@llm-dev-ops/agentics-cli 1.4.29 → 1.4.32

package/dist/bundled-agents/incident-manager-agents/src/integrations/upstream/sentinel_adapter.rs

@@ -0,0 +1,267 @@
+//! LLM-Sentinel Core Adapter
+//!
+//! Thin runtime adapter for consuming anomaly flags, threat signals, and drift events
+//! from the upstream llm-sentinel-core crate. Translates sentinel types to internal
+//! incident-manager types without modifying existing alerting logic.
+//!
+//! This adapter provides type-safe consumption of sentinel events and converts them
+//! to incident-manager's internal representation.
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+// Import internal types
+use crate::integrations::sentinel::{AlertCategory, AlertSeverity, SentinelAlert};
+
+/// Adapter for consuming events from llm-sentinel-core
+#[derive(Debug, Clone)]
+pub struct SentinelCoreAdapter {
+    /// Source identifier for tracing
+    source_id: String,
+    /// Enable debug logging
+    debug_enabled: bool,
+}
+
+impl Default for SentinelCoreAdapter {
+    fn default() -> Self {
+        Self::new("llm-sentinel-core")
+    }
+}
+
+impl SentinelCoreAdapter {
+    /// Create a new sentinel core adapter
+    pub fn new(source_id: impl Into<String>) -> Self {
+        Self {
+            source_id: source_id.into(),
+            debug_enabled: false,
+        }
+    }
+
+    /// Enable debug mode
+    pub fn with_debug(mut self, enabled: bool) -> Self {
+        self.debug_enabled = enabled;
+        self
+    }
+
+    /// Convert upstream anomaly event to internal SentinelAlert
+    ///
+    /// This is the primary consumption point for anomaly flags from sentinel-core.
+    /// Does not modify alerting algorithms - pure type translation.
+    pub fn convert_anomaly_event(&self, event: &UpstreamAnomalyEvent) -> SentinelAlert {
+        SentinelAlert {
+            id: event.id.clone(),
+            timestamp: event.timestamp,
+            severity: self.convert_severity(&event.severity),
+            category: self.convert_anomaly_type_to_category(&event.anomaly_type),
+            title: self.generate_alert_title(&event.anomaly_type, &event.service_id),
+            description: event.description.clone().unwrap_or_default(),
+            source: self.source_id.clone(),
+            affected_resources: vec![event.service_id.clone(), event.model_id.clone()],
+            metadata: event.metadata.clone(),
+            anomaly_score: Some(event.confidence),
+            recommended_actions: self.generate_recommendations(&event.anomaly_type),
+        }
+    }
+
+    /// Extract threat signal from anomaly event if security-related
+    pub fn extract_threat_signal(&self, event: &UpstreamAnomalyEvent) -> Option<UpstreamThreatSignal> {
+        // Only extract threat signals from security-related anomalies
+        if event.anomaly_type != "SecurityThreat" {
+            return None;
+        }
+
+        Some(UpstreamThreatSignal {
+            id: format!("threat-{}", event.id),
+            timestamp: event.timestamp,
+            threat_type: ThreatType::Unknown,
+            confidence: event.confidence,
+            source_service: event.service_id.clone(),
+            indicators: Vec::new(),
+            metadata: HashMap::new(),
+        })
+    }
+
+    /// Extract drift events from anomaly events
+    pub fn extract_drift_event(&self, event: &UpstreamAnomalyEvent) -> Option<UpstreamDriftEvent> {
+        let drift_type = match event.anomaly_type.as_str() {
+            "InputDrift" => Some(DriftType::Input),
+            "OutputDrift" => Some(DriftType::Output),
+            "ConceptDrift" => Some(DriftType::Concept),
+            "EmbeddingDrift" => Some(DriftType::Embedding),
+            _ => None,
+        }?;
+
+        Some(UpstreamDriftEvent {
+            id: format!("drift-{}", event.id),
+            timestamp: event.timestamp,
+            drift_type,
+            magnitude: event.confidence,
+            baseline_reference: event.metadata.get("baseline_id")
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string()),
+            affected_model: event.model_id.clone(),
+            detection_method: event.detection_method.clone(),
+            metadata: HashMap::new(),
+        })
+    }
+
+    /// Batch convert multiple anomaly events
+    pub fn convert_anomaly_batch(&self, events: &[UpstreamAnomalyEvent]) -> Vec<SentinelAlert> {
