@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.10 → 0.1.26

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/ignored_paths/check.py

@@ -15,9 +15,10 @@ actually RUNNING `test.sh` (with a `compliance` symlink pointed at
 internally) confirms it cannot execute even once: `env: init: No such file or
 directory`, from `fixture_() { env ... "$@"; }` being called as `fixture_
 init -q`, i.e. `env -C "$FIXTURE" init -q` -- the missing word is the command
-name itself. This is a harder case than `checks/coverage/config_committed`'s:
-that gate's shell tool could still run and its broken behaviour was directly
-observed and ported; here nothing runs even once, so there is no executed
+name itself. This is a harder case than `checks/coverage/config_committed`'s
+(deleted 2026-10-01 with the `coverage` domain): that gate's shell tool could
+still run and its broken behaviour was directly observed and ported; here
+nothing runs even once, so there is no executed
 behaviour to carry forward, only the intent the surrounding text still states
 unambiguously.
 

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/ignored_paths/test_check.py

@@ -11,8 +11,8 @@ for why the fixture is named `.gitignore` (not `.ignore`, which is what
 REP-005 is not yet listed in `checks/__init__.py` (a later step wires this
 whole wave in one shot), so dispatch-by-id would report `COULD_NOT_RUN` for
 every case regardless of this check's own behaviour -- the same reason
-`coverage/config_committed` and `layout/plans_layout`'s own test suites give
-for the identical choice.
+`coverage/config_committed` (deleted 2026-10-01 with the `coverage` domain) and
+`layout/plans_layout`'s own test suites give for the identical choice.
 
 Every scenario below hands `.gitignore` itself in the given set alongside the
 candidate paths, because this check reads `.gitignore` content from the GIVEN

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/cargo_lock.py

@@ -0,0 +1,490 @@
+"""What a `Cargo.lock` must contain for the manifests beside it, judged without cargo.
+
+REP-002's `LCK-002` used to be cargo's exit code alone: `cargo metadata --locked
+--offline --no-deps`. With `--no-deps` cargo never resolves, so it never reads the
+lockfile, and a lock that was `version = 4` alone, was not TOML, or said
+`version = 99` passed (measured through the real check, 2026-10-01). This module
+is the content half: deterministic Python (`tomllib`) that reads only the lock,
+the workspace manifest, the member manifests and the path-dependency manifests the
+manifest text names. It spawns nothing and never touches the registry cache or the
+network, so a verdict cannot differ between a machine that has the crate sources
+cached and one that does not. (Dropping `--no-deps` would make it differ: cargo
+then loads every dependency's manifest, which fails offline when the sources are
+not cached.)
+
+What is judged, each finding naming the lock path and the exact thing missing:
+
+  * the lock is UTF-8 and TOML;
+  * its top-level `version` is 3 or 4, or absent (the legacy V1/V2 encodings).
