Feat/crewai integration - #988
Conversation
Add native CrewAI support so Crew agents can share a ContextGraph and AgentContext via BaseTool subclasses and a BaseKnowledgeSource, matching the existing agno integration pattern. - SemanticaKGTool: 5 KG actions (extract_entities, extract_relations, add_to_graph, query_graph, find_related) with sync run()/async arun() - SemanticaDecisionTool: 5 decision-intelligence actions (record_decision, find_precedents, trace_causal_chain, analyze_impact, check_policy) over AgentContext - SemanticaKnowledgeSource: serializes a ContextGraph into crew knowledge storage; bridges legacy load_content() and current validate_content()/aadd() contracts for crewai>=0.80.0 - All classes degrade gracefully when crewai is absent - New pip extra crewai=... included in the all bundle - 70 new tests (stub-based present-case + subprocess degradation path) - Docs: integrations/crewai.md, docs.json nav, README matrix updates
…mantica-agi#962) Bugs found during live testing with crewai 1.15.16: - SemanticaKGTool.add_to_graph crashed on real Entity/Relation dataclasses ('str' object has no attribute 'end_char'): string names were passed to extract_relations(entities=...), which requires Entity objects, and the tool read .name/.source/.target instead of Entity's .text/.label and Relation's .subject/.object. Add shape-agnostic field helpers. - SemanticaDecisionTool() created an AgentContext without a knowledge_graph, so _decision_backend was never set and record_decision raised 'Decision tracking is not enabled'. Wire in a ContextGraph. - record_decision hard-failed when the agent omitted optional fields; fall back to category='general', reasoning='agent decision', outcome='recorded'. Add tests covering real Entity/Relation dataclass shapes and the live auto-created AgentContext path (now 77 crewai tests, 212 total).
…gi#962) ContextGraph.get_neighbors only follows outgoing edges, so a node whose only edge is incoming (A -> B) reported no related concepts. Rebuild a bidirectional adjacency from find_edges() in SemanticaKGTool._find_related so 'related' honors both directions.
…tion semantics (semantica-agi#962) - Exclude live graph/context/extractor state from JSON serialization (model_dump(mode="json")) so CrewAI checkpointing no longer raises PydanticSerializationError; model_post_init self-heals defaults on restore - query_graph now searches node content via graph.query() plus id/type - trace_causal_chain returns an explicit error when causal tracing is unavailable instead of substituting similarity precedents; call trace_decision_causality(..., max_depth=...) with the correct kwarg name - find_precedents propagates max_precedents/limit to the backend instead of being silently capped at 10 - Serialize add_to_graph batches under a module lock to prevent concurrent double-counting; skip nameless entities instead of creating repr()-junk nodes - aadd() runs CPU-bound serialization in a thread executor - Mirror crewai args_schema serialize/restore in the conftest stub and add serialization regression tests (crewai: 92 tests)
… harden concurrency (semantica-agi#962) - _eval_rule now coerces rule values type-aware: bool("false") was truthy, so 'enabled == false' reported a violation for enabled=false, and string datums like "0.90" were compared lexicographically instead of numerically - _trace_causal_chain no longer raises AttributeError (which escaped _run) when the decision context lacks knowledge_graph; returns honest error JSON - SemanticaKnowledgeSource storage failures log an actionable ERROR; without a configured crew embedder agents previously retrieved nothing silently - add_to_graph uses a per-graph re-entrant lock (WeakKeyDictionary) instead of a process-global one: independent graphs no longer serialize each other and re-entrant extractor callbacks cannot deadlock - entity/relation confidence=None normalizes to 1.0 instead of failing the whole extraction with float(None) - add subprocess integration test against real crewai covering Crew-level serialization round-trip and checkpoint restore (stub tests cannot see it) - docs: embedder requirement for SemanticaKnowledgeSource; resume contract note
…rage is wired (semantica-agi#962) Re-verification against real crewai showed the embedder-missing failure raises ValueError even though storage IS wired, so the old except-ValueError branch mislabeled it as 'storage not wired' and logged DEBUG — hiding the failure. Distinguish by storage presence instead of exception type: storage is None -> DEBUG keep-in-memory (legitimate standalone use); storage wired but save() raises -> actionable ERROR. Add regression test mirroring real crewai's ValueError-on-missing-embedder behavior.
…tica-agi#962) The public crewai contract is run()/arun(); without crewai installed they were missing (only the private _run existed), so the documented 'usable without crewai' path raised AttributeError at the entry point. Define them in degraded mode only, leaving crewai's BaseTool implementations untouched when present. Extend the degradation subprocess test to exercise run() and arun().
