@ngocsangairvds/vsaf 4.0.5 → 4.0.7

package/skills/vds-skill/vds-scripts/.github/workflows/scheduler-load-smoke.yml

@@ -0,0 +1,104 @@
+name: Scheduler Load Smoke (1-min)
+
+# TSK-8.4: 60-second smoke test against /health in stub mode (no DB required).
+# Validates that the FastAPI app starts correctly and responds within NFR bounds.
+#
+# Full 5-scenario baselines (S1-S5, ~85 min) are manual-only:
+#   bash scheduler_orchestrator/tests/load/run_baselines.sh
+#
+# NFR gate: GET /health p99 <= 1000 ms (validated by nfr_check.py --scenario smoke)
+#
+# Security: no github.event.* input is interpolated into run: steps.
+# All run: blocks use static strings or env-var references only.
+
+on:
+  pull_request:
+    paths:
+      - 'scheduler_orchestrator/**'
+      - '.github/workflows/scheduler-load-smoke.yml'
+  push:
+    branches:
+      - master
+    paths:
+      - 'scheduler_orchestrator/**'
+
+jobs:
+  load-smoke:
+    name: Scheduler load smoke (60 s)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    env:
+      # Stub mode: no Postgres required; only /health is tested in this job.
+      VDS_SCHEDULER_ENABLED: "false"
+      PYTHONUNBUFFERED: "1"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+
+      - name: Sync scheduler_orchestrator dev dependencies
+        # Installs locust + all dev deps defined in pyproject.toml [dev].
+        run: uv sync --extra dev
+        working-directory: scheduler_orchestrator
+
+      - name: Start FastAPI in stub mode
+        # Background: VDS_SCHEDULER_ENABLED=false means no DBOS/Postgres needed.
+        run: |
+          uv run uvicorn vds_scheduler_orchestrator.app:app \
+            --host 127.0.0.1 --port 8000 --log-level warning &
+          echo "FASTAPI_PID=$!" >> "$GITHUB_ENV"
+        working-directory: scheduler_orchestrator
+
+      - name: Wait for API readiness
+        run: |
+          for i in $(seq 1 15); do
+            if curl -sf http://127.0.0.1:8000/health; then
+              echo "API ready after ${i}s"
+              break
+            fi
+            sleep 2
+          done
+
+      - name: Run 60-second Locust smoke
+        run: |
+          uv run locust \
+            --locustfile tests/load/smoke.py \
+            --headless \
+            --users 5 \
+            --spawn-rate 5 \
+            --run-time 60s \
+            --host http://127.0.0.1:8000 \
+            --csv /tmp/smoke \
+            --only-summary
+        working-directory: scheduler_orchestrator
+
+      - name: Validate NFR gate (smoke p99 <= 1000 ms)
+        run: |
+          uv run python tests/load/nfr_check.py \
+            --scenario smoke \
+            /tmp/smoke_stats.csv
+        working-directory: scheduler_orchestrator
+
+      - name: Upload smoke CSV artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: smoke-locust-csv
+          path: /tmp/smoke_*.csv
+          retention-days: 7
+
+      - name: Stop API process
+        if: always()
+        run: |
+          if [ -n "${FASTAPI_PID}" ]; then
+            kill "${FASTAPI_PID}" 2>/dev/null || true
+          fi

