kovrin 2.0.0a1__tar.gz

kovrin-2.0.0a1/.env.example

@@ -0,0 +1,9 @@
+ANTHROPIC_API_KEY=your_key_here
+
+# Brave Search API key for web search tool
+# Free tier: 2,000 queries/month, no credit card required
+# Get your key at: https://api.search.brave.com/
+BRAVE_SEARCH_API_KEY=your_brave_key_here
+
+# Database URL — PostgreSQL for production, SQLite path for local dev
+# DATABASE_URL=postgresql://user:password@localhost:5432/kovrin

kovrin-2.0.0a1/.github/workflows/ci.yml

@@ -0,0 +1,99 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev,api]"
+
+      - name: Lint with ruff
+        run: |
+          ruff check src/ tests/
+
+      - name: Format check with ruff
+        run: |
+          ruff format --check src/ tests/
+
+      - name: Run tests with coverage
+        run: |
+          pytest tests/ -m "not integration" -v --tb=short \
+            --ignore=tests/test_api.py \
+            --ignore=tests/test_superwork_api.py \
+            --cov=src/kovrin --cov-report=xml --cov-report=term-missing \
+            --cov-fail-under=70
+
+      - name: Upload coverage to Codecov
+        if: matrix.python-version == '3.12'
+        uses: codecov/codecov-action@v4
+        with:
+          file: coverage.xml
+          fail_ci_if_error: false
+
+  typecheck:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev,api]"
+
+      - name: Type check with mypy
+        run: |
+          mypy src/kovrin/ --ignore-missing-imports \
+            --no-strict \
+            --warn-return-any \
+            --warn-unused-configs \
+            --disallow-untyped-defs \
+            --exclude 'superwork|examples' \
+            || echo "::warning::mypy found type errors (non-blocking)"
+
+  security:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev,api]"
+          pip install pip-audit
+
+      - name: Dependency audit
+        run: |
+          pip-audit --desc --ignore-vuln PYSEC-0 \
+            --skip-editable \
+            || echo "::warning::pip-audit found issues (non-blocking)"

kovrin-2.0.0a1/.github/workflows/publish.yml

@@ -0,0 +1,50 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write  # Required for trusted publishing
+
+jobs:
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish-pypi:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

kovrin-2.0.0a1/.gitignore

@@ -0,0 +1,71 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+*.egg-info/
+*.egg
+dist/
+build/
+sdist/
+wheels/
+*.whl
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Environment & secrets
+.env
+.env.local
+.env.production
+!.env.example
+
+# Database
+*.db
+*.sqlite3
+
+# Testing & coverage
+.pytest_cache/
+htmlcov/
+.coverage
+.coverage.*
+coverage.xml
+*.cover
+
+# mypy / ruff
+.mypy_cache/
+.ruff_cache/
+
+# Logs
+logs/
+*.log
+
+# Node (dashboard)
+node_modules/
+dashboard/node_modules/
+dashboard/dist/
+dashboard/.vite/
+
+# Claude Code session data
+.claude/
+
+# OS files
+Thumbs.db
+ehthumbs.db
+
+# Jupyter
+.ipynb_checkpoints/
+
+# Distribution / packaging
+*.tar.gz
+*.zip

kovrin-2.0.0a1/.python-version

@@ -0,0 +1 @@
+3.12.12

kovrin-2.0.0a1/CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [2.0.0a1] - 2026-02-24
+
+### Added
+
+- **Constitutional Core (Layer 0)** — 5 immutable axioms with SHA-256 integrity verification. All-or-nothing: one axiom fails = entire task rejected.
+- **Risk-Based Routing Matrix** — Deterministic `(RiskLevel x SpeculationTier) -> RoutingAction` table with 4 autonomy profiles (DEFAULT, CAUTIOUS, AGGRESSIVE, LOCKED). CRITICAL risk always routes to HUMAN_APPROVAL — hardcoded, non-overridable.
+- **Merkle Audit Trail** — SHA-256 hash chain, append-only, tamper-evident. `ImmutableTraceLog` with `verify_integrity()`.
+- **Critic Pipeline** — SafetyCritic (L0 compliance), FeasibilityCritic (capability matching), PolicyCritic (organizational constraints). All must PASS for task execution.
+- **IntentV2 Schema** — AMR-inspired graph with speech act performatives, semantic frames, and HTN decomposition via Claude API.
+- **ExecutionGraph** — DAG-based execution with topological sort, wave-based parallel execution, and dependency resolution.
+- **Watchdog Agent** — Independent safety monitor with temporal rules (NoExecutionAfterRejection, ExcessiveFailureRate, UnexpectedEventSequence). Graduated containment: WARN -> PAUSE -> KILL (irreversible).
+- **Delegation Capability Tokens (DCT)** — HMAC-SHA256 signed tokens with scope narrowing, cascading revocation via TokenAuthority.
+- **MCTS Explorer** — Monte Carlo Tree Search with UCB1 for decomposition exploration.
+- **Beam Search Executor** — Parallel beam execution with pruning.
+- **Process Reward Model (PRM)** — Step-level scoring for agent drift detection.
+- **Speculative Execution** — Three tiers: FREE (read-only), GUARDED (checkpoint/rollback), NONE (human approval).
+- **Safety-Gated Tools** — 8 built-in tools (web_search, calculator, datetime, json_transform, code_analysis, http_request, file_read, file_write) with per-tool risk profiles, sandboxed execution, and Merkle-audited calls.
+- **Multi-Model Providers** — ClaudeProvider, OpenAIProvider, OllamaProvider with ModelRouter and CircuitBreakerProvider for fault tolerance.
+- **Multi-Agent Coordination** — AgentCoordinator with AgentRegistry and DCT-scoped delegation.
+- **CLI** — `kovrin run`, `kovrin verify`, `kovrin audit`, `kovrin serve`, `kovrin status`.
+- **FastAPI Server** — REST + WebSocket + SSE endpoints for pipeline execution, audit, and real-time events.
+- **Schema Exporter** — JSON Schema + TypeScript type generation from Pydantic models (42 models, 17 enums).
+- **TLA+ Formal Verification** — 8 specification modules with 10 machine-checked safety invariants.
+- **741 tests** — Including 42 adversarial attack tests targeting safety bypasses.
+- **CI/CD** — GitHub Actions (pytest, mypy, pip-audit) + Railway auto-deploy.
+- **Brave Search Integration** — Real web search via Brave Search API (free tier).
+- **Custom Exceptions** — KovrinError hierarchy with 10 specific exception types.
+- **Structured Logging** — JSON + human-readable output via `kovrin.logging`.
+
+### Fixed
+
+- FeasibilityCritic false rejections — improved prompt with detailed tool capabilities and explicit evaluation rules. Verified: 4/4 tasks PASS in production.
+
+[2.0.0a1]: https://github.com/nkovalcin/kovrin/releases/tag/v2.0.0a1