Add OfficeAI-500 Sovereign Mesh demo: backend API, memory/capsule system, governance, audit and minimal frontend

[clairetech2025-max]

Motivation

• Provide an enterprise-focused task-orchestration MVP that simulates a 500-agent virtual office with governed execution, deterministic memory reuse, tamper detection, and auditable traces.
• Enable reproducible demo flows (load 500 agents, run batch demo) and observability for governance/review workflows and cost savings from memory reuse.

Description

• Add a FastAPI backend under OfficeAI-500-Sovereign-Mesh/backend with models (Agent, Task, MemoryCapsule, AuditTrace) and SQLite integration via SQLAlchemy in database.py and config.py.
• Implement memory capsule normalization, capsule id and integrity hashing, lookup and write semantics, and tamper verification in memory.py including deterministic capsule ids via sha384 and a secret salt in config.settings.
• Implement deterministic governance and conviction checks in governance.py with rules for INVOICE, EMAIL, COMPLIANCE, PAYMENT_EXCEPTION, and FINANCIAL types.
• Add execution mesh mesh.py that assigns/release agents, performs memory reuse, applies governance, writes memory capsules, and emits audit traces via audit.py.
• Provide API surface in main.py for health, agents, tasks, mesh dispatch/batch, demo load/run_500, memory tamper/verify, review approve/reject, audit and metrics endpoints.
• Add a minimal React frontend scaffold in OfficeAI-500-Sovereign-Mesh/frontend with basic UI and API client in src/api.js to exercise the demo endpoints and review flow.
• Include demo utilities (demo.py) to seed 500 agents and produce a stable set of 500 tasks, and add tests under backend/tests/test_officeai.py covering health, dispatch, governance rules, demo runs, tamper verification, and metrics.
• Add top-level and backend requirements.txt and a run.py to start the backend with uvicorn.

Testing

• Ran backend unit/integration tests with pytest (tests in OfficeAI-500-Sovereign-Mesh/backend/tests/test_officeai.py) which exercise endpoints including /health, /mesh/dispatch, governance failure cases, /demo/run_500 behavior, tamper/verify flow, and /metrics; tests passed.
• Exercised demo flows manually via the provided curl commands in the OfficeAI-500-Sovereign-Mesh/README.md to validate increased memory_hits on a second run and tamper detection behavior.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 572141a2c5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove eval on task payload before processing

The dispatcher executes eval(task.payload) on data that originates from the request body (TaskInput.payload), so a client can submit a string expression and run arbitrary Python code on the server during /mesh/dispatch or /mesh/batch. This is a direct remote code execution path (for example, any non-empty expression is evaluated before governance), and should be replaced with safe parsing/serialization (e.g., JSON) rather than eval.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Verify capsules against the wrong payload source

Integrity verification is recomputed using the payload from the first task with the same task_type instead of the payload that produced this capsule. When multiple tasks share a type but differ in payload, /memory/{capsule_id}/verify can incorrectly mark an untampered capsule as invalid (verified=False), which corrupts memory reuse behavior and auditability.

Useful? React with 👍 / 👎.