PR back to optum

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Esity @LegionIO/core

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"

.github/workflows/ci.yml

@@ -0,0 +1,93 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '0 9 * * 1'
+
+permissions: {}
+
+jobs:
+  ci:
+    permissions:
+      contents: read
+    uses: LegionIO/.github/.github/workflows/ci.yml@main
+
+  ci-postgres:
+    name: "RSpec (PostgreSQL)"
+    permissions:
+      contents: read
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: legion
+          POSTGRES_PASSWORD: legion
+          POSTGRES_DB: legionio
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.4'
+          bundler-cache: true
+      - name: Run RSpec (PostgreSQL adapter)
+        env:
+          LEGION_DATA_ADAPTER: postgres
+          LEGION_DATA_HOST: 127.0.0.1
+          LEGION_DATA_PORT: 5432
+          LEGION_DATA_USER: legion
+          LEGION_DATA_PASSWORD: legion
+          LEGION_DATA_DATABASE: legionio
+        run: bundle exec rspec
+
+  lint:
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: read
+    uses: LegionIO/.github/.github/workflows/lint-patterns.yml@main
+
+  security:
+    permissions:
+      contents: read
+      security-events: write
+    uses: LegionIO/.github/.github/workflows/security-scan.yml@main
+
+  version-changelog:
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: LegionIO/.github/.github/workflows/version-changelog.yml@main
+
+  dependency-review:
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: LegionIO/.github/.github/workflows/dependency-review.yml@main
+
+  stale:
+    if: github.event_name == 'schedule'
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: LegionIO/.github/.github/workflows/stale.yml@main
+
+  release:
+    needs: [ci, ci-postgres, lint]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+      packages: write
+    uses: LegionIO/.github/.github/workflows/release.yml@main
+    secrets:
+      rubygems-api-key: ${{ secrets.RUBYGEMS_API_KEY }}

.gitignore

@@ -13,3 +13,12 @@
 # rspec failure tracking
 .rspec_status
 legionio.key
+# logs and OS artifacts
+legion.log
+.DS_Store
+# gem build artifacts
+*.gem
+# SQLite database files
+*.db
+.worktrees
+/docs/

.pre-commit-config.yaml

@@ -0,0 +1,29 @@
+# Standard LegionIO pre-commit configuration
+# Install: pre-commit install
+# Manual:  pre-commit run --all-files
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-json
+        exclude: Gemfile\.lock
+      - id: check-merge-conflict
+
+  - repo: local
+    hooks:
+      - id: rubocop
+        name: RuboCop (autofix)
+        entry: scripts/pre-commit-rubocop.sh
+        language: script
+        types: [ruby]
+        pass_filenames: true
+
+      - id: ruby-syntax
+        name: Ruby syntax check
+        entry: bash -c 'status=0; for file in "$@"; do ruby -c "$file" || status=$?; done; exit $status' --
+        language: system
+        types: [ruby]
+        pass_filenames: true

.rubocop.yml

@@ -1,22 +1,56 @@
+inherit_gem:
+  rubocop-legion: config/core.yml
+AllCops:
+  TargetRubyVersion: 3.4
+  NewCops: enable
+  SuggestExtensions: false
 Layout/LineLength:
-  Max: 120
-  Exclude:
-    - 'lib/legion/data/migrations/*.rb'
+  Max: 160
+Layout/SpaceAroundEqualsInParameterDefault:
+  EnforcedStyle: space
+Layout/HashAlignment:
+  EnforcedHashRocketStyle: table
+  EnforcedColonStyle: table
 Metrics/MethodLength:
-  Max: 30
+  Max: 50
 Metrics/ClassLength:
   Max: 1500
-Metrics/AbcSize:
-  Max: 34
+Metrics/ModuleLength:
+  Max: 1500
+Naming/VariableNumber:
+  Exclude:
+    - 'spec/**/*'
+    - lib/legion/data/connection.rb
+Legion/Framework/EagerSequelModel:
+  Enabled: false
 Metrics/BlockLength:
-  Max: 50
+  Max: 100
   Exclude:
+    - 'spec/**/*'
     - 'lib/legion/data/migrations/*'
+ThreadSafety/ClassInstanceVariable:
+  Enabled: false
+ThreadSafety/ClassAndModuleAttributes:
+  Enabled: false
+Metrics/AbcSize:
+  Max: 60
+  Exclude:
+    - 'spec/**/*'
+Metrics/CyclomaticComplexity:
+  Max: 15
+  Exclude:
+    - 'spec/**/*'
+Metrics/PerceivedComplexity:
+  Max: 17
+  Exclude:
+    - 'spec/**/*'
+
 Style/Documentation:
   Enabled: false
-AllCops:
-  TargetRubyVersion: 2.5
-  NewCops: enable
-  SuggestExtensions: false
+Style/SymbolArray:
+  Enabled: true
 Style/FrozenStringLiteralComment:
+  Enabled: true
+  EnforcedStyle: always
+Naming/PredicateMethod:
   Enabled: false

