crupier 0.1.0__tar.gz

crupier-0.1.0/.env.example

@@ -0,0 +1,7 @@
+OPENAI_API_KEY=
+ANTHROPIC_API_KEY=
+GOOGLE_API_KEY=
+GEMINI_API_KEY=
+OLLAMA_API_KEY=
+OLLAMA_HOST=https://ollama.com/api
+OPENROUTER_API_KEY=

crupier-0.1.0/CHANGELOG.md

@@ -0,0 +1,95 @@
+# Changelog
+
+All notable changes to Crupier will be documented here.
+
+## 0.1.0 - 2026-06-20
+
+- Added multi-provider routing core with dry-run and real execution paths.
+- Added OpenAI, Anthropic Claude, Google Gemini, and Ollama Cloud adapters with explicit local-host override support.
+- Added a real optional OpenRouter BYOK adapter using OpenAI-compatible SDK calls, explicit default host configuration, and onboarding env-key coverage.
+- Added model discovery, capability probes, readiness checks, and registry snapshots.
+- Added bounded provider-call retries with backoff, trace-visible failed attempts, per-request retry overrides, and fallback-compatible retry accounting.
+- Added provider timeout handling for OpenAI, Anthropic Claude, Ollama, OpenRouter, and Google Gemini client configuration.
+- Added OpenAI unsupported-parameter repair so models that reject optional parameters such as `temperature` can retry once without the unsupported field.
+- Added structured output validation/repair, native JSON-schema request formatting for OpenAI/OpenRouter, Google, and Ollama, tool execution, multimodal file planning, and local trace storage.
+- Added OpenAI-compatible client, optional autopatch, and HTTP proxy surfaces.
+- Added project adoption audit, adoption doctor, production readiness gates, code comments, compare evals, and human feedback signals.
+- Added adoption `review_contract` summaries that separate technical readiness from human approval and block auto-approval while human gates remain open.
+- Hardened the OpenAI-compatible local server defaults so non-loopback binds require explicit opt-in and browser CORS is disabled unless an origin is configured.
+- Added config-free `adopt doctor`, `adopt plan`, `adopt patches`, and offline `adopt handoff` so freshly cloned repos can get non-destructive adoption guidance before `crupier init`.
+- Added `.env.example` creation and safe `.gitignore` entries to `crupier init` for new project onboarding.
+- Added a release gate for safe public onboarding defaults, including Ollama Cloud as the default Ollama host and opt-in prompt/response storage.
+- Added one-command `adopt package` to write the full human review bundle and persistent package index for an existing project.
+- Tightened programmer credential comments to reduce false positives from redaction regexes, short identifiers, generated output, and dependency trees.
+- Added human review packets for compare reports with ready-to-run feedback commands.
+- Added editable human decision templates and feedback import for reviewer-filled verdicts.
+- Added dry-run feedback source guards so simulated compare reports cannot satisfy production human-feedback gates by accident.
+- Added programmer code-comment review acknowledgements for adoption doctor gates.
+- Added PR/review-comment packets for programmer code comments.
+- Added SARIF export for programmer code comments and adoption packages.
+- Added editable programmer code-comment decision templates and import so partial human review keeps unresolved comments pending.
+- Classified credential-like test fixtures as P3 reviewer notes instead of P1 production credential blockers.
+- Added an executable offline SDK dry-run example for first-run onboarding without provider SDKs or API keys.
+- Added workplace-style offline examples for customer support triage, agentic pull-request review, multimodal claim review, drop-in AI boundary adoption, and a larger multi-workflow operations hub, plus fuller routing/model-compare datasets.
+- Added adoption handoff reports for reviewer-facing rollout actions, decision templates, and artifacts.
+- Added project-level adoption signoff records and production gates for human rollout approval/rejection.
+- Added production doctor checks for human feedback applied to capability cards.
+- Added release readiness checks and CI workflow.
+- Reworked README.md as a developer-first guide covering installation, SDK usage, provider setup, routing, adoption paths, multimodal input, operations, and release gates.
+- Clarified developer-facing adoption language so Crupier is positioned as a multi-provider AI orchestration layer, with OpenAI-compatible proxy/client support as an optional adoption path rather than the core scope.
+- Clarified multimodal README guidance to include Google Gemini native image execution support alongside OpenAI, Anthropic Claude, and Ollama adapters.
+- Kept the public repository and built distributions focused on package code, README, examples, changelog, issues, and onboarding artifacts rather than exposing internal planning documents or extra community policy files.
+- Added release checks that block reintroducing internal `docs/`, extra community policy files, or blank public issue forms before publication.
+- Added release checks for broken public Markdown code fences and relative links before publication.
+- Added public GitHub YAML syntax checks for workflows, Dependabot, and issue templates before publication.
+- Added a tracked-file secret pattern scan so provider-key shaped credentials cannot silently enter the public repository.
+- Added a repository `.gitignore` release check so local keys, caches, builds, and generated Crupier artifacts stay protected before public release.
+- Added a release check that keeps README links absolute for PyPI rendering.
+- Added PyPI publish workflow tag/manual-version matching and documented the final public release order.
+- Hardened the PyPI publish workflow so draft or non-final GitHub Releases cannot publish the final package.
+- Hardened the PyPI publish workflow so GitHub Release and manual publish paths only run from `main`.
+- Hardened the PyPI publish workflow so the checked-out release/manual commit must match `origin/main` before building or uploading distributions.
