fix: resolve merge conflicts in CI workflow

Resolved conflicts between fix/registry-login-env and origin/main: - Use single-line apt-get install - Use simplified short SHA command - Use 'Build and push image' step name from main All registry login changes preserved (env vars approach).
fix: use env vars for docker registry credentials
2026-09-06 23:40:32 -07:00 · 2026-09-06 23:37:51 -07:00 · 2026-09-06 23:35:02 -07:00 · 2026-09-06 23:17:10 -07:00
21 changed files with 142 additions and 1345 deletions
@@ -5,23 +5,19 @@ on:
    branches: [main]
  pull_request:
    branches: [main]
-  workflow_dispatch:

 env:
  GOPRIVATE: forgejo.riotpiao.com
  REGISTRY: forgejo.riotpiao.com
  IMAGE: forgejo.riotpiao.com/rock/poimen-workflows
-  DOCKER_HOST: tcp://localhost:2375

 jobs:
-  ci:
-    name: CI
+  test:
+    name: Test
    runs-on: golang
    steps:
-      - name: Install Node.js and Docker
-        run: |
-          apt-get update
-          apt-get install -y nodejs docker.io
+      - name: Install Node.js for actions runtime
+        run: apt-get update && apt-get install -y nodejs

      - name: Checkout code
        uses: actions/checkout@v4
@@ -38,6 +34,18 @@ jobs:
      - name: Build binary
        run: CGO_ENABLED=0 GOOS=linux go build -o /tmp/poimen-worker ./cmd/worker

+  build-push:
+    name: Build & Push Image
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: golang
+    steps:
+      - name: Install Node.js and Docker
+        run: apt-get update && apt-get install -y nodejs docker.io
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
      - name: Get short SHA
        id: sha
        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
@@ -50,17 +58,18 @@ jobs:
          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}

-      - name: Build Docker image
+      - name: Build and push image
        run: |
          docker build --no-cache \
            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" .
+            -t "${IMAGE}:latest" \
+            .

      - name: Push Docker image
        run: |
          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
          docker push "${IMAGE}:latest"
-          echo "✓ Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"

      - name: Prune unused images
        run: docker image prune -a --force 2>&1 | tail -3 || true
@@ -7,7 +7,3 @@
 starter
 worker
 poimen
-
-# Compiled binaries
-poimen-worker
-poimen-api
@@ -0,0 +1,78 @@
+# Forgejo Registry Secrets Configuration
+
+## One-Time Setup (Org Level)
+
+All repos in the `rock` org share the same Forgejo registry credentials.
+
+### Configure at Organization Level
+
+1. Navigate to: https://forgejo.riotpiao.com/rock
+2. Click Settings (gear icon)
+3. Go to: Actions → Secrets
+4. Add these org-level secrets:
+   - **Name**: `FORGEJO_REGISTRY_USER`
+     **Value**: `rock`
+   
+   - **Name**: `FORGEJO_REGISTRY_TOKEN`
+     **Value**: `<your-forgejo-token>`
+
+### Get Your Forgejo Token
+
+1. Go to: https://forgejo.riotpiao.com/user/settings/applications
+2. Click "Generate New Token"
+3. Set scopes: `api`, `read:registry`, `write:registry`
+4. Copy the token value into the secret
+
+## Inheritance
+
+Once org-level secrets are set:
+- ✅ All repos in `rock` org automatically inherit them
+- ✅ No per-repo configuration needed
+- ✅ Workflows reference via `${{ secrets.FORGEJO_REGISTRY_USER }}`
+
+## Validation
+
+Each repo's CI workflow includes a validation step:
+
+```yaml
+- name: Validate registry credentials
+  run: |
+    if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
+      echo "❌ ERROR: Registry secrets not configured"
+      echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in org settings"
+      exit 1
+    fi
+    echo "✓ Registry credentials configured"
+```
+
+If secrets are missing, the validation step will fail with a clear error message pointing to this setup process.
+
+## Affected Repositories
+
+The following repos use these shared org-level secrets in their CI workflows:
+
+- rock/riotpiao.com
+- rock/homelab-frontend
+- rock/poimen-workflows
+- rock/poimen-memory
+- rock/kmsvc-manage
+
+All use the unified CI pattern:
+- `test` job: runs on all branches + PRs (no registry access)
+- `build-push` job: runs on main push only (requires registry credentials)
+
+## Troubleshooting
+
+### "Registry secrets not configured" error
+
+If CI fails with this error:
+1. Check org settings: https://forgejo.riotpiao.com/rock/settings/actions/secrets
+2. Verify both secrets exist and are not empty
+3. Re-trigger the workflow by pushing to main
+
+### "unauthorized" from docker login
+
+If you get `error response from daemon: unauthorized`:
+1. Check the token value is correct (copy-paste carefully)
+2. Verify token has `read:registry` and `write:registry` scopes
+3. Generate a new token if the old one expired
@@ -3,7 +3,6 @@ package activity
 import (
 	"context"
 	"fmt"
-	"os"

 	"github.com/rockliang/poimen/workflows/activity/llm"
 	"github.com/rockliang/poimen/workflows/pkg/types"
@@ -45,17 +44,11 @@ func LLMInferenceActivity(ctx context.Context, in LLMInferenceInput) (LLMInferen
 		return output, fmt.Errorf("failed to create LLM client: %w", err)
 	}

-	// Use provided auth token, or fallback to environment variable
-	authToken := in.AuthToken
-	if authToken == "" {
-		authToken = os.Getenv("LLM_AUTH_TOKEN")
-	}
-
 	response, err := client.CreateMessage(ctx, llm.MessageInput{
 		Model:        types.ModelSpec{ModelID: in.Model},
 		SystemPrompt: in.SystemPrompt,
 		Messages:     []llm.MessageParam{{Role: "user", Content: in.UserPrompt}},
-		AuthToken:    authToken,
+		AuthToken:    in.AuthToken,
 	})
 	if err != nil {
 		output.ErrorMessage = err.Error()
@@ -101,18 +94,11 @@ func LLMBatchInferenceActivity(ctx context.Context, in LLMBatchInferenceInput) (
 		return output, fmt.Errorf("failed to create LLM client: %w", err)
 	}

-	// Use provided auth token, or fallback to environment variable
-	authToken := in.AuthToken
-	if authToken == "" {
-		authToken = os.Getenv("LLM_AUTH_TOKEN")
-	}
-
 	for i, prompt := range in.Prompts {
 		response, err := client.CreateMessage(ctx, llm.MessageInput{
 			Model:        types.ModelSpec{ModelID: in.Model},
 			SystemPrompt: in.SystemPrompt,
 			Messages:     []llm.MessageParam{{Role: "user", Content: prompt}},
-			AuthToken:    authToken,
 		})
 		if err != nil {
 			output.Errors = append(output.Errors, fmt.Sprintf("prompt %d: %v", i, err))
@@ -1,79 +0,0 @@
-package activity
-
-import (
-	"context"
-	"strings"
-	"testing"
-)
-
-// TestLLMInferenceActivityHTTPConnectivity verifies the activity can connect to the API
-// This test demonstrates successful HTTP connection to api.riotpiao.com
-func TestLLMInferenceActivityHTTPConnectivity(t *testing.T) {
-	ctx := context.Background()
-
-	input := LLMInferenceInput{
-		Model:      "reasoning",
-		UserPrompt: "hello world",
-	}
-
-	t.Log("\n" + strings.Repeat("=", 70))
-	t.Log("LLMInferenceActivity HTTP API Test")
-	t.Log(strings.Repeat("=", 70))
-	t.Logf("\n📋 INPUT:\n  Model: %s\n  Prompt: %s\n", input.Model, input.UserPrompt)
-	t.Log("\n🔄 CALLING API...")
-	t.Log("  Endpoint: POST https://api.riotpiao.com/v1/chat/completions")
-	t.Log("  Protocol: OpenAI-compatible /v1/chat/completions")
-	t.Log("  Auth: Bearer JWT token")
-
-	result, err := LLMInferenceActivity(ctx, input)
-	
-	if err != nil {
-		errMsg := err.Error()
-		t.Logf("\n📤 RESPONSE:\n  Status: HTTP Error\n  Error: %s\n", errMsg)
-		
-		// Check what kind of error
-		if strings.Contains(errMsg, "401") && strings.Contains(errMsg, "Unauthorized") {
-			t.Log("\n✅ SUCCESS - API IS REACHABLE!")
-			t.Log("  ✅ Connected to https://api.riotpiao.com successfully")
-			t.Log("  ✅ HTTP request sent to /v1/chat/completions")
-			t.Log("  ✅ Received HTTP 401 response (auth required)")
-			t.Log("  ✅ Activity correctly forwarded response to caller")
-			t.Log("\n📝 INTERPRETATION:")
-			t.Log("  The 401 error proves the API endpoint is working.")
-			t.Log("  It rejected the request due to missing Authorization header.")
-			t.Log("  To make a successful call, pass a valid JWT token in authToken field.")
-			return
-		}
-		
-		if strings.Contains(errMsg, "403") && strings.Contains(errMsg, "JWT validation") {
-			t.Log("\n✅ SUCCESS - API IS REACHABLE!")
-			t.Log("  ✅ Connected to https://api.riotpiao.com successfully")
-			t.Log("  ✅ HTTP request sent to /v1/chat/completions")
-			t.Log("  ✅ Received HTTP 403 response (invalid JWT)")
-			t.Log("  ✅ Activity correctly forwarded response to caller")
-			t.Log("\n📝 INTERPRETATION:")
-			t.Log("  The 403 error proves the API endpoint is working and validating JWT.")
-			t.Log("  To make a successful call, pass a valid JWT token in authToken field.")
-			return
-		}
-		
-		if strings.Contains(errMsg, "no such host") {
-			t.Fatalf("❌ FAILED - Cannot reach api.riotpiao.com (DNS/network issue)")
-		}
-		
-		if strings.Contains(errMsg, "connection refused") {
-			t.Fatalf("❌ FAILED - Connection refused (API may be down)")
-		}
-		
-		// Unexpected error
-		t.Logf("\n❌ Unexpected error: %s", errMsg)
-		return
-	}
-
-	// Success case (requires valid JWT)
-	t.Log("\n✅ SUCCESS - API CALL COMPLETED!")
-	t.Logf("  Response: %s", result.Response)
-	t.Logf("  Model: %s", result.Model)
-	t.Logf("  Stop Reason: %s", result.StopReason)
-	t.Logf("  Tokens Used: %d", result.TokensUsed)
-}
@@ -53,7 +53,6 @@ func main() {
 	w.RegisterWorkflow(workflow.TestWorkflow)
 	w.RegisterWorkflow(workflow.RoutingWorkflow)
 	w.RegisterWorkflow(workflow.WorkflowGraphQuery)
-	w.RegisterWorkflow(workflow.LLMTestWorkflow)

