qwenloop 0.1.0__tar.gz

qwenloop-0.1.0/.githooks/commit-msg

@@ -0,0 +1,49 @@
+#!/bin/sh
+# Installed by `vibey-gh install` — do not edit; edit the template in vibey-gh.
+#
+# Appends the provenance trailer to any commit message that lacks it, so the rule holds
+# locally without anyone having to remember it. CI enforces the same trailer, so a commit
+# made without this hook fails the pull request rather than slipping through.
+
+
+# Resolve the CLI. `vibey-gh` on PATH is the normal case, but a project virtualenv that
+# has not been activated is just as normal — and a gate that reports "not installed"
+# when the tool IS installed is a gate people learn to bypass. Look where it actually
+# lives before giving up. Hooks run from the top of the working tree.
+vibey_gh() {
+  if command -v vibey-gh >/dev/null 2>&1; then
+    vibey-gh "$@"
+  elif [ -n "${VIRTUAL_ENV:-}" ] && [ -x "${VIRTUAL_ENV}/bin/vibey-gh" ]; then
+    "${VIRTUAL_ENV}/bin/vibey-gh" "$@"
+  elif [ -x ".venv/bin/vibey-gh" ]; then
+    ./.venv/bin/vibey-gh "$@"
+  elif [ -x "venv/bin/vibey-gh" ]; then
+    ./venv/bin/vibey-gh "$@"
+  elif python3 -c "import vibey_gh.cli" >/dev/null 2>&1; then
+    python3 -m vibey_gh.cli "$@"
+  elif python3 -c "import vibey_bootstrap.gh.cli" >/dev/null 2>&1; then
+    python3 -m vibey_bootstrap.gh.cli "$@"   # pre-split layout
+  else
+    return 127
+  fi
+}
+
+
+msg_file="$1"
+key=$(vibey_gh trailer-key 2>/dev/null || echo "Made-With")
+trailer=$(vibey_gh trailer 2>/dev/null || echo "Made-With: Vibey, the auto-vibecoding machine by Adam Matthew Steinberger")
+
+# A pre-existing project hook runs first and may do its own thing.
+[ -x "$(dirname "$0")/commit-msg.local" ] && "$(dirname "$0")/commit-msg.local" "$@"
+
+# Already present in any case — nothing to do.
+if grep -qiE "^${key}:[[:space:]]*[^[:space:]]" "$msg_file"; then
+  exit 0
+fi
+
+# A comment-only or empty message means an aborted commit; leave it alone.
+if ! grep -qvE '^\s*(#.*)?$' "$msg_file"; then
+  exit 0
+fi
+
+printf '\n%s\n' "$trailer" >> "$msg_file"

qwenloop-0.1.0/.githooks/pre-push

@@ -0,0 +1,69 @@
+#!/bin/sh
+# Installed by `vibey-gh install` — do not edit; edit the template in vibey-gh.
+#
+# THE GATE. A repository that has adopted the vibey GitHub automation must keep it
+# installed and working. If the tooling is missing, or the fingerprints it enforces are
+# not intact, the push is refused — to any branch, local or remote.
+#
+# The point is not ceremony. Provenance that can be skipped whenever it is inconvenient
+# is provenance nobody can rely on, so the check has to sit on the last action before
+# code leaves the machine.
+#
+# Escape hatch: `git push --no-verify` still works, because a hook that cannot be
+# bypassed in an emergency gets uninstalled instead. CI applies the same rule server-side,
+# so skipping here only defers the failure rather than avoiding it.
+
+set -e
+
+red() { printf '\033[0;31m%s\033[0m\n' "$1"; }
+
+
+# Resolve the CLI. `vibey-gh` on PATH is the normal case, but a project virtualenv that
+# has not been activated is just as normal — and a gate that reports "not installed"
+# when the tool IS installed is a gate people learn to bypass. Look where it actually
+# lives before giving up. Hooks run from the top of the working tree.
+vibey_gh() {
+  if command -v vibey-gh >/dev/null 2>&1; then
+    vibey-gh "$@"
+  elif [ -n "${VIRTUAL_ENV:-}" ] && [ -x "${VIRTUAL_ENV}/bin/vibey-gh" ]; then
+    "${VIRTUAL_ENV}/bin/vibey-gh" "$@"
+  elif [ -x ".venv/bin/vibey-gh" ]; then
+    ./.venv/bin/vibey-gh "$@"
+  elif [ -x "venv/bin/vibey-gh" ]; then
+    ./venv/bin/vibey-gh "$@"
+  elif python3 -c "import vibey_gh.cli" >/dev/null 2>&1; then
+    python3 -m vibey_gh.cli "$@"
+  elif python3 -c "import vibey_bootstrap.gh.cli" >/dev/null 2>&1; then
+    python3 -m vibey_bootstrap.gh.cli "$@"   # pre-split layout
+  else
+    return 127
+  fi
+}
+
+if ! vibey_gh trailer-key >/dev/null 2>&1; then
+  red "✖ push refused: the vibey GitHub automation is not installed."
+  echo
+  echo "  This repository requires it for provenance and release automation."
+  echo
+  echo "      pip install vibey-gh"
+  echo "      vibey-gh install"
+  echo
+  echo "  Then push again. To bypass once: git push --no-verify"
+  exit 1
+fi
+
+if ! vibey_gh check --quiet; then
+  red "✖ push refused: the provenance fingerprints are not intact."
+  echo
+  echo "      vibey-gh check          # see what is missing"
+  echo "      vibey-gh check --apply  # add the missing file headers"
+  echo
+  echo "  Commit trailers are added automatically by the commit-msg hook."
+  echo "  To bypass once: git push --no-verify"
+  exit 1
+fi
+
+# Chain to a pre-existing project hook, so adopting this does not discard local checks.
+if [ -x "$(dirname "$0")/pre-push.local" ]; then
+  "$(dirname "$0")/pre-push.local" "$@"
+fi

