simpleaudit-studio 0.5.2__tar.gz → 0.5.4__tar.gz

simpleaudit_studio-0.5.4/.env.dev.example

@@ -0,0 +1,90 @@
+# =============================================================================
+# SimpleAudit Studio — local development
+#
+# Copy to `.env` (manage.py loads it automatically), then:
+#
+#   uv sync --extra dev
+#   uv run manage.py setup_local              # first time: + seed data
+#   uv run manage.py dev                       # daily
+#
+# SQLite holds the app data and `dev` starts its own embedded Hatchet queue,
+# so no Docker is needed. For production use Docker Compose with `.env.example`.
+#
+# Only what the dev flow actually reads is uncommented below. Settings the dev
+# server does not use are kept as documented examples at the bottom.
+# =============================================================================
+
+# --- Django -----------------------------------------------------------------
+DJANGO_SECRET_KEY=local-dev-key-not-for-prod
+DJANGO_DEBUG=true
+DJANGO_ALLOWED_HOSTS=*
+LOG_LEVEL=DEBUG
+
+# --- Bootstrap (read by setup_local / bootstrap_platform) ----------------------
+BOOTSTRAP_USERNAME=studio
+BOOTSTRAP_EMAIL=admin@example.local
+BOOTSTRAP_PASSWORD=localdevpass123
+BOOTSTRAP_PROJECT_NAME=Default
+
+# --- Database -----------------------------------------------------------------
+# `manage.py dev` is SQLite-first by design (zero setup) and force-enables
+# SQLite; Postgres is the Compose/deployment engine (see `.env.example` +
+# docker-compose.yml).
+SIMPLEAUDIT_LOCAL_SQLITE=1
+# Where the SQLite file lives. Relative paths resolve from the repo root;
+# absolute paths are used as-is. Unset/commented = `<repo>/dev.sqlite3`.
+SIMPLEAUDIT_SQLITE_PATH=dev.sqlite3
+
+# JSON result files shown by /visualizer/. The folder is created on demand;
+# set an absolute path when results live elsewhere.
+VISUALIZER_RESULTS_DIR=./results
+
+# --- Chat (Open WebUI) ----------------------------------------------------------
+# On by default in dev; no line needed. To force it off:
+#   SIMPLEAUDIT_CHAT=off          (env)
+#   manage.py dev --disable-chat  (flag; wins over the env value)
+
+# =============================================================================
+# OPTIONAL — commented out because `manage.py dev` does not read these.
+# Un-comment only for the stated use case.
+# =============================================================================
+
+# Label for the in-process audit worker pool (default: cpu).
+# WORKER_POOL=cpu
+
+# Domain DB on a running local Postgres instead of SQLite. Requires
+# SIMPLEAUDIT_LOCAL_SQLITE=0 above (dev is SQLite-first and force-enables it)
+# plus a Postgres server on these coordinates. Niche — most people stay on
+# SQLite. The embedded Hatchet always uses its own bundled Postgres, not
+# these. (Also set SIMPLEAUDIT_MODE=dev so `manage.py mode` can resolve —
+# without the SQLite flag, mode inference has no unambiguous signal left.)
+# POSTGRES_DB=simpleaudit
+# POSTGRES_USER=simpleaudit
+# POSTGRES_PASSWORD=localdevpass123
+# POSTGRES_HOST=localhost
+# POSTGRES_PORT=5432
+
+# External Hatchet server — Compose mode only (dev starts an embedded engine).
+# HATCHET_SERVER_URL=http://localhost:8888
+# HATCHET_GRPC_URL=localhost:7077
+# HATCHET_API_KEY=
+# HATCHET_TOKEN_FILE=./hatchet-token
+# HATCHET_TLS_STRATEGY=none
+
+# Sentry error reporting — add a DSN to enable; commented out = disabled.
+# SENTRY_DSN=
+# SENTRY_ENVIRONMENT=development
+
+# --- SimpleAudit engine ---------------------------------------------------------
+# No configuration needed: the engine is a pip dependency pinned in
+# pyproject.toml. To develop against an unmerged engine revision, create a
+# gitignored simpleaudit-dependency.yaml at the project root containing ONLY:
+#     git_ref: <full-40-char-sha>
+# That value is recorded as the run's git_commit provenance. Do NOT edit
+# pyproject.toml for a dev override.
+
+# --- Model API keys (optional) ---------------------------------------------------
+# Keys can be stored on a connection in the Models page. For connections set
+# to "Environment variable", add that variable here (read when a run starts),
+# e.g.:
+# SIMULACHAT_API_KEY=sk-...

