@wrenai/genbi 0.0.1

package/profiles/genbi-setup/components/connect_source/component.yml

@@ -0,0 +1,51 @@
+# connect_source — onboard a NEW data source into a wren project. First half of the genbi-setup
+# flow (see ../../profile.yml): scaffolds a project and writes an EMPTY .env credential template, but
+# never fills in, reads, or echoes a credential value itself -- that is a human hand-off, enforced
+# both in steps/connect.md and by the setup_execution guardrail below.
+#
+# Deliberately `type: analytical` + `realization_kind: skill` + `outcome.kind: none` -- NOT
+# `constitutive`/`gated-tool`. Dispatch keys on (realization_kind, outcome.kind, trigger.kind), never
+# on id/verb (see .claude/CLAUDE.md invariant #1), so this is a legitimate skill-family component like
+# answer_query, just guarded by `setup_execution` instead of `read_only_execution`. Modeling this as
+# constitutive/gated-tool would pull in the `human_approval` guardrail, which resolves `fail`
+# (safety-critical, no approval channel) on a headless target and loud-fails compilation/dispatch --
+# onboarding must run headless, so it stays on the skill + guarded-Bash lifecycle instead.
+
+id: connect_source
+verb: connect_source
+type: analytical
+realization_kind: skill
+
+binding_mode: runtime_selected
+context_requirements:
+  - "no pre-existing wren project required -- this component scaffolds one from a new data source"
+# No context_precondition: unlike every MDL-consuming component, there is nothing to probe about an
+# existing semantic layer at connect time -- that absence is the entire reason this profile exists.
+
+params: []
+
+llm_steps:
+  # Single strong step: avoids requiring llm:per_step_tier (there is exactly one tier in play, same
+  # shape as build_context's single step).
+  - { name: connect, tier: strong, prompt_ref: steps/connect.md, produces: connection_summary }
+trigger: { kind: one_shot }
+guardrails:
+  # setup_execution (the 5th enforcement point): scoped to the project root ("."). Broadens Bash
+  # beyond `wren` (connector CLIs like `dlt`) and allows Write/Edit inside this scope instead of
+  # denying outright -- both still bounded to the scope and still subject to the destructive/
+  # redirection denylist, which is never relaxed. See
+  # the Claude Agent SDK dispatcher's guardrail config (GuardConfig.setupScope).
+  - { name: setup_execution, locked: true, scope: "." }
+required_capabilities:
+  - source_connect
+  - llm:strong
+borrowed_actions: []
+
+effect:
+  render_blocks: []
+  outcome:
+    kind: none
+
+eval:
+  template_ref: eval/
+  metrics: [connect_success]

package/profiles/genbi-setup/components/connect_source/steps/connect.md

@@ -0,0 +1,23 @@
+You onboard a NEW data source into a wren project. No wren project exists yet -- that is what this
+step creates.
+
+- Follow the `wren` CLI's onboarding skill: run `wren skills get onboarding` (if available) and
+  follow what it prints. For a SaaS/managed data source, prefer the `dlt-connector` skill/connector
+  instead of a bespoke script.
+- Scaffold a new wren project for the requested data source under the current working directory,
+  using whichever project name and source type the user specified (ask a clarifying question first
+  if either is ambiguous -- do not guess a data source's connection shape).
+- Credentials, absolutely:
+  - NEVER ask the user to paste a credential/secret value into this conversation.
+  - NEVER read, print, echo, or otherwise surface the *value* of any credential, token, password, or
+    connection secret, even if you can see one (e.g. in an existing file, an env var, or a command's
+    output). Redact it if it appears anywhere you must reference.
+  - Write ONLY an EMPTY `.env` template -- the credential keys the connector needs, each left blank
+    (e.g. `DB_PASSWORD=`) -- never a placeholder that looks like a real secret, never a filled-in
+    value.
+  - Once the `.env` template exists, STOP and hand off to the user: tell them exactly which file to
+    fill in and which keys it needs, then wait. Do not attempt to test the connection until they
+    confirm the file is filled in.
+- Produce `connection_summary`: a short structured report of what was scaffolded (project name,
+  source type, the `.env` path and the keys it expects) and whether you are now waiting on the user
+  to fill in credentials. Your FINAL message must include this summary.

