admina-framework 0.13.0__tar.gz → 0.13.2__tar.gz

{admina_framework-0.13.0/admina_framework.egg-info → admina_framework-0.13.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: admina-framework
-Version: 0.13.0
+Version: 0.13.2
 Summary: Admina — governed AI development framework
 Author-email: Stefano Noferi <info@admina.org>
 Maintainer-email: Stefano Noferi <info@admina.org>
@@ -69,7 +69,7 @@ Requires-Dist: ollama<1,>=0.3; extra == "ollama"
 Provides-Extra: anthropic
 Requires-Dist: anthropic<2,>=0.39; extra == "anthropic"
 Provides-Extra: mistral
-Requires-Dist: mistralai<3,>=1.0; extra == "mistral"
+Requires-Dist: mistralai<4,>=1.0; extra == "mistral"
 Provides-Extra: gemini
 Requires-Dist: google-genai<3,>=1.0; extra == "gemini"
 Provides-Extra: bedrock
@@ -258,6 +258,11 @@ pip install admina-framework
 > matters more than that extra coverage. See
 > [Performance](#performance--hybrid-python--rust-engine) for the trade-off.
 
+The PyPI package `admina` is an alias: `pip install admina` installs
+`admina-framework` at the same version, and `admina[X]` installs
+`admina-framework[X]` for every extra above. It has no code of its own, so
+both names install the same `admina` module.
+
 ### Or install from source
 
 ```bash
@@ -439,6 +444,17 @@ dependency: one uvicorn serves the proxy API and the dashboard SPA on the
 same port. Use `--stack` for the production-like Docker compose, or
 `--with-llm` to also boot local LLM services.
 
+Local mode uses the forensic backend of `FORENSIC_BACKEND` or of
+`admina.yaml`, and memory when neither sets one. In the compose file that
+`admina init` writes, the dashboard (`127.0.0.1:3000`), OTEL and the
+`--with-llm` services listen on the loopback interface only; the dashboard
+asks for `ADMINA_DASHBOARD_PASSWORD` and the API key (both shown by
+`admina password show`). The proxy reaches the MCP server at
+`UPSTREAM_MCP_URL` (default `http://host.docker.internal:9000`, an MCP
+server on the host). `CLICKHOUSE_PASSWORD` and `GRAFANA_ADMIN_PASSWORD`
+come from the `.env` that `admina dev` writes; a plain `docker compose up`
+stops when they are not set.
+
 ## Dashboard
 
 Real-time governance dashboard on port 3000:
@@ -858,6 +874,12 @@ one trailing newline removed. A missing, unreadable or empty file, or a key
 set both directly and as a file, stops the proxy; the error names the
 setting and the path, never the key. `ADMINA_FORENSIC_STATE_KEY_FILE` inside
 the forensic directory stops it too: the key must be kept outside the store.
+The built-in `apikey` auth provider reads `ADMINA_API_KEY` from the
+environment only, and is loaded only when it is set there. A key given only
+through `ADMINA_API_KEY_FILE` or `.env` is checked by the authentication
+middleware itself (the same headers, the same constant-time comparison), and
+`POST /api/v1/audit` then stamps `submitted_by: "api_key"` instead of
+`"user:api_key_user"`.
 
 **Forensic store.** `FORENSIC_BACKEND` (`memory`, `filesystem`, `s3`) and
 `FORENSIC_BASE_DIR` choose where the forensic records go. When they are not
@@ -899,7 +921,12 @@ directory (UTC hour of the write, sequence number on eight digits), with
   `admina-forensic/1 record signature` under the chain-state key
   (`ADMINA_FORENSIC_STATE_KEY` or `ADMINA_FORENSIC_STATE_KEY_FILE`, kept
   outside the forensic directory); `record_sig_alg`: `hmac-sha256`. Without
-  a key a record has `record_sig_alg: "none"` and no `record_sig`.
+  a key a record has `record_sig_alg: "none"` and no `record_sig`. Since
+  0.13.1, when a store that holds signed records is opened without its