{simpleaudit_studio-0.5.2 → simpleaudit_studio-0.5.4}/.env.example

@@ -5,7 +5,7 @@
 # values already present in the real environment always win.
 #
 # This file documents the DOCKER COMPOSE deployment (the canonical one).
-# For a local (non-Docker) development setup, copy `.env.local.example` instead.
+# For a local (non-Docker) development setup, copy `.env.dev.example` instead.
 #
 # NOTE: docker-compose.yml overrides a few values per service (POSTGRES_HOST,
 # HATCHET_*) so the container-internal hostnames are used
@@ -13,6 +13,8 @@
 # =============================================================================
 
 # --- Django -----------------------------------------------------------------
+# REQUIRED: startup refuses to boot while this is empty or still `change-me`.
+# Generate one with: openssl rand -hex 32
 DJANGO_SECRET_KEY=change-me
 DJANGO_DEBUG=false
 DJANGO_ALLOWED_HOSTS=*
@@ -50,7 +52,7 @@ POSTGRES_PORT=5432
 # Docker Compose: the compose service name `hatchet-server` resolves inside the
 # compose network. HTTP API on :8888, gRPC on :7077 (see docker-compose.yml).
 # Local dev (Hatchet running on the host): use http://localhost:8888 and
-# localhost:7077 — see `.env.local.example`.
+# localhost:7077 — see `.env.dev.example`.
 HATCHET_SERVER_URL=http://hatchet-server:8888
 HATCHET_GRPC_URL=hatchet-server:7077
 # Explicit worker API token. Leave empty with the default auth-disabled
@@ -88,6 +90,37 @@ WORKER_POOL=cpu
 # skips if demo runs already exist. Set to false to opt out.
 SEED_DEMO_AUDITS=true
 
+# --- Chat (Open WebUI) ---------------------------------------------------------
+# Single-origin model: Open WebUI (the subpath fork) serves its whole app at
+# /chat/ on Studio's own origin, and Studio's wrapper page (model-picker bar +
+# iframe) lives at /ai/. Caddy is the only published port and does the
+# forward-auth (/chat/authz). Signed in as the Studio user (workspace admins
+# become Open WebUI admins). ON by default: the first line makes the web
+# container serve /ai/ + /chat/authz, the second makes `docker compose up -d`
+# start the open-webui container. To run Compose WITHOUT chat, comment both
+# out (or set SIMPLEAUDIT_CHAT=off). See docs/chat.md.
+SIMPLEAUDIT_CHAT=docker
+COMPOSE_PROFILES=chat
+# Base path the browser loads the chat from. Same origin as Studio, so a plain
+# base path is the default (leave unset). Set a FULL URL only if a deployment
+# keeps Open WebUI on its own origin (legacy cross-origin shape).
+#SIMPLEAUDIT_CHAT_URL=http://localhost:8000/chat
+# The public Studio origin (login redirect target, OTLP endpoint, ...).
+# Use your own hostname behind TLS; on a separate subdomain also set
+# SESSION_COOKIE_DOMAIN.
+SIMPLEAUDIT_STUDIO_URL=http://localhost:8000
+# Optional: export Open WebUI's spans to Studio's OTLP listener. Off by default.
+# Exports unauthenticated (matches an enabled "none" credential). For a
+# basic/bearer credential, set OTEL_BASIC_AUTH_* to match it. See docs/chat.md.
+#SIMPLEAUDIT_CHAT_OTLP=true
+#SIMPLEAUDIT_CHAT_OTLP_ENDPOINT=http://web:8000
+#OTEL_BASIC_AUTH_USERNAME=
+#OTEL_BASIC_AUTH_PASSWORD=
+# Optional: switch Studio's OTLP listener (POST /otlp/v1/traces + credential
+# management) on or off. ON by default (preserves existing behavior). Set to
+# "off" to 404 the /otlp/* and /api/otlp/* routes and hide the OTLP button.
+#SIMPLEAUDIT_OTLP=off
+
 # --- Optional observability -----------------------------------------------------
 
