rubik 0.1.6 → 0.2.0

data/lib/rubik/runtime/repair_probe.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require "tempfile"
+require "timeout"
+require_relative "discovery"
+require_relative "diagnostic_engine"
+require_relative "../lsp/client"
+
+module Rubik
+  module Runtime
+    # Functional checks own their resources through the caller's probe context.
+    class RepairProbe
+      def initialize(root_dir:)
+        @root_dir = root_dir
+      end
+
+      PROBE_TIMEOUT = 5
+      # These commands support help without running tests or formatting files.
+      HELP_PROBE_BINARIES = ["ruby", "python", "python3", "pytest", "rspec", "rake", "bundle", "rubocop", "standardrb", "ruff", "black", "rustfmt", "cargo", "go", "gofmt",
+                             "goimports", "clang-format", "zig", "prettier", "biome", "npm", "pnpm", "yarn", "bun", "mix", "dart", "crystal", "echo"].freeze
+
+      def verify(target, lang, proposed_cmd, sub_ctx, probe_args: nil)
+        return probe_failure(proposed_cmd, 1, "Unknown target component type: #{target}") unless ["lsp", "test_runner", "linter", "command"].include?(target)
+        unless Rubik::Runtime::Discovery.binary_available?(proposed_cmd, root_dir: @root_dir)
+          return probe_failure(proposed_cmd, 127, "Availability check failed: executable not found in PATH")
+        end
+
+        if target == "lsp"
+          client = Rubik::LSP::Client.new(lang, root_dir: @root_dir, server_cmd: proposed_cmd)
+          sub_ctx.on_dispose { client.stop }
+          begin
+            result = Timeout.timeout(PROBE_TIMEOUT) { client.start }
+            return probe_failure(proposed_cmd, 1, "Functional probe failed: LSP initialize handshake rejected") unless result && client.alive?
+          rescue Timeout::Error
+            return probe_failure(proposed_cmd, 124, "LSP initialize handshake timed out")
+          end
+          return [true, nil]
+        end
+
+        argv = Shellwords.split(proposed_cmd)
+        if probe_args.nil?
+          unless HELP_PROBE_BINARIES.include?(File.basename(argv.first.to_s))
+            return probe_failure(proposed_cmd, 1, "Available but unverified: provide non-mutating probe_args for this executable")
+          end
+
+          probe_args = ["--help"]
+        end
+        return probe_failure(proposed_cmd, 1, "probe_args must be a non-empty array of strings") unless probe_args.is_a?(Array) && !probe_args.empty? && probe_args.all?(String)
+
+        argv.concat(probe_args)
+        # Array-form spawn never interprets shell operators. File-backed output
+        # avoids pipe-reader threads surviving a timeout or a forked descendant.
+        output = Tempfile.new("rubik-repair-probe")
+        sub_ctx.on_dispose { output.close! }
+        options = { chdir: @root_dir, in: File::NULL, out: output, err: output }
+        options[:pgroup] = true unless Rubik::Platform.windows?
+        pid = Process.spawn(*argv, **options)
+        reaped = false
+        sub_ctx.on_dispose do
+          if Rubik::Platform.windows?
+            Rubik::Platform.kill_tree(pid) unless reaped
+          else
+            begin
+              Process.kill("KILL", -pid)
+            rescue Errno::ESRCH
+              nil
+            end
+          end
+          Process.waitpid(pid) unless reaped
+        rescue Errno::ECHILD
+          nil
+        end
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + PROBE_TIMEOUT
+        loop do
+          waited = Process.waitpid2(pid, Process::WNOHANG)
+          if waited
+            reaped = true
+            status = waited.last
+            return [true, nil] if status.success?
+
+            output.rewind
+            return probe_failure(proposed_cmd, status.exitstatus || 1, "Functional probe failed: #{output.read(4096)}")
+          end
+          return probe_failure(proposed_cmd, 124, "Functional probe timed out") if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+
+          sleep 0.01
+        end
+      end
+
+      private
+
+      def probe_failure(command, code, message)
+        [false, Rubik::Runtime::DiagnosticEngine.diagnose(cmd: command, exit_code: code, stderr: message)]
+      end
+    end
+  end
+end

