Skip to content

v0.1.0-alpha.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@michaelegner michaelegner released this 27 Aug 12:44
· 76 commits to main since this release
v0.1.0-alpha.2
65264a1

Project status: Experimental / Alpha
License: Apache-2.0

Second public pre-release, superseding v0.1.0-alpha.1. v0.1.0-alpha.1's own verification (fresh
clone, fresh runtime demo, a pulled GHCR image) surfaced several real issues — this tag exists
specifically to confirm they're fixed, and to give the release pipeline itself one clean run before
promoting to v0.1.0. See docs/release-validation/ for the full verification record, including
why alpha.1's own GHCR tag ended up pointing to an image built before one of these fixes.

Changed since v0.1.0-alpha.1

  • Container now runs as a non-root user (alpha.1's published image ran as root — no USER
    instruction in Dockerfile).
  • Fixed a CodeQL finding: GET /health/neo4j no longer leaks exception detail (e.g. connection
    info) to the caller on failure — logged server-side only now.
  • Fixed the base Quick Start: docker-compose.yml required OPENAI_API_KEY even though the
    platform is documented as working without one; README.md's Quick Start also had a placeholder
    clone URL and never mentioned creating .env at all.
  • Fixed the runtime demo's natural-language query: it silently returned zero rows against demo
    data, because the default analysis window was scoped to the wrong environment.
  • Release pipeline hardening: the GitHub Actions Docker workflow previously fired twice per
    release (a real race that split alpha.1's build across two different image digests); branch
    protection, dependency alerts, and dependabot security updates are now all enabled; pyproject.toml
    no longer carries stale PoC-era metadata.

Highlights

  • OpenAPI ingestion (REST provider extraction)
  • AsyncAPI queue topology (send/receive, DLQ mapping)
  • Architecture Manifest adapter (the one thing OpenAPI can't express: who calls a REST operation)
  • Evidence/provenance — every architecture fact is persisted with a traceable source
  • Five deterministic architecture analyses (no LLM): queue senders/consumers, orphan queues,
    mixed sync/async blast radius
  • Semantic query validation (Graph Schema + Cypher validator) for the optional natural-language
    query layer
  • OpenTelemetry runtime discovery — /v1/traces OTLP ingestion, resolved against declared
    architecture
  • Declared vs. observed architecture comparison: CONFIRMED / OBSERVED_ONLY /
    NOT_OBSERVED_IN_WINDOW
  • Architecture drift detection — undocumented dependencies surface as OBSERVED_ONLY findings
  • Runtime evidence reconciliation — removing a stale declaration degrades a relation to
    OBSERVED_ONLY, never silently deletes it
  • Cross-batch HTTP correlation — a CLIENT span and its matching SERVER span can arrive in separate
    OTLP requests and still resolve to one observed dependency

Known limitations

  • Pre-1.0 — the Canonical Model, REST API, Graph Schema, Adapter SPI, and configuration format are
    not yet guaranteed stable (see ROADMAP.md).
  • No Kubernetes/cloud discovery yet (planned for v0.2).
  • The natural-language query layer requires an LLM provider API key; everything else works without
    one.

Quick Start

git clone https://github.com/michaelegner/architecture-intelligence-platform.git
cd architecture-intelligence-platform
cp .env.example .env
docker compose up

Then open http://localhost:8000. See README.md for the full Quick Start and the Collector-based
runtime demo.

Documentation

docs/ — architecture, canonical model, graph/evidence model, OpenTelemetry, security model,
adapter development, and more. docs/adr/ for the reasoning behind the core design decisions.
docs/release-validation/ for exactly what's been verified about this release and how.

Security

See SECURITY.md — please report vulnerabilities via GitHub's private vulnerability reporting, not
as a public issue.

Assets 2
Loading