atomadic-forge 0.19.0__tar.gz → 0.51.0__tar.gz

{atomadic_forge-0.19.0 → atomadic_forge-0.51.0}/.github/workflows/ci.yml

@@ -95,23 +95,8 @@ jobs:
           name: atomadic-forge-dist
           path: dist/*
 
-  metrics:
-    name: Metrics freshness
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-          cache: pip
-
-      - name: Install package
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install -e ".[dev]"
-
-      - name: Verify forge_metrics.json is current
-        run: python scripts/update_metrics.py --check
+  # v0.49.0+ — the canonical metrics gate now lives in
+  # .github/workflows/metrics-drift.yml using `forge metrics --apply`
+  # against the live TOOLS dict. The legacy scripts/update_metrics.py
+  # ships only the propagation helper for site repos; it is no longer
+  # the gate.

atomadic_forge-0.51.0/.github/workflows/mcp-registry-publish.yml

@@ -0,0 +1,104 @@
+name: MCP Registry Publish
+
+# v0.50.0 — every tag automatically publishes server.json to the MCP
+# Official Registry (registry.modelcontextprotocol.io). The version
+# field in server.json is rewritten to match the tag, the description
+# is refreshed from forge_metrics.json so the registry's listing always
+# carries the live tool count, and the published artifact is uploaded
+# via mcp-publisher's GitHub OIDC flow (no PAT or manual publishing).
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish (defaults to the tag name without v prefix)"
+        required: false
+        default: ''
+
+permissions:
+  id-token: write   # OIDC auth to the MCP registry
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 6
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve version
+        id: ver
+        run: |
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            v="${GITHUB_REF_NAME#v}"
+          elif [ -n "${{ inputs.version }}" ]; then
+            v="${{ inputs.version }}"
+          else
+            v="$(python -c 'import re,pathlib; t=pathlib.Path("pyproject.toml").read_text(); m=re.search(r"^version\\s*=\\s*\"([^\"]+)\"", t.split("[project]",1)[1], re.M); print(m.group(1))')"
+          fi
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+
+      - name: Sync server.json with tag + live metrics
+        run: |
+          set -euo pipefail
+          v="${{ steps.ver.outputs.version }}"
+          # Pull live numbers so the registry description always cites
+          # the current MCP tool / action count instead of drifting.
+          tools=$(jq -r '.mcp_tools // 10' forge_metrics.json)
+          actions=$(jq -r '.mcp_actions // 64' forge_metrics.json)
+          theorems=$(jq -r '.lean_theorems.count // 886' forge_metrics.json)
+          # Rewrite version (top-level + first package entry) and refresh
+          # the description string with the live numbers.
+          # Registry caps description at 100 chars — keep it punchy +
+          # carry live numbers. Long form lives in README/website.
+          jq \
+            --arg v "$v" \
+            --arg tools "$tools" \
+            --arg actions "$actions" \
+            --arg theorems "$theorems" \
+            '.version = $v
+             | .packages[0].version = $v
+             | .description = "Architecture compiler for AI code. \($tools) tools, \($actions) actions, \($theorems) Lean4 proofs, 100/100 self-cert."' \
+            server.json > /tmp/server.json
+          mv /tmp/server.json server.json
+          echo "── server.json after sync ──"
+          cat server.json
+
+      - name: Install mcp-publisher
+        run: |
+          # Pre-built CLI; falls back to building from source on miss.
+          set -euo pipefail
+          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64" \
+            -o /usr/local/bin/mcp-publisher || {
+              echo "binary unavailable, building from source"
+              go install github.com/modelcontextprotocol/registry/cmd/publisher@latest
+              cp "$(go env GOPATH)/bin/publisher" /usr/local/bin/mcp-publisher
+            }
+          chmod +x /usr/local/bin/mcp-publisher
+          mcp-publisher --version || true
+
+      - name: Authenticate via GitHub OIDC
+        run: mcp-publisher login github-oidc
+
+      - name: Publish to MCP Registry
+        run: mcp-publisher publish
+
+      - name: Smoke-check published version
+        run: |
+          set -euo pipefail
+          v="${{ steps.ver.outputs.version }}"
+          # Allow up to ~30s for the registry to propagate.
+          for i in 1 2 3 4 5 6; do
+            sleep 5
+            got=$(curl -fsS "https://registry.modelcontextprotocol.io/v0/servers?search=atomadic-forge" \
+                   | jq -r '.servers[0].server.version' || echo "")
+            echo "registry reports version: $got (want $v)"
+            if [ "$got" = "$v" ]; then
+              echo "PASS: registry shows v$v"
+              exit 0
+            fi
+          done
+          echo "::warning::registry did not propagate v$v within 30s; check registry.modelcontextprotocol.io manually"

