Backend upload-automation file

app/infrastructure/settings.py

@@ -163,10 +163,42 @@ BATCH_QUEUE_MAX = int(os.getenv("BATCH_QUEUE_MAX", "4"))
 # resource it has.
 BATCH_RETENTION_DAYS = int(os.getenv("BATCH_RETENTION_DAYS", "7"))
 
+# --- Unattended ingestion --------------------------------------------------
+# Whether POST /api/uploads/catalog runs the pipeline on arrival, or parks the
+# files in the admin review inbox for someone to start by hand.
+#
+# READ THIS BEFORE CHANGING IT. That endpoint takes NO credential - it was
+# opened deliberately so colleagues could send spreadsheets without one being
+# issued to them. With autorun on, "anyone who can reach this host" and "anyone
+# who can write to the live catalogue" become the same set of people, and an
+# ingest is an upsert with no undo. That trade was made knowingly: the ask was
+# for uploads to run without manual intervention, and a review queue that needs
+# an admin to press a button is not that.
+#
+# What still bounds it: the per-request ceilings above (20 files / 50MB / 20k
+# rows), and BATCH_QUEUE_MAX behind a single worker thread - so a sender can
+# occupy the ingestion worker but cannot multiply it. Those cap throughput, not
+# who. If that stops being an acceptable trade, set this to false and the review
+# inbox comes back with no code change; everything it needs is still here.
+UPLOAD_AUTORUN = _bool("UPLOAD_AUTORUN", "true")
+
+# How an auto-started run behaves. Not accepted from the request: the sender is
+# anonymous, and letting an anonymous caller turn on the expensive stages is the
+# one thing the open endpoint must not allow.
+#
+# Images ON, because a product landing without one is the failure this endpoint
+# exists to avoid - stage 6 is the slowest stage and reaches the network, but
+# only one batch runs at a time so nothing else is competing with it.
+#
+# LLM OFF, because `use_llm` gates only description generation in
+# stage_2_row_intake, and production runs USE_OLLAMA=false: turning it on there
+# buys nothing and costs a connection timeout per row.
+UPLOAD_AUTORUN_FETCH_IMAGES = _bool("UPLOAD_AUTORUN_FETCH_IMAGES", "true")
+UPLOAD_AUTORUN_USE_LLM = _bool("UPLOAD_AUTORUN_USE_LLM", "false")
+
 # --- Review inbox ----------------------------------------------------------
-# POST /api/uploads/catalog accepts files with NO credential, so that colleagues
-# can send spreadsheets without one being issued to them. Nothing it accepts is
-# queued - files wait in the admin review inbox - which removes BATCH_QUEUE_MAX
+# The bound that applies only when UPLOAD_AUTORUN is false. Files then wait in
+# the admin review inbox rather than being queued, which removes BATCH_QUEUE_MAX
 # as the bound on that endpoint and leaves the volume as the only thing an
 # anonymous sender can exhaust. These are that bound; past either, the endpoint
 # answers 429 and stages nothing.