hiveplane 0.1.0__tar.gz

hiveplane-0.1.0/.gitignore

@@ -0,0 +1,128 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+*.manifest
+*.spec
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.dmypy.json
+dmypy.json
+
+# Virtual environments
+.env
+.venv
+venv/
+env/
+ENV/
+env.bak/
+venv.bak/
+
+# uv
+.uv/
+uv.lock
+
+# Poetry
+poetry.lock
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# pyenv
+.python-version
+
+# Django
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Docker run evidence is committed (M23, #93/#96): keep the runner logs.
+!field_test/v0.1.0/docker/*.log
+
+# Flask
+instance/
+.webassets-cache
+
+# SQLite databases
+*.sqlite3
+
+# Environment files / secrets
+.env
+.env.*
+!.env.example
+!.env.ci
+!.env.local
+!.env.cloud
+*.pem
+*.key
+
+# Docker / local state
+docker-compose.override.yml
+data/
+.hiveplane/
+*.pid
+
+# Editor / OS
+.idea/
+.vscode/
+*.swp
+*.swo
+.DS_Store
+Thumbs.db
+
+# Node / React UI
+node_modules/
+.next/
+out/
+.turbo/
+*.tsbuildinfo
+
+# Field-test vendored upstream agent repos (re-cloned via download scripts, not committed)
+field_test/agents/proven/tooltrust/vendor/
+field_test/agents/proven/evalforge/agents/
+field_test/agents/proven/exectrace/agent-github/
+field_test/agents/proven/exectrace/agent-weather/
+field_test/agents/proven/exectrace/agent-crew/
+field_test/agents/proven/exectrace/agent-chatbot/
+field_test/agents/proven/exectrace/agent-react/
+field_test/agents/proven/exectrace/agent-mcp/

hiveplane-0.1.0/CHANGELOG.md

@@ -0,0 +1,66 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-09-25
+
+The first release: the certified control loop. Register agents, certify them against a
+reproducible benchmark, admit only certified agents to production, run them under
+budget/policy/sandbox, intervene on live runs, deliver results, and observe the fleet —
+all locally on Docker Compose with real workloads.
+
+### Added
+
+- **Foundation & data models** — workload manifest (`hiveplane/v1`), run state machine,
+  typed core models, settings, and the MCP tool registry with stable tool IDs and trust levels.
+- **Registry service** — agent registration, desired-state validation, fleet catalog, tool
+  and trigger records, and certification attestation storage.
+- **Certification pipeline (the thesis)** — reproducible benchmark runner, certification
+  engine, signed (Ed25519) attestations verified on read, promotion gate, and drift detector.
+  Production admission requires a valid, unexpired certification.
+- **Run lifecycle & execution API** — task submission, persistent run state
+  (queued → running → paused/completed/failed), pause/resume/cancel controls, admission
+  gates, and durable pause/resume across restarts.
+- **Policy engine & approvals** — deny-by-default tool policy, per-tool authorization,
+  escalation, and a human approval queue with attributed operator actions.
+- **Budget enforcement** — per-run and per-day budgets enforced before expensive work,
+  with model pricing and usage accounting.
+- **Execution sandbox & tool-output shaping** — isolated execution context with resource
+  caps and restricted egress; tool outputs inspected, bounded, and injection-scanned.
+- **Runtime adapters & conformance** — raw-worker and LangGraph adapters plus a conformance
+  suite; model-identity binding reported from actual inference (model-swap defense).
+- **State store & persistence** — PostgreSQL system of record with Alembic migrations and
+  a tamper-evident, chained-hash audit log.
+- **Telemetry & observability** — OpenTelemetry-native traces, metrics, logs, and audit
+  events; fleet metrics and trace-linked debug context; Docker Compose stack with Tempo,
+  Prometheus, and Grafana.
+- **CLI & operator UI** — `hiveplane` CLI (register, validate, certify, submit, runs,
+  approve) and a server-rendered operator UI (fleet list, run detail, approvals, spend).
+- **Result fan-out** — delivery to Slack and generic webhooks with trace + attestation links.
+- **Docker Compose reference stack** — one-command start; `.env` profiles for fake (hermetic),
+  local (OMLX), and cloud (OpenAI) model backends.
+- **Field test** — 10/10 scenarios and all acceptance criteria A1–A20 pass against the live
+  stack; container-layer suite 25/25 green. See
+  [Field Test Report](docs/field-test/v0.1.0/FIELD_TEST_REPORT.md).
+
+### Security
+
+- Deny-by-default tool policy and production admission gated on certification.
+- Signed attestations verified on every read; persistent signing key.
+- Secrets redacted from logs, traces, and audit events.
+- Pre-release secret/dependency audit (trufflehog, `pip-audit`) clean — see
+  [Security audit](docs/release/v0.1.0/security-audit.md) and [SECURITY.md](SECURITY.md).
+
+### Known limitations
+
+- Coverage gate is **92%** (local 93%; CI 95.45% with Postgres).
+- Tier 2 platform coverage is one certified agent per framework (broader coverage deferred).
+- Multi-tenant support, ROI dashboards, and Helm/cluster deployment deferred to v0.4.0.
+
+[Unreleased]: https://github.com/deghosal-2026/hiveplane/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/deghosal-2026/hiveplane/releases/tag/v0.1.0

hiveplane-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,59 @@
+# Contributing to HivePlane
+
+Thanks for your interest. HivePlane is an open-source control plane for operating AI
+agent fleets, and contributions of all kinds are welcome — bug reports, docs, workloads,
+adapters, and code.
+
+## Getting started
+
+```bash
+git clone https://github.com/deghosal-2026/hiveplane.git
+cd hiveplane
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+```
+
+Postgres-backed tests run only when a database is reachable; without one they skip. To
+run the full suite as CI does, start Postgres (see `docker compose up -d postgres`) and
+set the `HIVEPLANE_DATABASE__*` variables (see `.env.example`).
+
+## Quality gates
+
+Every change must pass:
+
+```bash
+make test    # pytest (deterministic suite)
+make cov     # pytest with coverage report (>= 92%)
+make lint    # ruff
+make type    # mypy (strict)
+make check   # lint + type + cov
+```
+
+CI (`.github/workflows/ci.yml`) runs the same gates on Python 3.12 and 3.13 against a
+Postgres service, plus the operator UI browser tests and a Docker image build.
+
+## Making a change
+
+1. Open an issue describing the problem or feature (or comment on an existing one).
+2. Branch from `main`.
+3. Keep changes focused; add tests for behavior changes.
+4. Run the quality gates locally.
+5. Open a pull request with a clear description and link the issue.
+
+Commit messages use a conventional prefix (`feat`, `fix`, `docs`, `test`, `ci`,
+`security`, `chore`) with an optional scope, e.g. `fix(registry): reject empty tool ids`.
+
+## Adding a workload
+
+See [`docs/workloads/CONTRIBUTING.md`](docs/workloads/CONTRIBUTING.md) for the workload
+manifest format, corpus requirements, and validation steps.
+
+## Security
+
+Do **not** open a public issue for a vulnerability — follow the process in
+[SECURITY.md](SECURITY.md).
+
+## License
+
+By contributing, you agree that your contributions are licensed under the
+[MIT License](LICENSE).

hiveplane-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Debashish Ghosal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.