from Homebrew Python.app. Force CPU unless overridden.
+CRE_LIBRARIAN_DEVICE?=cpu
 start-worker:
-	. ./venv/bin/activate && FLASK_APP=`pwd`/cre.py python cre.py --start_worker
+	. ./venv/bin/activate && \
+	OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES \
+	CRE_LIBRARIAN_DEVICE="$(CRE_LIBRARIAN_DEVICE)" \
+	FLASK_APP=`pwd`/cre.py python cre.py --start_worker
+
+# Local OIE RQ fleet (queue ``oie``). Default 10; override with OIE_WORKER_COUNT=N.
+# Double-fork via scripts/start_oie_workers.py so workers survive make exit (SIGHUP).
+OIE_WORKER_COUNT?=10
+start-oie-workers:
+	. ./venv/bin/activate && \
+	OIE_WORKER_COUNT="$(OIE_WORKER_COUNT)" \
+	CRE_LIBRARIAN_DEVICE="$(CRE_LIBRARIAN_DEVICE)" \
+	OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES \
+	python scripts/start_oie_workers.py
 
 upstream-sync:
 	. ./venv/bin/activate &&\

application/__init__.py

@@ -49,6 +49,22 @@ def create_app(mode: str = "production", conf: any = None) -> Any:
         letters = string.ascii_lowercase
         app.secret_key = "".join(random.choice(letters) for i in range(20))
 
+    # JWT API-token signing secret: env, or mint+persist once on install/boot.
+    # Tests get a stable in-process default so create_app does not touch /code.
+    try:
+        from application.utils.api_tokens.secret import ensure_api_token_jwt_secret
+
+        if (
+            mode == "test"
+            and not (os.environ.get("API_TOKEN_JWT_SECRET") or "").strip()
+        ):
+            os.environ["API_TOKEN_JWT_SECRET"] = (
+                "test-only-api-token-jwt-secret-32bytes"
+            )
+        ensure_api_token_jwt_secret()
+    except Exception:
+        logger.exception("API_TOKEN_JWT_SECRET bootstrap failed")
+
     # config[mode].init_app(app)
     sqla.init_app(app=app)
     from application.web.web_main import app as app_blueprint
@@ -59,8 +75,19 @@ def create_app(mode: str = "production", conf: any = None) -> Any:
 
     init_openapi(app)
 
-    CORS(app)
-    app.config["CORS_HEADERS"] = "Content-Type"
+    # Credentialed browser calls are same-origin in prod/staging; keep CORS
+    # narrow so cross-site pages cannot drive cookie auth. Admin mutations also
+    # require CSRF (see web_main.admin_imports_enabled_required).
+    cors_origins = [
+        o.strip()
+        for o in (os.environ.get("CORS_ALLOWED_ORIGINS") or "").split(",")
+        if o.strip()
+    ]
+    if cors_origins:
+        CORS(app, origins=cors_origins, supports_credentials=True)
+    else:
+        CORS(app, supports_credentials=True)
+    app.config["CORS_HEADERS"] = "Content-Type, X-CSRF-Token"
 
     compress.init_app(app)
     cache.init_app(app)