feat: Go context-engineering proxy/library (tree-sitter, TOON, Starlark extractor, config, metrics, real integrations)

.github/workflows/ci.yaml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          check-latest: true
+      - name: Lint
+        run: make lint
+      - name: Test
+        run: make test
+      - name: Build
+        run: make build
+
+  trivy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Trivy filesystem scan
+        uses: aquasecurity/trivy-action@0.28.0
+        with:
+          scan-type: fs
+          ignore-unfixed: true
+          severity: CRITICAL,HIGH
+          exit-code: '1'

.gitignore

@@ -162,3 +162,9 @@ cython_debug/
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 .idea/
 
+
+# Go / lab-context-engineering
+/bin/
+*.test
+*.out
+coverage.txt

.pre-commit-config.yaml

@@ -0,0 +1,21 @@
+# Run `make pre-commit` once to install these hooks (including commit-msg / DCO).
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+
+  - repo: https://github.com/dnephin/pre-commit-golang
+    rev: v0.5.1
+    hooks:
+      - id: go-fmt
+      - id: go-vet
+      - id: go-mod-tidy
+
+  - repo: https://github.com/jorisroovers/gitlint
+    rev: v0.19.1
+    hooks:
+      - id: gitlint

CLAUDE.md

@@ -0,0 +1,35 @@
+# CLAUDE.md
+
+Guidance for working in `lab-context-engineering`, a Kagenti platform component.
+
+## What this repo is
+
+A single **Go** core that reduces the token cost of LLM agent traffic. It ships as a
+standalone proxy binary (`cmd/proxy`), an importable library (`engine`, `surfaces`), and
+eval-containers wiring. Its lineage is the Python `winnow` prototype (`../winnow`), which
+is the behavioral reference — port its *logic*, re-implement its transport in Go.
+
+## Hard boundaries
+
+- **No AuthBridge / kagenti-extensions code lives here.** That plugin is built in
+  `kagenti-extensions` and depends on this repo. Keep the public API (`engine`,
+  `surfaces`, `config`) clean and importable; never reach into another repo.
+- **Fail open, always.** Any error in any stage forwards the original request untouched.
+  Reductions must be reversible (markers + rewind store). Never drop content that is only
+  *predicted* unused — `provable_only` is on by default.
+
+## Conventions
+
+- Go 1.25, module `github.com/kagenti/lab-context-engineering`. `make fmt lint test build`.
+- Match the surrounding code's style; keep packages small and single-purpose.
+- **Commits: DCO sign-off is mandatory** — `git commit -s`. Author as the repo owner.
+  AI attribution uses `Assisted-By:` — never `Co-Authored-By`, never a "Generated with"
+  line. Conventional-commit titles.
+- Observability follows OpenTelemetry **GenAI semantic conventions** (`gen_ai.*`).
+
+## Layout
+
+`cmd/proxy` (binary) · `engine` (Transform/Expand + stages) · `surfaces` (wire⇄canonical)
+· `internal/*` (types, extract, relevance, signals, taxonomy, actions, cache, markers,
+rewind, zones, session, compaction, tokens) · `config` · `observability` · `deploy` ·
+`docs`.

CODE_OF_CONDUCT.md

@@ -0,0 +1,8 @@
+# Code of Conduct
+
+This project adheres to the Kagenti community Code of Conduct, which is based on the
+[Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+By participating, you are expected to uphold this code. Please report unacceptable
+behavior to the maintainers listed in [MAINTAINERS.md](MAINTAINERS.md) or via the process
+described in the main [Kagenti](https://github.com/kagenti/kagenti) repository.

CONTRIBUTING.md

@@ -0,0 +1,41 @@
+# Contributing
+
+Thanks for your interest in `lab-context-engineering`, a component of the
+[Kagenti](https://github.com/kagenti/kagenti) platform.
+
+## Developer Certificate of Origin (DCO)
+
+All commits must be signed off under the [DCO](https://developercertificate.org/):
+
+```sh
+git commit -s -m "feat: ..."
+```
+
+This adds a `Signed-off-by:` trailer certifying you wrote or have the right to submit the
+patch. PRs with unsigned commits will not be merged.
+
+When a commit was assisted by an AI agent, attribute it with an `Assisted-By:` trailer —
+do **not** use `Co-Authored-By` and do not add "Generated with" lines.
+
+## Development
+
+```sh
+make fmt      # format + go mod tidy
+make lint     # go vet + gofmt check
+make test     # go test -race ./...
+make build    # build ./bin/lab-cx
+```
+
+- Go 1.25+.
+- Keep packages small and single-purpose; the engine core must stay transport-agnostic.
+- Every reduction must be reversible and fail-open. Add tests for both the happy path and
+  the fault-injection (fail-open) path.
+
+## Pull requests
+
+Use conventional-commit titles (`feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`).
+Keep PRs focused. CI (lint, test, build, Trivy) must be green.
+
+## Reporting security issues
+
+See [SECURITY.md](SECURITY.md). Do not open public issues for vulnerabilities.

Dockerfile

@@ -1,7 +1,16 @@
-FROM python:3.13-slim
-COPY --from=ghcr.io/astral-sh/uv:0.9.5 /uv /bin/uv
-WORKDIR /app
+# Build the lab-cx proxy. CGO is required (tree-sitter), so the final image is
+# glibc-based (distroless/base), not static.
+FROM golang:1.25 AS build
+WORKDIR /src
 COPY . .
-RUN UV_COMPILE_BYTECODE=1 HOME=/tmp uv sync --no-cache --link-mode copy
-ENV PRODUCTION_MODE=True
-CMD ["/app/.venv/bin/server"]
+ARG VERSION=dev
+ARG COMMIT=none
+RUN CGO_ENABLED=1 go build \
+	-ldflags "-s -w -X github.com/kagenti/lab-context-engineering/internal/buildinfo.Version=${VERSION} -X github.com/kagenti/lab-context-engineering/internal/buildinfo.Commit=${COMMIT}" \
+	-o /out/lab-cx ./cmd/proxy
+
+FROM gcr.io/distroless/base-debian12:nonroot
+COPY --from=build /out/lab-cx /usr/local/bin/lab-cx
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/lab-cx"]
+CMD ["proxy"]

GOVERNANCE.md

@@ -0,0 +1,9 @@
+# Governance
+
+`lab-context-engineering` is a component of the
+[Kagenti](https://github.com/kagenti/kagenti) platform and follows Kagenti's project
+governance. See the Kagenti community
+[GOVERNANCE](https://github.com/i-am-bee/community/blob/main/GOVERNANCE.md) document for
+the roles, decision-making process, and the path to becoming a maintainer.
+
+Maintainers of this repository are listed in [MAINTAINERS.md](MAINTAINERS.md).