orc-hestrator-server 2.0.0__tar.gz

orc_hestrator_server-2.0.0/.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3

orc_hestrator_server-2.0.0/.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## Description
+<!-- What does this PR do? -->
+
+## Type
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Documentation
+- [ ] CI/Infrastructure
+
+## Testing
+- [ ] Tests added/updated
+- [ ] All tests pass
+
+## Related Issues
+Closes #

orc_hestrator_server-2.0.0/.github/workflows/ci.yml

@@ -0,0 +1,64 @@
+name: CI
+
+# Actions are SHA-pinned (not moving tags) for supply-chain safety, mirroring the
+# convention established in mcp-memory-service. Dependabot (github-actions group)
+# proposes bumps; the trailing comment records the human-readable version.
+# paths-ignore on push skips CI for docs-only changes; pull_request has no filter
+# so required checks still report (same reasoning as mcp-memory-service ci.yml).
+
+on:
+  push:
+    branches: [main]
+    paths-ignore: ['docs/**', '*.md', 'LICENSE', '.gitignore']
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          version: "0.9.18"  # pinned so `uv lock` regeneration is reproducible (F7 R13)
+      # Pin ruff so a new release with new rules can't turn CI red without a code
+      # change. Bump this version deliberately. Config lives in pyproject [tool.ruff].
+      - run: uv tool run ruff@0.17.0 check src/ tests/
+      - run: uv tool run ruff@0.17.0 format --check src/ tests/
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          version: "0.9.18"  # pinned so `uv lock` regeneration is reproducible (F7 R13)
+      - name: Install
+        run: uv sync --extra test --extra ui
+      - name: Test with coverage
+        run: |
+          uv pip install pytest-cov
+          uv run pytest tests/ -v --tb=short --cov=src/task_orchestrator --cov-report=term --cov-fail-under=50
+
+  security:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Security check (bandit)
+        run: |
+          pip install bandit
+          bandit -r src/ -ll -ii --skip B608

orc_hestrator_server-2.0.0/.github/workflows/codeql.yml

@@ -0,0 +1,17 @@
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: python
+      - uses: github/codeql-action/analyze@v4

orc_hestrator_server-2.0.0/.github/workflows/links.yml

@@ -0,0 +1,49 @@
+name: Links
+
+# Markdown link checking. Pattern mirrored from mcp-memory-service's links.yml:
+# internal links checked on every push/PR (fast, offline); external links only on
+# a weekly schedule (third-party sites answer unreliably — a red PR caused by
+# someone else's server is noise). Uses lychee rather than porting the project's
+# 197-line checker: the Orc has ~20 markdown files, so an off-the-shelf, pinned
+# action is the right size.
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 5 * * 1'   # Mondays 05:17 UTC — external pass
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  internal:
+    if: github.event_name == 'pull_request' || github.event_name == 'push'
+    runs-on: ubuntu-latest
+    name: Internal links (offline)
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
+        with:
+          # --offline: internal/relative links only; no network. Exclude the venv
+          # and git internals.
+          args: --offline --no-progress './**/*.md' --exclude-path .venv --exclude-path .git
+          fail: true
+
+  external:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    name: External links (weekly)
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
+        with:
+          args: --no-progress './**/*.md' --exclude-path .venv --exclude-path .git
+          # Weekly external pass does not fail the build on flaky third-party
+          # responses; results surface in the job summary.
+          fail: false

orc_hestrator_server-2.0.0/.github/workflows/publish.yml

@@ -0,0 +1,20 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      # SHA-pinned, mirroring ci.yml (supply-chain safety; F7 R9).
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          version: "0.9.18"  # pinned so `uv lock` regeneration is reproducible (F7 R13)
+      - run: uv build
+      - run: uv publish --trusted-publishing always

orc_hestrator_server-2.0.0/.github/workflows/stale.yml

@@ -0,0 +1,14 @@
+name: Stale
+on:
+  schedule:
+    - cron: "0 10 * * 1"
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v10
+        with:
+          days-before-stale: 90
+          days-before-close: 30
+          stale-issue-message: "Esta issue está inativa há 90 dias"
+          stale-pr-message: "Este PR está inativo há 90 dias"

