fix(ci): scope pytest discovery to open_ksa/tests

.agent-config.toml

@@ -0,0 +1,2 @@
+tracked = ["claude"]
+local_only = ["codegraph"]

.claude/rules/openwolf.md

@@ -0,0 +1,15 @@
+---
+description: OpenWolf protocol enforcement — active on all files
+globs: **/*
+---
+
+- Check .wolf/anatomy.md before reading any project file
+- Check .wolf/cerebrum.md Do-Not-Repeat list before generating code
+- After writing or editing files, update .wolf/anatomy.md and append to .wolf/memory.md
+- After receiving a user correction, update .wolf/cerebrum.md immediately (Preferences, Learnings, or Do-Not-Repeat)
+- LEARN from every interaction: if you discover a convention, user preference, or project pattern, add it to .wolf/cerebrum.md. Low threshold — when in doubt, log it.
+- BEFORE fixing any bug or error: read .wolf/buglog.json for known fixes
+- AFTER fixing any bug, error, failed test, failed build, or user-reported problem: ALWAYS log to .wolf/buglog.json with error_message, root_cause, fix, and tags
+- If you edit a file more than twice in a session, that likely indicates a bug — log it to .wolf/buglog.json
+- When the user asks to check/evaluate UI design: run `openwolf designqc` to capture screenshots, then read them from .wolf/designqc-captures/
+- When the user asks to change/pick/migrate UI framework: read .wolf/reframe-frameworks.md, ask decision questions, recommend a framework, then execute with the framework's prompt

.devcontainer/.dockerignore

@@ -0,0 +1,17 @@
+.git
+node_modules
+__pycache__
+*.pyc
+*.log
+venv
+.code-workspace
+.egg-info
+dist
+*.csv
+opendata
+data
+dist/*
+opendata/*
+*/opendata/*
+*venv**
+venv/*

.devcontainer/Dockerfile

@@ -0,0 +1,15 @@
+# Stage 1: Build stage
+FROM python:3.12.1-alpine AS build
+RUN apk add --no-cache git build-base
+WORKDIR /workspaces
+# Copy the requirements.txt file and install dependencies
+COPY requirements.txt /workspaces/
+COPY examples/ open_ksa/ pyproject.toml .devcontainer/ .github/ /workspaces/
+
+# Stage 2: Final stage
+FROM python:3.12.1-alpine
+RUN apk add --no-cache git
+WORKDIR /workspaces
+COPY --from=build /workspaces /workspaces
+RUN pip install --upgrade pip && \
+    pip install --no-cache-dir -r requirements.txt

.devcontainer/devcontainer.json

@@ -0,0 +1,14 @@
+{
+    "name": "Open KSA Package",
+    "dockerFile": "Dockerfile",
+    "context": "..",
+    "settings": {
+        "terminal.integrated.shell.linux": "/bin/bash"
+    },
+    "extensions": [
+        "ms-python.python",
+        "ms-vscode-remote.remote-containers"
+    ],
+    "remoteUser": "root"
+
+}

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# All files — Esturban reviews every PR
+* @Esturban

.github/pull_request_template.md

@@ -0,0 +1,14 @@
+## What
+
+<!-- one sentence: what does this change -->
+
+## Why
+
+<!-- what problem or goal drives it -->
+
+## Checklist
+
+- [ ] Tests pass locally (`pytest -q` / `shellcheck` / `R CMD check`)
+- [ ] No secrets or credentials committed
+- [ ] Commit messages follow `type(scope): description`
+- [ ] Ready for Esturban review

.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [dev, master, main]
+  push:
+    branches: [dev]
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+
+      - name: Install dependencies
+        run: |
+          pip install --upgrade pip
+          if [ -f pyproject.toml ]; then
+            pip install -e ".[dev]" 2>/dev/null || pip install -e ".[test]" 2>/dev/null || pip install -e . 2>/dev/null || true
+          fi
+          if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt; fi
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          pip install ruff pytest 2>/dev/null || true
+
+      - name: Lint
+        run: ruff check .
+
+      - name: Test
+        run: |
+          if find . -name "test_*.py" -o -name "*_test.py" | grep -q .; then
+            pytest --tb=short -q
+          else
+            echo "No tests found — skipping (add tests to enforce this step)"
+          fi