+        events.iter().map(|e| self.convert_anomaly_event(e)).collect()
+    }
+
+    // --- Private helper methods ---
+
+    fn convert_severity(&self, severity: &str) -> AlertSeverity {
+        match severity.to_lowercase().as_str() {
+            "critical" => AlertSeverity::Critical,
+            "high" => AlertSeverity::High,
+            "medium" => AlertSeverity::Medium,
+            "low" => AlertSeverity::Low,
+            _ => AlertSeverity::Info,
+        }
+    }
+
+    fn convert_anomaly_type_to_category(&self, anomaly_type: &str) -> AlertCategory {
+        match anomaly_type {
+            "InputDrift" | "OutputDrift" | "ConceptDrift" | "EmbeddingDrift" => AlertCategory::ModelDrift,
+            "LatencySpike" | "ThroughputDegradation" => AlertCategory::PerformanceDegradation,
+            "ErrorRateIncrease" | "QualityDegradation" | "Hallucination" => AlertCategory::DataQuality,
+            "SecurityThreat" => AlertCategory::SecurityThreat,
+            "TokenUsageSpike" | "CostAnomaly" => AlertCategory::ResourceExhaustion,
+            _ => AlertCategory::Other,
+        }
+    }
+
+    fn generate_alert_title(&self, anomaly_type: &str, service_id: &str) -> String {
+        format!("{} detected in {}", anomaly_type, service_id)
+    }
+
+    fn generate_recommendations(&self, anomaly_type: &str) -> Vec<String> {
+        match anomaly_type {
+            "InputDrift" | "OutputDrift" => vec![
+                "Review recent input data distributions".to_string(),
+                "Check for data pipeline changes".to_string(),
+                "Consider model retraining if drift persists".to_string(),
+            ],
+            "SecurityThreat" => vec![
+                "Investigate potential security incident".to_string(),
+                "Review access logs and audit trails".to_string(),
+                "Escalate to security team if confirmed".to_string(),
+            ],
+            "LatencySpike" => vec![
+                "Check infrastructure health".to_string(),
+                "Review recent deployments".to_string(),
+                "Monitor resource utilization".to_string(),
+            ],
+            _ => vec!["Review anomaly details and investigate root cause".to_string()],
+        }
+    }
+}
+
+/// Upstream anomaly event from sentinel
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct UpstreamAnomalyEvent {
+    pub id: String,
+    pub timestamp: DateTime<Utc>,
+    pub anomaly_type: String,
+    pub severity: String,
+    pub confidence: f64,
+    pub service_id: String,
+    pub model_id: String,
+    pub description: Option<String>,
+    pub detection_method: String,
+    pub metadata: HashMap<String, serde_json::Value>,
+}
+
+impl UpstreamAnomalyEvent {
+    // NOTE: from_sentinel requires ecosystem feature (llm_sentinel_core)
+    // Uncomment when ecosystem dependencies are available
+    // pub fn from_sentinel(event: &llm_sentinel_core::events::AnomalyEvent) -> Self { ... }
+}
+
+/// Threat signal extracted from sentinel telemetry
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct UpstreamThreatSignal {
+    pub id: String,
+    pub timestamp: DateTime<Utc>,
+    pub threat_type: ThreatType,
+    pub confidence: f64,
+    pub source_service: String,
+    pub indicators: Vec<String>,
+    pub metadata: HashMap<String, serde_json::Value>,
+}
+
+/// Classification of threat types
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum ThreatType {
+    PromptInjection,
+    Jailbreak,
+    DataExfiltration,
+    ModelInversion,
+    AdversarialInput,
+    Unknown,
+}
+
+/// Drift event from sentinel anomaly detection
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct UpstreamDriftEvent {
+    pub id: String,
+    pub timestamp: DateTime<Utc>,
+    pub drift_type: DriftType,
+    pub magnitude: f64,
+    pub baseline_reference: Option<String>,
+    pub affected_model: String,
+    pub detection_method: String,
+    pub metadata: HashMap<String, serde_json::Value>,
+}
+
+/// Types of drift detected
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum DriftType {
+    Input,
+    Output,
+    Concept,
+    Embedding,
+    Distribution,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_adapter_creation() {
+        let adapter = SentinelCoreAdapter::new("test-source");
+        assert_eq!(adapter.source_id, "test-source");
+    }
+
+    #[test]
