@ngocsangairvds/vsaf 4.1.8 → 4.1.9

package/skills/vds-skill/vds-scripts/.github/workflows/lint-and-test.yml

@@ -1,90 +0,0 @@
-name: Lint, Type, Test & Standardize
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-    branches: [master]
-
-env:
-  PYTHON_VERSION: "3.14"
-
-jobs:
-  ruff:
-    name: Ruff lint + format check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
-        with:
-          version: "latest"
-      - name: Run ruff check (changed files only)
-        run: |
-          # Phase 3: diff-based — only lint files changed in this PR/branch
-          git diff --name-only HEAD^ HEAD -- "*.py" "*.pyi" | xargs -I{} uv run ruff check {} --no-fix || true
-      - name: Run ruff format check (changed files only)
-        run: |
-          git diff --name-only HEAD^ HEAD -- "*.py" "*.pyi" | xargs -I{} uv run ruff format --check {} || true
-
-  mypy:
-    name: mypy type check (CLI packages)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
-        with:
-          version: "latest"
-      - name: Install workspace
-        run: uv sync --all-packages --extra dev
-      - name: Run mypy on CLI packages
-        run: uv run mypy vds_cli/src/ vds_cli_common/src/ platform_core/src/
-
-  pytest-cli:
-    name: pytest CLI packages + coverage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
-        with:
-          version: "latest"
-      - name: Install workspace
-        run: uv sync --all-packages --extra dev
-      - name: Run pytest with coverage
-        run: |
-          uv run pytest \
-            vds_cli/tests/ \
-            vds_cli_common/tests/ \
-            platform_core/tests/ \
-            --cov=vds_cli \
-            --cov=vds_cli_common \
-            --cov=platform_core \
-            --cov-report=term \
-            -q --tb=short
-
-  validate-cli:
-    name: CLI standardization validation
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
-        with:
-          version: "latest"
-      - name: Install workspace
-        run: uv sync --project vds_cli --extra dev
-      - name: Run standardization check
-        run: bash scripts/validate-cli-standardization.sh
-      - name: Run alias removal check
-        run: uv run python scripts/_validate_alias_phase2.py
-
-  import-linter:
-    name: Import dependency contract
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
-        with:
-          version: "latest"
-      - name: Install workspace
-        run: uv sync --all-packages --extra dev
-      - name: Run import-linter
-        run: uv run lint-imports || true

package/skills/vds-skill/vds-scripts/.github/workflows/scheduler-load-smoke.yml

@@ -1,104 +0,0 @@
-name: Scheduler Load Smoke (1-min)
-
-# TSK-8.4: 60-second smoke test against /health in stub mode (no DB required).
-# Validates that the FastAPI app starts correctly and responds within NFR bounds.
-#
-# Full 5-scenario baselines (S1-S5, ~85 min) are manual-only:
-#   bash scheduler_orchestrator/tests/load/run_baselines.sh
-#
-# NFR gate: GET /health p99 <= 1000 ms (validated by nfr_check.py --scenario smoke)
-#
-# Security: no github.event.* input is interpolated into run: steps.
-# All run: blocks use static strings or env-var references only.
-
-on:
-  pull_request:
-    paths:
-      - 'scheduler_orchestrator/**'
-      - '.github/workflows/scheduler-load-smoke.yml'
-  push:
-    branches:
-      - master
-    paths:
-      - 'scheduler_orchestrator/**'
-
-jobs:
-  load-smoke:
-    name: Scheduler load smoke (60 s)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    env:
-      # Stub mode: no Postgres required; only /health is tested in this job.
-      VDS_SCHEDULER_ENABLED: "false"
-      PYTHONUNBUFFERED: "1"
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v3
-
-      - name: Sync scheduler_orchestrator dev dependencies
-        # Installs locust + all dev deps defined in pyproject.toml [dev].
-        run: uv sync --extra dev
-        working-directory: scheduler_orchestrator
-
-      - name: Start FastAPI in stub mode
-        # Background: VDS_SCHEDULER_ENABLED=false means no DBOS/Postgres needed.
-        run: |
-          uv run uvicorn vds_scheduler_orchestrator.app:app \
-            --host 127.0.0.1 --port 8000 --log-level warning &
-          echo "FASTAPI_PID=$!" >> "$GITHUB_ENV"
-        working-directory: scheduler_orchestrator
-
-      - name: Wait for API readiness
-        run: |
-          for i in $(seq 1 15); do
-            if curl -sf http://127.0.0.1:8000/health; then
-              echo "API ready after ${i}s"
-              break
-            fi
-            sleep 2
-          done
-
-      - name: Run 60-second Locust smoke
-        run: |
-          uv run locust \
-            --locustfile tests/load/smoke.py \
-            --headless \
-            --users 5 \
-            --spawn-rate 5 \
-            --run-time 60s \
-            --host http://127.0.0.1:8000 \
-            --csv /tmp/smoke \
-            --only-summary
-        working-directory: scheduler_orchestrator
-
-      - name: Validate NFR gate (smoke p99 <= 1000 ms)
-        run: |
-          uv run python tests/load/nfr_check.py \
-            --scenario smoke \
-            /tmp/smoke_stats.csv
-        working-directory: scheduler_orchestrator
-
-      - name: Upload smoke CSV artifacts
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: smoke-locust-csv
-          path: /tmp/smoke_*.csv
-          retention-days: 7
-
-      - name: Stop API process
-        if: always()
-        run: |
-          if [ -n "${FASTAPI_PID}" ]; then
-            kill "${FASTAPI_PID}" 2>/dev/null || true
-          fi

