novafabric 0.57.0__tar.gz

novafabric-0.57.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,34 @@
+---
+name: Bug report
+about: Report a bug in NovaFabric
+labels: bug
+---
+
+## Description
+
+A clear description of what the bug is.
+
+## Steps to reproduce
+
+1. Run `novafabric ...`
+2. See error
+
+## Expected behavior
+
+What you expected to happen.
+
+## Actual behavior
+
+What actually happened. Include full output or error message.
+
+## Environment
+
+- OS:
+- Python version (`python --version`):
+- NovaFabric version (`pip show novafabric`):
+
+## Asset spec (if relevant)
+
+```yaml
+# Paste your spec YAML here (remove any sensitive values)
+```

novafabric-0.57.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,21 @@
+---
+name: Feature request
+about: Suggest a new feature or improvement
+labels: enhancement
+---
+
+## Motivation
+
+What problem does this solve? Why is this useful?
+
+## Proposed solution
+
+Describe what you'd like. Be specific about CLI commands, YAML fields, or behavior changes.
+
+## Alternatives considered
+
+Other approaches you thought about.
+
+## Additional context
+
+Links, examples, or prior art that might help.

novafabric-0.57.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,12 @@
+## Summary
+
+What does this PR do?
+
+## Checklist
+
+- [ ] Tests added or updated
+- [ ] `uv run pytest` passes (coverage ≥ 90%)
+- [ ] `uv run ruff check src tests` passes
+- [ ] `uv run mypy src` passes
+- [ ] `CHANGELOG.md` updated for user-facing changes
+- [ ] Docs updated if behavior changed

novafabric-0.57.0/.github/workflows/ci.yml

@@ -0,0 +1,236 @@
+name: CI
+
+# Runs the same quality gates the project's PR template asks contributors
+# to run locally: pytest with coverage, ruff lint, mypy strict. Mirrors
+# CONTRIBUTING.md and the v0.6.1-baseline gates (558 tests, 90% coverage,
+# 87 source files clean under mypy strict).
+#
+# Jobs:
+#   unit        — runs on every PR/push; no external services required.
+#   integration — runs on every PR/push; spins up a Postgres 16 service.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Cancel in-flight runs of the same ref when new commits land. Saves CI
+# minutes on rapid-fire pushes.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # --------------------------------------------------------------------------
+  # Unit tests + quality gates
+  # No external services. Must pass without Postgres or any network access.
+  # --------------------------------------------------------------------------
+  unit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          # Keep the uv binary cached across runs.
+          enable-cache: true
+
+      - name: Set up Python (matches requires-python in pyproject.toml)
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install project + dev deps
+        run: uv sync --frozen
+
+      - name: Lint (ruff)
+        run: uv run ruff check src tests
+
+      - name: Run unit tests with coverage
+        # Excludes tests/integration/ which requires optional external services.
+        # --cov-fail-under=90 enforces the project's coverage floor at the
+        # CI gate so a regression cannot land silently.
+        # --benchmark-disable skips the 100-round latency benchmark; that gate
+        # runs in the dedicated seal-latency-gate job below.
+        run: uv run pytest tests/ --ignore=tests/integration --benchmark-disable --cov=novafabric --cov-report=term-missing --cov-fail-under=90
+
+      - name: Smoke-test the CLI
+        # Confirms the `nova` entry point installs cleanly and reports
+        # the version. Catches packaging regressions that pure unit
+        # tests miss.
+        run: |
+          uv run nova --version
+          uv run nova --help > /dev/null
+
+  # --------------------------------------------------------------------------
