fix(docker): install git for VCS deps; drop .suite6-config.json from the scaffold - #151
Merged
Merged
Conversation
… deps - Add git to apt-get install in Dockerfile, chassis/Dockerfile.chassis, and Dockerfile.prod build stages so pip/poetry can resolve git+https dependencies (previously failed with "Cannot find command 'git'"). - Fix Dockerfile.prod poetry install: --no-dev is deprecated, replaced with --only main --no-root (the latter avoids failing on a missing README.md before it's copied into the build context). Removed the silent pip fallback in favor of failing fast. - Align requirements.txt with pyproject.toml (redis, numpy versions) and add openai/asyncpg/python-multipart to pyproject.toml to remove dependency drift between the two manifests. Regenerated poetry.lock. chore(license): replace MIT LICENSE with Quantum AI Partners proprietary license, matching the README's existing "proprietary" claim and the org-wide license standardization applied across other Quantum-L9 repos. Adds license = "LicenseRef-Proprietary" to pyproject.toml. Co-authored-by: Cursor <cursoragent@cursor.com>
Records the diagnostic commands run while investigating org-level GitHub ruleset enforcement for Quantum-L9 (repo/org ruleset state, plan-tier gating, the CI Gate ruleset's invalid empty ref_name.include, CodeQL coverage, and the post-Enterprise-upgrade re-check) for future reference. Co-authored-by: Cursor <cursoragent@cursor.com>
…registry The 24 machine-readable contracts in contracts/ and the 20 prose docs in docs/contracts/ had drifted: YAML pointed at test files rather than test classes, no YAML named the doc that described it, seven contracts had no prose at all, and several docs referenced modules (l9.core, l9.memory, chassis.metrics) that do not exist in this repo. Splits ownership by concern -- YAML owns identity and wiring, Markdown owns prose -- and adds tests/contracts/test_contract_registry.py as a blocking drift gate so the two cannot diverge again silently. - contracts/*.yaml: verification.test is now a pytest node ID; every contract names its docs; scanner_rules populated and corrected - 7 new docs (C-10, 11, 15, 18, 20, 21, 22) plus 10 partial docs expanded - TestContract21-24 added; all 24 contracts now have a test class - verify_contracts.py reads docs: from YAML on top of its literal floor list, and now also checks AGENTS.md for wiring - STUB-001/002/003 registered for the zero-stub protocol, scoped to engine/ (chassis ABCs legitimately raise NotImplementedError) - resolved two contradictions against the code: gate count is 10, not 14; both logging.getLogger and structlog.get_logger satisfy CONTRACT-04, since the enforced invariant is that the engine never configures logging - contract_report.py now splits node IDs on '::' when checking test existence 1749 passed, 0 failures. ruff and mypy clean. Co-authored-by: Cursor <cursoragent@cursor.com>
SETUP_QUICK_START.md already declares this config stale and CANONICAL_LAW.md is headed "Post-Suite-6", but the file stayed in l9_template_manifest.yaml, so every newly scaffolded L9 repo inherited dead configuration. Phase 4 of the Suite-6 cut-over. Scoped deliberately to the config removal; the manifest's other pending edits belong to the L9_META injector work. Co-authored-by: Cursor <cursoragent@cursor.com>
|
❌ Too Many Reviewable Files Changed ❌ PR Too Large 📋 Best Practices for Large Changes
🚫 This PR is blocked until reviewable size limits are met. |
/v1/health returns 200 while the engine is still warming up, so an unready container was reported healthy. Also ignores the mypy venv.
Adds the CONTRACT-24 resilience section, the contract-suite run commands, and the chassis_app.py path corrections that the registry alignment left unapplied in the prose docs.
