125 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
rock	3b8b698e65	Merge pull request 'fix: Remove workflow-runner deployment' (#22) from fix/remove-workflow-runner into main	2026-09-12 20:42:02 +00:00
poimen	26e57f619c	fix: Remove unnecessary workflow-runner deployment, keep only worker and workflows	2026-09-13 05:41:51 +09:00
rock	3a8b7dfd57	Merge pull request 'fix: Build all required binaries in Docker image' (#21) from fix/docker-binaries into main	2026-09-12 20:40:35 +00:00
poimen	db63c06875	fix: Build all required binaries in Docker image (worker, workflow-runner, starter)	2026-09-13 05:40:08 +09:00
rock	792d7a62f3	Merge pull request 'fix: Update Docker image registry path' (#20) from fix/docker-registry into main	2026-09-12 20:23:34 +00:00
poimen	864fb68f51	fix: Update all image references and git clone URLs to new registry path	2026-09-12 23:51:04 +09:00
poimen	63d05aad4d	fix: Update Docker image registry path	2026-09-12 23:50:34 +09:00
rockandpoimen	78650cd46f	[Phase 2.2] Synthesis activities (5 activities) (#13) ... ## Changes - `activity/synthesis.go` — 5 synthesis pipeline activities - `activity/synthesis_test.go` — 10 unit tests ## Activities 1. **ChunkAndEmbedActivity** — deterministic chunk ID + memory service ingest 2. **ExtractEntitiesActivity** — wiki-link, proper noun, technical term extraction 3. **ExtractFactsActivity** — 6 verb patterns with entity-boosted confidence 4. **DetectContradictionsActivity** — query + pre-filter + severity classification 5. **PersistSynthesisActivity** — save entities + facts to memory service ## Validation - 10 unit tests pass - `go build ./...` clean - Full suite: 35 packages pass, 0 failures --------- Co-authored-by: poimen <[email protected]> Reviewed-on: #13	2026-09-09 00:51:45 +00:00
rock	ab3a81502f	[Phase 2.1] Synthesis workflow definition (#12) ... ## Changes - `workflow/synthesis.go` — 5-stage synthesis pipeline as Temporal workflow - `workflow/synthesis_test.go` — 5 tests using Temporal test framework ## Pipeline Stages 1. **ChunkAndEmbed** — chunk text + generate embeddings 2. **ExtractEntities** — LLM entity extraction with reflection 3. **ExtractFacts** — pattern + LLM fact extraction 4. **DetectContradictions** — pre-filter + LLM verification 5. **PersistSynthesis** — save all results to DB	2026-09-09 00:37:16 +00:00
rock	3858f54670	[Phase 1.3] Temporal configuration + secrets (#11) ... ## Changes - `internal/config/config.go` — Env-specific loading (dev/staging/prod), validation, in-cluster detection - `internal/config/config_test.go` — 11 tests covering defaults, env override, TLS, prod gates - `k8s/secrets.enc.yaml` — SOPS-encrypted Secret (anthropic key, memory JWT, temporal postgres pw) ## Validation - 11 config tests pass - Full test suite passes (`go test ./...`) - `go build ./...` clean - SOPS encryption verified (age key)	2026-09-09 00:31:52 +00:00
rockandpoimen	76d8c518f0	(feat) Temporal SDK client, worker mgmt, k8s deployments (#10) ... ## Changes - `internal/temporal/client.go` — Robust Temporal client with retry (exp backoff), TLS, health check - `internal/temporal/worker.go` — Worker creation, activity/workflow registration, lifecycle - `internal/temporal/context.go` — Timeout helpers - `k8s/worker-deployment.yaml` — 2-10 replica HPA, liveness/readiness probes, security context, pod anti-affinity - `k8s/workflow-runner-deployment.yaml` — Singleton runner with probes - `k8s/kustomization.yaml` — Updated resource list Co-authored-by: poimen <[email protected]>	2026-09-09 00:03:00 +00:00