AGENTS.md

@@ -0,0 +1,77 @@
+Always run a full `bundle exec rspec` and `bundle exec rubocop -A` and fix all errors before committing.
+
+# AGENTS.md - legion-data
+
+## Repo Role
+
+`legion-data` owns persistent storage for LegionIO. Keep this repo focused on database connectivity, Sequel migrations, Sequel models, local SQLite state, extraction persistence, audit/governance storage, identity/RBAC storage, Apollo storage, and the LLM lifecycle ledger.
+
+HTTP APIs, runtime orchestration, extension behavior, and UI concerns belong in their owning repos. This repo should expose clean model contracts that those layers can call.
+
+## Required Commands
+
+Run from the repo root:
+
+```bash
+bundle exec rubocop -A
+bundle exec rspec --format json --out tmp/rspec_results.json --format progress --out tmp/rspec_progress.txt
+```
+
+If RSpec fails, extract failures with:
+
+```bash
+jq '[.examples[] | select(.status != "passed") | {file_path, line_number, full_description, status, exception: .exception}]' tmp/rspec_results.json > tmp/rspec_failures.json
+```
+
+Do not run partial RSpec or partial RuboCop for release validation.
+
+## Migration Rules
+
+- Never edit published migrations. Add a new migration instead.
+- Do not guard migrations with `create_table?`, `drop_table?`, `table_exists?`, `if_exists`, `if_not_exists`, `next if`, or `next unless`.
+- Keep migrations split by domain and dependency. Do not hide a whole schema rewrite in one large migration.
+- Use portable Sequel DSL by default. Adapter-specific code is acceptable only for adapter-specific features, such as PostgreSQL vector columns.
+- Prefer `id` integer primary keys for joins and `uuid` public identifiers for APIs, logs, and external references.
+- Avoid JSON columns unless the data is genuinely dynamic provider evidence or cannot be normalized without losing meaning.
+
+## Sequel Association Rules
+
+Use the official Sequel association APIs as the model contract:
+
+- Association API reference: https://sequel.jeremyevans.net/rdoc/classes/Sequel/Model/Associations/ClassMethods.html
+- Association basics: https://github.com/jeremyevans/sequel/blob/master/doc/association_basics.rdoc
+
+Required mapping:
+
+| Schema shape | Sequel association |
+|--------------|--------------------|
+| This table has the foreign key | `many_to_one` |
+| Other table has the foreign key | `one_to_many` or `one_to_one` |
+| Join table connects both sides | `many_to_many` |
+| One associated row through a join table | `one_through_one` |
+
+Rules:
+
+- Define associations for real foreign-key relationships when adding or changing models.
+- Prefer association methods and association datasets over ad hoc `where(foreign_key: ...)` lookups in model helpers.
+- When names are not inferable, explicitly set `:class`, `:key`, `:primary_key`, `:join_table`, `:left_key`, and `:right_key`.
+- Do not create association names that collide with actual column names; Sequel creates methods using the association name.
+- Keep namespace models aligned with API/domain shape, for example `Legion::Data::Model::Identity::*`, `LLM::*`, `Apollo::*`, and `RBAC::*`.
+
+## Current Schema Notes
+
+- Migrations currently run through `096`.
+- `074`-`076` are mainline Apollo/task/extract migrations.
+- `077`-`090` define the LLM lifecycle ledger.
+- `091`-`096` define portable identity companion tables.
+- Published PostgreSQL identity migrations remain in place; portable identity tables are additive.
+
+## Release Hygiene
+
+For behavior, model, migration, or Ruby code changes:
+
+- Update `lib/legion/data/version.rb`.
+- Update `CHANGELOG.md`.
+- Update `README.md` when public behavior, schema, configuration, or model surface changes.
+- Keep `.gitignore` ignoring `/Gemfile.lock` and `*.gem`.
+- Do not include generated DBs, logs, coverage output, built gems, or repo-external `/docs` workspace files in commits.