ananke-plexus 0.1.0__tar.gz

ananke_plexus-0.1.0/.ananke/apm.lock

@@ -0,0 +1,22 @@
+{
+  "packages": [
+    {
+      "name": "code-graph-reviewer",
+      "version": "0.1.0",
+      "source": "/Users/abhikanap/Documents/Repositories/Ananke-Plexus/.ananke/tmp/import-code-graph-reviewer",
+      "digest": "63efd3b0ed2fcfeca0536c4c28e6559adc6e534e8c863dc2da780ed7b999aa98",
+      "installed_at": "2026-09-16T03:49:14.866819+00:00",
+      "permissions": {
+        "filesystem_read": [
+          "src/**",
+          ".ananke/**"
+        ],
+        "filesystem_write": [
+          ".ananke/evidence/**"
+        ],
+        "network": [],
+        "shell": []
+      }
+    }
+  ]
+}

ananke_plexus-0.1.0/.ananke/architecture/diagrams.md

@@ -0,0 +1,14 @@
+# Architecture Render: ananke-system
+
+## Validation
+- Missing from CALM: 2
+- Missing from Graph: 0
+
+## Mermaid
+```mermaid
+flowchart LR
+```
+
+## Graph Overlay
+- src: missing
+- tests: missing

ananke_plexus-0.1.0/.ananke/architecture/system.calm.json

@@ -0,0 +1,8 @@
+{
+  "schema_version": "0.1",
+  "system": {
+    "name": "ananke-system"
+  },
+  "components": [],
+  "relationships": []
+}

ananke_plexus-0.1.0/.ananke/config.local.toml.example

@@ -0,0 +1,10 @@
+# Local-only overrides. Copy to config.local.toml (ignored by git).
+[jira]
+base_url = "https://example.atlassian.net"
+email = ""
+token = { env = "ANANKE_JIRA_TOKEN" }
+
+[bitbucket]
+base_url = "https://api.bitbucket.org"
+username = ""
+app_password = { env = "ANANKE_BITBUCKET_APP_PASSWORD" }

ananke_plexus-0.1.0/.ananke/config.toml

@@ -0,0 +1,19 @@
+[project]
+name = "ananke-project"
+default_branch = "main"
+
+[ananke]
+mode = "developer"
+fail_closed = true
+offline = false
+
+[spec]
+provider = "speckit"
+contract_mode = "ananke-bmad"
+
+[security]
+allow_network = false
+secret_scan = true
+sast = true
+sca = true
+license_scan = true

ananke_plexus-0.1.0/.ananke/policy/default.toml

@@ -0,0 +1,7 @@
+[[rule]]
+id = "policy.core.fail-closed"
+stage = "verify"
+severity = "high"
+gate = "core"
+assert = "config.ananke.fail_closed == true"
+on_failure = "block"

ananke_plexus-0.1.0/.ananke/skills/installed/code-graph-reviewer@0.1.0/README.md

@@ -0,0 +1 @@
+Imported from Copilot skill format.

ananke_plexus-0.1.0/.ananke/skills/installed/code-graph-reviewer@0.1.0/SKILL.md

@@ -0,0 +1,3 @@
+# Code Graph Reviewer
+
+Review graph impact and summarize risk.

ananke_plexus-0.1.0/.ananke/skills/installed/code-graph-reviewer@0.1.0/ananke-skill.toml

@@ -0,0 +1,23 @@
+[skill]
+name = "code-graph-reviewer"
+version = "0.1.0"
+description = "Imported Copilot skill"
+license = "UNKNOWN"
+
+[compatibility]
+ananke = ">=0.1,<1"
+skill_api = "1"
+
+[permissions]
+filesystem_read = ["src/**", ".ananke/**"]
+filesystem_write = [".ananke/evidence/**"]
+network = []
+shell = []
+
+[entrypoints]
+instructions = "SKILL.md"
+
+[provenance]
+source = "copilot"
+repository = "tests/fixtures/copilot-skills"
+revision = "local"

ananke_plexus-0.1.0/.ananke/specs/ANANKE-EPIC-SPECKIT-implement-spec-kit-end-to-end-lifecycle/bmad.yaml

@@ -0,0 +1,13 @@
+behavior:
+  scenarios:
+    - id: AC-1
+      description: "Spec Kit provider adapter exists"
+    - id: AC-2
+      description: "converge generates requirement spec plan tasks bmad lock"
+    - id: AC-3
+      description: "validate passes and drift shows none"
+model:
+  schemas:
+    - requirement_boundary_v1
+architecture:
+  calm_ref: .ananke/architecture/system.calm.json

ananke_plexus-0.1.0/.ananke/specs/ANANKE-EPIC-SPECKIT-implement-spec-kit-end-to-end-lifecycle/plan.md

