chore: import upstream snapshot with attribution

.github/workflows/ci.yml

@@ -0,0 +1,468 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "surfaces/**"
+      - "config/**"
+      - "core/**"
+      - "platform/deployment/**"
+      - "integrations/**"
+      - "platform/**"
+      - "tools/**"
+      - "tests/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "pytest.ini"
+      - "ruff.toml"
+      - "mypy.ini"
+      - "Makefile"
+      - ".importlinter"
+      - ".importlinter.strict"
+      - ".github/ci/**"
+      - ".github/workflows/ci.yml"
+
+  pull_request:
+    branches: [main]
+    paths:
+      - "surfaces/**"
+      - "config/**"
+      - "core/**"
+      - "platform/deployment/**"
+      - "integrations/**"
+      - "platform/**"
+      - "tools/**"
+      - "tests/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "pytest.ini"
+      - "ruff.toml"
+      - "mypy.ini"
+      - "Makefile"
+      - ".importlinter"
+      - ".importlinter.strict"
+      - ".github/ci/**"
+      - ".github/workflows/ci.yml"
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  PYTHON_SOURCE_PATHS: "config core integrations platform surfaces tools"
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: quality (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    continue-on-error: ${{ matrix.os == 'windows-latest' }}
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            pyproject.toml
+            uv.lock
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Lint
+        run: uv run python -m ruff check $PYTHON_SOURCE_PATHS tests/
+
+      - name: Format check
+        run: uv run python -m ruff format --check $PYTHON_SOURCE_PATHS tests/
+
+      - name: Typecheck
+        run: uv run python -m mypy $PYTHON_SOURCE_PATHS
+
+      - name: Import graph
+        run: uv run python .github/ci/check_imports.py --strict
+
+      # Full layered contracts (.importlinter.strict), not the minimal default
+      # .importlinter config used by ``make check-imports``.
+      - name: Import boundaries
+        run: uv run lint-imports --config .importlinter.strict
+
+  test:
+    name: test (${{ matrix.shard }})
+    strategy:
+      fail-fast: false
+      max-parallel: 5
+      matrix:
+        include:
+          - os: ubuntu-latest
+            shard: tools-runtime
+            # ``tests/core/agent`` is excluded here; it runs in cli-runtime,
+            # which pins openai for its live action-planning oracles.
+            extra_pytest_args: >-
+              --ignore=tests/core/agent
+            pytest_paths: >-
+              tests/tools
+              tests/core
+              tests/platform
+              tests/utils
+              tests/masking
+              tests/watch_dog
+          - os: ubuntu-latest
+            shard: cli-runtime
+            # Live shell action-agent contracts are validated on openai,
+            # matching interactive-shell-live.yml. The
+            # default anthropic tool-call model (haiku) cannot reliably perform
+            # compound action planning, so pin this shard to openai.
+            # ``tests/core/agent`` runs here because it contains the live
+            # action-planning oracles (``test_live_action_planning`` and
+            # ``test_live_turn_execution_oracle``) that need the openai pin —
+            # plus the static ``test_import_boundaries`` guard the surfaces
+            # restructure (#3299) added.
+            llm_provider: openai
+            pytest_paths: >-
+              tests/cli
+              tests/interactive_shell
+              tests/agent
+              tests/core/agent
+              tests/fleet_monitoring
+              tests/analytics
+              tests/tools/investigation
+              tests/delivery
+              tests/sandbox
+              tests/hermes
+          - os: ubuntu-latest
+            shard: integrations-and-misc
+            pytest_paths: >-
+              tests/integrations
+              tests/deployment
+              tests/benchmarks
+              tests/chaos_engineering
+              tests/shared
+              tests/config
+              tests/github_ci
+              tests/packaging
+              tests/scheduler
+              gateway/tests
+          - os: ubuntu-latest
+            shard: e2e-general
+            pytest_paths: >-
+              tests/e2e
+            extra_pytest_args: >-
+              --ignore=tests/e2e/kubernetes
+              --ignore=tests/e2e/openclaw
+              --ignore=tests/e2e/upstream_lambda
+              --ignore=tests/e2e/upstream_prefect_ecs_fargate
+              --ignore=tests/e2e/upstream_apache_flink_ecs
+          - os: ubuntu-latest
+            shard: e2e-provider-and-openclaw
+            pytest_paths: >-
+              tests/e2e/openclaw
+              tests/e2e/upstream_lambda
+              tests/e2e/upstream_prefect_ecs_fargate
+              tests/e2e/upstream_apache_flink_ecs
+              tests/e2e/kubernetes
+
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+
+    env:
+      # Per-shard LLM provider for live_llm contracts; defaults to anthropic.
+      LLM_PROVIDER: ${{ matrix.llm_provider || 'anthropic' }}
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      JWT_TOKEN: ${{ secrets.JWT_TOKEN }}
+      GRAFANA_READ_TOKEN: ${{ secrets.GRAFANA_READ_TOKEN }}
+      GCLOUD_HOSTED_METRICS_ID: ${{ secrets.GCLOUD_HOSTED_METRICS_ID }}
+      GCLOUD_HOSTED_METRICS_URL: ${{ secrets.GCLOUD_HOSTED_METRICS_URL }}
+      GCLOUD_HOSTED_LOGS_ID: ${{ secrets.GCLOUD_HOSTED_LOGS_ID }}
+      GCLOUD_HOSTED_LOGS_URL: ${{ secrets.GCLOUD_HOSTED_LOGS_URL }}
+      GCLOUD_RW_API_KEY: ${{ secrets.GCLOUD_RW_API_KEY }}
+      GCLOUD_OTLP_ENDPOINT: ${{ secrets.GCLOUD_OTLP_ENDPOINT }}
+      GCLOUD_OTLP_AUTH_HEADER: ${{ secrets.GCLOUD_OTLP_AUTH_HEADER }}
+      PYTHONUTF8: "1"
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            pyproject.toml
+            uv.lock
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Validate pytest marker
+        env:
+          # Fork PRs do not receive repository secrets; skip live_llm contracts
+          # (see interactive-shell-live.yml). Index a JSON string array so the
+          # value is always a marker string — never a bare boolean from
+          # ``a && 'x' || 'y'`` (boolean false → ``-m false`` → xdist
+          # ``N workers [0 items]``, which can still exit 0).
+          PYTEST_MARKER_EXPR: ${{ fromJSON('["not synthetic", "not (synthetic or live_llm)"]')[github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true] }}
+        run: |
+          echo "PYTEST_MARKER_EXPR=${PYTEST_MARKER_EXPR}"
+          case "${PYTEST_MARKER_EXPR}" in
+            "not synthetic"|"not (synthetic or live_llm)") ;;
+            *)
+              echo "Refusing unexpected PYTEST_MARKER_EXPR: '${PYTEST_MARKER_EXPR}'" >&2
+              exit 1
+              ;;
+          esac
+
+      - name: Run tests
+        env:
+          COVERAGE_FILE: .coverage.${{ matrix.shard }}
+          PYTEST_MARKER_EXPR: ${{ fromJSON('["not synthetic", "not (synthetic or live_llm)"]')[github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true] }}
+        # Keep ``run: >`` (folded) so ``matrix.pytest_paths`` stays one argv list.
+        # A ``run: |`` + ``\`` rewrite can drop/split those paths and yield
+        # ``N workers [0 items]`` even when the marker is correct.
+        run: >
+          uv run python -m pytest -n auto -v
+          ${{ matrix.pytest_paths }}
+          --cov=config
+          --cov=core
+          --cov=platform.deployment.aws --cov=platform.deployment
+          --cov=integrations
+          --cov=platform
+          --cov=surfaces
+          --cov=tools
+          --cov-report=
+          --ignore=tests/e2e/kubernetes_local_alert_simulation
+          --ignore=tests/synthetic
+          ${{ matrix.extra_pytest_args }}
+          -m "${PYTEST_MARKER_EXPR}"
+
+      - name: Upload shard coverage data
+        if: >-
+          always() &&
+          github.event_name == 'push' &&
+          github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-data-${{ matrix.shard }}
+          path: .coverage.${{ matrix.shard }}*
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 7
+
+  coverage-report:
+    name: coverage-report
+    runs-on: ubuntu-latest
+    needs: [test]
+    if: >-
+      always() &&
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/main'
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            pyproject.toml
+            uv.lock
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Download shard coverage artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: coverage-data-*
+          path: ./
+          merge-multiple: true
+
+      - name: Combine coverage and build report
+        run: |
+          uv run python -m coverage combine .
