Skip to content

Develop#243

Merged
gowthamrao merged 28 commits into
mainfrom
develop
May 17, 2026
Merged

Develop#243
gowthamrao merged 28 commits into
mainfrom
develop

Conversation

@gowthamrao
Copy link
Copy Markdown
Contributor

No description provided.

Comment thread tests/federation/test_substrate_bridge_client.py Fixed
Comment thread tests/federation/test_substrate_bridge_client.py Fixed
Comment thread tests/federation/test_substrate_bridge_client.py Fixed
Comment thread tests/federation/test_substrate_bridge_client.py Fixed
Comment thread tests/federation/test_substrate_bridge_client.py Fixed
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 16, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 26 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.
See the Details below.

License Issues

pyproject.toml

PackageVersionLicenseIssue Type
dspy-ai>= 3.2.1NullUnknown License

uv.lock

PackageVersionLicenseIssue Type
cachetools7.1.2NullUnknown License
cvxpy1.8.2NullUnknown License
equinox0.13.8NullUnknown License
highspy1.14.0NullUnknown License
inferactively-pymdp1.0.2NullUnknown License
jaxtyping0.3.9NullUnknown License
langchain-core1.4.0NullUnknown License
langchain-protocol0.0.15NullUnknown License
langgraph1.2.0NullUnknown License
langgraph-checkpoint4.1.0NullUnknown License
langgraph-prebuilt1.1.0NullUnknown License
langgraph-sdk0.3.14NullUnknown License
langsmith0.8.5NullUnknown License
llvmlite0.47.0NullUnknown License
matplotlib3.11.0rc2NullUnknown License
mcp1.27.1NullUnknown License
momentchi20.1.8NullUnknown License
numba0.65.1NullUnknown License
osqp1.1.1NullUnknown License
scs3.2.11NullUnknown License
sparse0.18.0NullUnknown License
sse-starlette3.4.4NullUnknown License
uuid-utils0.15.0NullUnknown License
wrapt2.2.0rc11NullUnknown License
z3-solver4.16.0.0NullUnknown License
Denied Licenses: AGPL-1.0, AGPL-3.0, GPL-1.0, GPL-2.0, GPL-3.0, LGPL-2.0, LGPL-2.1, LGPL-3.0

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/dspy-ai >= 3.2.1 UnknownUnknown
pip/absl-py 2.4.0 UnknownUnknown
pip/cachetools 7.1.2 UnknownUnknown
pip/causal-learn 0.1.4.5 UnknownUnknown
pip/chex 0.1.91 UnknownUnknown
pip/clarabel 0.11.1 UnknownUnknown
pip/contourpy 1.3.3 UnknownUnknown
pip/cryptography 48.0.0 UnknownUnknown
pip/cvxpy 1.8.2 UnknownUnknown
pip/cycler 0.12.1 UnknownUnknown
pip/cython 3.2.4 UnknownUnknown
pip/dowhy 0.14 UnknownUnknown
pip/econml 0.16.0 UnknownUnknown
pip/equinox 0.13.8 UnknownUnknown
pip/fonttools 4.63.0 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 3Found 6/16 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/graphviz 0.21 UnknownUnknown
pip/highspy 1.14.0 UnknownUnknown
pip/httpx-sse 0.4.3 UnknownUnknown
pip/inferactively-pymdp 1.0.2 UnknownUnknown
pip/jax 0.10.0 UnknownUnknown
pip/jaxlib 0.10.0 UnknownUnknown
pip/jaxtyping 0.3.9 UnknownUnknown
pip/kiwisolver 1.5.0 UnknownUnknown
pip/langchain-core 1.4.0 UnknownUnknown
pip/langchain-protocol 0.0.15 UnknownUnknown
pip/langgraph 1.2.0 UnknownUnknown
pip/langgraph-checkpoint 4.1.0 UnknownUnknown
pip/langgraph-prebuilt 1.1.0 UnknownUnknown
pip/langgraph-sdk 0.3.14 UnknownUnknown
pip/langsmith 0.8.5 UnknownUnknown
pip/lightgbm 4.6.0 UnknownUnknown
pip/llvmlite 0.47.0 UnknownUnknown
pip/matplotlib 3.11.0rc2 UnknownUnknown
pip/mcp 1.27.1 UnknownUnknown
pip/mctx 0.0.6 UnknownUnknown
pip/ml-dtypes 0.5.4 UnknownUnknown
pip/momentchi2 0.1.8 UnknownUnknown
pip/multimethod 2.0.2 UnknownUnknown
pip/numba 0.65.1 UnknownUnknown
pip/opt-einsum 3.4.0 UnknownUnknown
pip/ormsgpack 1.12.2 UnknownUnknown
pip/osqp 1.1.1 UnknownUnknown
pip/patsy 1.0.2 🟢 3.6
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 57 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 0/3 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/pydot 4.0.1 UnknownUnknown
pip/pyjwt 2.12.1 UnknownUnknown
pip/pyparsing 3.3.2 UnknownUnknown
pip/requests-toolbelt 1.0.0 UnknownUnknown
pip/scs 3.2.11 UnknownUnknown
pip/seaborn 0.13.2 UnknownUnknown
pip/shap 0.48.0 UnknownUnknown
pip/slicer 0.0.8 ⚠️ 2.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 1Found 4/28 approved changesets -- score normalized to 1
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/sparse 0.18.0 UnknownUnknown
pip/sse-starlette 3.4.4 UnknownUnknown
pip/statsmodels 0.14.6 UnknownUnknown
pip/uuid-utils 0.15.0 UnknownUnknown
pip/wadler-lindig 0.1.7 UnknownUnknown
pip/wrapt 2.2.0rc11 UnknownUnknown
pip/z3-solver 4.16.0.0 🟢 4.3
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/19 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 9license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Fuzzing⚠️ 0project is not fuzzed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy⚠️ 0security policy file not detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Packaging🟢 10packaging workflow detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/zstandard 0.25.0 UnknownUnknown

