agent-core-inbound 0.8.2__tar.gz

agent_core_inbound-0.8.2/.gitignore

@@ -0,0 +1,245 @@
+# Memory compiler runtime state
+memory-compiler/daily/
+memory-compiler/reports/
+memory-compiler/scripts/state.json
+memory-compiler/scripts/last-flush.json
+memory-compiler/scripts/flush.log
+memory-compiler/scripts/compile.log
+memory-compiler/scripts/session-flush-*.md
+memory-compiler/scripts/flush-context-*.md
+
+# Handoff writer state (placed alongside handoff files)
+**/handoff-state.json
+
+# Git worktrees (superpowers / parallel feature work)
+.worktrees/
+# Native (harness) worktrees
+.claude/worktrees/
+
+# Superpowers brainstorm mockups / scratch
+.superpowers/
+
+# Agent-core runtime state (handoffs, bus.sqlite, transcripts, etc.)
+.agent-core/
+
+# Local scratch / smoke-test artifacts
+.tmp/
+
+# Claude Code per-machine local overrides
+.claude/settings.local.json
+.claude/*.lock
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+#poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+#pdm.lock
+#pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+#pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+# Abstra
+# Abstra is an AI-powered process automation framework.
+# Ignore directories containing user credentials, local state, and settings.
+# Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#  Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#  that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#  and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#  you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Cursor
+#  Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
+#  exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
+#  refer to https://docs.cursor.com/context/ignore-files
+.cursorignore
+.cursorindexingignore
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+.gstack/
+
+# macOS Finder metadata (occasionally sneaks in via vendored sources)
+.DS_Store
+
+# Operational docs that must not live in source control
+pepper-vault-plan.txt

agent_core_inbound-0.8.2/CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+## [0.8.2](https://github.com/jeffrichley/agent_core/compare/v0.8.1...agent-core-inbound-v0.8.2) (2026-07-22)
+
+
+### Bug Fixes
+
+* republish package family to complete rate-limited first publish ([#477](https://github.com/jeffrichley/agent_core/issues/477)) ([32977ac](https://github.com/jeffrichley/agent_core/commit/32977ac78da4a15553329bb4e1fdaa9e894834ad))
+
+## [0.8.1](https://github.com/jeffrichley/agent_core/compare/v0.8.0...agent-core-inbound-v0.8.1) (2026-07-22)
+
+
+### Bug Fixes
+
+* rename flagship dist to agent-core-bus + bump inter-package pins to 0.8.x ([#474](https://github.com/jeffrichley/agent_core/issues/474)) ([48426e7](https://github.com/jeffrichley/agent_core/commit/48426e7ff753d8f35d4a4626308546e9d0f331f7))
+
+## [0.8.0](https://github.com/jeffrichley/agent_core/compare/v0.7.0...agent-core-inbound-v0.8.0) (2026-07-21)
+
+
+### Features
+
+* **deps:** version-pin sibling deps and remove qwen-tts from voice ([#430](https://github.com/jeffrichley/agent_core/issues/430)) ([3b173ee](https://github.com/jeffrichley/agent_core/commit/3b173eebd24fb8eab995785a9e154a0dda870f19))
+* **hatchery:** ungendered templates + .mcp.json generation ([#81](https://github.com/jeffrichley/agent_core/issues/81)/[#82](https://github.com/jeffrichley/agent_core/issues/82)) ([#357](https://github.com/jeffrichley/agent_core/issues/357)) ([f48762d](https://github.com/jeffrichley/agent_core/commit/f48762df78eb12cfa9524e9b5a277741534ea8a7)), closes [#311](https://github.com/jeffrichley/agent_core/issues/311)
+* **release:** configure release-please for 12-package synchronized version train ([#428](https://github.com/jeffrichley/agent_core/issues/428)) ([c1b4097](https://github.com/jeffrichley/agent_core/commit/c1b409765c61d09a6657b0e8b5e43a27cb235b3e))
+* **secrets:** add vault-API accessor and scrub subprocess env ([#399](https://github.com/jeffrichley/agent_core/issues/399)) ([adb404b](https://github.com/jeffrichley/agent_core/commit/adb404b046bd224b56d64188b2cb56eb134d99b7))
+* **supervision:** migrate leaky asyncio.create_task sites to BusHandle.spawn() ([#302](https://github.com/jeffrichley/agent_core/issues/302)) ([0716587](https://github.com/jeffrichley/agent_core/commit/07165879a4f1055ff1d0636169bdc2a178ea57da))
+
+
+### Bug Fixes
+
+* **discord,inbound:** nack transient failures instead of acking (issue [#275](https://github.com/jeffrichley/agent_core/issues/275)) ([#281](https://github.com/jeffrichley/agent_core/issues/281)) ([ad52bd6](https://github.com/jeffrichley/agent_core/commit/ad52bd6eb883f1706e76df32260317767f697b2d))