+  key, the proxy does not start in `closed` fail mode
+  (`ADMINA_FORENSIC_FAIL_MODE`) and logs a warning in `open` mode, where
+  the records it then writes are unsigned (a later verification with the
+  key reports `unsigned`).
 
 The chain state (`_chain_state.json`, with its HMAC-SHA256 in
 `_chain_state.json.sig` when a key is set) holds `record_count`,
@@ -974,7 +1001,10 @@ introduced.
 **Audit records.** `POST /api/v1/audit` records the event it receives with
 `source: "api_v1_audit"` (a `source` in the request is kept as
 `client_source`) and `submitted_by`: the credential the request was admitted
-with (`api_key`, `append_key`, `user:<id>` or `unauthenticated`). An
+with (`api_key`, `append_key`, `user:<id>` or `unauthenticated`). With
+`ADMINA_API_KEY` in the environment the built-in `apikey` auth provider
+admits API-key requests, stamped `user:api_key_user`; `api_key` is the stamp
+when the key comes only from `ADMINA_API_KEY_FILE` or `.env`. An
 `event_type` of the records the proxy writes itself (`mcp_request`,
 `mcp_response`, `gateway_request`, `gateway_response`, `gateway_response_scan`,
 `policy_violation`, `chain_state_rebuilt`) is refused with `400`.
@@ -1423,18 +1453,18 @@ fields are always scanned.
 
 The scan follows the body 32 levels deep: the body is level 0, its fields
 level 1, and the JSON of tool call arguments is at the level of its string.
-A request with a string nested deeper is blocked in `enforce` mode
-(`X-Admina-Would-Action: BLOCK` in `observe` and `dry-run`), and its record
-has `checks.scan_depth = {"action": "BLOCK", "reason":
+With the firewall on, a request with a string nested deeper is blocked in
+`enforce` mode (`X-Admina-Would-Action: BLOCK` in `observe` and `dry-run`),
+and its record has `checks.scan_depth = {"action": "BLOCK", "reason":
 "depth_limit_exceeded"}`. Tool call arguments nested deeper than the JSON
 parser reads are scanned as they are, and the request is blocked the same
 way.
 
-`/mcp` and `/api/v1/validate` scan and redact to the same depth. With the
-firewall or PII redaction on, a request holding a string, or a non-empty
-object or array, past level 32 is blocked the same way, since that text
-would be neither scanned nor redacted. `content` of `/api/v1/validate` must
-be a string.
+`/mcp` scans and redacts to the same depth. With the firewall or PII
+redaction on, a request holding a string, or a non-empty object or array,
+past level 32 is blocked the same way, since that text would be neither
+scanned nor redacted. `content` of `/api/v1/validate` must be a string, so
+that block does not apply there.
 
 #### Scan scope
 
@@ -1479,6 +1509,10 @@ case-sensitive. The caller must keep these tags out of text written by
 untrusted parties, because the gateway cannot tell such text from its own
 blocks.
 
+`ruleset_sha256()` hashes the Admina version too (and the `admina-core`
+version with the Rust engine), so a ruleset hash changes with every release:
+recompute the hashes in `gateway.prescan_rulesets` after each upgrade.
+
 Trust model: with scan policies on, the gateway takes the caller's word for
 what it has scanned. Any caller that holds the API key can send the header,
 and the ruleset it must declare is not a secret (it is on every response and
@@ -1719,7 +1753,10 @@ cd integrations/cheshirecat/admina-plugin
 
 <br>
 
-Governs every LLM call and tool invocation in-process:
+Governs every LLM call and tool invocation in-process. Install
+`admina-framework[proxy,nlp]`: the loop detection that the callbacks turn
+on by default needs scikit-learn from `[proxy]` (or pass
+`loop_detection=False`).
 