Scanned Files

  • pyproject.toml
  • uv.lock

* chore: migrate epistemic ledger to letta

Replaces proprietary Python episodic memory context-window algorithms with Letta delegation. Ensures strict anti-CRUD adherence in the ledger via Letta dual-write and passes all pre-commit validation and required test coverage modifications.

* chore: migrate epistemic ledger to letta

- Replaces proprietary Python episodic memory context-window algorithms with Letta delegation.
- Uses `asyncio.to_thread` for Letta's synchronous client calls to prevent blocking the event loop.
- Ensures strict anti-CRUD adherence in the ledger via Letta dual-write and propagates errors if Letta fails, preventing silent state drift.
- Passes all pre-commit validation and required test coverage modifications, specifically asserting the dual-write behavior in integration tests.

* chore: migrate epistemic ledger to letta

- Replaces proprietary Python episodic memory context-window algorithms with Letta delegation.
- Uses `asyncio.to_thread` for Letta's synchronous client calls to prevent blocking the event loop.
- Ensures strict anti-CRUD adherence in the ledger via Letta dual-write and propagates errors if Letta fails, preventing silent state drift.
- Adds `test_upsert_projection` method to `TestGraphitiLatentMemoryManager` and verifies the test suite physically validates the Letta delegation via `real_latent_manager` and its client payload list tracking.
- Passes all pre-commit validation.
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
Comment thread tests/memory/test_graphiti_adapter.py Fixed
* chore: strict zero-waste mathematical consolidation

Removed custom Temporal wrappers for Active Inference, Causal Inference, SMPC, and Neurosymbolic verification.

These domains are now directly bridged to SOTA OSS tools via FastMCP capabilities. All tests reflect the anti-CRUD stateless function mandate.

* Jules reconcile 245 (#246)

* refactor: Delegate WasmCloud Lattice via NATS JetStream (#242)

* chore: migrate epistemic ledger to letta (#241)

* chore: migrate epistemic ledger to letta

Replaces proprietary Python episodic memory context-window algorithms with Letta delegation. Ensures strict anti-CRUD adherence in the ledger via Letta dual-write and passes all pre-commit validation and required test coverage modifications.

* chore: migrate epistemic ledger to letta

- Replaces proprietary Python episodic memory context-window algorithms with Letta delegation.
- Uses `asyncio.to_thread` for Letta's synchronous client calls to prevent blocking the event loop.
- Ensures strict anti-CRUD adherence in the ledger via Letta dual-write and propagates errors if Letta fails, preventing silent state drift.
- Passes all pre-commit validation and required test coverage modifications, specifically asserting the dual-write behavior in integration tests.

* chore: migrate epistemic ledger to letta

- Replaces proprietary Python episodic memory context-window algorithms with Letta delegation.
- Uses `asyncio.to_thread` for Letta's synchronous client calls to prevent blocking the event loop.
- Ensures strict anti-CRUD adherence in the ledger via Letta dual-write and propagates errors if Letta fails, preventing silent state drift.
- Adds `test_upsert_projection` method to `TestGraphitiLatentMemoryManager` and verifies the test suite physically validates the Letta delegation via `real_latent_manager` and its client payload list tracking.
- Passes all pre-commit validation.