+    fn test_default_adapter() {
+        let adapter = SentinelCoreAdapter::default();
+        assert_eq!(adapter.source_id, "llm-sentinel-core");
+    }
+
+    #[test]
+    fn test_severity_conversion() {
+        let adapter = SentinelCoreAdapter::default();
+        assert!(matches!(adapter.convert_severity("Critical"), AlertSeverity::Critical));
+        assert!(matches!(adapter.convert_severity("low"), AlertSeverity::Low));
+    }
+
+    #[test]
+    fn test_drift_type_category() {
+        let adapter = SentinelCoreAdapter::default();
+        assert!(matches!(
+            adapter.convert_anomaly_type_to_category("InputDrift"),
+            AlertCategory::ModelDrift
+        ));
+        assert!(matches!(
+            adapter.convert_anomaly_type_to_category("SecurityThreat"),
+            AlertCategory::SecurityThreat
+        ));
+    }
+}

package/dist/bundled-agents/incident-manager-agents/src/lib.rs

@@ -0,0 +1,33 @@
+pub mod adapters;
+pub mod analytics;
+pub mod api;
+pub mod benchmarks;
+pub mod circuit_breaker;
+pub mod config;
+pub mod correlation;
+pub mod enrichment;
+pub mod error;
+pub mod escalation;
+#[macro_use]
+pub mod execution;
+pub mod graphql;
+pub mod grpc;
+pub mod integrations;
+pub mod metrics;
+pub mod ml;
+pub mod models;
+pub mod notifications;
+pub mod playbooks;
+pub mod processing;
+pub mod scheduler;
+pub mod search;
+pub mod state;
+pub mod messaging;
+pub mod websocket;
+
+pub use config::Config;
+pub use error::{AppError, Result};
+
+// Re-export canonical benchmark interface
+pub use benchmarks::{run_all_benchmarks, BenchmarkResult};
+pub use adapters::{all_targets, BenchTarget};

package/dist/bundled-agents/incident-manager-agents/src/main.rs

@@ -0,0 +1,302 @@
+use llm_incident_manager::{
+    api::{build_router, AppState},
+    config::Config,
+    correlation::{CorrelationConfig, CorrelationEngine},
+    escalation::EscalationEngine,
+    grpc::start_grpc_server,
+    notifications::NotificationService,
+    playbooks::PlaybookService,
+    processing::{DeduplicationEngine, IncidentProcessor},
+    state::create_store,
+    websocket::{WebSocketConfig, WebSocketState},
+};
+use std::sync::Arc;
+use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // Initialize tracing
+    tracing_subscriber::registry()
+        .with(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| "llm_incident_manager=info,tower_http=info".into()),
+        )
+        .with(tracing_subscriber::fmt::layer())
+        .init();
+
+    // Load configuration
+    let config = Config::load().unwrap_or_else(|e| {
+        eprintln!("Failed to load configuration: {}", e);
+        eprintln!("Using default configuration");
+        default_config()
+    });
+
+    tracing::info!("Starting LLM Incident Manager v{}", env!("CARGO_PKG_VERSION"));
+    tracing::info!("Deployment mode: {:?}", config.deployment.mode);
+
+    // Initialize Prometheus metrics
+    if config.observability.prometheus_enabled {
+        if let Err(e) = llm_incident_manager::metrics::init_metrics() {
+            tracing::warn!("Failed to initialize metrics: {}", e);
+            tracing::warn!("Continuing without metrics");
+        } else {
+            tracing::info!("✅ Prometheus metrics initialized");
+        }
+    } else {
+        tracing::info!("⚠️  Prometheus metrics disabled in configuration");
+    }
+
+    // Initialize storage backend
+    tracing::info!("Storage backend: {:?}", config.state.backend);
+    let store = create_store(&config.state).await?;
+    tracing::info!("✅ Storage backend initialized");
+
+    // Initialize components
+    let dedup_engine = Arc::new(DeduplicationEngine::new(
+        store.clone(),
+        config.processing.deduplication_window_secs as i64,
+    ));
+
+    // Initialize notification service
+    let notification_service = match NotificationService::new(config.notifications.clone(), store.clone()) {
+        Ok(service) => {
+            tracing::info!("✅ Notification service initialized");
+            Some(Arc::new(service))
+        }
+        Err(e) => {
+            tracing::warn!("⚠️  Notification service initialization failed: {}", e);
+            tracing::warn!("   Continuing without notifications");
+            None
+        }
+    };
+
+    // Initialize playbook service
+    let playbook_service = Arc::new(PlaybookService::new(
+        store.clone(),
+        notification_service.clone(),