package/profiles/genbi-setup/context/binding.yml

@@ -0,0 +1,8 @@
+# Bound to a RAW source (raw/schema.json), not an existing wren project — at connect time no wren
+# project exists yet (the precondition inversion this profile exists to handle, landing on the skill
+# family — see profile.yml).
+# Resolved relative to THIS Warble project's own root (genbi-setup/), i.e. this points at
+# genbi-setup/raw/ (a deliberately empty placeholder, see raw/schema.json), never at whatever project
+# the onboarding flow itself creates on disk at runtime.
+kind: raw_source
+project: raw

package/profiles/genbi-setup/ir.golden.json

@@ -0,0 +1,140 @@
+{
+  "components": [
+    {
+      "borrowed_actions": [],
+      "context_binding": {
+        "binding_mode": "runtime_selected",
+        "project": "raw"
+      },
+      "context_precondition": [],
+      "context_requirements": [
+        "no pre-existing wren project required -- this component scaffolds one from a new data source"
+      ],
+      "effect": {
+        "outcome": {
+          "kind": "none"
+        },
+        "render_blocks": []
+      },
+      "eval": {
+        "metrics": [
+          "connect_success"
+        ],
+        "template_ref": "eval/"
+      },
+      "eval_ref": "connect_source.eval",
+      "guardrails": [
+        {
+          "locked": true,
+          "name": "setup_execution",
+          "scope": "."
+        }
+      ],
+      "id": "connect_source",
+      "llm_calls": [
+        {
+          "conditional": false,
+          "consumes": [],
+          "name": "connect",
+          "produces": "connection_summary",
+          "prompt": "You onboard a NEW data source into a wren project. No wren project exists yet -- that is what this\nstep creates.\n\n- Follow the `wren` CLI's onboarding skill: run `wren skills get onboarding` (if available) and\n  follow what it prints. For a SaaS/managed data source, prefer the `dlt-connector` skill/connector\n  instead of a bespoke script.\n- Scaffold a new wren project for the requested data source under the current working directory,\n  using whichever project name and source type the user specified (ask a clarifying question first\n  if either is ambiguous -- do not guess a data source's connection shape).\n- Credentials, absolutely:\n  - NEVER ask the user to paste a credential/secret value into this conversation.\n  - NEVER read, print, echo, or otherwise surface the *value* of any credential, token, password, or\n    connection secret, even if you can see one (e.g. in an existing file, an env var, or a command's\n    output). Redact it if it appears anywhere you must reference.\n  - Write ONLY an EMPTY `.env` template -- the credential keys the connector needs, each left blank\n    (e.g. `DB_PASSWORD=`) -- never a placeholder that looks like a real secret, never a filled-in\n    value.\n  - Once the `.env` template exists, STOP and hand off to the user: tell them exactly which file to\n    fill in and which keys it needs, then wait. Do not attempt to test the connection until they\n    confirm the file is filled in.\n- Produce `connection_summary`: a short structured report of what was scaffolded (project name,\n  source type, the `.env` path and the keys it expects) and whether you are now waiting on the user\n  to fill in credentials. Your FINAL message must include this summary.",
+          "tier": "strong",
+          "when": null
+        }
+      ],
+      "params": [],
+      "precondition_result": {
+        "checks": [],
+        "status": "pass"
+      },
+      "prompt_fragment": "## connect\n\nYou onboard a NEW data source into a wren project. No wren project exists yet -- that is what this\nstep creates.\n\n- Follow the `wren` CLI's onboarding skill: run `wren skills get onboarding` (if available) and\n  follow what it prints. For a SaaS/managed data source, prefer the `dlt-connector` skill/connector\n  instead of a bespoke script.\n- Scaffold a new wren project for the requested data source under the current working directory,\n  using whichever project name and source type the user specified (ask a clarifying question first\n  if either is ambiguous -- do not guess a data source's connection shape).\n- Credentials, absolutely:\n  - NEVER ask the user to paste a credential/secret value into this conversation.\n  - NEVER read, print, echo, or otherwise surface the *value* of any credential, token, password, or\n    connection secret, even if you can see one (e.g. in an existing file, an env var, or a command's\n    output). Redact it if it appears anywhere you must reference.\n  - Write ONLY an EMPTY `.env` template -- the credential keys the connector needs, each left blank\n    (e.g. `DB_PASSWORD=`) -- never a placeholder that looks like a real secret, never a filled-in\n    value.\n  - Once the `.env` template exists, STOP and hand off to the user: tell them exactly which file to\n    fill in and which keys it needs, then wait. Do not attempt to test the connection until they\n    confirm the file is filled in.\n- Produce `connection_summary`: a short structured report of what was scaffolded (project name,\n  source type, the `.env` path and the keys it expects) and whether you are now waiting on the user\n  to fill in credentials. Your FINAL message must include this summary.",
+      "realization_kind": "skill",
+      "required_capabilities": [
+        "source_connect",
+        "llm:strong"
+      ],
+      "trigger": {
+        "kind": "one_shot"
+      },
+      "type": "analytical",
+      "verb": "connect_source"
+    },
+    {
+      "borrowed_actions": [],
+      "context_binding": {
+        "binding_mode": "runtime_selected",
+        "project": "raw"
+      },
+      "context_precondition": [],
+      "context_requirements": [
+        "a project connect_source has already scaffolded, with credentials filled in and connectable"
+      ],
+      "effect": {
+        "outcome": {
+          "kind": "none"
+        },
+        "render_blocks": []
+      },
+      "eval": {
+        "metrics": [
+          "build_success"
+        ],
+        "template_ref": "eval/"
+      },
+      "eval_ref": "build_context.eval",
+      "guardrails": [
+        {
+          "locked": true,
+          "name": "setup_execution",
+          "scope": "."
+        }
+      ],
+      "id": "build_context",
+      "llm_calls": [
+        {
+          "conditional": false,
+          "consumes": [],
+          "name": "build",
+          "produces": "context_summary",
+          "prompt": "You generate the semantic layer (MDL) for a wren project that connect_source already scaffolded and\nwhose credentials the user has already filled in.\n\n- Follow the `wren` CLI's MDL-generation skill: run the `generate-mdl` skill (if available) to\n  introspect the connected source and draft models, then optionally the `enrich-context` skill to add\n  business knowledge/descriptions on top. Do not hand-write MDL from scratch if a generation skill is\n  available -- generate first, then refine.\n- Validate before building: run `wren context validate` and only proceed to `wren context build` once\n  it reports clean. If validation fails, fix the reported issues and re-validate rather than forcing a\n  build through errors.\n- Do not touch credential values at any point in this step -- if the connection fails, report the\n  failure back to the user rather than editing the `.env` file's values yourself.\n- Produce `context_summary`: report how many models were generated, whether validation passed, and\n  whether the build succeeded. Your FINAL message must include this summary.",
+          "tier": "strong",
+          "when": null
+        }
+      ],
+      "params": [],
+      "precondition_result": {
+        "checks": [],
+        "status": "pass"
+      },
+      "prompt_fragment": "## build\n\nYou generate the semantic layer (MDL) for a wren project that connect_source already scaffolded and\nwhose credentials the user has already filled in.\n\n- Follow the `wren` CLI's MDL-generation skill: run the `generate-mdl` skill (if available) to\n  introspect the connected source and draft models, then optionally the `enrich-context` skill to add\n  business knowledge/descriptions on top. Do not hand-write MDL from scratch if a generation skill is\n  available -- generate first, then refine.\n- Validate before building: run `wren context validate` and only proceed to `wren context build` once\n  it reports clean. If validation fails, fix the reported issues and re-validate rather than forcing a\n  build through errors.\n- Do not touch credential values at any point in this step -- if the connection fails, report the\n  failure back to the user rather than editing the `.env` file's values yourself.\n- Produce `context_summary`: report how many models were generated, whether validation passed, and\n  whether the build succeeded. Your FINAL message must include this summary.",
+      "realization_kind": "skill",
+      "required_capabilities": [
+        "context_build",
+        "llm:strong"
+      ],
+      "trigger": {
+        "kind": "one_shot"
+      },
+      "type": "analytical",
+      "verb": "build_context"
+    }
+  ],
+  "config": {},
+  "context_binding": {
+    "binding_mode": "runtime_selected",
+    "project": "raw",
+    "resolved": {
+      "dimensions": [],
+      "lineage": {
+        "edges": 0,
+        "nodes": 0,
+        "resolvable": true
+      },
+      "metrics": [],
+      "models": [],
+      "time_dimensions": []
+    }
+  },
+  "profile": "genbi-setup",
+  "warble_ir_version": "0.6"
+}