+    cargo 0.99.0, `src/cargo/core/resolver/encode.rs`, `EncodableResolve::into_resolve`:
+    `Some(4)` and `Some(3)` are read, `Some(5)` only on nightly with
+    `-Znext-lockfile-bump`, any other number bails ("lock file version `n` was found,
+    but this version of Cargo does not understand this lock file"), and no `version`
+    key means V1, "so this could either be the V1 or V2 encoding". An explicit
+    `version = 1` or `2` is therefore NOT supported, whatever the encodings' names;
+  * `[[package]]` is a non-empty array of tables, each with a string `name` and
+    `version`;
+  * the lock is closed over itself: every `name`, `name version` or `name version
+    (source)` a package lists in `dependencies` is a package the lock holds (name, and
+    version when the entry gives one). A package dropped from the lock while its
+    dependents still list it is a lock cargo refuses to parse, and no manifest shows it
+    when the package is not a direct dependency. This is judged from the lock alone,
+    before any manifest is read, as are the first three points;
+  * every workspace member appears in the lock as a path package (no `source`) with
+    its name AND version. Members are the root `[package]`, every `[workspace].members`
+    entry (expanded as cargo expands it: the `glob` crate's patterns, hidden
+    directories included) minus `[workspace].exclude`, and every path dependency that
+    lives inside the workspace root (cargo: "All path dependencies residing in the
+    workspace directory automatically become members") unless excluded or a workspace
+    root of its own;
+  * every direct dependency of every member appears under its REAL package name, and in
+    the member's OWN lock entry's `dependencies` (a name the lock holds for some other
+    package does not satisfy it: `tokio` is in nearly every lock already, and a manifest
+    that gained it would otherwise pass while `cargo build --locked` refuses the lock):
+    `[dependencies]`, `[dev-dependencies]`, `[build-dependencies]` (and the underscore
+    spellings cargo accepts) and each `[target.<cfg>.<those>]`, optional ones included
+    because cargo locks every feature. A package that dev-depends on itself (to enable
+    features) is not asked to list itself. `package = "x"` is the real name when present,
+    else the key; `workspace = true` reads the `[workspace.dependencies]` entry (whose
+    `path` is relative to the workspace root); a path dependency's real name is the
+    `[package].name` of the manifest it points at, and it must be a path package.
+
+What cannot be judged from the manifest text raises `Undecidable` naming it, and the
+gate turns that into could-not-run. It is never skipped: a manifest this module
+cannot parse, a root with neither `[package]` nor `[workspace]`, a `members` entry
+matching no directory or a directory with no `Cargo.toml`, a member with no
+`[package].name`, an `exclude` entry using glob syntax (cargo's treatment of it is not
+verified, and a wrong guess invents a finding or hides a member), a dependency
+specification that is neither a string nor a table, `workspace = true` with no
+`[workspace.dependencies]` entry, and a path dependency whose manifest cannot be read.
+
+**The limits, stated plainly.**
+
+  * Version-REQUIREMENT drift is not detected: a manifest that raises
+    `serde = "1.0.200"` past a locked `1.0.150` still passes here. That is
+    `cargo metadata` without `--no-deps`, which needs the registry, and it stays the
+    authority for it. This module covers presence, structure and membership.
+  * A path dependency that is NOT a workspace member (any path dependency of a manifest
+    with no `[workspace]`, or one outside the workspace root) is judged by its own
+    presence in the lock only; its own dependencies are not read, so a dependency added
+    to such a crate (enact-combined's `plugins/enact-keychain` is one) is not detected.
+    Reading them would need that crate's own workspace for its `workspace = true`
+    entries and cargo's feature rules for its optional ones (an optional dependency of a
+    non-member is locked only when a feature activates it), and a wrong guess is a false
+    positive on a good lock.
+"""
+
+from __future__ import annotations
+
+import glob
+import os
+import tomllib
+from collections.abc import Callable
+from pathlib import Path
+from typing import ClassVar, NamedTuple
+
+Table = dict[str, object]
+
+
+class Undecidable(Exception):
+    """The lock cannot be judged from the manifests' text. Could-not-run, never a pass."""
+
+
+class Package(NamedTuple):
+    """One `[[package]]` of the lock."""
+
+    name: str
+    version: str
+    path: bool
+    """No `source`: a path package (a workspace member or a path dependency)."""
+    needs: tuple[str, ...]
+    """Its `dependencies = [...]`, verbatim: `name`, `name version` or `name version (source)`."""
+
+
+class Dependency(NamedTuple):
+    """A direct dependency, resolved to the package the lock must list."""
+
+    key: str
+    """The name it is declared under (differs from `name` when renamed)."""
+    name: str
+    """The REAL package name."""
+    section: str
+    """`[dependencies]`, `[target.'cfg(unix)'.dev-dependencies]`, ... as written."""
+    target: Path | None
+    """The manifest a path dependency points at; `None` for a registry or git one."""