 ```python
 from admina.integrations.langchain.callbacks import AdminaCallbackHandler
@@ -1967,6 +2004,14 @@ curl -X POST http://localhost:8080/api/compliance/classify \
 curl http://localhost:8080/api/dashboard/score
 ```
 
+A blocked `/mcp` call is answered with a JSON-RPC error (`-32600`, "Request
+blocked by Admina governance") whose `error.data` holds the `event_id` of
+the forensic record and a `reason`: `injection_detected` (firewall),
+`scan_depth_exceeded` (text nested deeper than the scan depth),
+`egress_refused` (egress policy), `guard_blocked` (a request guard, also a
+guard error under `ADMINA_GUARD_FAIL_MODE=closed`) or `response_blocked`
+(a response guard). Before 0.13.1 every block reported `injection_detected`.
+
 </details>
 
 ## Project documents

{admina_framework-0.13.0 → admina_framework-0.13.2}/README.md

@@ -174,6 +174,11 @@ pip install admina-framework
 > matters more than that extra coverage. See
 > [Performance](#performance--hybrid-python--rust-engine) for the trade-off.
 
+The PyPI package `admina` is an alias: `pip install admina` installs
+`admina-framework` at the same version, and `admina[X]` installs
+`admina-framework[X]` for every extra above. It has no code of its own, so
+both names install the same `admina` module.
+
 ### Or install from source
 
 ```bash
@@ -355,6 +360,17 @@ dependency: one uvicorn serves the proxy API and the dashboard SPA on the
 same port. Use `--stack` for the production-like Docker compose, or
 `--with-llm` to also boot local LLM services.
 
+Local mode uses the forensic backend of `FORENSIC_BACKEND` or of
+`admina.yaml`, and memory when neither sets one. In the compose file that
+`admina init` writes, the dashboard (`127.0.0.1:3000`), OTEL and the
+`--with-llm` services listen on the loopback interface only; the dashboard
+asks for `ADMINA_DASHBOARD_PASSWORD` and the API key (both shown by
+`admina password show`). The proxy reaches the MCP server at
+`UPSTREAM_MCP_URL` (default `http://host.docker.internal:9000`, an MCP
+server on the host). `CLICKHOUSE_PASSWORD` and `GRAFANA_ADMIN_PASSWORD`
+come from the `.env` that `admina dev` writes; a plain `docker compose up`
+stops when they are not set.
+
 ## Dashboard
 
 Real-time governance dashboard on port 3000:
@@ -774,6 +790,12 @@ one trailing newline removed. A missing, unreadable or empty file, or a key
 set both directly and as a file, stops the proxy; the error names the
 setting and the path, never the key. `ADMINA_FORENSIC_STATE_KEY_FILE` inside
 the forensic directory stops it too: the key must be kept outside the store.
+The built-in `apikey` auth provider reads `ADMINA_API_KEY` from the
+environment only, and is loaded only when it is set there. A key given only
+through `ADMINA_API_KEY_FILE` or `.env` is checked by the authentication
+middleware itself (the same headers, the same constant-time comparison), and
+`POST /api/v1/audit` then stamps `submitted_by: "api_key"` instead of
+`"user:api_key_user"`.
 
 **Forensic store.** `FORENSIC_BACKEND` (`memory`, `filesystem`, `s3`) and
 `FORENSIC_BASE_DIR` choose where the forensic records go. When they are not
@@ -815,7 +837,12 @@ directory (UTC hour of the write, sequence number on eight digits), with
   `admina-forensic/1 record signature` under the chain-state key
   (`ADMINA_FORENSIC_STATE_KEY` or `ADMINA_FORENSIC_STATE_KEY_FILE`, kept
   outside the forensic directory); `record_sig_alg`: `hmac-sha256`. Without
-  a key a record has `record_sig_alg: "none"` and no `record_sig`.
+  a key a record has `record_sig_alg: "none"` and no `record_sig`. Since
+  0.13.1, when a store that holds signed records is opened without its
+  key, the proxy does not start in `closed` fail mode
+  (`ADMINA_FORENSIC_FAIL_MODE`) and logs a warning in `open` mode, where
+  the records it then writes are unsigned (a later verification with the
+  key reports `unsigned`).
 
 The chain state (`_chain_state.json`, with its HMAC-SHA256 in
 `_chain_state.json.sig` when a key is set) holds `record_count`,
@@ -890,7 +917,10 @@ introduced.
 **Audit records.** `POST /api/v1/audit` records the event it receives with
 `source: "api_v1_audit"` (a `source` in the request is kept as
 `client_source`) and `submitted_by`: the credential the request was admitted
-with (`api_key`, `append_key`, `user:<id>` or `unauthenticated`). An
+with (`api_key`, `append_key`, `user:<id>` or `unauthenticated`). With
+`ADMINA_API_KEY` in the environment the built-in `apikey` auth provider
+admits API-key requests, stamped `user:api_key_user`; `api_key` is the stamp
+when the key comes only from `ADMINA_API_KEY_FILE` or `.env`. An
 `event_type` of the records the proxy writes itself (`mcp_request`,
 `mcp_response`, `gateway_request`, `gateway_response`, `gateway_response_scan`,
 `policy_violation`, `chain_state_rebuilt`) is refused with `400`.
@@ -1339,18 +1369,18 @@ fields are always scanned.
 