package/skills/vds-skill/vds-scripts/.github/workflows/telegram-bridge-ci.yml

@@ -1,131 +0,0 @@
-name: Telegram Bridge — Tier 1 CI
-
-# Spec ref: telegram_bridge/skill_content/references/verification.md §Tier 1
-# Closes:   AC-1.13 (gate-enforcing CI workflow — operator-deferred half)
-# Gate:     >= 75% overall coverage (AC-1.13 / NFR-1.1), enforced via
-#           --cov-fail-under=75 inside verify-tier1.sh
-#
-# The canonical verification entry point is:
-#   telegram_bridge/scripts/verify-tier1.sh
-# This workflow wraps that script so the same gate runs locally and in CI.
-
-on:
-  push:
-    paths:
-      - "telegram_bridge/**"
-      - ".github/workflows/telegram-bridge-ci.yml"
-  pull_request:
-    paths:
-      - "telegram_bridge/**"
-
-# Cancel in-progress runs on the same ref so a force-push does not queue stale
-# runs behind the new one.  github.event_name is included in the group key so a
-# push run and a PR run on the same ref do not cancel each other.
-concurrency:
-  group: "telegram-bridge-ci-${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}"
-  cancel-in-progress: true
-
-env:
-  PYTHON_VERSION: "3.14"
-
-jobs:
-  # -- Fast path-filter check ---------------------------------------------------
-  # dorny/paths-filter compares changed files against the PR base (or the
-  # preceding commit for push events).  If no telegram_bridge/** file changed
-  # -- e.g. a PR that only touches vds_cli or scheduler_orchestrator -- the
-  # expensive tier1 job is skipped entirely, saving install + pyarrow build time.
-  path-changed:
-    name: Detect changed paths
-    runs-on: ubuntu-latest
-    outputs:
-      telegram: ${{ steps.filter.outputs.telegram }}
-    steps:
-      - name: Checkout (full depth for base-commit diff)
-        # fetch-depth 0 ensures dorny can resolve the base ref for push events.
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Filter -- telegram_bridge/**
-        id: filter
-        # dorny/paths-filter v3 -- outputs a boolean per named filter.
-        # See: https://github.com/dorny/paths-filter
-        uses: dorny/paths-filter@v3
-        with:
-          filters: |
-            telegram:
-              - "telegram_bridge/**"
-              - ".github/workflows/telegram-bridge-ci.yml"
-
-  # -- Tier 1 gate --------------------------------------------------------------
-  # Runs the full unit + acceptance suite and enforces the >=75% coverage gate.
-  # Mirrors the local command documented in:
-  #   telegram_bridge/skill_content/references/verification.md -- Tier 1
-  #
-  # Pass criteria (verification.md -- Tier 1):
-  #   - All tests pass (448 passed, 29 skipped as of v1.0.13)
-  #   - Overall coverage >= 75% (gate is --cov-fail-under=75)
-  #   - Exit code 0 from verify-tier1.sh means AC-1.13 / NFR-1.1 PASS
-  tier1:
-    name: "Tier 1 -- unit + acceptance (>=75% coverage)"
-    runs-on: ubuntu-latest
-    needs: path-changed
-    # Skip when no telegram_bridge files changed to avoid unnecessary installs.
-    if: needs.path-changed.outputs.telegram == 'true'
