mirror of
https://github.com/trustgraph-ai/trustgraph.git
synced 2026-04-25 00:16:23 +02:00
d35473f7f7
Introduces `workspace` as the isolation boundary for config, flows,
library, and knowledge data. Removes `user` as a schema-level field
throughout the code, API specs, and tests; workspace provides the
same separation more cleanly at the trusted flow.workspace layer
rather than through client-supplied message fields.
Design
------
- IAM tech spec (docs/tech-specs/iam.md) documents current state,
proposed auth/access model, and migration direction.
- Data ownership model (docs/tech-specs/data-ownership-model.md)
captures the workspace/collection/flow hierarchy.
Schema + messaging
------------------
- Drop `user` field from AgentRequest/Step, GraphRagQuery,
DocumentRagQuery, Triples/Graph/Document/Row EmbeddingsRequest,
Sparql/Rows/Structured QueryRequest, ToolServiceRequest.
- Keep collection/workspace routing via flow.workspace at the
service layer.
- Translators updated to not serialise/deserialise user.
API specs
---------
- OpenAPI schemas and path examples cleaned of user fields.
- Websocket async-api messages updated.
- Removed the unused parameters/User.yaml.
Services + base
---------------
- Librarian, collection manager, knowledge, config: all operations
scoped by workspace. Config client API takes workspace as first
positional arg.
- `flow.workspace` set at flow start time by the infrastructure;
no longer pass-through from clients.
- Tool service drops user-personalisation passthrough.
CLI + SDK
---------
- tg-init-workspace and workspace-aware import/export.
- All tg-* commands drop user args; accept --workspace.
- Python API/SDK (flow, socket_client, async_*, explainability,
library) drop user kwargs from every method signature.
MCP server
----------
- All tool endpoints drop user parameters; socket_manager no longer
keyed per user.
Flow service
------------
- Closure-based topic cleanup on flow stop: only delete topics
whose blueprint template was parameterised AND no remaining
live flow (across all workspaces) still resolves to that topic.
Three scopes fall out naturally from template analysis:
* {id} -> per-flow, deleted on stop
* {blueprint} -> per-blueprint, kept while any flow of the
same blueprint exists
* {workspace} -> per-workspace, kept while any flow in the
workspace exists
* literal -> global, never deleted (e.g. tg.request.librarian)
Fixes a bug where stopping a flow silently destroyed the global
librarian exchange, wedging all library operations until manual
restart.
RabbitMQ backend
----------------
- heartbeat=60, blocked_connection_timeout=300. Catches silently
dead connections (broker restart, orphaned channels, network
partitions) within ~2 heartbeat windows, so the consumer
reconnects and re-binds its queue rather than sitting forever
on a zombie connection.
Tests
-----
- Full test refresh: unit, integration, contract, provenance.
- Dropped user-field assertions and constructor kwargs across
~100 test files.
- Renamed user-collection isolation tests to workspace-collection.
137 lines
5.5 KiB
Makefile
137 lines
5.5 KiB
Makefile
|
|
# VERSION=$(shell git describe | sed 's/^v//')
|
|
|
|
VERSION=0.0.0
|
|
|
|
DOCKER=podman
|
|
|
|
all: containers
|
|
|
|
# Not used
|
|
wheels:
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph/
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph-base/
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph-flow/
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph-vertexai/
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph-bedrock/
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph-embeddings-hf/
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph-cli/
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph-ocr/
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph-unstructured/
|
|
pip3 wheel --no-deps --wheel-dir dist trustgraph-mcp/
|
|
|
|
packages: update-package-versions
|
|
rm -rf dist/
|
|
cd trustgraph && python -m build --sdist --outdir ../dist/
|
|
cd trustgraph-base && python -m build --sdist --outdir ../dist/
|
|
cd trustgraph-flow && python -m build --sdist --outdir ../dist/
|
|
cd trustgraph-vertexai && python -m build --sdist --outdir ../dist/
|
|
cd trustgraph-bedrock && python -m build --sdist --outdir ../dist/
|
|
cd trustgraph-embeddings-hf && python -m build --sdist --outdir ../dist/
|
|
cd trustgraph-cli && python -m build --sdist --outdir ../dist/
|
|
cd trustgraph-ocr && python -m build --sdist --outdir ../dist/
|
|
cd trustgraph-unstructured && python -m build --sdist --outdir ../dist/
