diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..899713c --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @DevChiniwala diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 0000000..c3508d0 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,77 @@ +name: Bug report +description: Report a reproducible ControlSurface defect. +title: "[Bug]: " +labels: + - bug +body: + - type: markdown + attributes: + value: | + Thanks for helping improve ControlSurface. Remove credentials, prompts, trace payloads, and other sensitive telemetry before submitting. + - type: input + id: version + attributes: + label: ControlSurface version + description: Tag, commit SHA, or container/source revision. + placeholder: v0.1.0-rc.1 + validations: + required: true + - type: dropdown + id: component + attributes: + label: Component + options: + - Web console + - Control API + - OTLP ingest + - Worker / ClickHouse projection + - Python SDK + - CLI / release gates + - Docker Compose / operations + - Documentation + - Other + validations: + required: true + - type: textarea + id: environment + attributes: + label: Environment + description: Operating system, browser or Python version, deployment method, and relevant service versions. + validations: + required: true + - type: textarea + id: reproduction + attributes: + label: Reproduction steps + description: Provide the smallest deterministic sequence that reproduces the problem. + validations: + required: true + - type: textarea + id: expected + attributes: + label: Expected behavior + validations: + required: true + - type: textarea + id: actual + attributes: + label: Actual behavior + validations: + required: true + - type: textarea + id: diagnostics + attributes: + label: Sanitized diagnostics + description: Add relevant logs, screenshots, trace IDs, or error output after removing secrets and sensitive telemetry. + render: shell + - type: checkboxes + id: checks + attributes: + label: Submission checks + options: + - label: I reproduced this on the latest release candidate or current main branch. + required: true + - label: I removed secrets and sensitive production telemetry. + required: true + - label: I searched existing issues for the same problem. + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..2c3af93 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: Security vulnerability + url: https://github.com/DevChiniwala/ControlSurface/security/advisories/new + about: Report vulnerabilities privately. Do not open a public security issue. + - name: Questions and support + url: https://github.com/DevChiniwala/ControlSurface/discussions/categories/q-a + about: Ask installation, configuration, and usage questions in Discussions. diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml new file mode 100644 index 0000000..e4cdbdb --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -0,0 +1,53 @@ +name: Feature request +description: Propose a focused product or engineering improvement. +title: "[Feature]: " +labels: + - enhancement +body: + - type: textarea + id: problem + attributes: + label: Problem + description: What production-agent workflow is difficult or impossible today? + validations: + required: true + - type: textarea + id: outcome + attributes: + label: Desired outcome + description: Describe observable behavior and user value, not only an implementation. + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed approach + description: Include interfaces, workflow, or data implications when known. + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + - type: dropdown + id: area + attributes: + label: Product area + options: + - Observe + - Evaluate + - Monitor + - Diagnose + - Improve + - Ship + - Operations + - Developer experience + validations: + required: true + - type: checkboxes + id: checks + attributes: + label: Submission checks + options: + - label: This request describes a concrete problem rather than a duplicate feature list. + required: true + - label: I searched existing issues and roadmap items. + required: true diff --git a/.github/ISSUE_TEMPLATE/integration.yml b/.github/ISSUE_TEMPLATE/integration.yml new file mode 100644 index 0000000..bfd0713 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/integration.yml @@ -0,0 +1,44 @@ +name: Integration request +description: Request or propose an agent framework, model, tool, or telemetry integration. +title: "[Integration]: " +labels: + - integration +body: + - type: input + id: target + attributes: + label: Integration target + placeholder: Framework, provider, protocol, tool system, or runtime + validations: + required: true + - type: input + id: version + attributes: + label: Relevant versions + - type: textarea + id: use_case + attributes: + label: Production use case + description: Describe the agent workflow and why generic OpenTelemetry instrumentation is insufficient. + validations: + required: true + - type: textarea + id: telemetry + attributes: + label: Expected telemetry + description: Which agent, model, tool, retrieval, retry, session, token, cost, or error data should be captured? + validations: + required: true + - type: textarea + id: references + attributes: + label: Public technical references + description: Link official documentation or protocol specifications only. + - type: checkboxes + id: contribution + attributes: + label: Contribution + options: + - label: I am willing to help validate the integration. + - label: I am willing to contribute an implementation or fixtures. + - label: I can provide a minimal public reproduction. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..2ddd918 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,17 @@ +## What changed + + + +## Verification + +- [ ] Relevant unit or integration tests pass. +- [ ] Formatting, lint, and type checks pass. +- [ ] Documentation and examples are updated when behavior changes. +- [ ] UI changes include current screenshots and keyboard/accessibility verification. +- [ ] Schema or migration changes are forward-safe and documented. +- [ ] Security, privacy, retention, and secret-handling implications were considered. +- [ ] No sensitive telemetry, credentials, generated evidence, or private paths are included. + +## Related issue + + diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..19fcb5b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,49 @@ +version: 2 +updates: + - package-ecosystem: npm + directory: /apps/web + schedule: + interval: weekly + day: monday + groups: + web-routine: + patterns: ["*"] + update-types: [minor, patch] + + - package-ecosystem: pip + directory: /services/controlplane + schedule: + interval: weekly + day: monday + groups: + controlplane-routine: + patterns: ["*"] + update-types: [minor, patch] + + - package-ecosystem: pip + directory: /sdk/python + schedule: + interval: weekly + day: monday + groups: + sdk-routine: + patterns: ["*"] + update-types: [minor, patch] + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + + - package-ecosystem: docker + directory: /services/controlplane + schedule: + interval: weekly + day: monday + + - package-ecosystem: docker + directory: /apps/web + schedule: + interval: weekly + day: monday diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f9c1573..fa9b717 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,8 @@ name: CI +permissions: + contents: read + on: push: branches: [main] @@ -11,15 +14,15 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 20 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.12" cache: pip cache-dependency-path: | services/controlplane/pyproject.toml sdk/python/pyproject.toml - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: "22" cache: npm @@ -63,15 +66,15 @@ jobs: needs: quality timeout-minutes: 35 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.12" cache: pip cache-dependency-path: | services/controlplane/pyproject.toml sdk/python/pyproject.toml - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: "22" cache: npm diff --git a/CHANGELOG.md b/CHANGELOG.md index a6bbd18..9189efb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ All notable changes are recorded here. ControlSurface has not published a package or container release. -## Unreleased — v0.1.0-rc.1 candidate +## 0.1.0-rc.1 — 2026-09-28 ### Added diff --git a/README.md b/README.md index 813b337..4779d46 100644 --- a/README.md +++ b/README.md @@ -24,6 +24,16 @@ ControlSurface — ship reliable AI agents with production health, traces, incident intelligence, and release gates