+- Serialized PyPI publish workflow runs per ref so duplicate release/manual triggers cannot race each other.
+- Scoped PyPI trusted-publishing permissions to the publish job and linked the `pypi` environment to the package page.
+- Hardened the PyPI publish workflow so the first `0.1.0` upload requires an available project name while later releases allow the already-owned PyPI project.
+- Aligned the repository development allowlist with currently verified OpenAI, Anthropic Claude, and Ollama Cloud models, and clarified the provider-readiness remediation path when real checks need capability probes.
+- Aligned the repository development provider config with the final OpenAI, Anthropic Claude, Google Gemini, and Ollama Cloud readiness gate.
+- Added public package discovery metadata for AI-oriented PyPI classification and GitHub repository topics.
+- Added Trove classifier validation to the dev release path so invalid PyPI classifiers are caught before upload.
+- Added a release guard requiring public PyPI classifiers for every Python version tested in CI.
+- Added release-guide guards so final provider-readiness commands include Google Gemini alongside OpenAI, Anthropic Claude, and Ollama Cloud.
+- Added a global `--env-file` CLI option for loading local ignored provider keys during real-provider checks without passing secrets as command arguments.
+- Added a public model-example release guard so README and CLI examples stay aligned with the current default allowlist.
+- Added public repository settings guidance for focused GitHub surfaces, squash-only merges, vulnerability reporting, and secret scanning before opening the project.
+- Added public branch-protection guidance for `main` after the final single release commit, with required CI and no force pushes before accepting public changes.
+- Tightened the PyPI publishing workflow so trusted publishing runs through the `pypi` environment and repeats the first-upload PyPI name preflight.
+- Added CONTRIBUTING.md with local development, provider-key handling, PR, public onboarding, and release-gate expectations.
+- Added MIT license metadata for package release readiness.
+- Tightened public PyPI metadata checks for keywords and classifiers without using legacy license classifiers rejected by modern setuptools.
+- Added a non-blocking project URL readiness warning so public PyPI uploads do not ship with placeholder or missing repository links by accident.
+- Added sdist + wheel build, artifact content inspection, `twine check`, py.typed packaging, and wheel/sdist install/import/CLI/`crupier init`/dry-run route/Python SDK quickstart smoke validation to release checks.
+- Added built wheel/sdist PyPI metadata inspection for name, version, summary, Python requirement, license, project URLs, classifiers, and extras.
+- Excluded the repository-local `crupier.toml` from release artifacts and added a guard so local project config cannot leak into PyPI distributions.
+- Excluded repository tests from PyPI distributions and added an artifact guard so package uploads stay focused on runtime code, public examples, and onboarding files.
+- Kept Ollama Cloud/local REST support dependency-free in the base package and added release guards against incomplete provider extras or reintroducing the unused Ollama Python SDK dependency.
+- Added `crupier release check --strict-public` so PyPI publishing blocks on warnings such as missing public project URLs and on skipped build/install smoke checks.
+- Added opt-in `crupier release check --verify-providers` for final public release gates with real provider discovery, readiness, and smoke validation.
+- Increased real-provider smoke output budget to avoid false negatives on reasoning-heavy models that spend some tokens before emitting text.
+- Added release artifact inspection for the offline SDK example so the sdist keeps first-run onboarding examples.
+- Added release smoke validation for public examples from the built sdist so packaged examples stay executable without provider keys.
+- Added wheel/sdist install smoke validation for exported public API names in `crupier.__all__`.
+- Added `crupier --version` and release smoke validation for installed CLI version output.
+- Added release smoke validation for installed `python -m crupier --version` module execution.
+- Added release checks and artifact inspection for CONTRIBUTING.md so public development guidance is shipped and maintained.
+- Added a PyPI publish workflow for GitHub Release based publishing.
+- Added a release-language guard so final `0.1.0` package metadata and public onboarding files do not regress into non-final release labels.
+- Added optional `crupier release check --check-pypi-name` with `--allow-existing-pypi-project` for first-upload and maintenance-release PyPI name preflights.
+- Added `crupier release check --verify-project-urls` for public package-link reachability checks before PyPI upload.
+- Added public collaboration templates and release checks for bug reports, feature requests, and pull requests.
+- Added required issue-template safety confirmations so public bug reports and feature requests ask reporters to remove keys, prompts, provider responses, customer data, `.env`, and `.crupier/` artifacts before posting.
+- Added Dependabot configuration for Python tooling and GitHub Actions plus release checks for dependency-update automation and minimal CI permissions.
+- Added public repository guidance and release-check coverage for enabling Dependabot security updates before opening the repository.
+- Updated CI/publish workflows to current GitHub Actions majors and added checked distribution artifact upload before PyPI publishing.
+- Expanded SECURITY.md with scope, private reporting, supported versions, disclosure process, and secret-handling guidance, and added release checks for that content.
+- Added `pip-audit` to the development workflow plus CI and publish dependency vulnerability audit steps.
+- Added Ruff critical lint (`E9,F63,F7,F82`) to dev, CI, publish, and release-readiness checks.

