Skip to content

Commit af69464

Browse files
author
SIN-Agent
committed
merge: feat/operational-hardening squashed into main
1 parent be5172a commit af69464

31 files changed

Lines changed: 1042 additions & 760 deletions

.github/workflows/ci.yml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: ci
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["main"]
8+
9+
concurrency:
10+
group: ci-${{ github.ref }}
11+
cancel-in-progress: true
12+
13+
jobs:
14+
lint:
15+
name: lint & format (ruff)
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@v4
19+
- uses: actions/setup-python@v5
20+
with:
21+
python-version: "3.12"
22+
- name: Install dev dependencies
23+
run: pip install -e ".[dev]"
24+
- name: ruff check
25+
run: ruff check .
26+
- name: ruff format --check
27+
run: ruff format --check .
28+
29+
test:
30+
name: test (py${{ matrix.python-version }})
31+
runs-on: ubuntu-latest
32+
strategy:
33+
fail-fast: false
34+
matrix:
35+
python-version: ["3.11", "3.12", "3.13"]
36+
steps:
37+
- uses: actions/checkout@v4
38+
- uses: actions/setup-python@v5
39+
with:
40+
python-version: ${{ matrix.python-version }}
41+
- name: Install package (with dev extras)
42+
run: pip install -e ".[dev]"
43+
- name: Run test suite
44+
run: pytest -q
45+
- name: Install optional extras and re-run
46+
run: |
47+
pip install -e ".[dev,lsp,bench,mcp]" || echo "optional extras unavailable; skipping extra run"
48+
pytest -q
49+
50+
consistency:
51+
name: cross-repo consistency (non-blocking)
52+
runs-on: ubuntu-latest
53+
continue-on-error: true
54+
steps:
55+
- uses: actions/checkout@v4
56+
- uses: actions/setup-python@v5
57+
with:
58+
python-version: "3.12"
59+
- name: Install package
60+
run: pip install -e ".[dev]"
61+
- name: Check consistency
62+
run: python scripts/check_consistency.py

.github/workflows/release.yml

Lines changed: 41 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,57 @@ on:
55
tags: ["v*"]
66

77
permissions:
8-
contents: read
9-
id-token: write # required for PyPI Trusted Publishing (no API token needed)
8+
contents: write # required to create the GitHub Release + upload assets
9+
id-token: write # required for PyPI Trusted Publishing (no API token needed)
1010

1111
jobs:
12-
build-and-publish:
12+
build:
13+
name: build sdist + wheel
1314
runs-on: ubuntu-latest
14-
environment: pypi
1515
steps:
1616
- uses: actions/checkout@v4
1717
- uses: actions/setup-python@v5
1818
with:
1919
python-version: "3.12"
2020
- name: Build distribution
2121
run: |
22-
python -m pip install --upgrade build hatchling
22+
python -m pip install --upgrade build
2323
python -m build
24+
- name: Verify wheel installs in a clean env
25+
run: |
26+
python -m venv /tmp/clean
27+
/tmp/clean/bin/pip install dist/*.whl
28+
/tmp/clean/bin/sin --help >/dev/null
29+
- name: Upload build artifacts
30+
uses: actions/upload-artifact@v4
31+
with:
32+
name: dist
33+
path: dist/*
34+
35+
github-release:
36+
name: attach artifacts to GitHub Release
37+
needs: build
38+
runs-on: ubuntu-latest
39+
steps:
40+
- uses: actions/download-artifact@v4
41+
with:
42+
name: dist
43+
path: dist
44+
- name: Create GitHub Release
45+
uses: softprops/action-gh-release@v2
46+
with:
47+
files: dist/*
48+
generate_release_notes: true
49+
50+
pypi-publish:
51+
name: publish to PyPI (Trusted Publishing)
52+
needs: build
53+
runs-on: ubuntu-latest
54+
environment: pypi
55+
steps:
56+
- uses: actions/download-artifact@v4
57+
with:
58+
name: dist
59+
path: dist
2460
- name: Publish to PyPI
2561
uses: pypa/gh-action-pypi-publish@release/v1

CHANGELOG.md

Lines changed: 34 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77
## [Unreleased]
88