orc_hestrator_server-2.0.0/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.pyc
+*.egg-info/
+dist/
+build/
+.venv/
+.node_modules/
+node_modules/
+
+# Local databases and test artifacts
+*.db
+*.db-wal
+*.db-shm
+.ruff_cache/
+.pytest_cache/
+frontend/dist/

orc_hestrator_server-2.0.0/AGENTS.md

@@ -0,0 +1,102 @@
+# AGENTS.md
+
+Instructions for agents working **in this repository**. For the product itself, read the
+[README](README.md); for requirements, [docs/PRD.md](docs/PRD.md).
+
+## Project overview
+
+Orc[hestrator] — an MCP server that keeps work items, dependencies, gates, agent presence and
+claims in one place, with an optional web UI. Python 3.11+, FastMCP, SQLite (WAL + FTS5).
+Entry point: `src/task_orchestrator/server.py`.
+
+Distribution name: `orc-hestrator` (formerly `task-orchestrator-py`). Commands: `orc`, `orc-ui`.
+The Python import package stays `task_orchestrator` — see `docs/adr/ADR-006-rename-orc-hestrator.md`.
+
+## Architecture
+
+```
+src/task_orchestrator/
+├── server.py            ← FastMCP tools (thin layer), agent identity resolution, /health
+├── onboarding.py        ← orc_onboarding tool + static resources (self-teaching surface)
+├── prompts.py           ← MCP workflow prompts
+├── engine/              ← domain logic, one module per concern
+│   ├── __init__.py      ← facade: re-exports the public API as `engine.X` (back-compat)
+│   ├── base.py          ← ToolError, constants, helpers, resolve_short_id
+│   ├── items.py         ← WorkItem CRUD, hierarchy, FTS search
+│   ├── transitions.py   ← state machine, gates, unblock logic
+│   ├── dependencies.py  ← graph, BFS, cycle detection
+│   ├── notes.py         ← per-phase notes, auto-reopen
+│   ├── queries.py       ← next item, blocked, context, scheduling
+│   ├── trees.py         ← create_work_tree, complete_tree
+│   ├── metrics.py       ← throughput, lead time, critical path, impact
+│   ├── archive.py       ← auto-archive of done items
+│   ├── portability.py   ← export_graph / import_graph
+│   ├── workspace_view.py← workspace context, execution stack
+│   ├── presence.py      ← sessions (hostname/agent_id/session_id), heartbeat, reaping
+│   ├── claims.py        ← work items and free-form resources, conflict detection
+│   └── users.py         ← accounts, roles, web sessions
+├── db.py                ← schema + additive migrations + FTS5
+├── schemas.py           ← note-gate schemas and gate enforcement
+├── workspace.py         ← workspace configs, scoped tag queries
+├── checkpoints.py       ← checkpoint snapshots
+├── web/                 ← REST API over the engine (/api), graph endpoints
+└── ui/                  ← optional server-rendered board (FastAPI + HTMX)
+frontend/                ← React management UI (Vite + TS + Tailwind), isolated from Python
+```
+
+**Import rule:** `engine/` is a DAG — `base` ← feature modules ← aggregators. No module imports an
+aggregator back. External code (`server.py`, `web/`, `checkpoints.py`, tests) uses `engine.X` via