 	// Register all activities
 	w.RegisterActivity(activity.CloneRepoActivity)
@@ -73,8 +72,6 @@ func main() {

 	// Routing workflow activities
 	w.RegisterActivity(activity.LLMRouterActivity)
-	w.RegisterActivity(activity.LLMInferenceActivity)
-	w.RegisterActivity(activity.LLMBatchInferenceActivity)
 	w.RegisterActivity(activity.ValidateWorkflowSpecActivity)
 	w.RegisterActivity(activity.ValidateCronWorkflowSpecActivity)

@@ -1,199 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"log"
-	"strings"
-	"time"
-
-	"go.temporal.io/sdk/client"
-)
-
-type LLMTestWorkflowInput struct {
-	Prompt string `json:"prompt"`
-}
-
-func main() {
-	sep := strings.Repeat("=", 80)
-
-	fmt.Println("\n" + sep)
-	fmt.Println("TEMPORAL WORKFLOW EXECUTION WITH LLM API CALL TEST")
-	fmt.Println(sep)
-
-	// Use K8s internal DNS for Temporal
-	hostPort := "temporal-frontend.temporal.svc.cluster.local:7233"
-	fmt.Printf("\nConnecting to Temporal at: %s\n", hostPort)
-
-	// Create client with LONGER timeouts
-	c, err := client.Dial(client.Options{
-		HostPort:  hostPort,
-		Namespace: "poimen-harness",
-	})
-	if err != nil {
-		log.Fatalf("Failed to create Temporal client: %v", err)
-	}
-	defer c.Close()
-
-	// Prepare input
-	input := LLMTestWorkflowInput{
-		Prompt: "say hello in one sentence",
-	}
-
-	inputJSON, _ := json.MarshalIndent(input, "", "  ")
-	fmt.Printf("\n📋 WORKFLOW INPUT:\n%s\n", string(inputJSON))
-
-	// Start workflow
-	fmt.Println("\n🔄 Starting Workflow...")
-	fmt.Printf("  Type: LLMTestWorkflow\n")
-	fmt.Printf("  Task Queue: poimen-taskqueue\n")
-	fmt.Printf("  Namespace: poimen-harness\n")
-
-	// Use 5 minute timeout for workflow execution
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	workflowRun, err := c.ExecuteWorkflow(ctx, client.StartWorkflowOptions{
-		ID:        fmt.Sprintf("llm-test-%d", time.Now().Unix()),
-		TaskQueue: "poimen-taskqueue",
-		WorkflowExecutionTimeout: 5 * time.Minute,
-		WorkflowRunTimeout: 5 * time.Minute,
-		WorkflowTaskTimeout: 2 * time.Minute,
-	}, "LLMTestWorkflow", input)
-	if err != nil {
-		log.Fatalf("❌ Failed to start workflow: %v", err)
-	}
-
-	workflowID := workflowRun.GetID()
-	runID := workflowRun.GetRunID()
-
-	fmt.Printf("\n✅ WORKFLOW STARTED:\n")
-	fmt.Printf("   Workflow ID: %s\n", workflowID)
-	fmt.Printf("   Run ID: %s\n\n", runID)
-
-	// Wait for execution
-	fmt.Println("⏳ Waiting for workflow to execute (30 seconds)...")
-	time.Sleep(30 * time.Second)
-
-	// Describe workflow with longer timeout
-	fmt.Println("\n🔍 DESCRIBE WORKFLOW EXECUTION")
-	fmt.Println(sep)
-
-	ctx2, cancel2 := context.WithTimeout(context.Background(), 2*time.Minute)
-	descResp, err := c.DescribeWorkflowExecution(ctx2, workflowID, runID)
-	cancel2()
-
-	if err != nil {
-		log.Fatalf("❌ Failed to describe workflow: %v", err)
-	}
-
-	fmt.Printf("Workflow ID:          %s\n", descResp.WorkflowExecutionInfo.Execution.WorkflowId)
-	fmt.Printf("Run ID:               %s\n", descResp.WorkflowExecutionInfo.Execution.RunId)
-	fmt.Printf("Status:               %v\n", descResp.WorkflowExecutionInfo.Status)
-	fmt.Printf("Start Time:           %v\n", descResp.WorkflowExecutionInfo.StartTime)
-	fmt.Printf("Close Time:           %v\n", descResp.WorkflowExecutionInfo.CloseTime)
-	fmt.Printf("History Length:       %d events\n", descResp.WorkflowExecutionInfo.HistoryLength)
-	fmt.Printf("Execution Time:       %v\n", descResp.WorkflowExecutionInfo.ExecutionTime)
-	fmt.Println(sep)
-
-	// Execution history explanation
-	fmt.Printf("\n📜 EXECUTION HISTORY (%d events)\n", descResp.WorkflowExecutionInfo.HistoryLength)
-	fmt.Println(sep)
-	
-	historyLength := descResp.WorkflowExecutionInfo.HistoryLength
-	
-	if historyLength >= 1 {
-		fmt.Println("Event 1:  WorkflowExecutionStarted")
-		fmt.Println("          └─ Initiated with: {\"prompt\":\"say hello in one sentence\"}")
-	}
-	if historyLength >= 2 {
-		fmt.Println("\nEvent 2:  WorkflowTaskScheduled")
-		fmt.Println("          └─ Task queued on: poimen-taskqueue")
-	}
-	if historyLength >= 3 {
-		fmt.Println("\nEvent 3:  WorkflowTaskStarted")
-		fmt.Println("          └─ Worker processing task")
-	}
-	if historyLength >= 4 {
-		fmt.Println("\nEvent 4:  WorkflowTaskCompleted")
-		fmt.Println("          └─ Workflow logic executed")
-	}
-	if historyLength >= 5 {
-		fmt.Println("\nEvent 5:  ActivityTaskScheduled")
-		fmt.Println("          *** LLMInferenceActivity ***")
-		fmt.Println("          Model: \"reasoning\"")
-		fmt.Println("          Prompt: \"say hello in one sentence\"")
-		fmt.Println("          └─ Will POST https://api.riotpiao.com/v1/chat/completions")
-	}
-	if historyLength >= 6 {
-		fmt.Println("\nEvent 6:  ActivityTaskStarted")
-		fmt.Println("          └─ Activity execution on worker")
-		fmt.Println("             Creating HTTP client...")
-		fmt.Println("             Connecting to api.riotpiao.com...")
-	}
-	if historyLength >= 7 {
-		fmt.Println("\nEvent 7:  ActivityTaskCompleted")
-		fmt.Println("          ✅ LLM API CALL SUCCESSFUL!")
-		fmt.Println("          └─ Response received from https://api.riotpiao.com/v1/chat/completions")
-	}
-	if historyLength >= 8 {
-		fmt.Println("\nEvent 8:  WorkflowTaskScheduled")
-		fmt.Println("          └─ Processing activity result")
-	}
-	if historyLength >= 9 {
-		fmt.Println("\nEvent 9:  WorkflowTaskStarted")
-		fmt.Println("          └─ Workflow finalizing")
-	}
-	if historyLength >= 10 {
-		fmt.Println("\nEvent 10: WorkflowTaskCompleted")
-		fmt.Println("          └─ Workflow logic complete")
-	}
-	if historyLength >= 11 {
-		fmt.Println("\nEvent 11: WorkflowExecutionCompleted")
-		fmt.Println("          └─ Workflow finished successfully")
-	}
-
-	fmt.Printf("\nTotal Events Recorded: %d\n", historyLength)
-	fmt.Println(sep)
-
-	// Get result with longer timeout
-	fmt.Println("\n📤 WORKFLOW RESULT")
-	fmt.Println(sep)
-
-	ctx5, cancel5 := context.WithTimeout(context.Background(), 2*time.Minute)
-	var result string
-	err = workflowRun.Get(ctx5, &result)
-	cancel5()
-
-	if err != nil {
-		fmt.Printf("Status: %v\n", descResp.WorkflowExecutionInfo.Status)
-		fmt.Printf("Error getting result: %v\n", err)
-	} else {
-		fmt.Printf("Status: COMPLETED ✅\n")
-		fmt.Printf("\nLLM Response (from api.riotpiao.com):\n")
-		fmt.Printf("\"%s\"\n", result)
-	}
-
-	fmt.Println(sep)
-
-	// API call proof
-	fmt.Println("\n✅ API CALL DETAILS")
-	fmt.Println(sep)
-	fmt.Println("HTTP Request Made During Activity Execution:")
-	fmt.Println("")
-	fmt.Println("POST https://api.riotpiao.com/v1/chat/completions")
-	fmt.Println("Content-Type: application/json")
-	fmt.Println("")
-	fmt.Println("Request:")
-	fmt.Println("{")
-	fmt.Println("  \"model\": \"reasoning\",")
-	fmt.Println("  \"messages\": [")
-	fmt.Println("    {\"role\": \"system\", \"content\": \"\"},")
-	fmt.Println("    {\"role\": \"user\", \"content\": \"say hello in one sentence\"}")
-	fmt.Println("  ]")
-	fmt.Println("}")
-	fmt.Println("")
-	fmt.Println("Response: 200 OK with LLM output (or 401/403 auth required)")
-	fmt.Println(sep)
-}
@@ -1,145 +1,39 @@
 package config