 # --- Sentry error tracking & tracing (leave empty to disable) -------------------

simpleaudit_studio-0.5.4/.github/agents/orchestrator.agent.md

@@ -0,0 +1,47 @@
+---
+name: Orchestrator
+description: Parallel-first coding orchestrator
+tools: ['agent', 'edit', 'read', 'search', 'execute']
+agents: ['Researcher', 'Verifier', 'Test Reviewer', 'Regression Reviewer']
+---
+
+You are the main engineering orchestrator.
+
+Default behavior:
+- Decompose non-trivial tasks into independent workstreams.
+- Run independent research/review tasks in parallel whenever possible.
+- Prefer parallel subagents over doing sequential investigation yourself.
+- Keep the main context focused on decisions and integration.
+- Do not delegate trivial tasks where coordination overhead exceeds the work.
+
+For implementation:
+1. First identify independent components.
+2. Launch parallel subagents for codebase research, dependency analysis,
+   test discovery, and alternative implementation approaches.
+3. Integrate the best findings yourself.
+4. After editing, launch independent reviewers in parallel:
+   - correctness
+   - test coverage
+   - regression risk
+   - hallucinated APIs / assumptions
+5. Run tests and inspect actual outputs.
+6. Fix issues found by reviewers.
+7. Repeat verification until there are no actionable failures.
+
+Never trust another agent's factual claim about the repository unless it
+provides file references or you verify it yourself.
+
+Prefer evidence from:
+- repository contents
+- compiler/type checker
+- test output
+- runtime output
+- official documentation
+
+If uncertain, investigate rather than guessing.
+
+Keep working autonomously until:
+- the requested result is implemented,
+- tests/checks have been run,
+- significant reviewer findings have been addressed,
+- or a genuine blocker requires user input.

simpleaudit_studio-0.5.4/.github/agents/regression-reviewer.agent.md

@@ -0,0 +1,21 @@
+---
+name: Regression Reviewer
+description: Assess regression risk of proposed changes
+user-invocable: false
+tools: ['read', 'search', 'execute']
+---
+
+Assess the regression risk of the proposed changes.
+
+Check:
+- existing behavior that depends on the changed code
+- callers and consumers that may break
+- shared state, configuration, or schema changes
+- edge cases the change may have disturbed
+
+Use repository evidence and executable checks whenever possible.
+
+Return only:
+1. confirmed regression risks
+2. evidence
+3. concrete mitigations

simpleaudit_studio-0.5.4/.github/agents/researcher.agent.md

@@ -0,0 +1,13 @@
+---
+name: Researcher
+description: Fast codebase reconnaissance
+user-invocable: false
+tools: ['read', 'search']
+---
+
+Investigate the assigned question deeply but do not edit files.
+
+Search broadly, identify relevant files and existing patterns,
+and return concise findings with exact file references.
+
+Do not speculate when repository evidence is available.

simpleaudit_studio-0.5.4/.github/agents/test-reviewer.agent.md

@@ -0,0 +1,21 @@
+---
+name: Test Reviewer
+description: Review test coverage for changed behavior
+user-invocable: false
+tools: ['read', 'search', 'execute']
+---
+
+Review the tests for the changed behavior.
+
+Check:
+- tests exist for the new or changed behavior
+- tests assert the right outcomes, not just that code runs
+- edge cases and failure paths are covered
+- the test suite actually passes when run
+
+Run the relevant tests and report actual output.
+
+Return only:
+1. confirmed gaps or failures
+2. evidence
+3. concrete fixes

simpleaudit_studio-0.5.4/.github/agents/verifier.agent.md

@@ -0,0 +1,25 @@
+---
+name: Verifier
+description: Verify implementation claims and detect hallucinations
+user-invocable: false
+tools: ['read', 'search', 'execute']
+---
+
+Independently verify the proposed solution.
+
+Do not assume another agent's claims are correct.
+
+Check:
+- referenced files and symbols actually exist
+- APIs and function signatures are real
+- dependencies actually expose the claimed features
+- tests exercise the changed behavior
+- implementation matches the original request
+- no placeholder or speculative code remains
+
+Use repository evidence and executable checks whenever possible.
+
+Return only:
+1. confirmed problems
+2. evidence
+3. concrete fixes