data/lib/rubik/security/blocked_guidance.rb

@@ -59,6 +59,25 @@ module Rubik
                     "If genuinely required and safe, the operator can allowlist it once:",
                     "  !allow-cmd add #{quoted}"
                   ]
+                elsif kind == :classifier_error
+                  # AST walk crashed (fail-closed): the command was never
+                  # classified, so no rule matched — blame-free guidance
+                  # plus the explicit statement that AST evaluation failed.
+                  [
+                    "Security blocked: #{message}",
+                    "The command AST could not be evaluated (classifier error), so the command was not classified.",
+                    "If genuinely required and safe, the operator can allowlist the exact simple command once:",
+                    "  !allow-cmd add #{quoted}"
+                  ]
+                elsif kind == :parse_ambiguous
+                  # Tree-sitter reported syntax errors: a partial verdict is
+                  # not a verdict — the command was blocked unparsed.
+                  [
+                    "Security blocked: #{message}",
+                    "The command AST could not be fully parsed (tree-sitter syntax error), so the command was not classified.",
+                    "If genuinely required and safe, the operator can allowlist it once:",
+                    "  !allow-cmd add #{quoted}"
+                  ]
                 elsif cmd && err.respond_to?(:probe_like) && err.probe_like
                   # Probe branch first: `python3 --version` is probe-shaped and
                   # must not be hijacked by the text-munging variant below.

data/lib/rubik/security/guard.rb

@@ -109,6 +109,13 @@ module Rubik
       # whose ONLY arguments are these flags is read-only by construction.
       SAFE_PROBE_FLAGS = ["--version", "-v", "--help", "-h"].freeze
 
+      # Shell metacharacters that make a raw (AST-less) token-prefix allowlist
+      # match dishonest: they can join, redirect, substitute, or line-split
+      # the string, so "the first tokens match" would not mean "the whole
+      # simple command matches". The classifier-crash rescue only accepts a
+      # single simple command; anything else fails closed.
+      RAW_ALLOWLIST_UNSAFE_PATTERN = /[;&|<>`$(){}\[\]\\\n\r]/
+
       attr_reader :audit_log_path
 
       # Live-reconfigurable audit destination (ConfigWiring applies config
@@ -486,16 +493,55 @@ module Rubik
             )
           end
 
+          # Ambiguous parse (tree-sitter syntax errors) is a classification
+          # failure, not a pass: the walk cannot vouch for the whole
+          # expression, so a safe-looking partial verdict must not fall
+          # through to the catastrophic-only regex gate. The allowlist stays
+          # the valve because a real AST exists — every segment is checked
+          # against the operator entries.
+          if !allow_unknown && ast.parse_warnings.to_a.any?
+            allowlisted = begin
+              command_allowlisted?(ast, cmd_str: cmd_str)
+            rescue StandardError => e
+              warn "[Guard] allowlist evaluation failed, failing closed: #{e.class}: #{e.message}"
+              false
+            end
+            if allowlisted
+              log_audit("allowed_command", command: cmd_str, reason: "operator_allowlist")
+              verify_command_fallback_regex!(cmd_str)
+              return true
+            end
+            log_audit("blocked_command", command: cmd_str, reason: "parse_ambiguous",
+                                         parse_warnings: ast.parse_warnings.to_a.size)
+            raise BlockedWriteError.new(
+              "Command AST could not be fully parsed (tree-sitter syntax error); execution blocked (fail-closed): #{cmd_str}",
+              kind: :parse_ambiguous,
+              blocked_command: cmd_str,
+              rule_name: "parse_ambiguous",
+              probe_like: probe_shape?(cmd_str),
+              segment_report: nil
+            )
+          end
+
           return true if [:readonly, :local_effects, :external_effects].include?(ast.classification) && ast.parse_warnings.empty?
         rescue BlockedWriteError
           raise
         rescue StandardError => e
-          # Unconditional warn + audit trail: a classifier crash downgrades
-          # this verification to the narrow fallback regex, silently skipping
-          # allowlist/probe logic — a security-observable downgrade nobody
-          # should need RUBIK_DEBUG to notice.
-          warn "[WARN] AST classification error, falling back to regex gate: #{e.message}"
-          log_audit("classifier_error", command: cmd_str, reason: "#{e.class}: #{e.message}")
+          # Unconditional warn + audit trail: a classifier crash is a
+          # security-observable downgrade nobody should need RUBIK_DEBUG to
+          # notice. The shell gate fails closed — an exception must never
+          # mint execution permission; the operator allowlist is the one
+          # sanctioned valve. The synthesis seam (allow_unknown) keeps
+          # flowing into its own deny layers (DANGEROUS_SYNTHESIS_PATTERNS
+          # + RubyVM walk), which run after this gate.
+          if allow_unknown
+            warn "[WARN] AST classification error on non-shell input, continuing to synthesis deny layers: #{e.message}"
+            log_audit("classifier_error", command: cmd_str, reason: "#{e.class}: #{e.message}",
+                                          decision: "synthesis_layers")
+          else
+            warn "[WARN] AST classification error, failing closed: #{e.class}: #{e.message}"
+            block_on_classifier_failure!(cmd_str, e)
+          end
         end
 