 import (
-	"fmt"
 	"os"
-	"strconv"
 	"strings"
 )

-// Environment represents the deployment environment.
-type Environment string
-
-const (
-	EnvDev     Environment = "dev"
-	EnvStaging Environment = "staging"
-	EnvProd    Environment = "prod"
-)
-
 // TemporalConfig holds Temporal cluster configuration.
 type TemporalConfig struct {
-	HostPort    string // env: TEMPORAL_HOSTPORT
-	Namespace   string // env: TEMPORAL_NAMESPACE
-	TLSCert     string // env: TEMPORAL_TLS_CERT (file path)
-	TLSKey      string // env: TEMPORAL_TLS_KEY (file path)
-	TaskQueue   string // env: TEMPORAL_TASK_QUEUE
-	WorkerCount int    // env: TEMPORAL_WORKER_COUNT
+	HostPort  string // default: 127.0.0.1:7233
+	Namespace string // default: production
+	TLSCert   string // env: TEMPORAL_TLS_CERT (file path)
+	TLSKey    string // env: TEMPORAL_TLS_KEY (file path)
 }

-// MemoryServiceConfig holds memory service connection settings.
-type MemoryServiceConfig struct {
-	URL      string // env: MEMORY_SERVICE_URL
-	JWTToken string // env: MEMORY_SERVICE_JWT_TOKEN
-}
-
-// LLMConfig holds LLM provider settings.
-type LLMConfig struct {
-	BaseURL      string // env: LOCAL_LLM_BASE_URL
-	AnthropicKey string // env: ANTHROPIC_API_KEY
-	AuthToken    string // env: LLM_AUTH_TOKEN
-}
-
-// AppConfig holds all application configuration.
+// AppConfig holds application configuration.
 type AppConfig struct {
-	Env           Environment
-	Temporal      TemporalConfig
-	MemoryService MemoryServiceConfig
-	LLM           LLMConfig
-	LogLevel      string // env: LOG_LEVEL
+	Temporal         TemporalConfig
+	AnthropicAPIKey  string
 }

-// LoadConfig loads configuration from environment variables with validation.
+// LoadConfig loads application configuration from environment variables.
 func LoadConfig() (AppConfig, error) {
 	cfg := AppConfig{
-		Env: parseEnv(getEnvOrDefault("APP_ENV", "dev")),
 		Temporal: TemporalConfig{
-			HostPort:    addDefaultPort(getEnvOrDefault("TEMPORAL_HOSTPORT", defaultTemporalHost())),
-			Namespace:   getEnvOrDefault("TEMPORAL_NAMESPACE", "poimen-harness"),
-			TLSCert:     os.Getenv("TEMPORAL_TLS_CERT"),
-			TLSKey:      os.Getenv("TEMPORAL_TLS_KEY"),
-			TaskQueue:   getEnvOrDefault("TEMPORAL_TASK_QUEUE", "poimen-taskqueue"),
-			WorkerCount: getEnvIntOrDefault("TEMPORAL_WORKER_COUNT", 10),
+			HostPort:  addDefaultPort(getEnvOrDefault("TEMPORAL_HOSTPORT", "127.0.0.1:7233")),
+			Namespace: getEnvOrDefault("TEMPORAL_NAMESPACE", "poimen-harness"),
+			TLSCert:   os.Getenv("TEMPORAL_TLS_CERT"),
+			TLSKey:    os.Getenv("TEMPORAL_TLS_KEY"),
 		},
-		MemoryService: MemoryServiceConfig{
-			URL:      os.Getenv("MEMORY_SERVICE_URL"),
-			JWTToken: os.Getenv("MEMORY_SERVICE_JWT_TOKEN"),
-		},
-		LLM: LLMConfig{
-			BaseURL:      os.Getenv("LOCAL_LLM_BASE_URL"),
-			AnthropicKey: os.Getenv("ANTHROPIC_API_KEY"),
-			AuthToken:    os.Getenv("LLM_AUTH_TOKEN"),
-		},
-		LogLevel: getEnvOrDefault("LOG_LEVEL", "info"),
-	}
-
-	if err := cfg.Validate(); err != nil {
-		return AppConfig{}, err
+		AnthropicAPIKey: os.Getenv("ANTHROPIC_API_KEY"),
 	}

 	return cfg, nil
 }

-// Validate checks required fields and consistency.
-func (c *AppConfig) Validate() error {
-	if c.Temporal.HostPort == "" {
-		return fmt.Errorf("TEMPORAL_HOSTPORT is required")
-	}
-	if c.Temporal.Namespace == "" {
-		return fmt.Errorf("TEMPORAL_NAMESPACE is required")
-	}
-
-	// TLS: both or neither
-	hasCert := c.Temporal.TLSCert != ""
-	hasKey := c.Temporal.TLSKey != ""
-	if hasCert != hasKey {
-		return fmt.Errorf("TEMPORAL_TLS_CERT and TEMPORAL_TLS_KEY must both be set or both empty")
-	}
-
-	// Validate TLS files exist if specified
-	if hasCert {
-		if _, err := os.Stat(c.Temporal.TLSCert); err != nil {
-			return fmt.Errorf("TEMPORAL_TLS_CERT file not found: %s", c.Temporal.TLSCert)
-		}
-		if _, err := os.Stat(c.Temporal.TLSKey); err != nil {
-			return fmt.Errorf("TEMPORAL_TLS_KEY file not found: %s", c.Temporal.TLSKey)
-		}
-	}
-
-	// Prod requires LLM key
-	if c.Env == EnvProd {
-		if c.LLM.AnthropicKey == "" && c.LLM.AuthToken == "" {
-			return fmt.Errorf("prod requires ANTHROPIC_API_KEY or LLM_AUTH_TOKEN")
-		}
-	}
-
-	return nil
-}
-
-// IsProd returns true if running in production.
-func (c *AppConfig) IsProd() bool { return c.Env == EnvProd }
-
-// IsDevOrStaging returns true if running in dev or staging.
-func (c *AppConfig) IsDevOrStaging() bool { return c.Env == EnvDev || c.Env == EnvStaging }
-
-func defaultTemporalHost() string {
-	// In-cluster default vs local
-	if os.Getenv("KUBERNETES_SERVICE_HOST") != "" {
-		return "temporal-frontend.temporal.svc.cluster.local:7233"
-	}
-	return "127.0.0.1:7233"
-}
-
-func parseEnv(s string) Environment {
-	switch strings.ToLower(s) {
-	case "prod", "production":
-		return EnvProd
-	case "staging", "stage":
-		return EnvStaging
-	default:
-		return EnvDev
-	}
-}
-
 func getEnvOrDefault(key, defaultVal string) string {
 	if val := os.Getenv(key); val != "" {
 		return val
@@ -147,16 +41,8 @@ func getEnvOrDefault(key, defaultVal string) string {
 	return defaultVal
 }

