raidlock 0.1.0__tar.gz

raidlock-0.1.0/.claude-plugin/marketplace.json

@@ -0,0 +1,24 @@
+{
+  "name": "raidlock",
+  "owner": {
+    "name": "agi1clj",
+    "url": "https://github.com/agi1clj"
+  },
+  "metadata": {
+    "description": "raidlock plugin for Claude Code"
+  },
+  "plugins": [
+    {
+      "name": "raidlock",
+      "source": "./",
+      "description": "Lease-and-review board for coding agents: path locks enforced by hooks, a lead-only done gate, heartbeats and handbacks.",
+      "version": "0.1.0",
+      "author": {
+        "name": "agi1clj"
+      },
+      "homepage": "https://github.com/agi1clj/raidlock",
+      "repository": "https://github.com/agi1clj/raidlock",
+      "license": "MIT"
+    }
+  ]
+}

raidlock-0.1.0/.claude-plugin/plugin.json

@@ -0,0 +1,13 @@
+{
+  "name": "raidlock",
+  "version": "0.1.0",
+  "description": "Lease-and-review board for coding agents: path locks enforced by hooks, a lead-only done gate, heartbeats and handbacks.",
+  "author": {
+    "name": "agi1clj",
+    "url": "https://github.com/agi1clj"
+  },
+  "homepage": "https://github.com/agi1clj/raidlock",
+  "repository": "https://github.com/agi1clj/raidlock",
+  "license": "MIT",
+  "keywords": ["agents", "coordination", "leases", "locks", "review"]
+}

raidlock-0.1.0/.dockerignore

@@ -0,0 +1,7 @@
+*
+!pyproject.toml
+!README.md
+!LICENSE
+!src/
+**/__pycache__
+**/*.pyc

raidlock-0.1.0/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @agi1clj

raidlock-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,49 @@
+name: Bug report
+description: Something does not work as documented.
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you did, what you expected and what happened instead.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Commands, from a fresh board if possible. Do not paste secrets or private transcript content.
+      render: shell
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: raidlock version
+      placeholder: raidlock --version
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: OS
+      options: [Linux, macOS, Windows, Other]
+    validations:
+      required: true
+  - type: input
+    id: python
+    attributes:
+      label: Python version
+  - type: dropdown
+    id: runtime
+    attributes:
+      label: Runtime involved
+      multiple: true
+      options: [Claude Code, Codex CLI, Gemini CLI, shell, web UI, none]
+  - type: textarea
+    id: logs
+    attributes:
+      label: Output
+      description: Error output or `--json` output.
+      render: text

raidlock-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/agi1clj/raidlock/security/advisories/new
+    about: Report vulnerabilities privately, not as an issue.

raidlock-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,22 @@
+name: Feature request
+description: Suggest a change or new feature.
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to do, and what gets in the way today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What should raidlock do? Note any change to PROTOCOL.md.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

raidlock-0.1.0/.github/ISSUE_TEMPLATE/runner_adapter.yml

@@ -0,0 +1,43 @@
+name: Runner adapter request
+description: Ask for raidlock to delegate quests to another agent CLI.
+labels: [runner-adapter]
+body:
+  - type: input
+    id: cli
+    attributes:
+      label: Agent CLI
+      placeholder: name and link
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: CLI version tested
+    validations:
+      required: true
+  - type: textarea
+    id: headless
+    attributes:
+      label: Headless invocation
+      description: How to run it non-interactively with a prompt on stdin, a working directory and a model.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: sandbox
+    attributes:
+      label: Sandbox and approval modes
+      description: Read-only and write modes, and how to keep approvals on. Links to the CLI's docs.
+    validations:
+      required: true
+  - type: textarea
+    id: events
+    attributes:
+      label: Machine-readable output
+      description: Event stream or JSON output format, structured output support, and where usage (tokens, cost) is reported.
+  - type: checkboxes
+    id: willing
+    attributes:
+      label: Contribution
+      options:
+        - label: I can open a pull request with the adapter and recorded-event tests

