Release 0.4.0 — layered control plane (overlays, strict load, lazy federation) + CI

.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+# Per-PR CI pipeline for grimoire.
+# Runs on every pull request and push to main.
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint (ruff)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: ruff check
+        run: ruff check src/
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install -e ".[test]"
+
+      - name: Run tests
+        run: pytest tests/ -x

CHANGELOG.md

@@ -5,6 +5,100 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] — Layered Control Plane
+
+This release makes grimoire composable enough to serve as THE single prompt/
+tool/skill control plane for llmcore and wairu: a builtin (shipped) pack, an
+optional admin overlay, and a user overlay compose into one deterministic
+view for **every** artifact type.
+
+### Added
+- **`Grimoire.layered(roots)`** — build the facade over ordered
+  `(name, path, writable)` layers (lowest → highest precedence). All facade
+  APIs (conjure, tool_schemas, catalog, bind, validate, intent search)
+  resolve through the composed view.
+- **`CompositeRepoView`** — a read-only merged `GrimoireRepo` over layers,
+  covering ALL artifact types (spells, runes, promptlets, rituals, bundles,
+  skilldocs, default vars). Duck-type compatible with every existing
+  consumer, including in-memory runtime rune registration (runtime runes
+  drop on `reload()` by documented design).
+- **`LayeredGrimoire`** extended beyond spells: typed `get_*`/`list_*` for
+  all artifact types, per-key `default_vars` merge, and a generalized
+  `resolve_layer(artifact_id, kind)`.
+- **Strict repo loading** — `GrimoireRepo.load(..., strict=True)` raises
+  `RepoError` on artifact parse failures and duplicate ids (fail-loud mode
+  for control-plane overlays); `LayeredGrimoire.from_roots(..., strict=True)`
+  names the failing layer.
+- **`Grimoire.validate(layer=...)`** — validate a single layer in isolation
+  (startup validation of user overlays).
+- **Caches** — static host/git conjure builtins are computed once per engine
+  (previously two `git` subprocesses on *every* conjure); `catalog()` and
+  unfiltered `tool_schemas()` are memoized with `invalidate_caches()` (called
+  automatically on `reload()` and by runtime rune registration).
+
+### Changed
+- **Deterministic discovery** — artifact discovery is now `sorted()`; the
+  duplicate-id winner is stable (path-list order, then lexicographic file
+  order) instead of filesystem-dependent.
+- **`grimoire.federation` imports llmcore lazily** (PEP 562) and the llmcore
+  requirement is declared as the `federation` extra — grimoire's core has no
+  llmcore dependency, so llmcore can hard-depend on grimoire with no import
+  cycle.
+
+## [0.3.0] — Procedural Tools, MCP Server, Federation & OWASP Auditing
+
+This release turns grimoire into a stronger prompt and tool control plane:
+rune command schemas are exportable, spells and rune commands are discoverable
+by intent, and a JSON-RPC MCP server exposes rune tools and prompt endpoints
+to external runtimes. See `release_notes.md` for the full narrative.
+
+### Added — Rune command schema export
+- `runes/schema.py`: centralized `param_to_json_schema`,
+  `command_parameters_schema`, and `command_to_openai_tool_schema` helpers;
+  the llmcore/wairu binders and skilldoc selector now consume these instead
+  of duplicating schema-building logic.
+
+### Added — Intent-based procedural discovery
+- `Grimoire.find_by_intent(...)` (async) — rank spells against a natural-language
+  intent; returns `IntentMatch` results.
+- `Grimoire.find_tools_by_intent(...)` (async) — same for rune commands;
+  returns `ToolIntentMatch` results.
+- `procedural` package additions: `find_spells_by_intent_linear`,
+  `find_tools_by_intent_linear`, `build_spell_index_document`,
+  `build_rune_command_index_documents`, plus `ProceduralIndexer` /
+  `ProceduralRetriever` support for rune-command documents.
+- Semantiscan-backed smoke test covering grimoire discovery over semantiscan.
+
+### Added — MCP server (JSON-RPC)
+- New `mcp_server` package (auth, execution, handlers, models, server):
+  exposes the rune tool manifest, tool calls, and prompt endpoints over
+  JSON-RPC via FastAPI.
+- `grimoire mcp serve` CLI command (`--host`, `--port`, `--endpoint`).
+- `Grimoire.to_mcp_tool_manifest(...)` and `Grimoire.tool_schemas(...)` on the
+  public API.
+- New `mcp` optional extra pulling in `fastapi` and `uvicorn`.
+
+### Added — Federation adapters
+- `federation.py`: `federate_mcp_request/response/tool_call` and
+  `federate_rune_command(s)` adapters that normalize MCP and rune activity
+  into ecosystem federation events.
+
+### Added — OWASP metadata & auditing
+- Rune contracts (rune-level and per-command) accept `owasp_categories`
+  metadata, preserved through parsing and carried into binder/manifest
+  exports and federation events.
+- `grimoire rune audit` CLI command producing an OWASP coverage report
+  (`--filter-owasp` category filter, `--require-owasp` strict mode).
+
+### Added — Wairu runtime adapter
+- `bind/wairu.py`: `wairu_tool_to_rune`, `wairu_tools_to_runes`, and
+  `register_wairu_plugin_tools` — convert wairu tool definitions back into
+  rune specs and register grimoire tools with a wairu plugin runtime.
+
+### Changed
+- llmcore and wairu binders consume the centralized rune command schema
+  export (richer tool surface, less duplicated logic).
+
 ## [0.2.0] — Attributes, Tag Search, Spell Write API, Layered Overlays
 
 This release adds the grimoire-side foundation for the Convergence **v0.8.0**

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "grimoire"
-version = "0.3.0"
+version = "0.4.0"
 description = "Prompt & tool control plane for the llmcore ecosystem — spells, rituals, runes."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -42,6 +42,13 @@ mcp = [
     "fastapi>=0.110.0",
     "uvicorn>=0.29.0",
 ]
+# grimoire.federation adapts rune/MCP surfaces to llmcore's ecosystem event
+# envelope. Declared (not installed by default) because the hard dependency
+# edge in the ecosystem points the other way: llmcore depends on grimoire.
+# llmcore is not on PyPI — install from GitHub when enabling this extra.
+federation = [
+    "llmcore>=0.52.0",
+]
 test = [
     "pytest>=7.0.0",
     "pytest-cov>=4.0.0",