@@ -0,0 +1,7 @@
+# Implementation Plan
+
+## Steps
+1. Validate requirement and acceptance criteria.
+2. Compile Ananke BMAD contracts.
+3. Implement code changes with tests.
+4. Run verify and finalize evidence.

ananke_plexus-0.1.0/.ananke/specs/ANANKE-EPIC-SPECKIT-implement-spec-kit-end-to-end-lifecycle/requirement.md

@@ -0,0 +1,12 @@
+# Requirement ANANKE-EPIC-SPECKIT
+
+## Title
+Implement Spec Kit end-to-end lifecycle
+
+## Body
+Implement provider-based Spec Kit integration, spec lifecycle commands, lock/drift checks, and superpowers converge flow.
+
+## Acceptance Criteria
+- Spec Kit provider adapter exists
+- converge generates requirement spec plan tasks bmad lock
+- validate passes and drift shows none

ananke_plexus-0.1.0/.ananke/specs/ANANKE-EPIC-SPECKIT-implement-spec-kit-end-to-end-lifecycle/spec.lock.json

@@ -0,0 +1,11 @@
+{
+  "feature_dir": "ANANKE-EPIC-SPECKIT-implement-spec-kit-end-to-end-lifecycle",
+  "content_hash": "bc173e712d806c10082c53bc7963a4bb63d34ca61d95bc95877b47b0172402de",
+  "files": {
+    "requirement.md": "ce32cc5c6cd4c7a0aed157228aa4856208156de0d764cd5292383ce43987de9c",
+    "spec.md": "2c7823715654015e9a11480cddb978b00db2f5b0a8ed62ab97548729cda0c274",
+    "plan.md": "2a7d1538ba7854451dc133bd43725e8745aa85837a855aa5587859d7f74a0e6b",
+    "tasks.md": "76728d2bea9bc0ec7461b9bd88bb695885af6efa4be0942064106104f99dd481",
+    "bmad.yaml": "d740341397c4e4445e3e7afd69f9e5249f71e7070546a5bd19addab31a42bc78"
+  }
+}

ananke_plexus-0.1.0/.ananke/specs/ANANKE-EPIC-SPECKIT-implement-spec-kit-end-to-end-lifecycle/spec.md

@@ -0,0 +1,9 @@
+# Spec for ANANKE-EPIC-SPECKIT
+
+## Scope
+Implement the requirement with explicit, testable behavior.
+
+## Behavioral Contract
+- AC: Spec Kit provider adapter exists
+- AC: converge generates requirement spec plan tasks bmad lock
+- AC: validate passes and drift shows none

ananke_plexus-0.1.0/.ananke/specs/ANANKE-EPIC-SPECKIT-implement-spec-kit-end-to-end-lifecycle/tasks.md

@@ -0,0 +1,7 @@
+# Task Checklist
+
+- [ ] Create/adjust tests
+- [ ] Implement requirement behavior
+- [ ] Validate architecture impact
+- [ ] Run verification gates
+- [ ] Attach evidence bundle to review

ananke_plexus-0.1.0/.ananke/specs/ANANKE-ROADMAP-ALL-implement-all-ideated-ananke-plexus-capabilities/bmad.yaml

@@ -0,0 +1,17 @@
+behavior:
+  scenarios:
+    - id: AC-1
+      description: "All epics A-M have tracked implementation tasks"
+    - id: AC-2
+      description: "Spec pipeline maintains lock and drift checks"
+    - id: AC-3
+      description: "Each roadmap phase is represented by executable milestones"
+    - id: AC-4
+      description: "Security and provenance controls are part of release criteria"
+    - id: AC-5
+      description: "MCP APM lifecycle and graph integrations are delivered incrementally"
+model:
+  schemas:
+    - requirement_boundary_v1
+architecture:
+  calm_ref: .ananke/architecture/system.calm.json

ananke_plexus-0.1.0/.ananke/specs/ANANKE-ROADMAP-ALL-implement-all-ideated-ananke-plexus-capabilities/plan.md

@@ -0,0 +1,7 @@
+# Implementation Plan
+
+## Steps
+1. Validate requirement and acceptance criteria.
+2. Compile Ananke BMAD contracts.
+3. Implement code changes with tests.
+4. Run verify and finalize evidence.

ananke_plexus-0.1.0/.ananke/specs/ANANKE-ROADMAP-ALL-implement-all-ideated-ananke-plexus-capabilities/requirement.md

@@ -0,0 +1,14 @@
+# Requirement ANANKE-ROADMAP-ALL
+
+## Title
+Implement all ideated Ananke Plexus capabilities
+
+## Body
+Drive implementation across all roadmap phases including core, specs, architecture, graph, policy, MCP, APM, lifecycle, run engine, and release hardening.
+
+## Acceptance Criteria
+- All epics A-M have tracked implementation tasks
+- Spec pipeline maintains lock and drift checks
+- Each roadmap phase is represented by executable milestones
+- Security and provenance controls are part of release criteria
+- MCP APM lifecycle and graph integrations are delivered incrementally

ananke_plexus-0.1.0/.ananke/specs/ANANKE-ROADMAP-ALL-implement-all-ideated-ananke-plexus-capabilities/spec.lock.json

