Feature enhancements: thresholding, train/prediction, 3d volume

.dockerignore

@@ -14,9 +14,11 @@ backend/static
 htmlcov
 .coverage
 
-# Tiled server config, data & catalog (external in production — never bundled)
+# Tiled's own runtime catalog/data (local dev state — never bundled). NOT
+# excluding tiled/ itself: the app-full Docker image's Tiled server needs
+# tiled/config.docker.yml (see Dockerfile's app-full stage) in the build
+# context, and it's tiny source config, not runtime data.
 .tiled
-tiled/
 
 # Local data, backups, runtime files
 data

.env.example

@@ -0,0 +1,49 @@
+# docker-compose config — copy to `.env` at the repo root (docker compose
+# loads this automatically for every `docker compose -f docker-compose*.yml`
+# invocation; git-ignored, never commit real secrets into it).
+#
+# This is distinct from backend/.env.example (used by start_all.sh / running
+# the backend directly, not via Docker) and frontend/.env.example (used by a
+# plain `npm run build`/`npm run dev`, not via Docker) — those are for local
+# development outside a container; this file is for `docker compose` runs.
+#
+# Relevant to: docker-compose.yml (app), docker-compose.ml.yml (app-ml).
+# docker-compose.full.yml and docker-compose.local.yml bundle their own Tiled,
+# so TILED_URI/TILED_BROWSE_PATH don't apply there — only TILED_API_KEY and
+# BROWSE_ALLOWED_ORIGINS do.
+
+# --- Connect to an existing (e.g. staging/production) Tiled server ---
+# Required for docker-compose.yml / docker-compose.ml.yml, which never bundle
+# a Tiled server themselves.
+TILED_URI=https://tiled-staging.als.lbl.gov
+TILED_API_KEY=
+
+# Path into that Tiled server's tree Browse should treat as its root — set
+# this to the real institutional path (confirm with whoever operates that
+# Tiled server; don't assume it matches another deployment's beamline).
+# Leave unset for a from-scratch bundled Tiled (docker-compose.full.yml /
+# docker-compose.local.yml), which uses its own ingest root instead.
+TILED_BROWSE_PATH=beamlines/bl832/processed
+
+# --- Frontend build-time (docker-compose.ml.yml only; baked in at build,
+# not read at container start — see docs/reference/deployment.md) ---
+# Bare path only, never a scheme/host (see that doc's warning on this).
+# Leave unset for root-hosted.
+VITE_BASE_PATH=/bl832/seg_studio/
+
+# --- Same-origin SPA+API → CORS can stay empty; set only for split origins ---
+BROWSE_ALLOWED_ORIGINS=
+
+# --- docker-compose.local.yml only: host port for the nginx proxy in front
+# of the bundled :local-shaped stack (default 5173) ---
+HOST_PORT=5173
+
+# --- docker-compose.full.yml / docker-compose.local.yml only: bind-mount a
+# real host directory to /data/processed, so the bundled Tiled server can read your
+# own datasets directly (register-in-place via the Zarr loader, or the
+# Browse-tab ingest flow) instead of only ever seeing what was uploaded
+# through the app. Defaults to an empty placeholder (.local-source/, git-
+# ignored) so these compose files still work unset. Must be an ABSOLUTE
+# host path (a relative one is resolved against wherever `docker compose`
+# happens to be run from, not this file's location):
+# LOCAL_SOURCE_DIR=/Users/you/Documents/data/tomo

.github/workflows/ci.yml

@@ -5,6 +5,11 @@ on:
     branches: [main]
   pull_request:
 
+# None of these jobs push commits, comment on PRs, or touch packages — read-only
+# is the least-privilege default (CodeQL actions/missing-workflow-permissions).
+permissions:
+  contents: read
+
 jobs:
   backend:
     runs-on: ubuntu-latest
@@ -16,20 +21,58 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
-      - run: pip install -e ".[dev,test]"
+      # `ml` (torch/dlsia/qlty) installed here so dlsia's train/infer code
+      # paths are actually exercised in CI, CPU-only — without it every
+      # dlsia-dependent test silently skips (torch_available() is False).
+      - run: pip install -e ".[dev,test,ml]"
       - run: flake8 . --max-line-length=120 --extend-ignore=E501,W503
       - run: pytest
 