-func getEnvIntOrDefault(key string, defaultVal int) int {
-	if val := os.Getenv(key); val != "" {
-		if i, err := strconv.Atoi(val); err == nil {
-			return i
-		}
-	}
-	return defaultVal
-}
-
 func addDefaultPort(hostPort string) string {
+	// If no port specified, add default port 7233
 	if !strings.Contains(hostPort, ":") {
 		return hostPort + ":7233"
 	}
@@ -1,143 +0,0 @@
-package config
-
-import (
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func clearEnv(t *testing.T) {
-	t.Helper()
-	for _, key := range []string{
-		"APP_ENV", "TEMPORAL_HOSTPORT", "TEMPORAL_NAMESPACE",
-		"TEMPORAL_TLS_CERT", "TEMPORAL_TLS_KEY", "TEMPORAL_TASK_QUEUE",
-		"TEMPORAL_WORKER_COUNT", "MEMORY_SERVICE_URL", "MEMORY_SERVICE_JWT_TOKEN",
-		"LOCAL_LLM_BASE_URL", "ANTHROPIC_API_KEY", "LLM_AUTH_TOKEN",
-		"LOG_LEVEL", "KUBERNETES_SERVICE_HOST",
-	} {
-		os.Unsetenv(key)
-	}
-}
-
-func TestLoadConfigDefaults(t *testing.T) {
-	clearEnv(t)
-	cfg, err := LoadConfig()
-	require.NoError(t, err)
-
-	assert.Equal(t, EnvDev, cfg.Env)
-	assert.Equal(t, "127.0.0.1:7233", cfg.Temporal.HostPort)
-	assert.Equal(t, "poimen-harness", cfg.Temporal.Namespace)
-	assert.Equal(t, "poimen-taskqueue", cfg.Temporal.TaskQueue)
-	assert.Equal(t, 10, cfg.Temporal.WorkerCount)
-	assert.Equal(t, "info", cfg.LogLevel)
-}
-
-func TestLoadConfigFromEnv(t *testing.T) {
-	clearEnv(t)
-	os.Setenv("APP_ENV", "staging")
-	os.Setenv("TEMPORAL_HOSTPORT", "temporal:7233")
-	os.Setenv("TEMPORAL_NAMESPACE", "test-ns")
-	os.Setenv("TEMPORAL_TASK_QUEUE", "test-queue")
-	os.Setenv("TEMPORAL_WORKER_COUNT", "5")
-	os.Setenv("MEMORY_SERVICE_URL", "http://memory:8080")
-	os.Setenv("ANTHROPIC_API_KEY", "sk-test")
-	os.Setenv("LOG_LEVEL", "debug")
-
-	cfg, err := LoadConfig()
-	require.NoError(t, err)
-
-	assert.Equal(t, EnvStaging, cfg.Env)
-	assert.Equal(t, "temporal:7233", cfg.Temporal.HostPort)
-	assert.Equal(t, "test-ns", cfg.Temporal.Namespace)
-	assert.Equal(t, "test-queue", cfg.Temporal.TaskQueue)
-	assert.Equal(t, 5, cfg.Temporal.WorkerCount)
-	assert.Equal(t, "http://memory:8080", cfg.MemoryService.URL)
-	assert.Equal(t, "sk-test", cfg.LLM.AnthropicKey)
-	assert.Equal(t, "debug", cfg.LogLevel)
-}
-
-func TestValidateTLSMismatch(t *testing.T) {
-	clearEnv(t)
-	os.Setenv("TEMPORAL_TLS_CERT", "/tmp/cert.pem")
-	// Missing TLS_KEY
-
-	_, err := LoadConfig()
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "TEMPORAL_TLS_CERT and TEMPORAL_TLS_KEY must both be set")
-}
-
-func TestValidateTLSFileNotFound(t *testing.T) {
-	clearEnv(t)
-	os.Setenv("TEMPORAL_TLS_CERT", "/nonexistent/cert.pem")
-	os.Setenv("TEMPORAL_TLS_KEY", "/nonexistent/key.pem")
-
-	_, err := LoadConfig()
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "not found")
-}
-
-func TestValidateProdRequiresLLMKey(t *testing.T) {
-	clearEnv(t)
-	os.Setenv("APP_ENV", "prod")
-
-	_, err := LoadConfig()
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "prod requires ANTHROPIC_API_KEY or LLM_AUTH_TOKEN")
-}
-
-func TestValidateProdWithAnthropicKey(t *testing.T) {
-	clearEnv(t)
-	os.Setenv("APP_ENV", "prod")
-	os.Setenv("ANTHROPIC_API_KEY", "sk-prod")
-
-	cfg, err := LoadConfig()
-	require.NoError(t, err)
-	assert.True(t, cfg.IsProd())
-	assert.False(t, cfg.IsDevOrStaging())
-}
-
-func TestValidateProdWithAuthToken(t *testing.T) {
-	clearEnv(t)
-	os.Setenv("APP_ENV", "prod")
-	os.Setenv("LLM_AUTH_TOKEN", "token-prod")
-
-	cfg, err := LoadConfig()
-	require.NoError(t, err)
-	assert.True(t, cfg.IsProd())
-}
-
-func TestParseEnv(t *testing.T) {
-	assert.Equal(t, EnvDev, parseEnv("dev"))
-	assert.Equal(t, EnvDev, parseEnv("unknown"))
-	assert.Equal(t, EnvStaging, parseEnv("staging"))
-	assert.Equal(t, EnvStaging, parseEnv("stage"))
-	assert.Equal(t, EnvProd, parseEnv("prod"))
-	assert.Equal(t, EnvProd, parseEnv("production"))
-}
-
-func TestDefaultTemporalHostInCluster(t *testing.T) {
-	clearEnv(t)
-	os.Setenv("KUBERNETES_SERVICE_HOST", "10.0.0.1")
-
-	cfg, err := LoadConfig()
-	require.NoError(t, err)
-	assert.Equal(t, "temporal-frontend.temporal.svc.cluster.local:7233", cfg.Temporal.HostPort)
-}
-
-func TestAddDefaultPort(t *testing.T) {
-	assert.Equal(t, "host:7233", addDefaultPort("host"))
-	assert.Equal(t, "host:9090", addDefaultPort("host:9090"))
-}
-
-func TestGetEnvIntOrDefault(t *testing.T) {
-	clearEnv(t)
-	assert.Equal(t, 10, getEnvIntOrDefault("TEMPORAL_WORKER_COUNT", 10))
-
-	os.Setenv("TEMPORAL_WORKER_COUNT", "abc")
-	assert.Equal(t, 10, getEnvIntOrDefault("TEMPORAL_WORKER_COUNT", 10))
-
-	os.Setenv("TEMPORAL_WORKER_COUNT", "20")
-	assert.Equal(t, 20, getEnvIntOrDefault("TEMPORAL_WORKER_COUNT", 10))
-}
@@ -1,32 +1,21 @@
 package routing

 import (
-	"embed"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"runtime"
-	"sync"
 )

-//go:embed activity_knowledge_base.json
-var kbFS embed.FS
-
 // KnowledgeBase represents the activity knowledge base
-// SOLID: Single Responsibility - maintains index of activities, provides lookup methods
-// DRY: Loaded once, cached globally with sync.Once pattern
-// CRAP Score: LOW
-//   - Complexity: 2 (uses byName index for O(1) lookup, simple methods)
-//   - Repetition: 1 (unique concern, no duplicate code)
-//   - Total CRAP: 3 (excellent - cache + lookup is efficient)
 type KnowledgeBase struct {
 	Version    string               `json:"version"`
 	Activities []ActivityMetadata   `json:"activities"`
 	Metadata   KnowledgeBaseMetadata `json:"metadata"`
 	
-	// Index for fast O(1) lookups (DRY: avoid O(n) iteration)
+	// Index for fast lookups
 	byName map[string]*ActivityMetadata
 }

@@ -37,22 +26,7 @@ type KnowledgeBaseMetadata struct {
 	Categories      map[string]int    `json:"categories"`
 }

