legion-data 1.4.2 → 1.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eaf37e68acae5015ef50b01e6a5c7a4806e81b80f5cf74f3c71b72e6799f0bd4
-  data.tar.gz: 81b55083c6e8d59403b51a838935a4146b1d3f39eca8316dfd82ee4d2f6a0b05
+  metadata.gz: cc137f8ac51b46a97a5bc6c82b25e8036536fb5771309b69aa9df35604db7b89
+  data.tar.gz: dd10068c7f5b243c0fe6b5d56b572ab06cdfe3a33bcf6449c8758e94e4e17147
 SHA512:
-  metadata.gz: 4a24d0a86df7d44669ff38d34667c4f0c63036f877d1453df2e1418670b8a8c59ad803f9c245f5895094465d994253e1b4eced1007f0724cd31f53c4ae804d37
-  data.tar.gz: 830b7fc8203eb8a339a5ad84d334e56dabf0e6e02084be99a3b27a3067b104d7b5ca973437f3f8577050983c0126a302903624bdcf6a2916e267a1e6a8558754
+  metadata.gz: 74ca6d37fce4a381b04b9ce35bc50117649a0be3fae11c3231d496aed38aa43a03439dc5262569bcce2c6b037a996fa6b16ac6067c48d2e40cd1b97aa2153241
+  data.tar.gz: c7d530da08c104df4f2d633a33ac13171c7eac51516ac75d2b54374b9d938a9075a41a0d37edc0614f204753e349264bd0a96b76ca3ca031ccc63c926f9deebd

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Legion::Data Changelog
 
+## [Unreleased]
+
+### Added
+- `Legion::Data::Spool`: filesystem-based event buffer at `~/.legionio/data/spool/`
+
+## v1.4.3
+
+### Added
+- `Legion::Data::Spool`: filesystem-based event buffer at `~/.legionio/data/spool/`
+
 ## v1.4.2
 
 ### Fixed

data/CLAUDE.md

@@ -5,9 +5,10 @@
 
 ## Purpose
 
-Manages persistent database storage for the LegionIO framework. Supports SQLite (default), MySQL, and PostgreSQL via Sequel ORM. Provides automatic schema migrations and data models for extensions, functions, runners, nodes, tasks, settings, digital workers, task relationships, and Apollo shared knowledge tables (PostgreSQL only). Also provides a parallel local SQLite database (`Legion::Data::Local`) for agentic cognitive state persistence.
+Manages persistent database storage for the LegionIO framework. Supports SQLite (default), MySQL, and PostgreSQL via Sequel ORM. Provides automatic schema migrations and data models for extensions, functions, runners, nodes, tasks, settings, digital workers, task relationships, Apollo shared knowledge tables (PostgreSQL only), tenants, webhooks, audit log, and archive tables. Also provides a parallel local SQLite database (`Legion::Data::Local`) for agentic cognitive state persistence.
 