crupier-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,108 @@
+# Contributing to Crupier
+
+Thanks for helping make Crupier reliable for real AI projects. Keep changes small,
+reviewable, and backed by tests or documented manual verification.
+
+## Development Setup
+
+Use Python 3.11 or newer:
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+python -m pip install --upgrade pip
+python -m pip install -e ".[dev]"
+python -m pytest
+```
+
+Run the offline SDK example before changing public onboarding behavior:
+
+```bash
+python examples/sdk_dry_run.py
+```
+
+## Provider Keys
+
+Never commit provider keys, prompts, responses, customer data, traces, or local
+`.crupier/` artifacts. Use environment variables or a local `.env` file ignored
+by git:
+
+```bash
+OPENAI_API_KEY=
+ANTHROPIC_API_KEY=
+GOOGLE_API_KEY=
+GEMINI_API_KEY=
+OLLAMA_API_KEY=
+OLLAMA_HOST=https://ollama.com/api
+```
+
+Use real provider checks only when keys are intentionally loaded:
+
+```bash
+crupier --env-file .env release check --verify-providers --provider openai --provider anthropic --provider google --provider ollama
+```
+
+`--env-file` loads missing variables only; exported shell or CI variables keep precedence.
+
+## Pull Request Checklist
+
+Before opening a PR, run:
+
+```bash
+python -m pytest
+python -m ruff check src tests --select E9,F63,F7,F82
+python -m pip_audit --skip-editable --progress-spinner off
+crupier release check
+```
+
+For release-facing changes, also run:
+
+```bash
+crupier release check --strict-public
+crupier release check --strict-public --verify-project-urls --check-pypi-name
+```
+
+`--strict-public` fails if real public `[project.urls]` are missing.
+Use the combined `--verify-project-urls --check-pypi-name` gate before publishing so package metadata
+links are reachable and first-upload package-name availability is checked against PyPI.
+Do not bypass those checks for a public PyPI upload.
+
+## Public Onboarding
+
+Update `README.md`, `CHANGELOG.md`, package metadata, and examples whenever behavior changes.
+Public examples must be executable without secrets unless they are explicitly marked as real-provider checks.
+
+## Public Repository Settings
+
+Before changing repository visibility to public, keep the public surface focused:
+
+- Issues enabled; wiki and projects disabled unless there is an active maintainer workflow for them.
+- GitHub topics set for AI, agents, LLM routing, orchestration, and Python discoverability.
+- Pull requests merged with squash commits and head branches deleted after merge.
+- Dependabot security updates enabled and unpaused for dependency vulnerability remediation.
+- Protect `main` after the final single release commit is accepted: require the CI workflow, require pull-request review for public changes, and disallow force pushes.
+- Private vulnerability reporting enabled once GitHub exposes it for the public repository.
+- Secret scanning and push protection enabled once available for the repository visibility/account.
+
+After the visibility change, rerun:
+
+```bash
+crupier release check --strict-public --verify-project-urls --check-pypi-name
+crupier release check --strict-public --verify-providers --provider openai --provider anthropic --provider google --provider ollama
+```
+
+Publish `0.1.0` from a GitHub Release tagged `v0.1.0` or `0.1.0` only after
+PyPI trusted publishing is configured for this repository and the `pypi`
+environment. The publish workflow checks the release tag against the package
+version before building or uploading distributions. Manual workflow dispatch
+must provide `version=0.1.0` and `confirm_publish=true`; use it only to retry an
+intentional release operation.
+For `0.1.0`, the workflow requires the PyPI project name to be unclaimed. For
+later package versions, the workflow allows the existing PyPI project name so
+maintenance releases can publish after the first upload establishes ownership.
+
+## Release Discipline
+
+Crupier public releases use final numeric versions such as `0.1.0`. Do not
+publish non-final, development, or local build versions unless the release
+policy is intentionally changed.

crupier-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Crupier contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crupier-0.1.0/MANIFEST.in

@@ -0,0 +1,15 @@
+include README.md
+include CONTRIBUTING.md
+include LICENSE
+include SECURITY.md
+include CHANGELOG.md
+include .env.example
+recursive-include examples *.json *.py
+prune .crupier
+prune .venv
+prune dist
+prune build
+prune tests
+global-exclude __pycache__/*
+global-exclude *.py[cod]
+global-exclude .DS_Store