The prod image healthcheck only asserted that /v1/health answered, so a container whose Neo4j driver or domain loader failed to come up still reported healthy and took traffic. Matches the dev Dockerfile and Dockerfile.chassis change in this PR. Co-authored-by: Cursor <cursoragent@cursor.com>
Wires the SDK-native chassis (chassis/node_app.py, handler_registration.py, entrypoint.py) into engine/handlers.py by adding ACTION_HANDLERS as the single source of truth for the 8 action handlers (CONTRACT-02). The legacy chassis (chassis/actions.py) now consumes ACTION_HANDLERS directly instead of maintaining a duplicate hardcoded list, so the two chassis implementations can't drift apart. Wires tools/research/top5_leverage_patterns_detailed.json into the spec coverage extractor (tools/spec_extract.py::extract_research_features) so the 5 leverage-pattern engine mappings show up in the coverage matrix. Fixes 4 missing-underscore typos in tools/auditors/*.py contract_file properties that pointed at non-existent docs (METHODSIGNATURES.md -> METHOD_SIGNATURES.md, etc.), caught by the new test_auditor_wiring.py. Adds 7 new contract docs, 5 auditor remediation docs, and 5 new contract tests (test_auditor_wiring, test_chassis_parity, test_research_wiring, test_node_app, test_contract_registry). Defers reconciling contracts/contract_*.yaml (24 files) against the new schema test_contract_registry.py expects -- tracked as DEFERRED-003 in DEFERRED.md and flagged in TODO.md, since it requires per-contract doc/test-class mapping decisions rather than a mechanical fix. Co-authored-by: Cursor <cursoragent@cursor.com>
… conflicts Remediation-Cycle: #151/cycle-1 Co-authored-by: Cursor <cursoragent@cursor.com>
Remediation-Cycle: #146/cycle-1 Co-authored-by: Cursor <cursoragent@cursor.com>
L9 Audit Harness Report
Step Results
Architecture Audit Findings
See Spec Coverage
See Next StepsAll checks passed. Safe to merge. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Post harness report to PR | ||
| if: always() && github.event_name == 'pull_request' | ||
| uses: actions/github-script@v8 |
There was a problem hiding this comment.
Pull request overview
This PR updates the repo’s build/scaffold behavior (Docker + template manifest) while also introducing a sizable SDK-native chassis path with new handler registration and contract/unit tests, plus additional documentation and contract artifacts.
Changes:
- Install
gitin Docker build stages to supportgit+httpsdependencies and adjust prod dependency installation (Poetry main-only, no-root). - Remove stale
.suite6-config.jsonfrom the template scaffold and add diagnostics/docs artifacts. - Add an SDK-native chassis entrypoint/registration path and new tests/docs/contracts to enforce parity and contract wiring.
Reviewed changes
Copilot reviewed 36 out of 39 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
tools/spec_extract.py |
Adds research feature extraction but currently duplicates constants and appends research features twice (needs fix). |
tools/l9_template_manifest.yaml |
Removes .suite6-config.json from scaffold manifest. |
tools/deploy/deploy.sh |
Removes repo-agnostic VPS deploy script. |
tools/auditors/base.py |
Adjusts auditor base header/docstring formatting (now diverges from existing L9_META conventions). |
tools/auditors/api_regression.py |
Updates fix hint to reference METHOD_SIGNATURES.md. |
TODO.md |
Adds DEFERRED-003 tracking note for contract registry schema drift. |
tests/unit/test_node_app.py |
Adds unit tests for SDK-native chassis ingress + handler registry/audit behavior. |
tests/contracts/test_contract_registry.py |
Adds contract registry drift gate (currently will fail against existing contract YAMLs unless guarded/migrated). |
tests/contracts/test_chassis_parity.py |
Adds contract tests asserting legacy vs SDK chassis parity on action routing. |
scripts/scripts-deploy.sh |
Removes Terraform deploy script stub. |
requirements.txt |
Updates runtime dependencies (notably redis/numpy) and includes git-based SDK dependency. |
pyproject.toml |
Aligns Poetry deps with runtime requirements and sets proprietary license identifier. |
poetry.lock |
Updates lockfile (Poetry version + dependency set changes). |
LICENSE |
Switches from MIT to a proprietary/source-available license text. |
engine/security/P2_9_llm_schemas.py |
Changes OpenAI client init to prefer missing-key error before missing-package error. |
engine/handlers.py |
Introduces ACTION_HANDLERS as a single source of truth and refactors legacy registration accordingly. |
docs/github-ruleset-diagnostics.md |
Adds org ruleset diagnostic command log. |
docs/contracts/SCORING_WEIGHT_CEILING.md |
Adds contract documentation for scoring weight ceiling. |
docs/contracts/PROHIBITED_FACTORS.md |
Adds contract documentation for prohibited factors enforcement. |
docs/contracts/PII_HANDLING.md |
Adds contract documentation for PII handling modes and constraints. |