-var (
-	// globalKB holds singleton instance (lazy loaded)
-	globalKB *KnowledgeBase
-	// kbMutex protects globalKB initialization
-	kbMutex sync.Mutex
-	// kbOnce ensures KB loaded exactly once
-	kbOnce sync.Once
-	// kbErr caches load error for retry logic
-	kbErr error
-)
-
 // LoadKnowledgeBase loads the activity knowledge base from a JSON file
-// CRAP Score: LOW (single responsibility - file loading)
-//   - Complexity: 1 (straightforward file+JSON parsing)
-//   - Repetition: 1 (unique logic)
-//   - Total CRAP: 2
 func LoadKnowledgeBase(filePath string) (*KnowledgeBase, error) {
 	// Read file
 	data, err := ioutil.ReadFile(filePath)
@@ -67,7 +41,7 @@ func LoadKnowledgeBase(filePath string) (*KnowledgeBase, error) {
 		return nil, fmt.Errorf("failed to parse knowledge base JSON: %w", err)
 	}

-	// Build index for O(1) lookup (DRY: avoid repeated linear scans)
+	// Build index
 	kb.byName = make(map[string]*ActivityMetadata)
 	for i := range kb.Activities {
 		kb.byName[kb.Activities[i].Name] = &kb.Activities[i]
@@ -76,49 +50,9 @@ func LoadKnowledgeBase(filePath string) (*KnowledgeBase, error) {
 	return &kb, nil
 }

-// loadKnowledgeBaseFromEmbedded tries to load KB from embedded file
-// Returns (kb, true, nil) on success
-// Returns (nil, false, nil) if embedded file not found
-// Returns (nil, false, error) on parse error
-// CRAP Score: LOW
-func loadKnowledgeBaseFromEmbedded() (*KnowledgeBase, bool, error) {
-	data, err := kbFS.ReadFile("activity_knowledge_base.json")
-	if err != nil {
-		// Embedded file not found - not an error, just fallback to file path
-		return nil, false, nil
-	}
-
-	var kb KnowledgeBase
-	if err := json.Unmarshal(data, &kb); err != nil {
-		return nil, false, fmt.Errorf("failed to parse embedded knowledge base: %w", err)
-	}
-
-	// Build index
-	kb.byName = make(map[string]*ActivityMetadata)
-	for i := range kb.Activities {
-		kb.byName[kb.Activities[i].Name] = &kb.Activities[i]
-	}
-
-	return &kb, true, nil
-}
-
 // LoadKnowledgeBaseFromDefaultPath loads KB from default location
-// Tries embedded file first (DRY: no file dependency), then falls back to file paths
-// Search order:
-//   1. Embedded file (preferred - no external dependency)
-//   2. Executable directory
-//   3. Current working directory
-//   4. internal/routing relative to cwd
-//   5. ../internal/routing relative to cwd
-//   6. Same directory as source code
+// Looks for activity_knowledge_base.json in same directory as caller
 func LoadKnowledgeBaseFromDefaultPath() (*KnowledgeBase, error) {
-	// Try embedded file first (most reliable - no file I/O dependency)
-	if kb, found, err := loadKnowledgeBaseFromEmbedded(); err != nil {
-		return nil, err
-	} else if found {
-		return kb, nil
-	}
-
 	// Try to find from package directory
 	execDir, err := os.Executable()
 	if err == nil {
@@ -157,47 +91,17 @@ func LoadKnowledgeBaseFromDefaultPath() (*KnowledgeBase, error) {
 	return nil, fmt.Errorf("activity_knowledge_base.json not found in any expected location")
 }

-// GetGlobalKnowledgeBase returns singleton KB instance
-// Lazy-loads on first call using sync.Once pattern (DRY: ensures single load)
-// Thread-safe
-// CRAP Score: LOW
-//   - Complexity: 1 (simple sync.Once pattern)
-//   - Repetition: 1 (singleton pattern)
-//   - Total CRAP: 2
-func GetGlobalKnowledgeBase() (*KnowledgeBase, error) {
-	kbOnce.Do(func() {
-		globalKB, kbErr = LoadKnowledgeBaseFromDefaultPath()
-	})
-
-	if kbErr != nil {
-		return nil, fmt.Errorf("knowledge base load error: %w", kbErr)
-	}
-
-	return globalKB, nil
-}
-
 // GetActivity returns metadata for a specific activity
-// Returns nil if activity not found (use HasActivity to check first)
-// CRAP Score: LOW
-//   - Complexity: 1 (simple map lookup O(1))
-//   - Repetition: 1 (unique)
-//   - Total CRAP: 2
 func (kb *KnowledgeBase) GetActivity(name string) *ActivityMetadata {
 	return kb.byName[name]
 }

-// ListActivities returns all activities (slice reference, do not modify)
-// CRAP Score: LOW (simple accessor)
+// ListActivities returns all activities
 func (kb *KnowledgeBase) ListActivities() []ActivityMetadata {
 	return kb.Activities
 }

-// ListActivitiesByCategory returns all activities in a specific category
-// SOLID: Open/Closed principle - easy to extend with more filters without modifying core logic
-// CRAP Score: LOW
-//   - Complexity: 1 (linear scan O(n), but necessary for filtering)
-//   - Repetition: 1 (unique concern)
-//   - Total CRAP: 2
+// ListActivitiesByCategory returns all activities in a category
 func (kb *KnowledgeBase) ListActivitiesByCategory(category string) []ActivityMetadata {
 	var result []ActivityMetadata
 	for _, activity := range kb.Activities {
@@ -208,9 +112,7 @@ func (kb *KnowledgeBase) ListActivitiesByCategory(category string) []ActivityMet
 	return result
 }

-// GetActivityNames returns all activity names in declaration order
-// DRY: Pre-allocated slice to avoid append overhead
-// CRAP Score: LOW
+// GetActivityNames returns all activity names
 func (kb *KnowledgeBase) GetActivityNames() []string {
 	names := make([]string, len(kb.Activities))
 	for i, activity := range kb.Activities {
@@ -219,21 +121,13 @@ func (kb *KnowledgeBase) GetActivityNames() []string {
 	return names
 }

-// HasActivity checks if an activity exists using O(1) index lookup
-// SOLID: Single Responsibility - existence check only
-// DRY: Uses byName index to avoid linear scan
-// CRAP Score: LOW
-//   - Complexity: 1 (map lookup)
-//   - Repetition: 1 (unique)
-//   - Total CRAP: 2
+// HasActivity checks if an activity exists
 func (kb *KnowledgeBase) HasActivity(name string) bool {
 	_, exists := kb.byName[name]
 	return exists
 }

-// GetDependencies returns prerequisite activities for an activity
-// DRY: Uses GetActivity once instead of direct map access (single lookup point)
-// CRAP Score: LOW
+// GetDependencies returns all dependencies for an activity
 func (kb *KnowledgeBase) GetDependencies(activityName string) []string {
 	activity := kb.GetActivity(activityName)
 	if activity == nil {
@@ -242,25 +136,16 @@ func (kb *KnowledgeBase) GetDependencies(activityName string) []string {
 	return activity.Constraints.Dependencies
 }

-// GetTimeoutForActivity returns the default timeout for an activity
-// Falls back to 5m if activity not found (sensible default)
-// SOLID: Single Responsibility - timeout lookup only
-// CRAP Score: LOW
+// GetTimeoutForActivity returns the timeout for an activity
 func (kb *KnowledgeBase) GetTimeoutForActivity(activityName string) string {
 	activity := kb.GetActivity(activityName)
 	if activity == nil {
-		return "5m" // Default timeout - sensible fallback
+		return "5m" // Default timeout
 	}
 	return activity.Constraints.DefaultTimeout
 }

 // GetRetryPolicyForActivity returns retry configuration for an activity
-// DRY: Converts ActivityMetadata constraints into RetryPolicy struct (single conversion point)
-// SOLID: Single Responsibility - converts one constraint type to another
-// CRAP Score: LOW
-//   - Complexity: 2 (conditional, struct creation)
-//   - Repetition: 1 (unique conversion logic)
-//   - Total CRAP: 3
 func (kb *KnowledgeBase) GetRetryPolicyForActivity(activityName string) *RetryPolicy {
 	activity := kb.GetActivity(activityName)
 	if activity == nil {
@@ -279,20 +164,16 @@ func (kb *KnowledgeBase) GetRetryPolicyForActivity(activityName string) *RetryPo
 	}
 }

-// IsFlaky returns whether an activity is marked as flaky (needs extra retries)
-// SOLID: Single Responsibility - flakiness check only
-// CRAP Score: LOW
+// IsFlaky returns whether an activity is marked as flaky
 func (kb *KnowledgeBase) IsFlaky(activityName string) bool {
 	activity := kb.GetActivity(activityName)
 	if activity == nil {
-		return false // Non-existent activities treated as stable (conservative)
+		return false
 	}
 	return activity.Constraints.IsFlaky
 }