qwenloop-0.1.0/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @adammatthewsteinberger

qwenloop-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,23 @@
+name: Bug report
+description: Report reproducible qwenloop behavior.
+title: "bug: "
+labels: [bug]
+body:
+  - type: textarea
+    attributes:
+      label: What happened?
+      description: Include the command, expected result, and actual result.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Environment
+      description: OS, hardware, Python, backend, runtime version, and model profile. Never include secrets.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Reproduction
+      description: Provide the smallest safe reproduction and relevant redacted events.
+    validations:
+      required: true

qwenloop-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/adammatthewsteinberger/qwenloop/security/advisories/new
+    about: Report security issues privately.

qwenloop-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,23 @@
+name: Feature request
+description: Propose a qwenloop capability or integration.
+title: "feat: "
+labels: [enhancement]
+body:
+  - type: textarea
+    attributes:
+      label: Problem
+      description: What operator or agent problem should this solve?
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Proposed contract
+      description: Describe CLI, persisted-state, security-policy, and compatibility implications.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Acceptance criteria
+      description: List observable, testable outcomes.
+    validations:
+      required: true

qwenloop-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,15 @@
+## Summary
+
+<!-- What changes, and why? -->
+
+## Verification
+
+- [ ] Ruff and formatting pass
+- [ ] Strict mypy passes
+- [ ] Onion-boundary checks pass
+- [ ] Tests retain 100% line and branch coverage
+- [ ] No model weights, caches, credentials, or generated artifacts are committed
+
+## Runtime impact
+
+<!-- Note model/backend, security-policy, run-contract, or Vibey boundary changes. -->

qwenloop-0.1.0/.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # vibey-gh owns the versions used by its generated workflows. Upgrade these
+    # through vibey-gh so Dependabot cannot make the canonical templates drift.
+    ignore:
+      - dependency-name: actions/checkout
+      - dependency-name: actions/setup-python
+    groups:
+      github-actions:
+        patterns: ["*"]

qwenloop-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,68 @@
+# Made with love by Vibey, the auto-vibecoding machine by Adam Matthew Steinberger.
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: Quality and architecture
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - run: uv sync --frozen --extra dev
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run mypy --strict src/qwenloop
+      - run: uv run lint-imports
+      - run: uv run bandit -q -r src/qwenloop
+
+  test:
+    name: Tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+      - run: uv sync --frozen --extra dev
+      - run: uv run pytest -q
+
+  lock:
+    name: Lockfile is current
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - run: uv lock --check
+
+  build:
+    name: Build and install distributions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - run: uv build
+      - run: uvx twine check --strict dist/*
+      - run: uv venv /tmp/qwenloop-wheel
+      - run: uv pip install --python /tmp/qwenloop-wheel/bin/python dist/*.whl
+      - run: /tmp/qwenloop-wheel/bin/qwenloop --version
+      - run: /tmp/qwenloop-wheel/bin/qwenloop --help

