# Prova Brain — Hugging Face Space (Docker, CPU basic)

The brain is a FastAPI app in a Docker Space on the free CPU hardware. No GPU, no Gradio: the
Dockerfile installs `requirements.txt` and starts `uvicorn brain.app:app` on port 7860.

## Deploy

Use the existing Docker Space. Its `README.md` must keep `sdk: docker` and `app_port: 7860`;
the `README.md` in this folder already does.

```bash
git clone https://huggingface.co/spaces/chintakapp/prova-core hf-space
# The Space still holds the old app? Empty it first (keeps .git): git -C hf-space rm -r -q .
robocopy backend hf-space /E /XD .venv __pycache__ .pytest_cache .ruff_cache .idea .test-tmp tests reports training .git .hf-space /XF .env
cd hf-space
git add -A
git commit -m "Deploy Prova brain"
git push
```

`/XF .env` keeps your local secrets file out of the Space repository: never copy it. Check with
`git status` before you commit that no `.env` is listed. `robocopy` exit codes 0-7 all mean
success. The Dockerfile copies only `requirements.txt` and `brain/`, and `.dockerignore` keeps the
tests and `.env` out of the image.

## Secrets and variables

Space → Settings → Variables and secrets. The full list, with what each one is for, is in
`.env.example`. Never put a value in a file or commit it.

The environment holds only keys, two model names and the login and database secrets. Which model
answers, the user's name and the AI's name are set from the app through the API
(`docs/SETTINGS_API.md`); the timezone is a constant in code.

Secrets:
- `GEMINI_KEY_1`, and `GEMINI_KEY_2` to `_5` as spares. **One key is required**; a spare takes over
  when the one before it runs out of quota.
- `GROQ_KEY_1`, and `GROQ_KEY_2` to `_5` as spares. Optional: without any, the app shows GPT-OSS as
  unavailable and Gemini answers. (This is the old `PROVA_LOCAL_API_KEY` value.)
- `SUPABASE_URL`, `SUPABASE_SECRET_KEY`, **`AUTH_SECRET`**, `ALLOWED_EMAIL`. Make `AUTH_SECRET` on
  your own machine, never in chat: `python -c "import secrets; print(secrets.token_urlsafe(48))"`.

Variables: **`GOOGLE_CLIENT_IDS`** (the Prova Web client id, public). Optional: `GEMINI_MODEL` and
`GROQ_MODEL`; leave them out and the defaults in `brain/config.py` apply
(`gemini-3.5-flash-lite`, `openai/gpt-oss-120b`). For Postman testing only, also
`AUTH_ALLOW_NO_NONCE=1`; delete it afterwards.

**Delete if they are there:** `PROVA_PROVIDER`, `PROVA_LOCAL_API_KEY`, `PROVA_LOCAL_MODEL`,
`PROVA_LOCAL_BASE_URL`, `PROVA_CHAT_MODEL`, `PROVA_USER_NAME`, `PROVA_AI_NAME`, `PROVA_TIMEZONE`,
`GROQ_API_KEY`, `ALLOWED_ORIGINS`. The brain no longer reads them.

Login is the brain's own (Google in, brain-signed tokens out, `docs/AUTH_API.md`), so the Space no
longer needs `SUPABASE_JWKS_URL`, `SUPABASE_JWT_SECRET` or Supabase Auth. Delete those secrets if
they are there. Web push is off, so no `VAPID_*` either.

Supabase SQL Editor, in this order: `0001_init.sql`, `0002_functions.sql`, `0004_login_sessions.sql`.
Skip `0003_cron.sql`. `0004` creates the `login_sessions` table (refresh tokens, hashed) and drops
the links to Supabase Auth.

Never set `PROVA_DEV` on the Space: the brain refuses to start with it next to `SUPABASE_URL`.
Restart the Space after changing a secret.

## Check it

- `https://chintakapp-prova-core.hf.space/` shows the Prova Brain page with "Backend running".
- `https://chintakapp-prova-core.hf.space/health` returns `"ok": true`, `"store": "SupabaseStore"`,
  `"dev": false` and `"auth": true`. `"auth": false` means `AUTH_SECRET`, `GOOGLE_CLIENT_IDS` or
  `ALLOWED_EMAIL` is missing, and no one can sign in yet.
- Every other route needs the brain's access token: sign in at `POST /auth/google` (see
  `docs/AUTH_API.md`, which also has the Thunder Client recipe).

## Run it locally

```bash
cd backend
PROVA_DEV=1 SUPABASE_URL= .venv/Scripts/python -m uvicorn brain.app:app --port 7860
```

No keys needed: fake replies, memory kept in RAM. `SUPABASE_URL=` is blanked because dev mode
refuses to start beside a real Supabase URL, and `.env` would otherwise supply one. Run it in
Git Bash: PowerShell removes a variable set to an empty string.

For the real thing (Gemini and Supabase from `.env`), drop `PROVA_DEV=1 SUPABASE_URL=`.