Merge pull request #93 from Copilot-home/copilot/research-daiof-framework

feat: DAIOF Production Deployment Checklist — Security hardening, CI fixes, tests, documentation

Author: NguyenCuong1989

.github/copilot-instructions.md

@@ -1,145 +1,66 @@
-# 🌟 Digital AI Organism Framework (DAIOF)
+# 🧬 Digital AI Organism Framework (DAIOF)
 
-> ## 🚀 **OFFICIALLY LAUNCHED - October 30, 2025!** 🎉
+> **OFFICIALLY LAUNCHED — October 30, 2025**
 
 ## Architecture Overview
 
-This project uses [autoplans.dev](https://autoplans.dev) for AI-powered project management and development automation.
+DAIOF applies biological principles to AI systems: organisms have genomes, metabolism, nervous systems and live inside ecosystems.
 
 ### Key Components
 
-Document your major system components and their interactions here:
-- Service boundaries and responsibilities
-- Data flow between components
-- Integration points and external dependencies
-- Critical architectural decisions and the reasoning behind them
+| Layer | Location | Responsibility |
+|---|---|---|
+| **Framework core** | `digital_ai_organism_framework.py` | `DigitalGenome`, `DigitalOrganism`, `DigitalEcosystem`, `SymphonyControlCenter` (monolith) |
+| **Package API** | `src/hyperai/` | Installable package re-exporting core classes with proper module boundaries |
+| **HAIOS Runtime** | `haios_runtime.py` | 7 Hard Invariants, AttestationLog (SHA-256 chain), safety floor enforcement |
+| **Orchestrator** | `unified_ai_orchestrator.py` | Heartbeat cycle (60 s) connecting all AI modules |
+| **LLM integration** | `ollama_config.py` | Ollama local LLM client with D&R 3-phase protocol |
+| **Autonomous agents** | `.github/scripts/` | GitHub API automation (issue triage, health, metrics, autonomous dev) |
+| **CI/CD** | `.github/workflows/ci.yml` | Pytest, flake8 lint, gene verification, codecov |
 
 ### Technology Stack
 
-List your core technologies, frameworks, and key dependencies:
-- Languages and runtimes
-- Frameworks and libraries
-- Database and data storage
-- External services and APIs
+- **Language**: Python 3.9+
+- **Dependencies**: `numpy`, `PyGithub`, `pyyaml`, `requests` (see `requirements.txt`)
+- **LLM**: Ollama local (`http://localhost:11434`) — no cloud LLM keys required
+- **Storage**: SQLite (`autonomous_todo.db`), JSONL audit logs
+- **CI**: GitHub Actions, Codecov
 
 ## Development Workflows
 
 ### Build & Run
 ```bash
-# Add your build commands here
-npm install
-npm run build
-npm run dev
+pip install -r requirements.txt      # runtime deps
+pip install -e ".[dev]"               # editable install + dev tools
+hyperai                               # CLI health check
+python quick_start.py                 # interactive demo
 ```
 
 ### Testing
 ```bash
-# Add your test commands here
-npm test
-npm run test:e2e
+pytest tests/ -v --cov=digital_ai_organism_framework
+python -m unittest tests/test_smoke.py
 ```
 
-### Debugging
-- Describe debugging setup and common debugging scenarios
-- Document environment variables and configuration
-- Note any debugging tools or extensions required
+### Key Design Patterns
 
-## Project-Specific Conventions
-
-### Code Style & Patterns
-- Document naming conventions that differ from defaults
-- Describe project-specific design patterns
-- Note any non-standard code organization
+- **4 Pillars** (`an_toan`, `duong_dai`, `tin_vao_so_lieu`, `han_che_rui_ro`): every action scored against Safety, Long-term, Data-driven, Risk-reduction.
+- **D&R Protocol** (Deconstruction → Focal Point → Re-architecture): applied in `SymphonyControlCenter.apply_dr_protocol()` and `OllamaClient.dandr_analysis()`.
+- **7 Hard Invariants**: attribution, safety floor ≥ 7, rollback, K-State = 1, 4 pillars composite ≥ 7.5, governance quorum, immutable audit.
+- **Biological metaphor**: `DigitalGenome` (traits + mutation), `DigitalMetabolism` (resource mgmt), `DigitalNervousSystem` (perception/decision).
 