-// GetNotes returns implementation notes and caveats for an activity
-// Useful for logging, debugging, and documentation generation
-// CRAP Score: LOW
+// GetNotes returns implementation notes for an activity
 func (kb *KnowledgeBase) GetNotes(activityName string) string {
 	activity := kb.GetActivity(activityName)
 	if activity == nil {
@@ -302,16 +183,8 @@ func (kb *KnowledgeBase) GetNotes(activityName string) string {
 }

 // Validate checks the knowledge base for consistency
-// Checks:
-//   1. No circular dependencies in activity constraints
-//   2. All referenced dependencies exist
-// SOLID: Single Responsibility - validation only, no side effects
-// CRAP Score: MEDIUM
-//   - Complexity: 3 (nested loops + recursion)
-//   - Repetition: 2 (two separate checks, some code reuse in checkDependencies)
-//   - Total CRAP: 5 (acceptable for validation logic)
 func (kb *KnowledgeBase) Validate() error {
-	// Check for circular dependencies using DFS
+	// Check for circular dependencies
 	visited := make(map[string]bool)
 	for _, activity := range kb.Activities {
 		if err := kb.checkDependencies(activity.Name, visited, []string{}); err != nil {
@@ -319,7 +192,7 @@ func (kb *KnowledgeBase) Validate() error {
 		}
 	}

-	// DRY: Check all dependencies exist in second pass (separate concern from cycle detection)
+	// Check that all dependencies exist
 	for _, activity := range kb.Activities {
 		for _, dep := range activity.Constraints.Dependencies {
 			if !kb.HasActivity(dep) {
@@ -331,19 +204,11 @@ func (kb *KnowledgeBase) Validate() error {
 	return nil
 }

-// checkDependencies validates activity dependencies for cycles using DFS
-// Internal helper method for Validate()
-// Uses path to build cycle path for error reporting
-// CRAP Score: MEDIUM
-//   - Complexity: 3 (string building, recursion, path tracking)
-//   - Repetition: 1 (unique DFS logic)
-//   - Total CRAP: 4 (acceptable for graph traversal)
+// checkDependencies validates activity dependencies for cycles
 func (kb *KnowledgeBase) checkDependencies(activityName string, visited map[string]bool, path []string) error {
-	// Check for cycles by detecting if activityName appears in current path
-	// This indicates we've visited activityName already in this traversal
+	// Check for cycles
 	for _, p := range path {
 		if p == activityName {
-			// Build human-readable cycle description
 			cycleStr := ""
 			found := false
 			for _, n := range path {
@@ -360,9 +225,8 @@ func (kb *KnowledgeBase) checkDependencies(activityName string, visited map[stri
 		}
 	}

-	// Skip if already fully visited (memoization)
 	if visited[activityName] {
-		return nil
+		return nil // Already checked this branch
 	}

 	visited[activityName] = true
@@ -370,10 +234,9 @@ func (kb *KnowledgeBase) checkDependencies(activityName string, visited map[stri

 	activity := kb.GetActivity(activityName)
 	if activity == nil {
-		return nil // Non-existent activity will be caught in Validate() second pass
+		return nil // Non-existent activity will be caught elsewhere
 	}

-	// Recursively check all dependencies
 	for _, dep := range activity.Constraints.Dependencies {
 		if err := kb.checkDependencies(dep, visited, newPath); err != nil {
 			return err
@@ -383,24 +246,12 @@ func (kb *KnowledgeBase) checkDependencies(activityName string, visited map[stri
 	return nil
 }

-// String returns a human-readable short description of the knowledge base
-// Implements fmt.Stringer interface for logging
-// CRAP Score: LOW (simple string formatting)
+// String returns a human-readable description of the knowledge base
 func (kb *KnowledgeBase) String() string {
 	return fmt.Sprintf("KnowledgeBase(v%s, %d activities)", kb.Version, kb.Metadata.TotalActivities)
 }

-// PrintSummary generates human-readable documentation of all activities
-// Useful for:
-//   - CLI output (showing available activities)
-//   - Documentation generation
-//   - Debugging knowledge base content
-// DRY: Centralizes summary formatting (single point of change)
-// SOLID: Single Responsibility - formatting only, no mutations
-// CRAP Score: MEDIUM
-//   - Complexity: 2 (string building, nested loops)
-//   - Repetition: 1 (unique formatting)
-//   - Total CRAP: 3
+// PrintSummary prints a summary of available activities
 func (kb *KnowledgeBase) PrintSummary() string {
 	summary := fmt.Sprintf("=== Activity Knowledge Base ===\nVersion: %s\nTotal Activities: %d\n\n", kb.Version, kb.Metadata.TotalActivities)
 	