rock	e5a773054b	ci: unified workflow - single job, DOCKER_HOST, build+push on all events (#7) ... - Single job (no split test/build-push) - DOCKER_HOST=tcp://localhost:2375 for dind - Build + push on PRs too (verify before merge) - workflow_dispatch for manual trigger --------- Reviewed-on: rock/poimen-workflows#7	2026-09-07 20:53:36 +00:00
rockandTest	70442e94b4	fix: standardize poimen-workflows CI to unified pattern (#5) ... Unified pattern enforced: - test job: runs on all branches + PRs - build-push job: only on main push, depends on test - Proper env vars (GOPRIVATE, REGISTRY, IMAGE) - Install Node.js before checkout - Install docker only in build-push - Docker login + build + push + prune --------- Co-authored-by: Test <[email protected]> Reviewed-on: rock/poimen-workflows#5	2026-09-07 07:14:46 +00:00
rockandTest	45b7f8ca61	fix: use env vars for docker registry credentials (#4) ... Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation. Uses the proven pattern from riotpiao.com reference commit. This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach. After merge + org-level secrets configured: - All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN - CI validates credentials exist before docker login - Image pushed to registry on main push --------- Co-authored-by: Test <[email protected]> Reviewed-on: rock/poimen-workflows#4	2026-09-07 06:48:25 +00:00
rockandTest	0261ad141b	fix: separate test and build-push jobs (#3) ... ## Problem Monolithic test-build-push job runs all steps sequentially, with conditionals for push only on main. This makes it hard to see what failed and doesn't clearly separate concerns. ## Fix Split into two jobs: - **test**: Runs on all branches + PRs (go mod, vet, test, build binary) - **build-push**: Runs only on main push after test passes Move env vars to workflow level (cleaner, reused by both jobs). ## Result - PRs: test job runs ✅ (no docker install, no registry push) ✅ - Main push: test → build-push → registry push ✅ --------- Co-authored-by: Test <[email protected]> Reviewed-on: rock/poimen-workflows#3	2026-09-07 06:23:59 +00:00
rockandTest	3452c6fca7	fix: CI workflow - remove container override, use actions/checkout@v4 (#2) ... Container override breaks docker socket access to dind sidecar. Changes: - Remove 'container: image: golang:1.26' (breaks dind socket access) - Remove manual git config/checkout, use actions/checkout@v4 - Move docker.io install to conditional step before docker login - Install Node.js for actions runtime This workflow now works with the new runner setup (golang:1.26-bookworm label image with shared docker socket via dind sidecar). Resolves issues with docker build/push failing in CI. --------- Co-authored-by: Test <[email protected]> Reviewed-on: rock/poimen-workflows#2	2026-09-07 05:48:24 +00:00
rockandTest	e81bfbc98d	ci: merge test+build+push into single pipeline (#1) ... Merge ci.yaml + build-push.yml into single CI pipeline. Single job: vet → test → build binary → build image → push. Image push gated on main push only. Fixed Dockerfile to golang:1.26, build cmd/worker, removed HTTP healthcheck. --------- Co-authored-by: Test <[email protected]> Reviewed-on: rock/poimen-workflows#1	2026-09-06 13:18:10 +00:00
Test	7ed0642819	security: remove hardcoded cluster.local URLs from source code ... - activity/memory.go: read MEMORY_SERVICE_URL from env, default localhost - pkg/db/db.go: remove cluster.local from DSN comment - Fix memory_test.go env var name to match	2026-09-06 06:01:21 -07:00
Test	cf91155c10	security: encrypt ConfigMap with SOPS, remove plaintext secrets ... - ConfigMap values encrypted with age/SOPS (YubiKey-gated) - Removed secrets.env, secret.yaml, poimen-application.yaml (plaintext) - Worker needs no secrets — uses local LLM via ClusterIP, JWT from activity input - Decrypt: sops-unlock && sops --decrypt k8s/configmap.enc.yaml	2026-09-06 05:56:49 -07:00