 The scan follows the body 32 levels deep: the body is level 0, its fields
 level 1, and the JSON of tool call arguments is at the level of its string.
-A request with a string nested deeper is blocked in `enforce` mode
-(`X-Admina-Would-Action: BLOCK` in `observe` and `dry-run`), and its record
-has `checks.scan_depth = {"action": "BLOCK", "reason":
+With the firewall on, a request with a string nested deeper is blocked in
+`enforce` mode (`X-Admina-Would-Action: BLOCK` in `observe` and `dry-run`),
+and its record has `checks.scan_depth = {"action": "BLOCK", "reason":
 "depth_limit_exceeded"}`. Tool call arguments nested deeper than the JSON
 parser reads are scanned as they are, and the request is blocked the same
 way.
 
-`/mcp` and `/api/v1/validate` scan and redact to the same depth. With the
-firewall or PII redaction on, a request holding a string, or a non-empty
-object or array, past level 32 is blocked the same way, since that text
-would be neither scanned nor redacted. `content` of `/api/v1/validate` must
-be a string.
+`/mcp` scans and redacts to the same depth. With the firewall or PII
+redaction on, a request holding a string, or a non-empty object or array,
+past level 32 is blocked the same way, since that text would be neither
+scanned nor redacted. `content` of `/api/v1/validate` must be a string, so
+that block does not apply there.
 
 #### Scan scope
 
@@ -1395,6 +1425,10 @@ case-sensitive. The caller must keep these tags out of text written by
 untrusted parties, because the gateway cannot tell such text from its own
 blocks.
 
+`ruleset_sha256()` hashes the Admina version too (and the `admina-core`
+version with the Rust engine), so a ruleset hash changes with every release:
+recompute the hashes in `gateway.prescan_rulesets` after each upgrade.
+
 Trust model: with scan policies on, the gateway takes the caller's word for
 what it has scanned. Any caller that holds the API key can send the header,
 and the ruleset it must declare is not a secret (it is on every response and
@@ -1635,7 +1669,10 @@ cd integrations/cheshirecat/admina-plugin
 
 <br>
 
-Governs every LLM call and tool invocation in-process:
+Governs every LLM call and tool invocation in-process. Install
+`admina-framework[proxy,nlp]`: the loop detection that the callbacks turn
+on by default needs scikit-learn from `[proxy]` (or pass
+`loop_detection=False`).
 
 ```python
 from admina.integrations.langchain.callbacks import AdminaCallbackHandler
@@ -1883,6 +1920,14 @@ curl -X POST http://localhost:8080/api/compliance/classify \
 curl http://localhost:8080/api/dashboard/score
 ```
 
+A blocked `/mcp` call is answered with a JSON-RPC error (`-32600`, "Request
+blocked by Admina governance") whose `error.data` holds the `event_id` of
+the forensic record and a `reason`: `injection_detected` (firewall),
+`scan_depth_exceeded` (text nested deeper than the scan depth),
+`egress_refused` (egress policy), `guard_blocked` (a request guard, also a
+guard error under `ADMINA_GUARD_FAIL_MODE=closed`) or `response_blocked`
+(a response guard). Before 0.13.1 every block reported `injection_detected`.
+
 </details>
 
 ## Project documents

{admina_framework-0.13.0 → admina_framework-0.13.2}/admina/__init__.py

@@ -23,7 +23,7 @@ from __future__ import annotations
 
 from admina.sdk import ComplianceKit, GovernedAgent, GovernedData, GovernedModel
 
-__version__ = "0.13.0"
+__version__ = "0.13.2"
 