|
|
cd trustgraph-mcp && python -m build --sdist --outdir ../dist/
|
|
|
|
pypi-upload:
|
|
twine upload dist/*-${VERSION}.*
|
|
|
|
CONTAINER_BASE=docker.io/trustgraph
|
|
|
|
update-package-versions:
|
|
mkdir -p trustgraph-cli/trustgraph
|
|
mkdir -p trustgraph/trustgraph
|
|
echo __version__ = \"${VERSION}\" > trustgraph-base/trustgraph/base_version.py
|
|
echo __version__ = \"${VERSION}\" > trustgraph-flow/trustgraph/flow_version.py
|
|
echo __version__ = \"${VERSION}\" > trustgraph-vertexai/trustgraph/vertexai_version.py
|
|
echo __version__ = \"${VERSION}\" > trustgraph-bedrock/trustgraph/bedrock_version.py
|
|
echo __version__ = \"${VERSION}\" > trustgraph-embeddings-hf/trustgraph/embeddings_hf_version.py
|
|
echo __version__ = \"${VERSION}\" > trustgraph-cli/trustgraph/cli_version.py
|
|
echo __version__ = \"${VERSION}\" > trustgraph-ocr/trustgraph/ocr_version.py
|
|
echo __version__ = \"${VERSION}\" > trustgraph-unstructured/trustgraph/unstructured_version.py
|
|
echo __version__ = \"${VERSION}\" > trustgraph/trustgraph/trustgraph_version.py
|
|
echo __version__ = \"${VERSION}\" > trustgraph-mcp/trustgraph/mcp_version.py
|
|
|
|
containers: container-base container-flow \
|
|
container-bedrock container-vertexai \
|
|
container-hf container-ocr \
|
|
container-unstructured container-mcp
|
|
|
|
some-containers: container-base container-flow container-unstructured
|
|
|
|
push:
|
|
${DOCKER} push ${CONTAINER_BASE}/trustgraph-base:${VERSION}
|
|
${DOCKER} push ${CONTAINER_BASE}/trustgraph-flow:${VERSION}
|
|
${DOCKER} push ${CONTAINER_BASE}/trustgraph-bedrock:${VERSION}
|
|
${DOCKER} push ${CONTAINER_BASE}/trustgraph-vertexai:${VERSION}
|
|
${DOCKER} push ${CONTAINER_BASE}/trustgraph-hf:${VERSION}
|
|
${DOCKER} push ${CONTAINER_BASE}/trustgraph-ocr:${VERSION}
|
|
${DOCKER} push ${CONTAINER_BASE}/trustgraph-unstructured:${VERSION}
|
|
${DOCKER} push ${CONTAINER_BASE}/trustgraph-mcp:${VERSION}
|
|
|
|
# Individual container build targets
|
|
container-%: update-package-versions
|
|
${DOCKER} build \
|
|
-f containers/Containerfile.${@:container-%=%} \
|
|
-t ${CONTAINER_BASE}/trustgraph-${@:container-%=%}:${VERSION} .
|
|
|
|
# Multi-arch: build both platforms sequentially into one manifest (local use)
|
|
manifest-%: update-package-versions
|
|
-@${DOCKER} manifest rm \
|
|
${CONTAINER_BASE}/trustgraph-${@:manifest-%=%}:${VERSION}
|
|
${DOCKER} build --platform linux/amd64,linux/arm64 \
|
|
-f containers/Containerfile.${@:manifest-%=%} \
|
|
--manifest \
|
|
${CONTAINER_BASE}/trustgraph-${@:manifest-%=%}:${VERSION} .
|
|
|
|
# Multi-arch: build a single platform image (for parallel CI)
|
|
platform-%-amd64: update-package-versions
|
|
${DOCKER} build --platform linux/amd64 \
|
|
-f containers/Containerfile.${@:platform-%-amd64=%} \
|
|
-t ${CONTAINER_BASE}/trustgraph-${@:platform-%-amd64=%}:${VERSION}-amd64 .
|
|
|
|
platform-%-arm64: update-package-versions
|
|
${DOCKER} build --platform linux/arm64 \
|
|
-f containers/Containerfile.${@:platform-%-arm64=%} \
|
|
-t ${CONTAINER_BASE}/trustgraph-${@:platform-%-arm64=%}:${VERSION}-arm64 .
|
|
|
|
# Push a single platform image
|
|
push-platform-%-amd64:
|
|
${DOCKER} push \
|
|
${CONTAINER_BASE}/trustgraph-${@:push-platform-%-amd64=%}:${VERSION}-amd64
|
|
|
|
push-platform-%-arm64:
|
|
${DOCKER} push \
|
|
${CONTAINER_BASE}/trustgraph-${@:push-platform-%-arm64=%}:${VERSION}-arm64
|
|
|
|
# Combine per-platform images into a multi-arch manifest
|
|
combine-manifest-%:
|
|
-@${DOCKER} manifest rm \
|
|
${CONTAINER_BASE}/trustgraph-${@:combine-manifest-%=%}:${VERSION}
|
|
${DOCKER} manifest create \
|
|
${CONTAINER_BASE}/trustgraph-${@:combine-manifest-%=%}:${VERSION} \
|
|
docker://${CONTAINER_BASE}/trustgraph-${@:combine-manifest-%=%}:${VERSION}-amd64 \
|
|
docker://${CONTAINER_BASE}/trustgraph-${@:combine-manifest-%=%}:${VERSION}-arm64
|
|
${DOCKER} manifest push \
|
|
${CONTAINER_BASE}/trustgraph-${@:combine-manifest-%=%}:${VERSION}
|
|
|
|
# Push a container
|
|
push-container-%:
|
|
${DOCKER} push \
|
|
${CONTAINER_BASE}/trustgraph-${@:push-container-%=%}:${VERSION}
|
|
|
|
# Push a manifest (from local multi-arch build)
|
|
push-manifest-%:
|
|
${DOCKER} manifest push \
|
|
${CONTAINER_BASE}/trustgraph-${@:push-manifest-%=%}:${VERSION}
|
|
|
|
clean:
|
|
rm -rf wheels/
|
|
|
|
set-version:
|
|
echo '"${VERSION}"' > templates/values/version.jsonnet
|
|
|
|
docker-hub-login:
|
|
cat docker-token.txt | \
|
|
${DOCKER} login -u trustgraph --password-stdin registry-1.docker.io
|
|
|