         verify_command_fallback_regex!(cmd_str)
@@ -685,6 +731,69 @@ module Rubik
         report ? report[:segments].size : 0
       end
 
+      # Classifier-crash gate for the shell path: structured block by
+      # default, one sanctioned rescue — an operator allowlist entry
+      # covering the exact single-command prefix (the same explicit
+      # authorization contract as the unknown-command gate). The
+      # catastrophic fallback regex still runs afterwards on the rescue
+      # path; on the block path it gets first refusal so a catastrophic
+      # command keeps its precise :dangerous_pattern reason.
+      def block_on_classifier_failure!(cmd_str, error)
+        allowlisted = begin
+          command_allowlisted_raw?(cmd_str)
+        rescue StandardError => e
+          warn "[Guard] raw allowlist evaluation failed, failing closed: #{e.class}: #{e.message}"
+          false
+        end
+        log_audit("classifier_error", command: cmd_str, reason: "#{error.class}: #{error.message}",
+                                      decision: allowlisted ? "operator_allowlist" : "blocked")
+
+        if allowlisted
+          log_audit("allowed_command", command: cmd_str, reason: "operator_allowlist_classifier_error")
+          return
+        end
+
+        verify_command_fallback_regex!(cmd_str)
+        log_audit("blocked_command", command: cmd_str, reason: "classifier_error")
+        raise BlockedWriteError.new(
+          "AST evaluation failed, so the command could not be classified; execution blocked (fail-closed): #{cmd_str}",
+          kind: :classifier_error,
+          blocked_command: cmd_str,
+          rule_name: "classifier_error",
+          probe_like: probe_shape?(cmd_str),
+          segment_report: nil
+        )
+      end
+
+      # Token-prefix allowlist check for an input whose AST does not exist
+      # (classifier crashed). Only a single simple command qualifies: with
+      # shell metacharacters present the string may hold several segments
+      # and the gate's "every segment must match" contract cannot be
+      # honored — fail closed instead of over-promising the prefix match.
+      # Quoting is handled by Shellwords; an unparseable string (unbalanced
+      # quote) fails closed.
+      def command_allowlisted_raw?(cmd_str)
+        return false if @command_allowlist.empty?
+        return false if cmd_str.match?(RAW_ALLOWLIST_UNSAFE_PATTERN)
+
+        tokens = nil
+        begin
+          tokens = Shellwords.split(cmd_str)
+        rescue ArgumentError
+          return false
+        end
+        return false if tokens.empty?
+        return false if Rubik::Security::Classifier::Matcher::BUILTIN_DANGEROUS_CMDS.include?(tokens[0].to_s)
+
+        @command_allowlist.any? do |entry|
+          next false if entry.length > tokens.length
+
+          entry.each_with_index.all? do |token, i|
+            i.zero? ? binary_allowlist_match?(tokens[i], token) : tokens[i] == token
+          end
+        end
+      end
+
       def verify_command_fallback_regex!(cmd_str)
         return true unless DANGEROUS_COMMAND_PATTERNS.any? { |p| cmd_str.match?(p) }
 

data/lib/rubik/tools/builtins/lifecycle.rb

@@ -3,6 +3,8 @@
 require_relative "../base"
 require_relative "../output"
 require_relative "../../runtime"
+require_relative "../../runtime/repair_probe"
+require_relative "../../buffer/apply_contract"
 
 module Rubik
   module Tools
@@ -33,7 +35,9 @@ module Rubik
       def execute(args = {})
         return ToolOutput.error("Buffer manager is not connected.") unless @buffer_manager
 
