omninode-intelligence 0.23.0__tar.gz → 0.24.0__tar.gz

omninode_intelligence-0.24.0/.env.example

@@ -0,0 +1,130 @@
+# =============================================================================
+# OmniIntelligence Environment Configuration
+# =============================================================================
+#
+# QUICK START:
+# 1. Copy this file to .env:  cp .env.example .env
+# 2. Set OMNIINTELLIGENCE_DB_URL in your .env (see PostgreSQL section below).
+#    Default: localhost:5436 (local Docker via omnibase_infra).
+#    Obtain the password from your team lead or secure credential storage.
+# 3. Run tests: pytest tests/integration -m integration -v
+#
+# IMPORTANT: The .env file contains secrets and should NEVER be committed.
+#            It is already in .gitignore.
+#
+# =============================================================================
+
+# =============================================================================
+# PostgreSQL Database Configuration
+# =============================================================================
+# Single connection URL for the OmniIntelligence database.
+# Host options:
+#   - Local Docker (default): localhost:5436 (omnibase_infra external port)
+#   - Docker internal:         postgres:5432  (for services on omnibase-infra-network)
+#
+# REQUIRED: Replace <password> with the actual PostgreSQL password.
+# Contact your team lead or check secure credential storage.
+# DO NOT commit credentials to version control.
+OMNIINTELLIGENCE_DB_URL=postgresql://postgres:<password>@localhost:5436/omniintelligence
+
+# Connection pool settings (optional, sensible defaults provided)
+POSTGRES_MIN_POOL_SIZE=2
+POSTGRES_MAX_POOL_SIZE=10
+
+# Command timeout in seconds for database operations (optional).
+# Read by plugin.py and tests/integration/conftest.py with a default of 60.0.
+# POSTGRES_COMMAND_TIMEOUT=60.0
+
+# =============================================================================
+# Kafka/Redpanda Event Bus Configuration
+# =============================================================================
+# Kafka/Redpanda broker address.
+# Two-bus policy (OMN-3431):
+#   - bus_local (default — tests + automated pipelines): localhost:19092
+#   - bus_cloud (interactive sessions, via launchd tunnel): localhost:29092
+#
+# IMPORTANT: Use different configurations depending on context:
+#   - Host scripts/tests (bus_local): localhost:19092
+#   - Docker services: redpanda:9092 (internal port via Docker DNS — never inherited from host)
+#   - Interactive/demo sessions (bus_cloud): localhost:29092
+
+# bus_local (default — tests + automated pipelines):
+KAFKA_BOOTSTRAP_SERVERS=localhost:19092
+KAFKA_BROKER_ALLOWLIST=localhost:19092,127.0.0.1:19092
+KAFKA_REQUEST_TIMEOUT_MS=30000
+KAFKA_MAX_BLOCK_MS=10000
+# bus_cloud (interactive sessions):
+# KAFKA_BOOTSTRAP_SERVERS=localhost:29092
+
+# =============================================================================
+# Qdrant Vector Database Configuration (Optional)
+# =============================================================================
+# Used for vector search and embeddings storage.
+# Typically runs locally on the development machine.
+
+QDRANT_HOST=localhost
+QDRANT_PORT=6333
+QDRANT_URL=http://localhost:6333
+
+# =============================================================================
+# AI/ML API Keys (Optional)
+# =============================================================================
+# Required for intelligence operations that call external AI services.
+
+OPENAI_API_KEY=
+
+# =============================================================================
+# LLM Endpoints
+# =============================================================================
+# LLM inference endpoints. Override with the addresses appropriate for your
+# deployment environment.
+
+LLM_CODER_URL=http://localhost:8000
+LLM_CODER_FAST_URL=http://localhost:8001
+LLM_DEEPSEEK_R1_URL=http://localhost:8101
+LLM_QWEN3_NEXT_URL=http://localhost:8102
+LLM_EMBEDDING_URL=http://localhost:8002
+LLM_QWEN_72B_URL=http://localhost:8100
+
+# =============================================================================
+# Feature Flags (Optional)
+# =============================================================================
+
+# Allow Kafka producers/consumers to use default configuration when
+# bootstrap servers are not explicitly configured.
+OMNIINTELLIGENCE_ALLOW_DEFAULT_KAFKA=true
+
+# Shared Kafka consumer group ID for all intelligence topic consumers (OMN-2439).
+# All runtime containers (omninode-runtime, omninode-runtime-effects, runtime-worker-*)
+# must use the same group so Kafka load-balances partitions across the group rather
+# than delivering each message to every container independently.
+# Defaults to "omniintelligence-hooks" when unset or empty.
+# Must not contain whitespace characters.
+# OMNIINTELLIGENCE_CONSUMER_GROUP=omniintelligence-hooks
+
+# Enable real-time event publishing for intelligence operations.
+ENABLE_REAL_TIME_EVENTS=true
+
+# Enable Kafka-based intelligence operations.
+KAFKA_ENABLE_INTELLIGENCE=true
+
+# =============================================================================
+# Repository Paths
+# =============================================================================
+# Absolute path to the omni_home canonical registry. Required by handlers
+# that resolve source files at runtime (e.g. code quality dispatch handler).
+OMNI_HOME=/path/to/omni_home
+
+# Absolute path to the worktrees directory (defaults to ../omni_worktrees
+# relative to OMNI_HOME when unset).
+# OMNI_WORKTREES=/path/to/omni_worktrees
+
+# =============================================================================
+# Development/Test Settings
+# =============================================================================
+
+# Log level for debugging
+LOG_LEVEL=INFO
+
+# Enable verbose test output
+PYTEST_ADDOPTS=-v --tb=short