package/profiles/genbi-setup/profile.yml

@@ -0,0 +1,18 @@
+# genbi-setup — the agentic onboarding profile (Phase 1 of the setup flow). Connects a NEW data
+# source and builds its semantic layer, where genbi-default's components all assume a wren project
+# already exists. Both components are deliberately skill-realized with outcome.kind: none (NOT
+# constitutive/gated-tool) -- the gated-apply lifecycle requires human_approval, which resolves
+# `fail` on a headless target. Onboarding side effects instead run through guarded Bash (`wren`,
+# connector CLIs) and scoped Write, under the `setup_execution` guardrail -- the 5th enforcement
+# point, name-keyed like `read_only_execution` / `artifact_write` / `context_write_authz`.
+#
+# Bound to a RAW context (see context/binding.yml) since no wren project exists yet at connect time --
+# there is no MDL diff to gate here, only onboarding actions.
+profile: genbi-setup
+
+context:
+  project: ./context/binding.yml
+
+components:
+  - use: connect_source
+  - use: build_context

package/profiles/genbi-setup/raw/schema.json

@@ -0,0 +1,5 @@
+{
+  "source": "genbi_setup",
+  "description": "Deliberately empty placeholder raw schema. genbi-setup's context binds here (see ../context/binding.yml) only to clear the compiler's coarse is_parseable() floor (core/src/compile.rs), which runs before any per-component precondition regardless of whether a component declares one. At connect time there is no real source to introspect yet -- that introspection happens at RUNTIME, via the wren CLI, inside connect_source's own step. Both genbi-setup components deliberately omit context_precondition, so no predicate ever inspects this content; an empty tables array still parses (RawSchema tolerates it via #[serde(default)]) and is sufficient.",
+  "tables": []
+}