-        if @shell&.config && @shell.config.fetch("buffer.model_can_apply", true) == false
+        shell_config = @shell.respond_to?(:config) ? @shell.config : nil
+        manager_config = @buffer_manager.respond_to?(:config) ? @buffer_manager.config : nil
+        unless Rubik::Buffer::ApplyContract.model_can_apply?(shell_config: shell_config, manager_config: manager_config)
           return ToolOutput.error("Model buffer application is disabled by configuration " \
                                   "(buffer.model_can_apply: false). The human operator will review and apply changes.")
         end
@@ -43,7 +47,15 @@ module Rubik
         policy = force ? "overwrite" : nil
 
         if @buffer_manager.dirty?
-          applied = @buffer_manager.apply!(policy: policy)
+          applied = nil
+          begin
+            applied = @buffer_manager.apply!(policy: policy)
+          rescue Rubik::Buffer::ApplyFailedError => e
+            # Partial apply: files in e.applied ARE on disk — sync the model's
+            # view for them and report the remainder honestly (issue #146).
+            lines = Rubik::Buffer::ApplyContract.failure_lines(e, sync: ->(paths) { @shell&.sync_context_and_ast(paths) })
+            return ToolOutput.error(lines.join("\n"))
+          end
           conflicts = @buffer_manager.last_conflicts || []
           @shell&.sync_context_and_ast(applied) unless applied.empty?
 
@@ -68,30 +80,16 @@ module Rubik
             messages.join("\n")
           end
         else
-          clean_buffer_message
+          Rubik::Buffer::ApplyContract.clean_buffer_message(@buffer_manager.last_applied, auto_apply_mode)
         end
       end
 
       private
 
-      # "Buffer is clean" alone reads as "nothing happened" when an earlier
-      # apply (apply_buffer itself or the auto-apply policy) already flushed
-      # the edits to disk. Surface the last successful apply so the model can
-      # verify against reality instead of re-editing or force-applying
-      # (issue #97 finding 6). When the mode cannot be read, the origin stays
-      # deliberately two-sided rather than inventing a specific cause.
-      def clean_buffer_message
-        last = @buffer_manager.last_applied
-        return "No unapplied buffer changes to write (buffer is clean)." unless last.is_a?(Hash) && Array(last[:paths]).any?
-
-        mode = @shell.respond_to?(:config) && @shell.config.respond_to?(:fetch) ? @shell.config.fetch("buffer.auto_apply", "manual") : nil
-        origin = if !mode.nil? && !mode.to_s.strip.empty? && mode.to_s.downcase != "manual"
-                   "the auto-apply policy (buffer.auto_apply: #{mode})"
-                 else
-                   "an earlier apply_buffer call or the auto-apply policy"
-                 end
-        "No unapplied buffer changes to write (buffer is clean): #{last[:paths].size} file(s) were already written to disk " \
-          "at #{last[:at].utc.iso8601} by #{origin}: #{last[:paths].join(', ')}."
+      def auto_apply_mode
+        return nil unless @shell.respond_to?(:config) && @shell.config.respond_to?(:fetch)
+
+        @shell.config.fetch("buffer.auto_apply", "manual")
       end
     end
 
@@ -117,6 +115,10 @@ module Rubik
               type: "string",
               description: "Replacement or custom command string (optional, probed automatically if auto_probe: true)"
             },
+            probe_args: {
+              type: "array", items: { type: "string" },
+              description: "Explicit non-mutating functional probe arguments appended to the exact proposed command; required for unknown executables"
+            },
             auto_probe: {
               type: "boolean",
               description: "Whether to automatically probe system binaries and candidate commands (default: true)"
@@ -187,7 +189,7 @@ module Rubik
         error_diagnostic = nil
 
         begin
-          verified, error_diagnostic = verify_binary(target, lang, proposed_cmd, sub_ctx)
+          verified, error_diagnostic = verify_binary(target, lang, proposed_cmd, sub_ctx, probe_args: args["probe_args"] || args[:probe_args])
         rescue StandardError => e
           error_diagnostic = Rubik::Runtime::DiagnosticEngine.diagnose(
             cmd: proposed_cmd,
@@ -200,66 +202,114 @@ module Rubik
 
         return ToolOutput.error("Verification failed for #{target} (#{lang}):\n#{error_diagnostic&.format_for_llm}") unless verified
 
