simpleaudit-studio 0.1.0__tar.gz

simpleaudit_studio-0.1.0/.dockerignore

@@ -0,0 +1,12 @@
+.git
+.env
+.venv
+__pycache__/
+*.pyc
+data/
+staticfiles/
+media/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+# sync 1790239341

simpleaudit_studio-0.1.0/.env.example

@@ -0,0 +1,117 @@
+# =============================================================================
+# SimpleAudit Platform — environment configuration
+#
+# Copy to `.env` and edit. `manage.py` loads `.env` automatically (python-dotenv);
+# values already present in the real environment always win.
+#
+# This file documents the DOCKER COMPOSE deployment (the canonical one).
+# For a local (non-Docker) development setup, copy `.env.local.example` instead.
+#
+# NOTE: docker-compose.yml overrides a few values per service (POSTGRES_HOST,
+# HATCHET_*, MINIO_ENDPOINT) so the container-internal hostnames are used
+# regardless of what is written here.
+# =============================================================================
+
+# --- Django -----------------------------------------------------------------
+DJANGO_SECRET_KEY=change-me
+DJANGO_DEBUG=false
+DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
+LOG_LEVEL=INFO
+
+# --- Bootstrap (idempotent; run automatically by the web container) ----------
+BOOTSTRAP_ADMIN_USERNAME=admin
+BOOTSTRAP_ADMIN_EMAIL=admin@example.local
+BOOTSTRAP_ADMIN_PASSWORD=change-me
+BOOTSTRAP_PROJECT_NAME=Default
+
+# --- First-run seed (idempotent; run automatically by the web container) -----
+# Imports the built-in SimpleAudit scenario packs (safety, rag, health,
+# system_prompt) and creates default model connections (OpenAI) into the
+# default project. Safe on every start: existing data is skipped.
+# Set to false to opt out (e.g. hardened deployments that seed manually).
+SEED_ON_BOOT=true
+
+# --- Demo mode (prefill login form with credentials for public demos) --------
+# Set to true on HF Spaces or public demo deployments. Leave false in production.
+DEMO_MODE=false
+DEMO_USERNAME=admin
+DEMO_PASSWORD=change-me
+
+# --- PostgreSQL ---------------------------------------------------------------
+# In Docker Compose the web/worker containers reach Postgres at host `postgres`
+# (compose service name). For a local dev setup use `localhost` instead.
+POSTGRES_DB=simpleaudit
+POSTGRES_USER=simpleaudit
+POSTGRES_PASSWORD=change-me
+POSTGRES_HOST=postgres
+POSTGRES_PORT=5432
+
+# --- MinIO / S3-compatible object storage (OFF by default) --------------------
+# Enable with: docker compose --profile storage up -d
+# Then uncomment and set real credentials:
+# MINIO_ENDPOINT=http://minio:9000
+# MINIO_ACCESS_KEY=change-me
+# MINIO_SECRET_KEY=change-me
+# MINIO_BUCKET=simpleaudit-artifacts
+
+# --- Durable workflow system (Hatchet) ----------------------------------------
+# Docker Compose: the compose service name `hatchet-server` resolves inside the
+# compose network. HTTP API on :8888, gRPC on :7077 (see docker-compose.yml).
+# Local dev (Hatchet running on the host): use http://localhost:8888 and
+# localhost:7077 — see `.env.local.example`.
+HATCHET_SERVER_URL=http://hatchet-server:8888
+HATCHET_GRPC_URL=hatchet-server:7077
+# Explicit worker API token. Leave empty with the default auth-disabled
+# hatchet-lite-dev image (the token file below is used instead). Set this for
+# the auth-enabled hatchet-lite image.
+HATCHET_API_KEY=
+# The auth-disabled dev image writes its fixed worker JWT to this file on its
+# config volume; compose mounts that volume read-only into web + worker.
+# For a local (non-Docker) Hatchet, point this at the file on your host.
+HATCHET_TOKEN_FILE=/config/authdisabled-token
+# gRPC transport security: "none" for the compose plaintext endpoint,
+# "tls"/"mtls" for hardened deployments (certs via HATCHET_CLIENT_TLS_*).
+HATCHET_TLS_STRATEGY=none
+# Worker pool label: cpu (default) or gpu.
+WORKER_POOL=cpu
+
+# --- Operational limits --------------------------------------------------------
+MAX_CONCURRENT_AUDITS=2
+MAX_SCENARIOS_PER_RUN=500
+SSE_MAX_CONNECTIONS_PER_USER=10
+
+# --- SimpleAudit engine ---------------------------------------------------------
+# No configuration needed here. The engine is a normal pip dependency pinned in
+# requirements.txt; its version + optional git commit are read from the installed
+# package metadata automatically (infra/simpleaudit_package.py). To develop
+# against an unmerged revision, create a gitignored simpleaudit-dependency.yaml
+# at the project root with a single `git_ref:` key — do NOT edit requirements.txt.
+
+# --- Model API credentials (resolved at execution time, never stored) ----------
+# Add one variable per model endpoint's `secret_reference`, e.g.:
+# SIMULACHAT_API_KEY=sk-...
+
+# --- Demo audit seeding ---------------------------------------------------------
+# When true, the boot sequence loads pre-recorded audit results from
+# infra/fixtures/demo_audit_results.json to populate the dashboard.
+# No API key needed — results are captured at build time. Idempotent:
+# skips if demo runs already exist. Set to false to opt out.
+SEED_DEMO_AUDITS=true
+
+# --- Optional observability -----------------------------------------------------
+OTEL_EXPORTER_OTLP_ENDPOINT=
+LANGFUSE_PUBLIC_KEY=
+LANGFUSE_SECRET_KEY=
+LANGFUSE_HOST=
+
+# --- Sentry error tracking & tracing (leave empty to disable) -------------------
+SENTRY_DSN=
+SENTRY_ENVIRONMENT=development
+
+# --- WorkOS AuthKit (passwordless email verification + SSO) ---------------------
+# Leave both empty to disable the "Continue with email (WorkOS)" button.
+# WORKOS_CLIENT_ID is public; WORKOS_API_KEY is server-side secret (keep out of git).
+WORKOS_CLIENT_ID=
+WORKOS_API_KEY=
+# Public base URL used to build the OAuth redirect URI, e.g. http://localhost:8000
+APP_BASE_URL=http://localhost:8000