+the facade; do not import submodules directly from outside the package.
+
+**Data flow:** tool call → validate → engine function → DB → transition → structured result.
+
+## Conventions that bite
+
+- **Storage:** one SQLite file. `ORC_DB` (fallback `TASK_ORCHESTRATOR_DB`), default
+  `~/.orc/tasks.db`. WAL mode.
+- **Transport default is stdio.** `MCP_TRANSPORT=streamable-http` is what deployments use, not the
+  default: `os.environ.get("MCP_TRANSPORT", "stdio")`. Port comes from `MCP_PORT` (default 3201;
+  the reference deployment uses 8005 behind a proxy).
+- **The web extra is optional.** `fastapi` lives in the `ui` extra: after any plain `uv sync` the
+  streamable-http path dies with `ModuleNotFoundError: fastapi`. Always
+  `uv sync --extra test --extra ui` in a dev environment.
+- **State machine:** queue → work → review → done; triggers start, complete, block/hold, resume,
+  cancel, reopen. The engine rejects anything else — never bypass it from an adapter.
+- **Dependencies:** `from_id` blocks `to_id`, with `unblock_at` ∈ {done, review, work}. Max
+  hierarchy depth is 4.
+- **Identity:** `agent_id` resolves per request (argument → `X-Agent-ID` → `MCP_AGENT_ID` → OAuth
+  client id) through a contextvar that must be reset. Never cache it across requests.
+- **Two audiences, two auth paths:** humans use cookie sessions with RBAC on `/api/*`; agents use
+  the proxy's basic auth and optionally OAuth2 (`MCP_OAUTH_ENABLED`).
+
+## Adding a tool
+
+1. Implement the domain rule in `engine/` first. The tool is an adapter.
+2. Register in `server.py` with a docstring that states the operations and constraints; annotate
+   `-> str` for consistency with the other tools.
+3. Decorate with `@with_agent_id` if the tool writes state.
+4. Add tests at three levels: engine, MCP surface, and a real client call when the contract is
+   about the wire.
+5. Regenerate `docs/TOOLS.md` — it is derived from the server, never hand-written.
+
+## Tests
+
+```bash
+uv sync --extra test --extra ui
+uv run pytest tests/ -q                # full suite
+uv run pytest tests/test_engine.py -q  # one module
+uv run ruff check . && uv run ruff format --check .
+```
+
+- Tests use temporary SQLite databases; never touch a real database.
+- A green suite does not close a gate by itself: measure the acceptance criterion against the real
+  execution path (spawn the server, speak MCP to it) before claiming done.
+- `tests/test_onboarding.py` includes a subprocess test that boots the server on a free port; it
+  must leave no `.db` artifact behind.
+
+## Where things are decided
+
+- `docs/adr/` — architecture decisions, one file per decision, immutable once accepted.
+- `docs/specs/` — per-slice requirements with verifiable acceptance criteria.
+- `docs/BRING-YOUR-AGENT.md` — how an agent connects and what it gets.
+- `CHANGELOG.md` — what shipped and when. Product requirements are never tracked here.

