chore(release): Cut the v2.0.0-beta.1 Ailanthus beta

.env.example

@@ -8,6 +8,9 @@ LOG_CHANNEL=stack
 LOG_DEPRECATIONS_CHANNEL=null
 LOG_LEVEL=debug
 
+PLUGIN_ENGINE_LOG_CHANNEL=
+PLUGIN_ENGINE_LOG_LEVEL=warning
+
 DB_CONNECTION=mysql
 DB_HOST=mysql
 DB_PORT=3306
@@ -16,6 +19,18 @@ DB_USERNAME=trakli
 DB_PASSWORD=secret
 
 BROADCAST_DRIVER=log
+
+# Real-time chat streaming (Laravel Reverb). Set BROADCAST_DRIVER=reverb to enable.
+# In the docker stack the app reaches the server as "reverb"; the browser uses
+# the published host port (REVERB_HOST_PORT, default 6001).
+REVERB_APP_ID=your-reverb-app-id
+REVERB_APP_KEY=your-reverb-app-key
+REVERB_APP_SECRET=generate-a-secure-random-string-here
+REVERB_HOST=reverb
+REVERB_PORT=8080
+REVERB_SCHEME=http
+REVERB_HOST_PORT=6001
+
 CACHE_DRIVER=file
 FILESYSTEM_DISK=local
 QUEUE_CONNECTION=sync
@@ -29,7 +44,7 @@ REDIS_PASSWORD=null
 REDIS_PORT=6379
 
 MAIL_MAILER=smtp
-MAIL_HOST=mailpit
+MAIL_HOST=mailhog
 MAIL_PORT=1025
 MAIL_USERNAME=null
 MAIL_PASSWORD=null
@@ -88,3 +103,15 @@ GEMINI_API_KEY=
 # MAILHOG_SMTP_PORT=1025
 # MAILHOG_UI_PORT=8025
 # SMARTQL_PORT=5000
+
+# MCP (Model Context Protocol) Configuration
+MCP_ENABLED=true
+MCP_ENDPOINT=mcp
+MCP_AUTH_GUARD=sanctum
+MCP_RATE_LIMIT_ENABLED=true
+MCP_RATE_LIMIT_MAX=60
+MCP_RATE_LIMIT_DECAY=1
+MCP_STRICT_PERMISSIONS=false
+
+# Agent token-usage metrics (routes off; usage is read internally)
+TOKEN_USAGE_REGISTER_ROUTES=false

.env.production.example

@@ -69,3 +69,15 @@ MODEL_CONFIG_ROUTE_PREFIX=api/v1
 # Firebase credentials path (ensure file exists in production)
 FIREBASE_CREDENTIALS=storage/app/firebase-auth.json
 
+# MCP (Model Context Protocol) Configuration
+MCP_ENABLED=false
+MCP_ENDPOINT=mcp
+MCP_AUTH_GUARD=sanctum
+MCP_RATE_LIMIT_ENABLED=true
+MCP_RATE_LIMIT_MAX=60
+MCP_RATE_LIMIT_DECAY=1
+MCP_STRICT_PERMISSIONS=false
+
+
+# Agent token-usage metrics (routes off; usage is read internally)
+TOKEN_USAGE_REGISTER_ROUTES=false

.github/workflows/build-and-publish.yml

@@ -0,0 +1,54 @@
+name: Build and Publish Docker Image
+
+on:
+  push:
+    branches:
+      - dev
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve short commit SHA
+        id: meta
+        if: ${{ github.event_name == 'push' }}
+        run: echo "sha=${GITHUB_SHA:0:7}" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push commit image
+        if: ${{ github.event_name == 'push' }}
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: docker/prod/Dockerfile
+          push: true
+          tags: ghcr.io/trakli/webservice:${{ steps.meta.outputs.sha }}
+
+      - name: Build and push latest
+        if: ${{ github.event_name == 'release' }}
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: docker/prod/Dockerfile
+          push: true
+          tags: |
+            ghcr.io/trakli/webservice:latest
+            ghcr.io/trakli/webservice:${{ github.event.release.tag_name }}