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      # Install uv -- matches the astral-sh/setup-uv@v4 convention used in
-      # .github/workflows/lint-and-test.yml and chaos-smoke.yml.
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
-        with:
-          version: "latest"
-
-      # Install Python 3.14 via uv.  uv manages the interpreter directly so
-      # actions/setup-python is not required alongside setup-uv.
-      - name: Install Python
-        run: uv python install "$PYTHON_VERSION"
-        env:
-          PYTHON_VERSION: ${{ env.PYTHON_VERSION }}
-
-      # Sync all workspace packages so telegram_bridge and every dependency
-      # (including pyarrow, required by the parquet cold-rotation tests in
-      # test_rotate_audit.py) are available in .venv.
-      #
-      # Latency note: pyarrow may take 60-120 s to build from source when
-      # a pre-built wheel is unavailable for the exact Python version/platform.
-      # uv's cache layer (auto-enabled by setup-uv) mitigates this on repeat
-      # runs within the same workflow or runner pool.
-      - name: Install workspace deps (uv sync --all-packages)
-        run: uv sync --all-packages
-
-      # Run the canonical Tier 1 entry point.
-      # verify-tier1.sh resolves the venv python from WT_ROOT/.venv/bin/python,
-      # so it works regardless of the GH Actions working directory.
-      #
-      # Exit codes (from verify-tier1.sh):
-      #   0 -- all tests pass + coverage >= 75%   --> gate GREEN
-      #   1 -- test failure
-      #   2 -- coverage below 75% gate            --> AC-1.13 FAIL
-      #
-      # Output is tee'd to a file so it is uploadable as an artifact even when
-      # the step fails.  GH Actions uses bash with -o pipefail by default, so
-      # the pipe exit code propagates correctly (left-side failure = step failure).
-      - name: "Run Tier 1 verification (>=75% coverage gate -- AC-1.13 / NFR-1.1)"
-        run: |
-          bash telegram_bridge/scripts/verify-tier1.sh 2>&1 | tee verify-tier1-output.txt
-
-      # Upload the captured terminal output as a CI artifact.
-      # 'if: always()' ensures this runs even when the tier1 step fails so
-      # coverage details are always inspectable from the Actions UI.
-      - name: Upload Tier 1 output artifact
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          # Unique artifact name per run + attempt avoids collisions on re-runs.
-          name: "verify-tier1-output-${{ github.run_id }}-${{ github.run_attempt }}"
-          path: verify-tier1-output.txt
-          if-no-files-found: warn

package/skills/vds-skill/vds-scripts/.graphifyignore

@@ -1,29 +0,0 @@
-# vds-scripts .graphifyignore
-# Exclude build artifacts, caches, and non-source content
-
-# Python
-.venv/
-__pycache__/
-*.pyc
-*.pyo
-*.egg-info/
-.mypy_cache/
-.pytest_cache/
-.ruff_cache/
-.tox/
-site-packages/
-
-# Build/dist
-dist/
-build/
-
-# Graphify output
-graphify-out/
-
-# Large generated files
-*.sqlite3
-*.db
-htmlcov/
-
-# Archive/historical
-scripts/archive/