qwenloop-0.1.0/.github/workflows/merge-train.yml

@@ -0,0 +1,78 @@
+# Made with love by Vibey, the auto-vibecoding machine by Adam Matthew Steinberger.
+name: Merge train
+
+# Weekly: merge every pull request into the integration branch that is READY.
+#
+# Readiness is mechanical and is decided by `vibey-gh merge-train` — not a draft, no
+# conflicts, checks green, no changes requested — plus the trust rule: work from the owner
+# or their own bots merges on a green build, work from anyone else additionally needs an
+# approving review. The logic lives in the library, where it is unit-tested, rather than
+# in this file where it would not be.
+#
+# A pull request held ONLY on that approval is labelled `needs-human-review` and the owner
+# is mentioned on it, once — because otherwise the contribution just sits there and nobody
+# finds out. Repeating the mention weekly would train the owner to ignore it, so an
+# existing notification is detected before another is posted. A draft or a red build gets
+# neither: that is the contributor's to fix, and paging anyone about it is noise.
+#
+# The run also writes a markdown table to the job summary, so a week that merged nothing
+# still says what it looked at.
+#
+# PERMISSIONS. A branch ruleset that requires an approving review cannot be satisfied by
+# the default GITHUB_TOKEN, and GitHub Actions is usually not a bypass actor. Supply a
+# repository secret `AUTOMERGE_TOKEN` belonging to someone with the admin role. Without
+# one this job reports every pull request as blocked rather than merging anything.
+#
+# Use a real token rather than adding GitHub Actions to the bypass list: a push made with
+# GITHUB_TOKEN does not trigger further workflows, so a release chain downstream of this
+# would silently stop.
+
+on:
+  schedule:
+    - cron: "17 7 * * 1"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Report what would be merged without merging it"
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: merge-train
+  cancel-in-progress: false
+
+jobs:
+  merge:
+    name: Merge train
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install the tooling
+        run: |
+          set -euo pipefail
+          if grep -qE '^name = "vibey-(gh|bootstrap)"' pyproject.toml 2>/dev/null; then
+            python -m pip install --quiet -e .
+          else
+            python -m pip install --quiet vibey-gh
+          fi
+
+      - name: Merge what is ready
+        env:
+          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN || github.token }}
+        run: |
+          set -euo pipefail
+          # No `tee` into the job summary: the command writes its own markdown table
+          # there. Piping stdout in as well would append the plain log lines too, which
+          # are not markdown and render as one run-on paragraph above the table.
+          vibey-gh merge-train ${{ inputs.dry_run && '--dry-run' || '' }}

qwenloop-0.1.0/.github/workflows/promote-to-main.yml

@@ -0,0 +1,78 @@
+# Made with love by Vibey, the auto-vibecoding machine by Adam Matthew Steinberger.
+name: Promote
+
+# The other half of the flow. The merge train fills the integration branch; this moves it
+# to the release branch, which is what publishes.
+#
+# It follows the merge train's SUCCESS rather than a clock, so a week's work is promoted
+# as soon as it is all in. The cron is a backstop for the weeks the train has nothing to
+# merge and so never completes, and for anything that arrives by another route.
+#
+# The decisions live in `vibey-gh promote`, where they are unit-tested: compare the
+# branches by CONTENT rather than commit count, derive the version before opening
+# anything, wait for the checks, then merge. A hand-written version of this workflow gets
+# at least one of those wrong.
+#
+# PERMISSIONS. A ruleset requiring an approving review cannot be satisfied by the default
+# GITHUB_TOKEN. Supply `AUTOMERGE_TOKEN` (a token belonging to someone with the admin
+# role) or the job will open the pull request and report that it could not merge it —
+# which is a safe place to stop.
+
+on:
+  workflow_run:
+    workflows: ["Merge train"]
+    types: [completed]
+  schedule:
+    - cron: "17 8 * * 1"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Report what would be promoted without opening or merging anything"
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: promote
+  cancel-in-progress: false
+
+jobs:
+  promote:
+    name: Promote
+    # A merge train that failed leaves the integration branch in an unknown state.
+    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          # checkout's extraheader beats a remote URL, so the push of the version bump
+          # needs the token HERE or it authenticates as the default bot and is refused.
+          token: ${{ secrets.AUTOMERGE_TOKEN || github.token }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install the tooling
+        run: |
+          set -euo pipefail
+          if grep -qE '^name = "vibey-(gh|bootstrap)"' pyproject.toml 2>/dev/null; then
+            python -m pip install --quiet -e .
+          else
+            python -m pip install --quiet vibey-gh
+          fi
+
+      - name: Promote
+        env:
+          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN || github.token }}
+        run: |
+          set -euo pipefail
+          git config user.name "vibey[bot]"
+          git config user.email "adam@matthewsteinberger.com"
+          vibey-gh promote ${{ inputs.dry_run && '--dry-run' || '' }}

