pystreamai 2.1.0__tar.gz → 2.1.2__tar.gz

pystreamai-2.1.2/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,46 @@
+name: Bug report
+description: Report a real, reproducible problem in PyStreamAI
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing: check the README's "How this works today" and "Known
+        issues" sections - several things that look like bugs (no cloud
+        backend, no auth, `pystreamai.gpu` being advisory-only, HF upload
+        being a no-op) are already-known, documented limitations rather
+        than new bugs.
+  - type: input
+    id: version
+    attributes:
+      label: PyStreamAI version
+      description: Output of `python3 -c "import pystreamai; print(pystreamai.__version__)"`
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, Python version, and whether you used a prebuilt wheel or built from source
+      placeholder: "e.g. macOS 15, Python 3.11, pip install pystreamai"
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Minimal code that reproduces the issue
+      render: python
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected vs. actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Full error / traceback
+      render: shell

pystreamai-2.1.2/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Propose a new feature or improvement
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Check `docs/ROADMAP.md` and the README's "Known issues" section
+        first - your idea may already be tracked (e.g. cloud backends,
+        real GPU benchmarking, Hugging Face upload, LLM optimizations,
+        edge deployment) as a known gap rather than something to propose
+        from scratch.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: What are you trying to do that PyStreamAI doesn't support today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

pystreamai-2.1.2/.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

pystreamai-2.1.2/.github/pull_request_template.md

@@ -0,0 +1,17 @@
+## What does this change do?
+
+<!-- Describe the change and why it's needed. -->
+
+## How was this tested?
+
+<!-- Real commands you ran, e.g. `pytest`, `cargo test --release`, `ruff check .`,
+     `maturin develop --release`. If a code path wasn't exercised, say so - don't
+     imply test coverage that doesn't exist. -->
+
+## Checklist
+
+- [ ] `pytest` passes locally
+- [ ] `ruff check .` passes locally
+- [ ] `cargo test --release` passes locally (if `src/*.rs` changed)
+- [ ] If this changes behavior described in `README.md` / `docs/`, those docs are updated in the same PR
+- [ ] If this adds a new simulated/placeholder/advisory-only code path, it is labeled as such in code comments and in the README (see "no fake stubs" precedent in this repo - don't add unlabeled placeholder logic)

{pystreamai-2.1.0 → pystreamai-2.1.2}/.github/workflows/build-wheels.yml

@@ -10,15 +10,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Rust
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
+        uses: dtolnay/rust-toolchain@stable
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: '3.10'
 

pystreamai-2.1.2/.github/workflows/security-audit.yml

@@ -0,0 +1,48 @@
+name: Security Audit
+
+# Runs on a schedule + manual dispatch rather than on every push/PR, so a
+# newly-discovered advisory in a transitive dependency doesn't block
+# unrelated PRs from merging. Findings should be triaged as issues, not
+# silently ignored - this job intentionally does NOT swallow failures with
+# `|| true`; a red run here means a real advisory was found and should be
+# looked at.
+#
+# NOTE: not runnable/verifiable in the sandbox this workflow was authored
+# in (no network access to pypi.org/crates.io/GitHub's advisory DB). It has
+# not been confirmed green on actual GitHub Actions infrastructure yet.
+on:
+  schedule:
+    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC
+  workflow_dispatch: {}
+  pull_request:
+    paths:
+      - 'pyproject.toml'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/security-audit.yml'
+
+jobs:
+  pip-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install project + pip-audit
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev,serving,onnx,observability,registry]"
+          pip install pip-audit
+      - name: pip-audit
+        run: pip-audit
+
+  cargo-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - name: cargo audit
+        run: cargo audit

{pystreamai-2.1.0 → pystreamai-2.1.2}/.github/workflows/tests.yml

@@ -13,13 +13,11 @@ jobs:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Set up Rust
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
+        uses: dtolnay/rust-toolchain@stable
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

{pystreamai-2.1.0 → pystreamai-2.1.2}/.gitignore

@@ -34,7 +34,10 @@ env/
 
 # Rust
 target/
-Cargo.lock
+# Cargo.lock is intentionally committed (not ignored): this crate builds a
+# cdylib (a PyO3 extension shipped in wheels), not a library consumed by
+# other Cargo projects, so per Cargo's own guidance the lockfile should be
+# checked in for reproducible builds.
 
