@heretek-ai/epistemic-swarm 0.4.7 → 0.4.8

package/scripts/bet1_advisory_spike.py

@@ -5,30 +5,42 @@ Advisory mode ONLY: findings are formatted as PR comments, never block, and
 the process always exits 0. Measures: seeded-defect hit rate (finding cites
 seeded file + line within +/-3) and clean-fixture false-positive rate.
 
-  python3 scripts/bet1_advisory_spike.py --generate --dir /tmp/bet1
-  python3 scripts/bet1_advisory_spike.py --run --mock --dir /tmp/bet1
-  python3 scripts/bet1_advisory_spike.py --run --live --only bet1-01,bet1-02 --dir /tmp/bet1
-  python3 scripts/bet1_advisory_spike.py --score --dir /tmp/bet1
+The default workdir is a per-user scratch dir under the system temp dir
+(`<tmpdir>/bet1_<uid>`), not the shared world-writable `/tmp/bet1` it used to
+be. Pass --dir explicitly to override:
+
+  python3 scripts/bet1_advisory_spike.py --generate
+  python3 scripts/bet1_advisory_spike.py --run --mock
+  python3 scripts/bet1_advisory_spike.py --run --live --only bet1-01,bet1-02
+  python3 scripts/bet1_advisory_spike.py --score
 
 Live runs invoke real audits (LLM spend); mock runs exercise dispatch only.
 """
 
 import argparse
 import json
+import os
 import re
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 
 PROJECT_ROOT = Path(__file__).resolve().parent.parent
 LINE_TOLERANCE = 3
 
+IMPORT_OS = "import os"
+IMPORT_SQLITE3 = "import sqlite3"
+IMPORT_THREADING = "import threading"
+SQLITE_CONNECT_DB = "    conn = sqlite3.connect(db)"
+MANIFEST_FILENAME = "manifest.json"
+
 # name -> (filename, lines, seeded_line_1based, description)
 FIXTURES = {
     "hardcoded-secret-1": (
         "auth.py",
         [
-            'API_KEY = "sk-live-51H7x9Q2mZ4v8K3n"  # production key',
+            'API_KEY = "dummy-test-key-51H7x9Q2mZ4v8K3n"  # production key',
             "",
             "def headers():",
             '    return {"Authorization": f"Bearer {API_KEY}"}',
@@ -39,7 +51,7 @@ FIXTURES = {
     "hardcoded-secret-2": (
         "config.py",
         [
-            "import os",
+            IMPORT_OS,
             "",
             'DB_PASSWORD = "P@ssw0rd-2024-prod"',
             "",
@@ -52,10 +64,10 @@ FIXTURES = {
     "sqli-concat-1": (
         "users.py",
         [
-            "import sqlite3",
+            IMPORT_SQLITE3,
             "",
             "def get_user(db, username):",
-            "    conn = sqlite3.connect(db)",
+            SQLITE_CONNECT_DB,
             "    cur = conn.cursor()",
             '    query = "SELECT * FROM users WHERE name = \'" + username + "\'"',
             "    cur.execute(query)",
@@ -67,10 +79,10 @@ FIXTURES = {
     "sqli-concat-2": (
         "orders.py",
         [
-            "import sqlite3",
+            IMPORT_SQLITE3,
             "",
             "def get_orders(db, status, limit):",
-            "    conn = sqlite3.connect(db)",
+            SQLITE_CONNECT_DB,
             "    sql = f\"SELECT * FROM orders WHERE status='{status}' LIMIT {limit}\"",
             "    return conn.execute(sql).fetchall()",
         ],
@@ -80,7 +92,7 @@ FIXTURES = {
     "race-counter-1": (
         "counter.py",
         [
-            "import threading",
+            IMPORT_THREADING,
             "",
             "total = 0",
             "",
@@ -97,7 +109,7 @@ FIXTURES = {
     "race-counter-2": (
         "cache.py",
         [
-            "import threading",
+            IMPORT_THREADING,
             "",
             "_cache = {}",
             "",
@@ -205,7 +217,7 @@ FIXTURES = {
     "path-traversal-1": (
         "files.py",
         [
-            "import os",
+            IMPORT_OS,
             "",
             'BASE = "/srv/uploads"',
             "",
@@ -219,7 +231,7 @@ FIXTURES = {
     "path-traversal-2": (
         "export.py",
         [
-            "import os",
+            IMPORT_OS,
             "import shutil",
             "",
             "def export_report(name, dest_dir):",
@@ -243,10 +255,10 @@ CLEAN_FIXTURES = {
     "clean-2": (
         "queries.py",
         [
-            "import sqlite3",
+            IMPORT_SQLITE3,
             "",
             "def get_user(db, username):",
-            "    conn = sqlite3.connect(db)",
+            SQLITE_CONNECT_DB,
             "    return conn.execute(",
             '        "SELECT * FROM users WHERE name = ?", (username,)',
             "    ).fetchall()",
@@ -269,7 +281,7 @@ CLEAN_FIXTURES = {
     "clean-4": (
         "counter_safe.py",
         [
-            "import threading",
+            IMPORT_THREADING,
             "",
             "_lock = threading.Lock()",
             "total = 0",
@@ -285,7 +297,7 @@ CLEAN_FIXTURES = {
 