docs/contracts/L9_META_HEADERS.md |
Adds contract documentation for L9_META header format. |
docs/contracts/KGE_EMBEDDINGS.md |
Adds contract documentation for KGE embeddings constraints. |
docs/contracts/FEATURE_FLAG_DISCIPLINE.md |
Adds contract documentation for feature-flag discipline. |
docs/contracts/BIDIRECTIONAL_MATCHING.md |
Adds contract documentation for direction-unaware gate behavior. |
docs/Commands.md |
Adds a command scratchpad/log (unstructured content). |
docs/CI_CONSTELLATION_BOUNDARY.md |
Adds CI constellation boundary doc (header currently missing /L9_META --> closing marker; needs fix). |
Dockerfile.prod |
Adds git install and adjusts Poetry install strategy; improves healthcheck readiness semantics. |
Dockerfile |
Adds git install and tightens healthcheck to check readiness. |
DEFERRED.md |
Adds DEFERRED-003 detailing contract registry schema mismatch and why it’s deferred. |
chassis/node_app.py |
Adds SDK-native FastAPI app creation + gate-only ingress middleware + lifecycle adapter. |
chassis/handler_registration.py |
Registers ACTION_HANDLERS into the SDK registry with packet-audit wrapper. |
chassis/entrypoint.py |
Adds a single uvicorn entrypoint that selects legacy vs SDK chassis via L9_CHASSIS. |
chassis/Dockerfile.chassis |
Adds git install and readiness-based healthcheck update. |
chassis/actions.py |
Updates legacy chassis to consume ACTION_HANDLERS rather than rebuilding a local action list. |
artifacts/harness_report.md |
Adds a captured audit harness report artifact. |
AGENTS.md |
Adds a top-level L9_META header and expands governance/formatter ownership content. |
.suite6-config.json |
Removes stale suite configuration file. |
.gitignore |
Ignores .venv-py312-mypy/. |
.github/workflows/audit.yml |
Adds PR comment posting step and adjusts permissions; header now diverges from existing L9_META conventions. |
Suppressed comments (1)
tools/spec_extract.py:580
- extract_research_features(root) is called twice, so research features are duplicated in
featuresand the printed totals become inconsistent. Computeresearchonce and append once.
Comment on lines
50
to
55
| L9_TEMPLATE_TAG = "L9_TEMPLATE" | ||
| RESEARCH_DIR = "tools/research" | ||
| RESEARCH_PATTERNS_FILE = "top5_leverage_patterns_detailed.json" | ||
|
|
||
| RESEARCH_DIR = "tools/research" | ||
| RESEARCH_PATTERNS_FILE = "top5_leverage_patterns_detailed.json" |
Comment on lines
+29
to
+44
| EXPECTED_COUNT = 24 | ||
| REQUIRED_KEYS = {"id", "name", "layer", "level", "scope", "preconditions", "postconditions", "verification", "docs"} | ||
| VALID_LEVELS = {"MUST", "SHOULD", "MAY"} | ||
|
|
||
|
|
||
| def _load_contracts() -> list[dict]: | ||
| specs = [] | ||
| for f in sorted(CONTRACTS_DIR.glob("contract_*.yaml")): | ||
| specs.append((f.name, yaml.safe_load(f.read_text(encoding="utf-8")))) | ||
| return specs | ||
|
|
||
|
|
||
| CONTRACTS = _load_contracts() | ||
|
|
||
|
|
||
| def _scanner_rule_ids() -> set[str]: |
Comment on lines
+6
to
+9
| tags: [ci, constellation, l9-ci-core, l9-ci-sdk, l9-harness, l9-assurance, boundary] | ||
| owner: platform | ||
| status: active | ||
| --> |
Comment on lines
2
to
9
| --- L9_META --- | ||
| l9_schema: 1 | ||
| l9_schema: 2 | ||
| origin: l9-template | ||
| engine: graph | ||
| layer: [audit] | ||
| tags: [L9_TEMPLATE, auditors, base] | ||
| owner: platform | ||
| tags: [delivery, harness] | ||
| status: active | ||
| --- /L9_META --- |
Comment on lines
1
to
7
| # --- L9_META --- | ||
| # l9_schema: 1 | ||
| # l9_schema: 2 | ||
| # origin: l9-template | ||
| # engine: graph | ||
| # layer: [ci] | ||
| # tags: [L9_TEMPLATE, ci, audit, harness] | ||
| # owner: platform | ||
| # tags: [delivery, harness] | ||
| # status: active |
- l9-lint-test: mypy engine/ (not SOURCE_DIR=.) - supply-chain: allow-licenses only (action rejects both allow+deny) - l9-analysis: remove semgrep fail-open || true - contracts: install requirements-ci before verify/scan Co-authored-by: Cursor <cursoragent@cursor.com>
… arg) Remediation-Cycle: #146/cycle-2 Co-authored-by: Cursor <cursoragent@cursor.com>
…x/docker-git-deps-and-proprietary-license
| steps: | ||
| # fetch-depth is irrelevant here, but the checkout must be a real git repo: | ||
| # discovery enumerates via `git ls-files -z`, not a filesystem walk. | ||
| - uses: actions/checkout@v6 |
| # fetch-depth is irrelevant here, but the checkout must be a real git repo: | ||
| # discovery enumerates via `git ls-files -z`, not a filesystem walk. | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/setup-python@v5 |
| with: | ||
| python-version: "3.12" | ||
| - run: pip install pyyaml | ||
| # Default mode is dry-run verification; there is no `check` subcommand. |
Co-authored-by: Cursor <cursoragent@cursor.com>
…x/docker-git-deps-and-proprietary-license
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 99 out of 102 changed files in this pull request and generated 3 comments.
