HJIOUKJ

[5hy7xz92nd-oss]

No description provided.

[Copilot]

Pull request overview

Adds LLM failure logging, failed-response storage, and a sequential agent pipeline, alongside documentation and CI/security configuration.

Changes:

• Adds logging, JSONL export, and agent pipeline APIs.
• Expands architecture, contribution, security, and changelog documentation.
• Adds build, validation, CodeQL, APIsec, Dependabot, and agent configuration.

Reviewed changes

Copilot reviewed 17 out of 28 changed files in this pull request and generated 21 comments.

Show a summary per file

File	Summary
Sources/LargeLanguageModels/Intramodular/LLMs/Logging/LLMErrorLogger.swift	LLM error logging API
Sources/LargeLanguageModels/Intramodular/LLMs/Logging/FailedLLMResponseStore.swift	Failed response storage and export
Sources/LargeLanguageModels/Intramodular/LLMs/Agents/LLMAgentPipeline.swift	Sequential agent pipeline
SECURITY.md	Security policy
README.md	Project documentation
Package.resolved	Dependency updates
enhanced-continuous-validation.yml	Validation workflow
docs/README.md	Documentation index
docs/ARCHITECTURE.md	Architecture documentation
CONTRIBUTING.md	Contribution guidance
CHANGELOG.md	Unreleased changes
.github/workflows/swift.yml	Swift build and test workflow
.github/workflows/preternatural-build.yml	Xcode build matrix
.github/workflows/codeql.yml	CodeQL scanning
.github/workflows/apisec-scan.yml	API security scanning
.github/PULL_REQUEST_TEMPLATE.md	Pull request template
.github/dependabot.ymlv	Dependabot configuration
.github/agents/my-agent.agent.md	Custom agent scaffold

Suppressed comments (23)

.github/dependabot.ymlv:8

• Even after correcting the filename, an empty package-ecosystem is invalid, so Dependabot cannot determine what to update. Use the Swift Package Manager ecosystem for this repository.

  - package-ecosystem: "" # See documentation for possible values

.github/dependabot.ymlv:8

• Dependabot does not discover a file named dependabot.ymlv; it only loads .github/dependabot.yml or .yaml. After renaming it, package-ecosystem is also empty, so set a supported ecosystem such as swift.

  - package-ecosystem: "" # See documentation for possible values

.github/workflows/apisec-scan.yml:65

• VAmPI is the sample project name from APIsec's starter workflow, not this repository's Swift AI package. The scan/SARIF therefore targets an unrelated registered project and can produce misleading security results; configure the registered project for this repository.

          apisec-project: "VAmPI"

CONTRIBUTING.md:17

• The table of contents points contributors to imported Open Source Guides material and a #community section that does not exist in this file. Other referenced files/scripts (docs/translations.md, CODE_OF_CONDUCT.md, docs/styleguide.md, and script/bootstrap/script/server) are also absent, so these contribution links and setup instructions are broken.

0. [Types of contributions we're looking for](#types-of-contributions-were-looking-for)
0. [Ground rules & expectations](#ground-rules--expectations)
0. [How to contribute](#how-to-contribute)
0. [Style guide](#style-guide)
0. [Setting up your environment](#setting-up-your-environment)

README.md:280

• Package.swift defines a standalone ElevenLabs product, so this sentence incorrectly tells users that ElevenLabs must be consumed through AI. Remove ElevenLabs from the no-standalone-product list.

There is **no** standalone SPM product today for `CoreMI`, `LargeLanguageModels`, `Cohere`, `Groq`, `HuggingFace`, `Jina`, `Mistral`, `Ollama`, or `ElevenLabs` — consume them via the `AI` product (or add a product in `Package.swift` if you need a leaner slice).

README.md:187

• This graph is labeled as the Package.swift target dependency graph, but the AI target also directly depends on NeetsAI (Package.swift:403); the edge is missing. Add AI --> NeetsAI while retaining the separate product information below.

