@guanlin4924/devflow-pi 0.1.15 → 0.1.17

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/execution_contract.rb

@@ -0,0 +1,94 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# ExecutionContract v2 is synthesized from current Core truth. There is no
+# CLI input for agents, paths, checkers, or budgets: those are fixed policy.
+require "digest"
+require "json"
+require "optparse"
+require "yaml"
+require_relative "control_io"
+require_relative "requirement_graph"
+
+POLICY = {
+  "requirement-baseline" => { "checkers" => %w[requirement-graph-check slice-independence-check acceptance-coverage-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[requirement rule boundary slice acceptance] },
+  "api-contract" => { "checkers" => %w[requirement-graph-check contract-coverage-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[api] },
+  "architecture-feasibility" => { "checkers" => %w[requirement-graph-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[workload_shape workload_constraint decision risk] },
+  "integration-verify" => { "checkers" => %w[requirement-graph-check slice-independence-check contract-coverage-check change-impact-check], "agents" => ["verification-runner"], "budget" => 1, "allowed_graph_delta" => %w[requirement risk decision] },
+  "change-plan" => { "checkers" => %w[requirement-graph-check slice-independence-check contract-coverage-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[acceptance] },
+  "execute" => { "checkers" => %w[change-impact-check], "agents" => ["implementation-worker"], "budget" => 1, "allowed_graph_delta" => %w[requirement rule boundary behavior] },
+  "verify" => { "checkers" => %w[acceptance-coverage-check change-impact-check], "agents" => ["verification-runner"], "budget" => 1, "allowed_graph_delta" => %w[acceptance] }
+}.freeze
+
+options = { feature: nil, step: nil, expected_state_revision: nil, expected_graph_revision: nil, write: false, json: false }
+command = ARGV.shift
+OptionParser.new do |o|
+  o.on("--feature NAME") { |v| options[:feature] = v }
+  o.on("--step ID") { |v| options[:step] = v }
+  o.on("--expected-state-revision N", Integer) { |v| options[:expected_state_revision] = v }
+  o.on("--expected-graph-revision N", Integer) { |v| options[:expected_graph_revision] = v }
+  o.on("--write") { options[:write] = true }
+  o.on("--json") { options[:json] = true }
+end.parse!
+
+def load_state(root)
+  document = File.read(File.join(root, ".planning/STATE.md"))
+  front = document.match(/\A---\n(.*?)\n---/m)&.[](1)
+  raise "STATE.md has no YAML front matter" unless front
+  YAML.safe_load(front, permitted_classes: [], aliases: false)
+end
+
+def interpolate(value, state)
+  value.gsub("{feature}", state.fetch("current_feature").to_s).gsub("{phase}", state.fetch("current_phase").to_s)
+end
+
+root = Dir.pwd
+lock = %w[create inspect].include?(command) ? DevflowControlIO.acquire_project_lock(root) : nil
+begin
+  raise ArgumentError, "command must be create or inspect" unless %w[create inspect].include?(command)
+  raise ArgumentError, "invalid feature" unless RequirementGraph.valid_feature?(options[:feature])
+  state = load_state(root)
+  raise ArgumentError, "state feature/step mismatch" unless state["current_feature"] == options[:feature] && state["current_step"] == options[:step]
+  workflow_relative = state.fetch("workflow_config")
+  workflow_path, = DevflowControlIO.resolve_control_path(root, workflow_relative, :workflow)
+  workflow_raw = File.read(workflow_path)
+  workflow = YAML.safe_load(workflow_raw, permitted_classes: [], aliases: false)
+  step = Array(workflow["steps"]).find { |item| item["id"] == options[:step] }
+  raise ArgumentError, "unknown workflow step" unless step
+  graph, = RequirementGraph.load_graph(root, options[:feature])
+  if command == "create"
+    raise ArgumentError, "stale state revision: expected #{options[:expected_state_revision]}, actual #{state["revision"]}" if options[:expected_state_revision] && state["revision"] != options[:expected_state_revision]
+    raise ArgumentError, "stale graph revision: expected #{options[:expected_graph_revision]}, actual #{graph["revision"]}" if options[:expected_graph_revision] && graph["revision"] != options[:expected_graph_revision]
+  end
+  policy = POLICY.fetch(options[:step], { "checkers" => [], "agents" => [], "budget" => 0 })
+  paths = (Array(step["outputs"]).map { |output| output["path"] } + [step.dig("meta_output", "path")]).compact.map { |value| interpolate(value, state) }.uniq
+  contract = {
+    "schema_version" => 2, "origin" => "core_execution_contract", "feature" => options[:feature], "step" => options[:step],
+    "state_revision" => state["revision"], "graph_revision" => graph["revision"], "workflow_path" => workflow_relative,
+    "workflow_fingerprint" => Digest::SHA256.hexdigest(workflow_raw), "manifest_id" => "devflow-core-execution-policy-v2",
+    "allowed_paths" => paths, "allowed_agents" => policy["agents"], "checker_ids" => policy["checkers"],
+    "allowed_tools" => %w[read grep find glob lsp search write edit apply_patch bash shell exec_command task],
+    "tool_budget" => policy["budget"], "acceptance" => Array(graph["nodes"]).select { |node| node["kind"] == "acceptance" }.map { |node| node["id"] },
+    "allowed_graph_delta" => Array(policy["allowed_graph_delta"]),
+    "on_unknown" => "block_and_escalate"
+  }
+  frozen = contract.merge("frozen_hash" => Digest::SHA256.hexdigest(JSON.generate(contract)))
+  contract_id = "EC-#{frozen["frozen_hash"][0, 16]}"
+  frozen["contract_id"] = contract_id
+  if command == "inspect"
+    result = { "ok" => true, "contract" => frozen }
+  else
+    raise ArgumentError, "--write is required" unless options[:write]
+    destination = File.join(root, ".planning/contracts", options[:feature], "#{contract_id}.json")
+    DevflowControlIO.atomic_write(destination, JSON.pretty_generate(frozen) + "\n")
+    audit = File.join(root, ".planning/contracts", options[:feature], "control-events.jsonl")
+    existing = File.exist?(audit) ? File.read(audit) : ""
+    DevflowControlIO.atomic_write(audit, existing + JSON.generate({ "event" => "execution_contract_frozen", "contract_id" => contract_id, "state_revision" => state["revision"], "graph_revision" => graph["revision"], "frozen_hash" => frozen["frozen_hash"] }) + "\n")
+    result = { "ok" => true, "path" => destination.sub("#{root}/", ""), "contract" => frozen }
+  end
+rescue StandardError => error
+  result = { "ok" => false, "reason" => "execution_contract_failed", "message" => error.message }
+ensure
+  DevflowControlIO.release_lock(lock)
+end
+puts JSON.pretty_generate(result)