package/skills/vds-skill/vds-scripts/.github/workflows/telegram-bridge-ci.yml

@@ -0,0 +1,131 @@
+name: Telegram Bridge — Tier 1 CI
+
+# Spec ref: telegram_bridge/skill_content/references/verification.md §Tier 1
+# Closes:   AC-1.13 (gate-enforcing CI workflow — operator-deferred half)
+# Gate:     >= 75% overall coverage (AC-1.13 / NFR-1.1), enforced via
+#           --cov-fail-under=75 inside verify-tier1.sh
+#
+# The canonical verification entry point is:
+#   telegram_bridge/scripts/verify-tier1.sh
+# This workflow wraps that script so the same gate runs locally and in CI.
+
+on:
+  push:
+    paths:
+      - "telegram_bridge/**"
+      - ".github/workflows/telegram-bridge-ci.yml"
+  pull_request:
+    paths:
+      - "telegram_bridge/**"
+
+# Cancel in-progress runs on the same ref so a force-push does not queue stale
+# runs behind the new one.  github.event_name is included in the group key so a
+# push run and a PR run on the same ref do not cancel each other.
+concurrency:
+  group: "telegram-bridge-ci-${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}"
+  cancel-in-progress: true
+
+env:
+  PYTHON_VERSION: "3.14"
+
+jobs:
+  # -- Fast path-filter check ---------------------------------------------------
+  # dorny/paths-filter compares changed files against the PR base (or the
+  # preceding commit for push events).  If no telegram_bridge/** file changed
+  # -- e.g. a PR that only touches vds_cli or scheduler_orchestrator -- the
+  # expensive tier1 job is skipped entirely, saving install + pyarrow build time.
+  path-changed:
+    name: Detect changed paths
+    runs-on: ubuntu-latest
+    outputs:
+      telegram: ${{ steps.filter.outputs.telegram }}
+    steps:
+      - name: Checkout (full depth for base-commit diff)
+        # fetch-depth 0 ensures dorny can resolve the base ref for push events.
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Filter -- telegram_bridge/**
+        id: filter
+        # dorny/paths-filter v3 -- outputs a boolean per named filter.
+        # See: https://github.com/dorny/paths-filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            telegram:
+              - "telegram_bridge/**"
+              - ".github/workflows/telegram-bridge-ci.yml"
+
+  # -- Tier 1 gate --------------------------------------------------------------
+  # Runs the full unit + acceptance suite and enforces the >=75% coverage gate.
+  # Mirrors the local command documented in:
+  #   telegram_bridge/skill_content/references/verification.md -- Tier 1
+  #
+  # Pass criteria (verification.md -- Tier 1):
+  #   - All tests pass (448 passed, 29 skipped as of v1.0.13)
+  #   - Overall coverage >= 75% (gate is --cov-fail-under=75)
+  #   - Exit code 0 from verify-tier1.sh means AC-1.13 / NFR-1.1 PASS
+  tier1:
+    name: "Tier 1 -- unit + acceptance (>=75% coverage)"
+    runs-on: ubuntu-latest
+    needs: path-changed
+    # Skip when no telegram_bridge files changed to avoid unnecessary installs.
+    if: needs.path-changed.outputs.telegram == 'true'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Install uv -- matches the astral-sh/setup-uv@v4 convention used in
+      # .github/workflows/lint-and-test.yml and chaos-smoke.yml.
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      # Install Python 3.14 via uv.  uv manages the interpreter directly so
+      # actions/setup-python is not required alongside setup-uv.
+      - name: Install Python
+        run: uv python install "$PYTHON_VERSION"
+        env:
+          PYTHON_VERSION: ${{ env.PYTHON_VERSION }}
+
+      # Sync all workspace packages so telegram_bridge and every dependency
+      # (including pyarrow, required by the parquet cold-rotation tests in
+      # test_rotate_audit.py) are available in .venv.
+      #
+      # Latency note: pyarrow may take 60-120 s to build from source when
+      # a pre-built wheel is unavailable for the exact Python version/platform.
+      # uv's cache layer (auto-enabled by setup-uv) mitigates this on repeat
+      # runs within the same workflow or runner pool.
+      - name: Install workspace deps (uv sync --all-packages)
+        run: uv sync --all-packages
+
+      # Run the canonical Tier 1 entry point.
+      # verify-tier1.sh resolves the venv python from WT_ROOT/.venv/bin/python,
+      # so it works regardless of the GH Actions working directory.
+      #
+      # Exit codes (from verify-tier1.sh):
+      #   0 -- all tests pass + coverage >= 75%   --> gate GREEN
+      #   1 -- test failure
+      #   2 -- coverage below 75% gate            --> AC-1.13 FAIL
+      #
+      # Output is tee'd to a file so it is uploadable as an artifact even when
+      # the step fails.  GH Actions uses bash with -o pipefail by default, so
+      # the pipe exit code propagates correctly (left-side failure = step failure).
+      - name: "Run Tier 1 verification (>=75% coverage gate -- AC-1.13 / NFR-1.1)"
+        run: |
+          bash telegram_bridge/scripts/verify-tier1.sh 2>&1 | tee verify-tier1-output.txt
+
+      # Upload the captured terminal output as a CI artifact.
+      # 'if: always()' ensures this runs even when the tier1 step fails so
+      # coverage details are always inspectable from the Actions UI.
+      - name: Upload Tier 1 output artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          # Unique artifact name per run + attempt avoids collisions on re-runs.
+          name: "verify-tier1-output-${{ github.run_id }}-${{ github.run_attempt }}"
+          path: verify-tier1-output.txt
+          if-no-files-found: warn