  AI --> Jina

README.md:244

• The protocol matrix underreports TogetherAI: TogetherAI.Client explicitly conforms to both LLMRequestHandling and TextEmbeddingsRequestHandling in Sources/TogetherAI. Give it its own yes/yes row instead of grouping it with providers that have no such conformance.

| TogetherAI, ElevenLabs, PlayHT, Rime, HumeAI, NeetsAI, _Gemini, HuggingFace | | | Provider-specific client APIs / hub helpers (see `Sources/<Name>`) |

README.md:814

• TogetherAITests is already registered in Package.swift and Tests/TogetherAI exists, so listing the TogetherAI folder as a missing test target is stale and misleading. Limit this roadmap item to the genuinely missing targets or update the manifest instead.

### Project hygiene

- [x] Architecture & dependency documentation
- [x] Contributing guide, docs index, PR template & changelog
- [ ] Register missing test targets (Ollama, Rime, TogetherAI folder)

README.md:764

• This documentation-table entry says docs/ARCHITECTURE.md contains a protocol matrix and tests, but that file currently has neither. Update the description or add the promised sections.

| **[docs/README.md](docs/README.md)** | Documentation index |
| **[docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)** | Full architecture, products vs targets, Mermaid graph, protocol matrix, tests |

README.md:258

• The detailed external-package table also omits Media, even though Package.swift declares it. Add a row so this supposedly complete dependency table agrees with the manifest.

| Swallow | [vmanot/Swallow](https://github.com/vmanot/Swallow) | Extensions, macros client, diagnostics |
| Merge | [vmanot/Merge](https://github.com/vmanot/Merge) | Concurrency / async utilities |
| NetworkKit | [vmanot/NetworkKit](https://github.com/vmanot/NetworkKit) | HTTP client & API specifications |
| CorePersistence | [vmanot/CorePersistence](https://github.com/vmanot/CorePersistence) | Persistence & schema helpers (e.g. JSONSchema) |
| SwiftUIX | [SwiftUIX/SwiftUIX](https://github.com/SwiftUIX/SwiftUIX) | SwiftUI extensions |

README.md:187

• The README graph is also presented as a graph of Package.swift target dependencies, but it omits the direct AI dependencies on NeetsAI and Swallow. Add the corresponding edges rather than representing NeetsAI only as a provider outside the umbrella graph.

  AI --> HuggingFace
  AI --> Jina

Sources/LargeLanguageModels/Intramodular/LLMs/Agents/LLMAgentPipeline.swift:124

• The pipeline calls the overload that builds a prompt from messages without assigning a model. This works for clients with defaults, but Ollama's _model(for:) unwraps prompt.context.modelIdentifier and throws when it is absent, so this generic pipeline cannot run with that provider as documented. Accept a model/context or make the requirement explicit.

        public init(
            observer: any LLMAgentStage = ObserverStage(),
            researcher: any LLMAgentStage = ResearchStage(),
            decisionMaker: any LLMAgentStage = DecisionStage(),
            llm: any LLMRequestHandling

Sources/LargeLanguageModels/Intramodular/LLMs/Agents/LLMAgentPipeline.swift:31

• The default implementation always calls the chat-message overload, but LLMRequestHandling is not chat-only. For example, TogetherAI.Client conforms to that protocol while rejecting ChatPrompt and implementing only TextPrompt, so this pipeline throws for a valid protocol conformer. Restrict the pipeline to a chat-capable interface or provide a capability-specific stage API.

        let completion = try await llm.complete(messages)

docs/ARCHITECTURE.md:90

• The note says the AI target's dependencies end at OpenAI, but Package.swift also declares direct dependencies on NeetsAI and Swallow (Package.swift:402-403). The graph likewise lacks the NeetsAI target edge, so this architecture documentation is inconsistent with its source of truth.