+
+
+class Member(NamedTuple):
+    manifest: Path
+    name: str
+    version: str
+    dependencies: tuple[Dependency, ...]
+
+
+class CargoLock:
+    """One lockfile against the manifest of the workspace it belongs to."""
+
+    VERSIONS: ClassVar[tuple[int, ...]] = (3, 4)
+    SECTIONS: ClassVar[tuple[str, ...]] = (
+        "dependencies",
+        "dev-dependencies",
+        "dev_dependencies",
+        "build-dependencies",
+        "build_dependencies",
+    )
+    GLOB_SYNTAX: ClassVar[str] = "*?["
+
+    def __init__(self, lock: Path, manifest: Path, relative: Callable[[Path], str]) -> None:
+        self.lock = lock
+        self.manifest = manifest
+        self.shown = relative(lock)
+        self.relative = relative
+        self.root = manifest.parent
+        self.root_document: Table = {}
+
+    # ------------------------------------------------------------------ the verdict
+
+    def problems(self) -> list[str]:
+        """Every way the lock fails its manifests, in a stable order; empty when it holds."""
+        try:
+            text = self.lock.read_text(encoding="utf-8")
+        except UnicodeDecodeError:
+            return [f"{self.shown} is not valid UTF-8 text"]
+        try:
+            document: Table = tomllib.loads(text)
+        except tomllib.TOMLDecodeError as exc:
+            return [f"{self.shown} is not valid TOML: {exc}"]
+
+        packages, found = self._packages(document)
+        found = [*self._version(document), *found]
+        if found:
+            # The structure is wrong, so there is nothing sound to compare the manifests with.
+            return found
+        # What the lock says about itself is conclusive without any manifest.
+        return self._closure(packages) or self._membership(packages)
+
+    # ------------------------------------------------------------------ the lock itself
+
+    def _version(self, document: Table) -> list[str]:
+        if "version" not in document:
+            return []  # the legacy V1/V2 encodings carry no version key; cargo reads them
+        value = document["version"]
+        if isinstance(value, bool) or not isinstance(value, int) or value not in self.VERSIONS:
+            return [
+                f"{self.shown} version {value!r} is not supported "
+                "(cargo reads lock versions 3 and 4)"
+            ]
+        return []
+
+    def _packages(self, document: Table) -> tuple[list[Package], list[str]]:
+        raw = document.get("package")
+        if raw is None or raw == []:
+            return [], [f"{self.shown} lists no packages ([[package]] is absent or empty)"]
+        if not isinstance(raw, list):
+            return [], [
+                f"{self.shown} has a `package` key that is not an array of [[package]] tables"
+            ]
+        packages: list[Package] = []
+        found: list[str] = []
+        for number, entry in enumerate(raw, start=1):
+            where = f"{self.shown} has a [[package]] entry (number {number})"
+            if not isinstance(entry, dict):
+                found.append(f"{where} that is not a table")
+                continue
+            name, version = entry.get("name"), entry.get("version")
+            needs = entry.get("dependencies", [])
+            if not isinstance(name, str):
+                found.append(f"{where} without a string name")
+            elif not isinstance(version, str):
+                found.append(f"{where} without a string version")
+            elif not isinstance(needs, list) or not all(isinstance(n, str) for n in needs):
+                found.append(f"{where} whose `dependencies` is not a list of strings")
+            else:
+                packages.append(Package(name, version, "source" not in entry, tuple(needs)))
+        return packages, found
+
+    def _closure(self, packages: list[Package]) -> list[str]:
+        """A package some other package lists as a dependency must itself be in the lock.
+
+        Internal to the lock, so it needs no manifest. A lock with a package removed (a
+        merge that dropped a block, a hand edit) is one cargo refuses to parse, and the
+        manifests never show it when the missing package is not a direct dependency.