agent_core_inbound-0.8.2/PKG-INFO

@@ -0,0 +1,132 @@
+Metadata-Version: 2.4
+Name: agent-core-inbound
+Version: 0.8.2
+Summary: Inbound notifications router — deny-by-default external-event surface for agent-core beings.
+License-Expression: MIT
+Requires-Python: >=3.12
+Requires-Dist: agent-core-bus<0.9,>=0.8
+Requires-Dist: agent-core-credentials<0.9,>=0.8
+Requires-Dist: fastapi>=0.110
+Requires-Dist: pydantic>=2.0
+Requires-Dist: uvicorn>=0.27
+Requires-Dist: watchdog>=4.0
+Provides-Extra: test
+Requires-Dist: httpx; extra == 'test'
+Requires-Dist: pytest; extra == 'test'
+Requires-Dist: pytest-asyncio; extra == 'test'
+Description-Content-Type: text/markdown
+
+# agent-core-inbound
+
+Deny-by-default inbound notifications router for agent-core beings.
+External signals (GitHub webhooks, Gmail messages, calendar events)
+flow through per-source **connectors** that classify each event as
+`Allow{tier, reason}` or `Deny`. The router de-dupes, rate-limits,
+delivers via the agent-core bus, and writes an audit log.
+
+See `docs/superpowers/specs/2026-06-20-inbound-notifications-design.md`
+in the agent_core repo for the full design.
+
+## Bringing v1.a online (operator runbook)
+
+### 1. Generate the GitHub webhook secret
+
+Pick any high-entropy string; e.g.:
+
+```bash
+python -c "import secrets; print(secrets.token_urlsafe(32))"
+```
+
+Set it as an env var in the daemon's environment (e.g., your `~/.agent-core/.env` or systemd unit):
+
+```bash
+FOREMAN_GITHUB_WEBHOOK_SECRET=<paste-here>
+```
+
+### 2. Write your allowance file
+
+`~/.<being>/.config/inbound/github-allowance.toml`:
+
+```toml
+# Schema-flexible rule shape (v2).  See spec
+# docs/superpowers/specs/2026-06-21-inbound-v2-schema-flexible-events-design.md
+# for the full grammar.
+
+[[allow]]
+rule_id = "pr_review_requested_any_project"
+event = "pull_request_review_requested"
+match = { "requested_reviewer.login" = "<your-github-login>" }
+tier = "red"
+reason = "PR review requested on me"
+
+[[allow]]
+rule_id = "needs_help_foreman"
+event = "issues_labeled"
+repo = "<org>/<repo>"
+match = { "label.name" = "foreman:needs-help" }
+tier = "red"
+reason = "Foreman escalation — needs operator unstick"
+```
+
+The `reviewer`/`label_name` shortcuts from v1.a still work — they translate to `match` entries automatically. `body_contains` was removed in v2 (raises `ValueError` on load); use exact-equality `match` instead, or wait for v2.1's `match_contains` operator.
+
+**Body projection.** The GitHub connector trims the Notification envelope body to a small per-event-type field set (event type, action, repo, key identifiers). This keeps inline bus payloads under 1 KB and avoids bloating tool results with GitHub metadata your being doesn't need. The full raw webhook payload is always recoverable from GitHub's webhook delivery history via `gh api repos/<repo>/hooks/<id>/deliveries/<delivery_id>`.
+
+The router watches the file's mtime and reloads on every webhook delivery — edit the TOML and the next event picks up the new rules without restarting the daemon.
+
+### 3. Register the endpoint in agent_core.yaml
+
+The inbound-notifications endpoint registers via the `agent_core` pluggy hook (see `agent_core_inbound/plugin.py` — the `inbound.github` type is registered automatically once the package is installed).
+
+Add this entry to your `agent_core.yaml`'s `endpoints:` list:
+
+```yaml
+endpoints:
+  - type: inbound.github
+    name: inbound
+    params:
+      target_being: <your-being>
+      listen_host: 127.0.0.1
+      listen_port: 8765
+      webhook_secret_env: FOREMAN_GITHUB_WEBHOOK_SECRET
+      github_allowance_path: ~/.<being>/.config/inbound/github-allowance.toml
+      audit_log_path: ~/.<being>/state/inbound-audit.jsonl
+      rate_limit_per_minute: 30
+```
+
+The runner reads each entry's `type` and looks it up in the pluggy-registered endpoint types map. The `name` is the bus addressing name (also surfaces in `agent-core ps`). All `params` are passed as constructor kwargs to `InboundEndpoint`.
+
+### 4. Start Tailscale Funnel
+
+```bash
+tailscale funnel 8765
+```
+
+Note the issued `https://router.<tailnet>.ts.net` URL.
+
+### 5. Configure the GitHub webhook
+
+In your repo settings → Webhooks → Add webhook:
+
+- **Payload URL:** `https://router.<tailnet>.ts.net/github`
+- **Content type:** `application/json`
+- **Secret:** the same value you stored in `FOREMAN_GITHUB_WEBHOOK_SECRET`
+- **Which events:** "Let me select individual events" — check **Workflow runs**, **Pull requests**, **Pull request reviews**, **Issues**, **Issue comments**, **Pushes**, **Releases**, **Statuses**. (Schema-flexible matching means we can add more later via `gh api -X PATCH repos/<repo>/hooks/<id> -f events='[...]'` with no daemon change.)
+
+### 6. Smoke test
+
+On any PR in your configured repo, request a review from `@<your-github-login>`. Within ~10s:
+
+- `~/.<being>/state/inbound-audit.jsonl` gains an `allow` line with `rule_id=pr_review_requested_any_project`.
+- Your being's bus inbox receives a `Notification` envelope (urgency `red`).
+
+If you instead see a `deny` line, double-check `match = { "requested_reviewer.login" = "<your-github-login>" }` in the allowance TOML against the actual reviewer GitHub login.
+
+### Troubleshooting
+
+- **All POSTs land 401:** the env var secret does not match the GitHub webhook secret. Re-paste both ends.
+- **`BusBootError: unknown endpoint type 'inbound.github'`:** the `agent-core-inbound` package isn't installed in the daemon's environment, or its entry point isn't being discovered. Run `uv sync` (or your install path equivalent) and confirm `python -c "import agent_core_inbound.plugin"` succeeds.
+- **Webhook delivers but no bus envelope:** check the audit log first. If `deny` lines appear, the allowance rule isn't matching — verify the `event`, `repo`, and `match` dotted-path keys against the actual webhook payload (visible in GitHub's webhook delivery history).
+- **No audit log writes at all:** the endpoint isn't seeing the POST. Confirm Tailscale Funnel is active (`tailscale funnel status`) and the daemon log shows `InboundEndpoint(name=inbound) started on 127.0.0.1:8765`.
+- **`deny` with `reason="no_matching_rule"` on every event:** v2 parses every webhook event generically (no silent 204 fallback), so the connector denies anything not matched by an allow rule. If you expected an allow, the rule's `event` key (e.g. `pull_request_opened`) or `match` dotted-paths don't line up with the payload shape — check the webhook delivery body in GitHub's "Recent Deliveries" UI to confirm the exact field names.
+- **Webhook deliveries land 404 from uvicorn:** the Tailscale Funnel command should be `tailscale funnel <port>` — do NOT use `--set-path=/github`. That flag STRIPS the path prefix before forwarding, leaving uvicorn to see `POST /` (no route). The default mount at `/` is correct because the FastAPI route is at `/github`.