.github/workflows/dev-to-trunk.yml

@@ -0,0 +1,76 @@
+name: Dev to Trunk Auto-PR
+
+# Opens (or refreshes) a PR from `dev` into this repo's trunk (default) branch on
+# every push to `dev`, requesting the repo owner (Esturban) as reviewer.
+#
+# EV's hard rule: a PR is ONLY ever opened by this Action -- never by a human or
+# agent running `gh pr create`. Push `dev` -> this Action opens the PR -> EV reviews.
+#
+# Idempotent + no-diff safe: if an open dev -> trunk PR already exists it is refreshed
+# (reviewer re-requested), not duplicated; if `dev` has no commits ahead of trunk the
+# run exits cleanly and fires again on the next push.
+
+on:
+  push:
+    branches: [dev]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  open-pr:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      TRUNK: ${{ github.event.repository.default_branch }}
+    steps:
+      - name: Checkout (full history for trunk..dev diff)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Open or refresh dev -> trunk PR
+        run: |
+          set -euo pipefail
+
+          # Hardcoded, not ${GITHUB_REPOSITORY_OWNER}: that resolves to the org
+          # name on org-owned repos (e.g. EV-Advisory), which isn't a valid PR
+          # reviewer/assignee target -- both calls silently no-op with `|| true`
+          # swallowing the error, so the Action reports success while doing nothing.
+          OWNER="Esturban"
+          echo "dev -> ${TRUNK} (reviewer: ${OWNER})"
+
+          # No commits on dev ahead of trunk -> nothing to PR (fires again next push).
+          if [ -z "$(git rev-list "origin/${TRUNK}..HEAD" 2>/dev/null || true)" ]; then
+            echo "No commits on dev ahead of ${TRUNK}; nothing to PR."
+            exit 0
+          fi
+
+          # Idempotency: refresh the existing open PR instead of opening a duplicate.
+          EXISTING="$(gh pr list --head dev --base "${TRUNK}" --state open --json number --jq '.[0].number // empty')"
+          if [ -n "${EXISTING}" ]; then
+            echo "PR #${EXISTING} already open for dev -> ${TRUNK}; re-requesting reviewer."
+            gh pr edit "${EXISTING}" --add-reviewer "${OWNER}" 2>/dev/null \
+              || gh pr edit "${EXISTING}" --add-assignee "${OWNER}" 2>/dev/null || true
+            exit 0
+          fi
+
+          TITLE="$(git log -1 --pretty=format:%s HEAD)"
+          [ -n "${TITLE}" ] || TITLE="dev -> ${TRUNK}"
+          BODY="Auto-opened by the \`Dev to Trunk Auto-PR\` action on push to \`dev\` (base: \`${TRUNK}\`). ${OWNER} requested as reviewer."
+
+          # The owner cannot always be a reviewer; fall back to assignee but never
+          # double-create: if the reviewer call already created the PR, just edit it.
+          if gh pr create --base "${TRUNK}" --head dev --title "${TITLE}" --body "${BODY}" --reviewer "${OWNER}"; then
+            echo "PR created with ${OWNER} as reviewer."
+          else
+            NUM="$(gh pr list --head dev --base "${TRUNK}" --state open --json number --jq '.[0].number // empty')"
+            if [ -n "${NUM}" ]; then
+              echo "PR #${NUM} exists; adding ${OWNER} as assignee."
+              gh pr edit "${NUM}" --add-assignee "${OWNER}" 2>/dev/null || true
+            else
+              echo "Reviewer path failed and no PR exists; creating with assignee."
+              gh pr create --base "${TRUNK}" --head dev --title "${TITLE}" --body "${BODY}" --assignee "${OWNER}"
+            fi
+          fi

.github/workflows/publish-to-pypi.yml

@@ -9,6 +9,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
@@ -26,15 +28,15 @@ jobs:
   publish-to-pypi:
     name: >-
       Publish Python 🐍 distribution 📦 to PyPI
-    if: startsWith(github.ref, 'refs/tags/')  # only publish to PyPI on tag pushes
+    if: startsWith(github.ref, 'refs/tags/')
     needs:
     - build
     runs-on: ubuntu-latest
     environment:
       name: pypi
       url: https://pypi.org/p/open_ksa
     permissions:
-      id-token: write  # IMPORTANT: mandatory for trusted publishing
+      id-token: write
 
     steps:
     - name: Download all the dists
@@ -54,8 +56,8 @@ jobs:
     runs-on: ubuntu-latest
 
     permissions:
-      contents: write  # IMPORTANT: mandatory for making GitHub Releases
-      id-token: write  # IMPORTANT: mandatory for sigstore
+      contents: write 
+      id-token: write 
 
     steps:
     - name: Download all the dists
@@ -64,7 +66,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Sign the dists with Sigstore
-      uses: sigstore/gh-action-sigstore-python@v2.1.1
+      uses: sigstore/gh-action-sigstore-python@v3.0.0
       with:
         inputs: >-
           ./dist/*.tar.gz
@@ -87,9 +89,9 @@ jobs:
         gh release upload
         '${{ github.ref_name }}' dist/**
         --repo '${{ github.repository }}'
-
   publish-to-testpypi:
     name: Publish Python 🐍 distribution 📦 to TestPyPI
+    if: startsWith(github.ref, 'refs/tags/')
     needs:
     - build
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -0,0 +1,33 @@
+name: Release
+
+on:
+  push:
+    branches: [master, main]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Use existing tag on this commit, or generate a date-based one
+          TAG=$(git tag --points-at HEAD | head -1)
+          if [ -z "$TAG" ]; then
+            TAG="v$(date -u +%Y.%m.%d)-$(git rev-parse --short HEAD)"
+            git tag "$TAG"
+            git push origin "$TAG"
+          fi
+          gh release create "$TAG" \
+            --generate-notes \
+            --title "$TAG" \
+            --target "$(git rev-parse HEAD)"

.gitignore

@@ -25,6 +25,7 @@ share/python-wheels/
 .installed.cfg
 *.egg
 MANIFEST
+src/
 
 # PyInstaller
 #  Usually these files are written by a python script from a template
@@ -97,6 +98,7 @@ celerybeat-schedule
 # Environments
 .env
 .venv
+venv**
 env/
 venv/
 ENV/
@@ -152,4 +154,31 @@ opendata
 
 # Data types
 *.csv
-*.json
+*.json
+.specify
+.cursor
+.ruff_cache
+.pytest_cache
+.mypy_cache
+.pytype
+.pyre
+.vscode
+.DS_Store
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+.codegraph/
+
+# AI scaffolding / IDE (never public)
+CLAUDE.md
+AGENTS.md
+GEMINI.md
+.wolf/
+.cursorrules
+.clinerules
+.windsurfrules
+.roo*
+memory-bank/
+.github/copilot-instructions.md