raidlock-0.1.0/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      python:
+        patterns: ["*"]

raidlock-0.1.0/.github/pull_request_template.md

@@ -0,0 +1,13 @@
+## What and why
+
+## How it was tested
+
+## Checklist
+
+- [ ] Every commit is signed off (`git commit -s`)
+- [ ] Tests added or updated; the suite passes locally
+- [ ] `CHANGELOG.md` updated under Unreleased (if users would notice)
+- [ ] Docs updated (README, PROTOCOL.md, docs/guides) if behavior changed
+- [ ] PROTOCOL.md changes called out above
+- [ ] No code comments, no new runtime dependency, no secrets or real board data in fixtures
+- [ ] Workflow changes pass actionlint and pin actions to commit SHAs

raidlock-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,175 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  PYTHONUTF8: "1"
+  UV_NO_PROGRESS: "1"
+
+jobs:
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      ACTIONLINT_VERSION: 1.7.12
+      ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Install actionlint
+        run: |
+          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          curl -fsSLo "$archive" "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "$archive" actionlint
+      - name: Run actionlint
+        run: ./actionlint -color
+
+  test:
+    name: test (${{ matrix.os }}, py${{ matrix.python }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    continue-on-error: ${{ matrix.os == 'windows-latest' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        python: ["3.11", "3.12", "3.13", "3.14", "3.15"]
+        include:
+          - os: windows-latest
+            python: "3.11"
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Run tests
+        run: uv run --locked pytest --ignore=tests/web
+
+  playwright:
+    name: web UI (Playwright)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e
+        with:
+          python-version: "3.13"
+      - name: Install browser
+        run: |
+          uv sync --locked --extra ui-test
+          uv run --locked playwright install --with-deps chromium
+      - name: Run web tests
+        run: uv run --locked pytest tests/web
+      - name: Upload traces on failure
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: playwright-results
+          path: test-results/
+          if-no-files-found: ignore
+          retention-days: 7
+
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e
+        with:
+          python-version: "3.11"
+      - name: Ruff lint
+        run: uv run --locked --with ruff==0.15.14 ruff check
+      - name: Ruff format
+        if: always()
+        run: uv run --locked --with ruff==0.15.14 ruff format --check
+
+  overhead:
+    name: idle overhead
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e
+        with:
+          python-version: "3.11"
+      - name: Measure idle overhead
+        run: |
+          uv run --locked python scripts/bench_overhead.py --runs 5 --tokenizer estimate > overhead.json 2> overhead.md
+          head -n 1 overhead.md
+          cat overhead.md >> "$GITHUB_STEP_SUMMARY"
+
+  types:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e
+        with:
+          python-version: "3.11"
+      - name: Pyright
+        run: uv run --locked --with pyright==1.1.408 pyright src/raidlock
+
+  docker:
+    name: docker image
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      IMAGE: raidlock:ci
+      TRIVY_VERSION: 0.75.0
+      TRIVY_SHA256: c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Build image
+        run: docker build --platform linux/amd64 -t "$IMAGE" .
+      - name: Allow unprivileged user namespaces
+        run: |
+          if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
+            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          fi
+      - name: Smoke test in a hardened container
+        run: |
+          docker run --rm --read-only --cap-drop ALL --security-opt no-new-privileges \
+            --security-opt apparmor=unconfined --network none \
+            --tmpfs /tmp:uid=10001,gid=10001,mode=1777 \
+            --tmpfs /home/raid:uid=10001,gid=10001,mode=0700 \
+            --tmpfs /workspace:uid=10001,gid=10001,mode=0700 \
+            -v "$PWD/scripts/docker-smoke.sh:/smoke.sh:ro" \
+            --entrypoint sh "$IMAGE" /smoke.sh
+      - name: Install Trivy
+        run: |
+          archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          curl -fsSLo "$archive" "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"
+          echo "${TRIVY_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "$archive" trivy
+      - name: Trivy image scan
+        run: ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress "$IMAGE"