 __all__ = [
     "__version__",

{admina_framework-0.13.0 → admina_framework-0.13.2}/admina/cli/main.py

@@ -251,8 +251,10 @@ def init(
     for f in created:
         click.echo(f"  ✓ {f}")
 
-    # 4. Bootstrap secrets (first-time setup)
-    _bootstrap_secrets(project_dir)
+    # 4. Bootstrap secrets (first-time setup). A project whose vault exists
+    # gets the vault's secrets in a .env created by this run.
+    if _bootstrap_secrets(project_dir) is None and ".env" in created:
+        SecretVault(project_dir).write_dotenv(project_dir / ".env")
 
     # 5. Docker compose pull (optional)
     if not no_pull and shutil.which("docker"):
@@ -570,8 +572,28 @@ def _require_proxy_extra_for_local_dev() -> None:
     raise SystemExit(1)
 
 
+def _local_forensic_backend(env: dict[str, str], data: dict[str, object]) -> tuple[str, str]:
+    """The forensic backend the local proxy uses and where it comes from:
+    ``FORENSIC_BACKEND`` when set and not empty, else
+    ``domains.compliance.forensic.backend`` (or ``storage``) of admina.yaml,
+    else ``memory`` (the proxy's default, see admina.proxy.forensic_backend).
+    """
+    value = env.get("FORENSIC_BACKEND", "").strip().lower()
+    if value:
+        return value, "FORENSIC_BACKEND"
+    domains = data.get("domains")
+    compliance = domains.get("compliance") if isinstance(domains, dict) else None
+    forensic = compliance.get("forensic") if isinstance(compliance, dict) else None
+    if isinstance(forensic, dict):
+        value = str(forensic.get("backend") or forensic.get("storage") or "").strip().lower()
+        if value:
+            return ("s3" if value == "minio" else value), "admina.yaml"
+    return "memory", ""
+
+
 def _run_local(
     project_dir: Path,
+    data: dict[str, object],
     vault: SecretVault,
     *,
     no_browser: bool,
@@ -594,8 +616,9 @@ def _run_local(
 
     env = os.environ.copy()
     env.update(vault.export_env())
-    # Local dev defaults — sane for single-user localhost.
-    env.setdefault("FORENSIC_BACKEND", "memory")
+    # Local dev defaults — sane for single-user localhost. The forensic
+    # backend is not set here: the proxy reads FORENSIC_BACKEND, else the
+    # backend of admina.yaml, else uses memory.
     env.setdefault("OTEL_ENDPOINT", "")
     env.setdefault("REDIS_URL", "")
     env.setdefault("CLICKHOUSE_HOST", "")
@@ -622,7 +645,11 @@ def _run_local(
 
     click.echo(f"\n  Starting Admina proxy + dashboard on http://{display_host}:{port}")
     click.echo("  Mode: local (no Docker)")
-    click.echo("  Forensic backend: in-memory (events live for the process lifetime)")
+    forensic_backend, forensic_source = _local_forensic_backend(env, data)
+    if forensic_source:
+        click.echo(f"  Forensic backend: {forensic_backend} ({forensic_source})")
+    else:
+        click.echo("  Forensic backend: in-memory (events live for the process lifetime)")
     if is_public:
         click.echo(
             f"  ⚠ Listening on {host}:{port} — accessible from the LAN. "
@@ -848,6 +875,7 @@ def dev(
         bind_host = "0.0.0.0" if public else host
         _run_local(
             project_dir,
+            data,
             vault,
             no_browser=no_browser,
             port=port,

{admina_framework-0.13.0 → admina_framework-0.13.2}/admina/cli/templates/admina.yaml.j2

@@ -58,7 +58,8 @@ domains:
     forensic:
       # The proxy's forensic backend and directory. FORENSIC_BACKEND and
       # FORENSIC_BASE_DIR, when set, take precedence (the generated
-      # docker-compose.yml sets both; `admina dev` sets FORENSIC_BACKEND).
+      # docker-compose.yml sets both). Without either, the proxy, `admina dev`
+      # included, keeps the records in memory.
       # backend: filesystem
       # base_dir: .admina/forensic
       bucket: forensic-blackbox

{admina_framework-0.13.0 → admina_framework-0.13.2}/admina/cli/templates/docker-compose.yml.j2