@@ -0,0 +1,11 @@
+{
+  "feature_dir": "ANANKE-ROADMAP-ALL-implement-all-ideated-ananke-plexus-capabilities",
+  "content_hash": "613971010993379c67dcf1058c23d1bdfa4895035a37386d6ebf8d0f2f82652f",
+  "files": {
+    "requirement.md": "37b7485df865b25961f0e8c1f5760feb68e0b123238f6c7eee4d760ad255a82f",
+    "spec.md": "ededc5025f08bf9d349b09283356742e297de58dbc1d2e7d36124eda0555a1d1",
+    "plan.md": "2a7d1538ba7854451dc133bd43725e8745aa85837a855aa5587859d7f74a0e6b",
+    "tasks.md": "76728d2bea9bc0ec7461b9bd88bb695885af6efa4be0942064106104f99dd481",
+    "bmad.yaml": "a39768c96bc137b39746add3401d418dbdc35168181844afd18bd7b2ad994c2e"
+  }
+}

ananke_plexus-0.1.0/.ananke/specs/ANANKE-ROADMAP-ALL-implement-all-ideated-ananke-plexus-capabilities/spec.md

@@ -0,0 +1,11 @@
+# Spec for ANANKE-ROADMAP-ALL
+
+## Scope
+Implement the requirement with explicit, testable behavior.
+
+## Behavioral Contract
+- AC: All epics A-M have tracked implementation tasks
+- AC: Spec pipeline maintains lock and drift checks
+- AC: Each roadmap phase is represented by executable milestones
+- AC: Security and provenance controls are part of release criteria
+- AC: MCP APM lifecycle and graph integrations are delivered incrementally

ananke_plexus-0.1.0/.ananke/specs/ANANKE-ROADMAP-ALL-implement-all-ideated-ananke-plexus-capabilities/tasks.md

@@ -0,0 +1,7 @@
+# Task Checklist
+
+- [ ] Create/adjust tests
+- [ ] Implement requirement behavior
+- [ ] Validate architecture impact
+- [ ] Run verification gates
+- [ ] Attach evidence bundle to review

ananke_plexus-0.1.0/.env.example

@@ -0,0 +1,42 @@
+# ── Ananke Plexus local environment template ─────────────────────────────────
+# Copy to .env and fill in values you actually need.
+# Never commit .env to git.
+# Secrets are referenced by name in config (not stored inline).
+
+# ── Publishing via uv ─────────────────────────────────────────────────────────
+# Used by: make publish-pypi / make publish-testpypi
+# In CI, OIDC Trusted Publishing is used instead — no token needed.
+UV_PUBLISH_TOKEN=pypi-xxxx_replace_me
+UV_PUBLISH_TOKEN_TESTPYPI=pypi-xxxx_replace_me
+
+# ── Security scanning ─────────────────────────────────────────────────────────
+# TRIVY_TOKEN is only needed if scanning private registries
+# TRIVY_TOKEN=
+
+# Gitleaks licence key (optional — community edition works without it)
+# GITLEAKS_LICENSE=
+
+# ── Jira integration ─────────────────────────────────────────────────────────
+ANANKE_JIRA_BASE_URL=https://your-domain.atlassian.net
+ANANKE_JIRA_EMAIL=you@example.com
+ANANKE_JIRA_TOKEN=
+# Or use a command reference in config.toml: token = { env = "ANANKE_JIRA_TOKEN" }
+
+# ── Confluence integration ────────────────────────────────────────────────────
+ANANKE_CONFLUENCE_BASE_URL=https://your-domain.atlassian.net
+ANANKE_CONFLUENCE_EMAIL=you@example.com
+ANANKE_CONFLUENCE_TOKEN=
+
+# ── Bitbucket integration ─────────────────────────────────────────────────────
+ANANKE_BITBUCKET_BASE_URL=https://api.bitbucket.org
+ANANKE_BITBUCKET_WORKSPACE=your-workspace
+ANANKE_BITBUCKET_REPO_SLUG=your-repo
+ANANKE_BITBUCKET_USERNAME=
+ANANKE_BITBUCKET_APP_PASSWORD=
+
+# ── MCP HTTP bearer token (for ananke serve-mcp --transport http) ─────────────
+ANANKE_MCP_HTTP_TOKEN=
+
+# ── Runtime behaviour ─────────────────────────────────────────────────────────
+ANANKE_OFFLINE=false
+ANANKE_FAIL_CLOSED=true