raidlock-0.1.0/.github/workflows/docker-publish.yml

@@ -0,0 +1,63 @@
+name: Docker publish
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docker-publish-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  IMAGE: ghcr.io/agi1clj/raidlock
+
+jobs:
+  publish:
+    name: Build, sign and push
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Check tag matches project version
+        run: |
+          version="$(python3 -c 'import runpy; print(runpy.run_path("src/raidlock/__init__.py")["__version__"])')"
+          if [ "${GITHUB_REF_NAME#v}" != "$version" ]; then
+            echo "::error::tag ${GITHUB_REF_NAME} does not match project version ${version}"
+            exit 1
+          fi
+          echo "VERSION=${version}" >> "$GITHUB_ENV"
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          sbom: true
+          provenance: mode=max
+          tags: |
+            ${{ env.IMAGE }}:${{ env.VERSION }}
+            ${{ env.IMAGE }}:latest
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
+        with:
+          cosign-release: v3.1.3
+      - name: Sign image
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: cosign sign --yes "${IMAGE}@${DIGEST}"

raidlock-0.1.0/.github/workflows/pr-title.yml

@@ -0,0 +1,28 @@
+name: PR title
+
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  title:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            docs
+            test
+            refactor
+            perf
+            ci
+            build
+            chore
+            revert

raidlock-0.1.0/.github/workflows/release-please.yml

@@ -0,0 +1,19 @@
+name: Release please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

raidlock-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,118 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build sdist and wheel
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e
+        with:
+          python-version: "3.13"
+      - name: Check tag matches project version
+        run: |
+          version="$(python -c 'import runpy; print(runpy.run_path("src/raidlock/__init__.py")["__version__"])')"
+          if [ "${GITHUB_REF_NAME#v}" != "$version" ]; then
+            echo "::error::tag ${GITHUB_REF_NAME} does not match project version ${version}"
+            exit 1
+          fi
+      - name: Check distribution metadata versions
+        run: |
+          python - <<'PYTHON'
+          import json
+          import runpy
+          import tomllib
+          from pathlib import Path
+          version = runpy.run_path("src/raidlock/__init__.py")["__version__"]
+          plugin = json.loads(Path(".claude-plugin/plugin.json").read_text())
+          marketplace = json.loads(Path(".claude-plugin/marketplace.json").read_text())
+          lock = tomllib.loads(Path("uv.lock").read_text())
+          project = tomllib.loads(Path("pyproject.toml").read_text())
+          assert project["project"]["version"] == version
+          assert plugin["version"] == version
+          assert all(p["version"] == version for p in marketplace["plugins"])
+          assert next(p["version"] for p in lock["package"] if p["name"] == "raidlock") == version
+          PYTHON
+      - name: Build
+        run: uv build
+      - name: Extract release notes from CHANGELOG
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          awk -v v="$version" '
+            index($0, "## [" v "]") == 1 { found = 1; next }
+            found && /^## \[/ { exit }
+            found && /^\[[^]]+\]: / { exit }
+            found { print }
+          ' CHANGELOG.md > dist/RELEASE_NOTES.md
+          if [ ! -s dist/RELEASE_NOTES.md ]; then
+            echo "::error::no CHANGELOG.md section for ${version}"
+            exit 1
+          fi
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+          retention-days: 7
+
+  pypi:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/p/raidlock
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
+        with:
+          name: dist
+          path: dist/
+      - name: Keep only distributions
+        run: rm -f dist/RELEASE_NOTES.md
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086
+        with:
+          attestations: true
+
+  github-release:
+    name: GitHub release
+    needs: pypi
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
+        with:
+          name: dist
+          path: dist/
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
+            gh release upload "$GITHUB_REF_NAME" dist/*.tar.gz dist/*.whl
+            exit 0
+          fi
+          gh release create "$GITHUB_REF_NAME" \
+            --title "$GITHUB_REF_NAME" \
+            --notes-file dist/RELEASE_NOTES.md \
+            --verify-tag \
+            dist/*.tar.gz dist/*.whl

raidlock-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+.board/
+__pycache__/
+*.pyc
+.venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+node_modules/
+test-results/