 **GitHub**: https://github.com/LegionIO/legion-data
+**Version**: 1.4.3
 **License**: Apache-2.0
 
 ## Supported Databases
@@ -45,7 +46,7 @@ Legion::Data (singleton module)
 │   ├── .shutdown      # Close local connection
 │   └── .reset!        # Clear all state (testing)
 │
-├── Migration          # Auto-migration system (14 migrations, Sequel DSL)
+├── Migration          # Auto-migration system (25 migrations, Sequel DSL)
 │   └── migrations/
 │       ├── 001_add_schema_columns
 │       ├── 002_add_nodes
@@ -64,7 +65,14 @@ Legion::Data (singleton module)
 │       ├── 015_add_rbac_tables
 │       ├── 016_add_worker_health
 │       ├── 017_add_audit_log
-│       └── 018_add_governance_events    # append-only event store with hash chain
+│       ├── 018_add_governance_events    # append-only event store with hash chain
+│       ├── 019_add_audit_hash_chain
+│       ├── 020_add_webhooks
+│       ├── 021_add_archive_tables
+│       ├── 022_add_memory_traces
+│       ├── 023_add_data_archive
+│       ├── 024_add_tenant_partition_columns
+│       └── 025_add_tenants_table
 │
 ├── Model              # Sequel model loader
 │   └── Models/
@@ -80,7 +88,11 @@ Legion::Data (singleton module)
 │       ├── ApolloEntry    # Apollo knowledge entries — postgres only (pgvector embedding, confidence lifecycle)
 │       ├── ApolloRelation # Weighted relations between Apollo entries — postgres only
 │       ├── ApolloExpertise  # Per-agent domain expertise tracking — postgres only
-│       └── ApolloAccessLog  # Apollo entry access audit log — postgres only
+│       ├── ApolloAccessLog  # Apollo entry access audit log — postgres only
+│       ├── AuditLog       # Audit trail entries (AMQP + query layer)
+│       ├── RbacRoleAssignment  # RBAC principal -> role mappings
+│       ├── RbacRunnerGrant     # RBAC per-runner permission grants
+│       └── RbacCrossTeamGrant  # RBAC cross-team access grants
 │   Note: value_metrics table (migration 010) is accessed via raw Sequel dataset,
 │         not via a named Sequel::Model subclass.
 │   Note: Apollo models are guarded with `return unless adapter == :postgres` at load time.
@@ -169,10 +181,10 @@ Per-adapter credential defaults are defined in `Settings::CREDS`:
 | `lib/legion/data.rb` | Module entry, setup/shutdown lifecycle |
 | `lib/legion/data/connection.rb` | Sequel database connection (adapter selection) |
 | `lib/legion/data/migration.rb` | Migration runner |
-| `lib/legion/data/migrations/` | 14 numbered migration files (Sequel DSL) |
+| `lib/legion/data/migrations/` | 25 numbered migration files (Sequel DSL) |
 | `lib/legion/data/model.rb` | Model autoloader |
 | `lib/legion/data/local.rb` | Local SQLite module for agentic cognitive state |
-| `lib/legion/data/models/` | Sequel models (Extension, Function, Runner, Node, Task, TaskLog, Setting, DigitalWorker, Relationship, ApolloEntry, ApolloRelation, ApolloExpertise, ApolloAccessLog) |
+| `lib/legion/data/models/` | Sequel models (Extension, Function, Runner, Node, Task, TaskLog, Setting, DigitalWorker, Relationship, ApolloEntry, ApolloRelation, ApolloExpertise, ApolloAccessLog, AuditLog, RbacRoleAssignment, RbacRunnerGrant, RbacCrossTeamGrant) |
 | `lib/legion/data/encryption/cipher.rb` | AES-256-GCM encrypt/decrypt with versioned binary format and AAD |
 | `lib/legion/data/encryption/key_provider.rb` | Vault-backed key derivation with per-tenant scope and local fallback |
 | `lib/legion/data/encryption/sequel_plugin.rb` | Transparent `encrypted_column` DSL for Sequel models |
@@ -193,6 +205,11 @@ Optional persistent storage initialized during `Legion::Service` startup (after
 6. Task relationship graph (trigger/action chains)
 7. Apollo shared knowledge store (PostgreSQL + pgvector only, used by lex-apollo)
 8. Local SQLite for agentic cognitive state (memory traces, trust scores, dream journals) — always on-node, independent of shared DB
+9. RBAC assignment tables (migrations 015 — role assignments, runner grants, cross-team grants)
+10. Audit log with tamper-evident hash chain (migrations 017, 019)
+11. Governance event store with append-only integrity (migration 018)
+12. Webhook subscription storage (migration 020)
+13. Archive, memory traces, and tenant partition tables (migrations 021–025)
 
 ---
 

data/README.md

@@ -2,7 +2,7 @@
 
 Persistent database storage for the [LegionIO](https://github.com/LegionIO/LegionIO) framework. Provides database connectivity via Sequel ORM, automatic schema migrations, and data models for extensions, functions, runners, nodes, tasks, settings, digital workers, task relationships, and Apollo shared knowledge tables.
 
-Version: 1.3.0
+**Version**: 1.4.3
 
 ## Supported Databases
 
@@ -155,6 +155,16 @@ CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
 
 Set `enabled: false` to disable local SQLite entirely.
 