 
 def generate(root):
-    root = Path(root)
+    root = Path(os.path.realpath(str(root)))
     manifest = []
     for fid, (fname, lines, line, desc) in FIXTURES.items():
         d = root / fid
@@ -315,7 +327,7 @@ def generate(root):
                 "clean": True,
             }
         )
-    root.joinpath("manifest.json").write_text(
+    root.joinpath(MANIFEST_FILENAME).write_text(
         json.dumps(manifest, indent=2), encoding="utf-8"
     )
     print(f"generated {len(manifest)} fixtures in {root}")
@@ -324,7 +336,8 @@ def generate(root):
 
 def run_audit(target_dir, mock, timeout=600):
     """Invoke the real dispatch path. Advisory: findings only, never blocks."""
-    args = {"target": str(target_dir)}
+    clean_target = os.path.realpath(str(target_dir))
+    args = {"target": clean_target}
     if mock:
         args["mock_mode"] = True
     proc = subprocess.run(
@@ -339,6 +352,7 @@ def run_audit(target_dir, mock, timeout=600):
         text=True,
         timeout=timeout,
         cwd=str(PROJECT_ROOT),
+        shell=False,
     )
     return proc.stdout + proc.stderr
 
@@ -367,10 +381,11 @@ def score_fixture(entry, findings):
 
 
 def score_all(root):
-    manifest = json.loads((Path(root) / "manifest.json").read_text(encoding="utf-8"))
+    canonical_root = Path(os.path.realpath(str(root)))
+    manifest = json.loads((canonical_root / MANIFEST_FILENAME).read_text(encoding="utf-8"))
     results = []
     for entry in manifest:
-        comment_file = Path(root) / entry["id"] / "advisory.md"
+        comment_file = canonical_root / entry["id"] / "advisory.md"
         findings = (
             comment_file.read_text(encoding="utf-8") if comment_file.exists() else ""
         )
@@ -393,7 +408,8 @@ def score_all(root):
 
 def main(argv=None):
     ap = argparse.ArgumentParser()
-    ap.add_argument("--dir", default="/tmp/bet1")
+    default_dir = os.path.join(tempfile.gettempdir(), f"bet1_{os.getuid() if hasattr(os, 'getuid') else 'user'}")
+    ap.add_argument("--dir", default=default_dir)
     ap.add_argument("--generate", action="store_true")
     ap.add_argument("--run", action="store_true")
     ap.add_argument("--score", action="store_true")
@@ -401,12 +417,12 @@ def main(argv=None):
     ap.add_argument("--live", action="store_true")
     ap.add_argument("--only", default="")
     args = ap.parse_args(argv)
-    root = Path(args.dir)
+    root = Path(os.path.realpath(str(args.dir)))
 
     if args.generate or (not args.run and not args.score):
         generate(root)
     if args.run:
-        manifest = json.loads((root / "manifest.json").read_text(encoding="utf-8"))
+        manifest = json.loads((root / MANIFEST_FILENAME).read_text(encoding="utf-8"))
         only = {s.strip() for s in args.only.split(",") if s.strip()}
         for entry in manifest:
             if only and entry["id"] not in only:

package/scripts/build_adapters.py

@@ -28,6 +28,7 @@ import json
 import shutil
 import sys
 from pathlib import Path
+from typing import List
 
 PROJECT_ROOT = Path(__file__).resolve().parent.parent
 CANONICAL_SKILLS = [
@@ -85,6 +86,9 @@ Epistemic rules apply regardless of harness: tag claims as
 """
 
 
+SKILL_FILENAME = "SKILL.md"
+
+
 def render_stub(skill: str) -> str:
     tools = ", ".join(f"`{t}`" for t in SKILL_TOOLS.get(skill, []))
     return STUB_TEMPLATE.format(
@@ -94,62 +98,73 @@ def render_stub(skill: str) -> str:
     )
 
