Normalize line endings via .gitattributes

4th-cloud · 4th-cloud · commit da60fed4e8c2 · 2025-09-28T21:52:30.000-04:00
diff --git a/.gitattributes b/.gitattributes
@@ -0,0 +1,21 @@
+# Default: text files normalized to LF in the repo
+* text=auto eol=lf
+
+# Unix-y files that MUST be LF
+*.sh      text eol=lf
+*.py      text eol=lf
+*.yml     text eol=lf
+*.yaml    text eol=lf
+Dockerfile text eol=lf
+*.tf      text eol=lf
+*.tpl     text eol=lf
+
+# Windows batch stays CRLF (if you add any)
+*.bat     text eol=crlf
+*.cmd     text eol=crlf
+
+# Treat binaries as-is
+*.zip     binary
+*.png     binary
+*.jpg     binary
+*.exe     binary
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -0,0 +1 @@
+name: placeholder
diff --git a/README.md b/README.md
@@ -0,0 +1,3 @@
+# SentinelFlow Scaffold
+
+This is a minimal scaffolding to get started.
diff --git a/charts/platform/Chart.yaml b/charts/platform/Chart.yaml
@@ -0,0 +1,4 @@
+apiVersion: v2
+name: platform
+type: application
+version: 0.1.0
diff --git a/charts/platform/templates/_helpers.tpl b/charts/platform/templates/_helpers.tpl
@@ -0,0 +1 @@
+{{- define "platform.fullname" -}}sentinelflow{{- end -}}
diff --git a/charts/platform/templates/gateway.yaml b/charts/platform/templates/gateway.yaml
@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata: { name: sentinelflow-gateway }
+spec:
+  replicas: 1
+  selector: { matchLabels: { app: sentinelflow, comp: gateway } }
+  template:
+    metadata: { labels: { app: sentinelflow, comp: gateway } }
+    spec:
+      containers:
+        - name: gateway
+          image: {{ .Values.global.registry }}/{{ .Values.global.owner }}/gateway:{{ .Values.global.tag }}
+          ports: [{ containerPort: 8080 }]
+---
+apiVersion: v1
+kind: Service
+metadata: { name: sentinelflow-gateway }
+spec:
+  type: LoadBalancer
+  selector: { app: sentinelflow, comp: gateway }
+  ports: [{ port: 80, targetPort: 8080 }]
diff --git a/charts/platform/values.yaml b/charts/platform/values.yaml
@@ -0,0 +1,4 @@
+global:
+  registry: ghcr.io
+  owner: <you>/<repo>
+  tag: dev
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -0,0 +1,43 @@
+services:
+  gateway:
+    build: ./services/gateway
+    ports: ["8080:8080"]
+    environment:
+      - SERVICE_NAME=gateway
+      - PEP_URL=http://pep:8080
+      - RAG_URL=http://rag:8080
+      - AIMS_URL=http://aims:8080
+    depends_on: [ pep, rag, aims ]
+
+  pep:
+    build: ./services/pep
+    ports: ["8084:8080"]
+    environment:
+      - SERVICE_NAME=pep
+      - PDP_URL=http://aims:8080
+
+  aims:
+    build: ./services/aims
+    ports: ["8090:8080"]
+    environment:
+      - SERVICE_NAME=aims
+
+  rag:
+    build: ./services/rag
+    ports: ["8081:8080"]
+    environment:
+      - SERVICE_NAME=rag
+      - TOOLS_URL=http://tools:8080
+      - MODELS_URL=http://models:8080
+
+  tools:
+    build: ./services/tools
+    ports: ["8082:8080"]
+    environment:
+      - SERVICE_NAME=tools
+
+  models:
+    build: ./services/models
+    ports: ["8083:8080"]
+    environment:
+      - SERVICE_NAME=models
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
@@ -0,0 +1 @@
+#!/usr/bin/env bash
diff --git a/services/aims/Dockerfile b/services/aims/Dockerfile
@@ -0,0 +1,7 @@
+FROM python:3.11-slim
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY . .
+EXPOSE 8080
+CMD ["uvicorn","app:app","--host","0.0.0.0","--port","8080"]
diff --git a/services/aims/app.py b/services/aims/app.py
@@ -0,0 +1,38 @@
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+app = FastAPI(title="aims")
+
+EVIDENCE: list[dict] = []
+RULES = {"deny":["password","ssn","credit card"], "mask":["email@","@company.com"]}
+
+class PDPInput(BaseModel):
+    user_id: str | None = None
+    prompt: str
+    sensitivity: str | None = None
+    labels: list[str] = []
+
+@app.get("/healthz")
+async def healthz(): return {"status":"ok","service":"aims"}
+
+@app.post("/v1/pdp/decide")
+async def pdp_decide(inp: PDPInput):
+    p = inp.prompt.lower()
+    if (inp.sensitivity or "").lower() in {"confidential","restricted"}:
+        for kw in RULES["deny"]:
+            if kw in p: return {"decision":"deny","reason":f"Found '{kw}'"}
+    mask_terms = [kw for kw in RULES["mask"] if kw in inp.prompt]
+    if mask_terms: return {"decision":"modify","mask_terms":mask_terms,"reason":"masked low-risk ids"}
+    return {"decision":"allow","reason":"default allow"}
+
+class Evidence(BaseModel):
+    kind: str
+    decision: str | None = None
+
+@app.post("/v1/evidence")
+async def add_evidence(ev: Evidence):
+    EVIDENCE.append(ev.model_dump())
+    return {"ok": True, "count": len(EVIDENCE)}
+
+@app.get("/v1/evidence")
+async def list_ev(): return {"items": EVIDENCE[-100:]}
diff --git a/services/aims/requirements.txt b/services/aims/requirements.txt
@@ -0,0 +1,4 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6
+httpx==0.27.2
+pydantic==2.9.2
diff --git a/services/gateway/Dockerfile b/services/gateway/Dockerfile
@@ -0,0 +1,7 @@
+FROM python:3.11-slim
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY . .
+EXPOSE 8080
+CMD ["uvicorn","app:app","--host","0.0.0.0","--port","8080"]
diff --git a/services/gateway/app.py b/services/gateway/app.py
@@ -0,0 +1,55 @@
+from fastapi import FastAPI, HTTPException
+from pydantic import BaseModel
+import os, httpx
+
+app = FastAPI(title="gateway")
+
+class Query(BaseModel):
+    user_id: str | None = None
+    prompt: str
+    sensitivity: str | None = None
+    labels: list[str] = []
+
+PEP_URL  = os.getenv("PEP_URL",  "http://pep:8080")
+RAG_URL  = os.getenv("RAG_URL",  "http://rag:8080")
+AIMS_URL = os.getenv("AIMS_URL", "http://aims:8080")
+
+@app.get("/healthz")
+async def healthz(): return {"status":"ok","service":"gateway","version":os.getenv("VERSION","dev")}
+
+@app.post("/v1/route")
+async def route(q: Query):
+    # 1) ask PEP
+    try:
+        async with httpx.AsyncClient(timeout=10) as c:
+            d = await c.post(f"{PEP_URL}/v1/decide", json=q.model_dump())
+            d.raise_for_status()
+            decision = d.json()
+    except Exception as e:
+        raise HTTPException(502, f"PEP unavailable: {e}")
+
+    if decision.get("decision") == "deny":
+        return {"allowed": False, "reason": decision.get("reason")}
+
+    # 2) apply modify/masking if any
+    prompt = q.prompt
+    for t in decision.get("mask_terms", []):
+        prompt = prompt.replace(t, "[REDACTED]")
+
+    # 3) call RAG
+    try:
+        async with httpx.AsyncClient(timeout=15) as c:
+            r = await c.post(f"{RAG_URL}/v1/answer", json={"prompt": prompt, "labels": q.labels})
+            r.raise_for_status()
+            payload = r.json()
+    except Exception as e:
+        raise HTTPException(502, f"RAG unavailable: {e}")
+
+    # 4) non-blocking evidence
+    try:
+        async with httpx.AsyncClient(timeout=5) as c:
+            await c.post(f"{AIMS_URL}/v1/evidence", json={"kind":"gateway_log","decision":decision.get("decision")})
+    except Exception:
+        pass
+
+    return {"allowed": True, "result": payload}
diff --git a/services/gateway/requirements.txt b/services/gateway/requirements.txt
@@ -0,0 +1,4 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6
+httpx==0.27.2
+pydantic==2.9.2
diff --git a/services/models/Dockerfile b/services/models/Dockerfile
@@ -0,0 +1,7 @@
+FROM python:3.11-slim
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY . .
+EXPOSE 8080
+CMD ["uvicorn","app:app","--host","0.0.0.0","--port","8080"]
diff --git a/services/models/app.py b/services/models/app.py
@@ -0,0 +1,11 @@
+from fastapi import FastAPI
+from pydantic import BaseModel
+app = FastAPI(title="models")
+class GenReq(BaseModel):
+    prompt: str
+    context: str = ""
+@app.get("/healthz")
+async def healthz(): return {"status":"ok","service":"models"}
+@app.post("/v1/generate")
+async def generate(req: GenReq):
+    return {"text": f"Echo: {req.prompt} | ctx bytes: {len(req.context)}"}
diff --git a/services/models/requirements.txt b/services/models/requirements.txt
@@ -0,0 +1,4 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6
+httpx==0.27.2
+pydantic==2.9.2
diff --git a/services/pep/Dockerfile b/services/pep/Dockerfile
@@ -0,0 +1,7 @@
+FROM python:3.11-slim
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY . .
+EXPOSE 8080
+CMD ["uvicorn","app:app","--host","0.0.0.0","--port","8080"]
diff --git a/services/pep/app.py b/services/pep/app.py
@@ -0,0 +1,23 @@
+from fastapi import FastAPI
+from pydantic import BaseModel
+import os, httpx
+
+app = FastAPI(title="pep")
+
+class EvalRequest(BaseModel):
+    user_id: str | None = None
+    prompt: str
+    sensitivity: str | None = None
+    labels: list[str] = []
+
+PDP_URL = os.getenv("PDP_URL", "http://aims:8080")
+
+@app.get("/healthz")
+async def healthz(): return {"status":"ok","service":"pep"}
+
+@app.post("/v1/decide")
+async def decide(req: EvalRequest):
+    async with httpx.AsyncClient(timeout=10) as c:
+        r = await c.post(f"{PDP_URL}/v1/pdp/decide", json=req.model_dump())
+        r.raise_for_status()
+        return r.json()
diff --git a/services/pep/requirements.txt b/services/pep/requirements.txt
@@ -0,0 +1,4 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6
+httpx==0.27.2
+pydantic==2.9.2
diff --git a/services/rag/Dockerfile b/services/rag/Dockerfile
@@ -0,0 +1,7 @@
+FROM python:3.11-slim
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY . .
+EXPOSE 8080
+CMD ["uvicorn","app:app","--host","0.0.0.0","--port","8080"]
diff --git a/services/rag/app.py b/services/rag/app.py
@@ -0,0 +1,26 @@
+from fastapi import FastAPI
+from pydantic import BaseModel
+import os, httpx
+
+app = FastAPI(title="rag")
+
+class RAGQuery(BaseModel):
+    prompt: str
+    labels: list[str] = []
+
+TOOLS_URL  = os.getenv("TOOLS_URL",  "http://tools:8080")
+MODELS_URL = os.getenv("MODELS_URL", "http://models:8080")
+
+@app.get("/healthz")
+async def healthz(): return {"status":"ok","service":"rag"}
+
+@app.post("/v1/answer")
+async def answer(q: RAGQuery):
+    async with httpx.AsyncClient(timeout=10) as c:
+        t = await c.post(f"{TOOLS_URL}/v1/toolcall", json={"prompt": q.prompt})
+        t.raise_for_status()
+        ctx = t.json().get("context","")
+        m = await c.post(f"{MODELS_URL}/v1/generate", json={"prompt": q.prompt, "context": ctx})
+        m.raise_for_status()
+        out = m.json()
+    return {"answer": out.get("text"), "used_context": ctx}
diff --git a/services/rag/requirements.txt b/services/rag/requirements.txt
@@ -0,0 +1,4 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6
+httpx==0.27.2
+pydantic==2.9.2
diff --git a/services/tools/Dockerfile b/services/tools/Dockerfile
@@ -0,0 +1,7 @@
+FROM python:3.11-slim
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY . .
+EXPOSE 8080
+CMD ["uvicorn","app:app","--host","0.0.0.0","--port","8080"]
diff --git a/services/tools/app.py b/services/tools/app.py
@@ -0,0 +1,9 @@
+from fastapi import FastAPI
+from pydantic import BaseModel
+app = FastAPI(title="tools")
+class ToolReq(BaseModel): prompt: str
+@app.get("/healthz")
+async def healthz(): return {"status":"ok","service":"tools"}
+@app.post("/v1/toolcall")
+async def toolcall(req: ToolReq):
+    return {"context": f"[ctx for: {req.prompt[:32]}...]"}
diff --git a/services/tools/requirements.txt b/services/tools/requirements.txt
@@ -0,0 +1,4 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6
+httpx==0.27.2
+pydantic==2.9.2

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+# SentinelFlow Scaffold`
	`2`	`+`
	`3`	`+This is a minimal scaffolding to get started.`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+{{- define "platform.fullname" -}}sentinelflow{{- end -}}`