tetrabench 0.1.0__tar.gz

tetrabench-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,118 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  UV_PYTHON: "3.12"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Python 3.12
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.11.21"
+          enable-cache: true
+
+      - name: Check lockfile
+        run: uv lock --check
+
+      - name: Validate workflow syntax and shell commands
+        run: >-
+          docker run --rm
+          --volume "$PWD:/repo:ro"
+          --workdir /repo
+          rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+          .github/workflows/ci.yml .github/workflows/release.yml
+        # rhysd/actionlint:1.7.12
+
+      - name: Install locked dependencies
+        run: uv sync --locked --all-groups
+
+      - name: Lint
+        run: uv run ruff check .
+
+      - name: Check formatting
+        run: uv run ruff format --check .
+
+      - name: Type-check
+        run: uv run ty check
+
+      - name: Scan production source
+        run: uv run bandit --quiet --recursive src tools
+
+      - name: Check Docker daemon
+        run: docker info
+
+      - name: Run required Docker tests
+        run: TETRABENCH_EXPECT_DOCKER_TESTS=11 uv run pytest --strict-markers -m docker
+
+      - name: Run non-Docker test suite
+        run: uv run pytest --strict-markers -m "not docker"
+
+      - name: Build wheel and source distribution
+        run: uv build
+
+      - name: Validate distribution metadata and README rendering
+        run: uv run --locked twine check --strict dist/*.whl dist/*.tar.gz
+
+      - name: Smoke-test isolated wheel, Docker, and offline Modal graph
+        run: >-
+          uv run python tools/distribution_smoke.py
+          --wheel dist/tetrabench-*.whl
+          --sdist dist/tetrabench-*.tar.gz
+          --work-dir "${{ runner.temp }}/tetrabench-wheel-smoke"
+          --category release-smoke --docker
+
+      - name: Audit all locked dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          requirements="$(mktemp)"
+          trap 'rm -f "$requirements"' EXIT
+          uv export --quiet --locked --all-groups --no-emit-project > "$requirements"
+          uv run pip-audit --strict --require-hashes --disable-pip -r "$requirements"
+
+  secrets:
+    name: Full-history secret scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out full history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Scan with Gitleaks
+        run: >-
+          docker run --rm
+          --volume "$PWD:/repo:ro"
+          --workdir /repo
+          ghcr.io/gitleaks/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f
+          detect --source=/repo --redact --verbose --no-banner
+        # ghcr.io/gitleaks/gitleaks:v8.30.1

tetrabench-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,82 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
+jobs:
+  checks:
+    if: ${{ !github.event.release.prerelease && !github.event.release.draft }}
+    uses: ./.github/workflows/ci.yml
+
+  build:
+    needs: checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check out released commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.11.21"
+          enable-cache: false
+      - name: Build distributions
+        run: |
+          uv lock --check
+          uv build --python 3.12
+          uv run --python 3.12 --locked twine check --strict dist/*.whl dist/*.tar.gz
+      - name: Verify release version and test exact wheel
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: >-
+          uv run --python 3.12 --locked python tools/distribution_smoke.py
+          --wheel dist/tetrabench-*.whl
+          --sdist dist/tetrabench-*.tar.gz
+          --work-dir "${{ runner.temp }}/tetrabench-release-smoke"
+          --tag "$RELEASE_TAG" --category release-smoke --docker
+      - name: Seal tested artifact checksums
+        run: sha256sum dist/*.whl dist/*.tar.gz > SHA256SUMS
+      - name: Retain tested release artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-dist
+          path: |
+            dist/*.whl
+            dist/*.tar.gz
+            SHA256SUMS
+          if-no-files-found: error
+          retention-days: 90
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/project/tetrabench/
+    permissions:
+      id-token: write
+    steps:
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.11.21"
+          enable-cache: false
+      - name: Download tested artifacts without checking out source
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-dist
+      - name: Verify and publish unchanged distributions through OIDC
+        run: |
+          sha256sum --check --strict SHA256SUMS
+          uv publish --trusted-publishing always dist/*.whl dist/*.tar.gz

tetrabench-0.1.0/.gitignore

@@ -0,0 +1,13 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv
+
+# Local agent and operator notes
+tmp/

tetrabench-0.1.0/.gitleaksignore

@@ -0,0 +1,2 @@
+46837cd5ccf076d488867bd1236ad3b6abedeb79:IMPLEMENTATION_PLAN.md:generic-api-key:315
+e66496e8e832ae4bee372326d00e4f9e39237b69:NOTES.md:generic-api-key:1476

tetrabench-0.1.0/.python-version

@@ -0,0 +1 @@
+3.12

tetrabench-0.1.0/AGENTS.md

@@ -0,0 +1,51 @@
+# Tetrabench Agent Contract
+
+## Session Start
+
+At the start of every session, read these files in order:
+
+1. the applicable global `AGENTS.md`;
+2. [README.md](README.md);
+3. [IMPLEMENTATION_PLAN.md](IMPLEMENTATION_PLAN.md);
+4. [NOTES.md](NOTES.md).
+
+Read questionnaire-meme.png.
+
+Inspect the repository state before editing. Apply the global Systems Design gate to pinned interfaces, lifecycle boundaries, canonical state, distributed mutation, destructive actions, and other high-blast-radius work.
+
+## Planning Record
+
+[IMPLEMENTATION_PLAN.md](IMPLEMENTATION_PLAN.md) is the canonical scope, decision, progress, and evidence record.
+
+- Update its current state, checklists, evidence, and blockers periodically during work and before every session ends.
+- Preserve completed and superseded information. Mark it completed or superseded instead of deleting it.
+- Keep stable IDs stable. Add new IDs rather than renumbering old ones.
+- Do not mark implementation complete without the stated acceptance evidence.
+- Surface correctness-critical unknowns as `unproven`.
+
+## Notes
+
+[NOTES.md](NOTES.md) is append-only.
+
+- Add dated, timestamped, and provenanced entries. Each entry is append-only immediately after creation.
+- Correct an entry by appending a correction; never rewrite history.
+- Promote durable decisions into the plan while retaining the originating note.
+- Separate user-provided contracts, primary-source research, observations, and inference.
+
+## User Documentation
+
+[README.md](README.md) contains only verified user-facing behavior. Do not document planned commands, APIs, or capabilities as working. Keep design detail, progress, and unresolved evidence in the plan.
+
+Edit existing human-facing documentation in place. Preserve its facts, intent, voice, structure, links, and caveats, and inspect the old/new diff for loss. Rewrite only when requested or structurally necessary.
+
+## Change Discipline
+
+- Once the user authorizes an eval or calibration budget, continue paid attempts within each invocation's implemented cap without asking again. Stop only on success or when another recorded safety boundary blocks execution.
+- Prefer native Harbor, Modal, S3, and Docker mechanisms over custom control planes.
+- Do not add a custom run database.
+- Never deliberately serialize credentials into plans, receipts, logs, fixtures, or committed configuration.
+- Treat native Harbor logs and artifacts as sensitive private bytes; tetrabench guarantees only that it does not deliberately serialize credentials.
+- Keep submitter and controller storage credentials separate. Do not give child agent or verifier sandboxes S3 publication credentials.
+- Do not write controller code until E-019 proves child ID/tag observation through a supported Harbor v0.22.0 extension surface.
+- Preserve unrelated changes and use the smallest reviewable mutation.
+- Before ending work, run the strongest practical checks named by the current plan and record their evidence.

tetrabench-0.1.0/CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md