rosett-ai 1.5.9 → 1.5.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29a816be5fea64d709f477070a052b5b595a13f74c1f77507a17f7f175a87972
-  data.tar.gz: ca13bcf8795e23edb27c19c27f2b5f90355159f1688f5a40c05e88c45331afd9
+  metadata.gz: cb0358498de4f1123fd29a3ae3e728712340a70772a5469a31d25048a4525aca
+  data.tar.gz: bbc11a0a29c5d4b8b14fe3c34e9d28ae93c1046b1b6fc6f1758f09e4c8d21684
 SHA512:
-  metadata.gz: fa098e5c74b48e50337278e7a6e8f59a37c4a26d916466d573426882e5aa8b139680d68d9e5d48e5975bfba36f016b6d684716cf829d910fdc85698469f6774a
-  data.tar.gz: 4951940f5dc9d20cd28f0dc648a2f004c69c7ec8bce406191c91819736e8faae92a51b6393d881fc9a1b511ef555fb77dc3181c65273aedaa866cdb8f731e535
+  metadata.gz: bbfc6704a022cbc1077b0c394282abb6ed055aea1de6810d7bfc56b915c2749831ba9484b2325aae150601bd8cf8c01db2b84e17856e2a71c928184b06121436
+  data.tar.gz: 8a143b9cb92ee1e6dad0622cd0da6275e806589e6ec10fb171111af98a0e21882a24e4f952652e0b7b40aa079c69cda8b57f07cd7bfc2b1d5949030b1bb5021b

data/CHANGELOG.md

@@ -6,6 +6,42 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.5.12] - 2026-07-15
+
+### Fixed
+
+- **`rai_behaviour_list` / `rai_behaviour_show` / `rai_behaviour_display` MCP tools** — all three
+  were resolving the behaviour directory via `RosettAi.root.join('conf', 'behaviour')` (the gem
+  install directory) instead of `RosettAi.paths.rai_conf_dir.join('behaviour')` (the user XDG
+  config path `~/.config/rosett-ai/conf/behaviour/`). This caused the tools to always return
+  empty results.
+
+## [1.5.11] - 2026-07-15
+
+### Fixed
+
+- **D-Bus rate-limiter thread-safety specs** — added `Process.clock_gettime` stub to the
+  `describe 'thread safety'` block, freezing monotonic time at `0.0` for all concurrent
+  examples. Without the stub, wall-clock token refill (rate: 100–1000 tokens/s) races the
+  assertions on slow CI runners, causing intermittent `results.count(:success) != burst`
+  failures. Root cause: test-timing artifact; the implementation mutex is correct. Mirrors
+  the existing stub pattern used in `#available_tokens` and `refill precision` blocks.
+
+## [1.5.10] - 2026-07-08
+
+### Security
+
+- **publish:gem CI gate hardened** — `publish:gem` now declares `needs:` on
+  `audit:artifact`, `package:smoke-test`, and `package:gem-smoke-test` in
+  addition to the existing `audit:gem` gate. Gem publication is blocked until
+  both the `.gem` and `.deb` artifact audits pass and the install-parity smoke
+  tests succeed. Closes the DAG gap that allowed v1.5.9 to publish the gem
+  past failing audit and smoke-test jobs.
+
+- **publish:deb-push-aptly CI gate hardened** — adds `package:smoke-test`
+  to the existing `needs:` list so `.deb` publication is also blocked until
+  the postinst smoke test passes.
+
 ## [1.5.9] - 2026-07-06
 
 ### Security
@@ -13,7 +49,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **audit:gem CI gate** — adds a standalone `audit:gem` job (allowlist,
   denylist, PII scan, gitleaks) wired as a `needs:` dependency of
   `publish:gem`. Closes the DAG gap that let v1.5.8 publish without any
-  security verification (WP#3248).
+  security verification.
 
 ### Added
 
@@ -22,8 +58,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   subcommands load without `LoadError` or `NameError`.
 
 - **test:mutant:full** — full-suite mutant gate on `v*` tag pipelines;
-  `allow_failure:true` until surviving mutants are resolved (WP#3248 P1
-  baseline ~596 survivors).
+  `allow_failure:true` until surviving mutants are resolved
+  (baseline ~596 survivors).
 
 - **sec_016 behaviour rule** — codifies the requirement that every publish
   job targeting a public registry must declare both an artifact-audit gate

data/lib/rosett_ai/mcp/tools/behaviour_display_tool.rb

@@ -44,8 +44,8 @@ module RosettAi
         # @param format [String] output format ('table' or 'json')
         # @return [Hash] formatted behaviour display
         def call(format: 'json')
-          dir = RosettAi.root.join('conf', 'behaviour')
-          return { behaviours: [], format: format } unless dir.directory?
+          dir = RosettAi.paths.rai_conf_dir.join('behaviour')
+          return { behaviours: [], format: format, total: 0 } unless dir.directory?
 
           behaviours = dir.glob('*.yml').filter_map { |path| load_display(path) }
           { behaviours: behaviours, format: format, total: behaviours.size }

data/lib/rosett_ai/mcp/tools/behaviour_list_tool.rb

@@ -31,7 +31,7 @@ module RosettAi
         #
         # @return [Hash] result with :behaviours array
         def call
-          dir = RosettAi.root.join('conf', 'behaviour')
+          dir = RosettAi.paths.rai_conf_dir.join('behaviour')
           return { behaviours: [] } unless dir.directory?
 