simpleaudit_studio-0.5.4/.github/prompts/parallel-orchestrate.prompt.md

@@ -0,0 +1,21 @@
+---
+name: parallel-orchestrate
+description: Parallel-first orchestration convention for substantial tasks
+---
+
+Use parallel subagents aggressively for independent work. Optimize for
+wall-clock time, not token count. Treat model calls as cheap. Keep yourself
+as the coordinator and integrator. Verify claims with repository evidence
+and executable checks before concluding.
+
+For every substantial task:
+1. Launch 2-3 Researcher subagents in parallel for independent angles
+   (simplest implementation, architecture-compatible implementation,
+   hidden risks).
+2. Integrate the best findings and implement.
+3. Launch Verifier, Test Reviewer, and Regression Reviewer in parallel.
+4. Fix confirmed findings and re-verify until there are no actionable
+   failures.
+
+Keep the delegation tree wide, not deep: orchestrator -> workers/reviewers.
+Do not nest subagents more than one level.

{simpleaudit_studio-0.5.2 → simpleaudit_studio-0.5.4}/.github/workflows/ci.yml

@@ -32,13 +32,20 @@ jobs:
         run: uv sync --frozen --extra dev
       - name: Lint (ruff)
         run: uv run ruff check .
-      - name: Run tests (parallel)
-        run: uv run python manage.py test infra --parallel auto --exclude-tag embedded_hatchet
+      - name: Cache testmon dependency data
+        uses: actions/cache@v4
+        with:
+          path: .testmondata
+          key: testmon-${{ github.sha }}
+          restore-keys: |
+            testmon-
+      - name: Run tests (parallel, affected-only via testmon)
+        run: uv run pytest --testmon -n auto -m "not embedded_hatchet"
       - name: Check if embedded Hatchet files changed
         id: hatchet-changed
         run: |
           CHANGED=$(git diff --name-only origin/main...HEAD -- infra/minimal_config.py infra/worker.py 2>/dev/null || true)
-          if [ -n "$CHANGED" ]; then echo "changed=true" >> "$GITHUB_OUTPUT"; else echo "changed=false" >> "$GITHUB_OUTPUT"; fi
+          if [ -n "$CHANGED"]; then echo "changed=true" >> "$GITHUB_OUTPUT"; else echo "changed=false" >> "$GITHUB_OUTPUT"; fi
       - name: Run tests (embedded Hatchet, serial)
         if: steps.hatchet-changed.outputs.changed == 'true'
-        run: uv run python manage.py test infra.tests.test_minimal_config.TestEmbeddedHatchetLifecycle
+        run: uv run pytest -m "embedded_hatchet"