> Note: The `AI` umbrella target currently depends on `CoreMI`, `LargeLanguageModels`, `Anthropic`, `Cohere`, `ElevenLabs`, `Groq`, `HuggingFace`, `Jina`, `Mistral`, `Ollama`, and `OpenAI`. Other provider modules in this repository are distributed as standalone products and are not re-exported by `AI` in `Package.swift`.

enhanced-continuous-validation.yml:128

• This repository has no CONTINUOUS_VALIDATION_ORCHESTRATOR.py (and no lowercase Python tests/ tree), so this required command fails on every run once the workflow is discoverable. Replace this Python-project command with this package's Swift build/test validation or add the missing implementation.

    - name: Run continuous validation orchestrator (single cycle)
      run: |
        echo "🔄 Running Continuous Validation Cycle..."
        python CONTINUOUS_VALIDATION_ORCHESTRATOR.py --single

enhanced-continuous-validation.yml:93

• The pytest command's failure is converted to a successful echo and the step also has continue-on-error: true, so test failures cannot fail this validation job or block downstream jobs. Let the test command's exit status propagate.

    - name: Run pytest suite
      run: |
        echo "🧪 Running Pytest Suite..."
        pytest tests/ -v --tb=short --maxfail=10 -x || echo "Pytest completed with warnings"
      continue-on-error: true

enhanced-continuous-validation.yml:171

• The Bandit failure is swallowed by || echo; the same pattern plus continue-on-error is used for Safety and pip-audit below, so the security-validation job reports success even when scanners fail. Allow scanner failures to fail the job, or explicitly aggregate and surface them as a failed result.

    - name: Run bandit security scan
      run: |
        echo "🔒 Running Bandit security scan..."
        bandit -r packages/ apps/ -ll || echo "Security scan completed"

enhanced-continuous-validation.yml:52

• The failing test is explicitly converted into a successful step with || echo, so a missing script or failed test does not affect the job result. This makes the validation gate report success without running a passing test; let the command fail (or record a deliberate warning status separately).

    - name: Run decrypt and validation tests
      run: |
        echo "🔐 Running Decrypt & Validation Test Suite..."
        python tests/test_decrypt_validation.py || echo "Tests completed with warnings"

enhanced-continuous-validation.yml:87

• The integration test command also converts any failure, including the missing tests/test_integration.py in this repository, into success. Remove the error suppression so the job result reflects whether the test actually ran and passed.

    - name: Run integration tests
      run: |
        echo "🔗 Running Integration Test Suite..."
        python tests/test_integration.py || echo "Tests completed with warnings"

enhanced-continuous-validation.yml:177

• The security result is explicitly ignored here (|| echo plus continue-on-error), so a failed dependency check still makes security-validation succeed. Remove the suppression or expose the check as non-gating rather than labeling it validation.

    - name: Run safety check
      run: |
        echo "🛡️ Running Safety dependency check..."
        safety check || echo "Safety check completed"
      continue-on-error: true

enhanced-continuous-validation.yml:183

• pip-audit failures are likewise converted to success, meaning the workflow can report security validation passed despite an audit finding or an audit execution error. Preserve the exit status if this is intended to be a security gate.

    - name: Run pip-audit
      run: |
        echo "🔍 Running pip-audit..."
        pip-audit || echo "Audit completed"
      continue-on-error: true

enhanced-continuous-validation.yml:17

• workflow_dispatch.inputs.run_type is never referenced by any job or command, so choosing quick, full, or extended has no effect and every manual run executes the same pipeline. Use the input to select the relevant jobs/flags or remove the advertised choices.

      run_type:
        description: 'Type of validation run'
        required: true
        default: 'full'
        type: choice

enhanced-continuous-validation.yml:304

• The quoted heredoc delimiter prevents shell expansion of $(date ...), so every generated deployment report contains the literal text instead of a timestamp. Use an unquoted delimiter or compute the timestamp before writing the file.

        cat << 'EOF' > deployment-validation-report.txt
        ================================================
        AUTO-DEPLOY VALIDATION REPORT
        ================================================
        Timestamp: $(date -u +"%Y-%m-%d %H:%M:%S UTC")

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.