17 Commits

Author	SHA1	Message	Date
Jesús Pérez	847523e4d4	fix: eliminate stub implementations across 6 integration points ... - WorkflowOrchestrator and WorkflowService wired in main.rs (non-fatal) - try_fallback_with_budget actually calls fallback providers - vapora-tracking persistence: real TrackingEntry + NatsPublisher - vapora-doc-lifecycle: workspace + classify/consolidate/rag/NATS stubs - Merkle hash chain audit trail (tamper-evident, verify_integrity) - /api/v1/workflows/* routes operational; get_workflow_audit Result fix - ADR-0039, CHANGELOG, workflow-orchestrator docs updated	2026-02-27 00:00:02 +00:00
Jesús Pérez	e5e2244e04	feat(security): add SSRF protection and prompt injection scanning ... - Add security module (ssrf.rs, prompt_injection.rs) to vapora-backend - Block RFC 1918, link-local, cloud metadata URLs before channel registration - Scan 60+ injection patterns on RLM (load/query/analyze) and task endpoints - Fix channel SSRF: filter-before-register instead of warn-and-proceed - Add sanitize() to load_document (was missing, only analyze_document had it) - Return 400 Bad Request (not 500) for all security rejections - Add 11 integration tests via Surreal::init() — no external deps required - Document in ADR-0038, CHANGELOG, and docs/adrs/README.md	2026-02-26 18:20:07 +00:00
Jesús Pérez	765841b18f	feat(capabilities): add vapora-capabilities crate with in-process executor dispatch ... - New vapora-capabilities crate: CapabilitySpec, Capability trait, CapabilityRegistry (parking_lot RwLock), CapabilityLoader (TOML overrides), 3 built-ins (code-reviewer, doc-generator, pr-monitor), 22 tests - Move AgentDefinition to vapora-shared to break capabilities↔agents circular dep - Wire system_prompt into AgentExecutor via LLMRouter.complete_with_budget - AgentCoordinator: in-process task dispatch via DashMap<String, Sender<TaskAssignment>> - server.rs: bootstrap CapabilityRegistry + LLMRouter from env, spawn executors per capability - Landing page: 620 tests, 21 crates, Capability Packages feature box - docs: capability-packages feature guide, ADR-0037, CHANGELOG, SUMMARY EOF	2026-02-26 16:43:28 +00:00
Jesús Pérez	27a290b369	feat(kg,channels): hybrid search + agent-inactive notifications ... - KG: HNSW + BM25 + RRF(k=60) hybrid search via SurrealDB 3 native indexes - Fix schema bug: kg_executions missing agent_role/provider/cost_cents (silent empty reads) - channels: on_agent_inactive hook (AgentStatus::Inactive → Message::error) - migration 012: adds missing fields + HNSW + BM25 indexes - docs: ADR-0036, update ADR-0035 + notification-channels feature doc	2026-02-26 15:32:44 +00:00
Jesús Pérez	027b8f2836	feat(channels): webhook notification channels with built-in secret resolution ... Add vapora-channels crate with trait-based Slack/Discord/Telegram webhook delivery. ${VAR}/${VAR:-default} interpolation is mandatory inside ChannelRegistry::from_config — callers cannot bypass secret resolution. Fire-and-forget dispatch via tokio::spawn in both vapora-workflow-engine (four lifecycle events) and vapora-backend (task Done, proposal approve/reject). New REST endpoints: GET /channels, POST /channels/:name/test. dispatch_notifications extracted as pub(crate) fn for inline testability; 5 handler tests + 6 workflow engine tests + 7 secret resolution unit tests. Closes: vapora-channels bootstrap, notification gap in workflow/backend layer ADR: docs/adrs/0035-notification-channels.md	2026-02-26 14:49:34 +00:00
Jesús Pérez	bb55c80d2b	feat(workflow-engine): autonomous scheduling with timezone and distributed lock ... Add cron-based autonomous workflow firing with two hardening layers: - Timezone-aware scheduling via chrono-tz: ScheduledWorkflow.timezone (IANA identifier), compute_next_fire_at/after_tz, validate_timezone; DST-safe, UTC fallback when absent; validated at config load and REST API - Distributed fire-lock via SurrealDB conditional UPDATE (locked_by/locked_at fields, 120 s TTL); WorkflowScheduler gains instance_id (UUID) as lock owner; prevents double-fires across multi-instance deployments without extra infra - ScheduleStore: try_acquire_fire_lock, release_fire_lock (own-instance guard), full CRUD (load_one/all, full_upsert, patch, delete, load_runs) - REST: 7 endpoints (GET/PUT/PATCH/DELETE schedules, runs history, manual fire) with timezone field in all request/response types - Migrations 010 (schedule tables) + 011 (timezone + lock columns) - Tests: 48 passing (was 26); ADR-0034; changelog; feature docs updated	2026-02-26 11:34:44 +00:00