atomadic_forge-0.51.0/.github/workflows/metrics-auto-regen.yml

@@ -0,0 +1,101 @@
+name: Metrics Auto-Regenerate
+
+# Single-source-of-truth pipeline. On every push to main, recomputes the
+# canonical forge_metrics.json artifact and pushes a follow-up commit if
+# the artifact drifted from what the source tree should produce.
+#
+# Together with metrics-drift.yml (CI gate on PRs), this means:
+#   - PRs are blocked on stale metrics.
+#   - Direct pushes to main self-heal automatically.
+#   - Public surfaces (atomadic.tech, shields.io endpoints proxied by
+#     the worker) always read live numbers from the same JSON.
+#
+# Lean theorem count requires the IP-protected mhed-codex repo. The
+# FORGE_MHED_CODEX_REPO secret (org-level) provides a deploy-key URL;
+# without it the lean_theorems block is preserved from the prior commit
+# (see surgical merge step below) so this workflow never destroys real
+# numbers when running without the IP repo attached.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src/atomadic_forge/**"
+      - "tests/**"
+      - "pyproject.toml"
+      - "src/atomadic_forge/a1_at_functions/forge_metrics.py"
+      - "src/atomadic_forge/a3_og_features/forge_metrics_feature.py"
+
+permissions:
+  contents: write
+
+jobs:
+  regen:
+    runs-on: ubuntu-latest
+    timeout-minutes: 8
+    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, 'chore(metrics): auto-regenerate') }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install package
+        run: pip install -e . --quiet
+      - name: Run pytest to count live passing
+        id: pytest
+        run: |
+          set +e
+          out=$(python -m pytest tests/ -q --no-header 2>&1 | tail -3)
+          echo "$out"
+          passed=$(echo "$out" | grep -oE '[0-9]+ passed' | head -1 | grep -oE '[0-9]+')
+          echo "passed=${passed:-0}" >> "$GITHUB_OUTPUT"
+      - name: Optionally clone IP-protected mhed-codex (preserves lean count)
+        # GitHub Actions disallows `secrets.*` in `if` — runtime check
+        # inside the script instead. No-op if the deploy key is unset.
+        env:
+          MHED_CODEX_DEPLOY_KEY: ${{ secrets.MHED_CODEX_DEPLOY_KEY }}
+        run: |
+          if [ -z "${MHED_CODEX_DEPLOY_KEY:-}" ]; then
+            echo "MHED_CODEX_DEPLOY_KEY not set — skipping mhed-codex clone."
+            exit 0
+          fi
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          echo "$MHED_CODEX_DEPLOY_KEY" > ~/.ssh/mhed_key && chmod 600 ~/.ssh/mhed_key
+          GIT_SSH_COMMAND="ssh -i ~/.ssh/mhed_key -o StrictHostKeyChecking=no" \
+            git clone --depth 1 git@github.com:atomadictech/mhed-codex.git /tmp/mhed-codex
+          echo "FORGE_MHED_CODEX=/tmp/mhed-codex" >> "$GITHUB_ENV"
+      - name: Regenerate forge_metrics.json
+        run: |
+          # Save the previous lean_theorems block so we can preserve it
+          # when no mhed-codex is attached (avoid zeroing the public
+          # number on a routine source-only push).
+          python -c "import json; d=json.load(open('forge_metrics.json')); print(json.dumps(d.get('lean_theorems', {})))" > /tmp/prev_lean.json
+          forge metrics --apply --tests-passing ${{ steps.pytest.outputs.passed }}
+          # If no mhed-codex was attached this run, restore prior lean block.
+          if [ -z "${FORGE_MHED_CODEX:-}" ]; then
+            python <<'PY'
+          import json, pathlib
+          p = pathlib.Path("forge_metrics.json")
+          d = json.loads(p.read_text())
+          prev = json.loads(pathlib.Path("/tmp/prev_lean.json").read_text())
+          # Only restore if the freshly-computed block reports found=False
+          # (i.e. mhed-codex unavailable) AND the prior had a real count.
+          if not d.get("lean_theorems", {}).get("found") and prev.get("count"):
+              d["lean_theorems"] = prev
+              p.write_text(json.dumps(d, indent=2, sort_keys=True) + "\n")
+          PY
+          fi
+      - name: Commit if drifted
+        run: |
+          git config user.name  "atomadic-bot"
+          git config user.email "bot@atomadic.tech"
+          if git diff --quiet -- forge_metrics.json; then
+            echo "metrics already current — no commit"
+            exit 0
+          fi
+          git add forge_metrics.json
+          git commit -m "chore(metrics): auto-regenerate forge_metrics.json [skip ci]"
+          git push origin main