+  # Type check (mypy strict) against the FULL dependency surface
+  # Separate job with --all-extras so optional-extra integrations (sigstore,
+  # kuzu, clickhouse, adapters, …) are type-checked against their real APIs
+  # instead of being silenced as missing imports. The unit job stays lean so
+  # its coverage denominator (and the 90% gate) is unaffected.
+  # --------------------------------------------------------------------------
+  typecheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Set up Python (matches requires-python in pyproject.toml)
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install project + dev deps + all extras
+        run: uv sync --frozen --all-extras
+
+      - name: Type check (mypy strict)
+        run: uv run mypy src
+
+  # --------------------------------------------------------------------------
+  # NovaSeal p99 latency gate
+  # Runs 100 seal() rounds and asserts p99 < 200 ms (ADR-0041).
+  # Separate from the unit job so benchmark overhead does not inflate
+  # the coverage-measurement run.
+  # --------------------------------------------------------------------------
+  seal-latency-gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install project + dev deps
+        run: uv sync --frozen
+
+      - name: Run NovaSeal p99 latency gate
+        # --benchmark-json saves results as a JSON artifact for trend tracking.
+        # The p99 < 200 ms assertion is inside the test itself; a failing
+        # assertion fails this step and blocks the PR merge.
+        run: |
+          mkdir -p bench-results
+          uv run pytest tests/seal/test_benchmark.py -v \
+            --benchmark-json=bench-results/seal_latency.json
+
+      - name: Upload benchmark results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: seal-latency-${{ github.sha }}
+          path: bench-results/seal_latency.json
+          retention-days: 90
+
+  # --------------------------------------------------------------------------
+  # Showcase site build
+  # Confirms the Astro site (web/) builds cleanly and TypeScript types check.
+  # e2e tests require a running server so are not run here.
+  # --------------------------------------------------------------------------
+  web:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install web dependencies
+        working-directory: web
+        run: npm ci
+
+      - name: Type check (tsc)
+        working-directory: web
+        run: npm run lint
+
+      - name: Build showcase site
+        working-directory: web
+        run: npm run build
+
+  # --------------------------------------------------------------------------
+  # Integration tests
+  # Spins up a Postgres 16 service container and runs tests/integration/.
+  # Tests that don't need Postgres (server, auth, rbac, storage SQLite) still
+  # run here; Postgres-requiring tests (migration, storage Postgres) are
+  # automatically enabled via the env var.
+  # --------------------------------------------------------------------------
+  integration:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: test
+          POSTGRES_DB: novafabric_test
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Set up Python (matches requires-python in pyproject.toml)
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install project + dev deps
+        run: uv sync --frozen
+
+      - name: Run Postgres schema migrations
+        env:
+          NOVAFABRIC_POSTGRES_DSN: postgresql://postgres:test@localhost:5432/novafabric_test
+        run: uv run alembic -c alembic-postgres.ini upgrade head
+
+      - name: Run integration tests
+        env:
+          NOVAFABRIC_TEST_POSTGRES_DSN: postgresql://postgres:test@localhost:5432/novafabric_test
+        run: uv run pytest tests/integration/ -v