+

+ + ControlSurface real-product workflow from Production Health to a passing release gate + +

+ +

+ Watch the complete 70-second failure-to-release workflow +

+ ## Production failures should make your system smarter. **Traces tell you what happened. ControlSurface helps you decide what to do next.** @@ -110,14 +120,6 @@ Group recurring production failures by execution signature and open a representa -
-Watch the 12-second real-product walkthrough -
-

- ControlSurface production health to verified release walkthrough -

-
- ## What ControlSurface does | Area | Working capability | diff --git a/ROADMAP.md b/ROADMAP.md index d204cf1..3aef5c4 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -26,9 +26,8 @@ Remaining release work is intentionally narrow: 1. Run GitHub Actions on the exact candidate commit in the remote repository. 2. Review the final staged diff and repeat secret/naming scans after staging. -3. Capture a concise real-product hero demo from the synthetic refund workflow. -4. Complete artifact-specific license/SBOM review before publishing Python or container artifacts. -5. Tag `v0.1.0-rc.1` only after the remote pipeline is green. +3. Complete artifact-specific license/SBOM review before publishing Python or container artifacts. +4. Tag `v0.1.0-rc.1` only after the exact remote candidate is green and the final launch review is approved. ## v0.2: always-on reliability automation diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 0000000..a7092b6 --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,19 @@ +# Support + +ControlSurface is an early open-source release candidate. The fastest path to useful help is to choose the channel that matches the problem. + +## Questions and setup help + +Use [GitHub Discussions](https://github.com/DevChiniwala/ControlSurface/discussions/categories/q-a) for installation, configuration, instrumentation, and workflow questions. Include the ControlSurface version, deployment method, operating system, and sanitized diagnostics. + +## Reproducible defects + +Open a [bug report](https://github.com/DevChiniwala/ControlSurface/issues/new?template=bug.yml) when current behavior differs from documented behavior and can be reproduced. Search existing issues first. + +## Security vulnerabilities + +Follow [SECURITY.md](SECURITY.md) and use a [private security advisory](https://github.com/DevChiniwala/ControlSurface/security/advisories/new). Never publish a credential, exploit, sensitive trace, prompt, model output, customer record, or other private telemetry in an issue or discussion. + +## Operational emergencies + +The public repository does not provide a commercial support SLA or an emergency response channel. Operators remain responsible for backups, retention, access controls, TLS termination, and recovery procedures described in [docs/OPERATIONS.md](docs/OPERATIONS.md). diff --git a/docs/RELEASE_AUDIT.md b/docs/RELEASE_AUDIT.md index 0d8dcc3..5d1fc22 100644 --- a/docs/RELEASE_AUDIT.md +++ b/docs/RELEASE_AUDIT.md @@ -1,10 +1,10 @@ # v0.1.0-rc.1 release audit -Audit date: 2026-09-27 +Audit date: 2026-09-28 Scope: local source tree and locally built Linux/amd64 Compose artifacts -Status: **local and GitHub Actions release-candidate checks pass; binary distribution packaging remains** +Status: **engineering candidate checks pass; launch-only changes require exact-commit remote verification; binary distribution packaging remains** This record reports executed checks. It is not a promise that defects cannot exist, a security certification, or legal advice. @@ -22,8 +22,8 @@ This record reports executed checks. It is not a promise that defects cannot exi | Check | Result | | --- | --- | | Ruff lint and format (server, SDK, example, tests, benchmarks, scripts) | Pass | -| mypy (server, SDK, recovery operator) | Pass, 23 source files | -| Backend and SDK unit tests | Pass, 57 tests | +| mypy (server and SDK) | Pass, 22 source files | +| Backend and SDK unit tests | Pass, 59 tests | | TypeScript type check | Pass | | ESLint | Pass | | Prettier | Pass | @@ -112,10 +112,8 @@ Known limits remain: trusted-host/single-owner model, best-effort free-text