Document dashboard and SDK authentication for LLM invocation - #5
Closed
Goldokpa wants to merge 52 commits into
Closed
Document dashboard and SDK authentication for LLM invocation#5Goldokpa wants to merge 52 commits into
Goldokpa wants to merge 52 commits into
Conversation
Implements the AgentGateway Protocol — a credential isolation layer for production AI agents. Agents never hold raw secrets; all credentialed operations route through a gateway. Core SDK: - AgentGateway Protocol (runtime_checkable, 4 async methods) - DirectGateway — local dev with OpenAI + Anthropic support, cost tracking - ControlPlaneGateway — production gateway, zero secrets in agent, retry + backoff - MockGateway — test double with response queueing and full call recording - Complete exception hierarchy rooted at SandcastleError - Full data models: Message, Role, LLMResponse, PresignedURL, TokenUsage, ToolCall Tooling: - pyproject.toml with hatchling build, optional extras (openai, anthropic, all) - ruff + mypy strict mode, fully passing - pytest-asyncio unit suite (51 tests, zero network calls required) - GitHub Actions CI — matrix Python 3.10/3.11/3.12, PyPI publish on git tag - py.typed marker for downstream mypy compatibility - .gitignore and .env.example for contributor onboarding Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- DirectGateway: auto-detect provider from client class name and base_url (Anthropic, Mistral via mistral.ai URL, local via localhost/127.0.0.1) - Add explicit `provider` parameter and read-only `provider` property - Add Mistral pricing table; `_estimate_cost` returns $0.00 for provider='local' - Add examples/: openai_quickstart.py, ollama_local.py, mistral_eu.py - README: Data Sovereignty section + updated providers table with EU/local flags - pyproject.toml: add mistral optional extra, update all extra - tests: TestDirectGatewayProviderDetection (10 new cases, 61 total passing) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
README badge, __init__.py docstring, and pyproject.toml URLs all pointed to the non-existent Goldokpa/sandcastle-sdk repo instead of Goldokpa/Sandcastle. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rename sandcastle/ source directory to credseal/ - Update all imports, logger names, and module docstrings - Rename SandcastleError → CredSealError, SandcastleGateway → CredSealGateway - Update pyproject.toml: package name credseal-sdk, wheel target credseal - Update README, CLAUDE.md, CHANGELOG, CONTRIBUTING, examples, CI workflow - All 61 unit tests passing; ruff and mypy clean Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Local Claude Code rules are for personal use only and should not be tracked in the public repository. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- credseal/integrations/langchain.py: CredSealChatModel(BaseChatModel)
wraps any AgentGateway as a drop-in LangChain chat model
- lc_to_credseal(): converts Human/AI/System/Tool messages
- credseal_to_ai_message(): converts LLMResponse → AIMessage with
tool_calls and response_metadata (cost_usd, tokens, finish_reason)
- _agenerate() async primary path; _generate() sync via thread executor
- Tools passed through in OpenAI function-calling format
- tests/unit/test_integrations.py: 19 tests, all passing (80 total)
- examples/langchain_agent.py: tool-calling agent example
- pyproject.toml: langchain extra now requires langchain-core>=0.2.0 only
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- credseal/integrations/llamaindex.py: CredSealLLM(CustomLLM)
wraps any AgentGateway as a LlamaIndex LLM
- li_to_credseal(): converts all MessageRole variants including
CHATBOT→ASSISTANT, DEVELOPER→SYSTEM, FUNCTION→TOOL
- credseal_to_chat_response(): converts LLMResponse → ChatResponse
with tool_calls in additional_kwargs and cost/token metadata in raw
- achat()/chat() as primary chat interface; acomplete()/complete()
wraps prompt as a user message
- stream_complete()/stream_chat() raise NotImplementedError (roadmap)
- tests/unit/test_integrations.py: 23 new tests (103 total)
- examples/llamaindex_agent.py: tool-calling agent example
- pyproject.toml: llamaindex extra now requires llama-index-core>=0.10.0 only
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a CrewAI BaseLLM wrapper (CredSealCrewAILLM) plus unit tests and a runnable example. Made-with: Cursor