 ### Git Workflow
-- Branch naming conventions
-- Commit message format
-- PR requirements and review process
-
-## Task Management with Autoplans
-
-This project uses **autoplans.dev Language Model Tools** for intelligent task management. AI agents can:
-
-### Available Autoplans Tools
-```typescript
-// Project Management
-autoplans_list_projects()           // List all projects
-autoplans_create_project({name, description})  // Create new project
-autoplans_get_project({projectId})  // Get project details
-
-// Task Management  
-autoplans_list_tasks({projectId})   // List tasks for a project
-autoplans_create_task({projectId, title, description, priority, type})
-autoplans_update_task({taskId, status, priority, ...})
-autoplans_delete_task({taskId})
-autoplans_get_task({taskId})
-
-// Bulk Operations
-autoplans_bulk_create_tasks({projectId, tasks: []})
-autoplans_bulk_update_tasks({projectId, taskIds: [], updates: {}})
-
-// Business Planning
-autoplans_get_business_plan({projectId})
-autoplans_create_business_plan({projectId, ...})
-autoplans_update_business_plan({projectId, ...})
-
-// Repository Sync
-autoplans_generate_copilot_config()         // Generate this file
-autoplans_initialize_autoplans_folder()     // Create .autoplans/ docs
-autoplans_sync_project_to_repo()            // Sync all files
-```
-
-### Task Management Guidelines
-
-**When working on this project:**
-1. **Before starting work**: Check `autoplans_list_tasks()` for assigned tasks
-2. **Creating tasks**: Use `autoplans_create_task()` with clear descriptions and proper type (coding/design/documentation/testing)
-3. **Updating progress**: Call `autoplans_update_task()` to update status (pending → in_progress → completed)
-4. **Planning features**: Break down large features into smaller tasks using `autoplans_bulk_create_tasks()`
-
-**Task Types:**
-- `coding` - Implementation work
-- `design` - Architecture, UI/UX design
-- `documentation` - Docs, comments, guides
-- `testing` - Unit tests, E2E tests, QA
-
-**Task Status:**
-- `pending` - Not started
-- `in_progress` - Currently working
-- `blocked` - Waiting on dependency
-- `completed` - Finished
-- `waiting_for_review` - Ready for PR review
-
-## Getting Help
 
-- Visit [autoplans.dev](https://autoplans.dev) for documentation
-- Use `@autoplans` in Copilot chat for project-specific help
-- Check `.autoplans/` folder for project documentation and task details
-- Review `.autoplans/tasks.md` for current task list
-
----
-
-*Generated by autoplans.dev - Update this file with project-specific patterns and conventions as they emerge*
+- Main branch: `main`
+- CI runs on push/PR to `main` and `develop`
+- Autonomous workflows are **workflow_dispatch only** (schedules commented out)
+- Commit format: emoji prefix + short description (e.g., `🧬 Add genome mutation`)
 
 ## Instructions for AI Agents
 
-**This section should be customized based on codebase analysis:**
-
-Analyze this codebase to discover:
-- The "big picture" architecture requiring multiple files to understand - major components, service boundaries, data flows, and the "why" behind structural decisions
-- Critical developer workflows (builds, tests, debugging) especially commands that aren't obvious from file inspection alone
-- Project-specific conventions and patterns that differ from common practices
-- Integration points, external dependencies, and cross-component communication patterns
-
-Source existing AI conventions from:
-`**/{.github/copilot-instructions.md,AGENT.md,AGENTS.md,CLAUDE.md,.cursorrules,.windsurfrules,.clinerules,.cursor/rules/**,.windsurf/rules/**,.clinerules/**,README.md}`
-
-When updating this file:
-- Merge intelligently - preserve valuable content while updating outdated sections
-- Write concise, actionable instructions (~20-50 lines) using markdown structure
-- Include specific examples from the codebase when describing patterns
-- Avoid generic advice - focus on THIS project's specific approaches
-- Document only discoverable patterns, not aspirational practices
-- Reference key files/directories that exemplify important patterns
-
-For more guidance: https://aka.ms/vscode-instructions-docs
+1. **Core logic** lives in `digital_ai_organism_framework.py` (large file); read `src/hyperai/__init__.py` for the public API surface.
+2. **Tests** go in `tests/`; run `pytest tests/ -v` before any change.
+3. **Do not enable** `enable_sensitive_data=True` in observability — it captures prompts.
+4. **Workflow permissions** follow least-privilege; only add permissions that are strictly needed.
+5. **`sovereign_runner.py`** is local-only macOS tooling — not for production or CI.
+6. Creator attribution (`alpha_prime_omega`, verification `4287`) is a project constant — do not alter.

