feat: Production-Hardened Multi-Agent Business Intelligence Platform (Final Release)

Author: melbinjp

.devcontainer/devcontainer.json

@@ -0,0 +1,33 @@
+{
+  "name": "Python 3",
+  // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+  "image": "mcr.microsoft.com/devcontainers/python:1-3.11-bookworm",
+  "customizations": {
+    "codespaces": {
+      "openFiles": [
+        "README.md",
+        "frontend/app.py"
+      ]
+    },
+    "vscode": {
+      "settings": {},
+      "extensions": [
+        "ms-python.python",
+        "ms-python.vscode-pylance"
+      ]
+    }
+  },
+  "updateContentCommand": "[ -f packages.txt ] && sudo apt update && sudo apt upgrade -y && sudo xargs apt install -y <packages.txt; [ -f requirements.txt ] && pip3 install --user -r requirements.txt; pip3 install --user streamlit; echo '✅ Packages installed and Requirements met'",
+  "postAttachCommand": {
+    "server": "streamlit run frontend/app.py --server.enableCORS false --server.enableXsrfProtection false"
+  },
+  "portsAttributes": {
+    "8501": {
+      "label": "Application",
+      "onAutoForward": "openPreview"
+    }
+  },
+  "forwardPorts": [
+    8501
+  ]
+}

.dockerignore

@@ -0,0 +1,17 @@
+.env
+.env.*
+!.env.example
+.git
+.pytest_cache
+.venv
+venv
+env
+__pycache__
+*.pyc
+*.pyo
+*.db
+*.sqlite3
+chroma_data
+logs
+dist
+build

.env.example

@@ -0,0 +1,54 @@
+# Multi-Agent BI Platform - Environment Config
+# Copy this file to .env for local development.
+# Never commit real API keys or service credentials.
+
+# --- LLM Providers ---
+GEMINI_API_KEY=your_gemini_api_key_here
+GROQ_API_KEY=your_groq_api_key_here
+OPENROUTER_API_KEY=
+
+# --- Database ---
+# Local Docker Compose defaults:
+DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/agent_in
+DATABASE_URL_SYNC=postgresql://postgres:postgres@localhost:5432/agent_in
+
+# Use "disable" for local Docker Postgres and SQLite tests.
+# Use "require" for managed Postgres services that require SSL.
+DB_SSL_MODE=disable
+
+# --- Redis / Celery ---
+REDIS_URL=redis://localhost:6379/0
+
+# --- Vector memory ---
+CHROMA_PERSIST_DIR=./chroma_data
+
+# --- Observability ---
+LANGFUSE_PUBLIC_KEY=
+LANGFUSE_SECRET_KEY=
+LANGFUSE_BASE_URL=https://jp.cloud.langfuse.com
+
+# --- Cost Controls ---
+MAX_TOKENS_PER_JOB=100000
+MAX_DOLLARS_PER_JOB=1.00
+MAX_AGENT_ITERATIONS=10
+
+# --- Security ---
+# API Keys for authentication (comma-separated)
+# Leave empty to disable authentication (development mode)
+# Example: API_KEYS=dev-key-123,prod-key-456
+API_KEYS=
+
+# --- Frontend ---
+# Frontend URL for CORS configuration
+# Update this when deploying to production
+FRONTEND_URL=http://localhost:8501
+
+# --- App ---
+APP_ENV=development
+LOG_LEVEL=DEBUG
+
+# --- Streamlit frontend ---
+# Local:
+BACKEND_URL=http://localhost:8000/api/v1
+# Hosted Streamlit should use:
+# BACKEND_URL=https://your-render-api.onrender.com/api/v1

.gitattributes

@@ -0,0 +1,6 @@
+* text=auto
+*.py text eol=lf
+*.md text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+Dockerfile text eol=lf

.github/workflows/render-doppler-sync.yml

@@ -0,0 +1,35 @@
+name: Sync Doppler Secrets to Render
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  sync-secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch Secrets from Doppler
+        id: doppler
+        uses: DopplerHQ/secrets-fetch-action@v1.2.0
+        with:
+          doppler-token: ${{ secrets.DOPPLER_TOKEN }}
+
+      - name: Push Secrets to Render
+        env:
+          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
+          RENDER_SERVICE_ID: ${{ secrets.RENDER_SERVICE_ID }}
+        run: |
+          # Convert Doppler's flat JSON to Render's required format: [{"envVar": {"key": "K", "value": "V"}}]
+          echo '${{ steps.doppler.outputs.secrets }}' | jq '[to_entries | .[] | {"envVar": {"key": .key, "value": (.value | tostring)}}]' > payload.json
+          
+          echo "Pushing secrets to Render Service: ${RENDER_SERVICE_ID}..."
+          
+          curl -X PUT "https://api.render.com/v1/services/${RENDER_SERVICE_ID}/env-vars" \
+               -H "Accept: application/json" \
+               -H "Authorization: Bearer ${RENDER_API_KEY}" \
+               -H "Content-Type: application/json" \
+               -d @payload.json
+          
+          echo "Successfully synced Doppler secrets to Render."

.gitignore

@@ -0,0 +1,48 @@
+# Environment
+.env
+.env.*
+!.env.example
+.venv/
+venv/
+env/
+
+# Python
+__pycache__/
+.pytest_cache/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.coverage
+htmlcov/
+
+# IDE
+.vscode/
+.idea/
+
+# Database
+*.db
+*.sqlite3
+chroma_data/
+test_smoke.db
+test_smoke_async.db
+test_agent_in.db
+
+# Docker
+docker-compose.override.yml
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+logs/
+
+# Local planning scratch files
+*.md
+!README.md
+
+# Kiro
+.kiro/
+

.python-version

@@ -0,0 +1 @@
+3.12.11

Dockerfile

@@ -0,0 +1,21 @@
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1
+
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt .
+RUN pip install --upgrade pip \
+    && pip install -r requirements.txt
+
+COPY . .
+
+EXPOSE 8000
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.