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- n8n community node (adapters/n8n/) with credentials and node implementation - docs/adapters/ with guides for LangChain, LangGraph, LlamaIndex, CrewAI, n8n Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace typing.Union with X | Y syntax - Replace typing.Optional with X | None syntax - Use lowercase list/dict instead of typing.List/Dict - Import Sequence from collections.abc instead of typing - Break long super().__init__() line to fix E501 Fixes CI lint failures (24 ruff errors). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove unused type: ignore comments (lines 46, 50) - Add full type parameters: list[dict[str, Any]] instead of list[dict] Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add LICENSE-COMMERCIAL.md for enterprise customers (AGPL + Commercial dual license) - Add COMMUNITY.md with GitHub Discussions and support info - Add benchmarks/ directory with SDK overhead measurements (0.003ms actual overhead) - Update README with community links, demo link, and dual licensing info Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add GitHub Actions CI/CD workflow with deploy to Fly.io - Add Sentry SDK integration for error tracking (free tier) - Add database migration 006 for key_prefix column - Add SENTRY_DSN config option Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix import sorting in test files (I001) - Remove unused imports (F401) - Add return type annotation to __getattr__ (ANN202) - Remove unused variable exc_type in gemini.py (F841) - Move imports to top of file in langgraph.py (E402) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add type: ignore comments for google-generativeai SDK type issues - Add type annotation for tool_calls variable - Configure mypy overrides to relax strict checks for integrations (third-party SDK stubs are often incomplete) - Disable warn_unused_ignores to handle cross-version type stub differences Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The test_request_file_url test was failing in CI because it tried to create directories at /workspace which isn't writable. Updated the gemini_gateway fixture to use pytest's tmp_path for the workspace. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Complete product rebrand: - Rename package from credseal to identark - Update all imports, references, and documentation - Update package name to identark-sdk - Update URLs to identark.io domain - Update GitHub org references to identark/sdk Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Simpler package name: `pip install identark` - Updated all GitHub URLs to identark/identark - Cleaner imports matching industry standard (openai, anthropic, stripe) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add pytest skip marker for Python < 3.10 in test_integrations.py - Move external library imports (langchain_core, llama_index) inside test functions - Make identark integration imports conditional on Python version >= 3.10 - This prevents import errors during test collection on older Python versions
- Rename CredSeal to IdentArk across SDK - Add validation module - Add pricing module - Update n8n adapters with new branding - Update tests and integrations
Remove unused typing.cast, typing.Any, typing.TYPE_CHECKING, and llama_index.core.llms.ChatResponse imports. Simplify test_integrations.py by removing the redundant Python version guard around imports (already handled by pytestmark skipif). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Multi-agent CrewAI example showcasing IdentArk's core capabilities: - Triage → Forensics → Remediation agent pipeline - Human-in-the-loop approval for high-risk actions - Full audit trail with timestamps - Cost tracking via IdentArk gateway Includes both CLI (security_incident_crew.py) and Streamlit web app (security_crew_app.py) for customer demos. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…-identark) The IdentArk n8n community node now lives in its own repository so it can meet n8n's May-2026 verified-node requirements (provenance publish via GitHub Actions, npm Trusted Publisher, repo-root package layout). Keeping a copy here would create two sources of truth and risk a tag-trigger collision between this repo's PyPI release workflow (v*) and an n8n publish workflow (*.*.*) — v1.2.0 matches both.