orc_hestrator_server-2.0.0/CHANGELOG.md

@@ -0,0 +1,247 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [2.0.0] - 2026-10-18
+
+### Changed (breaking)
+
+- **Distribution renamed to `orc-hestrator-server`.** The name `orc-hestrator` is impossible on
+  PyPI: its ultra-normalized form (`0rchestrat0r`) collides with the existing `orchestrator`
+  project. The GitHub repository and the brand remain `orc-hestrator`.
+- **MCP server identity:** `initialize` now reports `serverInfo.name = "orc"`; the version comes
+  from `importlib.metadata` for the new distribution.
+- **Environment variable precedence:** `ORC_DB`, `ORC_CONFIG` and `ORC_LANG` are the primary
+  variables. `TASK_ORCHESTRATOR_DB` / `TASK_ORCHESTRATOR_CONFIG` still work as a fallback with a
+  single deprecation warning; when both are set, the `ORC_*` variable wins.
+- **Default database path** is now `~/.orc/tasks.db`. Continuity guard: if the old
+  `~/.task-orchestrator/tasks.db` exists and the new path does not, the old file is used (with a
+  one-time warning) instead of starting an empty database.
+- **New console scripts:** `orc` (stdio MCP server), `orc-mcp` (explicit stdio alias), `orc-serve`
+  (streamable-http server on `MCP_HOST`/`MCP_PORT`), `orc-ui` (lightweight board) and
+  `orc-hestrator` (distribution-homonym script, so `uvx orc-hestrator-server` works). The legacy
+  `task-orchestrator-py` / `task-orchestrator-ui` scripts remain as aliases that print a
+  deprecation warning on stderr.
+- **Transport is chosen by the entry point** (ADR-007), not by an environment variable: `orc`
+  opens stdio, `orc-serve` opens `streamable-http`. `MCP_TRANSPORT` remains as an override for
+  tests and edge cases.
+- **`mcp` dependency capped at `<2`.** A clean install without this cap resolved `mcp 2.x`, where
+  `mcp.server.fastmcp` no longer exists (FastMCP was renamed to MCPServer) and every entry point
+  died at import. The cap now ships in the wheel metadata, not only in `uv.lock`.
+- **`orc-serve` requires the `ui` extra.** The streamable-http transport needs `fastapi` +
+  `uvicorn`, which live in the optional `ui` extra — not core. A core-only install now exits with
+  code 2 and a clear pointer to `uvx --from 'orc-hestrator-server[ui]' orc-serve` (or
+  `uv tool install 'orc-hestrator-server[ui]'`) instead of a raw import traceback.
+
+## [1.5.1] - 2026-10-18
+
+> 1.5.1 is the last release published under the old name (`task-orchestrator-py`). It carries the
+> same code as 2.0.0 without the rename — only the metadata (version and a description pointing to
+> `orc-hestrator-server`) differs.
+
+### Fixed
+- **UI assets/routes under a base path.** Absolute references (`src="/mascote.png"`, router
+  `basename`) ignored Vite's `base`, resolving to the domain root and 404-ing when the SPA is
+  served under a subpath (e.g. `/orc/ui/`). Now use `import.meta.env.BASE_URL` for the mascot
+  logo (`Layout`, `Login`, `Overview`) and the `BrowserRouter` basename, and the favicon points
+  to `mascote.png` (the removed `.svg` left the icon broken).
+
+### Deployment notes
+- The web extra (`fastapi`) is **optional** (`[project.optional-dependencies] ui`). Deploys must
+  run `uv sync --extra ui`; a plain `uv sync` omits `fastapi` and the service restart-loops with
+  `ModuleNotFoundError: fastapi`.
+- Serving the SPA under a subpath: build with `vite build --base=/orc/ui/ (VITE_API_BASE=/orc/api)`
+  and reverse-proxy `/orc/api/` to the backend. The initial admin is seeded from
+  `ORC_ADMIN_USER`/`ORC_ADMIN_PASSWORD` on first boot when no user exists.
+- First production deploy of the management UI + real auth validated live at
+  `https://cfnarede.dev/orc/ui/` (login, session cookie, RBAC, real dashboard data).
+
+## [1.5.0] - 2026-10-16
+
+### Added
+- **Decoupled React management UI** (`frontend/`, Vite + React 18 + TypeScript + Tailwind):
+  9 screens consuming the REST API — login, dashboard/overview, live team presence
+  (host/agent/session triple), kanban board, arcs tree, DAG graph (Cytoscape), task detail,