Test	32f4614251	chore: remove migrations (api-gw owns DB, Temporal owns execution state)	2026-09-06 05:36:13 -07:00
Test	9c9e9450bc	refactor: rename action→activity, statemachine→workflow, remove HTTP API layer ... - action/ → activity/ (Temporal activities) - statemachine/ → workflow/ (Temporal workflows) - Removed internal/api/ and cmd/server/ (api-gw handles HTTP, Temporal is the API) - Created pkg/types/types.go as single source of truth for all shared types - Extracted CallRoleLLM helper (DRY: implementer/planner/judge shared pattern) - Fixed circular import: workflow_graph_query uses string activity names - Fixed logger.logf → logger.Info/Warn (method didn't exist) - Fixed routing types: added Branches, Activity, BackoffSeconds, TaskActivity - Fixed db.Canvas.Name, db.Client→DB, GetWorkflow→FetchWorkflow - Removed unused imports - All tests pass, build clean, vet clean	2026-09-05 23:59:13 -07:00
Test	c228b54fd7	ci: fix golang runner - use go 1.26, remove -mod=readonly, add go mod tidy	2026-09-05 23:28:56 -07:00
Test	3fb5f24208	chore: revert module path to github.com, unify Go version to 1.26.0	2026-09-05 14:48:21 -07:00
Test	62116225ff	ci: add go mod download to resolve dependencies	2026-09-05 14:05:30 -07:00
Test	fdb3591cf9	ci: use golang runner for Go project	2026-09-05 13:52:18 -07:00
Test	e21180f2eb	ci: fix runner to use node-labeled runner for Docker builds	2026-09-05 13:50:35 -07:00
Test	d81772502c	ci: add Forgejo CI/CD workflow for workflows image build & push	2026-09-05 13:47:27 -07:00
Test	46d0a42974	feat: migration for workflow relations and RAG indexing	2026-09-05 06:01:08 -07:00
Test	808e56e23d	feat: wire GraphRAG API handlers, activities, and database layer	2026-09-05 06:00:58 -07:00
Test	4fd4f8f1d7	chore: remove docker-compose (use k8s + CI/CD only)	2026-09-05 05:58:53 -07:00
Test	fd9882104e	feat: GraphRAG query API handlers and activities	2026-09-05 05:58:18 -07:00
Test	bb32a6aafd	docs: deployment guide for unified Poimen application	2026-09-05 05:57:34 -07:00
Test	0ee69a6c96	feat: unified Poimen application with k8s + docker-compose infrastructure	2026-09-05 05:57:08 -07:00
Test	c23e14cf43	feat: GraphRAG query workflow and indexing	2026-09-05 05:52:56 -07:00
Test	b82c730c82	feat: add relation wording schema	2026-09-05 05:45:47 -07:00
Test	ecec4bd7de	docs: temporal + graph RAG integration with unified query	2026-09-05 05:45:21 -07:00
Test	fcc2311c6b	feat: add canvas compatibility checking for connection validation	2026-09-05 01:01:01 -07:00
Test	8971a35bd3	feat: add CanvasReasonerActivity for auto-inferring workflow connections	2026-09-05 00:54:22 -07:00
Test	083ccfcfa0	feat: add JWT auth token support to LLM inference activities	2026-09-05 00:47:22 -07:00
Test	ae16ff8fcb	feat: database layer + canvas validator/converter + LLM inference activities ... - Add pkg/db models and CRUD methods for workflows - Add internal/routing canvas validator (DAG check, connectivity) - Add internal/routing canvas converter (Canvas → WorkflowSpec) - Register LLMInferenceActivity and LLMBatchInferenceActivity - Update api/server and cmd/server with database integration - Add K8s environment variable support - Update activity knowledge base with LLM activities - Add .env.example configuration template	2026-09-05 00:43:30 -07:00