omninode_intelligence-0.24.0/.github/workflows/auto-merge.yml

@@ -0,0 +1,96 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# OMN-6571: Automatically enable auto-merge (squash) on every PR opened
+# by jonahgabriel. Ensures PRs do not sit idle in the merge queue waiting
+# for manual enrollment.
+#
+# OMN-7786: Re-trigger on review and check_suite events so the workflow
+# re-attempts auto-merge after CodeRabbit review finishes and branch
+# protection gates clear. Silent continue-on-error removed; "already
+# enqueued" races are tolerated but real failures surface.
+name: Auto-Merge
+
+on:
+  pull_request:
+    types: [opened, reopened, ready_for_review]
+  pull_request_review:
+    types: [submitted, dismissed]
+  check_suite:
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number to enable auto-merge on"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    name: Enable Auto-Merge
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve PR and author
+        id: resolve
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_FROM_PAYLOAD: ${{ github.event.pull_request.number }}
+          PR_FROM_DISPATCH: ${{ github.event.inputs.pr_number }}
+          CHECK_SUITE_PRS: ${{ toJson(github.event.check_suite.pull_requests) }}
+          PR_AUTHOR_FROM_PAYLOAD: ${{ github.event.pull_request.user.login }}
+        run: |
+          set -euo pipefail
+          case "$EVENT_NAME" in
+            pull_request|pull_request_review)
+              PR="$PR_FROM_PAYLOAD"
+              ACTOR="$PR_AUTHOR_FROM_PAYLOAD"
+              ;;
+            workflow_dispatch)
+              PR="$PR_FROM_DISPATCH"
+              ACTOR="$(gh pr view "$PR" --json author --jq '.author.login')"
+              ;;
+            check_suite)
+              PR="$(echo "$CHECK_SUITE_PRS" | jq -r 'if type == "array" and length > 0 then .[0].number else empty end')"
+              if [ -z "$PR" ]; then
+                echo "check_suite had no associated PRs; nothing to do"
+                echo "skip=true" >> "$GITHUB_OUTPUT"
+                exit 0
+              fi
+              ACTOR="$(gh pr view "$PR" --json author --jq '.author.login')"
+              ;;
+            *)
+              echo "unsupported event: $EVENT_NAME"
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+              ;;
+          esac
+          echo "pr=$PR" >> "$GITHUB_OUTPUT"
+          echo "actor=$ACTOR" >> "$GITHUB_OUTPUT"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@v6
+
+      - name: Enable auto-merge
+        if: steps.resolve.outputs.skip != 'true' && steps.resolve.outputs.actor == 'jonahgabriel'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          PR: ${{ steps.resolve.outputs.pr }}
+        run: |
+          set -euo pipefail
+          if output=$(gh pr merge "$PR" --repo "$GH_REPO" --auto 2>&1); then
+            echo "auto-merge enabled: $output"
+            exit 0
+          fi
+          if echo "$output" | grep -qiE "already enqueued|already queued|auto-merge already enabled"; then
+            echo "auto-merge not newly enabled (expected): $output"
+            exit 0
+          fi
+          echo "auto-merge failed: $output"
+          exit 1