@@ -1,6 +1,9 @@
 # Docker Compose — {{ project_name }}
 # Generated by: admina init
 # Docs: https://admina.org/docs/docker
+#
+# Secrets come from .env, which `admina init` and `admina dev` write from the
+# project's secrets vault (show them with `admina password show`).
 
 services:
 
@@ -17,13 +20,29 @@ services:
       - .env
     environment:
       - REDIS_URL=redis://redis:6379/0
+{% if domains.compliance %}
       - CLICKHOUSE_HOST=clickhouse
       - CLICKHOUSE_PORT=8123
       - CLICKHOUSE_DB=admina
+{% else %}
+      # No ClickHouse and no OTEL collector without the compliance domain.
+      - CLICKHOUSE_HOST=
+{% endif %}
       - FORENSIC_BACKEND=filesystem
       - FORENSIC_BASE_DIR=/app/.admina/forensic
+{% if domains.compliance %}
       - OTEL_ENDPOINT=http://otel-collector:4317
+{% else %}
+      - OTEL_ENABLED=false
+{% endif %}
+      # The MCP server the proxy forwards /mcp to. The default is port 9000
+      # of the Docker host; export UPSTREAM_MCP_URL before `docker compose up`
+      # (or `admina dev --stack`) to use another server.
+      - UPSTREAM_MCP_URL=${UPSTREAM_MCP_URL:-http://host.docker.internal:9000}
       - LOG_LEVEL=INFO
+    extra_hosts:
+      # host.docker.internal on Linux too (Docker Desktop defines it).
+      - "host.docker.internal:host-gateway"
     volumes:
       # Forensic records and chain state (FORENSIC_BASE_DIR), kept when the
       # container is re-created.
@@ -31,8 +50,10 @@ services:
     depends_on:
       redis:
         condition: service_healthy
+{% if domains.compliance %}
       clickhouse:
         condition: service_healthy
+{% endif %}
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
       interval: 10s
@@ -47,13 +68,27 @@ services:
     image: ghcr.io/admina-org/admina-dashboard:{{ admina_version }}
     container_name: {{ project_name }}-dashboard
     ports:
-      - "3000:80"
+      # Loopback only. To reach the dashboard from other hosts, publish it
+      # behind TLS; it asks for ADMINA_DASHBOARD_PASSWORD (HTTP Basic Auth).
+      - "127.0.0.1:3000:80"
+    environment:
+      # With the API key the container needs a password: nginx adds the
+      # key only to the dashboard's read-only routes, behind Basic Auth.
+      - ADMINA_API_KEY=${ADMINA_API_KEY:-}
+      - ADMINA_DASHBOARD_PASSWORD=${ADMINA_DASHBOARD_PASSWORD:-}
 {% if domains.agent_security %}
     depends_on:
       - proxy
 {% endif %}
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:80/"]
+      # BusyBox wget on nginx:alpine resolves "localhost" to ::1 first and
+      # nginx listens on 0.0.0.0; force IPv4 to avoid spurious "Connection
+      # refused" failures.
+{% if domains.agent_security %}
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/health"]
+{% else %}
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/"]
+{% endif %}
       interval: 30s
       timeout: 3s
       retries: 3
@@ -68,12 +103,12 @@ services:
     environment:
       - CLICKHOUSE_DB=admina
       - CLICKHOUSE_USER=default
-      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:-changeme}
+      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:?CLICKHOUSE_PASSWORD must be set (admina dev writes it to .env)}
       - CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1
     volumes:
       - clickhouse-data:/var/lib/clickhouse
     healthcheck:
-      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
+      test: ["CMD", "clickhouse-client", "--user", "default", "--password", "${CLICKHOUSE_PASSWORD}", "--query", "SELECT 1"]
       interval: 5s
       timeout: 3s
       retries: 10
@@ -87,7 +122,7 @@ services:
     image: ollama/ollama:latest
     container_name: {{ project_name }}-ollama
     ports:
-      - "11434:11434"
+      - "127.0.0.1:11434:11434"   # no authentication: localhost only
     volumes:
       - ollama-data:/root/.ollama
 {% if gpu_vendor | default("none") == "nvidia" %}
@@ -119,7 +154,7 @@ services:
     image: chromadb/chroma:0.5.23
     container_name: {{ project_name }}-chromadb
     ports:
-      - "8000:8000"
+      - "127.0.0.1:8000:8000"   # no authentication: localhost only
     volumes:
       - chromadb-data:/chroma/chroma
     environment:
@@ -142,7 +177,8 @@ services:
     image: ghcr.io/open-webui/open-webui:main
     container_name: {{ project_name }}-webui
     ports:
-      - "{{ ai_infra_webui_port | default(3080) }}:8080"
+      # Localhost only: sign-up is open, and the first account is the admin.
+      - "127.0.0.1:{{ ai_infra_webui_port | default(3080) }}:8080"
     volumes:
       - webui-data:/app/backend/data
     environment:
@@ -183,8 +219,8 @@ services:
     image: otel/opentelemetry-collector-contrib:0.96.0
     container_name: {{ project_name }}-otel
     ports:
-      - "4317:4317"
-      - "4318:4318"
+      - "127.0.0.1:4317:4317"   # OTLP gRPC (localhost only)
+      - "127.0.0.1:4318:4318"   # OTLP HTTP (localhost only)
     depends_on:
       clickhouse:
         condition: service_healthy
@@ -201,7 +237,7 @@ services:
       - "3001:3000"
     environment:
       - GF_SECURITY_ADMIN_USER=admin
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admina}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD must be set (admina dev writes it to .env)}
       - GF_USERS_ALLOW_SIGN_UP=false
     volumes:
       - grafana-data:/var/lib/grafana