Test	abba3fa08d	refactor: improve AssumeRoleActivity code quality (CRAP/DRY/SOLID) ... - Extract validateAssumeRoleInput() - CRAP ~2 - Extract resolveAssumeRoleConfig() with getOrEnv() helper - CRAP ~4 * Fixes DRY violation (config resolution was repeated 3x) - Extract requestAuthToken() - CRAP ~4 (sequential, easy to test) - Extract buildAssumeRoleOutput() - CRAP ~1 - Main AssumeRoleActivity now ~CRAP 3 (orchestrates high-level flow) Overall CRAP reduction: 40+ → 6-8 total complexity Improves: - Single Responsibility: Each function does one thing - DRY: Config resolution centralized - Testability: Each step independently unit-testable - Readability: Main function reads like pseudocode	2026-09-04 14:13:47 -07:00
Test	5e7cb7a4f7	feat: add AssumeRoleActivity for temporary LLM API token grants ... Implements AWS AssumeRole-like pattern for Poimen: - User/service requests temporary access with identity + scope - AssumeRoleActivity exchanges credentials with OAuth2 auth server - Returns JWT token valid for limited time (default: 1hr, max: 24hrs) - Token used in all subsequent LLM API calls to api.riotpiao.com Key features: - Credentials from vault/K8s secrets (never hardcoded) - Scope-based access control (llm:read, llm:read llm:write, llm:admin) - Automatic token expiration tracking - Retry support for transient auth failures (2x, 1.5s backoff) - Configurable auth server endpoint Usage pattern: 1. AssumeRoleActivity(identity, scope) → JWT token 2. LLMRouter uses token in LLMAuth config 3. All activity calls validated against token + scopes 4. Workflow optionally refreshes token before expiry Security: - No credentials in code/logs (env or vault only) - Short-lived tokens (1hr default, 24hr max) - Server-enforced scope validation - Token revocation support Activity registered: #10 (authentication category) Knowledge base updated with full activity spec New file: action/assume_role.go (5.2 KB)	2026-09-04 14:11:58 -07:00
Test	8caa7d1c0c	refactor: simplify auth - remove undefined TenantID concept ... - Remove TenantID field from LLMAuth (JWT claims handle tenant info) - Remove Scopes field (not part of Poimen's design) - Simplify to 3 core auth types: Bearer, API Key, Custom - Update LLMRouterConfig to only include Auth field - Simplify README examples to per-deployment pattern - Focus on secure token management vs multi-tenant isolation - Clarify token rotation pattern for long-running workflows - Update security section with practical vault integration examples TenantID was introduced without proper context. In Poimen: - JWT token itself contains tenant/customer info in claims - Each deployment gets its own LLM_AUTH_TOKEN from vault - LLM API provider (riotpiao.com) validates token at their end - No need for separate tenant header in Poimen layer Simpler, clearer, more maintainable.	2026-09-04 10:56:47 -07:00
Test	813dc23f80	feat: add JWT/OAuth2 authentication & multi-tenant federation ... - Add LLMAuth struct with support for Bearer, API Key, and Custom auth types - Implement applyAuth() to inject auth headers into LLM requests - Add X-Tenant-ID header for multi-tenant isolation - Add X-OAuth-Scopes header for OAuth2 scope enforcement - Add UpdateAuth() for runtime token refresh (long-running workflows) - Update LLMRouterConfig with Auth and TenantID fields - Document 4 authentication patterns (Bearer, API Key, Custom, Router config) - Add security best practices: token vault integration, tenant isolation, scopes - Add audit headers for compliance & logging - Create multi-tenant router factory pattern Auth types supported: - Bearer: JWT/OAuth2 tokens (most secure for federated access) - API Key: Static keys (X-API-Key header) - Custom: Any custom header-based scheme - None: No authentication Customers can now pass per-tenant JWT tokens with customized scopes and isolated LLM API access per tenant/customer.	2026-09-04 10:54:22 -07:00