Remove unused typing.cast, typing.Any, typing.TYPE_CHECKING, and llama_index.core.llms.ChatResponse imports. Simplify test_integrations.py by removing the redundant Python version guard around imports (already handled by pytestmark skipif). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
chore: remove n8n adapter (moved to dedicated repo)
LICENSE file (legally binding) says MIT; pyproject license field says MIT; landing page claims MIT. Removed contradictory AGPL badge, classifier, __license__ constant, and dual-licensing README section. Strategy: SDK/protocol = MIT (maximize adoption of AgentGateway standard); control plane = proprietary (the monetized, defensible layer).
…credseal wheels - v1.1.0 (2026-03-18): LangChain/LlamaIndex/CrewAI integrations, PyPI trusted publishing - v1.2.0 (2026-04-02): CredSeal->IdentArk rebrand, validation module, CI/Sentry - Deleted stale pre-rebrand credseal_sdk-1.0.0 artifacts from local dist/ - Note: Python 3.9 audit item already resolved (requires-python >=3.10, CI matrix 3.10-3.12)
ci.yml, ci-enhanced.yml and publish.yml all published on the same v* tag. On a real release they raced: the first upload won, the other two failed with 'file already exists', turning every release red even on success. - Keep ci.yml's publish job (gated on tests, twine check, OIDC trusted publish) - Remove the duplicate publish job from ci-enhanced.yml - Delete redundant publish.yml Package builds clean (identark-1.2.0) and passes twine check. The PyPI badge is red only because nothing is published yet; after configuring the trusted publisher on PyPI and pushing a v1.2.0 tag, this single workflow publishes and the badge goes green.
Public runnable examples (LangGraph agent, Ollama local, n8n enterprise-support workflow). marketing_demo.py and unboarding_demo.py are kept local-only via .gitignore — internal demos, not for the public repo.
…rge) A concurrent merge reintroduced 'license = AGPL-3.0-only' in pyproject while the classifier and __license__ already said MIT. Realign the license field to MIT so the 1.2.1 wheel metadata is internally consistent. Verified: built wheel METADATA shows License: MIT + MIT classifier, v1.2.1.
CI Type Check failed with: numpy/__init__.pyi:737: error: Type statement is only supported in Python 3.12 and greater [syntax] A recent numpy ships PEP 695 'type' statements in its stubs; mypy pinned to python_version 3.10 can't parse them and bails before checking our code. We never import numpy directly (it's transitive via integration extras), so tell mypy to skip following into it. Verified: mypy clean (17 files), ruff clean.
The v1.2.1 publish failed with: invalid-publisher: valid token, but no corresponding publisher workflow_ref: .github/workflows/ci.yml@refs/tags/v1.2.1 PyPI's trusted publisher for 'identark' is registered against publish.yml (the workflow that published 1.2.0). Consolidating publishing into ci.yml broke that OIDC match. Restore publish.yml as the SOLE publisher and remove the publish job from ci.yml — matches PyPI's existing config (no PyPI change needed) and still avoids the multi-publisher race.
Same treatment as the TypeScript SDK: the mark lives in the repo rather than being hotlinked from the landing site, which is now private and would 404 for readers on GitHub or PyPI. Absolute raw.githubusercontent URL so it renders on the PyPI project page, which does not resolve repository-relative paths. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds a deployable Mintlify docs project under docs-site/: - Guides: introduction, quickstart, concepts, authentication, SDKs (Python/TS), production flow, MCP/HITL, ACS Guardian, limits & errors, security. - API Reference auto-generated from the control plane's own OpenAPI schema (95 endpoints), post-processed with the production server URL and a csk_ bearer-auth scheme. - Verified rendering with the Mintlify CLI (mint dev). Host by connecting the repo in the Mintlify dashboard with content directory docs-site/, custom domain docs.identark.io. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
docs: Mintlify documentation site + API reference
docs(cli): add production onboarding guide
ci(docs): build docs for Cloudflare Pages
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update only the LLM invoke operation and its referenced authentication schemes to describe scoped API keys, Firebase bearer tokens and dashboard session cookies. This accompanies the first protected-agent walkthrough. JSON validation passed; no SDK code or registry release changes.