agent_core_inbound-0.8.2/README.md

@@ -0,0 +1,114 @@
+# agent-core-inbound
+
+Deny-by-default inbound notifications router for agent-core beings.
+External signals (GitHub webhooks, Gmail messages, calendar events)
+flow through per-source **connectors** that classify each event as
+`Allow{tier, reason}` or `Deny`. The router de-dupes, rate-limits,
+delivers via the agent-core bus, and writes an audit log.
+
+See `docs/superpowers/specs/2026-06-20-inbound-notifications-design.md`
+in the agent_core repo for the full design.
+
+## Bringing v1.a online (operator runbook)
+
+### 1. Generate the GitHub webhook secret
+
+Pick any high-entropy string; e.g.:
+
+```bash
+python -c "import secrets; print(secrets.token_urlsafe(32))"
+```
+
+Set it as an env var in the daemon's environment (e.g., your `~/.agent-core/.env` or systemd unit):
+
+```bash
+FOREMAN_GITHUB_WEBHOOK_SECRET=<paste-here>
+```
+
+### 2. Write your allowance file
+
+`~/.<being>/.config/inbound/github-allowance.toml`:
+
+```toml
+# Schema-flexible rule shape (v2).  See spec
+# docs/superpowers/specs/2026-06-21-inbound-v2-schema-flexible-events-design.md
+# for the full grammar.
+
+[[allow]]
+rule_id = "pr_review_requested_any_project"
+event = "pull_request_review_requested"
+match = { "requested_reviewer.login" = "<your-github-login>" }
+tier = "red"
+reason = "PR review requested on me"
+
+[[allow]]
+rule_id = "needs_help_foreman"
+event = "issues_labeled"
+repo = "<org>/<repo>"
+match = { "label.name" = "foreman:needs-help" }
+tier = "red"
+reason = "Foreman escalation — needs operator unstick"
+```
+
+The `reviewer`/`label_name` shortcuts from v1.a still work — they translate to `match` entries automatically. `body_contains` was removed in v2 (raises `ValueError` on load); use exact-equality `match` instead, or wait for v2.1's `match_contains` operator.
+
+**Body projection.** The GitHub connector trims the Notification envelope body to a small per-event-type field set (event type, action, repo, key identifiers). This keeps inline bus payloads under 1 KB and avoids bloating tool results with GitHub metadata your being doesn't need. The full raw webhook payload is always recoverable from GitHub's webhook delivery history via `gh api repos/<repo>/hooks/<id>/deliveries/<delivery_id>`.
+
+The router watches the file's mtime and reloads on every webhook delivery — edit the TOML and the next event picks up the new rules without restarting the daemon.
+
+### 3. Register the endpoint in agent_core.yaml
+
+The inbound-notifications endpoint registers via the `agent_core` pluggy hook (see `agent_core_inbound/plugin.py` — the `inbound.github` type is registered automatically once the package is installed).
+
+Add this entry to your `agent_core.yaml`'s `endpoints:` list:
+
+```yaml
+endpoints:
+  - type: inbound.github
+    name: inbound
+    params:
+      target_being: <your-being>
+      listen_host: 127.0.0.1
+      listen_port: 8765
+      webhook_secret_env: FOREMAN_GITHUB_WEBHOOK_SECRET
+      github_allowance_path: ~/.<being>/.config/inbound/github-allowance.toml
+      audit_log_path: ~/.<being>/state/inbound-audit.jsonl
+      rate_limit_per_minute: 30
+```
+
+The runner reads each entry's `type` and looks it up in the pluggy-registered endpoint types map. The `name` is the bus addressing name (also surfaces in `agent-core ps`). All `params` are passed as constructor kwargs to `InboundEndpoint`.
+
+### 4. Start Tailscale Funnel
+
+```bash
+tailscale funnel 8765
+```
+
+Note the issued `https://router.<tailnet>.ts.net` URL.
+
+### 5. Configure the GitHub webhook
+
+In your repo settings → Webhooks → Add webhook:
+
+- **Payload URL:** `https://router.<tailnet>.ts.net/github`
+- **Content type:** `application/json`
+- **Secret:** the same value you stored in `FOREMAN_GITHUB_WEBHOOK_SECRET`
+- **Which events:** "Let me select individual events" — check **Workflow runs**, **Pull requests**, **Pull request reviews**, **Issues**, **Issue comments**, **Pushes**, **Releases**, **Statuses**. (Schema-flexible matching means we can add more later via `gh api -X PATCH repos/<repo>/hooks/<id> -f events='[...]'` with no daemon change.)
+
+### 6. Smoke test
+
+On any PR in your configured repo, request a review from `@<your-github-login>`. Within ~10s:
+
+- `~/.<being>/state/inbound-audit.jsonl` gains an `allow` line with `rule_id=pr_review_requested_any_project`.
+- Your being's bus inbox receives a `Notification` envelope (urgency `red`).
+
+If you instead see a `deny` line, double-check `match = { "requested_reviewer.login" = "<your-github-login>" }` in the allowance TOML against the actual reviewer GitHub login.
+
+### Troubleshooting
+
+- **All POSTs land 401:** the env var secret does not match the GitHub webhook secret. Re-paste both ends.
+- **`BusBootError: unknown endpoint type 'inbound.github'`:** the `agent-core-inbound` package isn't installed in the daemon's environment, or its entry point isn't being discovered. Run `uv sync` (or your install path equivalent) and confirm `python -c "import agent_core_inbound.plugin"` succeeds.
+- **Webhook delivers but no bus envelope:** check the audit log first. If `deny` lines appear, the allowance rule isn't matching — verify the `event`, `repo`, and `match` dotted-path keys against the actual webhook payload (visible in GitHub's webhook delivery history).
+- **No audit log writes at all:** the endpoint isn't seeing the POST. Confirm Tailscale Funnel is active (`tailscale funnel status`) and the daemon log shows `InboundEndpoint(name=inbound) started on 127.0.0.1:8765`.
+- **`deny` with `reason="no_matching_rule"` on every event:** v2 parses every webhook event generically (no silent 204 fallback), so the connector denies anything not matched by an allow rule. If you expected an allow, the rule's `event` key (e.g. `pull_request_opened`) or `match` dotted-paths don't line up with the payload shape — check the webhook delivery body in GitHub's "Recent Deliveries" UI to confirm the exact field names.
+- **Webhook deliveries land 404 from uvicorn:** the Tailscale Funnel command should be `tailscale funnel <port>` — do NOT use `--set-path=/github`. That flag STRIPS the path prefix before forwarding, leaving uvicorn to see `POST /` (no route). The default mount at `/` is correct because the FastAPI route is at `/github`.