simpleaudit_studio-0.1.0/.env.local.example

@@ -0,0 +1,92 @@
+# =============================================================================
+# SimpleAudit Platform — LOCAL (non-Docker) development environment
+#
+# Copy to `.env` and edit. `manage.py` loads `.env` automatically.
+#
+# This setup runs the web server and worker as plain processes on your machine
+# (SQLite for the domain DB, Hatchet + Postgres via Docker for the queue).
+# It is for development only — the canonical deployment is Docker Compose
+# (see `.env.example`).
+#
+# Prerequisites:
+#   1. A Python 3.12+ virtualenv with `pip install -r requirements.txt`
+#   2. Docker, for Postgres + Hatchet (the "partial Docker" pattern below)
+#   3. A SimpleAudit engine checkout (for the worker to execute audits)
+# =============================================================================
+
+# --- Django -----------------------------------------------------------------
+DJANGO_SECRET_KEY=local-dev-key-not-for-prod
+DJANGO_DEBUG=true
+DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
+LOG_LEVEL=DEBUG
+
+# --- Bootstrap ----------------------------------------------------------------
+# `python manage.py bootstrap_platform` reads these on first run (idempotent).
+BOOTSTRAP_ADMIN_USERNAME=admin
+BOOTSTRAP_ADMIN_EMAIL=admin@example.local
+BOOTSTRAP_ADMIN_PASSWORD=localdevpass123
+BOOTSTRAP_PROJECT_NAME=Default
+
+# --- Database -----------------------------------------------------------------
+# LOCAL-ONLY: use SQLite so no Postgres is needed for the domain tables.
+# (The test suite also uses this flag; production always uses Postgres.)
+SIMPLEAUDIT_LOCAL_SQLITE=1
+# These are ignored while SIMPLEAUDIT_LOCAL_SQLITE=1, but keep them correct
+# for the Hatchet Postgres (see below) and for switching back to Postgres.
+POSTGRES_DB=simpleaudit
+POSTGRES_USER=simpleaudit
+POSTGRES_PASSWORD=localdevpass123
+POSTGRES_HOST=localhost
+POSTGRES_PORT=5432
+
+# --- Hatchet (durable job queue) ----------------------------------------------
+# Run Postgres + Hatchet via Docker ("partial Docker" pattern):
+#
+#   docker compose up -d postgres hatchet-server
+#
+# That gives you:
+#   - Postgres on localhost:5432 (Hatchet's own queue DB, created by
+#     deploy/postgres-init.sql on first init)
+#   - Hatchet HTTP API on localhost:8888 (dashboard at http://localhost:8888)
+#   - Hatchet gRPC on localhost:7077
+#
+# The auth-disabled hatchet-lite-dev image writes its worker JWT to its config
+# volume. To use it from a local (non-container) worker, copy the token out:
+#
+#   docker compose cp hatchet-server:/config/authdisabled-token ./hatchet-token
+#
+# and point HATCHET_TOKEN_FILE at it (below). Alternatively set HATCHET_API_KEY
+# directly to the token's contents.
+HATCHET_SERVER_URL=http://localhost:8888
+HATCHET_GRPC_URL=localhost:7077
+HATCHET_API_KEY=
+HATCHET_TOKEN_FILE=./hatchet-token
+HATCHET_TLS_STRATEGY=none
+WORKER_POOL=cpu
+
+# --- SimpleAudit engine ---------------------------------------------------------
+# No configuration needed here. The engine is a normal pip dependency pinned in
+# requirements.txt; its version + optional git commit are read from the installed
+# package metadata automatically (infra/simpleaudit_package.py).
+#
+# To develop against an unmerged engine revision, create a gitignored
+# simpleaudit-dependency.yaml at the project root containing ONLY:
+#     git_ref: <full-40-char-sha>
+# That value is recorded as the run's git_commit provenance. Do NOT edit
+# requirements.txt for a dev override.
+
+# --- Model API credentials (resolved at execution time, never stored) ----------
+# Add one variable per model endpoint's `secret_reference`, e.g.:
+# SIMULACHAT_API_KEY=sk-...
+
+# --- Optional (leave empty to disable) ------------------------------------------
+MINIO_ENDPOINT=
+MINIO_ACCESS_KEY=
+MINIO_SECRET_KEY=
+MINIO_BUCKET=simpleaudit-artifacts
+OTEL_EXPORTER_OTLP_ENDPOINT=
+LANGFUSE_PUBLIC_KEY=
+LANGFUSE_SECRET_KEY=
+LANGFUSE_HOST=
+SENTRY_DSN=
+SENTRY_ENVIRONMENT=development

