sovereign-fleet 0.6.0__tar.gz

sovereign_fleet-0.6.0/.github/FUNDING.yml

@@ -0,0 +1,2 @@
+# Sponsor button: value-for-value support on sovgrid.org
+custom: ["https://sovgrid.org/support/"]

sovereign_fleet-0.6.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,32 @@
+name: Bug Report
+description: Create a report to help us fix a bug in Sovereign Fleet
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: Thanks for reporting an issue! Please verify your environment and include actionable logs.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Describe the problem clearly.
+    validations:
+      required: true
+  - type: textarea
+    id: steps-to-reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Exact commands or configuration to reproduce the issue.
+      placeholder: |
+        1. Run `fleet ...`
+        2. Dispatch task ...
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS version, kernel (`uname -r`), Python version (`python3 --version`), and agent CLI versions.
+      render: shell
+    validations:
+      required: true

sovereign_fleet-0.6.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,21 @@
+name: Feature Request
+description: Suggest an idea or enhancement for Sovereign Fleet
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: Proposals should align with sovereign local execution, verified gates, or pluggable harnesses.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Is your feature request related to a problem?
+      description: A clear and concise description of what the problem is.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed Solution
+      description: How should Sovereign Fleet address this?
+    validations:
+      required: true

sovereign_fleet-0.6.0/.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]

sovereign_fleet-0.6.0/.github/pull_request_template.md

@@ -0,0 +1,11 @@
+## Summary
+<!-- Describe what this change accomplishes, why it is needed, and link any related issues. -->
+
+## Changes Made
+- 
+
+## Verification & Quality Checklist
+- [ ] `./scripts/verify.sh` passes locally (all tests and lint checks green).
+- [ ] No secrets, tokens, or private hostnames committed.
+- [ ] Tests added or updated for new functionality or bug fixes.
+- [ ] Documentation updated if CLI options, endpoints, or configuration changed.

sovereign_fleet-0.6.0/.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Check syntax and lint (Ruff)
+        run: |
+          python -m ruff check --select F,E9,B src tests
+
+      - name: Run test suite (pytest)
+        run: |
+          python -m pytest -q