package/skills/vds-skill/vds-scripts/.importlinter

@@ -1,86 +0,0 @@
-[importlinter]
-# Root packages that participate in contracts. Kept to workspace members so
-# `lint-imports` resolves them in the workspace venv without extra sync steps.
-# TSK-7.12b will expand this set to include `vds_platform_core` once that
-# package is added to `tool.uv.workspace.members` (part of TSK-7.12a scope).
-root_packages =
-    vds_agent_core
-    vds_cli_common
-    vds_platform_core
-include_external_packages = True
-
-# --- No-op seed contract ---
-#
-# TSK-7.0 (Phase 7, v24.2.0) installs import-linter and seeds this file with a
-# contract that always passes, so CI can wire up `lint-imports` before
-# TSK-7.12b adds the real layering invariant.
-#
-# TSK-7.12b will append a "forbidden" contract of the form:
-#
-#   [importlinter:contract:platform-core-no-vds-cli-common]
-#   name = platform_core must not depend on vds_cli_common
-#   type = forbidden
-#   source_modules = vds_platform_core
-#   forbidden_modules = vds_cli_common
-#
-# That contract makes the Layer 1 -> Layer 2 inversion (DEFAULT_ENV_PATHS lazy
-# import at config.py:20-23) a build-break rather than a runtime-only warning.
-
-[importlinter:contract:platform-core-no-vds-cli-common]
-name = platform_core must not depend on vds_cli_common
-type = forbidden
-source_modules =
-    vds_platform_core
-forbidden_modules =
-    vds_cli_common
-
-# --- Phase 9 FR-9 boundary contract (added 2026-04-30) ---
-#
-# Encodes the spec mandate from `vds-agent-core-alignment` requirements.md
-# that `vds_agent_core` depends ONLY on `vds_cli_common` + `vds_platform_core`.
-# Wave 33 dependency-chain audit verified the runtime state is clean; this
-# contract makes future regressions a CI build-break instead of a manual-grep
-# discovery. Replaces the `phase7-seed-noop` seed (deleted 2026-04-30).
-#
-# Forbidden modules: every workspace orchestrator. If a new orchestrator
-# joins the workspace, add it here.
-
-[importlinter:contract:agent-core-isolation]
-name = vds_agent_core must not depend on any orchestrator
-type = forbidden
-source_modules =
-    vds_agent_core
-forbidden_modules =
-    vds_audit_orchestrator
-    vds_memory_orchestrator
-    vds_scheduler_orchestrator
-    vds_multi_agent_orchestrator
-    vds_progress_report_orchestrator
-    vds_research_orchestrator
-    vds_spec_orchestrator
-    vds_task_orchestrator
-    vds_evolution
-    vds_confluence_orchestrator
-    vds_bitbucket_orchestrator
-    vds_jira_orchestrator
-    vds_grafana_orchestrator
-    vds_sonarqube_orchestrator
-    vds_elastic_orchestrator
-    vds_brd_orchestrator
-    vds_circular_dependency_orchestrator
-    vds_db_query_orchestrator
-    vds_excel_orchestrator
-    vds_git_orchestrator
-    vds_google_sheets_orchestrator
-    vds_hexagonal_orchestrator
-    vds_intellij_orchestrator
-    vds_links_orchestrator
-    vds_lsp_orchestrator
-    vds_markdown_orchestrator
-    vds_metabase_orchestrator
-    vds_openapi_orchestrator
-    vds_pdf_orchestrator
-    vds_public_interface_boundary_orchestrator
-    vds_structure_orchestrator
-    vds_sync_orchestrator
-    vds_cli

package/skills/vds-skill/vds-scripts/.mcp.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "code-review-graph": {
-      "command": "uvx",
-      "args": [
-        "code-review-graph",
-        "serve"
-      ]
-    }
-  }
-}