+        """
+        held = {(p.name, p.version) for p in packages}
+        names = {p.name for p in packages}
+        found: list[str] = []
+        listed: set[str] = set()
+        for package in packages:
+            for need in package.needs:
+                name, _, rest = need.partition(" ")
+                version = rest.partition(" ")[0]
+                if need in listed or ((name, version) in held if version else name in names):
+                    continue
+                listed.add(need)
+                found.append(
+                    f"{self.shown} lists dependency '{need}' of package "
+                    f"'{package.name}' {package.version} but has no such package"
+                )
+        return found
+
+    # ------------------------------------------------------------- lock against manifests
+
+    def _membership(self, packages: list[Package]) -> list[str]:
+        members = self._members()
+        found: list[str] = []
+        missing_members: set[str] = set()
+        entries: dict[Path, Package] = {}  # a member's manifest -> the lock entry that is it
+
+        for member in members:
+            locked = [p for p in packages if p.name == member.name and p.path]
+            at = f"workspace member {self.relative(member.manifest)}"
+            if not locked:
+                missing_members.add(member.name)
+                found.append(f"{self.shown} lists no path package '{member.name}' ({at})")
+            elif all(p.version != member.version for p in locked):
+                versions = ", ".join(sorted({p.version for p in locked}))
+                found.append(
+                    f"{self.shown} lists '{member.name}' at version {versions} but {at} "
+                    f"declares {member.version}"
+                )
+            else:
+                entries[member.manifest] = next(p for p in locked if p.version == member.version)
+
+        # A package nothing in the lock holds is one finding however many members need it. One
+        # the lock holds, but that this member's own entry does not list, is a finding per member:
+        # `tokio` is in nearly every lock already, so presence anywhere would pass the commonest
+        # stale lock (a manifest that gained a dependency the lock has for someone else).
+        absent: set[tuple[str, bool]] = set()
+        unlisted: set[tuple[Path, str]] = set()
+        for member in members:
+            entry = entries.get(member.manifest)
+            listed = {need.partition(" ")[0] for need in entry.needs} if entry else None
+            for dependency in member.dependencies:
+                name, path = dependency.name, dependency.target is not None
+                if name == member.name or (path and name in missing_members):
+                    # A package may dev-depend on itself to enable features; a missing member
+                    # was already reported as the member it is.
+                    continue
+                if not any(p.name == name and (p.path or not path) for p in packages):
+                    if (name, path) not in absent:
+                        absent.add((name, path))
+                        found.append(
+                            f"{self.shown} lists no {'path ' if path else ''}package '{name}' "
+                            f"(dependency '{dependency.key}' in {dependency.section} of "
+                            f"{self.relative(member.manifest)})"
+                        )
+                elif (
+                    listed is not None
+                    and name not in listed
+                    and (member.manifest, name) not in unlisted
+                ):
+                    unlisted.add((member.manifest, name))
+                    found.append(
+                        f"{self.shown} package '{member.name}' {member.version} does not list "
+                        f"'{name}' as a dependency ({dependency.section} of "
+                        f"{self.relative(member.manifest)} declares dependency '{dependency.key}')"
+                    )
+        return found
+
+    # ------------------------------------------------------------------------- members
+
+    def _members(self) -> list[Member]:
+        """The workspace's members, root first, then declared, then implicit path members."""
+        self.root_document = self._load(self.manifest)
+        workspace = self.root_document.get("workspace")
+        if workspace is not None and not isinstance(workspace, dict):
+            raise Undecidable(
+                f"{self.relative(self.manifest)} has a [workspace] that is not a table"
+            )
+        if "package" not in self.root_document and workspace is None:
+            raise Undecidable(
+                f"{self.relative(self.manifest)} has neither a [package] nor a [workspace] table"
+            )
+
+        queue: list[Path] = []
+        if "package" in self.root_document:
+            queue.append(self.manifest)
+        if workspace is not None:
+            queue.extend(self._declared(workspace))
+
+        members: dict[Path, Member] = {}
+        while queue:
+            manifest = queue.pop(0)
+            if manifest in members:
+                continue
+            document = self.root_document if manifest == self.manifest else self._load(manifest)
+            member = self._member(manifest, document)
+            members[manifest] = member
+            if workspace is None:
+                continue
+            for dependency in member.dependencies:
+                if dependency.target is not None and self._implicit(dependency.target, workspace):
+                    queue.append(dependency.target)
+        return list(members.values())
+
+    def _declared(self, workspace: Table) -> list[Path]:
+        """`members` globs expanded on disk, minus `exclude`, as manifests."""