           behaviours = dir.glob('*.yml').filter_map { |path| load_behaviour(path) }

data/lib/rosett_ai/mcp/tools/behaviour_show_tool.rb

@@ -44,7 +44,7 @@ module RosettAi
         # @param name [String] behaviour name (without .yml)
         # @return [Hash] behaviour data or error
         def call(name:)
-          path = RosettAi.root.join('conf', 'behaviour', "#{name}.yml")
+          path = RosettAi.paths.rai_conf_dir.join('behaviour', "#{name}.yml")
           return ResponseHelper.error("Behaviour not found: #{name}") unless path.exist?
 
           data = YAML.safe_load_file(path, permitted_classes: [Symbol])

data/lib/rosett_ai/thor/tasks/build.rb

@@ -77,8 +77,8 @@ module RosettAi
           'Gemfile.integration', 'Gemfile.integration.lock',
           # CI/CD
           '.gitlab-ci*',
-          # CI artifacts — never ship test/lint output
-          'rspec-report.xml', 'rubocop-report.json',
+          # CI artifacts — never ship test/lint/security-scan output
+          'rspec-report.xml', 'rubocop-report.json', 'trivy-config-report.json',
           # Build & packaging
           'coverage', 'tmp', 'pkg', 'spec', 'test', 'packaging',
           # Dev tool configs
@@ -89,7 +89,7 @@ module RosettAi
           '.project', '.rosett-ai',
           # Dev-only documentation (not needed at runtime)
           'doc/api', 'doc/reference', 'doc/context', 'doc/issues',
-          'doc/decisions', 'doc/changes',
+          'doc/decisions', 'doc/changes', 'doc/design',
           # Security advisories — internal, never ship publicly
           'doc/security',
           # Design docs — carry internal WP refs, not runtime-required
@@ -444,13 +444,24 @@ module RosettAi
         # -- gem installation --------------------------------------------------
 
         def install_gems!
-          spinner = build_spinner('Installing gems (deployment mode)...')
+          spinner = build_spinner('Installing gems into embedded gem home...')
+          ruby_abi = query_embedded_ruby('RbConfig::CONFIG["ruby_version"]')
+          gem_home = staging_embedded.join('lib', 'ruby', 'gems', ruby_abi)
+          FileUtils.mkdir_p(gem_home)
           embedded_bundle = staging_embedded.join('bin', 'bundle').to_s
 
-          env = embedded_env
+          # Install runtime deps directly into the embedded Ruby's own gem home.
+          # The embedded ruby finds them by default (via GEM_HOME) with no wrapper
+          # env vars or bundler/setup at runtime — proving genuine self-containment.
+          env = clean_env.merge(
+            'PATH' => "#{staging_embedded.join('bin')}:#{HERMETIC_SYSTEM_PATH}",
+            'BUNDLE_GEMFILE' => staging_app.join('Gemfile').to_s,
+            'GEM_HOME' => gem_home.to_s,
+            'GEM_PATH' => gem_home.to_s,
+            'LD_LIBRARY_PATH' => staging_embedded.join('lib').to_s
+          )
+
           cmds = [
-            [env, embedded_bundle, 'config', 'set', '--local', 'deployment', 'true'],
-            [env, embedded_bundle, 'config', 'set', '--local', 'path', 'vendor/bundle'],
             [env, embedded_bundle, 'config', 'set', '--local', 'without', 'development test build desktop engines'],
             [env, embedded_bundle, 'config', 'set', '--local', 'jobs', jobs_count.to_s],
             [env, embedded_bundle, 'install']
@@ -462,8 +473,8 @@ module RosettAi
             spinner.error(Rainbow(' failed').red)
             log_bundle_debug(env, embedded_bundle)
             abort_build(<<~MSG.chomp)
-              Gem installation failed.
-                The embedded Ruby bundler could not resolve or install gems.
+              Gem installation into embedded gem home failed.
+                The embedded Ruby bundler could not install gems into #{gem_home}.
                 This usually means Bundler environment variables from the parent
                 process leaked into the build. Check the build log for details.
             MSG
@@ -492,8 +503,8 @@ module RosettAi
         end
 
         def collect_build_artifacts
-          Dir.glob(staging_app.join('vendor', 'bundle', '**', '{gem_make.out,mkmf.log}')) +
-            Dir.glob(staging_app.join('vendor', 'bundle', '**', 'ext', '**', 'Makefile'))
+          Dir.glob(staging_embedded.join('lib', 'ruby', 'gems', '**', '{gem_make.out,mkmf.log}')) +
+            Dir.glob(staging_embedded.join('lib', 'ruby', 'gems', '**', 'ext', '**', 'Makefile'))
         end
 
         def remove_artifact(path)
@@ -523,15 +534,6 @@ module RosettAi
         # 1. Unsets all Bundler/RubyGems vars inherited from `bundle exec`
         # 2. Sets PATH to prefer the embedded Ruby
         # 3. Points BUNDLE_GEMFILE at the staging app's Gemfile
-        def embedded_env
-          env = clean_env.merge(
-            'PATH' => "#{staging_embedded.join('bin')}:#{HERMETIC_SYSTEM_PATH}",
-            'BUNDLE_GEMFILE' => staging_app.join('Gemfile').to_s
-          )
-          log_to_file("embedded_env: #{env.inspect}")
-          env
-        end
-
         # Strips all Bundler/RubyGems variables. When passed to system(),
         # nil values cause the variable to be unset in the child process.
         def clean_env

data/lib/rosett_ai/version.rb

@@ -5,5 +5,5 @@
 
 module RosettAi
   # @return [String] Current version of the rosett-ai gem.
-  VERSION = '1.5.9'
+  VERSION = '1.5.12'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rosett-ai
 version: !ruby/object:Gem::Version
-  version: 1.5.9
+  version: 1.5.12
 platform: ruby
 authors:
 - Hugo Antonio Sepulveda Manriquez