maref 0.30.0__tar.gz

maref-0.30.0/.chaos-reports/full-run-20260523-191257.json

@@ -0,0 +1 @@
+{}

maref-0.30.0/.env.example

@@ -0,0 +1,45 @@
+# MAREF Environment Configuration
+# Copy this file to ~/.maref.env (for LaunchAgent) or .env (for project)
+# and fill in your actual API keys
+
+# ==========================================
+# Required: API Keys
+# ==========================================
+
+# 阿里云百炼 DashScope API Key
+# Get yours at: https://dashscope.console.aliyun.com/apiKey
+DASHSCOPE_API_KEY=sk-your-key-here
+
+# Optional: Other LLM providers
+# OPENAI_API_KEY=sk-your-openai-key
+# ANTHROPIC_API_KEY=sk-your-anthropic-key
+
+# ==========================================
+# Optional: Path Configuration
+# Uncomment and set to your absolute paths if needed
+# ==========================================
+
+# MAREF_PROJECT_ROOT=/path/to/maref-experiments
+# MAREF_MAILBOX_DIR=/path/to/mailbox
+# MAREF_OUTPUT_DIR=/path/to/output
+
+# ==========================================
+# Installation Instructions
+# ==========================================
+#
+# For LaunchAgent (macOS):
+#   1. Copy this file to ~/.maref.env
+#   2. Edit ~/.maref.env with your actual API keys
+#   3. Ensure permissions: chmod 600 ~/.maref.env
+#   4. Install LaunchAgent plist
+#   5. The wrapper script will automatically load ~/.maref.env
+#
+# For Project Development:
+#   1. Copy this file to .env in project root
+#   2. Edit .env with your actual API keys
+#   3. .env is already in .gitignore
+#
+# For macOS Keychain (recommended for production):
+#   1. Install keyring: pip install keyring
+#   2. Store key: python -c "import keyring; keyring.set_password('com.maref.agent', 'DASHSCOPE_API_KEY', 'sk-your-key')"
+#   3. The KeyringStore will automatically retrieve from keychain

maref-0.30.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,36 @@
+---
+name: Bug Report
+about: Report a bug in MAREF
+title: "[Bug] "
+labels: ["bug"]
+assignees: []
+---
+
+## Description
+
+Clear and concise description of the bug.
+
+## Steps to Reproduce
+
+1.
+2.
+3.
+
+## Expected Behavior
+
+What you expected to happen.
+
+## Actual Behavior
+
+What actually happened, including error messages or stack traces.
+
+## Environment
+
+- MAREF version: 
+- Python version: 
+- OS: 
+- Dependencies: `pip list | grep -E "maref|torch|pydantic"`
+
+## Additional Context
+
+Any other context, logs, or screenshots.

maref-0.30.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,27 @@
+---
+name: Feature Request
+about: Suggest a new feature for MAREF
+title: "[Feature] "
+labels: ["enhancement"]
+assignees: []
+---
+
+## Problem Statement
+
+What problem does this feature solve?
+
+## Proposed Solution
+
+Describe the feature you'd like to see.
+
+## Alternatives Considered
+
+Any alternative approaches you've thought about.
+
+## Impact
+
+Which MAREF modules/components would be affected?
+
+## Additional Context
+
+Any references, papers, or examples from other projects.

maref-0.30.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,30 @@
+## Description
+
+<!-- Describe your changes -->
+
+## Type of Change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Breaking change
+- [ ] Documentation update
+- [ ] CI/CD improvement
+
+## Testing
+
+- [ ] All existing tests pass
+- [ ] New tests added for new functionality
+- [ ] Coverage does not decrease
+
+## Quality
+
+- [ ] `ruff check` passes
+- [ ] `ruff format --check` passes
+- [ ] `mypy src/` passes (where applicable)
+
+## Checklist
+
+- [ ] I have read the [Contributing Guide](CONTRIBUTING.md)
+- [ ] My code follows the project style conventions
+- [ ] I have added/updated tests
+- [ ] I have updated documentation if needed

maref-0.30.0/.github/dependabot.yml

@@ -0,0 +1,40 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "python"
+
+  - package-ecosystem: "npm"
+    directory: "/gui"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "frontend"
+
+  - package-ecosystem: "cargo"
+    directory: "/gui/src-tauri"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "rust"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "ci"