ananke_plexus-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,120 @@
+name: ci
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    name: quality (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: "latest"
+          enable-cache: true
+
+      - name: Set up Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --all-extras --python ${{ matrix.python-version }}
+
+      - name: Lint (ruff check)
+        run: uv run ruff check src tests
+
+      - name: Format check (ruff format)
+        run: uv run ruff format --check src tests
+
+      - name: Type check (mypy)
+        run: uv run mypy src
+
+      - name: Tests with coverage
+        run: uv run pytest --cov=src/ananke --cov-report=xml --cov-report=term
+
+      - name: Upload coverage report
+        if: matrix.python-version == '3.11'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage.xml
+
+  build:
+    name: build & validate
+    runs-on: ubuntu-latest
+    needs: quality
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: "latest"
+
+      - name: Build wheel and sdist
+        run: uv build
+
+      - name: Validate package metadata (twine check)
+        run: uv run --with twine twine check dist/*
+
+      - name: Smoke-test wheel install
+        run: |
+          uv run --with dist/*.whl --no-project -- ananke version
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-${{ github.sha }}
+          path: dist/
+
+  trivy:
+    name: trivy filesystem scan
+    runs-on: ubuntu-latest
+    needs: quality
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Trivy — SARIF report (upload to Security tab)
+        uses: aquasecurity/trivy-action@v0.28.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          trivyignores: .trivyignore
+
+      - name: Upload Trivy SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif
+
+      - name: Trivy — blocking table scan (CRITICAL only)
+        uses: aquasecurity/trivy-action@v0.28.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          severity: CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore
+          exit-code: "1"

ananke_plexus-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,33 @@
+name: codeql
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["python"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

ananke_plexus-0.1.0/.github/workflows/dependency-review.yml

@@ -0,0 +1,14 @@
+name: dependency-review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4

ananke_plexus-0.1.0/.github/workflows/docs.yml

@@ -0,0 +1,29 @@
+name: docs
+
+on:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install docs dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install .[docs]
+
+      - name: Build and deploy docs
+        run: mkdocs gh-deploy --force

ananke_plexus-0.1.0/.github/workflows/release-pypi.yml

@@ -0,0 +1,142 @@
+name: release-pypi
+
+# Triggered by a vX.Y.Z tag push.
+# Build-once, attest, scan with Trivy, then publish via uv + OIDC Trusted Publishing.
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  # ── 1. Build ───────────────────────────────────────────────────────────────
+  build:
+    name: build artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: "latest"
+
+      - name: Build wheel and sdist
+        run: uv build
+
+      - name: Validate package metadata
+        run: uv run --with twine twine check dist/*
+
+      - name: Generate SBOM (CycloneDX)
+        run: |
+          uv run --with cyclonedx-bom cyclonedx-py environment \
+            --output-format json \
+            --output-file dist/sbom.cdx.json
+        continue-on-error: true
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: pypi-dist-${{ github.ref_name }}
+          path: dist/
+          if-no-files-found: error
+
+  # ── 2. Trivy security gate ─────────────────────────────────────────────────
+  trivy:
+    name: trivy security gate
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Trivy SARIF scan (all severities)
+        uses: aquasecurity/trivy-action@v0.28.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH,MEDIUM
+          ignore-unfixed: true
+          trivyignores: .trivyignore
+
+      - name: Upload SARIF to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif
+
+      - name: Trivy blocking gate (CRITICAL + HIGH, unfixed)
+        uses: aquasecurity/trivy-action@v0.28.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          trivyignores: .trivyignore
+          exit-code: "1"
+
+  # ── 3. Build provenance attestation ───────────────────────────────────────
+  provenance:
+    name: attest provenance
+    runs-on: ubuntu-latest
+    needs: [build, trivy]
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+    steps:
+      - name: Download dist
+        uses: actions/download-artifact@v4
+        with:
+          name: pypi-dist-${{ github.ref_name }}
+          path: dist/
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: "dist/*"
+
+  # ── 4. Publish to PyPI ─────────────────────────────────────────────────────
+  publish:
+    name: publish to PyPI
+    runs-on: ubuntu-latest
+    needs: [build, trivy, provenance]
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - name: Download exact dist artifacts from build step
+        uses: actions/download-artifact@v4
+        with:
+          name: pypi-dist-${{ github.ref_name }}
+          path: dist/
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: "latest"
+
+      - name: Publish to PyPI (OIDC Trusted Publishing)
+        run: uv publish --trusted-publishing always
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          generate_release_notes: true
+          body: |
+            ## ${{ github.ref_name }}
+
+            Published to [PyPI](https://pypi.org/project/ananke-plexus/).
+            See [CHANGELOG.md](https://github.com/neo-pragnya/ananke-plexus/blob/main/CHANGELOG.md) for details.