99
### Added
10-
- **Performance monitoring** across all 16 SIN-Code repos:
11-
- 600x speedup for Discover 500-1000 file projects (parallel analysis + content cache)
12-
- 1200x speedup for SCKG 10000+ node queries (pre-built adjacency indexes)
13-
- Extension filter optimization via string suffix matching
14-
- **Test stabilization** for all 7 Go tools + 8 Python subsystems:
15-
- Fixed zsh compatibility in Execute tests
16-
- Fixed secret redaction patterns (secret_key, private_key, bearer)
17-
- Fixed macOS /private symlink handling in project root detection
18-
- Fixed JSON parsing tests for nested objects
19-
- Fixed process group timeout tests
20-
- All 472+ tests passing across all repos
21-
22-
### Changed
23-
- Version bump to 0.3.6 to align with Go tool releases
10+
- **Operational hardening** (closes #8): production-readiness CI/release tooling.
11+
- `.github/workflows/ci.yml`: `ruff check` + `ruff format --check` lint gate
12+
and a `pytest` matrix across Python 3.11/3.12/3.13, plus a non-blocking
13+
cross-repo consistency job.
14+
- `.github/workflows/release.yml`: builds sdist+wheel on `v*` tags, verifies a
15+
clean-env install, attaches artifacts to a GitHub Release, and publishes to
16+
PyPI via Trusted Publishing.
17+
- `scripts/check_consistency.py` (WS4): asserts version alignment, subsystem
18+
import health, and that every `sin mcp-config` client points at the real
19+
`sin serve` entry point. `--strict` mode for full multi-repo CI.
20+
- `scripts/dev_install.sh` + `scripts/run_all_tests.sh` (WS5): two-command
21+
editable bootstrap and aggregated test runner across all 8 sibling repos.
22+
- Adopted a shared `ruff` config (E/F/I/W) and applied a one-shot mechanical
23+
format; aligned `__version__` with the packaged `0.2.0`.
24+
- **GitNexus bridge** (`sin_code_bundle.gitnexus`): integrates the upstream
25+
[GitNexus](https://github.com/abhigyanpatwari/GitNexus) code knowledge graph
26+
as a mandatory, always-on context source for coder agents. GitNexus is
27+
invoked via `npx` (not vendored), keeping the bundle MIT-licensed while
28+
GitNexus stays PolyForm-Noncommercial upstream.
29+
- `sin gitnexus setup` wires the GitNexus MCP server into OpenCode, Codex,
30+
and Hermes configs (idempotent, preserves existing config).
31+
- `sin preflight` auto-builds/refreshes the graph so agents never code blind.
32+
- `sin gitnexus index|status|doctor|context|impact|ai-context` commands.
33+
- `gitnexus_context`, `gitnexus_impact`, `gitnexus_ai_context` exposed via
34+
`sin serve`; GitNexus availability shown in `sin status`.
35+
- Docs at `docs/GITNEXUS.md`; requires Node.js >= 18.
36+
- **CoDocs** integration, merged from the former
37+
`SIN-Hermes-Bundles/SIN-Code-CoDocs-Bundle` repo:
38+
- `sin_code_bundle.codocs` — a robust, stdlib-only validator that replaces the
39+
original fragile `grep | sed` one-liner.
40+
- `sin codocs check`, `sin codocs list`, and `sin codocs install-skill` CLI
41+
commands, plus a `codocs_check` MCP tool exposed via `sin serve`.
42+
- Packaged agent skill (`data/codocs/SKILL.md`), `docs/CODOCS.md`, and a
43+
worked example under `examples/codocs/`.
2444

2545
## [0.1.0] - 2026-05-30
2646

docs/plans/operational-hardening.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Plan: Operational Hardening
22

3-
Status: proposed
3+
Status: implemented (Bundle)
44
Owner: unassigned
55
Scope: all 7 SIN-Code repositories (SCKG, IBD, POC, EFSM, ADW, Verification-Oracle, Bundle)
66

pyproject.toml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,3 +81,9 @@ testpaths = ["tests"]
8181
[tool.ruff]
8282
line-length = 100
8383
target-version = "py311"
84+
# CoDocs example fixtures demonstrate doc co-location, not runnable code.
85+
extend-exclude = ["examples", "build", "dist"]
86+
87+
[tool.ruff.lint]
88+
select = ["E", "F", "I", "W"]
89+
ignore = ["E501"]

