Intent Graph Engine (IGE) — v0.2.0

Local-first orchestration core implementing the Intent Graph Engine PRD (PRD.md). Phase 1 ships the narrow vertical the PRD recommends (§25): ingest an intent, build a graph + plan, gate high-risk actions, execute in a sandbox, capture evidence, append to a tamper-evident ledger, and surface everything through a review console.

What's in the box (v0.2.0)

• Core domain (src/ige/core): pure Python, framework-free. Domain models, hexagonal ports, deterministic planner, rules-based policy engine, JSONL hash-chained ledger, subprocess sandbox, evidence store, orchestrator, secret scanner (Yelp detect-secrets), prompt-injection scanner (regex + entropy).
• API (src/ige/api): FastAPI + SQLAlchemy 2.
  • PostgreSQL or SQLite (URL via env). Alembic migrations.
  • structlog structured logging (JSON in prod, console in dev).
  • OpenTelemetry (optional OTLP export + FastAPI/SQLAlchemy instrumentation).
  • slowapi rate limiting + CORS middleware.
  • OPA/Rego adapter — drop in a sidecar (docker-compose up opa) or keep the in-process rule pack.
  • LLM classifier — OpenAI-compatible (works with OpenAI, Azure, Ollama, vLLM) or the deterministic regex classifier.
• Web (apps/web/static): single-page vanilla-JS review console, no build step, calm dark UI per PRD §17.
• Deploy: multi-stage Dockerfile + docker-compose.yml (api + Postgres + OPA) + alembic.ini + ops/opa/ige.rego.
• CI: GitHub Actions (lint, test against Postgres, build image).
• Load: Locust scenario in tests/load/.

Quickstart (local SQLite, no Docker)

python3 -m venv .venv && . .venv/bin/activate
pip install -e ".[dev]"
cp .env.example .env
python -m uvicorn ige.api.main:app --host 127.0.0.1 --port 8080
# Open http://127.0.0.1:8080/  →  review console
# Open http://127.0.0.1:8080/docs  →  interactive API

Quickstart (full stack, prod-like)

cp .env.example .env
# edit .env: set IGE_DATABASE_URL=postgresql+psycopg://... and IGE_OPA_URL=...
docker compose up --build
# API on :8080, OPA on :8181, Postgres on :5432

Tests

pytest -q                      # 38+ tests, hermetic
ruff check src tests           # linter
locust -f tests/load/locustfile.py --host=http://127.0.0.1:8080

Layout

apps/web/static/         HTML + JS review console
data/                    SQLite db, evidence, ledger (gitignored)
docs/                    API, schemas, policies, mermaid appendix
migrations/              alembic env + versions
ops/opa/ige.rego         Rego policy pack
scripts/                 dev.sh, seed.sh
src/ige/
  core/                  domain + ports + services (no framework deps)
    services/secret_scan.py        detect-secrets adapter
    services/injection_scan.py     regex + entropy
  api/
    main.py              app factory
    lifespan.py          startup (alembic + OTel)
    routers/             intents, runs, claims, reviews, ledger, policies, system
    services/
      container.py       DI container
      opa_adapter.py     OPA client
      llm_classifier.py  LLM + deterministic
      seed.py            policy defaults
    dependencies.py
    db.py                SQLAlchemy 2.0
    models.py            SQLAlchemy tables
    schemas.py           Pydantic
    config.py            pydantic-settings
    logging_config.py    structlog
    telemetry.py         OTel bootstrap
tests/
  core/                  domain + ports + new scanners
  api/                   integration + adapters
  load/locustfile.py

Endpoints (15 routes)

GET  /api/v1/system/health
GET  /api/v1/intents
POST /api/v1/intents
GET  /api/v1/intents/{intent_id}
POST /api/v1/intents/{intent_id}/plan
POST /api/v1/intents/{intent_id}/run
GET  /api/v1/runs/{run_id}
GET  /api/v1/claims
GET  /api/v1/claims/{claim_id}
GET  /api/v1/reviews
POST /api/v1/reviews?claim_id=…
GET  /api/v1/ledger
GET  /api/v1/ledger/verify
GET  /api/v1/policies
POST /api/v1/policies
POST /api/v1/policies/{rule_id}/toggle

Full reference: docs/API.md.

Safety posture

• Secret scan at ingest: Yelp detect-secrets (AWS, OpenAI, GitHub, PEM, Slack, Stripe, GCP, Azure, basic-auth, …). Findings return 422 with the detector types that fired.
• Prompt-injection scan: regex patterns + entropy-based blob detection. Findings return 422.
• Policy gate: OPA/Rego sidecar (prod) or in-process rule pack (dev). High/critical risk → require_approval. Network egress denied by default. Fails closed on backend unreachable.
• Sandbox: subprocess in a temp dir, allowlist of binaries (python3, grep, awk, …); curl/http_request are not on the list. Phase 2 will harden with unshare -n + seccomp.
• Ledger: append-only JSONL with per-event sha256 chain. Any tamper is detected by GET /api/v1/ledger/verify.
• Observability: OTel traces + structured logs. Rate limit + CORS middleware in front.

License

Apache-2.0.