feat: D1 Durable Dana Conversation — restart-resumable ACP agent

.github/workflows/pr-lint-and-test.yml

@@ -1,5 +1,11 @@
 # Lint + test on pull requests to protected branches
 # Skips live and deep tests — those require API keys and run locally
+#
+# Two lanes:
+#   * PRs to develop + manual dispatch  → fast lane, no postgres service,
+#     postgres parametrizations deselected (-k "not postgres")
+#   * PRs to master                     → full lane, real postgres:16 service,
+#     session-journal contract exercised against both backends
 
 name: PR Lint & Test
 
@@ -10,6 +16,8 @@ on:
 
 jobs:
   lint-and-test:
+    # Fast lane: everything except PRs into master
+    if: github.event_name != 'pull_request' || github.base_ref != 'master'
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -22,6 +30,59 @@ jobs:
         uses: astral-sh/setup-uv@v6
         with:
           enable-cache: true
+          # Pin uv to the matrix python — otherwise uv resolves its own
+          # interpreter and the "(3.12)" job name lies about what ran.
+          python-version: ${{ matrix.python-version }}
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Lint
+        run: uv run ruff check dana/
+
+      - name: Run tests (no live, no deep, no postgres)
+        env:
+          DANA_MOCK_LLM: "true"
+          DANA_USE_REAL_LLM: "false"
+        # No postgres service on this lane — deselect the [postgres]
+        # parametrizations so they skip-by-selection instead of failing
+        # their CI=true-without-DSN contract check.
+        run: uv run pytest tests/ -m "not live and not deep" -k "not postgres" -v --maxfail=10 --tb=short --durations=10
+
+  lint-and-test-postgres:
+    # Full lane: only PRs into master get the real-database contract
+    if: github.event_name == 'pull_request' && github.base_ref == 'master'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.12"]
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
@@ -34,8 +95,9 @@ jobs:
       - name: Lint
         run: uv run ruff check dana/
 
-      - name: Run tests (no live, no deep)
+      - name: Run tests (no live, no deep, with postgres contract)
         env:
           DANA_MOCK_LLM: "true"
           DANA_USE_REAL_LLM: "false"
+          DANA_TEST_POSTGRES_DSN: postgresql://postgres:postgres@localhost:5432/postgres
         run: uv run pytest tests/ -m "not live and not deep" -v --maxfail=10 --tb=short --durations=10

.github/workflows/publish.yml

@@ -0,0 +1,96 @@
+# Publish dana-agent to PyPI on v* tags.
+#
+# Trigger chain: merge develop → master makes release-on-merge-to-master.yml
+# push a `v{version}` tag (version read from pyproject.toml); that tag
+# triggers this workflow, which builds sdist+wheel, verifies the tag matches
+# the pyproject version, and uploads via PyPI Trusted Publishing (OIDC) —
+# no API tokens stored as secrets.
+#
+# ONE-TIME MAINTAINER STEP (required before the first real upload):
+# On pypi.org, add a Trusted Publisher for this repo — project "dana-agent",
+# owner aitomatic, repository dana-runtime, workflow publish.yml,
+# environment "pypi". Repeat on test.pypi.org with environment "testpypi"
+# if the dry-run target is used. Until then the upload step fails with a
+# trusted-publisher error (builds and checks still pass).
+#
+# Manual dry-runs: Actions → Publish to PyPI → Run workflow.
+#   - dry_run=true (default): build + twine check only, no upload.
+#   - testpypi=true: upload to test.pypi.org instead of pypi.org.
+
+name: Publish to PyPI
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      testpypi:
+        description: "Upload to test.pypi.org instead of pypi.org"
+        type: boolean
+        default: false
+      dry_run:
+        description: "Build and check artifacts without uploading"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    # Tag push → production. Manual run → testpypi environment (only used
+    # when actually uploading; dry runs skip the upload step).
+    environment: ${{ github.event_name == 'push' && 'pypi' || 'testpypi' }}
+    permissions:
+      id-token: write # PyPI Trusted Publishing (OIDC)
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Read version from pyproject.toml
+        id: version
+        run: |
+          VERSION=$(grep -m1 '^version' pyproject.toml | sed 's/.*"\(.*\)"/\1/')
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Version: $VERSION"
+
+      - name: Verify tag matches pyproject version
+        if: github.event_name == 'push'
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          EXPECTED="v${{ steps.version.outputs.version }}"
+          if [ "$TAG" != "$EXPECTED" ]; then
+            echo "Tag $TAG does not match pyproject version $EXPECTED"
+            exit 1
+          fi
+          echo "Tag $TAG matches pyproject version $EXPECTED"
+
+      - name: Build sdist and wheel
+        run: |
+          rm -rf dist
+          uv build
+          ls -la dist/
+
+      - name: Check metadata (twine check)
+        run: uvx twine check dist/*
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dana-agent-${{ steps.version.outputs.version }}
+          path: dist/*
+
+      - name: Publish to PyPI
+        if: github.event_name == 'push' || inputs.testpypi
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: "${{ inputs.testpypi && 'https://test.pypi.org/legacy/' || '' }}"
+
+      - name: Publish skipped (dry run)
+        if: github.event_name != 'push' && !inputs.testpypi
+        run: echo 'Dry run — artifacts built and checked, no upload performed'