 # Compiled PyO3/maturin extension (built locally via `maturin develop`)
 pystreamai/_core*.so
@@ -49,3 +52,5 @@ tmp/
 
 # Real training artifacts written by Platform.train() when code is a script
 pystreamai_artifacts/
+
+graphify-out/

pystreamai-2.1.2/.graphifyignore

@@ -0,0 +1,31 @@
+# Graphify ignore file - https://docs.graphify.com/reference/configuration
+# Keep the scan (and therefore the agent's graph) focused on real source.
+.git/
+.github/
+graphify-out/
+
+# Build output / artifacts
+target/
+dist/
+build/
+*.egg-info/
+node_modules/
+.venv/
+venv/
+env/
+
+# Caches
+__pycache__/
+*.pyc
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.tox/
+.nox/
+.coverage
+htmlcov/
+
+# Vendored / generated
+*.min.js
+*.min.css
+*.lock

pystreamai-2.1.2/CHANGELOG.md

@@ -0,0 +1,98 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+This file did not exist before 2026-09-19 - there is no reconstructed
+history here for `v0.1.0` through `v2.1.0`. For that history, see
+`git log`, the repository's git tags (`v0.1.0`, `v0.2.0`, `v0.2.1`,
+`v0.3.0`, `v2.0.0`, ...), and `docs/PUBLISH.md` /
+`docs/ROADMAP.md`. Do not treat the absence of pre-2026-09-19 entries as
+"nothing happened" - it means this file wasn't being kept yet.
+
+## [Unreleased]
+
+### Fixed
+- `pyproject.toml`'s `[onnx]` extra was missing the `onnx` package itself,
+  so `tests/test_onnx_runtime.py` / `tests/test_platform_onnx_predict.py`
+  were silently skipped in CI. Added `onnx>=1.15.0,<1.23.0` to the
+  extra - pinned below 1.23.0 because onnx 1.23.0 is the first release
+  that writes IR version 14 graphs, which the currently-resolved
+  `onnxruntime` (1.30.0, satisfying `>=1.15.0`) rejects (max supported
+  IR version 13; verified directly, not just from the error message).
+  onnx 1.15.0-1.22.0 all write IR versions 9-13, which onnxruntime
+  1.30.0 loads correctly. All 8 previously-skipped ONNX tests now run
+  and pass for real.
+- `pyproject.toml`'s `dev` extra was missing `httpx`, so
+  `tests/test_api.py` and `tests/test_model_failure_states.py` (15
+  tests total) were also silently skipped in CI via
+  `pytest.importorskip("httpx", ...)` (needed by
+  `fastapi.testclient.TestClient`) - same shape of bug as the ONNX gap
+  above, found while investigating it. Added `httpx>=0.24.0` to `dev`.
+- Full suite is now 169 passed / 0 skipped (previously 146 passed / 4
+  skipped when `[dev,serving,onnx]` was installed without the two fixes
+  above), `ruff check .` clean, `cargo test --release` 16 passed.
+
+### Added
+- `ROADMAP_HONEST.md` - honest, bucketed roadmap and technical debt list
+  (dead Rust code, fake `llm_optimization`/`edge_deployment` modules, the
+  ONNX test suite's actual CI/version-compatibility status, etc).
+- `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, this `CHANGELOG.md`.
+- `.github/dependabot.yml` (pip, cargo, github-actions ecosystems).
+- `.github/ISSUE_TEMPLATE/bug_report.yml`, `feature_request.yml`, and
+  `.github/pull_request_template.md`.
+- `.github/workflows/security-audit.yml` - `pip-audit` + `cargo audit`,
+  scheduled weekly plus manual dispatch (not run on every PR). Not yet
+  confirmed green on real GitHub Actions infrastructure - authored and
+  `actionlint`-checked in a sandbox with no network access to PyPI/
+  crates.io/GitHub's advisory database.