maref-0.30.0/.github/workflows/ci.yml

@@ -0,0 +1,81 @@
+name: MAREF CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+      - name: Ruff lint
+        run: ruff check src/maref src/maref_lite
+      - name: Ruff format check
+        run: ruff format --check src/maref src/maref_lite
+      - name: Mypy type check
+        run: mypy src/maref src/maref_lite
+
+  test:
+    needs: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+      - name: Run unit tests
+        run: |
+          coverage run -m pytest tests/ -x -q --timeout=120 -m "not integration and not chaos and not benchmark"
+      - name: Validate mock consistency
+        run: python -c "from maref.testing.mock_validator import MockValidator; v=MockValidator(schema_dir=Path('vault/schemas'), mock_dir=Path('vault/mocks')); errors=v.validate_all(); assert not errors, f'Mock mismatch: {errors}'"
+      - name: Coverage report
+        run: coverage report --fail-under=70
+
+  security:
+    needs: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+      - name: Bandit SAST
+        run: bandit -r src/ -c pyproject.toml
+      - name: pip-audit
+        run: pip-audit
+      - name: TruffleHog Secret Scan
+        run: |
+          pip install trufflehog
+          trufflehog filesystem . --config .trufflehog.yaml --since 2026-01-01
+
+  crypto-test:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+      - name: Run cryptography tests
+        run: |
+          pytest tests/compliance/test_crypto_sm2.py tests/compliance/test_crypto_sm3.py tests/compliance/test_crypto_sm4.py -v

maref-0.30.0/.github/workflows/docker.yml

@@ -0,0 +1,220 @@
+name: Docker CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/maref
+  DOCKERHUB_IMAGE: maref/maref
+
+jobs:
+  build:
+    name: Build & Validate Docker Image
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.GHCR_IMAGE }}
+            ${{ env.DOCKERHUB_IMAGE }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=sha,format=short,prefix=sha-
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Verify image metadata
+        run: |
+          docker inspect ${{ steps.meta.outputs.tags }} | python3 -c "
+          import json, sys
+          data = json.load(sys.stdin)[0]
+          labels = data['Config']['Labels']
+          print(f\"Image: {labels.get('org.opencontainers.image.title', 'N/A')}\")
+          print(f\"Version: {labels.get('org.opencontainers.image.version', 'N/A')}\")
+          print(f\"Size: {data['Size'] / 1024 / 1024:.1f} MB\")
+          assert 'MAREF' in labels.get('org.opencontainers.image.title', '')
+          "
+
+      - name: Start container with Xvfb
+        run: |
+          docker run -d --name maref-test \
+            -p 8080:8080 \
+            -e MAREF_DRY_RUN=true \
+            -e DISPLAY=:99 \
+            --entrypoint /bin/bash \
+            ${{ steps.meta.outputs.tags }} \
+            -c "Xvfb :99 -screen 0 1280x720x24 & sleep 1 && maref serve --host 0.0.0.0 --port 8080"
+
+      - name: Wait for healthy
+        run: |
+          for i in $(seq 1 30); do
+            status=$(docker inspect --format='{{json .State.Health.Status}}' maref-test 2>/dev/null || echo "\"starting\"")
+            echo "Attempt $i: Health=$status"
+            if [ "$status" = "\"healthy\"" ]; then
+              echo "✓ Container is healthy!"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "✗ Container failed to become healthy within 60s"
+          docker logs maref-test --tail 50
+          exit 1
+
+      - name: Verify health endpoint
+        run: |
+          curl -sf http://localhost:8080/api/health || \
+            (echo "⚠ Health endpoint not available — checking container logs"; \
+             docker logs maref-test --tail 20)
+
+      - name: Container logs (on failure)
+        if: failure()
+        run: docker logs maref-test --tail 100
+
+      - name: Cleanup
+        if: always()
+        run: docker rm -f maref-test || true
+
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          image: ${{ steps.meta.outputs.tags }}
+          format: cyclonedx
+          output-file: sbom.cdx.json
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: sbom.cdx.json
+
+      - name: Image size report
+        run: |
+          echo "### Docker Image Size Report" >> $GITHUB_STEP_SUMMARY
+          docker images --format "| {{.Repository}}:{{.Tag}} | {{.Size}} |" ${{ steps.meta.outputs.tags }} >> $GITHUB_STEP_SUMMARY
+
+  scan:
+    name: Docker Vulnerability Scan
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image for scan
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: maref/maref:scan
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: image
+          scan-ref: maref/maref:scan
+          format: table
+          exit-code: 1
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+
+      - name: Run Trivy with SARIF output
+        uses: aquasecurity/trivy-action@master
+        if: always()
+        with:
+          scan-type: image
+          scan-ref: maref/maref:scan
+          format: sarif
+          output: trivy-results.sarif
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+
+      - name: Upload Trivy results
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-results.sarif
+          category: docker-vulnerability
+
+      - name: Scan summary
+        if: always()
+        run: |
+          echo "### Docker Vulnerability Scan Results" >> $GITHUB_STEP_SUMMARY
+          echo "Image: \`maref/maref:scan\`" >> $GITHUB_STEP_SUMMARY
+          echo "Severity: HIGH, CRITICAL" >> $GITHUB_STEP_SUMMARY
+          echo "Unfixed: ignored" >> $GITHUB_STEP_SUMMARY
+
+  push:
+    name: Push Docker Images to Registries
+    runs-on: ubuntu-latest
+    needs: [build, scan]
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.GHCR_IMAGE }}
+            ${{ env.DOCKERHUB_IMAGE }}
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,format=short,prefix=sha-
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push Docker images
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Push summary
+        run: |
+          echo "### Docker Image Push Summary" >> $GITHUB_STEP_SUMMARY
+          echo "| Registry | Image | Tags |" >> $GITHUB_STEP_SUMMARY
+          echo "|----------|-------|------|" >> $GITHUB_STEP_SUMMARY
+          echo "| GHCR | ${{ env.GHCR_IMAGE }} | ${{ steps.meta.outputs.tags }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Docker Hub | ${{ env.DOCKERHUB_IMAGE }} | ${{ steps.meta.outputs.tags }} |" >> $GITHUB_STEP_SUMMARY

maref-0.30.0/.github/workflows/formal-verify.yml

@@ -0,0 +1,27 @@
+name: Formal Verification
+
+on:
+  push:
+    paths:
+      - 'src/formal/**'
+      - 'src/maref/governance/**'
+  pull_request:
+    paths:
+      - 'src/formal/**'
+      - 'src/maref/governance/**'
+  workflow_dispatch:
+
+jobs:
+  tla-verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup TLA+
+        run: |
+          wget -q https://github.com/tlaplus/tlaplus/releases/download/v1.4.5/tla2tools.jar -O /tmp/tla2tools.jar
+      - name: Verify Gray Code FSM
+        run: |
+          java -cp /tmp/tla2tools.jar tlc2.TLC src/formal/MarefLite.tla -config src/formal/MarefLiteMC.cfg
+      - name: Verify Consensus
+        run: |
+          java -cp /tmp/tla2tools.jar tlc2.TLC src/formal/MAREF_Consensus.tla -config src/formal/MAREF_ConsensusMC.cfg

maref-0.30.0/.github/workflows/frontend-security.yml

@@ -0,0 +1,44 @@
+name: Frontend Security Audit
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'gui/**'
+      - '.github/workflows/frontend-security.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'gui/**'
+      - '.github/workflows/frontend-security.yml'
+  schedule:
+    - cron: '0 9 * * 1'
+
+jobs:
+  pnpm-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 10.33.2
+
+      - name: Install dependencies
+        working-directory: ./gui
+        run: pnpm install --frozen-lockfile
+
+      - name: Run pnpm audit
+        working-directory: ./gui
+        run: pnpm audit --audit-level=moderate
+
+      - name: Run ESLint security checks
+        working-directory: ./gui
+        run: pnpm lint
+        continue-on-error: true

maref-0.30.0/.github/workflows/lighthouse.yml

@@ -0,0 +1,58 @@
+name: Lighthouse CI
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'gui/**'
+      - '.github/workflows/lighthouse.yml'
+      - 'lighthouserc.json'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'gui/**'
+      - '.github/workflows/lighthouse.yml'
+      - 'lighthouserc.json'
+
+jobs:
+  lighthouse:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 10.33.2
+
+      - name: Install dependencies
+        working-directory: ./gui
+        run: pnpm install --frozen-lockfile
+
+      - name: Build GUI
+        working-directory: ./gui
+        run: pnpm build
+
+      - name: Run Lighthouse CI
+        working-directory: ./gui
+        run: |
+          npm install -g @lhci/cli@0.14.x
+          lhci autorun --config=../lighthouserc.json
+        env:
+          LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}
+
+      - name: Check bundle size
+        working-directory: ./gui
+        run: npx bundlesize
+
+      - name: Upload Lighthouse reports
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: lighthouse-reports
+          path: gui/.lighthouseci/

maref-0.30.0/.github/workflows/performance.yml

@@ -0,0 +1,19 @@
+name: Performance Budget
+
+on:
+  pull_request:
+    branches: [main, develop]
+
+jobs:
+  lighthouse:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - run: npm install -g @lhci/cli
+      - run: npm install
+        working-directory: gui
+      - run: lhci autorun
+        working-directory: gui