.github/workflows/build-hosted-image.yml

@@ -0,0 +1,137 @@
+name: Build Hosted Image
+
+on:
+  workflow_call:
+    inputs:
+      plugins:
+        description: 'JSON array of plugins to bundle, e.g. [{"repo":"<org>/<plugin>","ref":"main"}]'
+        type: string
+        required: true
+      base_image:
+        description: 'Public base image to stack on'
+        type: string
+        default: 'ghcr.io/trakli/webservice:latest'
+      image_name:
+        description: 'Target hosted image'
+        type: string
+        default: 'ghcr.io/trakli/webservice-hosted'
+      tag:
+        description: 'Tag for the hosted image'
+        type: string
+        default: 'latest'
+    secrets:
+      PLUGINS_TOKEN:
+        description: 'Token with read access to the private plugin repositories'
+        required: true
+  workflow_dispatch:
+    inputs:
+      plugins:
+        description: 'JSON array of plugins to bundle'
+        type: string
+        required: true
+      base_image:
+        type: string
+        default: 'ghcr.io/trakli/webservice:latest'
+      image_name:
+        type: string
+        default: 'ghcr.io/trakli/webservice-hosted'
+      tag:
+        type: string
+        default: 'latest'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout webservice
+        uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.2'
+          tools: composer:v2
+
+      - name: Clone private plugins
+        env:
+          PLUGINS_TOKEN: ${{ secrets.PLUGINS_TOKEN }}
+        run: |
+          set -euo pipefail
+          mkdir -p plugins
+          while read -r plugin; do
+            repo=$(echo "$plugin" | jq -r '.repo')
+            ref=$(echo "$plugin" | jq -r '.ref // "main"')
+            tmp=$(mktemp -d ./plugins/.clone.XXXXXX)
+            git clone --depth 1 --branch "$ref" \
+              "https://x-access-token:${PLUGINS_TOKEN}@github.com/${repo}.git" "$tmp"
+            rm -rf "$tmp/.git"
+            if [ ! -f "$tmp/plugin.json" ]; then
+              echo "::error::${repo} has no plugin.json; it is not a plugin-engine plugin" >&2
+              exit 1
+            fi
+            id=$(jq -r '.id // empty' "$tmp/plugin.json")
+            if [ -z "$id" ]; then
+              echo "::error::${repo} plugin.json is missing an 'id'" >&2
+              exit 1
+            fi
+            rm -rf "plugins/${id}"
+            mv "$tmp" "plugins/${id}"
+          done < <(echo '${{ inputs.plugins }}' | jq -c '.[]')
+
+      - name: Install core dependencies
+        run: |
+          composer install --no-dev --no-interaction --no-scripts --ignore-platform-reqs --prefer-dist --optimize-autoloader
+
+      - name: Verify bundled plugins carry no unbundled dependencies
+        run: |
+          set -euo pipefail
+          for d in plugins/*/; do
+            cj="${d}composer.json"
+            [ -f "$cj" ] || continue
+            extra=$(jq -r '.require // {} | keys[]' "$cj" | grep -ivE '^(php|laravel/framework)$' || true)
+            if [ -n "$extra" ]; then
+              echo "::error::Plugin '${d}' declares dependencies the bundler does not install:" >&2
+              echo "$extra" >&2
+              echo "::error::Extend this workflow to install plugin dependencies before bundling it." >&2
+              exit 1
+            fi
+          done
+
+      - name: Prepare application environment
+        run: |
+          cp .env.example .env
+          php artisan key:generate
+
+      - name: Enable and cache bundled plugins
+        run: |
+          set -euo pipefail
+          for d in plugins/*/; do
+            [ -f "${d}plugin.json" ] || continue
+            php artisan plugin:enable "$(jq -r '.id' "${d}plugin.json")"
+          done
+          php artisan plugin:cache
+
+      - name: Keep prepared vendor and plugin cache in the build context
+        run: |
+          sed -i '/^vendor$/d; /^bootstrap\/cache/d' .dockerignore
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push hosted image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/hosted/Dockerfile
+          push: true
+          build-args: |
+            BASE_IMAGE=${{ inputs.base_image }}
+          tags: ${{ inputs.image_name }}:${{ inputs.tag }}

.github/workflows/commits.yml

@@ -2,58 +2,12 @@ name: Commit message validation
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev]
   push:
-    branches: [main]
+    branches: [main, dev]
 
 jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 18
-
-      - run: npm install --save-dev @commitlint/{config-conventional,cli}
-
-      - name: Create commitlint config file
-        run: |
-          cat << EOF > commitlint.config.js
-          module.exports = {
-            extends: ['@commitlint/config-conventional'],
-            rules: {
-              'type-enum': [2, 'always', [
-                'feat', 'fix', 'docs', 'style', 'refactor', 'test', 'chore', 'build', 'ci',
-                'enh', 'enhance', 'tweak', 'imp', 'improve',
-              ]],
-              'subject-case': [2, 'always', 'sentence-case'],
-              'header-max-length': [2, 'always', 72],
-            },
-            ignores: [
-              (commit) => commit.includes('Signed-off-by: dependabot[bot]')
-            ]
-          };
-          EOF
-
-      - name: Run commitlint
-        run: npx commitlint --from HEAD^ --to HEAD --config commitlint.config.js
-
-      - name: Fail if commitlint fails (but not for Dependabot)
-        if: ${{ failure() && github.actor != 'dependabot[bot]'}}
-        run: |
-          echo "::error::Invalid commit message format. Please follow the conventional commit guidelines:"
-          echo "::error::- Type: One of: feat, fix, docs, style, refactor, test, chore, build, ci, enh, enhance, tweak, imp, improve"
-          echo "::error::- Scope (optional): A short name of the part of the codebase affected (e.g., 'auth', 'ui')."
-          echo "::error::- Subject: A brief description of the change, starting with a capital letter and generally in lowercase. Keep it concise (under 72 characters)."
-          echo "::error::- Body (optional): More detailed explanation of the change."
-          echo "::error::- Footer (optional): Related issue references, etc."
-          echo ""
-          echo "::error::Example:"
-          echo "::error::feat(user-authentication): Implement user login"
-          echo ""
-          echo "::error::For more information, see: [https://github.com/whilesmart/conventions/blob/main/commits.md]"
-          exit 1
+      - uses: whilesmart/workflows/commits@main

.github/workflows/coverage.yml

@@ -18,6 +18,6 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Update Coverage Baseline
-        uses: whilesmart/workflows/php/coverage/update@coverage
+        uses: whilesmart/workflows/php/coverage/update@main
         with:
           token: ${{ secrets.PAT_TOKEN }}