+- `Cargo.lock` is now committed (previously gitignored) for reproducible
+  builds of this cdylib/PyO3 extension.
+
+### Changed
+- `pyproject.toml`: added `[tool.maturin] include = ["LICENSE"]` so
+  `maturin sdist` doesn't omit `LICENSE` from the sdist tarball (a
+  recurring issue across this org's maturin-based projects that causes
+  PyPI to reject the upload).
+- `.github/workflows/tests.yml` / `build-wheels.yml`: replaced the
+  unmaintained `actions-rs/toolchain@v1` with `dtolnay/rust-toolchain@stable`,
+  and bumped `actions/checkout` to v4 and `actions/setup-python` to v5
+  (flagged by `actionlint` as running on a deprecated/EOL runner).
+- `README.md`: disclosed that `pystreamai.llm_optimization` and
+  `pystreamai.edge_deployment` are almost entirely fabricated (return
+  hardcoded values, never touch real models/files) - not previously
+  documented anywhere outside a test-file comment; disclosed that the
+  Rust extension's `Platform.train()`/`serve()`/`predict()` are literal
+  string formatters with no real behavior; disclosed that
+  `tests/test_onnx_runtime.py` / `tests/test_platform_onnx_predict.py`
+  are silently skipped in CI (missing `onnx` package) and actually fail
+  if run manually due to an `onnx`/`onnxruntime` IR-version mismatch.
+
+### Removed
+- `.env.example` - described `API_KEY`/`DATABASE_URL`/`REDIS_URL`/
+  `ELASTICSEARCH_URL`/`SECRET_KEY` etc., none of which are read anywhere
+  in this codebase (`grep -r "os.environ\|os.getenv" pystreamai/ src/`
+  returns nothing). Kept unremoved, it implied config surface that
+  doesn't exist.
+
+## [2.1.2] - 2026-10-18
+
+### Security
+- Default `APIServer.run()` bind address to loopback `127.0.0.1` instead of `0.0.0.0` (RECHECK-002).
+
+### Fixed
+- Set `ir_version=9` on ONNX test graphs so `onnxruntime` on Python 3.10 (max IR 11) loads graphs built with `onnx >= 1.21`.
+
+## [2.1.1] - 2026-10-17
+
+### Fixed
+- Audit remediation: security hardening, correctness fixes, and lint/CI gates.
+
+## Earlier versions
+
+Version bumps prior to this file (`0.1.0` → `2.1.0`) happened via
+`pyproject.toml`/`Cargo.toml` version fields and git tags without a
+changelog. See `git log --oneline` and `docs/PUBLISH.md` for the real
+mechanics of how releases were built and what changed in the `v1.1.0`
+restoration and the `v2.0.0` breaking-change release.

pystreamai-2.1.2/CODE_OF_CONDUCT.md

@@ -0,0 +1,37 @@
+# Code of Conduct
+
+## Our Pledge
+
+We as contributors and maintainers pledge to make participation in this
+project a harassment-free experience for everyone, regardless of age,
+body size, visible or invisible disability, ethnicity, sex
+characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance,
+race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Focusing on what is best for the community
+
+Examples of unacceptable behavior:
+
+- Harassment, insulting or derogatory comments, and personal or political attacks
+- Publishing others' private information without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may
+be reported to mullassery@gmail.com. All complaints will be reviewed and
+investigated promptly and fairly. Maintainers are obligated to respect
+the privacy and security of the reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the
+[Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