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/init_state.rb

@@ -94,7 +94,8 @@ pending_steps = if File.exist?(workflow_path)
 current_step = options[:step] || pending_steps.first || "requirement-triage"
 
 state = {
-  "state_schema_version" => 1,
+  "state_schema_version" => 2,
+  "governance_started_revision" => 0,
   "revision" => 0,
   "state_updated_at" => Date.today.to_s,
   "current_flow" => options[:flow],

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/machine_evidence.rb

@@ -0,0 +1,112 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Evidence Pack v2 is deliberately assembled from the current STATE/workflow
+# and canonical graph. Agent text is never used to decide completion.
+require "digest"
+require "json"
+require "optparse"
+require "yaml"
+require_relative "control_io"
+require_relative "requirement_graph"
+
+options = { feature: nil, step: nil, contract: nil, write: false, json: false }
+OptionParser.new do |o|
+  o.on("--feature NAME") { |v| options[:feature] = v }
+  o.on("--step ID") { |v| options[:step] = v }
+  o.on("--contract PATH") { |v| options[:contract] = v }
+  o.on("--write") { options[:write] = true }
+  o.on("--json") { options[:json] = true }
+end.parse!
+abort "feature, step and --write are required" unless options[:feature] && options[:step] && options[:write]
+abort "invalid feature" unless RequirementGraph.valid_feature?(options[:feature])
+
+def state_front_matter(root)
+  document = File.read(File.join(root, ".planning/STATE.md"))
+  front = document.match(/\A---\n(.*?)\n---/m)&.[](1)
+  raise "STATE.md has no YAML front matter" unless front
+  YAML.safe_load(front, permitted_classes: [], aliases: false)
+end
+
+def interpolate(path, state)
+  path.gsub("{feature}", state.fetch("current_feature", "").to_s).gsub("{phase}", state.fetch("current_phase", "").to_s)
+end
+
+def configured_checkers(workflow, step_id)
+  explicit = workflow.dig("governance", "step_checkers", step_id)
+  return Array(explicit) if explicit
+  case step_id
+  when "requirement-baseline" then %w[requirement-graph-check slice-independence-check acceptance-coverage-check change-impact-check]
+  when "api-contract" then %w[requirement-graph-check contract-coverage-check change-impact-check]
+  when "architecture-feasibility" then %w[requirement-graph-check change-impact-check]
+  when "integration-verify", "change-plan" then %w[requirement-graph-check slice-independence-check contract-coverage-check change-impact-check]
+  when "verify" then %w[acceptance-coverage-check change-impact-check]
+  else []
+  end
+end
+
+root = Dir.pwd
+lock = DevflowControlIO.acquire_project_lock(root)
+begin
+  state = state_front_matter(root)
+  unless state["current_feature"] == options[:feature] && state["current_step"] == options[:step]
+    result = { "ok" => false, "reason" => "state_step_mismatch", "state_feature" => state["current_feature"], "state_step" => state["current_step"] }
+    puts JSON.pretty_generate(result)
+    exit 0
+  end
+  workflow_path, = DevflowControlIO.resolve_control_path(root, state.fetch("workflow_config"), :workflow)
+  workflow_raw = File.read(workflow_path)
+  workflow = YAML.safe_load(workflow_raw, permitted_classes: [], aliases: false)
+  step = Array(workflow["steps"]).find { |item| item["id"] == options[:step] }
+  raise "unknown workflow step" unless step
+
+  output_specs = Array(step["outputs"]).select { |item| item["required"] }