package/skills/vds-skill/vds-scripts/.graphifyignore

@@ -0,0 +1,29 @@
+# vds-scripts .graphifyignore
+# Exclude build artifacts, caches, and non-source content
+
+# Python
+.venv/
+__pycache__/
+*.pyc
+*.pyo
+*.egg-info/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.tox/
+site-packages/
+
+# Build/dist
+dist/
+build/
+
+# Graphify output
+graphify-out/
+
+# Large generated files
+*.sqlite3
+*.db
+htmlcov/
+
+# Archive/historical
+scripts/archive/

package/skills/vds-skill/vds-scripts/.importlinter

@@ -0,0 +1,86 @@
+[importlinter]
+# Root packages that participate in contracts. Kept to workspace members so
+# `lint-imports` resolves them in the workspace venv without extra sync steps.
+# TSK-7.12b will expand this set to include `vds_platform_core` once that
+# package is added to `tool.uv.workspace.members` (part of TSK-7.12a scope).
+root_packages =
+    vds_agent_core
+    vds_cli_common
+    vds_platform_core
+include_external_packages = True
+
+# --- No-op seed contract ---
+#
+# TSK-7.0 (Phase 7, v24.2.0) installs import-linter and seeds this file with a
+# contract that always passes, so CI can wire up `lint-imports` before
+# TSK-7.12b adds the real layering invariant.
+#
+# TSK-7.12b will append a "forbidden" contract of the form:
+#
+#   [importlinter:contract:platform-core-no-vds-cli-common]
+#   name = platform_core must not depend on vds_cli_common
+#   type = forbidden
+#   source_modules = vds_platform_core
+#   forbidden_modules = vds_cli_common
+#
+# That contract makes the Layer 1 -> Layer 2 inversion (DEFAULT_ENV_PATHS lazy
+# import at config.py:20-23) a build-break rather than a runtime-only warning.
+
+[importlinter:contract:platform-core-no-vds-cli-common]
+name = platform_core must not depend on vds_cli_common
+type = forbidden
+source_modules =
+    vds_platform_core
+forbidden_modules =
+    vds_cli_common
+
+# --- Phase 9 FR-9 boundary contract (added 2026-04-30) ---
+#
+# Encodes the spec mandate from `vds-agent-core-alignment` requirements.md
+# that `vds_agent_core` depends ONLY on `vds_cli_common` + `vds_platform_core`.
+# Wave 33 dependency-chain audit verified the runtime state is clean; this
+# contract makes future regressions a CI build-break instead of a manual-grep
+# discovery. Replaces the `phase7-seed-noop` seed (deleted 2026-04-30).
+#
+# Forbidden modules: every workspace orchestrator. If a new orchestrator
+# joins the workspace, add it here.
+
+[importlinter:contract:agent-core-isolation]
+name = vds_agent_core must not depend on any orchestrator
+type = forbidden
+source_modules =
+    vds_agent_core
+forbidden_modules =
+    vds_audit_orchestrator
+    vds_memory_orchestrator
+    vds_scheduler_orchestrator
+    vds_multi_agent_orchestrator
+    vds_progress_report_orchestrator
+    vds_research_orchestrator
+    vds_spec_orchestrator
+    vds_task_orchestrator
+    vds_evolution
+    vds_confluence_orchestrator
+    vds_bitbucket_orchestrator
+    vds_jira_orchestrator
+    vds_grafana_orchestrator
+    vds_sonarqube_orchestrator
+    vds_elastic_orchestrator
+    vds_brd_orchestrator
+    vds_circular_dependency_orchestrator
+    vds_db_query_orchestrator
+    vds_excel_orchestrator
+    vds_git_orchestrator
+    vds_google_sheets_orchestrator
+    vds_hexagonal_orchestrator
+    vds_intellij_orchestrator
+    vds_links_orchestrator
+    vds_lsp_orchestrator
+    vds_markdown_orchestrator
+    vds_metabase_orchestrator
+    vds_openapi_orchestrator
+    vds_pdf_orchestrator
+    vds_public_interface_boundary_orchestrator
+    vds_structure_orchestrator
+    vds_sync_orchestrator
+    vds_cli