-        # 3. Live Context Promotion & Subsystem Configuration (Zero-Downtime Hot Swapping)
-        case target
-        when "lsp"
-          cfg_key = "lsp.servers.#{lang}"
-          prev_cmd = @config&.fetch(cfg_key)
-          had_client = @lsp_manager ? !@lsp_manager.client_for(lang).nil? : false
-          @config&.set(cfg_key, proposed_cmd)
-          if @lsp_manager
-            @lsp_manager.stop_client(lang)
-            start_res = @lsp_manager.start_client(lang)
-            unless start_res.is_a?(Hash) && start_res[:ok] == true
-              # Failure Reversibility (AGENTS.md §1.A): roll back the in-memory
-              # state; disk stays clean because persist happens only after a
-              # verified start (atomic promotion).
-              @lsp_manager.stop_client(lang)
-              @config&.set(cfg_key, prev_cmd)
-              @lsp_manager.start_client(lang) if had_client
-              cause = start_res.is_a?(Hash) ? start_res[:error] : "unexpected start_client response"
-              return ToolOutput.error("Failed to start LSP server for #{lang} ('#{proposed_cmd}'); " \
-                                      "previous configuration restored. Cause: #{cause}")
+        # Live changes belong to a disposable transaction. Successful project
+        # persistence is an operator decision and outlives lifecycle cleanup.
+        promotion_ctx = root_ctx.extend
+        released = false
+        @repair_scopes ||= {}
+        cfg_key = { "lsp" => "lsp.servers", "test_runner" => "test.runners",
+                    "linter" => "linter.commands" }[target]
+        cfg_key = "#{cfg_key}.#{lang}" if cfg_key
+        prev_cmd = @config&.fetch(cfg_key) if cfg_key
+        service_key = "#{{ 'test_runner' => 'runner' }.fetch(target, target)}:#{lang}"
+        previous_services = root_ctx.services
+        phase = "Promotion"
+        begin
+          promotion_ctx.on_dispose do
+            next if released
+
+            @repair_scopes.delete([root_ctx, service_key]) if @repair_scopes[[root_ctx, service_key]].equal?(promotion_ctx)
+            unless root_ctx.disposed?
+              if previous_services.key?(service_key)
+                restored = target == "lsp" ? @lsp_manager&.clients&.[](lang) : nil
+                root_ctx.provide(service_key, restored || previous_services[service_key])
+              else
+                root_ctx.unprovide(service_key)
+              end
             end
-            active_client = @lsp_manager.client_for(lang)
-            root_ctx.provide("lsp:#{lang}", active_client || proposed_cmd)
-          else
-            root_ctx.provide("lsp:#{lang}", proposed_cmd)
           end
-          # Persist to project config only after the live promotion succeeded.
-          persist_res = @config&.set(cfg_key, proposed_cmd, persist: :project)
-        when "test_runner"
-          persist_res = @config&.set("test.runners.#{lang}", proposed_cmd, persist: :project)
-          if @adapter_registry
-            adapter = @adapter_registry.get(lang)
-            if adapter
-              adapter.config ||= @config
-              adapter.custom_test_cmd = proposed_cmd
-            else
-              require_relative "../../adapter/generic" unless defined?(Rubik::Adapter::GenericAdapter)
-              new_adapter = Rubik::Adapter::GenericAdapter.new(lang, test_cmd: proposed_cmd, guard: @guard)
-              new_adapter.config = @config
-              @adapter_registry.register(lang, new_adapter, ctx: root_ctx)
+          if cfg_key && @config
+            promotion_ctx.on_dispose do
+              next if released
+
+              prev_cmd.nil? ? @config.delete(cfg_key) : @config.set(cfg_key, prev_cmd)
             end
+            @config.set(cfg_key, proposed_cmd)
           end
-          root_ctx.provide("runner:#{lang}", proposed_cmd)
-        when "linter"
-          persist_res = @config&.set("linter.commands.#{lang}", proposed_cmd, persist: :project)
-          if @adapter_registry
-            adapter = @adapter_registry.get(lang)
-            if adapter
-              adapter.config ||= @config
-              adapter.custom_format_cmd = proposed_cmd