admina_framework-0.13.2/admina/cli/templates/env.j2

@@ -0,0 +1,7 @@
+# {{ project_name }} — Environment variables
+# Generated by: admina init
+# The secrets (ADMINA_API_KEY, ADMINA_DASHBOARD_PASSWORD, CLICKHOUSE_PASSWORD,
+# GRAFANA_ADMIN_PASSWORD, WEBUI_SECRET_KEY) are written here from the
+# project's secrets vault by `admina init` and `admina dev`.
+
+LOG_LEVEL=INFO

{admina_framework-0.13.0 → admina_framework-0.13.2}/admina/core/config_schema.py

@@ -19,8 +19,8 @@ paths (``domains.agent_security.firewall.pattern_packs``,
 ``alert_channels[0].url``):
 
 - **errors**: values of the wrong type, each as ``<path>: must be …``
-  (true or false, an integer, a number, a string, a list of strings, a list
-  of mappings, a mapping);
+  (true or false, an integer, a number, a finite number greater than 0, a
+  string, a list of strings, a list of mappings, a mapping);
 - **unknown**: keys the schema does not know.
 
 An empty value (null) is not checked: the reader of the key treats it as
@@ -35,28 +35,43 @@ malformed entry is skipped with a warning).
 
 from __future__ import annotations
 
+import math
 from collections.abc import Mapping
 from dataclasses import dataclass, field
 from typing import Any
 
-__all__ = ["SCHEMA", "SchemaProblems", "find_problems"]
+__all__ = ["SCHEMA", "SchemaProblems", "find_problems", "positive_finite_number"]
+
+
+def positive_finite_number(value: Any) -> bool:
+    """Whether *value* is a finite number greater than 0 (an int or a float,
+    not a bool)."""
+    return (
+        not isinstance(value, bool)
+        and isinstance(value, int | float)
+        and math.isfinite(value)
+        and value > 0
+    )
 
 
 @dataclass(frozen=True)
 class _Scalar:
-    kind: str  # bool | int | number | str
+    kind: str  # bool | int | number | positive | str
 
     def describe(self) -> str:
         return {
             "bool": "true or false",
             "int": "an integer",
             "number": "a number",
+            "positive": "a finite number greater than 0",
             "str": "a string",
         }[self.kind]
 
