asgraph

Receiver for code-graph bundle uploads. A builder uploads a bundle for each commit of a repository; an nginx front end checks the uploader's bearer token and relays the upload to receiver.py on another host, which stores it.

Files

File	What
receiver.py	The receiver (Python 3, standard library only)
nginx-*.conf	nginx front end: token check, relay of /upload/ (and /mcp) to the backend host
selftest.sh	Exercises a locally running receiver: good bundle, bad checksum, missing secret, path traversal, bad file name

Receiver

PUT /upload/{repo}/{commit}/{file} where {repo} is one or two path segments, {commit} a hex commit hash, and {file} one of chunks.db.zst, graph.db.zst or manifest.json. Requests must carry the shared secret in X-Asgraph-Internal and come from the front-end host's address (set in receiver.py) or localhost.

Files are stored under bundles/{repo}/{commit}/. Send the data files first and manifest.json last: on arrival the receiver checks the data files' SHA-256 against the manifest, then marks the commit complete. Only the newest three complete commits per repository are kept. Files are limited to 4 GiB, and uploads are refused when less than 20 GiB of disk would remain. GET /healthz returns ok.

Running

mkdir -p secrets && head -c 32 /dev/urandom | base64 > secrets/internal
python3 receiver.py [port]    # default port 8787

The /mcp service the nginx config forwards to is not part of this repository.

License

MIT. See LICENSE.