sovereign_fleet-0.6.0/.github/workflows/contribution-check.yml

@@ -0,0 +1,111 @@
+# Checks that issues and pull requests from outside the project are complete, and says what is missing.
+#
+# No LLM and no checkout: a small script reads the issue or PR through the GitHub API, compares it with
+# the templates (.github/ISSUE_TEMPLATE/*.yml, .github/pull_request_template.md), and keeps one comment
+# up to date plus the label "needs info". It runs again when the author edits the text or pushes, so the
+# comment and the label follow. Maintainers, collaborators and bots are skipped.
+#
+# Maintainers are listed by login below on purpose: author_association is not enough, because an org
+# member with private membership shows up as CONTRIBUTOR to the workflow token.
+name: contribution-check
+
+on:
+  issues:
+    types: [opened, edited, reopened]
+  pull_request_target:  # base-branch code only; the contributed code is never checked out or run
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: contribution-check-${{ github.event.issue.number || github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    if: >-
+      (github.event.issue.user.type || github.event.pull_request.user.type) != 'Bot' &&
+      !contains(fromJSON('["cipherfoxie"]'),
+                github.event.issue.user.login || github.event.pull_request.user.login) &&
+      !contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'),
+                github.event.issue.author_association || github.event.pull_request.author_association)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const MARK = '<!-- contribution-check -->';
+            const LABEL = 'needs info';
+            const isPR = !!context.payload.pull_request;
+            const item = isPR ? context.payload.pull_request : context.payload.issue;
+            const number = item.number;
+            const body = item.body || '';
+            const labels = (item.labels || []).map((l) => l.name);
+            const missing = [];
+
+            // text under a "### Heading" (issue forms) or "## Heading" (PR template), without HTML
+            // comments, the forms' "_No response_" and empty list bullets
+            const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            const section = (title) => {
+              const re = new RegExp(`^#{2,3}\\s*${esc(title)}\\s*$([\\s\\S]*?)(?=^#{2,3}\\s|$(?![\\s\\S]))`, 'mi');
+              const m = body.match(re);
+              if (!m) return null;
+              return m[1].replace(/<!--[\s\S]*?-->/g, '').replace(/_No response_/g, '')
+                .replace(/^\s*[-*]\s*$/gm, '').trim();
+            };
+            const need = (title, hint) => { if (!section(title)) missing.push(hint || `"${title}"`); };
+
+            if (isPR) {
+              need('Summary', 'what the change does and why ("Summary")');
+              need('Changes Made', 'the list of changes ("Changes Made")');
+              const checklist = section('Verification & Quality Checklist') || '';
+              if (!/^\s*-\s*\[[xX]\]\s*`?\.\/scripts\/verify\.sh`?/m.test(checklist)) {
+                missing.push('`./scripts/verify.sh` run locally and ticked in the checklist');
+              }
+              const files = await github.paginate(github.rest.pulls.listFiles,
+                { owner: context.repo.owner, repo: context.repo.repo, pull_number: number, per_page: 100 });
+              const names = files.map((f) => f.filename);
+              const docsOnly = names.length > 0 && names.every((n) => n.startsWith('docs/') || n.endsWith('.md'));
+              if (!docsOnly && !names.includes('CHANGELOG.md')) missing.push('a line in `CHANGELOG.md` under `[Unreleased]`');
+              const code = names.filter((n) => n.startsWith('src/'));
+              if (code.length && !names.some((n) => n.startsWith('tests/'))) missing.push('a test for the change under `tests/`');
+            } else if (labels.includes('bug')) {
+              need('What happened?');
+              need('Steps to reproduce');
+              need('Environment');
+            } else if (labels.includes('enhancement')) {
+              need('Is your feature request related to a problem?');
+              need('Proposed Solution');
+            } else if (!labels.some((l) => l.startsWith('roadmap') || l === 'idea' || l === 'question')) {
+              missing.push('the bug report or feature request template (New issue, then pick one)');
+            }
+
+            const who = `@${item.user.login}`;
+            const first = ['FIRST_TIME_CONTRIBUTOR', 'FIRST_TIMER'].includes(item.author_association);
+            const thanks = first ? `Thanks for your first ${isPR ? 'pull request' : 'issue'}, ${who}!` : `Thanks, ${who}!`;
+            const text = missing.length
+              ? `${MARK}\n${thanks} To look at this, the maintainer needs:\n\n${missing.map((m) => `- ${m}`).join('\n')}\n\n` +
+                `Edit the ${isPR ? 'description or push a commit' : 'issue'} and this note updates by itself.`
+              : `${MARK}\n${thanks} Everything the template asks for is here; the maintainer will follow up.`;
+
+            const { owner, repo } = context.repo;
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number: number, per_page: 100 });
+            const mine = comments.find((c) => c.user.type === 'Bot' && c.body.startsWith(MARK));
+            if (mine) {
+              if (mine.body !== text) await github.rest.issues.updateComment({ owner, repo, comment_id: mine.id, body: text });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number: number, body: text });
+            }
+
+            if (missing.length && !labels.includes(LABEL)) {
+              try { await github.rest.issues.getLabel({ owner, repo, name: LABEL }); }
+              catch { await github.rest.issues.createLabel({ owner, repo, name: LABEL, color: 'fbca04', description: 'Waiting for details from the author' }); }
+              await github.rest.issues.addLabels({ owner, repo, issue_number: number, labels: [LABEL] });
+            } else if (!missing.length && labels.includes(LABEL)) {
+              await github.rest.issues.removeLabel({ owner, repo, issue_number: number, name: LABEL });
+            }
+            core.info(missing.length ? `missing: ${missing.join('; ')}` : 'complete');

sovereign_fleet-0.6.0/.github/workflows/guardrails.yml

@@ -0,0 +1,27 @@
+name: PR Guardrails
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+jobs:
+  guardrails:
+    name: Scope & Gate Guardrails
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Run Guardrail Checks
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+          BASE_REF: origin/${{ github.base_ref }}
+        run: |
+          python3 scripts/check_pr_guardrails.py --pr-body "$PR_BODY" --base-ref "$BASE_REF"