+        true, // Enable auto-execution
+    ));
+    tracing::info!("✅ Playbook service initialized with auto-execution enabled");
+
+    // Initialize escalation engine
+    let escalation_engine = Arc::new(EscalationEngine::new(
+        notification_service.clone(),
+        store.clone(),
+    ).with_check_interval(30));
+    tracing::info!("✅ Escalation engine initialized");
+
+    // Spawn escalation monitor
+    let monitor_engine = escalation_engine.clone();
+    tokio::spawn(async move {
+        monitor_engine.run_monitor().await;
+    });
+    tracing::info!("✅ Escalation monitor started");
+
+    // Initialize routing rule evaluator
+    let routing_evaluator = Arc::new(llm_incident_manager::escalation::RoutingRuleEvaluator::new(
+        Some(playbook_service.clone()),
+    ));
+    tracing::info!("✅ Routing rule evaluator initialized");
+
+    // Initialize correlation engine
+    let correlation_config = if config.processing.correlation_enabled {
+        CorrelationConfig::default()
+    } else {
+        CorrelationConfig {
+            enabled: false,
+            ..Default::default()
+        }
+    };
+
+    let correlation_engine = Arc::new(CorrelationEngine::new(
+        correlation_config,
+        store.clone(),
+    ));
+
+    if config.processing.correlation_enabled {
+        if let Err(e) = correlation_engine.start().await {
+            tracing::error!("Failed to start correlation engine: {}", e);
+        } else {
+            tracing::info!("✅ Correlation engine initialized and started");
+        }
+    } else {
+        tracing::info!("⚠️  Correlation engine disabled in configuration");
+    }
+
+    // Create processor with optional services
+    let mut processor = IncidentProcessor::new(store, dedup_engine);
+    if let Some(notif_service) = notification_service.clone() {
+        processor.set_notification_service(notif_service);
+        tracing::info!("✅ Notification service integrated with processor");
+    }
+    processor.set_playbook_service(playbook_service.clone());
+    tracing::info!("✅ Playbook service integrated with processor");
+
+    processor.set_escalation_engine(escalation_engine.clone());
+    tracing::info!("✅ Escalation engine integrated with processor");
+
+    processor.set_routing_evaluator(routing_evaluator.clone());
+    tracing::info!("✅ Routing rule evaluator integrated with processor");
+
+    if config.processing.correlation_enabled {
+        processor.set_correlation_engine(correlation_engine.clone());
+        tracing::info!("✅ Correlation engine integrated with processor");
+    }
+
+    // Initialize WebSocket state
+    let ws_config = WebSocketConfig::default();
+    let ws_state = Arc::new(WebSocketState::new(ws_config));
+    tracing::info!("✅ WebSocket server initialized");
+
+    // Integrate WebSocket handlers with processor (before Arc::new)
+    processor.set_websocket_handlers(Arc::new(ws_state.handlers.clone()));
+    tracing::info!("✅ WebSocket event handlers integrated with processor");
+
+    // Spawn WebSocket cleanup task
+    let cleanup_state = ws_state.clone();
+    tokio::spawn(async move {
+        llm_incident_manager::websocket::cleanup_task(cleanup_state).await;
+    });
+    tracing::info!("✅ WebSocket cleanup task started");
+
+    let processor = Arc::new(processor);
+
+    // Create application state for HTTP API with WebSocket
+    let app_state = AppState::new(processor.clone()).with_websocket(ws_state.clone());
+
+    // Build HTTP router with REST API
+    let app = build_router(app_state.clone());
+
+    // Note: GraphQL routes are now served separately or integrated directly into build_router
+    // For now, we'll just use the REST router as the main app
+
+    // Start HTTP server
+    let http_addr = format!("{}:{}", config.server.host, config.server.http_port);
+    let http_listener = tokio::net::TcpListener::bind(&http_addr).await?;
+
+    tracing::info!("🚀 HTTP API server listening on http://{}", http_addr);
+    tracing::info!("   Health check: http://{}/health", http_addr);
+    tracing::info!("   REST API: http://{}/v1/incidents", http_addr);
+    tracing::info!("   GraphQL API: http://{}/graphql", http_addr);
+    tracing::info!("   GraphQL Playground: http://{}/graphql/playground", http_addr);
+    tracing::info!("   GraphQL WebSocket: ws://{}/graphql/ws", http_addr);