package/skills/vds-skill/vds-scripts/.pre-commit-config.yaml

@@ -1,62 +0,0 @@
-# Pre-commit configuration for WHO-project/vds-scripts.
-#
-# The local hook below was introduced after commit 4e2cd398 to prevent
-# re-committing the antipatterns that crashed Bitbucket Server's /browse UI
-# with "500 UNKNOWN": macOS .nosync symlinks, absolute-path symlinks,
-# Finder rename-conflict artifacts, and committed worktree directories.
-#
-# Install once per checkout:
-#   uv tool install pre-commit   # or: pipx install pre-commit
-#   pre-commit install
-repos:
-  - repo: local
-    hooks:
-      - id: check-invalid-symlinks
-        name: Block invalid symlinks, committed worktrees, and macOS rename-conflict files
-        entry: python3 scripts/check-invalid-symlinks.py
-        language: system
-        pass_filenames: false
-        always_run: true
-        stages: [pre-commit]
-
-      - id: agent-core-isolation
-        name: vds_agent_core must not import orchestrators (FR-10.12)
-        entry: .venv/bin/lint-imports --contract agent-core-isolation
-        language: system
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: vds-agent-core-no-legacy-typing
-        name: vds_agent_core must use modern typing (no UP006/UP007/UP035) (FR-10.13)
-        entry: .venv/bin/ruff check vds_agent_core/src/ --select UP006,UP007,UP035 --quiet
-        language: system
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: vds-agent-core-use-pathlib
-        name: vds_agent_core must use pathlib not os.path (FR-10.13)
-        entry: .venv/bin/ruff check vds_agent_core/src/ --select PTH --quiet
-        language: system
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: vds-agent-core-no-debug-markers
-        name: vds_agent_core src must not contain TODO/FIXME/XXX/HACK (FR-10.13)
-        entry: python3 scripts/check-no-debug-markers.py
-        language: system
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: vds-agent-core-future-annotations
-        name: vds_agent_core src (non-init) must have from __future__ import annotations (FR-10.13)
-        entry: python3 scripts/check-future-annotations.py
-        language: system
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: vds-agent-core-no-unittest
-        name: vds_agent_core tests must not use unittest.TestCase or self.assert* (FR-10.13)
-        entry: python3 scripts/check-no-unittest.py
-        language: system
-        pass_filenames: false
-        stages: [pre-commit]

package/skills/vds-skill/vds-scripts/.ruffignore

@@ -1,3 +0,0 @@
-# Ruff ignore patterns (gitignore-style)
-# Intentional non-compliant fixtures that cause E902 syntax errors
-**/python-noncompliant/**

package/skills/vds-skill/vds-scripts/.secrets.baseline

@@ -1,133 +0,0 @@
-{
-  "version": "1.5.0",
-  "plugins_used": [
-    {
-      "name": "ArtifactoryDetector"
-    },
-    {
-      "name": "AWSKeyDetector"
-    },
-    {
-      "name": "AzureStorageKeyDetector"
-    },
-    {
-      "name": "Base64HighEntropyString",
-      "limit": 4.5
-    },
-    {
-      "name": "BasicAuthDetector"
-    },
-    {
-      "name": "CloudantDetector"
-    },
-    {
-      "name": "DiscordBotTokenDetector"
-    },
-    {
-      "name": "GitHubTokenDetector"
-    },
-    {
-      "name": "GitLabTokenDetector"
-    },
-    {
-      "name": "HexHighEntropyString",
-      "limit": 3.0
-    },
-    {
-      "name": "IbmCloudIamDetector"
-    },
-    {
-      "name": "IbmCosHmacDetector"
-    },
-    {
-      "name": "IPPublicDetector"
-    },
-    {
-      "name": "JwtTokenDetector"
-    },
-    {
-      "name": "KeywordDetector",
-      "keyword_exclude": ""
-    },
-    {
-      "name": "MailchimpDetector"
-    },
-    {
-      "name": "NpmDetector"
-    },
-    {
-      "name": "OpenAIDetector"
-    },
-    {
-      "name": "PrivateKeyDetector"
-    },
-    {
-      "name": "PypiTokenDetector"
-    },
-    {
-      "name": "SendGridDetector"
-    },
-    {
-      "name": "SlackDetector"
-    },
-    {
-      "name": "SoftlayerDetector"
-    },
-    {
-      "name": "SquareOAuthDetector"
-    },
-    {
-      "name": "StripeDetector"
-    },
-    {
-      "name": "TelegramBotTokenDetector"
-    },
-    {
-      "name": "TwilioKeyDetector"
-    }
-  ],
-  "filters_used": [
-    {
-      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
-    },
-    {
-      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
-      "min_level": 2
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_lock_file"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_sequential_string"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_swagger_file"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_templated_secret"
-    },
-    {
-      "path": "detect_secrets.filters.regex.should_exclude_file",
-      "pattern": [
-        ".*"
-      ]
-    }
-  ],
-  "results": {},
-  "generated_at": "2026-01-29T05:10:47Z"
-}