toolframe-core 0.6.2__tar.gz

toolframe_core-0.6.2/.github/workflows/ci.yml

@@ -0,0 +1,20 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    # publish.yml validates release tags in the publication run itself.
+    branches: ['**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    uses: ./.github/workflows/validate.yml
+    secrets: inherit

toolframe_core-0.6.2/.github/workflows/launcher.yml

@@ -0,0 +1,96 @@
+name: Native launcher wheels
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  launcher:
+    name: Launcher (${{ matrix.target }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            target: aarch64-apple-darwin
+            manylinux: 'off'
+          - runner: macos-15-intel
+            target: x86_64-apple-darwin
+            manylinux: 'off'
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            manylinux: '2_28'
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+            manylinux: '2_28'
+    env:
+      TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+      TOOLFRAME_REPOSITORY_TOKEN: ${{ secrets.TOOLFRAME_READ_TOKEN }}
+      MACOSX_DEPLOYMENT_TARGET: '12.0'
+      CARGO_BUILD_JOBS: '2'
+      TOOLFRAME_TARGET: ${{ matrix.target }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - name: Install the Rust toolchain
+        run: rustup toolchain install 1.94.1 --profile minimal --component rustfmt
+      - name: Verify the launcher source
+        run: |
+          cargo +1.94.1 fmt --check
+          cargo +1.94.1 test --locked
+      - name: Prepare native sources and acceptance dependencies
+        run: >-
+          python scripts/ci/prepare-launcher.py --target "$TOOLFRAME_TARGET"
+          --repository-owner "$TOOLFRAME_REPOSITORY_OWNER"
+      - name: Build the native wheel
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
+        with:
+          working-directory: build/launcher
+          target: ${{ matrix.target }}
+          manylinux: ${{ matrix.manylinux }}
+          maturin-version: 'v1.14.1'
+          rust-toolchain: '1.94.1'
+          args: --release --locked --out ../launcher-dist/wheels
+      - name: Export the identical GitHub Release executable
+        run: >-
+          python scripts/build-launcher.py finish --target "$TOOLFRAME_TARGET"
+          --output build/launcher-dist
+      - name: Check metadata and exercise the installed wheel
+        run: |
+          uv tool run --from twine==7.0.0 twine check --strict build/launcher-dist/wheels/*
+          python scripts/ci/check-launcher-wheel.py --output build/launcher-dist --wheelhouse build/launcher-inputs/validation-wheels
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: launcher-wheel-${{ matrix.target }}
+          path: build/launcher-dist/wheels/*.whl
+          if-no-files-found: error
+          retention-days: 14
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: launcher-release-${{ matrix.target }}
+          path: |
+            build/launcher-dist/release/*.tar.gz
+            build/launcher-dist/release/*.whl
+            build/launcher-dist/release/*.json
+            build/launcher-dist/release/SHA256SUMS-*.txt
+          if-no-files-found: error
+          retention-days: 14
+      - name: Retain acceptance evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: launcher-evidence-${{ matrix.target }}
+          path: build/launcher-dist/*.json
+          if-no-files-found: warn

toolframe_core-0.6.2/.github/workflows/publish.yml

@@ -0,0 +1,128 @@
+name: Publish Python distribution
+
+on:
+  workflow_dispatch:
+    inputs:
+      index:
+        description: Package index (select the matching vVERSION tag as the run ref)
+        type: choice
+        options:
+          - testpypi
+          - pypi
+        default: testpypi
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-${{ github.ref }}-${{ inputs.index }}
+  cancel-in-progress: false
+
+jobs:
+  release-tag:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - name: Require the exact project version tag
+        run: python scripts/ci/check-release.py --ref "$GITHUB_REF"
+
+  validate:
+    needs: release-tag
+    uses: ./.github/workflows/validate.yml
+    secrets: inherit
+
+  publish-core:
+    needs: [release-tag, validate]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment:
+      name: ${{ inputs.index }}
+    permissions:
+      id-token: write
+    steps:
+      - name: Download the distributions validated in this run
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-dist
+          path: dist/
+      - name: Require the complete Core release set
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          files = list(Path('dist').iterdir())
+          assert len(list(Path('dist').glob('toolframe_core-*.whl'))) == 1
+          assert len(list(Path('dist').glob('toolframe_core-*.tar.gz'))) == 1
+          assert len(files) == 2
+          PY
+      - name: Publish Core using its Trusted Publisher
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          packages-dir: dist/
+          repository-url: ${{ inputs.index == 'testpypi' && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}
+
+  publish-launcher:
+    needs: [release-tag, validate]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment:
+      name: ${{ inputs.index }}-launcher
+    permissions:
+      id-token: write
+    steps:
+      - name: Download all four validated native wheels
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: launcher-wheel-*
+          merge-multiple: true
+          path: dist/
+      - name: Require the complete launcher release set
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          files = list(Path('dist').iterdir())
+          assert len(list(Path('dist').glob('toolframe-*.whl'))) == 4
+          assert len(files) == 4
+          PY
+      - name: Publish the launcher using its Trusted Publisher
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          packages-dir: dist/
+          repository-url: ${{ inputs.index == 'testpypi' && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}
+
+  release-binaries:
+    needs: [validate, publish-core, publish-launcher]
+    if: inputs.index == 'pypi'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: launcher-release-*
+          merge-multiple: true
+          path: releases/
+      - name: Publish verified executables and checksums
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          cat releases/SHA256SUMS-*.txt > releases/SHA256SUMS
+          (cd releases && sha256sum --check SHA256SUMS)
+          cat > release-notes.txt <<'EOF'
+          Install the native CLI with `uv tool install toolframe`, or download the matching archive below and place `toolframe` on PATH. The wheel and archive contain the same executable.
+
+          Supported platforms: macOS 12+ (Apple Silicon and Intel), and Linux glibc 2.28+ (ARM64 and x86-64). First use prepares Python and public dependencies with uv. Windows and musl Linux are not included.
+
+          Start an application with `toolframe --home ./my-app init --template entry-register`, then `toolframe --home ./my-app serve`. Run `toolframe --home ./my-app open` in another terminal for the local sign-in link.
+          EOF
+          gh release create "$RELEASE_TAG" --verify-tag --title "Toolframe $RELEASE_TAG" \
+            --notes-file release-notes.txt releases/*.tar.gz releases/SHA256SUMS releases/manifest-*.json releases/*.whl