omninode_intelligence-0.24.0/.github/workflows/ban-hardcoded-runner-ip.yml

@@ -0,0 +1,21 @@
+---
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+
+# Calls the reusable ban-hardcoded-runner-ip check from omniclaude.
+# Implements OMN-10603.
+
+name: Ban Hardcoded Runner IP
+
+on:
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - .github/workflows/**
+
+jobs:
+  ban-hardcoded-runner-ip:
+    uses: OmniNode-ai/omniclaude/.github/workflows/ban-hardcoded-runner-ip.yml@main
+    permissions:
+      contents: read
+

omninode_intelligence-0.24.0/.github/workflows/build-and-push-migrate-image.yml

@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 OmniNode Team
+name: Build and push migration image to ECR
+on:
+  push:
+    branches: [main, 'hotfix/**']
+    paths:
+      - 'deployment/docker/Dockerfile.migrate'
+      - 'deployment/database/migrations/**'
+      - '.github/workflows/build-and-push-migrate-image.yml'
+  workflow_dispatch:
+concurrency:
+  group: build-migrate-${{ github.ref }}
+  cancel-in-progress: false
+permissions:
+  id-token: write
+  contents: read
+env:
+  AWS_REGION: us-east-1
+  ECR_REGISTRY: ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com
+  ECR_REPOSITORY: omniintelligence-migrate
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/omninode-github-actions-role
+          role-session-name: gha-build-migrate-omniintelligence
+          aws-region: ${{ env.AWS_REGION }}
+      - run: aws sts get-caller-identity
+      - uses: aws-actions/amazon-ecr-login@v2
+      - name: Build and push
+        env:
+          IMAGE_URI: ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}
+          COMMIT_SHA: ${{ github.sha }}
+        run: |
+          docker build -f deployment/docker/Dockerfile.migrate -t "${IMAGE_URI}:${COMMIT_SHA}" -t "${IMAGE_URI}:latest" .
+          docker push "${IMAGE_URI}:${COMMIT_SHA}"
+          docker push "${IMAGE_URI}:latest"

omninode_intelligence-0.24.0/.github/workflows/call-receipt-gate.yml

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# Caller workflow: invokes the reusable receipt-gate on every PR targeting main.
+#
+# Receipt-gate (omnibase_core) enforces "Enforcement by Receipt" (OMN-10483):
+# every PR must cite a Linear ticket whose dod_evidence items all have PASS
+# ModelDodReceipt artifacts in onex_change_control. Missing or failing receipts
+# block merge.
+#
+# Required-status-check name: `verify / verify`
+
+name: Receipt Gate
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+    branches: [main, dev]
+  merge_group:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  verify:
+    uses: OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml@main

omninode_intelligence-0.24.0/.github/workflows/call-reject-skip.yml

@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# OMN-10422 (Wave 5): Caller — re-scan skip-gate bypass tokens at merge_group entry.
+#
+# Invokes the omniclaude-hosted reusable workflow on pull_request and merge_group.
+# On merge_group, the reusable workflow resolves the PR via head SHA and asserts
+# exactly-one-PR (invariant I10). Cache is not reused across events (invariant I9).
+#
+# Required-status-check name: `scan / reject-skip-gate-token`
+# Wire via: Settings → Branches → main → Require status checks → add the check name above.
+
+name: Reject skip-gate bypass tokens
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+    branches: [main, dev]
+  merge_group:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  call-reject-skip-token:
+    uses: OmniNode-ai/omniclaude/.github/workflows/reject-deploy-gate-skip.yml@main
+    secrets: inherit

omninode_intelligence-0.24.0/.github/workflows/check-handshake.yml

@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+name: Check Architecture Handshake
+
+on:
+  push:
+    branches: [main, develop, 'hotfix/**']
+  pull_request:
+    branches: [main, dev, develop]
+  merge_group:
+  workflow_dispatch:
+
+jobs:
+  check-handshake:
+    name: Check architecture handshake
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Checkout omnibase_core
+        uses: actions/checkout@v6
+        with:
+          repository: OmniNode-ai/omnibase_core
+          # Pinned to omnibase_core main as of 2026-03-22.
+          # Update by running: gh api repos/OmniNode-ai/omnibase_core/commits/main --jq '.sha'
+          ref: 330a344cdb9c5dedd04a46dfbb0b63dae0baccfb
+          path: omnibase_core
+
+      - name: Verify omnibase_core checkout
+        run: |
+          if [ ! -f omnibase_core/architecture-handshakes/check-handshake.sh ]; then
+            echo "::error::Failed to checkout omnibase_core or check-handshake.sh not found."
+            exit 1
+          fi
+
+      - name: Check architecture handshake
+        run: bash omnibase_core/architecture-handshakes/check-handshake.sh