+### Spool (Filesystem Buffer)
+
+`Legion::Data::Spool` provides a filesystem-backed write buffer for extensions. When the database is unavailable, task data can be written to `~/.legionio/data/spool/` and replayed once the connection is restored.
+
+```ruby
+spool = Legion::Data::Spool.for(Legion::Extensions::MyLex)
+spool.write({ task_id: SecureRandom.uuid, data: payload })
+spool.drain { |entry| process(entry) }
+```
+
 ### Dev Mode Fallback
 
 When `dev_mode: true` and a network database (MySQL/PostgreSQL) is unreachable, the shared connection falls back to SQLite automatically instead of raising.

data/lib/legion/data/spool.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'fileutils'
+require 'securerandom'
+
+module Legion
+  module Data
+    module Spool
+      EXTENSION_PREFIX = 'Legion::Extensions::'
+
+      class << self
+        def root
+          @root ||= File.expand_path('~/.legionio/data/spool')
+        end
+
+        attr_writer :root
+
+        def for(extension_module)
+          ScopedSpool.new(extension_module, root)
+        end
+
+        private
+
+        def extension_path(extension_module)
+          name = extension_module.name
+          raise ArgumentError, "#{name} is not under Legion::Extensions::" unless name&.start_with?(EXTENSION_PREFIX)
+
+          name.delete_prefix(EXTENSION_PREFIX).gsub('::', '/').downcase
+        end
+      end
+
+      class ScopedSpool
+        def initialize(extension_module, spool_root)
+          @extension_dir = File.join(spool_root, Spool.send(:extension_path, extension_module))
+        end
+
+        def write(sub_namespace, payload)
+          dir = sub_dir(sub_namespace)
+          FileUtils.mkdir_p(dir)
+          filename = "#{Time.now.strftime('%s%9N')}-#{SecureRandom.uuid}.json"
+          path = File.join(dir, filename)
+          File.write(path, ::JSON.generate(payload))
+          path
+        end
+
+        def read(sub_namespace)
+          sorted_files(sub_namespace).map { |f| ::JSON.parse(File.read(f), symbolize_names: true) }
+        end
+
+        def flush(sub_namespace)
+          count = 0
+          sorted_files(sub_namespace).each do |path|
+            event = ::JSON.parse(File.read(path), symbolize_names: true)
+            yield event
+            File.delete(path)
+            count += 1
+          end
+          count
+        end
+
+        def count(sub_namespace)
+          sorted_files(sub_namespace).size
+        end
+
+        def clear(sub_namespace)
+          dir = sub_dir(sub_namespace)
+          return unless Dir.exist?(dir)
+
+          Dir[File.join(dir, '*.json')].each { |f| File.delete(f) }
+        end
+
+        private
+
+        def sub_dir(sub_namespace)
+          File.join(@extension_dir, sub_namespace.to_s)
+        end
+
+        def sorted_files(sub_namespace)
+          dir = sub_dir(sub_namespace)
+          return [] unless Dir.exist?(dir)
+
+          Dir[File.join(dir, '*.json')]
+        end
+      end
+    end
+  end
+end

data/lib/legion/data/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Data
-    VERSION = '1.4.2'
+    VERSION = '1.4.3'
   end
 end

data/lib/legion/data.rb

@@ -8,6 +8,7 @@ require 'legion/data/connection'
 require 'legion/data/model'
 require 'legion/data/migration'
 require_relative 'data/local'
+require_relative 'data/spool'
 
 module Legion
   module Data

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-data
 version: !ruby/object:Gem::Version
-  version: 1.4.2
+  version: 1.4.3
 platform: ruby
 authors:
 - Esity
@@ -140,6 +140,7 @@ files:
 - lib/legion/data/models/task.rb
 - lib/legion/data/models/task_log.rb
 - lib/legion/data/settings.rb
+- lib/legion/data/spool.rb
 - lib/legion/data/storage_tiers.rb
 - lib/legion/data/vector.rb
 - lib/legion/data/version.rb