+        shown = self.relative(self.manifest)
+        members = self._strings(workspace, "members", shown)
+        for entry in self._strings(workspace, "exclude", shown):
+            if any(char in entry for char in self.GLOB_SYNTAX):
+                raise Undecidable(
+                    f"{shown} [workspace].exclude entry {entry!r} uses glob syntax, which this "
+                    "check does not interpret"
+                )
+        manifests: list[Path] = []
+        for entry in members:
+            matched = sorted(
+                glob.glob(entry, root_dir=self.root, recursive=True, include_hidden=True)
+            )
+            directories = [self._normal(self.root / m) for m in matched if (self.root / m).is_dir()]
+            if not directories:
+                raise Undecidable(
+                    f"{shown} [workspace].members entry {entry!r} matches no directory"
+                )
+            for directory in directories:
+                if self._excluded(directory, workspace):
+                    continue
+                manifest = directory / "Cargo.toml"
+                if not manifest.is_file():
+                    raise Undecidable(
+                        f"workspace member directory {self.relative(directory)} (members entry "
+                        f"{entry!r} of {shown}) has no Cargo.toml"
+                    )
+                manifests.append(manifest)
+        return manifests
+
+    def _implicit(self, manifest: Path, workspace: Table) -> bool:
+        """A path dependency inside the workspace root is a member, unless it opts out."""
+        directory = manifest.parent
+        if not directory.is_relative_to(self.root) or self._excluded(directory, workspace):
+            return False
+        return "workspace" not in self._load(manifest)
+
+    def _excluded(self, directory: Path, workspace: Table) -> bool:
+        exclude = self._strings(workspace, "exclude", self.relative(self.manifest))
+        return any(directory.is_relative_to(self._normal(self.root / entry)) for entry in exclude)
+
+    def _member(self, manifest: Path, document: Table) -> Member:
+        shown = self.relative(manifest)
+        package = document.get("package")
+        if not isinstance(package, dict):
+            raise Undecidable(f"{shown} is a workspace member but has no [package] table")
+        name = package.get("name")
+        if not isinstance(name, str):
+            raise Undecidable(f"{shown} [package].name is not a string")
+        return Member(
+            manifest,
+            name,
+            self._version_of(shown, package),
+            self._dependencies(manifest, document),
+        )
+
+    def _version_of(self, shown: str, package: Table) -> str:
+        raw = package.get("version", "0.0.0")  # cargo's default for a package with no version
+        if isinstance(raw, str):
+            return raw
+        if isinstance(raw, dict) and raw.get("workspace") is True:
+            workspace = self.root_document.get("workspace")
+            inherited = workspace.get("package") if isinstance(workspace, dict) else None
+            version = inherited.get("version") if isinstance(inherited, dict) else None
+            if isinstance(version, str):
+                return version
+            raise Undecidable(
+                f"{shown} [package].version is `version.workspace = true` but "
+                f"[workspace.package].version of {self.relative(self.manifest)} is not a string"
+            )
+        raise Undecidable(
+            f"{shown} [package].version is neither a string nor `version.workspace = true`"
+        )
+
+    # ---------------------------------------------------------------------- dependencies
+
+    def _dependencies(self, manifest: Path, document: Table) -> tuple[Dependency, ...]:
+        shown = self.relative(manifest)
+        sections: list[tuple[str, object]] = [
+            (f"[{key}]", document[key]) for key in self.SECTIONS if key in document
+        ]
+        target = document.get("target")
+        if target is not None:
+            if not isinstance(target, dict):
+                raise Undecidable(f"{shown} [target] is not a table")