+  admin/RBAC, profile. Design from Stitch (`docs/design/stitch/`). Dark/light theme.
+  E2E navigation tests via playwright-with-yaml (`frontend/e2e/`).
+- **REST API over the engine** (`web/api.py`, mounted at `/api` on the streamable-http app):
+  reads (items, items/{id}, arcs, context, sessions, claims, metrics, graph, workspaces) and
+  writes (advance, claims). Thin layer reusing the engine — see `docs/specs/SPEC-http-api.md`.
+- **User authentication + RBAC** (`engine/users.py`, `docs/specs/SPEC-user-auth-rbac.md`):
+  `POST /api/auth/login|logout`, `GET /api/auth/me`; scrypt password hashing (stdlib, per-user
+  salt, constant-time compare); opaque session token in an HTTP-only cookie with server-side
+  revocation; roles `admin`/`user`; `require_admin` guard; `GET/POST /api/users` (admin-only,
+  never leaks the hash); initial admin seeded from `ORC_ADMIN_USER`/`ORC_ADMIN_PASSWORD`.
+  `get_current_user` now validates the session cookie (the SPEC-http-api R10 extension point),
+  without changing existing route signatures. Login is constant-time (no user enumeration) and
+  the cookie honors `X-Forwarded-Proto`/`ORC_COOKIE_SECURE` behind a TLS proxy.
+
+### Security
+- All `/api/*` routes except `/api/auth/login`, `/api/auth/logout` and `/health` require a
+  valid user session (401 otherwise).
+
+## [1.4.0] - 2026-10-16
+
+### Added
+- **Central session registry / presence** incorporated into the Orc: triple identity
+  (hostname, agent_id, session_id), heartbeat-based liveness, and claims — resolving
+  cross-session conflicts by session_id.
+
+## [1.3.0] - 2026-10-15
+
+### Added
+- **OAuth2 resource-server authentication** (opt-in, `MCP_OAUTH_ENABLED`, default off):
+  opaque pre-shared tokens verified via FastMCP's native `TokenVerifier`. Second barrier
+  behind the nginx edge basic auth (ADR-004). `/health` stays public. Pluggable verifier so a
+  future JWT/IdP (corporate SSO) can replace it without touching the rest of the service.
+- **Per-request agent attribution (`agent_id`)** (ADR-005): writes record who performed them
+  via `created_by`/`updated_by` on `work_items`, `created_by` on `notes` and `dependencies`.
+  Resolution precedence: explicit arg → `X-Agent-ID` header → `MCP_AGENT_ID` env → OAuth
+  client_id → null. Resolved per request via a contextvar with mandatory reset (no leakage
+  between requests). Additive, nullable migration — anonymous writes still succeed.
+- `get_project_graph_metrics` tool — critical path, impact scores, and bottleneck detection
+  over the dependency graph (previously planned).
+
+### Changed
+- **Internal refactor:** the monolithic `engine.py` (~1960 LOC) was split into an `engine/`
+  package of 11 cohesive modules (`base`, `items`, `transitions`, `dependencies`, `notes`,
+  `queries`, `trees`, `metrics`, `archive`, `portability`, `workspace_view`) behind a
+  re-export facade. **No public API change** — all tools, signatures, and the `engine.X`
+  import surface are preserved. Improves maintainability and navigation.
+- CI hardening: ruff config pinned (`[tool.ruff]`), actions SHA-pinned, per-job timeouts,
+  docs-only `paths-ignore`, and a markdown link-check workflow.
+
+### Fixed
+- `import_graph` now orders items topologically (parent-before-child at any depth), fixing a
+  `FOREIGN KEY constraint failed` crash on hierarchies ≥3 levels deep. Orphan parents are
+  normalized to roots instead of crashing. Removes the FK-off workaround used during the
+  cutover.
+- `AGENTS.md` architecture section now reflects the real module layout (it described modules
+  that never existed).
+
+## [1.2.1] - 2026-06-23
+
+### Added
+- `parent_id` is now updatable via `manage_items(update)` — enables reparenting items between ARCs
+- Validation: parent exists, no self-parent, max depth 4. Set to `""` to unparent.
+
+## [1.2.0] - 2026-06-23
+
+### Added
+- `/health` endpoint via `@mcp.custom_route` (GET, returns status/version/uptime)
+
+## [1.1.0] - 2026-06-08
+
+### Added
+- `get_execution_stack` tool — context stack for session resume after interruptions