toolframe_core-0.6.2/.github/workflows/validate.yml

@@ -0,0 +1,102 @@
+name: Validate distributions and launchers
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+# Concurrency belongs to the caller: a reusable workflow must not cancel it.
+jobs:
+  postgres:
+    name: PostgreSQL journal and mixed SQL storage
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      postgres:
+        image: postgres:16.14-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      TOOLFRAME_CORE_TEST_ADMIN_DSN: postgresql://postgres:postgres@127.0.0.1:5432/postgres
+      TOOLFRAME_POSTGRES_PG_DUMP: /usr/lib/postgresql/16/bin/pg_dump
+      TOOLFRAME_POSTGRES_PG_RESTORE: /usr/lib/postgresql/16/bin/pg_restore
+      TOOLFRAME_REPOSITORY_TOKEN: ${{ secrets.TOOLFRAME_READ_TOKEN }}
+      TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - name: Install matching PostgreSQL backup tools
+        run: sudo apt-get update && sudo apt-get install -y postgresql-client-16
+      - name: Verify journals, mixed storage and failure recovery
+        run: >-
+          python scripts/ci/validate.py --checks postgres --output build/ci-postgres
+          --repository-owner "$TOOLFRAME_REPOSITORY_OWNER"
+      - name: Save PostgreSQL validation evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: postgres-validation
+          path: |
+            build/ci-postgres/*.json
+            build/ci-postgres/workspace.txt
+          if-no-files-found: warn
+  python:
+    name: Python integration and distribution
+    runs-on: macos-15
+    timeout-minutes: 40
+    env:
+      # github.repository_owner is the base repository owner, including fork PRs.
+      TOOLFRAME_REPOSITORY_TOKEN: ${{ secrets.TOOLFRAME_READ_TOKEN }}
+      TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - name: Validate in a fresh pinned workspace
+        run: >-
+          python scripts/ci/validate.py --checks python --output build/ci-python
+          --repository-owner "$TOOLFRAME_REPOSITORY_OWNER"
+      - name: Save validated Python distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-dist
+          path: build/ci-python/python-dist/
+          if-no-files-found: error
+          retention-days: 14
+      - name: Save Python validation evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-validation
+          path: |
+            build/ci-python/*.json
+            build/ci-python/*.xml
+            build/ci-python/workspace.txt
+          if-no-files-found: warn
+          retention-days: 14
+
+  launcher:
+    uses: ./.github/workflows/launcher.yml
+    secrets: inherit

toolframe_core-0.6.2/.gitignore

@@ -0,0 +1,28 @@
+/target/
+/target-*/
+/.venv/
+/.pytest_cache/
+/.ruff_cache/
+/wheelhouse/
+/build/
+/dist/
+/.toolframe/
+/data/
+# Legacy pre-0.1 runtime locations remain ignored during upgrades.
+/runtime/
+/logs/
+/data.db
+/data.db-shm
+/data.db-wal
+__pycache__/
+*.py[cod]
+*.log
+.DS_Store
+
+/.coverage
+/htmlcov/
+
+# Local working documents, issue state, and development worktrees.
+/.local/
+/.issues/
+/.worktrees/

toolframe_core-0.6.2/CHANGELOG.md

@@ -0,0 +1,48 @@
+# Changelog
+
+These versions describe local development releases. A version entry does not
+imply that its distributions have been published or every target is qualified.
+
+## Unreleased
+
+- Run multiple SQL storage providers using service defaults and per-plugin bindings.
+- Retain store provider ownership across removal and restart; reject silent rebinding.
+- Bind migration plans and forward repair to their provider, and preserve admitted
+  bindings and cleanup across storage cohorts.
+
+## 0.5.2
+
+- Exclude development evaluation fixtures from installed plugin skills and bundles.
+- Preserve customized skills while upgrading unchanged installed copies.
+
+## 0.5.1
+
+- Align the Dashboard operation-history refresh and pagination controls.
+
+## 0.5.0
+
+- Add permanent operation sequence numbers and paginated, filtered history.
+- Upgrade existing journal rows while retaining their operation UUIDs.
+
+## 0.4.1
+
+- Reuse compatible retained plugin artifacts after executable upgrades.
+- Guide disabled plugins through enable operations and show Dashboard loading state.
+
+## 0.4.0
+
+- Add dependency, binding and presentation diagnostics with operation impact views.
+
+## 0.3.1
+
+- Simplify password creation, relative expiry and local timestamp presentation.
+
+## 0.3.0
+
+- Add independent Auth and Dashboard Auth plugins and explicit SDK authorization.
+- Separate configured Dashboard access policy from effective fallback behavior.
+
+## 0.2.0
+
+- Add configurable localhost/LAN listeners and standard executable bundles.
+- Report launcher versions without runtime preparation.