@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.12 → 0.1.28

package/packages/repo-controls/assets/reconcile-guard.sh

@@ -1,18 +1,17 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Stage 2 of the CI pipeline for pull requests into `integration` (stage 1
-# bumps the PR branch, stage 3 runs the tests). It forces the PR author,
-# usually an agent, to reconcile with integration before anything merges:
+# Stage 1 of the CI pipeline for pull requests into `integration` (stage 2
+# runs the tests). It forces the PR author, usually an agent, to reconcile with
+# integration before anything merges:
 #
-#   Check A  the PR branch contains integration's tip
-#   Check B  the PR branch's manifest version is integration's + 1 patch
+#   the PR source branch contains integration's tip
+#
+# That is the only check. The version bump is not a PR concern any more: the
+# integration-merge pipeline bumps after the merge (Tarun, 2026-10-01).
 #
 # Read-only: this script only fetches and reads. It never pushes, and the only
 # refs it writes are the two remote-tracking refs it fetches.
-#
-# Run from the package directory (like version-bump.sh); the manifest is
-# resolved repo-relative through `git rev-parse --show-prefix`.
 
 # CI never carries an agent identity. Never set one here, and never inherit
 # one from the caller.
@@ -23,17 +22,11 @@ die() {
   exit 1
 }
 
-version_file=''
 pr_source=''
 base=''
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --file)
-      [[ $# -ge 2 ]] || die '--file requires a path'
-      version_file="$2"
-      shift 2
-      ;;
     --pr-source)
       [[ $# -ge 2 ]] || die '--pr-source requires a branch'
       pr_source="$2"
@@ -50,8 +43,6 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-[[ -n "$version_file" ]] || die '--file is required'
-[[ "$version_file" == 'package.json' ]] || die 'only --file package.json is supported'
 [[ -n "$pr_source" ]] || die '--pr-source is required'
 [[ -n "$base" ]] || die '--base is required'
 
@@ -66,8 +57,7 @@ case "$branch" in
     ;;
 esac
 
-prefix="$(git rev-parse --show-prefix)" || die 'not inside a git work tree'
-manifest_path="${prefix}${version_file}"
+git rev-parse --show-prefix > /dev/null || die 'not inside a git work tree'
 
 base_ref="refs/remotes/origin/$base"
 branch_ref="refs/remotes/origin/$branch"
@@ -79,35 +69,9 @@ base_short="$(git rev-parse --short "$base_ref")" || die "cannot resolve $base_r
 
 if ! git merge-base --is-ancestor "$base_ref" "$branch_ref"; then
   missing="$(git rev-list --count "$branch_ref..$base_ref")"
-  echo "reconcile-guard: FAIL — $branch does not contain integration's tip ($base_short). Reconcile: git pull origin integration && git push" >&2
+  echo "reconcile-guard: FAIL — $branch does not contain integration's tip ($base_short) — reconcile: git pull origin integration, then push" >&2
   echo "reconcile-guard: $missing integration commit(s) missing from $branch" >&2
   exit 1
 fi
 
-read_version() {
-  local ref="$1" text
-  text="$(git show "$ref:$manifest_path")" || die "cannot read $manifest_path at $ref"
-  printf '%s' "$text" | node -e '
-    const version = JSON.parse(require("node:fs").readFileSync(0, "utf8")).version
-    if (typeof version !== "string") process.exit(1)
-    process.stdout.write(version)
-  ' || die "cannot read a string version from $manifest_path at $ref"
-}
-
-parse_version() {
-  [[ "$1" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]] || die "cannot parse '$1' as a release version x.y.z"
-}
-
-base_version="$(read_version "$base_ref")"
-branch_version="$(read_version "$branch_ref")"
-
-parse_version "$base_version"
-target="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.$((BASH_REMATCH[3] + 1))"
-parse_version "$branch_version"
-
-if [[ "$branch_version" != "$target" ]]; then
-  echo "reconcile-guard: FAIL — $branch version $branch_version is not integration $base_version + 1 patch ($target). Stage 1 bumps it; re-run the PR build after reconciling." >&2
-  exit 1
-fi
-
-echo "reconcile-guard: PASS — $branch contains integration $base_short and is at $target"
+echo "reconcile-guard: PASS — $branch contains integration $base_short"

package/packages/repo-controls/assets/version-bump.sh

@@ -1,22 +1,22 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# STAGE 1 of the PR pipeline (PR -> integration): the PR build owns package
-# version allocation. Every PR into `integration` must carry exactly
-# `<integration version> + patch 1`; this script makes it so, on the PR's
-# SOURCE branch, before anything else validates it:
+# STAGE 1 of the promote pipeline (push to `integration`): the integration-merge
+# build owns package version allocation (Tarun, 2026-10-01 -- a PR's
+# build-validation policy ignores `[skip ci]`, so a bump pushed from PR CI
+# re-queued itself; a push to a branch honours it). After a merge lands on
+# `integration` this sets the manifest to that commit's version + patch 1:
 #
-#   version-bump.sh --file package.json --pr-source <feature branch> \
-#     --base integration --push
+#   version-bump.sh --file package.json --integration --push
 #
-# The Azure Pipelines PR build checks out the detached refs/pull/N/merge
-# commit with persisted credentials, so `git push` authenticates as the
-# project build service. The bump commit is created on the source branch's own
-# tip (never on the merge commit), carries no ***NO_CI*** (feature branches
-# have no CI trigger, so the push re-queues the PR build, which then
-# validates the bumped commit), and is pushed with a plain push — never
-# forced. When the source is already at the target version nothing is
-# committed and the run continues. No npm query, no second PR.
+# The Azure Pipelines build checks out the detached commit that triggered the
+# run with persisted credentials, so `git push` authenticates as the project
+# build service (which needs Contribute + "Bypass policies when pushing" on
+# `integration`). The bump commit is created on that checkout, carries
+# `[skip ci]` so the push does not trigger this pipeline again, and is pushed
+# with a plain fast-forward -- never forced. If integration moved since the
+# checkout the push is rejected and the script fails loud; the newer merge's
+# own run bumps. No npm query, no PR.
 
 # CI never carries an agent identity: the push below authenticates as the
 # project build service through the checkout's persisted System.AccessToken.
@@ -29,8 +29,7 @@ die() {
 }
 
 version_file=''
-pr_source=''
-base_branch=''
+integration_mode=false
 push_bump=false
 
 while [[ $# -gt 0 ]]; do
@@ -40,15 +39,9 @@ while [[ $# -gt 0 ]]; do
       version_file="$2"
       shift 2
       ;;
-    --pr-source)
-      [[ $# -ge 2 ]] || die '--pr-source requires a branch ref'
-      pr_source="$2"
-      shift 2
-      ;;
-    --base)
-      [[ $# -ge 2 ]] || die '--base requires a branch name'
-      base_branch="$2"
-      shift 2
+    --integration)
+      integration_mode=true
+      shift
       ;;
     --push)
       push_bump=true
@@ -60,52 +53,14 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+[[ -n "$version_file" ]] || die '--file is required'
 [[ "$version_file" == 'package.json' ]] || die 'only --file package.json is supported'
-[[ -n "$pr_source" ]] || die '--pr-source is required'
-[[ -n "$base_branch" ]] || die '--base is required'
+[[ "$integration_mode" == true ]] || die '--integration is required'
 [[ "$push_bump" == true ]] || die '--push is required'
 
-# Accept `refs/heads/x` (Build.SourceBranch / System.PullRequest.SourceBranch)
-# or a bare `x`; anything else under refs/ is not a branch.
-source_branch="${pr_source#refs/heads/}"
-case "$source_branch" in
-  '') die '--pr-source names an empty branch' ;;
-  refs/*) die "--pr-source '$pr_source' is not a branch ref (expected 'refs/heads/<name>' or '<name>')" ;;
-esac
-base_branch="${base_branch#refs/heads/}"
-if [[ "$source_branch" == "$base_branch" || "$source_branch" == 'main' || "$source_branch" == 'integration' ]]; then
-  die "refusing to bump '$source_branch': the PR source must be a feature branch, not the base ('$base_branch'), main or integration"
-fi
-
 git diff --quiet || die 'working tree is not clean before version bump'
 git diff --cached --quiet || die 'index is not clean before version bump'
 repo_root="$(git rev-parse --show-toplevel)" || die 'cannot resolve the repository root'
-# The script runs from the package directory (e.g. apps/cli); the manifest's
-# repository-relative path is how it is read from the base branch.
-repo_prefix="$(git rev-parse --show-prefix)" || die 'cannot resolve the working directory inside the repository'
-repo_relative_file="${repo_prefix}${version_file}"
-
-# Read both tips fresh from origin. The PR build's checkout is the detached
-# merge commit; bumping that would push a commit that is not the branch's own
-# history, so the working tree is moved onto a REAL branch at the source tip.
-git fetch origin \
-  "refs/heads/$base_branch:refs/remotes/origin/$base_branch" \
-  "refs/heads/$source_branch:refs/remotes/origin/$source_branch" || \
-  die "cannot fetch '$base_branch' and '$source_branch' from origin"
-
-# The source must already contain the base's tip: the version it is bumped to
-# is derived from that tip, so a source behind it would be validated against a
-# merge the bump never saw.
-if ! git merge-base --is-ancestor "refs/remotes/origin/$base_branch" "refs/remotes/origin/$source_branch"; then
-  missing_count="$(git rev-list --count "refs/remotes/origin/$source_branch..refs/remotes/origin/$base_branch")"
-  base_short="$(git rev-parse --short "refs/remotes/origin/$base_branch")"
-  echo "version-bump: FAIL — $source_branch does not contain $base_branch's tip ($base_short); reconcile first: git pull origin $base_branch && git push" >&2
-  echo "version-bump: $missing_count commit(s) on $base_branch are missing from $source_branch" >&2
-  exit 1
-fi
-
-git checkout -q -B "$source_branch" "refs/remotes/origin/$source_branch" || \
-  die "cannot check out '$source_branch' at its origin tip"
 
 [[ -f "$version_file" ]] || die "manifest not found: $version_file"
 
@@ -113,20 +68,11 @@ read_version() {
   node -e 'const version = JSON.parse(require("node:fs").readFileSync(0, "utf8")).version; if (typeof version !== "string") process.exit(1); process.stdout.write(version)'
 }
 
-base_version="$(git show "refs/remotes/origin/$base_branch:$repo_relative_file" | read_version)" || \
-  die "cannot read a string version from $repo_relative_file on origin/$base_branch"
-if [[ ! "$base_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
-  die "cannot parse '$base_version' (origin/$base_branch) as a release version x.y.z"
-fi
-next_version="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.$((BASH_REMATCH[3] + 1))"
-
 current_version="$(read_version < "$version_file")" || die "cannot read a string version from $version_file"
-
-if [[ "$current_version" == "$next_version" ]]; then
-  echo "version-bump: $source_branch already at $next_version (integration $base_version); nothing to bump"
-  echo '##vso[task.setvariable variable=bumped;isOutput=true]false'
-  exit 0
+if [[ ! "$current_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+  die "cannot parse '$current_version' ($version_file) as a release version x.y.z"
 fi
+next_version="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.$((BASH_REMATCH[3] + 1))"
 
 node -e '
   const fs = require("node:fs")
@@ -142,7 +88,7 @@ node -e '
 # package.json can reach. No file, or no `pre_bump` key: no scripts, and
 # everything below this comment is a no-op, so the resulting commit is
 # byte-identical to the behaviour before this feature existed (see
-# packages/repo-controls/tests/version-bump-pr-source-pre-bump.test.ts).
+# packages/repo-controls/tests/version-bump-integration-pre-bump.test.ts).
 config_path="$repo_root/adl-config.toml"
 pre_bump_list=''
 if [[ -f "$config_path" ]]; then
@@ -226,9 +172,10 @@ fi
 
 git -C "$repo_root" add -A
 git diff --cached --quiet && die "version bump produced no staged change (expected at least $version_file)"
-# No ***NO_CI***: a feature branch has no CI trigger, so this push is what
-# re-queues the PR build against the bumped commit.
-git commit -m "chore: bump version $current_version to $next_version"
-git push origin "HEAD:refs/heads/$source_branch"
-echo "version-bump: bumped $source_branch from $current_version to $next_version (integration $base_version); pushed — this run ends, the re-queued PR build validates the bumped commit"
-echo '##vso[task.setvariable variable=bumped;isOutput=true]true'
+# `[skip ci]` (Azure DevOps: a push whose commits contain it does not trigger CI
+# pipelines) keeps this push from re-running the promote pipeline that made it.
+git commit -m "chore: bump version $current_version to $next_version [skip ci]"
+if ! git push origin "HEAD:refs/heads/integration"; then
+  die "push to integration rejected: integration moved since checkout, so this bump is stale; the next merge's run bumps"
+fi
+echo "version-bump: bumped integration from $current_version to $next_version; pushed"

package/packages/repo-controls/bunfig.toml

@@ -12,13 +12,12 @@
 # never-unit-tested Azure push code into the report at once, and 100% became
 # unreachable in a single commit.
 #
-# The package's OWN ratchet replaces it -- `coverageRegressions`, the same one
-# consumers are graded by. This repository is now one of its consumers:
-# `[controls.coverage].produce` builds coverage/coverage-summary.json from the
-# lcov below, `pre_push.coverage_ratchet` grades it against the committed copy,
-# and today's untested LINES may shrink but never grow. Counts rather than
-# percentages, for the reason settled for consumer coverage the same day -- a
-# percentage is derived, so it moves whenever a file's size moves.
+# `coverageRegressions` is the shared ratchet primitive used by every controlled
+# repository. This repository's root producer measures all workspace packages,
+# writes coverage/coverage-summary.json, and pre-push grades it against the
+# committed copy. Today's untested lines may shrink but never grow. Counts rather
+# than percentages: a percentage is derived, so it moves whenever a file changes
+# size.
 #
 # Nothing bespoke lives here. An earlier pass wrote a second ratchet and a second
 # record file for this repo alone; that was the package failing to eat its own

package/packages/repo-controls/package/adl-compliance/AGENTS.md

@@ -150,13 +150,12 @@ it. `tests/core/` is the one exception, for the spine (`Check`, `scope`,
 
 ## Status
 
-93 of the registry's 104 rows are ported — counted by importing
+Every row of the registry is implemented — 28 of 28, counted by importing
 `adl_compliance.checks` and measuring `len(CHECKS)` (`checks/__init__.py`'s
-explicit registry tuple), not by re-reading this paragraph.
-
-The remaining 11 are still shell in `compliance_new/`, which is frozen. A row
-with no Python implementation exits 2 with `no check implements <id>` — never
-a silent pass.
+explicit registry tuple), not by re-reading this paragraph. The shell
+`compliance_new/` tree this package ported from is gone, not frozen: a row
+with no Python implementation exits 2 with `no check implements <id>` —
+never a silent pass, and today no row reaches that.
 
 [`docs/operations/adl-compliance-invariants.md`](../../../../docs/operations/adl-compliance-invariants.md)
 records what is not true yet, including two rows that do not

package/packages/repo-controls/package/adl-compliance/conftest.py

@@ -66,7 +66,9 @@ def the_corpora_declare_their_shape(
         # empty packaged map. Seeding it here would make them vacuous.
         return
 
-    seeded = lambda: config.TreeMap(version=1, trees=fixture_trees())
+    def seeded() -> config.TreeMap:
+        return config.TreeMap(version=1, trees=fixture_trees())
+
     monkeypatch.setattr(config, "load", seeded)
     monkeypatch.setattr(registry, "load_tree_map", seeded)
 

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/__init__.py

@@ -13,14 +13,11 @@ scan would blur the difference.
 from __future__ import annotations
 
 from ..core.check import Check
-from .coverage.backend_crate import BackendCrate
-from .coverage.backend_ratchet import BackendRatchet
-from .coverage.baseline import CoverageBaseline
-from .coverage.config_committed import CoverageConfigCommitted
-from .coverage.full import CoverageFull
 from .docs.adr_lifecycle import AdrLifecycle
 from .docs.closed_set import DocsClosedSet
+from .docs.directory_size import DocsDirectorySize
 from .docs.english_only import DocsEnglishOnly
+from .docs.filename import DocsFilename
 from .docs.index_updated import IndexUpdated
 from .docs.indexes import Indexes
 from .docs.ledger import DocsLedger
@@ -34,15 +31,12 @@ from .layout.markdown_trees import MarkdownTrees
 from .layout.open_work_cap import OpenWorkCap
 from .layout.placement import Placement
 from .layout.plans_layout import PlansLayout
-from .layout.profile_data import ProfileData
 from .layout.references import References
 from .layout.root_closed_set import RootClosedSet
 from .layout.root_markdown_allowlist import RootMarkdownAllowlist
 from .layout.scripts_size_depth import ScriptsSizeDepth
 from .lfs.integrity import Integrity
 from .pipeline.phase_disjoint import PhaseDisjoint
-from .release.changeset_plan import ChangesetPlan
-from .release.version_release import VersionRelease
 from .repository.banned_commands import BannedCommands
 from .repository.ignored_paths import IgnoredPaths
 from .repository.license_declared import LicenseDeclared
@@ -51,17 +45,13 @@ from .repository.lockfile_integrity import LockfileIntegrity
 CHECKS: tuple[type[Check], ...] = (
     AdrLifecycle,
     AgentsLayout,
-    BackendCrate,
-    BackendRatchet,
     BannedCommands,
-    ChangesetPlan,
     CiPaths,
-    CoverageBaseline,
-    CoverageConfigCommitted,
-    CoverageFull,
     DirectoryRatchet,
     DocsClosedSet,
+    DocsDirectorySize,
     DocsEnglishOnly,
+    DocsFilename,
     DocsLedger,
     DocsSemantics,
     IgnoredPaths,
@@ -77,12 +67,10 @@ CHECKS: tuple[type[Check], ...] = (
     PhaseDisjoint,
     Placement,
     PlansLayout,
-    ProfileData,
     References,
     RootClosedSet,
     RootMarkdownAllowlist,
     ScriptsSizeDepth,
-    VersionRelease,
 )
 
 _BY_ID: dict[str, type[Check]] = {check.id: check for check in CHECKS}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/docs/adr_lifecycle/test_check.py

@@ -111,8 +111,15 @@ def test_a_redeclared_docs_tree_is_still_graded(tmp_path) -> None:
 def test_an_absent_decisions_directory_is_a_finding_not_a_pass() -> None:
     """An absent directory yields an empty set, and an empty set is a clean pass
     everywhere else in this estate. Without this structural probe the tree
-    losing docs/decisions/ entirely would pass in silence."""
-    verdict = verdict_for("DOC-001", corpus("coverage", "baseline") / "passing", given=())
+    losing docs/decisions/ entirely would pass in silence.
+
+    The root is `repository/lockfile-integrity`'s `clean` corpus, which holds no
+    `docs/` at all (a backend/frontend lockfile pair). It was the retired
+    `coverage/baseline` `passing` corpus until the `coverage` domain was deleted
+    2026-10-01."""
+    verdict = verdict_for(
+        "DOC-001", corpus("repository", "lockfile-integrity") / "clean", given=()
+    )
     assert verdict.outcome is Outcome.FINDINGS, verdict.render()
     assert "decisions directory is missing" in verdict.render()
 

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/docs/closed_set/fixtures/docs/notes.md

@@ -0,0 +1 @@
+# notes

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/docs/closed_set/test_check.py

@@ -92,6 +92,17 @@ def test_declared_dirs_and_files_stay_silent() -> None:
         assert f"docs/{entry}: undeclared" not in text
 
 
+def test_the_task_ledger_is_declared() -> None:
+    """`docs/notes.md` is the repository's task ledger (global agent rule: one
+    line at the start and one at the finish of every task), so it is a
+    declared top-level file. The stray file next to it is still reported, which
+    proves the ledger is allowed by name and not because the gate went quiet."""
+    assert "docs/notes.md" in corpus_files(CORPUS)
+    messages = tuple(f.render() for f in findings_for(corpus_files(CORPUS)))
+    assert not any("docs/notes.md" in m for m in messages), messages
+    assert any("docs/stray-root-file.md" in m for m in messages), messages
+
+
 def test_an_empty_set_grades_nothing() -> None:
     """Every undeclared entry is still on disk. A check that grades only what
     it is handed must report none of them against an empty given set."""

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/docs/directory_size/__init__.py

@@ -0,0 +1,7 @@
+"""DOC-012 — `docs.directory-size`."""
+
+from __future__ import annotations
+
+from .check import DocsDirectorySize
+
+__all__ = ["DocsDirectorySize"]