-            else
-              require_relative "../../adapter/generic" unless defined?(Rubik::Adapter::GenericAdapter)
-              new_adapter = Rubik::Adapter::GenericAdapter.new(lang, format_cmd: proposed_cmd, guard: @guard)
-              new_adapter.config = @config
-              @adapter_registry.register(lang, new_adapter, ctx: root_ctx)
+
+          case target
+          when "lsp"
+            raise "LSP manager and config are required for live activation" unless @lsp_manager && @config
+
+            had_client = !@lsp_manager.clients[lang].nil?
+            # The manager owns its client table. Restore the old configured
+            # client on rollback; probe clients never enter that table.
+            promotion_ctx.on_dispose do
+              next if released
+
+              @lsp_manager.stop_client(lang)
+              prev_cmd.nil? ? @config.delete(cfg_key) : @config.set(cfg_key, prev_cmd)
+              if had_client && !root_ctx.disposed?
+                restored = @lsp_manager.start_client(lang)
+                raise "Previous LSP client could not be restarted: #{restored}" unless restored[:ok]
+              end
+            end
+            @lsp_manager.stop_client(lang)
+            start_res = @lsp_manager.start_client(lang)
+            raise "Failed to start LSP server: #{start_res}" unless start_res.is_a?(Hash) && start_res[:ok]
+
+            service = @lsp_manager.clients[lang]
+            raise "LSP manager reported success without an active client" unless service
+          when "test_runner", "linter"
+            if @adapter_registry
+              adapter = @adapter_registry.get(lang)
+              if adapter
+                field = target == "test_runner" ? :custom_test_cmd : :custom_format_cmd
+                old_value = adapter.public_send(field)
+                old_config = adapter.config
+                promotion_ctx.on_dispose do
+                  next if released
+
+                  adapter.public_send("#{field}=", old_value)
+                  adapter.config = old_config
+                end
+                adapter.config ||= @config
+                adapter.public_send("#{field}=", proposed_cmd)
+              else
+                require_relative "../../adapter/generic" unless defined?(Rubik::Adapter::GenericAdapter)
+                options = target == "test_runner" ? { test_cmd: proposed_cmd } : { format_cmd: proposed_cmd }
+                adapter = Rubik::Adapter::GenericAdapter.new(lang, **options, guard: @guard)
+                adapter.config = @config
+                promotion_ctx.on_dispose do
+                  @adapter_registry.unregister(lang) if !released && @adapter_registry.get(lang).equal?(adapter)
+                end
+                @adapter_registry.register(lang, adapter)
+              end
             end
+            service = proposed_cmd
+          when "command"
+            service = proposed_cmd
           end
-          root_ctx.provide("linter:#{lang}", proposed_cmd)
-        when "command"
-          root_ctx.provide("command:#{lang}", proposed_cmd)
+
+          root_ctx.provide(service_key, service)
+          phase = "Persistence"
+          persist_res = @config.set(cfg_key, proposed_cmd, persist: :project) if cfg_key && @config
+          raise persist_res[:error].to_s if persist_res.is_a?(Hash) && !persist_res[:ok]
+        rescue StandardError => e
+          promotion_ctx.dispose
+          rollback_errors = promotion_ctx.last_dispose_errors
+          detail = rollback_errors.empty? ? "previous session state restored" : "rollback incomplete: #{rollback_errors}"
+          return ToolOutput.error("#{phase} failed for #{target} (#{lang}): #{e.message}; #{detail}")
+        end
+
+        # Keep one lifetime inverse per repaired key, preserving the original
+        # baseline across repeated repairs without retaining every transaction.
+        scope_key = [root_ctx, service_key]
+        if @repair_scopes.key?(scope_key)
+          released = true
+          promotion_ctx.dispose
+        else
+          @repair_scopes[scope_key] = promotion_ctx
         end
 