+            for cfg, body in target.items():
+                if not isinstance(body, dict):
+                    raise Undecidable(f"{shown} [target.{cfg!r}] is not a table")
+                label = cfg if all(c.isalnum() or c in "_-" for c in cfg) else f"'{cfg}'"
+                sections.extend(
+                    (f"[target.{label}.{key}]", body[key]) for key in self.SECTIONS if key in body
+                )
+        found: list[Dependency] = []
+        for section, table in sections:
+            if not isinstance(table, dict):
+                raise Undecidable(f"{shown} {section} is not a table")
+            for key, spec in table.items():
+                found.append(self._dependency(manifest, section, key, spec))
+        return tuple(found)
+
+    def _dependency(self, manifest: Path, section: str, key: str, spec: object) -> Dependency:
+        where = f"dependency {key!r} in {section} of {self.relative(manifest)}"
+        base = manifest.parent
+        if isinstance(spec, dict) and "workspace" in spec:
+            if spec["workspace"] is not True:
+                given = str(spec["workspace"]).lower()
+                raise Undecidable(f"{where} has `workspace = {given}`, not `workspace = true`")
+            workspace = self.root_document.get("workspace")
+            entries = workspace.get("dependencies") if isinstance(workspace, dict) else None
+            if not isinstance(entries, dict) or key not in entries:
+                raise Undecidable(
+                    f"{where} is `workspace = true` but [workspace.dependencies] of "
+                    f"{self.relative(self.manifest)} has no entry {key!r}"
+                )
+            spec, base = entries[key], self.root  # a workspace path is relative to the root
+        if isinstance(spec, str):
+            return Dependency(key, key, section, None)
+        if not isinstance(spec, dict):
+            raise Undecidable(f"{where} is neither a version string nor a table")
+
+        package, path = spec.get("package"), spec.get("path")
+        if package is not None and not isinstance(package, str):
+            raise Undecidable(f"{where} has a `package` that is not a string")
+        if path is not None and not isinstance(path, str):
+            raise Undecidable(f"{where} has a `path` that is not a string")
+        if path is None:
+            return Dependency(key, package or key, section, None)
+        target = self._normal(base / path / "Cargo.toml")
+        name = package or self._name_at(target, where)
+        return Dependency(key, name, section, target)
+
+    def _name_at(self, manifest: Path, where: str) -> str:
+        """A path dependency's real name: the `[package].name` of the manifest it points at."""
+        if not manifest.is_file():
+            raise Undecidable(f"{where} points at {self.relative(manifest)}, which is not a file")
+        package = self._load(manifest).get("package")
+        name = package.get("name") if isinstance(package, dict) else None
+        if not isinstance(name, str):
+            raise Undecidable(
+                f"{where} points at {self.relative(manifest)}, which has no [package].name"
+            )
+        return name
+
+    # ------------------------------------------------------------------------- plumbing
+
+    def _load(self, manifest: Path) -> Table:
+        shown = self.relative(manifest)
+        try:
+            return tomllib.loads(manifest.read_text(encoding="utf-8"))
+        except tomllib.TOMLDecodeError as exc:
+            raise Undecidable(f"{shown} is not valid TOML for this check: {exc}") from exc
+        except (OSError, UnicodeDecodeError) as exc:
+            raise Undecidable(f"{shown} could not be read: {exc}") from exc
+
+    @staticmethod
+    def _strings(table: Table, key: str, shown: str) -> list[str]:
+        value = table.get(key, [])
+        if not isinstance(value, list) or not all(isinstance(item, str) for item in value):
+            raise Undecidable(f"{shown} [workspace].{key} is not a list of strings")
+        return value
+
+    @staticmethod
+    def _normal(path: Path) -> Path:
+        return Path(os.path.normpath(path))