.github/workflows/ai-agent-autonomous.yml

@@ -19,22 +19,20 @@ on:
 
 permissions:
   contents: write
-  issues: write
   pull-requests: write
-  discussions: write
 
 jobs:
   autonomous-agent:
     runs-on: ubuntu-latest
     steps:
       - name: 🚀 Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 🐍 Setup Python Environment
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.10'
           cache: 'pip'

.github/workflows/autonomous-development.yml

@@ -20,9 +20,7 @@ on:
 
 permissions:
   contents: write
-  issues: write
   pull-requests: write
-  discussions: write
 
 jobs:
   autonomous_development:
@@ -31,13 +29,13 @@ jobs:
 
     steps:
       - name: 🧬 Clone Organism DNA
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 🐍 Prepare Organism Environment
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.9'
           cache: 'pip'

.github/workflows/autonomous-git-workflow.yml

@@ -24,9 +24,7 @@ on:
 
 permissions:
   contents: write
-  issues: write
   pull-requests: write
-  discussions: write
 
 jobs:
   autonomous_git_workflow:
@@ -35,7 +33,7 @@ jobs:
 
     steps:
       - name: 🧬 Clone Repository with Full History
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/autonomous-security-fix.yml

@@ -30,9 +30,7 @@ on:
 
 permissions:
   contents: write
-  issues: write
   pull-requests: write
-  security-events: write
 
 jobs:
   autonomous_security_fix:

.github/workflows/ci.yml

@@ -6,40 +6,41 @@ on:
   pull_request:
     branches: [ main, develop ]
 
+# Principle of Least Privilege: only read access for CI checks
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test on Python ${{ matrix.python-version }}
     runs-on: ${{ matrix.os }}
 
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
+        # Reduced to ubuntu-only to cut CI cost; framework is pure Python with no
+        # platform-specific code.  Re-add macos-latest/windows-latest if native
+        # extensions are introduced.
+        os: [ubuntu-latest]
+        python-version: ['3.9', '3.10', '3.11', '3.12']
 
     steps:
     - name: 📥 Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: 🐍 Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
 
     - name: 📦 Install dependencies
       run: |
         python -m pip install --upgrade pip
         pip install -r requirements.txt
-        pip install pytest pytest-cov black flake8 mypy
-    
-    - name: 🎨 Check code style with Black
-      run: black --check .
-      continue-on-error: true
+        pip install pytest pytest-cov flake8
     
-    - name: 🔍 Lint with flake8
+    - name: 🔍 Lint with flake8 (critical errors only)
       run: |
         flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=100 --statistics
-      continue-on-error: true
     
     - name: 🧬 Verify immutable genes
       run: |
@@ -59,10 +60,10 @@ jobs:
     - name: 🧪 Run tests
       run: |
         pytest tests/ -v --cov=digital_ai_organism_framework --cov-report=xml --cov-report=term
-      continue-on-error: true
     
     - name: 📊 Upload coverage to Codecov
-      uses: codecov/codecov-action@v4
+      if: matrix.python-version == '3.11'
+      uses: codecov/codecov-action@18283e04ce6e62d37312384ff67ab1fd11d9025a # v4.7.2
       with:
         file: ./coverage.xml
         flags: unittests
@@ -75,10 +76,10 @@ jobs:
 
     steps:
     - name: 📥 Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: 🐍 Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.11'
 
@@ -123,34 +124,31 @@ jobs:
 
     steps:
     - name: 📥 Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: 🐍 Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.11'
 
-    - name: 🔒 Run safety check
-      run: |
-        pip install safety
-        safety check --json || true
-      continue-on-error: true
-    
     - name: 🔐 Run bandit security linter
       run: |
         pip install bandit
-        bandit -r . -f json || true
+        bandit -r digital_ai_organism_framework.py haios_core.py haios_runtime.py src/ -f json -o bandit-report.json || true
+        bandit -r digital_ai_organism_framework.py haios_core.py haios_runtime.py src/ -ll
       continue-on-error: true
 
   release:
     name: Create Release
     runs-on: ubuntu-latest
     needs: [test, validate]
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
 
     steps:
     - name: 📥 Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: 🎉 Create Release
       uses: softprops/action-gh-release@v2