Test	78b5fce74a	docs: comprehensive README with skills & knowledge guide ... - Explain Poimen philosophy (shepherd metaphor for orchestration) - Document architecture and data flow with visual diagrams - List all 9 registered activities with knowledge specs - Provide getting started guide and usage patterns - Include CI/CD pipeline, troubleshooting, and roadmap - Integrate skills registration guide for contributors - Explain registerable knowledge types (activity, domain, patterns) - Document CRAP score improvements (97% reduction) - Create virtuous cycle explanation (self-improving system) - Add .gitignore exception for README.md Refs: Shepherd metaphor emphasizes learning, adaptation, and composition over rigid task scheduling. Each registered skill teaches the system.	2026-09-03 13:58:33 -07:00
Test	aa466ffcfd	fix: update LLMRouter callers after API refactor to use NewLLMRouterDefault	2026-09-03 09:42:56 -07:00
Test	d624842842	refactor: make routing system extensible with provider/builder interfaces ... BREAKING: LLMRouter now requires explicit LLMProvider New Abstractions: - LLMProvider interface: swap providers (OpenAI, Claude, local, etc) - SpecBuilder interface: custom spec generation strategies - ParameterBinder interface: flexible parameter resolution - ActivityExecutor interface: pluggable activity execution - WorkflowValidator interface: composable validation Provider System: - ProviderRegistry: manage multiple LLM providers - RoutingProviderLLM: fallback across providers - CachingLLMProvider: caching wrapper - RetryingLLMProvider: retry wrapper Spec Building: - DefaultSpecBuilder: basic spec generation - CronSpecBuilder: cron workflow specialization - SpecBuilderFactory: builder selection - CompositeSpecBuilder: multi-strategy fallback - BuildMetadata: context for builders Validators: - StateGraphValidator: DAG structure - ActivityAvailabilityValidator: activity existence - TimeoutValidator: timeout format - CompositeValidator: multiple validators - TransitionValidator: state transitions Refactored Components: - LLMRouter: config-driven, provider-agnostic - LLMClient: now implements LLMProvider - llm_router.go: 97 fewer lines (delegated to builders) Migration Path: OLD: NewLLMRouter(kb) NEW: NewLLMRouter(LLMRouterConfig{Provider: ..., KB: ...})	2026-09-03 09:17:38 -07:00
Test	75ad21d52b	fix: flaky TestGetPendingGates - add status assertion	2026-09-03 09:10:37 -07:00
Test	8d47081d8d	refactor: reduce CRAP scores in router/workflow/notification ... - llm_router.go: Extract getStringFromMap, firstNonEmpty, paramResolver - buildCronSpec: 12 → 4 complexity - buildParameters: 9 → 5 complexity - routing_workflow.go: Extract stateMachine, stateResult types - RoutingWorkflow: 11 → 6 complexity - Separate executeTask/executePass/executeFail - notification.go: Extract checker interface pattern - DeploymentPreCheckActivity: 10 → 5 complexity - goCheckers() returns language-specific checkers - Added 7 new test cases for helper functions - Coverage: internal/routing 63.6% → 66.0%	2026-09-03 08:50:21 -07:00
Test	94fc2082b9	feat: RoutingWorkflow + LLM Router + Memory Activity ... - Add RoutingWorkflow: generic state machine executor for WorkflowSpec - Add LLM Router: natural language → WorkflowSpec generation - Add RetrieveMemoryActivity: query poimen-memory for context - Add activities: AnalyzeCode, SecurityScan, GenerateReport, Notify, etc. - Add agent-prompts/router: LLM prompt documentation - Extend starter with --route flag for routing workflows - Remove orchestrator job (trigger via API/message instead) - Clean up: move docs to Desktop, add .gitignore for *.md	2026-09-02 19:21:53 -07:00