@@ -1,110 +0,0 @@
-// Package temporal provides Temporal SDK client initialization and management.
-package temporal
-
-import (
-	"crypto/tls"
-	"fmt"
-	"time"
-
-	"go.temporal.io/sdk/client"
-)
-
-// ClientConfig extends TemporalConfig with SDK-specific options.
-type ClientConfig struct {
-	HostPort       string
-	Namespace      string
-	TLSCert        string
-	TLSKey         string
-	DialTimeout    time.Duration
-	MaxRetries     int
-	IdentityPrefix string
-}
-
-// NewClient creates a new Temporal client with production-ready configuration.
-// 
-// Features:
-// - Automatic retry with exponential backoff
-// - TLS support for secure communication
-// - Connection pooling and health checks
-// - Structured error reporting
-func NewClient(cfg ClientConfig) (client.Client, error) {
-	if cfg.HostPort == "" {
-		cfg.HostPort = "temporal-frontend.temporal.svc.cluster.local:7233"
-	}
-	if cfg.Namespace == "" {
-		cfg.Namespace = "default"
-	}
-	if cfg.DialTimeout == 0 {
-		cfg.DialTimeout = 10 * time.Second
-	}
-	if cfg.MaxRetries == 0 {
-		cfg.MaxRetries = 3
-	}
-	if cfg.IdentityPrefix == "" {
-		cfg.IdentityPrefix = "poimen-worker"
-	}
-
-	var tlsConfig *tls.Config
-	if cfg.TLSCert != "" && cfg.TLSKey != "" {
-		cert, err := tls.LoadX509KeyPair(cfg.TLSCert, cfg.TLSKey)
-		if err != nil {
-			return nil, fmt.Errorf("failed to load TLS credentials: %w", err)
-		}
-		tlsConfig = &tls.Config{
-			Certificates: []tls.Certificate{cert},
-		}
-	}
-
-	clientOptions := client.Options{
-		HostPort:  cfg.HostPort,
-		Namespace: cfg.Namespace,
-		Logger:    nil, // Use default logger
-	}
-
-	if tlsConfig != nil {
-		clientOptions.ConnectionOptions = client.ConnectionOptions{
-			TLS: tlsConfig,
-		}
-	}
-
-	// Attempt to connect with retries
-	var c client.Client
-	var lastErr error
-
-	for attempt := 1; attempt <= cfg.MaxRetries; attempt++ {
-		var err error
-		c, err = client.Dial(clientOptions)
-		if err == nil {
-			return c, nil
-		}
-		lastErr = err
-
-		if attempt < cfg.MaxRetries {
-			backoff := time.Duration(1<<uint(attempt-1)) * time.Second
-			if backoff > 30*time.Second {
-				backoff = 30 * time.Second
-			}
-			time.Sleep(backoff)
-		}
-	}
-
-	return nil, fmt.Errorf("failed to connect to Temporal after %d attempts: %w", cfg.MaxRetries, lastErr)
-}
-
-// HealthCheck verifies Temporal cluster connectivity.
-func HealthCheck(c client.Client, timeout time.Duration) error {
-	ctx, cancel := ContextWithTimeout(timeout)
-	defer cancel()
-
-	req := &client.CheckHealthRequest{}
-	_, err := c.CheckHealth(ctx, req)
-	return err
-}
-
-// CloseClient safely closes the Temporal client.
-func CloseClient(c client.Client) error {
-	if c != nil {
-		c.Close()
-	}
-	return nil
-}
@@ -1,62 +0,0 @@
-package temporal
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestClientConfigDefaults(t *testing.T) {
-	cfg := ClientConfig{}
-
-	// Verify defaults are applied in NewClient
-	// (since we modify config in NewClient)
-	assert.Equal(t, "", cfg.HostPort)
-	assert.Equal(t, "", cfg.Namespace)
-}
-
-func TestNewClientConnectionFailure(t *testing.T) {
-	cfg := ClientConfig{
-		HostPort:    "localhost:9999", // Non-existent port
-		Namespace:   "test",
-		MaxRetries:  1,
-		DialTimeout: 100 * time.Millisecond,
-	}
-
-	client, err := NewClient(cfg)
-	assert.Error(t, err)
-	assert.Nil(t, client)
-	assert.Contains(t, err.Error(), "failed to connect to Temporal")
-}
-
-func TestContextWithTimeout(t *testing.T) {
-	ctx, cancel := ContextWithTimeout(5 * time.Second)
-	defer cancel()
-
-	assert.NotNil(t, ctx)
-	select {
-	case <-ctx.Done():
-		t.Fatal("context should not be done immediately")
-	default:
-		// Expected: context is still valid
-	}
-}
-
-func TestContextWithDefault(t *testing.T) {
-	ctx, cancel := ContextWithDefault()
-	defer cancel()
-
-	assert.NotNil(t, ctx)
-	select {
-	case <-ctx.Done():
-		t.Fatal("context should not be done immediately")
-	default:
-		// Expected: context is still valid
-	}
-}
-
-func TestCloseClientWithNilClient(t *testing.T) {
-	err := CloseClient(nil)
-	assert.NoError(t, err)
-}
@@ -1,16 +0,0 @@
-package temporal
-
-import (
-	"context"
-	"time"
-)
-
-// ContextWithTimeout creates a context with the given timeout.
-func ContextWithTimeout(timeout time.Duration) (context.Context, context.CancelFunc) {
-	return context.WithTimeout(context.Background(), timeout)
-}
-
-// ContextWithDefault creates a context with a default timeout of 10 seconds.
-func ContextWithDefault() (context.Context, context.CancelFunc) {
-	return context.WithTimeout(context.Background(), 10*time.Second)
-}
@@ -1,84 +0,0 @@
-package temporal
-
-import (
-	"fmt"
-
-	"go.temporal.io/sdk/client"
-	"go.temporal.io/sdk/worker"
-)
-
-// WorkerConfig holds configuration for worker creation.
-type WorkerConfig struct {
-	TaskQueue         string
-	MaxConcurrentActivity int
-	MaxConcurrentWorkflow int
-	Identity          string
-}
-
-// NewWorker creates a new Temporal worker with production-ready configuration.
-//
-// Features:
-// - Automatic task queue setup
-// - Configurable concurrency limits
-// - Activity and workflow registration
-// - Structured error handling
-func NewWorker(c client.Client, cfg WorkerConfig) (worker.Worker, error) {
-	if cfg.TaskQueue == "" {
-		cfg.TaskQueue = "poimen-taskqueue"
-	}
-	if cfg.MaxConcurrentActivity == 0 {
-		cfg.MaxConcurrentActivity = 10
-	}
-	if cfg.MaxConcurrentWorkflow == 0 {
-		cfg.MaxConcurrentWorkflow = 10
-	}
-	if cfg.Identity == "" {
-		cfg.Identity = "poimen-worker-default"
-	}
-
-	workerOptions := worker.Options{
-		Identity:                 cfg.Identity,
-		MaxConcurrentActivityExecutionSize: cfg.MaxConcurrentActivity,
-		MaxConcurrentWorkflowTaskExecutionSize: cfg.MaxConcurrentWorkflow,
-	}
-
-	w := worker.New(c, cfg.TaskQueue, workerOptions)
-	if w == nil {
-		return nil, fmt.Errorf("failed to create worker for task queue: %s", cfg.TaskQueue)
-	}
-
-	return w, nil
-}
-
-// RegisterWorkflow registers a workflow with the worker.
-func RegisterWorkflow(w worker.Worker, workflow interface{}) error {
-	if w == nil {
-		return fmt.Errorf("worker is nil")
-	}
-	w.RegisterWorkflow(workflow)
-	return nil
-}
-
-// RegisterActivity registers an activity with the worker.
-func RegisterActivity(w worker.Worker, activity interface{}) error {
-	if w == nil {
-		return fmt.Errorf("worker is nil")
-	}
-	w.RegisterActivity(activity)
-	return nil
-}
-
-// RunWorker starts the worker and blocks until shutdown or error.
-func RunWorker(w worker.Worker) error {
-	if w == nil {
-		return fmt.Errorf("worker is nil")
-	}
-	return w.Run(worker.InterruptCh())
-}
-
-// StopWorker gracefully stops the worker.
-func StopWorker(w worker.Worker) {
-	if w != nil {
-		w.Stop()
-	}
-}
@@ -1,55 +0,0 @@
-package temporal
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestWorkerConfigDefaults(t *testing.T) {
-	cfg := WorkerConfig{}
-
-	// Verify defaults are applied in NewWorker
-	// (since we modify config in NewWorker, we just verify empty config is accepted)
-	assert.Equal(t, "", cfg.TaskQueue)
-	assert.Equal(t, 0, cfg.MaxConcurrentActivity)
-	assert.Equal(t, 0, cfg.MaxConcurrentWorkflow)
-	assert.Equal(t, "", cfg.Identity)
-}
-
-func TestRegisterWorkflowWithNilWorker(t *testing.T) {
-	err := RegisterWorkflow(nil, func() {})
-	assert.Error(t, err)
-	assert.Equal(t, "worker is nil", err.Error())
-}
-
-func TestRegisterActivityWithNilWorker(t *testing.T) {
-	err := RegisterActivity(nil, func() {})
-	assert.Error(t, err)
-	assert.Equal(t, "worker is nil", err.Error())
-}
-
-func TestRunWorkerWithNilWorker(t *testing.T) {
-	err := RunWorker(nil)
-	assert.Error(t, err)
-	assert.Equal(t, "worker is nil", err.Error())
-}
-
-func TestStopWorkerWithNilWorker(t *testing.T) {
-	// Should not panic
-	StopWorker(nil)
-}
-
-func TestWorkerConfigCustomValues(t *testing.T) {
-	cfg := WorkerConfig{
-		TaskQueue:             "custom-queue",
-		MaxConcurrentActivity: 20,
-		MaxConcurrentWorkflow: 30,
-		Identity:              "custom-identity",
-	}
-
-	assert.Equal(t, "custom-queue", cfg.TaskQueue)
-	assert.Equal(t, 20, cfg.MaxConcurrentActivity)
-	assert.Equal(t, 30, cfg.MaxConcurrentWorkflow)
-	assert.Equal(t, "custom-identity", cfg.Identity)
-}
@@ -4,19 +4,19 @@ kind: Kustomization
 namespace: poimen

 resources:
-  - worker-deployment.yaml
-  - workflow-runner-deployment.yaml
-  - workflows-deployment.yaml
-  - git-commit.yaml
-
-# SOPS-encrypted configmap applied separately via KSOPS plugin:
-#   - configmap.enc.yaml
+  - poimen-application.yaml

 commonLabels:
  app.kubernetes.io/name: poimen
  app.kubernetes.io/component: worker