scripts/check_consistency.py

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
#!/usr/bin/env python3
2+
"""Cross-repo consistency check for the SIN-Code Bundle (WS4 of operational-hardening).
3+
4+
The Bundle orchestrates 8 sibling subsystems that are installed via local
5+
``pip install -e`` of adjacent repos. This script asserts that the Bundle's
6+
own expectations stay internally consistent and reports drift against any
7+
subsystems that happen to be installed.
8+
9+
Design goals:
10+
- Exit 0 on a clean *bundle-only* checkout (subsystems absent -> warnings, not
11+
failures), so it is safe to wire into CI as a non-blocking job first.
12+
- Promote ``--strict`` to make any missing subsystem or mismatch fail (exit 1),
13+
for use once the full multi-repo environment is provisioned.
14+
15+
Checks performed:
16+
1. Bundle metadata: ``pyproject`` version == ``__init__.__version__``.
17+
2. Subsystem import specs: each subsystem the ``status`` command probes either
18+
imports cleanly or is reported as not-installed.
19+
3. MCP advertising: every client config emitted by ``sin mcp-config`` points at
20+
the same ``sin serve`` entry point that the package actually registers.
21+
"""
22+
23+
from __future__ import annotations
24+
25+
import argparse
26+
import importlib.metadata as md
27+
import importlib.util
28+
import sys
29+
import tomllib
30+
from pathlib import Path
31+
32+
REPO_ROOT = Path(__file__).resolve().parent.parent
33+
34+
# Canonical subsystem map -- kept in sync with cli.status().
35+
SUBSYSTEMS = {
36+
"sin_code_sckg": "SCKG (knowledge graph)",
37+
"sin_code_ibd": "IBD (intent diff)",
38+
"sin_code_poc": "POC (proof of correctness)",
39+
"sin_code_efsm": "EFSM (mock orchestration)",
40+
"sin_code_adw": "ADW (debt watchdog)",
41+
"sin_code_oracle": "Oracle (verification)",
42+
"sin_code_orchestration": "Orchestration (multi-agent workflow)",
43+
"sin_code_review_interface": "Review-Interface (semantic review UI)",
44+
}
45+
46+
GREEN, YELLOW, RED, RESET = "\033[32m", "\033[33m", "\033[31m", "\033[0m"
47+
48+
49+
def _ok(msg: str) -> None:
50+
print(f"{GREEN}OK{RESET} {msg}")
51+
52+
53+
def _warn(msg: str) -> None:
54+
print(f"{YELLOW}WARN{RESET} {msg}")
55+
56+
57+
def _fail(msg: str) -> None:
58+
print(f"{RED}FAIL{RESET} {msg}")
59+
60+
61+
def check_version() -> list[str]:
62+
errors: list[str] = []
63+
pyproject = tomllib.loads((REPO_ROOT / "pyproject.toml").read_text())
64+
declared = pyproject["project"]["version"]
65+
init_text = (REPO_ROOT / "src" / "sin_code_bundle" / "__init__.py").read_text()
66+
runtime = next(
67+
(
68+
line.split("=", 1)[1].strip().strip('"').strip("'")
69+
for line in init_text.splitlines()
70+
if line.startswith("__version__")
71+
),
72+
None,
73+
)
74+
if runtime == declared:
75+
_ok(f"version aligned: pyproject == __init__ == {declared}")
76+
else:
77+
_fail(f"version drift: pyproject={declared!r} but __init__={runtime!r}")
78+
errors.append("version drift")
79+
return errors
80+
81+
82+
def check_subsystems(strict: bool) -> list[str]:
83+
errors: list[str] = []
84+
for module, desc in SUBSYSTEMS.items():
85+
installed = importlib.util.find_spec(module) is not None
86+
if installed:
87+
try:
88+
version = md.version(module.replace("_", "-"))
89+
except md.PackageNotFoundError:
90+
version = "unknown"
91+
_ok(f"{desc}: importable (v{version})")
92+
elif strict:
93+
_fail(f"{desc}: module '{module}' not installed (strict)")
94+
errors.append(f"{module} missing")
95+
else:
96+
_warn(f"{desc}: module '{module}' not installed (expected in bundle-only checkout)")
97+
return errors
98+
99+
100+
def check_mcp_advertising() -> list[str]:
101+
errors: list[str] = []
102+
from sin_code_bundle import mcp_config
103+
104+
expected_cmd, expected_args = mcp_config.COMMAND, mcp_config.ARGS
105+
if (expected_cmd, expected_args) != ("sin", ["serve"]):
106+
_fail(f"mcp entry point unexpected: {expected_cmd} {expected_args}")
107+
errors.append("mcp entry point")
108+
return errors
109+
110+
# The package must actually expose the `sin` console script the configs point at.
111+
scripts = {ep.name: ep.value for ep in md.entry_points(group="console_scripts")}
112+
if scripts.get("sin", "").startswith("sin_code_bundle.cli"):
113+
_ok("'sin' console script resolves to sin_code_bundle.cli")
114+
else:
115+
_fail(f"'sin' console script missing or wrong: {scripts.get('sin')!r}")
116+
errors.append("console script")
117+
118+
for client in mcp_config.SUPPORTED_CLIENTS:
119+
rendered = mcp_config.generate(client)
120+
if expected_cmd in rendered and "serve" in rendered:
121+
_ok(f"mcp-config[{client}] advertises '{expected_cmd} serve'")
122+
else:
123+
_fail(f"mcp-config[{client}] does not advertise the serve entry point")
124+
errors.append(f"mcp-config {client}")
125+
return errors
126+
127+
128+
def main() -> int:
129+
parser = argparse.ArgumentParser(description=__doc__)
130+
parser.add_argument(
131+
"--strict",
132+
action="store_true",
133+
help="Treat missing subsystems as failures (full multi-repo env).",
134+
)
135+
args = parser.parse_args()
136+
137+
print("== SIN-Code Bundle consistency check ==")
138+
errors: list[str] = []
139+
errors += check_version()
140+
errors += check_subsystems(args.strict)
141+
errors += check_mcp_advertising()
142+
143+
print()
144+
if errors:
145+
_fail(f"{len(errors)} consistency problem(s): {', '.join(errors)}")
146+
return 1
147+
_ok("all consistency checks passed")
148+
return 0
149+
150+
151+
if __name__ == "__main__":
152+
sys.exit(main())