+    tracing::info!("   WebSocket Streaming: ws://{}/ws", http_addr);
+
+    // Clone config for gRPC server
+    let grpc_config = config.clone();
+    let grpc_processor = processor.clone();
+
+    // Spawn gRPC server in separate task
+    let grpc_handle = tokio::spawn(async move {
+        tracing::info!(
+            "🚀 gRPC server listening on {}:{}",
+            grpc_config.server.host,
+            grpc_config.server.grpc_port
+        );
+        tracing::info!("   Incident Service: grpc://{}:{}", grpc_config.server.host, grpc_config.server.grpc_port);
+        tracing::info!("   Alert Ingestion: grpc://{}:{}", grpc_config.server.host, grpc_config.server.grpc_port);
+
+        if let Err(e) = start_grpc_server(grpc_config, grpc_processor).await {
+            tracing::error!("gRPC server error: {}", e);
+        }
+    });
+
+    tracing::info!("✅ All servers started successfully");
+    tracing::info!("Press Ctrl+C to shutdown");
+
+    // Run HTTP server
+    let http_handle = tokio::spawn(async move {
+        if let Err(e) = axum::serve(http_listener, app).await {
+            tracing::error!("HTTP server error: {}", e);
+        }
+    });
+
+    // Wait for both servers
+    tokio::select! {
+        _ = http_handle => {
+            tracing::warn!("HTTP server stopped");
+        }
+        _ = grpc_handle => {
+            tracing::warn!("gRPC server stopped");
+        }
+        _ = tokio::signal::ctrl_c() => {
+            tracing::info!("Shutdown signal received");
+        }
+    }
+
+    tracing::info!("Shutting down gracefully...");
+    Ok(())
+}
+
+fn default_config() -> Config {
+    use llm_incident_manager::config::*;
+
+    Config {
+        server: ServerConfig {
+            host: "0.0.0.0".to_string(),
+            http_port: 8080,
+            grpc_port: 9000,
+            metrics_port: 9090,
+            tls_enabled: false,
+            tls_cert: None,
+            tls_key: None,
+            request_timeout_secs: 30,
+            max_connections: 10000,
+        },
+        deployment: DeploymentConfig {
+            mode: DeploymentMode::Standalone,
+            worker_type: None,
+            region: None,
+            availability_zones: vec![],
+        },
+        state: StateConfig {
+            backend: StateBackend::Sled,
+            path: Some("./data/state".into()),
+            redis_url: None,
+            redis_cluster_nodes: vec![],
+            pool_size: 100,
+        },
+        messaging: None,
+        integrations: IntegrationsConfig::default(),
+        observability: ObservabilityConfig {
+            log_level: "info".to_string(),
+            json_logs: false,
+            otlp_enabled: false,
+            otlp_endpoint: None,
+            service_name: "llm-incident-manager".to_string(),
+            prometheus_enabled: true,
+        },
+        processing: ProcessingConfig {
+            max_concurrent_incidents: 10000,
+            processing_timeout_secs: 300,
+            deduplication_enabled: true,
+            deduplication_window_secs: 900,
+            correlation_enabled: true,
+        },
+        notifications: NotificationConfig {
+            slack_enabled: false,
+            slack_webhook_env: Some("SLACK_WEBHOOK_URL".to_string()),
+            slack_bot_token_env: Some("SLACK_BOT_TOKEN".to_string()),
+            slack_default_channel: Some("#incidents".to_string()),
+            email_enabled: false,
+            smtp_server: Some("smtp.example.com".to_string()),
+            smtp_port: 587,
+            smtp_use_tls: true,
+            smtp_username_env: Some("SMTP_USERNAME".to_string()),
+            smtp_password_env: Some("SMTP_PASSWORD".to_string()),
+            email_from: Some("incidents@example.com".to_string()),
+            email_from_name: Some("LLM Incident Manager".to_string()),
+            pagerduty_enabled: false,
+            pagerduty_api_token_env: Some("PAGERDUTY_API_TOKEN".to_string()),
+            pagerduty_integration_key_env: Some("PAGERDUTY_INTEGRATION_KEY".to_string()),
+            pagerduty_api_url: "https://events.pagerduty.com/v2/enqueue".to_string(),
+            webhook_enabled: true,
+            default_webhook_url: None,
+            webhook_timeout_secs: 10,
+            max_retries: 3,
+            retry_backoff_secs: 5,
+            queue_size: 10000,
+            worker_threads: 4,
+        },
+    }
+}