.gitignore

@@ -213,7 +213,16 @@ data/
 plans/
 .repomixignore
 AGENTS.md
+CLAUDE.md
+/sprint/
+/v2/
+# agent tool dirs / local scratch (NOT project source — analogous to .claude/.opencode)
+.agents/
+.codegraph/
+.codex/
+.superpowers/
+memories/
 release-manifest.json
 repomix-output.xml
 
-.DS_Store
+.DS_Store.worktree/

CONTEXT.md

@@ -0,0 +1,87 @@
+# Dana Agent Runtime
+
+Dana runs stateful STAR agent conversations across terminal, ACP, and future hosts while preserving one coherent record of each session.
+
+## Session History
+
+**Session Journal**:
+The sole durable authority for the ordered facts produced during one agent session. Facts remain available until explicit session deletion; large payloads may be retained separately as referenced artifacts.
+_Avoid_: Timeline, execution log, transcript
+
+**Owner Scope**:
+The immutable tenant or principal scope that owns a Session Journal and its artifacts. Every session operation remains within this scope, including forks and projections.
+_Avoid_: User field, optional tenant filter
+
+**Journal Fact**:
+An immutable, typed, and ordered statement about session activity. Content streams use bounded facts and an explicit final fact rather than treating each token as durable history.
+_Avoid_: Event, log line, token delta
+
+**Conversation View**:
+The model-facing projection of a Session Journal, including the active compression checkpoint and retained recent conversation.
+_Avoid_: Timeline snapshot, chat history
+
+**Thought Summary**:
+A sanitized reasoning update intentionally safe for host display and durable session history. It is distinct from hidden model reasoning and provider replay state.
+_Avoid_: Chain of thought, raw reasoning
+
+**Provider Replay State**:
+Protected model-provider material required to continue a conversation faithfully. It is not host-visible session history or an ordinary Journal Fact.
+_Avoid_: Thought, trace, reasoning log
+
+**Compression Checkpoint**:
+A typed, immutable Session Journal fact containing a summarized Conversation View for an exact committed sequence range. It records its projection version and provenance without replacing the facts it summarizes.
+_Avoid_: Compact session, summary message
+
+**Interrupted Turn**:
+A turn that started but has no terminal Journal Fact. Partial output remains visible to hosts, while unfinished tool outcomes remain unknown and the Conversation View does not treat the partial answer as complete.
+_Avoid_: Failed turn, cancelled turn
+
+**Committed Turn**:
+A turn closed by exactly one terminal Journal Fact. Only committed turn boundaries are valid fork points.
+_Avoid_: Completed request
+
+**Session Fork**:
+A new Session Journal that inherits conversation history through an immutable reference to a parent session's committed turn. Parent facts are not copied into the child journal.
+_Avoid_: Session copy, cloned transcript
+
+## Tool Execution
+
+**Tool Catalog**:
+The versioned set of tools available to one session. A turn uses one immutable catalog version for both model presentation and invocation resolution.
+_Avoid_: Global registry, tool list
+
+**Tool Identity**:
+The stable, provider-neutral identity of a tool within its source. Model-provider aliases and user-facing names may vary without changing journal or policy identity.
+_Avoid_: Function name, display name, provider alias
+
+**Operation**:
+A normalized request to invoke a tool, described by its effects, validated arguments, and affected locations. Permission policy evaluates Operations rather than provider aliases or hard-coded tool names.
+_Avoid_: Tool call dictionary, command
+
+**Permission Mode**:
+A session setting that controls when an otherwise permitted Operation requires user confirmation. Permission Modes never override hard policy.
+_Avoid_: Security level, sandbox mode
+
+**Policy Grant**:
+A durable, revocable rule that allows or rejects matching Operations within an explicit Owner Scope, workspace, Tool Identity, effect, and location scope. Hard policy always overrides an allow grant.
+_Avoid_: Remembered click, permission history, global wildcard
+
+**Policy Preflight**:
+A non-authorizing check that compares a workflow's declared Operations with hard policy and Policy Grants before execution. Dynamic Operations remain subject to invocation-time enforcement.
+_Avoid_: Permission bypass, automatic approval
+
+**Tool Execution Engine**:
+The session-owned module that authorizes, runs, cancels, and terminalizes every tool invocation while recording its ordered Journal Facts.
+_Avoid_: Tool wrapper, direct dispatch
+
+**Cancellation Capability**:
+A Tool Catalog declaration of how an invocation acknowledges cancellation. Cooperative thread tools declare and verify a maximum cancellation latency; hard cancellation requires a killable worker or acknowledged remote cancellation.
+_Avoid_: Thread kill, best-effort stop
+
+**Durable Job**:
+Background work that has accepted ownership independently of its originating turn, with its own journal identity and cancellation handle. Work remains part of the parent cancellation tree until this handoff completes.
+_Avoid_: Detached thread, fire-and-forget task
+
+**MCP Lease**:
+A session's scoped right to use one validated MCP server configuration and credential scope. Connection pooling is an internal optimization and does not change session ownership or tool visibility.
+_Avoid_: Global MCP registration, shared server object