{simpleaudit_studio-0.5.2 → simpleaudit_studio-0.5.4}/.gitignore

@@ -44,3 +44,4 @@ app.pid
 
 # Data artifacts (prototype)
 data/
+.testmondata*

simpleaudit_studio-0.5.4/AGENTS.md

@@ -0,0 +1,109 @@
+# AGENTS.md
+
+SimpleAudit Studio — an audit platform for LLM systems. It wraps the external
+SimpleAudit engine (Target → Auditor → Judge runs over versioned scenario sets)
+with a Django web UI, a durable worker, and an optional Open WebUI chat module.
+
+## Stack
+
+- Python ≥3.11 (CI runs 3.12), Django 5.2, DRF + drf-spectacular
+- PostgreSQL (canonical), SQLite (local dev + embedded mode)
+- Hatchet durable job queue (embedded engine for single-process modes)
+- uv for dependency management (see `uv.lock`)
+- ruff (line length 88), pytest + pytest-django
+
+## Run modes (read `config/runtime.py` before touching mode logic)
+
+| mode | command | db | queue |
+|---|---|---|---|
+| dev | `manage.py dev` | SQLite (repo root, `dev.sqlite3`) | embedded |
+| embedded | `spin` / `uvx simpleaudit-studio` | SQLite (`~/.simpleaudit-studio/`) | embedded |
+| compose | `docker compose up -d` | Postgres | external Hatchet |
+| single-docker | `docker run <image>` (HF Space) | SQLite (`/data`) | embedded |
+
+Mode selection is env-flag driven and happens in `manage.py` / `simpleaudit_studio/cli.py`
+**before** `django.setup()`. `config/runtime.py::resolve_mode()` is the single lens over
+those flags; `config/settings.py` selects the DB engine from the same flags. Entry points
+force flags (e.g. dev forces `SIMPLEAUDIT_LOCAL_SQLITE=1`) — don't fight that in `.env`.
+
+## Development
+
+```bash
+cp .env.dev.example .env
+uv sync --extra dev
+uv run manage.py setup_local   # migrate + bootstrap admin + seed (idempotent)
+uv run manage.py dev           # web + worker + embedded queue + chat
+```
+
+Login `studio` / `localdevpass123` (from `.env`). Migrations: `uv run manage.py makemigrations`.
+
+## Tests
+
+```bash
+uv run pytest -m "not embedded_hatchet"          # full suite (parallel in CI via -n auto --testmon)
+uv run pytest path/to/test_file.py -k "name"     # affected tests first
+uv run pytest -m "embedded_hatchet"              # only if infra/worker.py or infra/minimal_config.py changed; serial only
+uv run ruff check .
+```
+
+The suite runs on SQLite (`pytest.ini` sets the env). `@tag("slow")` and `@tag("embedded_hatchet")`
+are mirrored to pytest markers by `conftest.py`. `e2e/test_ui.py` is a standalone Playwright
+script, not collected by pytest.
+
+## Repository layout
+
+- `accounts/` — users, projects, auth (Django is the only authority on identity)
+- `scenarios/`, `model_registry/`, `judges/`, `audits/` — domain apps; each keeps business
+  logic in its `services.py`; models live in `<app>/models.py`, migrations in `<app>/migrations/`
+- `infra/` — platform plumbing: `worker.py` (Hatchet tasks), `engine.py` (engine bridge),
+  `tracing.py` (OTLP/Tempo/studio trace acquisition), `ui.py` (web views), `startup_checks.py`,
+  `seed.py`; `infra/management/commands/` holds the run modes
+- `chat/` — optional Open WebUI module; inert unless `SIMPLEAUDIT_CHAT` is set (`chat/config.py`)
+- `simpleaudit_studio/` — the `spin` CLI entry point (`uvx` mode)
+- `docs/` — `architecture.md`, `domain-model.md`, `deployment.md`, `chat.md`; link to these,
+  don't duplicate them
+
+## Hard boundaries (things that break subtly if violated)
+
+- `infra/engine.py` is the **only** file that imports the `simpleaudit` engine, and it imports
+  lazily inside functions. Never import the engine at module level elsewhere.
+- The **web/API process never executes model calls** — only the worker (`infra/worker.py`).
+  Audit progress is durable `AuditEvent` rows; SSE replays from them. Cancellation is a
+  durable flag, not process memory.
+- Scenarios execute from the **frozen endpoint snapshots** on the AuditRun, never from live
+  registry rows. Do not "fix" a run by reading current model/agent configuration.
+- Model secrets are stored as `secret_reference` identifiers and resolved from the environment
+  at execution time. Raw credentials are never persisted.
+- `infra/simpleaudit_package.py` resolves engine provenance from installed package metadata.
+  Never hardcode engine versions/commits; to develop against an unmerged engine revision use the
+  gitignored `simpleaudit-dependency.yaml` (`git_ref:`), not a `pyproject.toml` edit.
+- Chat SSO is forward-auth: a proxy calls `GET /chat/authz` and injects `X-Studio-*` headers.
+  Do not make anything read Django sessions/user tables outside Django.
+- `config/settings.py` DB engine selection and `manage.py`/CLI flag pre-setting are load-order
+  sensitive. Keep mode decisions before `django.setup()`.
+
+## Coding conventions
+
+- Thin views; business logic in the owning app's `services.py` (search for an existing helper
+  before writing a new one).
+- Type hints on new public functions; keep functions focused.
+- Multi-row related writes: wrap in a transaction. Avoid N+1 (`select_related`/`prefetch_related`).
+- Migrations: create per app, inspect the generated file, never edit already-applied migrations.
+  Consider existing production (Postgres) data; avoid destructive changes.
+- `RUF012` is intentionally ignored (Django Meta / factory-boy idioms) — don't "fix" those.
+
+## Configuration files
+
+- `.env.dev.example` → local dev only (`.env.example` → compose; the root `Dockerfile` bakes its
+  own `ENV` for HF/single-container). `manage.py` auto-loads `.env`; real environment wins.
+- `SIMPLEAUDIT_SQLITE_PATH` (dev-mode only) overrides the SQLite file location.
+- Updating a setting means updating the relevant `.env*.example` **and** `docs/deployment.md`'s
+  settings table.
+
+## Definition of done
+
+- Affected tests pass, then `uv run pytest -m "not embedded_hatchet"` and `uv run ruff check .`
+- Migrations created/inspected if models changed
+- Docs/env examples updated if configuration or externally visible behavior changed
+- No unrelated reformatting or cleanup in the diff
+- Summarize: what changed, design decisions, checks run, anything unresolved