…tate flag - _query_graph: id/type matches now return the same schema as content matches (id/type/label/content/score) instead of a bare list - _eval_rule: non-greedy field capture so hyphen/dot/space JSON keys (e.g. "risk-score >= 0.9") are addressable in policy rules - add had_live_state/reconstructed_state so checkpoint-restored tools and knowledge sources signal that their live graph/context was lost and an empty one reconstructed; knowledge source no longer hides the loss by eagerly rebuilding its graph inside __init__ (pydantic calls __init__ during model_validate)
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
PR Summary by QodoAdd first-class CrewAI integration (tools, knowledge source, checkpoints)
AI Description
Diagram
High-Level Assessment
Files changed (16)
|
Code Review by Qodo
1.
|
…listic availability - record_decision: stop calling float() in _run, so malformed confidence values surface as JSON errors (via _record_decision's handling) instead of crashing the tool - _coerce_value: return the stripped string for non-numeric literals so whitespace-padded decision_data fields match policy rules - centralize crewai availability in _availability.py so the exported CREWAI_AVAILABLE flag is holistic across tools and knowledge source (previously each module probed crewai independently and the package flag came from decision_tool only)
ZohaibHassan16
left a comment
There was a problem hiding this comment.
LGTM. All Qodo findings resolved and tests passing.
ZohaibHassan16
left a comment
There was a problem hiding this comment.
Looks like the CI build check is failing because requirements-ci.txt is out of date (the code is alright).
This PR adds the new crewai extra in pyproject.toml and also adds it to all. That brings in crewai, crewai-tools and a bunch of other transitive dependencies like chromadb, lancedb, etc
But requirements-ci.txt was not regenerated, so now it doesn't match pyproject.toml. The staleness check from #945 is catching this.
I think running the command from CONTRIBUTING.md should fix it:
pip install uv==0.12.1
uv pip compile pyproject.toml --python-version 3.11 --extra all --generate-hashes -o requirements-ci.txtThen commit the updated requirements-ci.txt and the build check should pass.
The crewai extra in pyproject.toml brings in crewai, crewai-tools and transitive deps (chromadb, lancedb, ...). Recompile with uv==0.12.1 per CONTRIBUTING.md so the CI staleness check passes.
crewai (all versions) hard-requires chromadb~=1.1.0, which carries a pre-authentication code-injection advisory (CVE-2026-45829 / GHSA-f4j7-r4q5-qw2c) with NO fixed release — even the latest 1.5.9 is affected. Keeping crewai in the 'all' extra failed pip-audit and the safety check on requirements-ci.txt. - drop crewai from the 'all' aggregate (standalone semantica[crewai] extra is unchanged and still installs crewai) - stop listing crewai-tools in the extra: the integration only uses crewai core (BaseTool, BaseKnowledgeSource) and crewai-tools pulled extra transitive deps - regenerate requirements-ci.txt: OSV/pip-audit 0 vulnerabilities, safety 0 vulnerabilities, staleness check matches
|
@ZohaibHassan16 thanks for the guidance! Regenerating requirements-ci.txt fixed the build staleness check, but it then exposed the real issue: crewai (all versions) hard-requires chromadb~=1.1.0, which carries a pre-authentication code-injection advisory (CVE-2026-45829 / GHSA-f4j7-r4q5-qw2c) with no fixed release - even the latest chromadb 1.5.9 is still in the affected range. That made pip-audit -r requirements-ci.txt and the safety check fail on the PR. Since there's no fixed chromadb to pin to, I resolved it by keeping the crewai integration fully installable but out of the locked CI dependency set (commit 5f2fad8):
Verified locally: pip-audit (OSV): 0 vulnerabilities across all 392 packages, safety: 0, staleness check matches, 245 tests pass, lint clean. The audit/security-scan jobs should now be green on the latest head. Also: the earlier approval was auto-dismissed by the new commits - could you give it another look when you get a chance? 🙏 |
ZohaibHassan16
left a comment
There was a problem hiding this comment.
Thank you for being so thorough, especially vis a vis chromadb CVE. Everything looks right.
Just two things I think we should fix before merging:
-
CHANGELOG.mdis outdated. It still sayscrewai>=0.80.0, crewai-tools>=0.17.0and mentions it being included in theallextra. Since5f2fad8donly changedpyproject.tomlandrequirements-ci.txt, the changelog doesn't match anymore. I think we should update it to mention thatcrewai-toolswas removed andcrewaiwas taken out ofallbecause of CVE-2026-45829. -
integrations/crewai/README.mdshould probably have a warning. Right now it only sayspip install semantica[crewai]. The CVE is only mentioned in a comment inpyproject.toml, so users installing the extra probably won't see it. Since this is still an unpatched critical CVE, I think we should add a short note saying that installing the extra pulls in chromadb, which is currently affected by CVE-2026-45829.
Once those two are updated, I'm good to re-approve.
Description
First-class CrewAI integration for Semantica: SemanticaKGTool, SemanticaDecisionTool, and SemanticaKnowledgeSource expose the Semantica context/knowledge graph to CrewAI agents and tasks — including policy-based decision intelligence, checkpoint (de)serialization against real crewai, and a fully functional degraded mode when crewai is not installed.
Type of Change
Related Issues
Changes Made
Testing
Test Commands
Documentation
Breaking Changes
Breaking Changes: No
Checklist
Additional Notes
Verified against real crewai 1.15.16 (separate venv) and in degraded mode (import-blocked). 108 crewai + 135 agno tests pass; flake8/black/isort clean; python -m build succeeds.