     def accepts(self, value: Any) -> bool:
         if self.kind == "bool":
             return isinstance(value, bool)
+        if self.kind == "positive":
+            return positive_finite_number(value)
         if isinstance(value, bool):
             return False
         if self.kind == "int":
@@ -117,6 +132,7 @@ class _List:
 BOOL = _Scalar("bool")
 INT = _Scalar("int")
 NUMBER = _Scalar("number")
+POSITIVE = _Scalar("positive")
 STR = _Scalar("str")
 STRINGS = _List(STR)
 ANY = _Any()
@@ -181,7 +197,10 @@ SCHEMA = _Section(
                             {
                                 "enabled": BOOL,
                                 "mode": STR,
-                                "heuristic_threshold": NUMBER,
+                                # Read by the Python firewall only, and
+                                # refused here so that an invalid value
+                                # stops either engine.
+                                "heuristic_threshold": POSITIVE,
                                 "allowed_tags": STRINGS,
                                 "custom_patterns": _List(ANY),
                                 "disabled_categories": STRINGS,

{admina_framework-0.13.0 → admina_framework-0.13.2}/admina/dashboard/static/index.html

@@ -921,7 +921,7 @@ function dashboard() {
           max: 25,
           hint: noAssessment ? 'No gap analysis run yet — see EU AI Act card' : null,
         },
-        { key: 'no_recent_attacks',     label: 'No blocked attacks (24h)',    value: bd.no_recent_attacks ?? 0,     max: 15 },
+        { key: 'no_recent_attacks',     label: 'No blocked requests (since start)', value: bd.no_recent_attacks ?? 0,     max: 15 },
         { key: 'forensic_chain_valid',  label: 'Forensic chain valid',        value: bd.forensic_chain_valid ?? 0,  max: 10 },
       ];
     },

{admina_framework-0.13.0 → admina_framework-0.13.2}/admina/domains/agent_security/egress.py

@@ -41,6 +41,7 @@ from typing import Any
 from urllib.parse import urlsplit
 
 from admina.core.types import RiskLevel
+from admina.domains.governance import SCAN_DEPTH
 
 __all__ = [
     "EGRESS_SURFACES",
@@ -60,9 +61,9 @@ logger = logging.getLogger("admina.egress")
 #: Surfaces the egress stage can run on (``agent_security.egress.surfaces``).
 EGRESS_SURFACES = ("gateway", "mcp", "integration", "sdk")
 
-# Mirrors _MAX_SCAN_DEPTH in admina/domains/governance.py so the egress walk
-# and the PII/firewall walk agree on how deep a payload is inspected.
-_MAX_SCAN_DEPTH = 6
+# The walks below stop at the pipeline's SCAN_DEPTH, so egress and the
+# PII/firewall walk agree on how deep a payload is inspected: a call the
+# firewall scans in full is never refused by egress for its depth alone.
 
 # Argument names that declare a network destination. Their presence means the
 # call is an egress attempt even when the value cannot be resolved.
@@ -182,7 +183,7 @@ def _walk(
     A truncated walk means part of the arguments was never inspected, so the
     caller cannot claim the call has no destination — see :func:`analyze`.
     """
-    if depth > _MAX_SCAN_DEPTH:
+    if depth > SCAN_DEPTH:
         # Only a string, dict or list could have hidden a destination; an
         # int, float, bool or None could not, so skipping one loses nothing
         # and must not be reported as an incomplete scan.
@@ -221,7 +222,7 @@ def _walk(
 
 def _classify_write_shaped(obj: Any, depth: int) -> str | None:
     """Return the reason the call is payload-bearing, or None."""
-    if depth > _MAX_SCAN_DEPTH:
+    if depth > SCAN_DEPTH:
         return None
     if isinstance(obj, str):
         # Bare hostnames are recognised here regardless of the key: the
@@ -275,7 +276,7 @@ def _collect_payload_fields(obj: Any, depth: int, found: list[str]) -> None:
     destination and carries a payload, and the payload is what this
     function is for.
     """
-    if depth > _MAX_SCAN_DEPTH:
+    if depth > SCAN_DEPTH:
         return
     if isinstance(obj, str):
         # A host or URL says where the call goes, which is what the fan-in
@@ -351,7 +352,7 @@ def payload_fields(params: Any) -> list[str]:
 
 
 def _remote_hint(obj: Any, depth: int = 0) -> bool | None:
-    if depth > _MAX_SCAN_DEPTH:
+    if depth > SCAN_DEPTH:
         return None
     if isinstance(obj, dict):
         for key, value in obj.items():