Jon Chery
8bcf7296d5
REQ-223: mcp/atelier/server.py plugin-registry MCP server (stdio, D-135). NovaAtelierServer wraps MCPServer (SDK v2, D-137) if installed; degrades to _ToolRegistry fallback if SDK absent (testable in CI without SDK). plugins/principles.py (lookup_principle, list_domains, matrix_lookup) + plugins/validation.py (validate_against_principles — agentic validation beyond Wiz/Checkmarx/Mend). 4 tools, 2 plugins. REQ-224: mcp/atelier/vendor/ pinned Atelier v0.3.6 (D-136) — core/ first-principles, domains/security/first-principles, review/agent-checklist, matrix/principles-matrix. vendor/VERSION.md + scripts/update_atelier_vendor.sh for intentional upgrades. mcp/atelier/README.md (tools, architecture, running, vendoring, extensibility, transport). REQ-225: tests/test_atelier_mcp.py — 16 tests, all pass. Covers: plugin discovery (both loaded), 4 tools registered, lookup_security_P4 (+P1, unknown domain/principle), list_domains (19, security-relevant, ui-ux-not), matrix_lookup (security 10 P-rules, unknown), validation (good-passes, bad-secret-fails, bad-swallowed-error-fails, bad-obfuscated-names-fails, result-structure). ---ci--- project: acdl phase: 5 milestone: v1.18 status: execute requirements: covered: [REQ-223, REQ-224, REQ-225] partial: [] ---/ci---
45 lines
1.7 KiB
Bash
Executable File
45 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# scripts/update_atelier_vendor.sh — intentionally upgrade the vendored Atelier snapshot.
|
|
# Usage: bash scripts/update_atelier_vendor.sh <new-tag>
|
|
set -euo pipefail
|
|
TAG="${1:?Usage: update_atelier_vendor.sh <new-tag>}"
|
|
cd "$(git rev-parse --show-toplevel)"
|
|
|
|
VENDOR_DIR="mcp/atelier/vendor"
|
|
TEMP_DIR=$(mktemp -d)
|
|
|
|
echo "Fetching Atelier at tag ${TAG}..."
|
|
git clone --depth 1 --branch "${TAG}" https://git.cloudinit.dev/coreci/atelier.git "${TEMP_DIR}/atelier" 2>&1 | tail -3
|
|
|
|
echo "Replacing vendored snapshot..."
|
|
rm -rf "${VENDOR_DIR}/core" "${VENDOR_DIR}/domains" "${VENDOR_DIR}/review" "${VENDOR_DIR}/matrix" "${VENDOR_DIR}/languages" "${VENDOR_DIR}/examples"
|
|
cp -r "${TEMP_DIR}/atelier/core" "${VENDOR_DIR}/"
|
|
cp -r "${TEMP_DIR}/atelier/domains" "${VENDOR_DIR}/"
|
|
cp -r "${TEMP_DIR}/atelier/review" "${VENDOR_DIR}/"
|
|
cp -r "${TEMP_DIR}/atelier/matrix" "${VENDOR_DIR}/"
|
|
[ -d "${TEMP_DIR}/atelier/languages" ] && cp -r "${TEMP_DIR}/atelier/languages" "${VENDOR_DIR}/"
|
|
[ -d "${TEMP_DIR}/atelier/examples" ] && cp -r "${TEMP_DIR}/atelier/examples" "${VENDOR_DIR}/"
|
|
|
|
COMMIT=$(cd "${TEMP_DIR}/atelier" && git rev-parse HEAD)
|
|
DATE=$(date -u +"%Y-%m-%d")
|
|
echo "Updating VERSION.md..."
|
|
cat > "${VENDOR_DIR}/VERSION.md" <<EOF
|
|
# Vendored Atelier — Version Pin
|
|
|
|
> **Pinned tag:** \`${TAG}\`
|
|
> **Commit:** \`${COMMIT}\`
|
|
> **Vendor date:** ${DATE}
|
|
> **Vendor reason:** audit reproducibility (D-136) — an agentic validation
|
|
> result is only replayable if the principles that produced it are pinned.
|
|
|
|
## Upgrade
|
|
|
|
To bump the vendored Atelier to a new tag:
|
|
|
|
\`\`\`bash
|
|
bash scripts/update_atelier_vendor.sh <new-tag>
|
|
\`\`\`
|
|
EOF
|
|
|
|
rm -rf "${TEMP_DIR}"
|
|
echo "Vendored Atelier updated to ${TAG}. Review the diff and commit." |