Suppressed comments (6)
tools/spec_extract.py:55
RESEARCH_DIRandRESEARCH_PATTERNS_FILEare defined twice, which will trip Ruff/Python redefinition checks (and is easy to miss during refactors). Keep a single definition to avoid F811-style failures and confusion over the intended values.
contracts/contract_18.yaml:31- This contract claims L9_META is now “schema v2” and that
ownerwas dropped, buttools/l9_meta_injector.pycurrently hardcodesL9_SCHEMA_VERSION = 1and still emits anowner:field. The contract text (and the repo’s injected headers) need to be aligned with the injector’s actual schema/output (or the injector needs updating).
tools/spec_extract.py:580 extract_research_features(root)is called twice, so research features are duplicated in thefeatureslist (andlen(features)will be inflated). This will produce misleading coverage output and double the scan work for those features.
docs/contracts/L9_META_HEADERS.md:32- This doc states the header is “schema version 1” and lists an
ownerfield, but this PR updates many headers tol9_schema: 2and removesowner, andcontracts/contract_18.yamlalso claims schema v2. Update this contract doc’s rule + field list to match the repo’s declared schema so agents/tooling don’t follow stale guidance.
docs/contracts/MEMORY_SUBSTRATE_ACCESS.md:31 - The docs show
await get_packet_store().write(packet), butengine.packet.packet_store.PacketStoreexposespersist(request, response)(nowrite). As written, this example won’t run and conflicts with the actual persistence API used elsewhere (e.g., chassis packet auditing).
tools/verify_contracts.py:78 yaml_declared_docs()assumesdocsis a list of strings. If a contract YAML accidentally setsdocs:to a scalar or includes a non-string entry,root / rellater will raise aTypeErrorand short-circuit verification. Validating the type here would make the failure mode clearer and keep the script robust to partial edits.
| hooks: | ||
| - id: l9-meta-check | ||
| name: L9_META Header Check | ||
| entry: python tools/l9_meta_injector.py check |
| scanner_rules: [] | ||
| test: tools/l9_meta_injector.py | ||
| test: tests/contracts/test_contracts.py::TestContract18L9Meta | ||
| command: python tools/l9_meta_injector.py check |
Comment on lines
+60
to
+62
| - run: pip install pyyaml | ||
| # Default mode is dry-run verification; there is no `check` subcommand. | ||
| - run: python tools/l9_meta_injector.py |
…rder Co-authored-by: Cursor <cursoragent@cursor.com>
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 99 out of 102 changed files in this pull request and generated 1 comment.
Suppressed comments (8)
tools/spec_extract.py:55
- RESEARCH_DIR and RESEARCH_PATTERNS_FILE are defined twice in a row, which is redundant and makes later edits error-prone (one definition will silently shadow the other).
.pre-commit-config.yaml:107 - This pre-commit hook calls
python tools/l9_meta_injector.py check, but tools/l9_meta_injector.py only supports--apply(nocheckarg). As written, the hook will error on every commit. Also, running the injector in dry-run should fail the hook when it prints PENDING/MISSING/ERROR so the contract is actually enforced.