atomadic_forge-0.51.0/.github/workflows/metrics-drift.yml

@@ -0,0 +1,67 @@
+name: Metrics Drift Gate
+
+# CI gate that keeps forge_metrics.json in sync with the live forge surface.
+# Any PR that changes TOOLS, CLI registry, source/test counts, or
+# pyproject.toml WITHOUT regenerating forge_metrics.json fails this check.
+#
+# Lean theorem count is recomputed only when the FORGE_MHED_CODEX repo is
+# accessible (CI env var). When not set, the lean_theorems block is
+# preserved from the in-tree forge_metrics.json so PRs that don't touch
+# mhed-codex don't get blocked here.
+#
+# Fix when this fails:  forge metrics --apply && git add forge_metrics.json
+
+on:
+  pull_request:
+    paths:
+      - "src/atomadic_forge/a0_qk_constants/schema_version_registry.py"
+      - "src/atomadic_forge/a1_at_functions/mcp_protocol.py"
+      - "src/atomadic_forge/a1_at_functions/forge_metrics.py"
+      - "src/atomadic_forge/a3_og_features/forge_metrics_feature.py"
+      - "src/atomadic_forge/a4_sy_orchestration/cli.py"
+      - "src/atomadic_forge/commands/**"
+      - "pyproject.toml"
+      - "forge_metrics.json"
+  push:
+    branches: [main]
+
+jobs:
+  metrics-drift:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install package (editable)
+        run: pip install -e . --quiet
+      - name: Compute live metrics + diff vs. checked-in artifact
+        run: |
+          set -euo pipefail
+          # Save committed copy.
+          cp forge_metrics.json /tmp/forge_metrics.committed.json
+          # Recompute (Lean count zero in CI unless FORGE_MHED_CODEX is wired).
+          forge metrics --apply
+          # If the only delta is the timestamp, that's expected — strip it
+          # before diffing so we only fail on substantive drift.
+          jq 'del(.generated_at_utc)' /tmp/forge_metrics.committed.json > /tmp/a.json
+          jq 'del(.generated_at_utc)' forge_metrics.json > /tmp/b.json
+          # Always strip `tests_passing` from the diff — that field is
+          # populated externally (CI test job + --tests-passing flag) and
+          # the committed artifact carries the full pytest count, while
+          # this gate doesn't run pytest. Comparing them is meaningless.
+          jq 'del(.tests_passing)' /tmp/a.json > /tmp/a2.json && mv /tmp/a2.json /tmp/a.json
+          jq 'del(.tests_passing)' /tmp/b.json > /tmp/b2.json && mv /tmp/b2.json /tmp/b.json
+          # If FORGE_MHED_CODEX is not set, also ignore the lean_theorems
+          # block (will be 0 in CI but the committed artifact has the real
+          # count from the IP repo).
+          if [ -z "${FORGE_MHED_CODEX:-}" ]; then
+            jq 'del(.lean_theorems)' /tmp/a.json > /tmp/a2.json && mv /tmp/a2.json /tmp/a.json
+            jq 'del(.lean_theorems)' /tmp/b.json > /tmp/b2.json && mv /tmp/b2.json /tmp/b.json
+          fi
+          if ! diff -u /tmp/a.json /tmp/b.json; then
+            echo "::error::forge_metrics.json is stale. Run 'forge metrics --apply' and commit the result."
+            exit 1
+          fi
+          echo "metrics drift check: OK"