agent_core_inbound-0.8.2/VERSION

@@ -0,0 +1 @@
+0.8.2

agent_core_inbound-0.8.2/pyproject.toml

@@ -0,0 +1,45 @@
+[project]
+name = "agent-core-inbound"
+dynamic = ["version"]
+description = "Inbound notifications router — deny-by-default external-event surface for agent-core beings."
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.12"
+dependencies = [
+    "agent-core-bus>=0.8,<0.9",
+    "agent-core-credentials>=0.8,<0.9",
+    "pydantic>=2.0",
+    "fastapi>=0.110",
+    "uvicorn>=0.27",
+    "watchdog>=4.0",
+]
+
+[project.optional-dependencies]
+test = [
+    "pytest",
+    "pytest-asyncio",
+    "httpx",
+]
+
+[project.entry-points."agent_core"]
+inbound_aliases = "agent_core_inbound.plugin"
+
+[build-system]
+requires = ["hatchling", "uv-dynamic-versioning"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/agent_core_inbound"]
+
+[tool.hatch.version]
+source = "uv-dynamic-versioning"
+
+[tool.uv-dynamic-versioning]
+fallback-version = "0.0.0"
+
+[tool.uv]
+cache-keys = [{ file = "pyproject.toml" }, { git = { commit = true, tags = true } }]
+
+[tool.uv.sources]
+agent-core = { workspace = true }
+agent-core-credentials = { workspace = true }