pystreamai-2.1.2/CONTRIBUTING.md

@@ -0,0 +1,80 @@
+# Contributing to PyStreamAI
+
+Thanks for considering a contribution. This project is early-stage
+(v2.1.0, source-available, Apache-2.0) - read the README's "Status" and
+"How this works today" sections first so you know which parts are real
+and which are documented placeholders before you patch either.
+
+## Before you start
+
+- Check `README.md`'s "Known issues" section and `ROADMAP_HONEST.md` -
+  your bug or idea may already be tracked there with more detail than an
+  issue would have.
+- For anything beyond a small fix, open an issue first to discuss the
+  approach. This avoids wasted work on something that conflicts with the
+  project's direction.
+
+## Development setup
+
+```bash
+git clone https://github.com/Mullassery/PyStreamAI.git
+cd PyStreamAI
+python3 -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev,serving,onnx]"
+maturin develop --release   # builds the Rust extension (src/*.rs) into the venv
+```
+
+Requires Python 3.10+ and a Rust toolchain (stable) if you're touching
+`src/*.rs`.
+
+## Running checks locally
+
+```bash
+pytest                # Python test suite
+ruff check .           # lint (pyflakes + core pycodestyle rules only, see pyproject.toml)
+cargo test --release   # Rust unit tests (src/*.rs)
+```
+
+All three must pass before opening a PR. If you add a new module or
+function, add a real test for it - not a smoke test that only checks it
+doesn't raise. If you can't add a real test yet (e.g. the feature is
+genuinely a hardcoded placeholder), say so explicitly in the code comment
+and the PR description; don't leave it implied.
+
+## The "no fake stubs" rule
+
+This codebase has a documented history of shipping code that looked done
+but wasn't (see README's "Performance claims" and "Known issues"
+sections, and `ROADMAP_HONEST.md`'s technical debt list for current
+examples still being cleaned up). When contributing:
+
+- If a function can't do the real thing yet (no test hardware, no real
+  backend, etc.), it must say so in its docstring and return values that
+  can't be mistaken for real measurements/results - not a plausible-looking
+  hardcoded number.
+- Don't add "TODO: implement later" methods that silently return success.
+  Either implement it for real or leave it unimplemented and raise
+  `NotImplementedError`.
+- If you're fixing one of the fake modules in `ROADMAP_HONEST.md` (e.g.
+  `pystreamai.llm_optimization`, `pystreamai.edge_deployment`), remove the
+  "not real" disclosure for that specific function in the same PR that
+  makes it real - don't let docs and code drift apart again.
+
+## Commit / PR conventions
+
+- Keep commits focused; one logical change per commit.
+- Update `README.md` and the relevant file under `docs/` in the same PR
+  as any behavior change - stale docs are treated as a bug here.
+- Add an entry to `CHANGELOG.md` under `[Unreleased]` for user-visible
+  changes.
+- Use the PR template (`.github/pull_request_template.md`) checklist.
+
+## Reporting security issues
+
+Do not open a public issue for a security vulnerability - see
+`SECURITY.md`.
+
+## License
+
+By contributing, you agree your contributions are licensed under this
+project's Apache License 2.0 (see `LICENSE`).

{pystreamai-2.1.0 → pystreamai-2.1.2}/Cargo.lock

@@ -283,7 +283,7 @@ dependencies = [
 
 [[package]]
 name = "pystreamai"
-version = "2.1.0"
+version = "2.1.2"
 dependencies = [
  "async-trait",
  "chrono",

{pystreamai-2.1.0 → pystreamai-2.1.2}/Cargo.toml

@@ -1,9 +1,9 @@
 [package]
 name = "pystreamai"
-version = "2.1.0"
+version = "2.1.2"
 edition = "2021"
 description = "Rust orchestrator for PyStreamAI - simple ML deployment platform"
-license = "Proprietary"
+license = "Apache-2.0"
 readme = "README.md"
 
 [lib]