novafabric-0.57.0/.github/workflows/collector-ci.yml

@@ -0,0 +1,152 @@
+name: Collector CI
+
+on:
+  push:
+    paths:
+      - "collector/**"
+      - "schemas/event-envelope-v1/**"
+      - "deploy/**"
+      - ".github/workflows/collector-ci.yml"
+  pull_request:
+    paths:
+      - "collector/**"
+      - "schemas/event-envelope-v1/**"
+      - "deploy/**"
+
+env:
+  # go.mod requires Go ≥ 1.25 since the OTel 1.43.0 bump (Dependabot Phase C).
+  GO_VERSION: "1.25"
+  GOPATH: ${{ github.workspace }}/.gopath
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: collector
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: collector/go.sum
+      - name: go vet
+        run: GOPATH=${{ env.GOPATH }} go vet ./...
+      - name: Prohibit flock/mmap/fcntl in spool
+        run: |
+          # Match the forbidden tokens in non-test Go files, then drop lines that
+          # are pure leading-comment lines (//... or  *...) so the spool's
+          # explanatory comments ("no flock/mmap/fcntl is used here") do not
+          # trip the check. Real uses would appear in code without a leading
+          # comment marker.
+          if grep -rn --include="*.go" \
+            -E 'flock|mmap|fcntl|F_SETLK|syscall\.Flock|LOCK_EX' \
+            internal/spool/ \
+            | grep -v "_test.go" \
+            | grep -Ev ':[[:space:]]*(//|\*)'; then
+            echo "ERROR: flock/mmap/fcntl found in spool non-test code"
+            exit 1
+          fi
+          echo "OK: no flock/mmap/fcntl in internal/spool"
+
+  unit:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: collector
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: collector/go.sum
+      - name: go test -race
+        run: GOPATH=${{ env.GOPATH }} go test -race -count=1 -timeout 120s ./...
+      - name: Coverage check
+        run: |
+          GOPATH=${{ env.GOPATH }} go test -coverprofile=coverage.out ./pkg/... ./internal/...
+          GOPATH=${{ env.GOPATH }} go tool cover -func=coverage.out | tail -1
+          COVERAGE=$(GOPATH=${{ env.GOPATH }} go tool cover -func=coverage.out | tail -1 | awk '{print $3}' | tr -d '%')
+          echo "Coverage: ${COVERAGE}%"
+          # Warn (not fail) if below 75%
+          awk "BEGIN {exit (${COVERAGE} < 75)}" || echo "WARNING: coverage below 75%"
+
+  spec:
+    name: Spec Corpus Validation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Validate corpus
+        run: |
+          python3 -c "
+          import json, pathlib, sys
+          schema = json.load(open('schemas/event-envelope-v1/envelope-v1.json'))
+          files = sorted(pathlib.Path('schemas/event-envelope-v1/corpus').glob('[0-9]*.json'))
+          errors = []
+          for f in files:
+              data = json.load(open(f))
+              for req in schema.get('required', []):
+                  if req not in data:
+                      errors.append(f'{f}: missing required field {req}')
+          if errors:
+              for e in errors[:10]: print(e, file=sys.stderr)
+              sys.exit(1)
+          print(f'{len(files)}/{len(files)} corpus events valid')
+          "
+
+  build:
+    name: Build Artifacts
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: collector
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: collector/go.sum
+      - name: Build binaries
+        run: |
+          GOPATH=${{ env.GOPATH }} go build -o bin/novafabric-collector ./cmd/novafabric-collector
+          GOPATH=${{ env.GOPATH }} go build -o bin/novafabric-verifier ./cmd/novafabric-verifier
+          GOPATH=${{ env.GOPATH }} go build -o bin/novafabric-hpc-hub ./cmd/novafabric-hpc-hub
+      - name: Smoke-test verifier --help
+        run: ./bin/novafabric-verifier --help 2>&1 | head -3 || true
+      - name: Smoke-test hpc-hub --help
+        run: ./bin/novafabric-hpc-hub --help 2>&1 | head -3 || true
+
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: collector
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: collector/go.sum
+      - name: govulncheck
+        run: |
+          GOPATH=${{ env.GOPATH }} go install golang.org/x/vuln/cmd/govulncheck@latest
+          ${{ env.GOPATH }}/bin/govulncheck ./... || echo "Vulnerabilities found — review required"
+      - name: License check (no AGPL/GPL/BSL)
+        run: |
+          GOPATH=${{ env.GOPATH }} go install github.com/google/go-licenses@latest
+          ${{ env.GOPATH }}/bin/go-licenses report ./... 2>/dev/null > /tmp/licenses.txt || true
+          # Allowlisted MPL-2.0 transitive deps (see ADR-0024 amendment for
+          # hashicorp/go-version — file-level copyleft, unmodified, pulled in
+          # transitively via go.opentelemetry.io/collector/featuregate).
+          grep -v '^github\.com/hashicorp/go-version,' /tmp/licenses.txt > /tmp/licenses.filtered.txt
+          if grep -E '(AGPL|GPL-3|BSL-1\.1|MPL-2\.0|Elastic)' /tmp/licenses.filtered.txt; then
+            echo "ERROR: Prohibited license found"
+            exit 1
+          fi
+          echo "License check passed"