{simpleaudit_studio-0.5.2 → simpleaudit_studio-0.5.4}/Dockerfile

@@ -1,14 +1,18 @@
 # =============================================================================
-# SimpleAudit Studio — Minimal Config (Hugging Face Space + local docker run)
+# SimpleAudit Studio — single-container image (local `docker run` + HF Space)
 #
 # Single-process image: Django web + embedded Hatchet + worker in one Python
 # process. No Postgres, no supervisord, no external services. SQLite for the
 # domain DB, embedded Postgres (sidecar binary) for Hatchet's queue.
 #
-# HF Spaces only build the root Dockerfile (no compose), so this IS the Space.
+# The container listens on 7860 (Hugging Face Spaces expect that port).
 #
 # Build:  docker build -t simpleaudit-studio .
-# Run:    docker run -p 7860:7860 simpleaudit-studio
+# Run:    docker run -d -p 8000:7860 -v sa-data:/data --name simpleaudit-studio simpleaudit-studio
+#         (web → http://localhost:8000, login studio / admin123 — override with
+#          -e BOOTSTRAP_PASSWORD=<strong> for anything shared)
+# All data (SQLite database, embedded queue, chat) lives in /data: mount a
+# named volume there to keep it across restarts and image updates.
 # =============================================================================
 
 FROM python:3.12-slim AS base
@@ -25,23 +29,30 @@ WORKDIR /app
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
+        git \
     && rm -rf /var/lib/apt/lists/*
 
 # --- Python dependencies -----------------------------------------------------
 # pyproject.toml is the single source of truth; uv.lock pins exact versions.
 # uv sync creates /app/.venv; the PATH update keeps the `python` entrypoint.
+# The core (simpleaudit) is a PyPI dependency; uv sync pulls it from the
+# registry (no local checkout needed).
 COPY pyproject.toml uv.lock README.md ./
 RUN pip install uv \
     && uv sync --frozen --no-install-project --no-dev
 ENV PATH="/app/.venv/bin:$PATH"
 
-# --- Environment defaults for the Space --------------------------------------
-# SIMPLEAUDIT_MINIMAL=1 enables the minimal config path (SQLite + embedded Hatchet).
-# Override via HF Space Secrets for anything sensitive.
-# Must be set BEFORE collectstatic: Django settings select the DB engine from it,
-# and the postgres driver is an optional extra not installed in this image.
+# --- Environment defaults -----------------------------------------------------
+# SIMPLEAUDIT_MINIMAL=1 enables the single-process path (SQLite + embedded
+# Hatchet); SIMPLEAUDIT_DATA_DIR points everything (database, embedded queue,
+# chat) at /data so a mounted volume persists it. PORT=7860 is what Hugging
+# Face Spaces expect. Override via `docker run -e ...` or HF Space environment
+# variables for anything sensitive.
+# Must be set BEFORE collectstatic: Django settings select the DB engine from
+# it, and the postgres driver is an optional extra not installed in this image.
 ENV SIMPLEAUDIT_MINIMAL=1 \
     PORT=7860 \
+    SIMPLEAUDIT_DATA_DIR=/data \
     DJANGO_SECRET_KEY=hf-space-demo-secret-key-change-in-production \
     DJANGO_DEBUG=false \
     DJANGO_ALLOWED_HOSTS=* \
@@ -60,9 +71,11 @@ COPY . .
 RUN python manage.py collectstatic --noinput
 