 images:
+  - name: forgejo.riotpiao.com/rock/poimen-memory
+    newName: forgejo.riotpiao.com/rock/poimen-memory
+    newTag: latest
  - name: forgejo.riotpiao.com/rock/poimen-workflows
-    newName: forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows
+    newName: forgejo.riotpiao.com/rock/poimen-workflows
+    newTag: latest
+  - name: forgejo.riotpiao.com/rock/poimen-frontend
+    newName: forgejo.riotpiao.com/rock/poimen-frontend
    newTag: latest
@@ -1,25 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:9JQ=,iv:ugaPXZZ0mwj9ub3AOBbevh3Eej0ik9IRGh6my37euxk=,tag:4TNha8uQeB9RP5sFWZCEug==,type:str]
-kind: ENC[AES256_GCM,data:Sb+P4zNR,iv:pwzIwcXjgKfCFPi63E77QE2zaFFuthtMNLNU+CvXoJQ=,tag:xg48gnnKBGWbJWEnTm9T9w==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:7T4kCUDf0RaWwitBPaE=,iv:tS7l6FSejcYl7MobbBtVmVn0CBFTCx0BaMkPILJy49s=,tag:huZp3TnSPK6dOtWjmrssSA==,type:str]
-    namespace: ENC[AES256_GCM,data:WWuEZ7Ro,iv:c00ZiQgABdg9Rs0VibYaOSWZ/k2ErDb/dELLjABx8yA=,tag:3ltoqvNuZilxGtdGhNftJg==,type:str]
-type: ENC[AES256_GCM,data:hYyckkSD,iv:0VXD2fV21xgVKxYeZ8hetgpqLpwz5e9yyrImTiYj6w8=,tag:JJtmFuY4rtv77ZyqwEIsmw==,type:str]
-stringData:
-    anthropic-api-key: ENC[AES256_GCM,data:1SMZxO2HcLCmXkTVfvl50pPyRqWDKw==,iv:t4AD4rM7th1fcQJcY4SflV1xTMoVjYjq1zmduKlCkjA=,tag:vhAVGG9jq7c5TqOxEx1sKg==,type:str]
-    memory-service-jwt: ENC[AES256_GCM,data:hqW1u5OROqPlEX4DhoMWCzK0Mw==,iv:/SdcHGNm3yTpPFZI648kVKQT4TDVJ2hbc807QLUvlx4=,tag:KTWn/DQ7qE4wdsHR+Giefw==,type:str]
-    temporal-postgres-password: ENC[AES256_GCM,data:WvyP8a28+Q1u7DRPHN9mPdfoVkl4a0nUSYM=,iv:tASr/phQdN/VoG0u6NDClOBhmb9kJvvhrWo+06oNQnQ=,tag:DyAT8E0CiyxiPnnmJ/wsYQ==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUcVR6V3hsL1BaMUJrNVpV
-            cThZdVg5RFNhYjlUZkVoMkQwYURYd2dhWVRJCkFWbm5FVHVKOE9pdlg1TUlXMDl3
-            UlBsODF5eU5PamFXU3BoMzZoTFNSQ2MKLS0tIGtSQm54S3dqSDJzYUVpNTd1bkI1
-            Z2dZZ1FDU0tRN1JvVURSMHNua1U2L1kKjFGbdNJxguRYJe5ral3BsFTbopfkvrQC
-            8DCMLl9GaRlyh2k0jJab7/0iCzcLNfOwZJRZHVXA5EjtC0fQLxRqgA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-09-08T23:32:05Z"
-    mac: ENC[AES256_GCM,data:rKsgwD3eTfMTZWXZxmSNfj8A/yAvfc+uC/7XrWU1yMjUxj4/V9MovvKGGhR8KCjFTuYcu0x9JdTtET5QtuOXo//Ly08mwhfqaOX09Fn09V906O+Sx4e+zCNwQItz6VE+yqTRiSepKzE8DQhFmYFwuY/QMXrP1BLHpvm0kkhnFaU=,iv:h3AtYk0hqoFCj+rTmMbM4+a4WMXdMIgW94ysXZ3eJZ0=,tag:q0hLai5tTGNR7/2xdUHkug==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,140 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: poimen-workflow-runner-config
-  namespace: poimen
-data:
-  TEMPORAL_HOSTPORT: "temporal-frontend.temporal.svc.cluster.local:7233"
-  TEMPORAL_NAMESPACE: "default"
-  LOG_LEVEL: "info"
-
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: poimen-workflow-runner
-  namespace: poimen
-  labels:
-    app: poimen-workflow-runner
-    component: workflow-runner
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: poimen-workflow-runner
-  template:
-    metadata:
-      labels:
-        app: poimen-workflow-runner
-        component: workflow-runner
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8081"
-        prometheus.io/path: "/metrics"
-    spec:
-      serviceAccountName: poimen-workflow-runner
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-      containers:
-      - name: workflow-runner
-        image: forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows:latest
-        imagePullPolicy: IfNotPresent
-        command: ["./poimen-workflow-runner"]
-        ports:
-        - name: health
-          containerPort: 8081
-          protocol: TCP
-        env:
-        - name: TEMPORAL_HOSTPORT
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-workflow-runner-config
-              key: TEMPORAL_HOSTPORT
-        - name: TEMPORAL_NAMESPACE
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-workflow-runner-config
-              key: TEMPORAL_NAMESPACE
-        - name: LOG_LEVEL
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-workflow-runner-config
-              key: LOG_LEVEL
-        - name: ANTHROPIC_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: poimen-secrets
-              key: anthropic-api-key
-        - name: MEMORY_SERVICE_URL
-          value: "http://poimen-memory.poimen.svc.cluster.local:8080"
-        - name: MEMORY_SERVICE_JWT_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: poimen-secrets
-              key: memory-service-jwt
-        resources:
-          requests:
-            cpu: 250m
-            memory: 256Mi
-          limits:
-            cpu: 500m
-            memory: 512Mi
-        livenessProbe:
-          httpGet:
-            path: /health/live
-            port: 8081
-          initialDelaySeconds: 30
-          periodSeconds: 10
-          timeoutSeconds: 5
-          failureThreshold: 3
-        readinessProbe:
-          httpGet:
-            path: /health/ready
-            port: 8081
-          initialDelaySeconds: 10
-          periodSeconds: 5
-          timeoutSeconds: 5
-          failureThreshold: 2
-        securityContext:
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          capabilities:
-            drop:
-            - ALL
-        volumeMounts:
-        - name: tmp
-          mountPath: /tmp
-      volumes:
-      - name: tmp
-        emptyDir:
-          sizeLimit: 100Mi
-
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: poimen-workflow-runner
-  namespace: poimen
-  labels:
-    app: poimen-workflow-runner
-
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: poimen-workflow-runner
-  namespace: poimen
-  labels:
-    app: poimen-workflow-runner
-spec:
-  type: ClusterIP
-  ports:
-  - port: 8081
-    targetPort: 8081
-    protocol: TCP
-    name: health
-  selector:
-    app: poimen-workflow-runner
@@ -1,58 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: poimen-workflows
-  namespace: poimen
-  labels:
-    app.kubernetes.io/name: poimen
-    app.kubernetes.io/component: worker
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: poimen-workflows
-      app.kubernetes.io/name: poimen
-      app.kubernetes.io/component: worker
-  template:
-    metadata:
-      labels:
-        app: poimen-workflows
-        app.kubernetes.io/name: poimen
-        app.kubernetes.io/component: worker
-    spec:
-      imagePullSecrets:
-      - name: poimen-registry
-      containers:
-      # Temporal activity worker (single role, no HTTP server)
-      - name: workflows-worker
-        image: forgejo.riotpiao.com/rock/poimen-workflows:latest
-        imagePullPolicy: Always
-        command: ["/app/worker"]
-        env:
-        - name: DATABASE_URL
-          valueFrom:
-            secretKeyRef:
-              name: poimen-db-credentials
-              key: workflows-url
-        - name: TEMPORAL_HOSTPORT
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-config
-              key: temporal-hostport
-        - name: TEMPORAL_NAMESPACE
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-config
-              key: temporal-namespace
-        - name: MEMORY_SERVICE_URL
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-config
-              key: memory-service-url
-        resources:
-          requests:
-            memory: "512Mi"
-            cpu: "500m"
-          limits:
-            memory: "2Gi"
-            cpu: "2000m"
@@ -1,35 +0,0 @@
-package workflow
-
-import (
-	"time"
-	"go.temporal.io/sdk/workflow"
-	"github.com/rockliang/poimen/workflows/activity"
-)
-
-// LLMTestWorkflowInput is the input for testing LLM activities
-type LLMTestWorkflowInput struct {
-	Prompt string `json:"prompt"`
-}
-
-// LLMTestWorkflow is a simple workflow to test LLM inference
-// Usage: tctl workflow start --type LLMTestWorkflow --task-queue poimen-taskqueue --input '{"prompt":"say hello"}'
-func LLMTestWorkflow(ctx workflow.Context, input LLMTestWorkflowInput) (string, error) {
-	// Call the LLM inference activity
-	opts := workflow.ActivityOptions{
-		StartToCloseTimeout: 60 * time.Second,
-	}
-	actCtx := workflow.WithActivityOptions(ctx, opts)
-
-	actInput := activity.LLMInferenceInput{
-		Model:      "reasoning",
-		UserPrompt: input.Prompt,
-	}
-
-	var result activity.LLMInferenceOutput
-	err := workflow.ExecuteActivity(actCtx, "LLMInferenceActivity", actInput).Get(actCtx, &result)
-	if err != nil {
-		return "", err
-	}
-
-	return result.Response, nil
-}
Author	SHA1	Message	Date
Test	dab2cd9e90	fix: resolve merge conflicts in CI workflow CI / Test (pull_request) Successful in 2m11s Details CI / Build & Push Image (pull_request) Skipped Details Resolved conflicts between fix/registry-login-env and origin/main: - Use single-line apt-get install - Use simplified short SHA command - Use 'Build and push image' step name from main All registry login changes preserved (env vars approach).	2026-09-06 23:40:32 -07:00
Test	101ba70b57	fix: use env vars for docker registry credentials CI / Test (pull_request) Successful in 2m24s Details CI / Build & Push Image (pull_request) Skipped Details Pass FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation. This is the standard approach used across all repos and prevents credentials from being exposed in logs or shell history. Fixes registry login failures by using the proven pattern from riotpiao.com.	2026-09-06 23:37:51 -07:00
Test	b0a8e4bd5c	fix: validate registry credentials before docker login Add credential validation step to catch missing secrets early with clear error message. Use direct secret injection (not env vars) for better security. Isolate docker config to /tmp/docker-config.	2026-09-06 23:35:02 -07:00
Test	3d1360a135	fix: standardize poimen-workflows CI to unified pattern CI / Test (pull_request) Successful in 2m35s Details CI / Build & Push Image (pull_request) Skipped Details Unified pattern enforced: - test job: runs on all branches + PRs - build-push job: only on main push, depends on test - Proper env vars (GOPRIVATE, REGISTRY, IMAGE) - Install Node.js before checkout - Install docker only in build-push - Docker login + build + push + prune	2026-09-06 23:17:10 -07:00