+  output_specs << step["meta_output"] if step["meta_output"].is_a?(Hash)
+  files = output_specs.map do |spec|
+    path = spec["path"]
+    next unless path
+    relative = interpolate(path, state)
+    absolute, = DevflowControlIO.resolve_control_path(root, relative, :artifact)
+    exists = File.file?(absolute)
+    { "path" => relative, "required" => true, "exists" => exists, "bytes" => exists ? File.size(absolute) : 0,
+      "sha256" => exists ? Digest::SHA256.file(absolute).hexdigest : nil }
+  end.compact
+
+  graph, = RequirementGraph.load_graph(root, options[:feature])
+  checkers = RequirementGraph.checker_results(graph)
+  selected = configured_checkers(workflow, options[:step])
+  gate = workflow.dig("governance", "requirement_graph_gate").to_s
+  enforced = gate == "enforced"
+  checker_results = selected.map do |id|
+    issues = checkers.fetch(id, ["unknown fixed checker: #{id}"])
+    { "id" => id, "origin" => "core_fixed_checker", "exit_code" => issues.empty? ? 0 : 1, "passed" => issues.empty?, "issues" => issues,
+      "counters" => { "issue_count" => issues.length } }
+  end
+  graph_missing = graph["revision"].zero? && !File.exist?(RequirementGraph.graph_path(root, options[:feature]).first)
+  checker_passed = !enforced || (!graph_missing && checker_results.all? { |item| item["passed"] })
+  contract_hash = nil
+  if options[:contract]
+    contract_path = File.expand_path(options[:contract], root)
+    raise "contract path escapes project" unless contract_path.start_with?("#{File.realpath(root)}#{File::SEPARATOR}") && File.file?(contract_path)
+    contract_hash = Digest::SHA256.file(contract_path).hexdigest
+  end
+  node_counts = Array(graph["nodes"]).group_by { |node| node["kind"] }.transform_values(&:length)
+  pack = {
+    "schema_version" => 2, "origin" => "core_machine", "feature" => options[:feature], "step" => options[:step],
+    "state_revision" => state["revision"], "graph_revision" => graph["revision"], "workflow_fingerprint" => Digest::SHA256.hexdigest(workflow_raw),
+    "contract_hash" => contract_hash, "files" => files, "checkers" => checker_results,
+    "counters" => { "required_file_count" => files.length, "existing_file_count" => files.count { |item| item["exists"] }, "nodes_by_kind" => node_counts,
+                    "stale_node_count" => Array(graph["stale"]).length, "stale_view_count" => Hash(graph["views"]).count { |_name, view| view["needs_recheck"] } },
+    "view_fingerprints" => Hash(graph["views"]).transform_values { |view| view.select { |key, _value| %w[fingerprint graph_revision state needs_recheck stale_fingerprint].include?(key) } },
+    "complete" => files.all? { |item| item["exists"] } && checker_passed,
+    "gate_mode" => gate.empty? ? "observe" : gate
+  }.compact
+  destination = File.join(root, ".planning/evidence", options[:feature], "#{options[:step]}.machine.json")
+  DevflowControlIO.atomic_write(destination, JSON.pretty_generate(pack) + "\n")
+  result = { "ok" => true, "path" => destination.sub("#{root}/", ""), "complete" => pack["complete"], "state_revision" => pack["state_revision"], "graph_revision" => pack["graph_revision"], "checkers" => checker_results }
+rescue StandardError => error
+  result = { "ok" => false, "reason" => "machine_evidence_failed", "message" => error.message }
+ensure
+  DevflowControlIO.release_lock(lock)
+end
+puts JSON.pretty_generate(result)