reda ## Release decision -The exact source candidate at `8d3f1b795f7d1aeeb1fb8fe4b1cce37897744295` passed both remote jobs in [GitHub Actions run 36322748409](https://github.com/DevChiniwala/ControlSurface/actions/runs/36322748409). It is ready for a **public source release candidate** after these product-release actions: +The engineering candidate at `8d3f1b795f7d1aeeb1fb8fe4b1cce37897744295` passed both remote jobs in [GitHub Actions run 36322748409](https://github.com/DevChiniwala/ControlSurface/actions/runs/36322748409). A captioned 70-second real-product demo has since been recorded from the synthetic refund workflow, and the repository's launch governance and public presentation have been prepared. -1. Record the planned short real-product hero demo. -2. Change repository visibility only when Dev Chiniwala is ready for public disclosure. -3. Tag `v0.1.0-rc.1` from the verified source candidate after the public-release decision. +The final launch commit must pass `quality` and `hero-e2e` again before tagging. Tag `v0.1.0-rc.1` only from that exact verified commit after Dev Chiniwala approves the final launch review. Not approved by this audit: public Python package publication, public container publication, production HA claims, or hosted multi-tenant operation. diff --git a/docs/assets/readme/hero-demo.gif b/docs/assets/readme/hero-demo.gif index 95f277d..119c481 100644 Binary files a/docs/assets/readme/hero-demo.gif and b/docs/assets/readme/hero-demo.gif differ diff --git a/docs/assets/social/controlsurface-social-preview.png b/docs/assets/social/controlsurface-social-preview.png new file mode 100644 index 0000000..02e4fdd Binary files /dev/null and b/docs/assets/social/controlsurface-social-preview.png differ diff --git a/docs/assets/social/controlsurface-social-preview.svg b/docs/assets/social/controlsurface-social-preview.svg new file mode 100644 index 0000000..3a2d18a --- /dev/null +++ b/docs/assets/social/controlsurface-social-preview.svg @@ -0,0 +1,40 @@ + + ControlSurface social preview + ControlSurface logo and the words Production engineering for AI agents on a deep navy background. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ControlSurface + + Production engineering for AI agents. + + diff --git a/docs/releases/v0.1.0-rc.1.md b/docs/releases/v0.1.0-rc.1.md new file mode 100644 index 0000000..86c8318 --- /dev/null +++ b/docs/releases/v0.1.0-rc.1.md @@ -0,0 +1,29 @@ +# ControlSurface v0.1.0-rc.1 + +First public release candidate of ControlSurface, an open-source production engineering platform for AI agents. + +## Highlights + +- OTLP-native agent tracing with source spans and AgentRunGraph projections. +- Production Health and AI-specific SLO evaluation. +- Deterministic structural failure clustering. +- Incidents with inspectable Change Ledger evidence. +- Production-derived, human-reviewed regression cases. +- Paired candidate evaluation. +- Reproducible release gates with content-addressed evidence. + +## Run it locally + +Follow the [Quickstart](../../README.md#quickstart) to start the supported Docker Compose deployment, create the owner, and send the first trace. + +The [refund-agent lifecycle](../../examples/refund_agent/README.md) demonstrates healthy traffic, a breaking tool-schema update, failure clustering, incident evidence, regression review, a fixed candidate, and a passing release gate. + +## Release status + +This is an early source release candidate. Docker Compose is the supported V1 self-hosting path. The trust model is a trusted single owner on a trusted host; see [Security and telemetry privacy](../../SECURITY.md) and [Operations](../OPERATIONS.md). + +Public Python-package and container-image distribution are intentionally deferred until the artifact-specific license bundle is complete. The tag includes source archives generated by GitHub; the full real-product demo is attached to the release separately. + +## Verification + +The tagged commit must pass the `quality` and `hero-e2e` GitHub Actions checks and a clean-volume Compose boot before this release is published. Detailed evidence is maintained in the [release audit](../RELEASE_AUDIT.md).