+          uv run python -m coverage html
+
+      - name: Upload combined coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report-ubuntu-latest
+          path: |
+            htmlcov/
+            .coverage
+          retention-days: 7
+
+  test-kubernetes:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    timeout-minutes: 15
+
+    if: >-
+      github.repository == 'Tracer-Cloud/opensre' &&
+      (github.event_name == 'push' ||
+      (
+        github.event_name == 'pull_request' &&
+        (
+          contains(github.event.pull_request.title, 'k8s') ||
+          contains(github.event.pull_request.title, 'kubernetes')
+        )
+      ))
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            pyproject.toml
+            uv.lock
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Run Kubernetes tests
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+        run: uv run python -m tests.e2e.kubernetes.test_local
+
+  should-run-thorough:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'Tracer-Cloud/opensre'
+    outputs:
+      thorough: ${{ steps.filter.outputs.thorough }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            thorough:
+              - ".github/workflows/ci.yml"
+              - "pyproject.toml"
+              - "uv.lock"
+              - "platform/deployment/**"
+              - "integrations/**"
+              - "tools/investigation/**"
+              - "tools/**"
+              - "tests/e2e/cloudwatch_demo/**"
+              - "tests/e2e/upstream_lambda/**"
+              - "tests/e2e/upstream_prefect_ecs_fargate/**"
+              - "tests/e2e/upstream_apache_flink_ecs/**"
+
+  test-thorough:
+    runs-on: ubuntu-latest
+    needs: [test, should-run-thorough]
+    if: >-
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/main' &&
+      github.repository == 'Tracer-Cloud/opensre' &&
+      needs.should-run-thorough.outputs.thorough == 'true'
+    timeout-minutes: 30
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: cloudwatch-demo
+            command: python3 -m tests.e2e.cloudwatch_demo.test_aws
+          - name: upstream-lambda
+            command: python3 -m tests.e2e.upstream_lambda.test_agent_e2e
+          - name: prefect-ecs-fargate
+            command: python3 -m tests.e2e.upstream_prefect_ecs_fargate.test_agent_e2e
+          - name: flink-ecs
+            command: python3 -m tests.e2e.upstream_apache_flink_ecs.test_agent_e2e
+
+    name: test-thorough (${{ matrix.name }})
+
+    env:
+      # Thorough e2e suites make live LLM calls; run them on openai because the
+      # default anthropic account is credit-exhausted. Requires a valid, funded
+      # OPENAI_API_KEY secret.
+      LLM_PROVIDER: openai
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      JWT_TOKEN: ${{ secrets.JWT_TOKEN }}
+      TRACER_API_URL: ${{ secrets.TRACER_API_URL }}
+      TRACER_INGEST_TOKEN: ${{ secrets.TRACER_INGEST_TOKEN }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_REGION: us-east-1
+      AWS_DEFAULT_REGION: us-east-1
+      GRAFANA_READ_TOKEN: ${{ secrets.GRAFANA_READ_TOKEN }}
+      GCLOUD_HOSTED_METRICS_ID: ${{ secrets.GCLOUD_HOSTED_METRICS_ID }}
+      GCLOUD_HOSTED_METRICS_URL: ${{ secrets.GCLOUD_HOSTED_METRICS_URL }}
+      GCLOUD_HOSTED_LOGS_ID: ${{ secrets.GCLOUD_HOSTED_LOGS_ID }}
+      GCLOUD_HOSTED_LOGS_URL: ${{ secrets.GCLOUD_HOSTED_LOGS_URL }}
+      GCLOUD_RW_API_KEY: ${{ secrets.GCLOUD_RW_API_KEY }}
+      CLOUDWATCH_VERIFY_LOGS: ${{ matrix.name == 'cloudwatch-demo' && '0' || '1' }}
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            pyproject.toml
+            uv.lock
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Install tracer CLI
+        run: |
+          curl -sSL https://install.tracer.cloud | sh -s user_36fbN6K6FwEgJFHsQv1pUByo8K6
+
+      - name: Initialize tracer (optional)
+        run: |
+          sudo tracer init --token ${{ secrets.JWT_TOKEN }}
+        continue-on-error: true
+        timeout-minutes: 2
+
+      - name: Run test
+        run: uv run ${{ matrix.command }}
+        timeout-minutes: 30