+- `manage_archive` tool — auto-archive done items older than N days
+- `manage_checkpoints` tool — create/list/restore/verify JSON snapshots
+- `get_workspace_context` tool — workspace payload at 3 verbosity levels (minimal/standard/full)
+- Workspace `repos` and `conventions` fields
+
+### Changed
+- Test suite expanded to 114+ tests
+
+## [1.0.0] - 2026-05-28
+
+### Added
+- **StreamableHTTP transport** on port 3201 (`MCP_TRANSPORT=streamable-http`)
+- systemd service support (task-orchestrator.service)
+- `manage_workspaces` tool — create/update/delete/list workspace configs
+- Workspace-scoped queries in `get_context`, `get_next_item`, `get_metrics`
+- `export_graph` and `import_graph` tools with workspace/tag filtering
+- Kanban Web UI skeleton (FastAPI + HTMX + Tailwind)
+
+### Changed
+- Default transport remains stdio for backward compatibility
+
+## [0.9.0] - 2026-05-18
+
+### Added
+- Workspace entity — tag mapping, memory_tags, description
+- Workspace-filtered `get_context`, `get_next_item`, `get_metrics`
+- Memory tag bridge (2 levels: inline + reference via memory service)
+- Auto-checkpoint JSON resilience (corruption recovery)
+
+## [0.8.0] - 2026-05-10
+
+### Added
+- Scheduling support (cron expressions, `next_run_at`)
+- `due_at` field on work items with deadline alerts
+
+### Fixed
+- croniter naive/aware datetime handling
+- CI pipeline stabilization
+
+## [0.7.0] - 2026-05-06
+
+### Added
+- `get_metrics` tool — throughput per week, lead time, WIP, stale ratio
+- Priority and tag breakdowns in metrics
+- Configurable lookback period (days param)
+- `complete_tree` tool — batch-complete descendants in topological order
+- `create_work_tree` — atomically create root + children + dependencies
+
+## [0.6.1] - 2026-05-02
+
+### Added
+- Comprehensive test suite with 35+ tests (#9)
+
+### Changed
+- Comprehensive README rewrite (#11)
+
+## [0.6.0] - 2026-05-02
+
+### Added
+- Stale item detection in get_context (#4)
+- Structured ToolError responses (#3)
+- Filter query_items by tags (#2)
+- Short hex ID resolution (4+ chars) (#1)
+
+## [0.5.0] - 2026-04-10
+
+### Added
+- Full feature parity with original Kotlin task-orchestrator
+
+## [0.4.0] - 2026-04-10
+
+### Added
+- Auto-reopen parent items from terminal status
+- `unblock_at` threshold for dependencies
+- README documentation
+
+## [0.3.0] - 2026-04-10
+
+### Added
+- MCP prompts (workflow skills)
+- Note schema gates
+
+## [0.2.0] - 2026-04-10
+
+### Added
+- Full feature parity with original task-orchestrator
+- Note schemas with gate enforcement
+- Lifecycle modes
+- GitHub Actions workflow for PyPI trusted publishing
+- Initial Python port of task-orchestrator
+
+[Unreleased]: https://github.com/filhocf/task-orchestrator-py/compare/v1.3.0...HEAD
+[1.3.0]: https://github.com/filhocf/task-orchestrator-py/compare/v1.2.1...v1.3.0
+[1.2.1]: https://github.com/filhocf/task-orchestrator-py/compare/v1.2.0...v1.2.1
+[1.2.0]: https://github.com/filhocf/task-orchestrator-py/compare/v1.1.0...v1.2.0
+[1.1.0]: https://github.com/filhocf/task-orchestrator-py/compare/v1.0.0...v1.1.0
+[1.0.0]: https://github.com/filhocf/task-orchestrator-py/compare/v0.9.0...v1.0.0
+[0.9.0]: https://github.com/filhocf/task-orchestrator-py/compare/v0.8.0...v0.9.0
+[0.8.0]: https://github.com/filhocf/task-orchestrator-py/compare/v0.7.0...v0.8.0
+[0.7.0]: https://github.com/filhocf/task-orchestrator-py/compare/v0.6.1...v0.7.0
+[0.6.1]: https://github.com/filhocf/task-orchestrator-py/compare/v0.6.0...v0.6.1
+[0.6.0]: https://github.com/filhocf/task-orchestrator-py/compare/v0.5.0...v0.6.0
+[0.5.0]: https://github.com/filhocf/task-orchestrator-py/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/filhocf/task-orchestrator-py/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/filhocf/task-orchestrator-py/compare/v0.2.0...v0.3.0
+[0.2.0]: https://github.com/filhocf/task-orchestrator-py/releases/tag/v0.2.0

orc_hestrator_server-2.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Claudio Ferreira Filho
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.