Jesús Pérez	b9e2cee9f7	feat(workflow-engine): add saga, persistence, auth, and NATS-integrated orchestrator hardening ... Key changes driving this: new saga.rs, persistence.rs, auth.rs in workflow-engine; SurrealDB migration 009_workflow_state.surql; backend services refactored; frontend dist built; ADR-0033 documenting the hardening decision.	2026-02-22 21:44:42 +00:00
Jesús Pérez	e91e3cb67a	fix(distro): correct install recipes — all 5 binaries, install-full for frontend ... distro::install now explicitly builds vapora-backend, vapora-agents, vapora-mcp-server, vapora-a2a, and vapora-cli in one cargo pass. vapora-a2a and vapora-mcp-server were missing from the build command; vapora-a2a was absent from the copy list entirely. Replaces the broken UI=true parameter with a separate install-full recipe that depends on install and runs trunk --release. just 1.x treats KEY=value tokens as positional args to the first recipe parameter when invoked via module syntax (distro::recipe), not as named overrides. install-targets now includes wasm32-unknown-unknown with an idempotent check. build-all-targets excludes wasm32 from the workspace loop to avoid failures on crates that don't support WASM.	2026-02-17 23:31:47 +00:00
Jesús Pérez	d2806935d6	chore: fix distro build with wasam, etc	2026-02-17 23:17:25 +00:00
Jesús Pérez	2f76728481	feat: integrate NatsBridge with real JetStream into A2A server ... vapora-agents: - Add nats_bridge.rs with real async_nats JetStream (submit_task, durable pull consumer, list_agents from live registry) - Replace swarm_adapter.rs stubs with real SwarmCoordinator calls (select_agent via bidding, report_completion with load update, agent_load from fractional profile) - Expose SwarmCoordinator::get_agent() for per-agent profile access vapora-a2a: - CoordinatorBridge: replace raw NatsClient with NatsBridge (JetStream at-least-once delivery via durable pull consumer) - Add GET /a2a/agents endpoint listing registered agents - task_manager::create(): switch .content() to parameterized INSERT INTO to avoid SurrealDB serializer failing on adjacently-tagged enums - task_manager::get(): explicit field projection, exclude id (Thing), cast datetimes with type::string() to fix serde_json::Value deserialization - Integration tests: 4/5 pass with SurrealDB + NATS vapora-leptos-ui: - Set doctest = false in [lib]: Leptos components require WASM reactive runtime, incompatible with native cargo test --doc	2026-02-17 22:28:51 +00:00
Jesús Pérez	4efea3053e	chore: add A2A y RLM	2026-02-16 05:09:51 +00:00
Jesús Pérez	b6a4d77421	feat: add Leptos UI library and modularize MCP server	2026-02-14 20:10:55 +00:00
Jesús Pérez	fe4d138a14	feat: CLI arguments, distribution management, and approval gates ... - Add CLI support (--config, --help) with env var override for backend/agents - Implement distro justfile recipes: list-targets, install-targets, build-target, install - Fix OpenTelemetry API incompatibilities and remove deprecated calls - Add tokio "time" feature for timeout support - Fix Cargo profile warnings and Nushell script syntax - Update all dead_code warnings with strategic annotations - Zero compiler warnings in vapora codebase - Comprehensive CHANGELOG documenting risk-based approval gates system	2026-02-03 21:35:00 +00:00
Jesús Pérez	cc55b97678	chore: update README and CHANGELOG with workflow orchestrator features	2026-01-24 02:07:45 +00:00
Jesús Pérez	4cbbf3f864	chore: add setup md files	2026-01-12 03:17:04 +00:00