atomadic_forge-0.51.0/.github/workflows/publish-on-tag.yml

@@ -0,0 +1,111 @@
+name: Publish on tag
+
+# v0.50.0 — single tag → full publish chain.
+#
+# Pushing a v* tag fires this workflow, which:
+#   1. Verifies forge_metrics.json is current at the tag (no stale numbers
+#      shipping to PyPI / atomadic.tech / shields.io).
+#   2. Creates a GitHub Release using the matching CHANGELOG section.
+#      The GH-Release event triggers release.yml which builds + publishes
+#      to PyPI.
+#   3. Fires a `repository_dispatch` to atomadic-forge-cloudflare-workers
+#      so the MCP worker redeploys with the same version. Public
+#      surfaces (badges, metrics.json proxy, MCP endpoint) are then in
+#      lockstep with the PyPI release.
+#
+# Required secrets:
+#   GH_TOKEN — automatic (github.token)
+#   WORKER_DEPLOY_PAT — PAT with `repo` scope on the worker repo;
+#       grants permission to fire repository_dispatch. If unset, the
+#       cross-repo dispatch is skipped (worker can be redeployed
+#       manually via its own workflow_dispatch).
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    name: Publish chain (metrics → GH Release → worker dispatch)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install package
+        run: pip install -e . --quiet
+
+      - name: Verify forge_metrics.json is current at this tag
+        run: |
+          set -euo pipefail
+          # Save the in-tree artifact, recompute, diff (ignoring
+          # generated_at_utc and lean_theorems — Lean count requires
+          # the IP-protected mhed-codex repo, not present in CI).
+          cp forge_metrics.json /tmp/forge_metrics.committed.json
+          # Use the most recent passing test count from the suite.
+          set +e
+          ptout=$(python -m pytest tests/ -q --no-header 2>&1 | tail -3)
+          set -e
+          passed=$(echo "$ptout" | grep -oE '[0-9]+ passed' | head -1 | grep -oE '[0-9]+')
+          forge metrics --apply --tests-passing "${passed:-0}"
+          jq 'del(.generated_at_utc) | del(.lean_theorems) | del(.tests_passing)' \
+            /tmp/forge_metrics.committed.json > /tmp/a.json
+          jq 'del(.generated_at_utc) | del(.lean_theorems) | del(.tests_passing)' \
+            forge_metrics.json > /tmp/b.json
+          if ! diff -u /tmp/a.json /tmp/b.json; then
+            echo "::error::forge_metrics.json is stale at tag ${GITHUB_REF_NAME}. Re-run \`forge metrics --apply\` and re-tag."
+            exit 1
+          fi
+
+      - name: Extract changelog for this version
+        id: changelog
+        run: |
+          version="${{ steps.version.outputs.version }}"
+          changelog=$(sed -n "/^## .*${version}/,/^## /{/^## .*${version}/d;/^## /d;p}" CHANGELOG.md | head -100)
+          if [ -z "$changelog" ]; then
+            changelog="Release v${version}"
+          fi
+          echo "$changelog" > /tmp/release_notes.md
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --title "Atomadic Forge ${{ github.ref_name }}" \
+            --notes-file /tmp/release_notes.md
+
+      - name: Dispatch worker redeploy
+        # GitHub Actions does not allow `secrets.*` in `if` expressions —
+        # we check at runtime instead. If the secret is unset, the
+        # dispatch step is a no-op (worker can be redeployed manually
+        # via its own workflow_dispatch).
+        env:
+          PAT: ${{ secrets.WORKER_DEPLOY_PAT }}
+        run: |
+          if [ -z "$PAT" ]; then
+            echo "WORKER_DEPLOY_PAT not set — skipping cross-repo dispatch."
+            exit 0
+          fi
+          curl -fsS -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${PAT}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/atomadictech/atomadic-forge-cloudflare-workers/dispatches \
+            -d "{\"event_type\":\"forge-released\",\"client_payload\":{\"version\":\"${{ steps.version.outputs.version }}\"}}"
+          echo "dispatched forge-released v${{ steps.version.outputs.version }} -> worker repo"

atomadic_forge-0.51.0/.github/workflows/uptime.yml

@@ -0,0 +1,72 @@
+name: Uptime monitor
+
+# Runs every 30 minutes. Pings all Atomadic services and opens an
+# issue if any are down. Free uptime monitoring via GitHub Actions.
+
+on:
+  schedule:
+    - cron: '*/30 * * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  check:
+    name: Health check
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - name: Ping all services
+        id: ping
+        run: |
+          failed=""
+          for entry in \
+            "forge.atomadic.tech|https://forge.atomadic.tech" \
+            "forge-mcp|https://forge.atomadic.tech/mcp" \
+            "chat.atomadic.tech|https://chat.atomadic.tech" \
+            "forge-auth|https://forge-auth.atomadic.tech" \
+          ; do
+            name="${entry%%|*}"
+            url="${entry##*|}"
+            status=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$url" 2>/dev/null || echo "000")
+            # 200, 401, 405 are all "alive" responses for various endpoints
+            if [[ "$status" =~ ^(200|301|302|401|403|405)$ ]]; then
+              echo "OK  $status  $name"
+            else
+              echo "ERR $status  $name"
+              failed="$failed $name($status)"
+            fi
+          done
+
+          if [ -n "$failed" ]; then
+            echo "failed=$failed" >> "$GITHUB_OUTPUT"
+            echo "has_failure=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_failure=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Open issue if services are down
+        if: steps.ping.outputs.has_failure == 'true'
+        uses: actions/checkout@v6
+
+      - name: Create or update issue
+        if: steps.ping.outputs.has_failure == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          title="Uptime alert: services down"
+          body="The following services are unreachable: ${{ steps.ping.outputs.failed }}
+
+          Detected at $(date -u +'%Y-%m-%d %H:%M UTC')
+
+          Run \`make uptime\` locally to verify."
+
+          # Check if an open uptime issue already exists
+          existing=$(gh issue list --label uptime --state open --json number -q '.[0].number' 2>/dev/null || true)
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --body "$body"
+          else
+            gh issue create --title "$title" --body "$body" --label uptime
+          fi