agent_core_inbound-0.8.2/src/agent_core_inbound/__init__.py

@@ -0,0 +1,4 @@
+"""Inbound notifications — deny-by-default external-event router.
+
+See docs/superpowers/specs/2026-06-20-inbound-notifications-design.md.
+"""

agent_core_inbound-0.8.2/src/agent_core_inbound/_path.py

@@ -0,0 +1,39 @@
+"""Dotted-path resolver for the GitHubConnector matching engine.
+
+Walks a nested dict by splitting a dotted path into keys. Returns the
+sentinel ``MISSING`` for any path that doesn't resolve cleanly —
+including paths through non-dict cursor values, missing keys, or the
+empty path. Falsy values (False, 0, "", None, [], {}) are NOT treated
+as missing; they're real values the resolver returns directly.
+"""
+from __future__ import annotations
+
+from typing import Any, Final
+
+
+class _MissingSentinel:
+    __slots__ = ()
+
+    def __repr__(self) -> str:
+        return "MISSING"
+
+
+MISSING: Final = _MissingSentinel()
+
+
+def resolve_path(payload: dict[str, Any], path: str) -> Any:
+    """Resolve a dotted path against a nested dict.
+
+    Returns ``MISSING`` for any path that doesn't fully resolve.
+    """
+    if not path:
+        return MISSING
+    cursor: Any = payload
+    for key in path.split("."):
+        if not isinstance(cursor, dict) or key not in cursor:
+            return MISSING
+        cursor = cursor[key]
+    return cursor
+
+
+__all__ = ["MISSING", "resolve_path"]

agent_core_inbound-0.8.2/src/agent_core_inbound/audit.py

@@ -0,0 +1,67 @@
+"""JSONL audit log for inbound-notifications router.
+
+One line per classification. Allow lines carry tier + reason +
+rule_id; Deny lines carry only the timestamp + source + target.
+Deny intentionally does NOT serialize the event body so a denied
+inbound leaves no privacy-sensitive trace.
+"""
+import json
+from collections.abc import Callable
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+from agent_core_inbound.types import Allow
+
+
+def _default_clock() -> datetime:
+    return datetime.now(UTC)
+
+
+class AuditLog:
+    """Append-only JSONL writer keyed by absolute path.
+
+    ``clock`` is injectable so tests can pin the timestamp without
+    monkey-patching ``datetime.now``. Parent directories are created
+    on first write.
+    """
+
+    def __init__(
+        self,
+        *,
+        path: Path,
+        clock: Callable[[], datetime] = _default_clock,
+    ) -> None:
+        self._path = path
+        self._clock = clock
+
+    def record_allow(
+        self,
+        *,
+        connector_name: str,
+        target_being: str,
+        verdict: Allow,
+        rule_id: str,
+    ) -> None:
+        self._write({
+            "ts": self._clock().isoformat(),
+            "source": connector_name,
+            "to": target_being,
+            "verdict": "allow",
+            "tier": verdict.tier.value,
+            "rule_id": rule_id,
+            "reason": verdict.reason,
+        })
+
+    def record_deny(self, *, connector_name: str, target_being: str) -> None:
+        self._write({
+            "ts": self._clock().isoformat(),
+            "source": connector_name,
+            "to": target_being,
+            "verdict": "deny",
+        })
+
+    def _write(self, entry: dict[str, Any]) -> None:
+        self._path.parent.mkdir(parents=True, exist_ok=True)
+        with self._path.open("a", encoding="utf-8") as fh:
+            fh.write(json.dumps(entry, separators=(",", ":")) + "\n")