simpleaudit_studio-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  foundation:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16.4-alpine
+        env:
+          POSTGRES_DB: simpleaudit_test
+          POSTGRES_USER: simpleaudit
+          POSTGRES_PASSWORD: simpleaudit
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U simpleaudit -d simpleaudit_test"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 20
+    env:
+      DJANGO_SETTINGS_MODULE: config.settings
+      DJANGO_SECRET_KEY: ci-secret-key
+      DJANGO_DEBUG: "false"
+      DJANGO_ALLOWED_HOSTS: localhost,127.0.0.1
+      POSTGRES_DB: simpleaudit_test
+      POSTGRES_USER: simpleaudit
+      POSTGRES_PASSWORD: simpleaudit
+      POSTGRES_HOST: localhost
+      POSTGRES_PORT: "5432"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+      - name: Django checks
+        run: python manage.py check
+      - name: Migrations from empty database
+        run: python manage.py migrate
+      - name: Run tests
+        run: python manage.py test infra

simpleaudit_studio-0.1.0/.github/workflows/docker-image.yml

@@ -0,0 +1,62 @@
+name: Docker Image
+
+# Builds the SimpleAudit Studio image from the pushed commit and pushes it to
+# GHCR. Deployment hosts then run `docker compose pull && docker compose up -d`
+# with no local clone of this repository (see docs/deployment.md).
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      # No actions/checkout needed: BuildKit fetches the source directly from
+      # the git context, so the runner never clones the repo either.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags + labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix=sha-
+            event=push,value=latest
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: https://github.com/${{ github.repository }}.git#${{ github.sha }}
+          # The compose-stack application image (web + worker only). The root
+          # Dockerfile is the single-container HF Space image and must NOT be
+          # published here — deployment hosts run docker-compose, which builds
+          # this image from deploy/compose/Dockerfile.
+          file: deploy/compose/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

simpleaudit_studio-0.1.0/.gitignore

@@ -0,0 +1,41 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+
+# Django
+db.sqlite3
+*.sqlite3
+media/
+staticfiles/
+
+# Environment
+.env
+.env.local
+
+# Dev-only SimpleAudit engine override (git_ref). Never committed — production
+# relies on the requirements.txt pin. See infra/simpleaudit_package.py.
+simpleaudit-dependency.yaml
+
+# IDE
+.vscode/
+.idea/
+*.swp
+.DS_Store
+
+# Test/coverage
+.coverage
+htmlcov/
+.pytest_cache/
+
+# Docker volumes (local)
+docker-data/
+
+# Logs
+*.log
+logs/
+
+# Data artifacts (prototype)
+data/