 # --- Non-root user ------------------------------------------------------------
+# /data is where a mounted named volume persists all app data; it must exist
+# and be writable by appuser before the user switch.
 RUN useradd --create-home appuser \
-    && mkdir -p /app/staticfiles \
-    && chown -R appuser:appuser /app
+    && mkdir -p /app/staticfiles /data \
+    && chown -R appuser:appuser /app /data
 USER appuser
 
 EXPOSE 7860

simpleaudit_studio-0.5.4/PKG-INFO

@@ -0,0 +1,102 @@
+Metadata-Version: 2.5
+Name: simpleaudit-studio
+Version: 0.5.4
+Summary: Production AI model audit platform — one-liner demo mode via uvx
+License: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Requires-Dist: caddyserver>=2.11.7
+Requires-Dist: cronsim==2.7
+Requires-Dist: django==5.2.4
+Requires-Dist: djangorestframework==3.16.0
+Requires-Dist: drf-spectacular==0.28.0
+Requires-Dist: hatchet-sdk==1.41.0
+Requires-Dist: httpx>=0.27
+Requires-Dist: opentelemetry-proto>=1.45.0
+Requires-Dist: psutil>=7.2.2
+Requires-Dist: pydantic<3,>=2.7
+Requires-Dist: python-dotenv==1.1.1
+Requires-Dist: requests==2.32.5
+Requires-Dist: sentry-sdk[django]>=2.0
+Requires-Dist: simpleaudit==0.3.1
+Requires-Dist: workos==10.4.0
+Provides-Extra: dev
+Requires-Dist: factory-boy==3.3.2; extra == 'dev'
+Requires-Dist: pytest-django<5,>=4.8; extra == 'dev'
+Requires-Dist: pytest-env<2,>=1; extra == 'dev'
+Requires-Dist: pytest-testmon<3,>=2; extra == 'dev'
+Requires-Dist: pytest-xdist<3.8,>=3.6; extra == 'dev'
+Requires-Dist: pytest<9,>=8; extra == 'dev'
+Requires-Dist: ruff; extra == 'dev'
+Provides-Extra: e2e
+Requires-Dist: playwright>=1.45; extra == 'e2e'
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary]==3.2.13; extra == 'postgres'
+Provides-Extra: server
+Requires-Dist: gunicorn==23.0.0; extra == 'server'
+Description-Content-Type: text/markdown
+
+---
+title: SimpleAudit Studio
+emoji: 🔍
+colorFrom: blue
+colorTo: indigo
+sdk: docker
+app_port: 7860
+pinned: false
+---
+
+# SimpleAudit Studio
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![Python](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
+[![PyPI](https://img.shields.io/pypi/v/simpleaudit-studio)](https://pypi.org/project/simpleaudit-studio/)
+
+A self-hostable platform for reproducible AI model audits using the [SimpleAudit](https://github.com/SimulaMet/simpleaudit) engine.
+
+## Quick run
+
+Needs [uv](https://docs.astral.sh/uv/):
+
+```bash
+uvx simpleaudit-studio@latest
+```
+
+To run the latest code from GitHub instead of the published package:
+
+```bash
+uvx --from "git+https://github.com/SimulaMet/SimpleAuditStudio@main" spin
+```
+
+Open <http://localhost:8000>. Try the [live demo](https://sushantgautam-simpleaudit-studio.hf.space) if you do not want to install anything.
+
+## Development
+
+```bash
+git clone https://github.com/SimulaMet/SimpleAuditStudio
+cd SimpleAuditStudio
+cp .env.dev.example .env
+uv sync --extra dev
+uv run manage.py setup_local
+uv run manage.py dev
+```
+
+The app opens at <http://localhost:8000> with live reload. Use `--no-browser` to skip opening a browser.
+
+## What it does
+
+- Build versioned scenario sets and register OpenAI-compatible models.
+- Define judges and run audits across models, scenarios, and settings.
+- Review runs live and compare results in the dashboard.
+- Monitor models for drift on a schedule.
+
+## Documentation
+
+- [Deployment](docs/deployment.md) — all run commands, settings, chat, upgrades, backups, and production notes
+- [Chat](docs/chat.md) — chat setup and privacy details
+- [Architecture](docs/architecture.md) — system design and service boundaries
+- [Domain model](docs/domain-model.md) — core data and invariants
+
+## Contributing
+
+Architecture decisions are documented in [docs/architecture.md](docs/architecture.md).