novafabric-0.57.0/.github/workflows/metadata_store_security_gate.yml

@@ -0,0 +1,99 @@
+name: MetadataStore Security Gate
+
+on:
+  push:
+    paths:
+      - "src/novafabric/metadata_store/**"
+      - "tests/metadata_store/**"
+      - "tests/fixtures/broken_session_set.py"
+  pull_request:
+    paths:
+      - "src/novafabric/metadata_store/**"
+      - "tests/metadata_store/**"
+      - "tests/fixtures/broken_session_set.py"
+
+jobs:
+  security-gate:
+    name: MetadataStore Security Gate
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_PASSWORD: testpass
+          POSTGRES_USER: postgres
+          POSTGRES_DB: novafabric_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Ruff lint
+        run: uv run ruff check src/ tests/
+
+      - name: Mypy type check
+        run: uv run mypy src/novafabric/metadata_store/ --exclude migrations
+
+      - name: FR-07 grep — no session-scoped SET app. in metadata_store
+        run: |
+          violations=$(grep -rn "SET " src/novafabric/metadata_store/ | grep -v "SET LOCAL" | grep "app\." || true)
+          if [ -n "$violations" ]; then
+            echo "FAIL: Session-scoped SET app. found — use SET LOCAL"
+            echo "$violations"
+            exit 1
+          fi
+          echo "PASS: No session-scoped SET app. found"
+
+      - name: FR-13 grep — RLS primitives confined to metadata_store
+        run: |
+          violations=$(grep -rnE 'current_setting\(.*app\.|FORCE\s+ROW\s+LEVEL' \
+            --include='*.py' src/ tests/ \
+            | grep -v 'src/novafabric/metadata_store/' \
+            | grep -v 'tests/metadata_store/' \
+            | grep -v 'tests/fixtures/broken_session_set.py' || true)
+          if [ -n "$violations" ]; then
+            echo "FAIL: RLS primitives found outside allowed paths:"
+            echo "$violations"
+            exit 1
+          fi
+          echo "PASS: RLS primitives confined to allowed paths"
+
+      - name: Run MetadataStore tests with coverage
+        run: |
+          uv run pytest tests/metadata_store/ -v --tb=short \
+            --cov=src/novafabric/metadata_store \
+            --cov-report=term-missing \
+            --cov-fail-under=85
+        env:
+          NOVAFABRIC_METADATA_BACKEND: sqlite
+
+      - name: FR-08 mutmut — SET LOCAL invariant kill-rate gate
+        run: |
+          # Curated mutation target: postgres.py SET LOCAL line only.
+          # Runner uses testcontainers (Docker required on CI host).
+          uv run mutmut run \
+            --paths-to-mutate src/novafabric/metadata_store/postgres.py \
+            --runner "uv run pytest tests/metadata_store/test_cross_tenant_isolation_pgbouncer.py tests/metadata_store/test_set_local_invariant.py -x --tb=short -q"
+          survived=$(uv run mutmut results 2>/dev/null | grep -c "survived" || true)
+          if [ "${survived:-0}" -gt 0 ]; then
+            echo "FAIL: mutant(s) survived — FR-08 SET LOCAL kill rate < 100%"
+            uv run mutmut results
+            exit 1
+          fi
+          echo "PASS: All SET LOCAL mutants killed — GDPR Article 32 invariant confirmed"
+
+      - name: Benchmark smoke
+        run: bash bench/rls_partition_pruning/ci_smoke.sh

novafabric-0.57.0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,77 @@
+name: Publish to PyPI
+
+# Builds the novafabric distribution and publishes it to PyPI using
+# Trusted Publishing (OIDC) — no API token or stored secret is required.
+# PyPI is configured to trust this exact tuple via a Trusted Publisher entry:
+#
+#   PyPI project   : novafabric
+#   Owner          : novafabric
+#   Repository     : novafabric
+#   Workflow name  : publish-pypi.yml   <-- the value to enter on pypi.org
+#   Environment    : pypi
+#
+# Fires when a v* tag is pushed (same trigger as release.yml, which creates
+# the GitHub Release). The two workflows run independently.
+on:
+  push:
+    tags:
+      - "v*"
+  # Allow a manual re-publish from the Actions tab if a tag run needs a retry.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Check distribution metadata
+        run: uvx twine check dist/*
+
+      - name: Upload distribution artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # Must match the "Environment name" configured in the PyPI Trusted Publisher.
+    environment:
+      name: pypi
+      url: https://pypi.org/p/novafabric
+    permissions:
+      # Required for Trusted Publishing: mints the OIDC token PyPI exchanges
+      # for a short-lived upload credential. No long-lived secret is stored.
+      id-token: write
+    steps:
+      - name: Download distribution artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

novafabric-0.57.0/.github/workflows/release.yml

@@ -0,0 +1,55 @@
+name: Release
+
+# Triggered when a v* tag is pushed. Creates a GitHub Release with notes
+# extracted from docs/releases/<tag>.md (the source of truth for release
+# notes — also linked from CHANGELOG.md and discoverable in-repo).
+#
+# Does NOT publish to PyPI — that requires repository secrets and is a
+# user-driven decision per release.
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  # Required to create the release. No write access to code.
+  contents: write
+
+jobs:
+  github-release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Locate release notes
+        id: notes
+        run: |
+          tag="${GITHUB_REF_NAME}"
+          notes_file="docs/releases/${tag}.md"
+          if [ ! -f "$notes_file" ]; then
+            echo "::error file=docs/releases::Missing release notes file: $notes_file"
+            echo "Tag $tag was pushed but $notes_file does not exist." >&2
+            exit 1
+          fi
+          # First H1 in the notes is the release title (drop the leading '# ').
+          title=$(head -1 "$notes_file" | sed 's/^# //')
+          if [ -z "$title" ]; then
+            echo "::error file=$notes_file::First line is not an H1; cannot derive title"
+            exit 1
+          fi
+          echo "notes_file=$notes_file" >> "$GITHUB_OUTPUT"
+          echo "title=$title" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "${{ steps.notes.outputs.title }}" \
+            --notes-file "${{ steps.notes.outputs.notes_file }}" \
+            --latest=true