         if @config.nil? && ["lsp", "test_runner", "linter"].include?(target)
@@ -267,71 +317,14 @@ module Rubik
                  "so the command is active for this session only and was not saved."
         end
 
-        if persist_res.is_a?(Hash) && !persist_res[:ok]
-          return "⚠️ Promoted '#{proposed_cmd}' for #{target} (#{lang}) — active in this session, " \
-                 "but saving to the project config failed: #{persist_res[:error]}"
-        end
-
         "✨ Successfully verified and promoted runtime service for #{target} (#{lang}): '#{proposed_cmd}'. " \
-          "Service is now active and hot-swapped in the live context with zero downtime."
+          "Service is now active in the live context."
       end
 
       private
 
-      def verify_binary(target, lang, proposed_cmd, sub_ctx)
-        case target
-        when "lsp"
-          client = Rubik::LSP::Client.new(lang, root_dir: @root_dir, server_cmd: proposed_cmd)
-          if client.available?
-            sub_ctx.provide("lsp_probe:#{lang}", client)
-            [true, nil]
-          else
-            [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-              cmd: proposed_cmd,
-              exit_code: 127,
-              stderr: "Pre-flight check failed: LSP binary '#{client.binary_name}' not available on system"
-            )]
-          end
-        when "test_runner"
-          if Rubik::Runtime::Discovery.binary_available?(proposed_cmd)
-            sub_ctx.provide("runner_probe:#{lang}", proposed_cmd)
-            [true, nil]
-          else
-            [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-              cmd: proposed_cmd,
-              exit_code: 127,
-              stderr: "Pre-flight check failed: Test runner executable not found in PATH"
-            )]
-          end
-        when "linter"
-          if Rubik::Runtime::Discovery.binary_available?(proposed_cmd)
-            sub_ctx.provide("linter_probe:#{lang}", proposed_cmd)
-            [true, nil]
-          else
-            [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-              cmd: proposed_cmd,
-              exit_code: 127,
-              stderr: "Pre-flight check failed: Linter/formatter executable not found in PATH"
-            )]
-          end
-        when "command"
-          if Rubik::Runtime::Discovery.binary_available?(proposed_cmd)
-            sub_ctx.provide("command_probe:#{lang}", proposed_cmd)
-            [true, nil]
-          else
-            [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-              cmd: proposed_cmd,
-              exit_code: 127,
-              stderr: "Pre-flight check failed: Command executable not found in PATH"
-            )]
-          end
-        else
-          [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-            cmd: proposed_cmd,
-            exit_code: 1,
-            stderr: "Unknown target component type: #{target}"
-          )]
-        end
+      def verify_binary(target, lang, proposed_cmd, sub_ctx, probe_args: nil)
+        Rubik::Runtime::RepairProbe.new(root_dir: @root_dir).verify(target, lang, proposed_cmd, sub_ctx, probe_args: probe_args)
       end
     end
 

data/lib/rubik/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rubik
-  VERSION = "0.1.6"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubik
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.2.0
 platform: ruby
 authors:
 - Özgür Ulukır
@@ -244,6 +244,7 @@ files:
 - lib/rubik/ast/body_loader.rb
 - lib/rubik/ast/c_extractor.rb
 - lib/rubik/ast/cache_store.rb
+- lib/rubik/ast/extraction_result.rb
 - lib/rubik/ast/extractor.rb
 - lib/rubik/ast/fallback_cleaner.rb
 - lib/rubik/ast/go_extractor.rb
@@ -266,6 +267,7 @@ files:
 - lib/rubik/benchmark/runner.rb
 - lib/rubik/benchmark/synth_repo.rb
 - lib/rubik/buffer.rb
+- lib/rubik/buffer/apply_contract.rb
 - lib/rubik/buffer/diff.rb
 - lib/rubik/buffer/manager.rb
 - lib/rubik/buffer/path_validator.rb
@@ -403,6 +405,8 @@ files:
 - lib/rubik/plugin.rb
 - lib/rubik/plugin/dsl.rb
 - lib/rubik/plugin/manager.rb
+- lib/rubik/plugin/package_inventory.rb
+- lib/rubik/plugin/requires_dag.rb
 - lib/rubik/plugin/storage.rb
 - lib/rubik/prompt.rb
 - lib/rubik/prompt/context_builder.rb
@@ -476,6 +480,7 @@ files:
 - lib/rubik/runtime/loop_service.rb
 - lib/rubik/runtime/manager.rb
 - lib/rubik/runtime/overlay_storage.rb
+- lib/rubik/runtime/repair_probe.rb
 - lib/rubik/runtime/service_definition.rb
 - lib/rubik/runtime/service_registration.rb
 - lib/rubik/runtime/task_manager.rb