sovereign_fleet-0.6.0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,29 @@
+name: publish-pypi
+
+on:
+  workflow_dispatch:
+  push:
+    tags: ["v*.*.*"]
+
+jobs:
+  pypi-publish:
+    name: Build and publish to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/sovereign-fleet/
+    permissions:
+      id-token: write # Mandatory for PyPI trusted publishing (OIDC)
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Build package
+        run: uv build
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
+          # skip-existing: true ensures idempotent publishes
+          skip-existing: true

sovereign_fleet-0.6.0/.github/workflows/release.yml

@@ -0,0 +1,64 @@
+name: release
+
+# A tag v*.*.* builds the package and creates a GitHub release whose notes are
+# that version's CHANGELOG.md section. No PyPI publish yet.
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: "pip"
+      - name: install build deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install build pytest ruff
+          pip install -e ".[dev]"
+      - name: run tests
+        run: python -m pytest -q tests/test_bump_version.py
+      - name: build sdist and wheel
+        run: python -m build
+      - name: upload artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  release:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: notes from CHANGELOG.md
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          awk -v v="$v" '$0 ~ "^## \\[" v "\\]" {on=1; next} /^## \[/ {if (on) exit} on' CHANGELOG.md > notes.md
+          test -s notes.md || echo "See CHANGELOG.md" > notes.md
+      - name: download artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+      - name: create or update the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
+            gh release upload "$GITHUB_REF_NAME" dist/* --clobber
+          else
+            gh release create "$GITHUB_REF_NAME" --title "Sovereign Fleet $GITHUB_REF_NAME" --notes-file notes.md --verify-tag dist/*
+          fi
+      # TODO: publish to PyPI when ready
+      # - name: publish to PyPI
+      #   uses: pypa/gh-action-pypi-publish@release/v1
+      #   with:
+      #     password: ${{ secrets.PYPI_API_TOKEN }}

sovereign_fleet-0.6.0/.gitignore

@@ -0,0 +1,14 @@
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.pytest_cache/
+.ruff_cache/
+build/
+dist/
+*.egg-info/
+.venv/
+certs/
+*.crt
+*.key
+.fleet_test_spool/

sovereign_fleet-0.6.0/AGENTS.md

@@ -0,0 +1,28 @@
+# AGENTS.md - Agent Fleet Repository Contract
+
+> Canonical rules for all autonomous agents operating on this repository.
+
+## 1. Principles
+- **Modularity:** Core engine has zero dependencies on specific chat or UI frameworks.
+- **Plugin Architecture:** Ingestion (Input), Remotes (Control), Harnesses, and Notifications (Output) are isolated plugins.
+- **Fail-Safe Sandboxing:** Never execute untrusted agent commands outside landlock-isolated worktrees.
+- **Deterministic Gates:** Verify before claim. A task is only complete when verified by automated tests.
+
+## 2. Directory Layout
+- `src/fleet/core/`: TaskStore, Landlock sandbox, worktrees, engine, settings, roster, quota, GateGuard.
+- `src/fleet/plugins/`: Plugin interfaces and builtin implementations (Matrix, HTTP, Harnesses).
+- `src/fleet/api/`: Standalone FastAPI control plane and CLI entrypoint.
+- `tests/`: Automated unit and integration test suite.
+
+## 3. Test Standards
+- Run tests via `pytest`.
+- 100% passing tests required before committing changes.
+- Security properties have tests that exercise the real thing (`tests/test_security.py`: sandbox, token, path traversal; `tests/test_worktree.py`: git config injection). Never weaken or skip them to make a change pass.
+
+## 4. Honesty
+- README, llms.txt, dashboard texts and the health endpoint describe what the code does today. No status value is hardcoded; anything not implemented is labelled as such.
+
+## 5. Current work
+- Migration from the grid runner: `docs/MIGRATION.md`. Phases 0 to 6 (6a to 6g: local daemon executor loop, crash recovery and worktree pruning, process-group cancellation, failure autopsies and atomic receipts, cross-lane review loop, Matrix output notifications and approvals-by-reply, and per-project `backend = "local"` strangler migration via `CompositeBackend`) are complete and verified in `docs/MIGRATION.md`.
+- Review history: the maintainer's handover notes (outside this repository) and CHANGELOG.md, section "Corrected".
+- A claim is not done until a test that fails without the change passes with it.