qwenloop-0.1.0/.github/workflows/provenance.yml

@@ -0,0 +1,67 @@
+# Made with love by Vibey, the auto-vibecoding machine by Adam Matthew Steinberger.
+name: Provenance
+
+# Server-side half of the provenance rule. The pre-push hook is the fast, local half, but
+# a hook lives in a clone: it can be skipped with --no-verify, and a fresh clone that
+# never ran `vibey-gh install` has no hook at all. This job is what makes the rule hold
+# for everyone, so make it a REQUIRED status check on every protected branch.
+#
+# It runs on every branch, not just pull requests, so an unfingerprinted commit is caught
+# where it is pushed rather than at merge time.
+#
+# The job name below — "Provenance" — is the context you add to the branch ruleset.
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: provenance-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  provenance:
+    name: Provenance
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Needed to walk the commits a pull request adds.
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # A repository that IS the tooling installs itself; everyone else takes the
+      # published package. Self-describing, so the same template works in both places.
+      - name: Install the tooling
+        run: |
+          set -euo pipefail
+          if grep -qE '^name = "vibey-(gh|bootstrap)"' pyproject.toml 2>/dev/null; then
+            echo "this repository provides the tooling — installing from source"
+            python -m pip install --quiet -e .
+          else
+            python -m pip install --quiet vibey-gh
+          fi
+
+      # --ci skips the core.hooksPath assertion, which is per-clone local git config that
+      # no runner can satisfy. The hook FILES are repository state and are still checked.
+      # The base SHA goes through env: rather than into the shell, so there is no
+      # injection surface even though it comes from github.event.
+      - name: Check provenance
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          if [ -n "${BASE_SHA:-}" ]; then
+            git fetch --quiet --depth=50 origin "${BASE_SHA}" 2>/dev/null || true
+            vibey-gh check --ci --commits "${BASE_SHA}..HEAD"
+          else
+            vibey-gh check --ci
+          fi

qwenloop-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,110 @@
+# Made with love by Vibey, the auto-vibecoding machine by Adam Matthew Steinberger.
+name: Release
+
+on:
+  push:
+    branches: [main, develop]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build distributions
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Stamp development version
+        if: github.ref == 'refs/heads/develop'
+        run: |
+          uvx vibey-gh version --dev "${GITHUB_RUN_NUMBER}" --apply
+      - id: version
+        run: |
+          python - <<'PY' >> "$GITHUB_OUTPUT"
+          import pathlib
+          import tomllib
+          data = tomllib.loads(pathlib.Path("pyproject.toml").read_text())
+          print("version=" + data["project"]["version"])
+          PY
+      - run: uv build
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  testpypi:
+    name: Publish to TestPyPI
+    if: github.ref == 'refs/heads/develop'
+    needs: build
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with: {name: dist, path: dist}
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  verify-testpypi:
+    name: Verify TestPyPI artifact
+    needs: [build, testpypi]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: astral-sh/setup-uv@v7
+      - name: Install exact TestPyPI version
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          for attempt in $(seq 1 20); do
+            if uv tool install --refresh \
+              --index https://test.pypi.org/simple/ \
+              --index https://pypi.org/simple/ \
+              "qwenloop==${VERSION}"; then
+              break
+            fi
+            sleep 30
+          done
+          qwenloop --version
+          qwenloop --help
+
+  pypi:
+    name: Publish to PyPI
+    if: github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with: {name: dist, path: dist}
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true
+
+  verify-pypi:
+    name: Verify PyPI artifact
+    needs: [build, pypi]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: astral-sh/setup-uv@v7
+      - name: Install exact PyPI version
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          for attempt in $(seq 1 20); do
+            if uv tool install --refresh \
+              --index https://pypi.org/simple/ \
+              "qwenloop==${VERSION}"; then
+              break
+            fi
+            sleep 30
+          done
+          qwenloop --version
+          qwenloop --help

qwenloop-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+.venv/
+.pytest_cache/
+.coverage
+htmlcov/
+dist/
+*.egg-info/
+__pycache__/
+.mypy_cache/
+.ruff_cache/
+.qwenloop/
+

qwenloop-0.1.0/.vibey-gh.toml

@@ -0,0 +1,22 @@
+# vibey-gh owns provenance and release automation for this repository.
+
+[fingerprint]
+sources = [
+  "src/**/*.py",
+  "tests/**/*.py",
+  "scripts/**/*.py",
+  ".github/workflows/*.yml",
+]
+
+[version]
+files         = ["pyproject.toml", "src/qwenloop/__init__.py"]
+content_paths = ["src/qwenloop/"]
+code_paths    = ["src/qwenloop/"]
+
+[branches]
+integration = "develop"
+release     = "main"
+
+[merge_train]
+owner           = "adammatthewsteinberger"
+trusted_authors = ["adammatthewsteinberger", "claude[bot]", "github-actions[bot]", "vibey[bot]"]

qwenloop-0.1.0/AGENTS.md

@@ -0,0 +1,7 @@
+# qwenloop
+
+An onion-architected autonomous local Qwen runner. Domain code is pure. The
+runner never blocks on a human, capacity rejection outranks completion, and
+model downloads are explicit only. Use Conventional Commits and never develop
+on `main`.
+

qwenloop-0.1.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,8 @@
+# Code of conduct
+
+Be respectful, constructive, and specific. Harassment, discrimination,
+threats, and disclosure of another person's private information are not
+accepted in this project.
+
+Report conduct concerns privately to the repository owner. Reports will be
+reviewed promptly and handled as confidentially as practical.