scripts/dev_install.sh

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/usr/bin/env bash
2+
# WS5: one-command editable dev setup for the full SIN-Code stack.
3+
#
4+
# Clones (if missing) and `pip install -e` each sibling subsystem next to this
5+
# repo, then installs the Bundle itself with dev extras. Run from anywhere.
6+
#
7+
# ./scripts/dev_install.sh # clone missing repos + editable install
8+
# SIN_NO_CLONE=1 ./scripts/dev_install.sh # only install repos already present
9+
set -euo pipefail
10+
11+
BUNDLE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
12+
WORKSPACE="$(cd "${BUNDLE_DIR}/.." && pwd)"
13+
ORG="https://github.com/OpenSIN-Code"
14+
15+
# Sibling repos in install order (dependencies before the bundle).
16+
REPOS=(
17+
"SIN-Code-Semantic-Codebase-Knowledge-Graphs"
18+
"SIN-Code-Intent-Based-Diffing"
19+
"SIN-Code-Proof-of-Correctness"
20+
"SIN-Code-Ephemeral-Full-Stack-Mocking-Orchestration"
21+
"SIN-Code-Architectural-Debt-Watchdogs"
22+
"SIN-Code-Verification-Oracle"
23+
"SIN-Code-Orchestration"
24+
"SIN-Code-Review-Interface"
25+
)
26+
27+
echo "== SIN-Code dev install =="
28+
echo "workspace: ${WORKSPACE}"
29+
30+
for repo in "${REPOS[@]}"; do
31+
path="${WORKSPACE}/${repo}"
32+
if [[ ! -d "${path}" ]]; then
33+
if [[ "${SIN_NO_CLONE:-0}" == "1" ]]; then
34+
echo "SKIP ${repo} (not present; SIN_NO_CLONE=1)"
35+
continue
36+
fi
37+
echo "CLONE ${repo}"
38+
git clone --depth 1 "${ORG}/${repo}.git" "${path}"
39+
fi
40+
echo "INSTALL ${repo}"
41+
pip install -e "${path}"
42+
done
43+
44+
echo "INSTALL SIN-Code-Bundle [dev]"
45+
pip install -e "${BUNDLE_DIR}[dev]"
46+
47+
echo "== done. run 'sin status' to verify subsystems =="

0 commit comments

Comments
 (0)