package/skills/vds-skill/vds-scripts/.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "code-review-graph": {
+      "command": "uvx",
+      "args": [
+        "code-review-graph",
+        "serve"
+      ]
+    }
+  }
+}

package/skills/vds-skill/vds-scripts/.pre-commit-config.yaml

@@ -0,0 +1,62 @@
+# Pre-commit configuration for WHO-project/vds-scripts.
+#
+# The local hook below was introduced after commit 4e2cd398 to prevent
+# re-committing the antipatterns that crashed Bitbucket Server's /browse UI
+# with "500 UNKNOWN": macOS .nosync symlinks, absolute-path symlinks,
+# Finder rename-conflict artifacts, and committed worktree directories.
+#
+# Install once per checkout:
+#   uv tool install pre-commit   # or: pipx install pre-commit
+#   pre-commit install
+repos:
+  - repo: local
+    hooks:
+      - id: check-invalid-symlinks
+        name: Block invalid symlinks, committed worktrees, and macOS rename-conflict files
+        entry: python3 scripts/check-invalid-symlinks.py
+        language: system
+        pass_filenames: false
+        always_run: true
+        stages: [pre-commit]
+
+      - id: agent-core-isolation
+        name: vds_agent_core must not import orchestrators (FR-10.12)
+        entry: .venv/bin/lint-imports --contract agent-core-isolation
+        language: system
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: vds-agent-core-no-legacy-typing
+        name: vds_agent_core must use modern typing (no UP006/UP007/UP035) (FR-10.13)
+        entry: .venv/bin/ruff check vds_agent_core/src/ --select UP006,UP007,UP035 --quiet
+        language: system
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: vds-agent-core-use-pathlib
+        name: vds_agent_core must use pathlib not os.path (FR-10.13)
+        entry: .venv/bin/ruff check vds_agent_core/src/ --select PTH --quiet
+        language: system
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: vds-agent-core-no-debug-markers
+        name: vds_agent_core src must not contain TODO/FIXME/XXX/HACK (FR-10.13)
+        entry: python3 scripts/check-no-debug-markers.py
+        language: system
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: vds-agent-core-future-annotations
+        name: vds_agent_core src (non-init) must have from __future__ import annotations (FR-10.13)
+        entry: python3 scripts/check-future-annotations.py
+        language: system
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: vds-agent-core-no-unittest
+        name: vds_agent_core tests must not use unittest.TestCase or self.assert* (FR-10.13)
+        entry: python3 scripts/check-no-unittest.py
+        language: system
+        pass_filenames: false
+        stages: [pre-commit]

package/skills/vds-skill/vds-scripts/.ruffignore

@@ -0,0 +1,3 @@
+# Ruff ignore patterns (gitignore-style)
+# Intentional non-compliant fixtures that cause E902 syntax errors
+**/python-noncompliant/**

package/skills/vds-skill/vds-scripts/.secrets.baseline

@@ -0,0 +1,133 @@
+{
+  "version": "1.5.0",
+  "plugins_used": [
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "name": "Base64HighEntropyString",
+      "limit": 4.5
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "DiscordBotTokenDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "name": "GitLabTokenDetector"
+    },
+    {
+      "name": "HexHighEntropyString",
+      "limit": 3.0
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "IPPublicDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "name": "KeywordDetector",
+      "keyword_exclude": ""
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "OpenAIDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "PypiTokenDetector"
+    },
+    {
+      "name": "SendGridDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TelegramBotTokenDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "filters_used": [
+    {
+      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
+      "min_level": 2
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_lock_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_sequential_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_swagger_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    },
+    {
+      "path": "detect_secrets.filters.regex.should_exclude_file",
+      "pattern": [
+        ".*"
+      ]
+    }
+  ],
+  "results": {},
+  "generated_at": "2026-01-29T05:10:47Z"
+}