+  ipred:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ipred
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: pip install -e ".[test]"
+      - run: pytest
+
   frontend:
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: frontend
     steps:
+      # The volume renderer lives in a submodule (frontend/vendor/); without it
+      # typecheck and build fail on an unresolved import.
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
       - run: npm ci
       - run: npm run typecheck
       - run: npm run test
+
+  docker-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - uses: docker/setup-buildx-action@v3
+      # Build only — catches a Dockerfile/compose file silently falling
+      # behind the app it packages (the exact drift found in this session's
+      # review: no ipred service, no ml extra, no Tiled service). Three
+      # standalone compose files (not overlays — each is a separate, complete
+      # service, not an override of another), built independently. Does not
+      # push anywhere; image publishing lives in its own workflow
+      # (publish-image.yml), gated on merge to main, not every PR.
+      - run: docker compose -f docker-compose.yml build
+      - run: docker compose -f docker-compose.ml.yml build
+      - run: docker compose -f docker-compose.full.yml build

.github/workflows/publish-image.yml

@@ -0,0 +1,94 @@
+name: Create and publish image
+
+# Mirrors als-computing/view_tomography_recon_app's own publish-image.yml —
+# same tag names (:local / :als-prod / :als-staging), same one-image-many-
+# tags shape. Runs on merge to main only (never on a PR — that stays in
+# ci.yml's build-only docker-build job, so PRs get a real "does it build"
+# check with no registry pushes or wasted publish minutes).
+on:
+  push:
+    branches: ['main']
+    tags: ['v*']
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          # The 3D viewer is a git submodule (frontend/vendor/) — without it
+          # the frontend build stage fails on an unresolved import.
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # :local — fully bundled (Tiled + backend/ml + ipred), for anyone
+      # running this repo locally with nothing external set up. Base path
+      # baked in at /seg_studio/ so it exercises subpath hosting by default,
+      # matching :als-prod/:als-staging below rather than leaving that path
+      # tested only at ALS. See docker-compose.local.yml.
+      - name: Build and push local image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: app-full
+          push: true
+          build-args: |
+            VITE_BASE_PATH=/seg_studio/
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:local
+          labels: ${{ steps.meta.outputs.labels }}
+
+      # :als-prod — ipred/ML bundled, Tiled external (ALS's own production
+      # Tiled — see docker-compose.als-prod.yml for the real TILED_URI
+      # default), hosted under ALS's hub path prefix.
+      - name: Build and push ALS production image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: app-ml
+          push: true
+          build-args: |
+            VITE_BASE_PATH=/bl832/seg_studio/
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:als-prod
+          labels: ${{ steps.meta.outputs.labels }}
+
+      # :als-staging — identical build to :als-prod today (this app reads
+      # TILED_URI at container-run time, not build time, so the prod/staging
+      # distinction lives in docker-compose.als-staging.yml's default rather
+      # than here) — kept as its own explicit step, not just a second tag on
+      # the same build, so staging and prod can diverge later without
+      # restructuring this workflow.
+      - name: Build and push ALS staging image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: app-ml
+          push: true
+          build-args: |
+            VITE_BASE_PATH=/bl832/seg_studio/
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:als-staging
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -13,6 +13,11 @@ build/
 # Secrets — never commit
 .env
 
+# Default bind-mount target for docker-compose.full.yml/docker-compose.local.yml's
+# LOCAL_SOURCE_DIR (see .env.example) — an empty placeholder so the compose
+# files work unset; your own data lives wherever LOCAL_SOURCE_DIR points, not here.
+.local-source/
+
 # Tiled catalog database (binary, regenerated on first run via start_all.sh)
 .tiled/catalog.db
 .tiled/catalog.db-shm
@@ -23,6 +28,10 @@ build/
 # ingested locally are ignored. To commit a new demo dataset, use `git add -f`.
 .tiled/data/
 
+# Generated 3-D volume pyramids (backend/tiff_stack_source.py). Derived data —
+# rebuildable from the source TIFFs by re-registering, and large.
+.tiled/volumes/
+
 # Runtime Tiled thumbnail containers created on save
 **/*__v_thumbs/
 
@@ -52,6 +61,7 @@ Thumbs.db
 htmlcov/
 .coverage
 coverage.xml
+frontend/coverage/
 
 # Vendored SAM model (large, fetched via frontend/scripts/fetch-sam-model.mjs)
 frontend/public/models/
@@ -63,3 +73,9 @@ site/
 peter/
 
 .reset-backups/
+
+.claude/
+
+CLAUDE.md
+
+graphify-out/*

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "frontend/vendor/view_tomography_recon_app"]
+	path = frontend/vendor/view_tomography_recon_app
+	url = https://github.com/als-computing/view_tomography_recon_app.git
+	branch = remote-tiled