Jesús Pérez	8f6a884f6e	docs: Update README and CHANGELOG with web assets optimization ... - Document web assets restructuring with minification pipeline * 32% compression (26KB → 18KB) * Bilingual support (EN/ES) preserved * Automated minify.sh script for version sync * Complete README.md guide with examples - Add web assets structure to project directory layout in README - New assets/web/ section with source and production versions - Reference to minification script and documentation - Include Just recipes documentation for local development - Show `just help` commands for discovering available recipes - Document 50+ recipes for build, test, and CI operations - Update CHANGELOG with infrastructure improvements - Web assets optimization (32% compression) - Just recipes CI/CD system (50+ commands) - Code quality improvements and bug fixes - Markdown linting compliance achieved - All tests passing (55/55 in vapora-backend) - Add build and test results to unreleased changes section - Clean compilation with 0 warnings in vapora-backend - 55 tests passing - Clippy compliance achieved	2026-01-11 20:12:56 +00:00
Jesús Pérez	d14150da75	feat: Phase 5.3 - Multi-Agent Learning Infrastructure ... Implement intelligent agent learning from Knowledge Graph execution history with per-task-type expertise tracking, recency bias, and learning curves. ## Phase 5.3 Implementation ### Learning Infrastructure (✅ Complete) - LearningProfileService with per-task-type expertise metrics - TaskTypeExpertise model tracking success_rate, confidence, learning curves - Recency bias weighting: recent 7 days weighted 3x higher (exponential decay) - Confidence scoring prevents overfitting: min(1.0, executions / 20) - Learning curves computed from daily execution windows ### Agent Scoring Service (✅ Complete) - Unified AgentScore combining SwarmCoordinator + learning profiles - Scoring formula: 0.3*base + 0.5*expertise + 0.2*confidence - Rank agents by combined score for intelligent assignment - Support for recency-biased scoring (recent_success_rate) - Methods: rank_agents, select_best, rank_agents_with_recency ### KG Integration (✅ Complete) - KGPersistence::get_executions_for_task_type() - query by agent + task type - KGPersistence::get_agent_executions() - all executions for agent - Coordinator::load_learning_profile_from_kg() - core KG→Learning integration - Coordinator::load_all_learning_profiles() - batch load for multiple agents - Convert PersistedExecution → ExecutionData for learning calculations ### Agent Assignment Integration (✅ Complete) - AgentCoordinator uses learning profiles for task assignment - extract_task_type() infers task type from title/description - assign_task() scores candidates using AgentScoringService - Fallback to load-based selection if no learning data available - Learning profiles stored in coordinator.learning_profiles RwLock ### Profile Adapter Enhancements (✅ Complete) - create_learning_profile() - initialize empty profiles - add_task_type_expertise() - set task-type expertise - update_profile_with_learning() - update swarm profiles from learning ## Files Modified ### vapora-knowledge-graph/src/persistence.rs (+30 lines) - get_executions_for_task_type(agent_id, task_type, limit) - get_agent_executions(agent_id, limit) ### vapora-agents/src/coordinator.rs (+100 lines) - load_learning_profile_from_kg() - core KG integration method - load_all_learning_profiles() - batch loading for agents - assign_task() already uses learning-based scoring via AgentScoringService ### Existing Complete Implementation - vapora-knowledge-graph/src/learning.rs - calculation functions - vapora-agents/src/learning_profile.rs - data structures and expertise - vapora-agents/src/scoring.rs - unified scoring service - vapora-agents/src/profile_adapter.rs - adapter methods ## Tests Passing - learning_profile: 7 tests ✅ - scoring: 5 tests ✅ - profile_adapter: 6 tests ✅ - coordinator: learning-specific tests ✅ ## Data Flow 1. Task arrives → AgentCoordinator::assign_task() 2. Extract task_type from description 3. Query KG for task-type executions (load_learning_profile_from_kg) 4. Calculate expertise with recency bias 5. Score candidates (SwarmCoordinator + learning) 6. Assign to top-scored agent 7. Execution result → KG → Update learning profiles ## Key Design Decisions ✅ Recency bias: 7-day half-life with 3x weight for recent performance ✅ Confidence scoring: min(1.0, total_executions / 20) prevents overfitting ✅ Hierarchical scoring: 30% base load, 50% expertise, 20% confidence ✅ KG query limit: 100 recent executions per task-type for performance ✅ Async loading: load_learning_profile_from_kg supports concurrent loads ## Next: Phase 5.4 - Cost Optimization Ready to implement budget enforcement and cost-aware provider selection.	2026-01-11 13:03:53 +00:00