- id: l9-meta-check
name: L9_META Header Check
entry: python tools/l9_meta_injector.py check
language: python
# pre-commit builds an isolated venv, so l9-meta.yaml parsing needs
.github/workflows/contracts.yml:63
- The meta-headers job runs the injector in dry-run mode, but tools/l9_meta_injector.py exits 0 even when it reports PENDING/MISSING/ERROR. That means this CI gate will pass even when headers are wrong (or when FILE_REGISTRY includes removed files). Make the step fail closed based on the injector output.
- run: pip install pyyaml
# Default mode is dry-run verification; there is no `check` subcommand.
- run: python tools/l9_meta_injector.py
contracts/contract_18.yaml:37
- The contract declares a
python tools/l9_meta_injector.py checkverification command, but tools/l9_meta_injector.py has nochecksubcommand (only--apply). This makes the contract metadata misleading and any automation that tries to run the declared command will fail.
tools/spec_extract.py:580 - extract_research_features(root) is invoked twice, so research features are duplicated in the feature list and the totals printed later will be inflated.
docs/contracts/L9_META_HEADERS.md:33 - This doc still describes L9_META schema v1 and includes an
ownerfield, but the repo changes in this PR move headers to schema v2 and dropowner(see e.g. .cursorrules / tools/verify_contracts.py headers). The contract doc should match the enforced schema so agents don’t reintroduce v1 headers.
tools/l9_template_manifest.yaml:118 - This manifest hunk removes
.suite6-config.json, but tools/l9_meta_injector.py still has it in FILE_REGISTRY. Once the meta-header gate is made fail-closed, it will report the file as MISSING until the registry is updated too.
docs/contracts/MEMORY_SUBSTRATE_ACCESS.md:31 - PacketStore does not expose a
write()method; the API ispersist(request, response)(andrecord_outcome(...)). This snippet will mislead readers and cause copy/paste errors.
| CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/v1/health')" | ||
| CMD python -c "import json,sys,urllib.request; sys.exit(0 if json.load(urllib.request.urlopen('http://localhost:8000/v1/health')).get('ready', True) else 1)" | ||
|
|
||
| CMD ["uvicorn", "chassis.app:create_app", "--factory", "--host", "0.0.0.0", "--port", "8000", "--workers", "4"] |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 99 out of 102 changed files in this pull request and generated no new comments.
Suppressed comments (4)
tools/spec_extract.py:55
- RESEARCH_DIR / RESEARCH_PATTERNS_FILE are defined twice, which makes the module state ambiguous and risks future edits diverging (the second assignment silently wins). Remove the duplicate constant definitions.
Dockerfile.prod:64 - Dockerfile.prod still starts uvicorn from chassis.app:create_app, but this PR introduces chassis/entrypoint.py as the single target for selecting legacy vs SDK chassis via L9_CHASSIS. Using chassis.app here bypasses that selection and makes L9_CHASSIS ineffective in prod images.
CMD ["uvicorn", "chassis.app:create_app", "--factory", "--host", "0.0.0.0", "--port", "8000", "--workers", "4"]
.pre-commit-config.yaml:106
- tools/l9_meta_injector.py does not support a positional "check" argument (it only has flags like --apply). As written, this pre-commit hook will fail with an argparse error and block commits.
name: L9_META Header Check
entry: python tools/l9_meta_injector.py check
language: python
tools/spec_extract.py:580
- extract_research_features(root) is called twice (once added directly to features, then again assigned to research and re-added). This double-counts research features and inflates coverage totals.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three commits that had accumulated on this branch without a PR. The last one (
02f6681, Jul 24) had never been pushed.Summary
9ef51d1— Docker VCS deps. InstallsgitinDockerfile,Dockerfile.prod, andchassis/Dockerfile.chassisso theconstellation-node-sdkgit dependency resolves during build. Fixes the Poetry prod install and realignspyproject.toml/poetry.lock/requirements.txt. Also switchesLICENSEto the proprietary text.fea9047— Diagnostics. Addsdocs/github-ruleset-diagnostics.md, a command log from the org-ruleset investigation.02f6681— Suite-6 cut-over, phase 4. Removes.suite6-config.jsonand its entry intools/l9_template_manifest.yaml.SETUP_QUICK_START.mdalready declares this config stale andCANONICAL_LAW.mdis headed "Post-Suite-6", but the manifest still carried it, so every newly scaffolded L9 repo inherited dead configuration. Scoped deliberately to the config removal — the manifest's other pending edits belong to the L9_META injector work.Test plan
.suite6-config.jsonappearsMade with Cursor