This repository is designed as a practical reference for building enterprise AI applications with governance, evals, traces, and demo-ready workflows.
- Add realistic enterprise failure cases.
- Improve eval coverage.
- Add production adapters without weakening local deterministic demos.
- Improve security controls around prompt injection, permission filtering, approval gates, or audit logs.
- Add docs that explain tradeoffs clearly.
- Keep all projects runnable with only Python standard library unless the change is behind an optional adapter.
- Do not make OpenAI API calls required for the basic demo.
- Do not move safety enforcement into model prompts only.
- Do not request, print, upload, or depend on secrets, local files, private user data, or account credentials.
- Do not hide eval failures, CI failures, generated artifacts, or network side effects.
- Add or update eval cases for behavior changes.
- Preserve the portfolio-level commands:
python -B scripts/dev.py api-docs
python -B scripts/dev.py assets
python -B scripts/dev.py architecture
python -B scripts/dev.py claims
python -B scripts/dev.py container-release
python -B scripts/dev.py dependency-surface
python -B scripts/dev.py contracts
python -B scripts/dev.py error-hygiene
python -B scripts/dev.py frontend
python -B scripts/dev.py health
python -B scripts/dev.py evals
python -B scripts/dev.py eval-csv
python -B scripts/dev.py fresh-clone
python -B scripts/dev.py github-launch-setup
python -B scripts/dev.py github-readiness
python -B scripts/dev.py governance
python -B scripts/dev.py model-gateway-safety
python -B scripts/dev.py observability
python -B scripts/dev.py otel-traces
python -B scripts/dev.py pr-policy
python -B scripts/dev.py pr-triage
python -B scripts/dev.py readiness-report
python -B scripts/dev.py replay
python -B scripts/dev.py replay-artifact
python -B scripts/dev.py scenario-data
python -B scripts/dev.py smoke
python -B scripts/dev.py report
python -B scripts/dev.py safety
python -B scripts/dev.py threat-model
python -B scripts/dev.py ui-contracts
python -B scripts/dev.py visual-assets
python -B scripts/dev.py workflow-security
python -B scripts/dev.py verify- Start both services.
- Run health checks.
- Run evals.
- Run smoke tests.
- Run the public safety scan.
- Run the container release hygiene check.
- Run the dependency-surface check.
- Run the architecture boundary check.
- Run the workflow security check.
- Run the model gateway safety check.
- Run the observability integrity check.
- Run the scenario data integrity check.
- Run the error hygiene check.
- Run the frontend integrity check.
- Run the threat model check.
- Run the PR review policy check.
- Run the runtime UI contract check.
- Run the visual asset manifest check.
- Run the API documentation check.
- Run the replay artifact export before release updates.
- Run the fresh clone check before broad external sharing or release updates.
- Update docs and demo report if behavior changed.
- The change has a clear business or engineering purpose.
- Evals pass.
- Smoke tests pass.
- Public safety scan passes.
- Container release hygiene check passes.
- Dependency-surface check passes.
- Architecture boundary check passes.
- Workflow security check passes.
- Model gateway safety check passes.
- Observability integrity check passes.
- Scenario data integrity check passes.
- Error hygiene check passes.
- Frontend integrity check passes.
- Threat model check passes.
- PR review policy check passes.
- Runtime UI contract check passes.
- Visual asset manifest check passes.
- API documentation check passes.
- Replay artifact export passes before release updates.
- Fresh clone check passes before broad external sharing or release updates.
- Security or governance behavior is not weakened.
- README or docs are updated if the user-facing workflow changed.
See First Pull Request Checklist and Issue To PR Handoff Flow before opening a local PR, and Maintainer Review Policy for how reviews and external PRs are triaged.