* fix: address user feedback and CI failures

This commit fixes the following issues:
1. Re-purges the Ghost Files correctly from the repository.
2. Reorganizes the test structure to mirror the actuator locations.
3. Fixes CI errors related to FastMCP signature restrictions.
4. Adds realistic stubbing logic using actual encrypted computations if tenseal becomes available, while currently gracefully failing over as tenseal does not build wheels for python 3.14 on this linux host.

* fix: address user feedback and CI failures

This commit fixes the following issues:
1. Re-purges the Ghost Files correctly from the repository.
2. Reorganizes the test structure to mirror the actuator locations.
3. Fixes CI errors related to FastMCP signature restrictions by removing leading underscores.
4. Adds realistic stubbing logic using actual encrypted computations if tenseal becomes available, while currently gracefully failing over as tenseal does not build wheels for python 3.14 on this linux host.

* fix: address user feedback and CI failures

This commit fixes the following issues:
1. Re-purges the Ghost Files correctly from the repository.
2. Reorganizes the test structure to mirror the actuator locations.
3. Fixes CI errors related to FastMCP signature restrictions by removing leading underscores.
4. Adds realistic stubbing logic using actual encrypted computations if tenseal becomes available, while currently gracefully failing over as tenseal does not build wheels for python 3.14 on this linux host.

* fix(smpc): eradicate production mocks and skip test if tenseal is missing

- Removed fake math fallback in smpc_tool.py.
- Added pytest.importorskip('tenseal') to test_smpc.py.
- Confirmed legacy workflow files are purged from the branch.
Comment thread tests/execution_plane/actuators/test_active_inference.py Fixed
Comment thread tests/execution_plane/actuators/test_causal_inference.py Fixed
Comment thread tests/execution_plane/actuators/test_neurosymbolic.py Fixed
Comment thread tests/execution_plane/actuators/test_smpc.py Fixed
Comment thread tests/execution_plane/actuators/test_smpc.py Fixed
Comment thread tests/execution_plane/actuators/test_smpc.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread tests/orchestration/graphs/test_topology_resolution.py Fixed
Comment thread tests/orchestration/graphs/test_topology_resolution.py Fixed
Comment thread tests/orchestration/graphs/test_topology_resolution.py Fixed
Comment thread tests/orchestration/solvers/test_remediation_compiler.py Fixed
Comment thread tests/orchestration/solvers/test_remediation_compiler.py Fixed
Comment thread tests/orchestration/solvers/test_remediation_compiler.py Fixed
Comment thread tests/orchestration/solvers/test_remediation_compiler.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
Comment thread src/coreason_runtime/orchestration/workflows/__init__.py Fixed
* Refactor cognitive orchestration to 3-tier L1/L2/L3 taxonomy

* chore(taxonomy): consolidate 3-tier cognitive execution taxonomy and normalize terminology

* feat: initialize coreason-runtime project structure with orchestration workflows, execution plane actuators, and extensive testing suite
Copy link
Copy Markdown

@github-advanced-security github-advanced-security AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bandit found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

Comment thread src/coreason_runtime/api/schema/router.py Fixed
Comment thread tests/orchestration/workflows/test_base_topology_workflow.py Fixed
Comment thread tests/orchestration/workflows/test_base_topology_workflow.py Fixed
Comment thread tests/orchestration/workflows/test_base_topology_workflow.py Fixed
Comment thread tests/orchestration/workflows/test_base_topology_workflow.py Fixed
Comment thread tests/orchestration/workflows/test_base_topology_workflow.py Fixed
Comment thread tests/orchestration/workflows/test_base_topology_workflow.py Fixed
Comment thread tests/orchestration/workflows/test_base_topology_workflow.py Fixed
Comment thread tests/orchestration/workflows/test_base_topology_workflow.py Fixed
Comment thread src/coreason_runtime/api/predict_router.py Fixed
Comment thread src/coreason_runtime/api/predict_router.py Fixed
Comment thread src/coreason_runtime/api/predict_router.py Fixed
Comment thread src/coreason_runtime/api/predict_router.py Fixed
Comment thread src/coreason_runtime/orchestration/worker.py Fixed
Comment thread src/coreason_runtime/orchestration/worker.py Fixed
Comment thread src/coreason_runtime/orchestration/worker.py Fixed
Comment thread src/coreason_runtime/orchestration/worker.py Fixed
…flow sandbox

Signed-off-by: Gowtham Rao MD PhD <gowtham.rao@coreason.ai>
Comment thread tests/conftest.py Fixed
Comment thread tests/orchestration/workflows/test_base_topology_workflow.py Fixed
@gowthamrao gowthamrao merged commit f5bd7c4 into main May 17, 2026
27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants