@arjunkhera/atlas 0.4.45 → 0.4.47

package/shape/releases.json

@@ -52,6 +52,11 @@
       "check_version": 9,
       "sha256": "87896abfc09afd22724cfa645bbb5ef029d83887caf70f38b88d00b21cddef02",
       "workflow_sha256": "fcddebef030e6564f97e1a5fb81c8ad1b3084ebef9622167c6565698312dcdd7"
+    },
+    {
+      "check_version": 10,
+      "sha256": "8943d8ea9f1af9a16c677942053b6ec7f9f767080d52f626d0960d7f36499732",
+      "workflow_sha256": "fcddebef030e6564f97e1a5fb81c8ad1b3084ebef9622167c6565698312dcdd7"
     }
   ]
 }

package/skills/lead/SKILL.md

@@ -83,9 +83,12 @@ the turn ends. Do not wait for a second miss.
 
 ## 5. The area rule
 
-1. A repo's entry file can list areas. Then run Atlas flows only in a
-   listed area. Outside them, say that the area is not listed, and stop.
-2. Some areas hold outside text, such as email. A session must hold no
+1. A repo lists its areas in `atlas.yaml`, under `areas:`. Its entry
+   file can list them too. Then run Atlas flows only in a listed area.
+   Outside them, say that the area is not listed, and stop. A repo with
+   no `areas:` is one area.
+2. Some areas hold outside text, such as email. In `atlas.yaml` such an
+   area says `outside_text: true`. A session must hold no
    tool that reads that outside text until Atlas has its outside-text
    reader. If the session holds such a tool, stop and say so.
 3. Until then, work in such an area uses made-up test data only.
@@ -100,10 +103,9 @@ set. A test keeps the two lists equal.
 | `atlas install` | Once on a new Mac, when the owner asks for Atlas there |
 | `atlas upgrade` | When the owner asks to upgrade Atlas. Call the `atlas_upgrade` tool instead: the Bash sandbox blocks this command. Run the command by hand only where that tool is missing. In a cloud session, call the tool with `check: true` at the first reply, as section 7 says |
 | `atlas doctor` | When Atlas seems missing or broken in a session |
-| `atlas check` | Before you ask for a merge in a repo that has the shape check |
+| `atlas check` | Before you ask for a merge in a repo that has the shape check. `--json` prints the counts of listed parts, procedures and jobs |
 | `atlas status` | To learn whether a repo's check is current or behind. `atlas status --all --json <repo>` lists each Atlas copy in a repo, with have, want and state |
 | `atlas tooling` | When `atlas status` says behind; `pr` opens the pull request |
-| `atlas kind-drift` | When the repo record and `atlas.yaml` may disagree on the kind; this command retires in stage 2, the onboarding stage |
 | `atlas code-read` | To resolve the citations of a code digest |
 | `atlas ste` | Before each publish; `--share` before a page goes to anyone else |
 | `atlas tests` | `write` puts the test kit in an area. `check` runs before a merge. `kept` runs the kept tests of a path 1 area and writes their evidence. `proof`, `verdict`, `named`, `covers` and `rerun` read the results of a run. `changed`, `before` and `after` run the test checks of the gate: changed tests, new cases fail on old code, old cases pass on new code. `sweep` and `issues` run the daily sweep |
@@ -112,7 +114,7 @@ set. A test keeps the two lists equal.
 | `atlas jobs` | The `atlas-jobs` workflow calls `check`, then `file`, once a day. A session calls it only to see what the watcher would file: `check`, then `file --dry-run` |
 | `atlas upkeep` | `check` before you ask for a merge. It reads the docs index, dead doc links, the code each doc names and stale pages. In a pull request it also reads the tracker item, the changed designs, and STE on the changed lines. The daily upkeep run calls it on the main branch. `replay` before the doc-sources rule changes how it gates. `procedures` runs the procedure steps tagged `atlas-run`; CI runs it with `--base` on each pull request |
 | `atlas gate` | `apply` once per repo, by the owner on his Mac, after the repo's `required_checks` exist. `--dry-run` first. `--off` and `--on` are the break glass. On a plan with no rulesets it reports advisory mode. `ready` before each merge, `check` in the `atlas-gate` workflow, `replay` before a change to the owner-only list. `audit` in the daily upkeep run, and with `--commit` in the push job of a repo that has one |
-| `atlas approve` | Never from a session. Only the owner runs it, on his Mac, with his key's touch. When the gate says "owner" for a pull request, ask him once for the signed act: name each pull request, its class and its cause. Put the owner pull requests of one day in one ask, so one touch signs them. `act`, `verify` and `key-check` work the same way. Each morning with open audit issues, ask him for `audit`; record its printed words as one decision for `item_done`, then close each issue |
+| `atlas approve` | Never from a session. Only the owner runs it, on his Mac, with his key's touch. When the gate says "owner" for a pull request, ask him once for the signed act: name each pull request, its class and its cause. Put the owner pull requests of one day in one ask, so one touch signs them. `act`, `verify` and `key-check` work the same way. Each morning with open audit issues, ask him for `audit`, and `audit-code <pr>` per audit-code merge; record its words as one decision, then close each issue |
 | `atlas judge` | In the fresh-agent test only, as the `atlas:fresh-agent-test` skill says. `seal` after the pick, `brief` to read a sealed ask, `run` for each sealed task, `check` after the grade |
 
 A person merges every file that `atlas tooling` writes.

package/work/lib/delivery.mjs

@@ -16,7 +16,7 @@ import { refuse, text, isoDate, url, stringList, sha256, repoKinds, LIVE_KINDS }
 import { oneLine, ROW_LINE_MAX, priorityOrderOf, byPriority, orderNote, waitsOnLine, blockersOf, blocksOf, blockedPhrase, waitsShown } from './questions.mjs';
 import { parseYaml } from '../../shape/check.mjs';
 import { ACTIONS_APP_ID } from '../../door/lib/gate.mjs';
-import { MARKER as SIGNED_MARKER, SIGNERS_FILE, parseSigners, verifyTexts, findAct, wordsFingerprint, AUDIT_CHECK, AUDIT_CHECKS, AUDIT_TEST, preKeyKeys } from '../../door/lib/signed-act.mjs';
+import { MARKER as SIGNED_MARKER, SIGNERS_FILE, parseSigners, verifyTexts, findAct, wordsFingerprint, AUDIT_CHECK, AUDIT_CHECKS, AUDIT_TEST, AUDIT_CODE_TEST, auditCodeDiff, preKeyKeys } from '../../door/lib/signed-act.mjs';
 
 export const DELIVERY_WRITE_VERBS = Object.freeze(['item_done', 'item_reopen']);
 export const DELIVERY_READ_VERBS = Object.freeze(['in_flight']);
@@ -467,8 +467,22 @@ export function createDeliveryVerbs(core) {
     // act for the push audit red may count, against the keys at the tip of
     // the default branch (preKeyKeys in signed-act.mjs holds the limits). The
     // audit runs only on the default branch, so the merge must be into it.
+    // Item f36c6b0f: the red audit check of a merge that changed the audit
+    // code takes only an accept-code act, which names the merge and the
+    // fingerprint of its audit-code change. An accept act never takes such
+    // a merge: the batch of atlas approve audit does not show its diff.
+    const auditRed = check === AUDIT_CHECK && testName === AUDIT_TEST;
+    const codeRed = AUDIT_CHECKS.includes(check) && testName === AUDIT_CODE_TEST;
+    let code = null;
+    if (auditRed || codeRed) {
+      code = auditCodeDiff(commit?.files);
+      if (code.unknown) refuse(`GitHub gave no full file list of the merge commit of ${pull.url}, so no accept act can be checked`);
+      if (auditRed && code.files.length) refuse(`${pull.url} changed the audit code (${code.files.join(', ')}), so an accept act does not count; the owner reads that diff and signs with atlas approve audit-code ${pull.number}, and the test is "${AUDIT_CODE_TEST}"`);
+      if (codeRed && (!Array.isArray(commit?.parents) || commit.parents.length !== 2)) refuse(`${pull.url} did not merge with a merge commit, so its audit-code diff is not its whole change; an accept-code act does not count`);
+      if (codeRed && !code.files.length) refuse(`${pull.url} changed no audit code, so the test "${AUDIT_CODE_TEST}" does not apply; the owner signs with atlas approve audit`);
+    }
     let prekey = null;
-    if (!keys.length && check === AUDIT_CHECK && testName === AUDIT_TEST) {
+    if (!keys.length && (auditRed || codeRed)) {
       const main = (await github(`repos/${pull.repo}`))?.default_branch;
       prekey = typeof main === 'string' && main === pull.base
         ? await preKeyKeys(githubOrNull, pull.repo, { parent, branch: main })
@@ -491,9 +505,11 @@ export function createDeliveryVerbs(core) {
     // cannot carry the touch to items the owner never named (review S2). The
     // words hold the time of the list, and a decision in any state counts,
     // so a replaced decision cannot hand the touch on (review 2, S3).
-    if (!found && words.trim() && check === AUDIT_CHECK && testName === AUDIT_TEST) {
+    if (!found && words.trim() && (auditRed || codeRed)) {
       const print = wordsFingerprint(words);
-      found = findAct(verified, { kind: 'accept', repo: pull.repo, pr: pull.number, head, words: print, check });
+      found = auditRed
+        ? findAct(verified, { kind: 'accept', repo: pull.repo, pr: pull.number, head, words: print, check })
+        : findAct(verified, { kind: 'accept-code', repo: pull.repo, pr: pull.number, head, merge: String(pull.merge_commit_sha).toLowerCase(), diff: code.print, words: print, check });
       if (found) {
         const same = decisions.filter((row) => typeof row.fields?.text === 'string' && wordsFingerprint(row.fields.text) === print);
         if (same.length !== 1 || same[0].id !== decisionId) refuse(`the accept act on ${pull.url} matches the words of ${same.length} decisions; exactly one decision, in any state, may hold the words the owner signed`);
@@ -501,9 +517,9 @@ export function createDeliveryVerbs(core) {
     }
     if (!found) {
       const why = verified.find((row) => row.error)?.error;
-      refuse(`accepted_red needs the owner's signed waiver on ${pull.url} for check ${check}, head ${head.slice(0, 12)} and decision ${decisionId}; none counts${why ? ` (a block was refused: ${why})` : ''}. The owner runs: atlas approve act waiver, and posts the block on the pull request; or, for an audit red, atlas approve audit, and the decision holds the words it printed`);
+      refuse(`accepted_red needs the owner's signed waiver on ${pull.url} for check ${check}, head ${head.slice(0, 12)} and decision ${decisionId}; none counts${why ? ` (a block was refused: ${why})` : ''}. The owner runs: atlas approve act waiver, and posts the block on the pull request; or, for an audit red, atlas approve audit (atlas approve audit-code <pr> for a merge that changed the audit code), and the decision holds the words it printed`);
     }
-    return { key: found.key, signed_at: found.signed_at, act: found.act.kind, ...(found.act.kind === 'accept' ? { run: String(found.act.run) } : {}), ...(prekey?.from ? { first_key: prekey.from } : {}) };
+    return { key: found.key, signed_at: found.signed_at, act: found.act.kind, ...(['accept', 'accept-code'].includes(found.act.kind) ? { run: String(found.act.run) } : {}), ...(prekey?.from ? { first_key: prekey.from } : {}) };
   }
 
   async function acceptedRed(value, pulls, item) {

package/door/lib/kind-drift.mjs

@@ -1,86 +0,0 @@
-// The facts helper's kind drift report.
-//
-// Milestone M2, slice L2 stage one: "The facts helper compares the `kind` in
-// `atlas.yaml` with the `kind` on the repo record and reports drift."
-//
-// The kind decides which of the six files a repository needs, so the two
-// copies disagreeing is not a detail. A repo record that says `service` while
-// atlas.yaml says `library` means four required parts read "not applicable" in
-// CI and "required" everywhere else.
-//
-// Which of the two is the source is open question O-9, and the owner settles it
-// before slice L2 ends. This report is neutral on that: it names both values
-// and says they differ. It never picks a winner, and it never writes.
-//
-// Where the record comes from. Reading it live needs the Atlas work verbs and
-// an Engram owner token, which CI does not have and this module does not hold.
-// So the record's kind is an input. Pass one repo's kind, or the JSON the
-// `registry_list` verb returns.
-import { readFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { parseYaml, SPECS } from '../../shape/check.mjs';
-import { REPO_KINDS, repoKinds } from '../../work/lib/verb-fields.mjs';
-
-// Stage 1: the repo record holds a list of kinds, and atlas.yaml one kind.
-// They agree when the list holds the file's kind. This report retires in
-// stage 2, with the fixed kind tables.
-export const KINDS = REPO_KINDS;
-const asList = (value) => (value === null || value === undefined ? null : (Array.isArray(value) ? value : String(value).split(',').map((one) => one.trim()).filter(Boolean)));
-
-// The kind a repository's own file declares, with the repo id beside it.
-export function fileKind(root) {
-  const path = join(root, 'atlas.yaml');
-  if (!existsSync(path)) return { kind: null, repo: null, error: 'atlas.yaml does not exist' };
-  try {
-    const facts = parseYaml(readFileSync(path, 'utf8'));
-    return { kind: facts?.kind ?? null, repo: facts?.repo ?? null, spec: facts?.spec ?? null, error: null };
-  } catch (error) {
-    // The parse error names a line and a column and never the content. That is
-    // the rule the whole check follows (amendment A1.6, section 4.9).
-    return { kind: null, repo: null, error: `atlas.yaml cannot be read: ${error.message}` };
-  }
-}
-
-// One repository, one verdict.
-export function driftOne({ root, recordKind = null, recordRepo = null }) {
-  const file = fileKind(root);
-  const known = (kind) => kind === null || KINDS.includes(kind);
-  const recordKinds = asList(recordKind);
-  recordKind = recordKinds && recordKinds.length ? recordKinds.join(', ') : null;
-  const row = {
-    root,
-    repo: file.repo ?? recordRepo ?? null,
-    file_kind: file.kind,
-    record_kind: recordKind,
-    spec: file.spec ?? null,
-    state: 'unknown',
-    why: '',
-  };
-  if (file.error) { row.state = 'unreadable'; row.why = file.error; return row; }
-  if (!known(file.kind)) { row.state = 'unreadable'; row.why = `atlas.yaml names kind "${file.kind}"; a kind is one of ${KINDS.join(', ')}`; return row; }
-  if (recordKind === null) { row.state = 'unknown'; row.why = 'no repo record kind was given, so there is nothing to compare with. Read it with the registry_list verb and pass it in.'; return row; }
-  const strange = recordKinds.find((kind) => !known(kind));
-  if (strange) { row.state = 'unreadable'; row.why = `the repo record names kind "${strange}"; a kind is one of ${KINDS.join(', ')}`; return row; }
-  if (file.kind === null) { row.state = 'drift'; row.why = `the repo record says "${recordKind}" and atlas.yaml names no kind at all, so CI cannot tell which files this repo needs`; return row; }
-  if (recordKinds.includes(file.kind)) { row.state = 'agree'; row.why = recordKinds.length === 1 ? `both say "${file.kind}"` : `the repo record's kinds (${recordKind}) hold "${file.kind}"`; return row; }
-  row.state = 'drift';
-  row.why = `atlas.yaml says "${file.kind}" and the repo record says "${recordKind}". The kind decides which parts are required, so the check in CI and the work verbs are scoring two different repos. Open question O-9 says which one is the source.`;
-  return row;
-}
-
-// The registry the `registry_list` verb returns, as { repoId: kinds }. A
-// row from before stage 1 has only kind, and reads as a list of one.
-export function kindsFromRegistry(registry) {
-  const out = {};
-  const kindsOf = (repo) => { const list = repoKinds(repo); return list.length ? list : null; };
-  for (const product of registry?.products ?? []) {
-    for (const repo of product?.repos ?? []) if (repo?.registry_id) out[repo.registry_id] = kindsOf(repo);
-  }
-  for (const repo of registry?.repos ?? []) if (repo?.registry_id) out[repo.registry_id] = kindsOf(repo);
-  return out;
-}
-
-export function drift(rows) {
-  const out = rows.map(driftOne);
-  return { rows: out, drifting: out.filter((row) => row.state === 'drift').length, specs_read: Object.keys(SPECS).map(Number) };
-}