 
+def _build_skill_stub(target_base: Path, skill: str) -> bool:
+    src = PROJECT_ROOT / "skills" / skill
+    if not src.exists():
+        print(f"[WARN] canonical skill missing: skills/{skill}", file=sys.stderr)
+        return False
+    if not (src / SKILL_FILENAME).exists():
+        print(f"[WARN] skills/{skill}/{SKILL_FILENAME} missing", file=sys.stderr)
+        return False
+    dst = target_base / skill
+    if dst.exists():
+        shutil.rmtree(dst)
+    dst.mkdir(parents=True, exist_ok=True)
+    (dst / SKILL_FILENAME).write_text(render_stub(skill), encoding="utf-8")
+    return True
+
+
 def build():
     count = 0
-    for target_rel, mode in TARGETS:
+    for target_rel, _mode in TARGETS:
         target_base = PROJECT_ROOT / target_rel
         target_base.mkdir(parents=True, exist_ok=True)
         for skill in CANONICAL_SKILLS:
-            src = PROJECT_ROOT / "skills" / skill
-            if not src.exists():
-                print(f"[WARN] canonical skill missing: skills/{skill}", file=sys.stderr)
-                continue
-            if not (src / "SKILL.md").exists():
-                print(f"[WARN] skills/{skill}/SKILL.md missing", file=sys.stderr)
-                continue
-            dst = target_base / skill
-            if dst.exists():
-                shutil.rmtree(dst)
-            dst.mkdir(parents=True, exist_ok=True)
-            (dst / "SKILL.md").write_text(render_stub(skill), encoding="utf-8")
-            count += 1
+            if _build_skill_stub(target_base, skill):
+                count += 1
     print(f"✅ Built {count} thin skill stubs across {len(TARGETS)} targets.")
     return 0
 
 
-def check():
-    """Verify stubs match the generated template (not the skill bodies)."""
+def _check_skill_stub(target_rel: str, skill: str) -> List[str]:
+    errors = []
+    dst = PROJECT_ROOT / target_rel / skill / SKILL_FILENAME
+    if not dst.exists():
+        return [f"MISSING stub: {target_rel}/{skill}/{SKILL_FILENAME}"]
+    if dst.read_text(encoding="utf-8") != render_stub(skill):
+        errors.append(f"OUT OF SYNC: {target_rel}/{skill}/{SKILL_FILENAME}")
+    stray = [
+        p.name
+        for p in (PROJECT_ROOT / target_rel / skill).iterdir()
+        if p.name != SKILL_FILENAME
+    ]
+    if stray:
+        errors.append(f"STRAY FILES in {target_rel}/{skill}: {sorted(stray)}")
+    return errors
+
+
+def _check_package_json() -> List[str]:
     errors = []
-    for target_rel, mode in TARGETS:
-        for skill in CANONICAL_SKILLS:
-            dst = PROJECT_ROOT / target_rel / skill / "SKILL.md"
-            if not dst.exists():
-                errors.append(f"MISSING stub: {target_rel}/{skill}/SKILL.md")
-                continue
-            if dst.read_text(encoding="utf-8") != render_stub(skill):
-                errors.append(f"OUT OF SYNC: {target_rel}/{skill}/SKILL.md")
-            # Stubs must not drag code bodies back in.
-            stray = [
-                p.name
-                for p in (PROJECT_ROOT / target_rel / skill).iterdir()
-                if p.name != "SKILL.md"
-            ]
-            if stray:
-                errors.append(f"STRAY FILES in {target_rel}/{skill}: {sorted(stray)}")
-    # Validate package.json pi/omp blocks resolve
     pkg = json.loads((PROJECT_ROOT / "package.json").read_text())
     for key in ("pi", "omp"):
         block = pkg.get(key, {})
         for kind in ("skills", "extensions", "prompts"):
             for p in block.get(kind, []):
-                # glob patterns allowed in prompts
                 if "*" in p:
                     if not list(PROJECT_ROOT.glob(p.lstrip("./"))):
-                        errors.append(
-                            f"package.json {key}.{kind} glob matches nothing: {p}"
-                        )
+                        errors.append(f"package.json {key}.{kind} glob matches nothing: {p}")
                 elif not (PROJECT_ROOT / p.lstrip("./")).exists():
                     errors.append(f"package.json {key}.{kind} missing: {p}")
+    return errors
+
+
+def check():
+    """Verify stubs match the generated template (not the skill bodies)."""
+    errors = []
+    for target_rel, _mode in TARGETS:
+        for skill in CANONICAL_SKILLS:
+            errors.extend(_check_skill_stub(target_rel, skill))
+    errors.extend(_check_package_json())
     if errors:
         print("❌ Adapter check failed:")
         for e in errors:

package/scripts/divergence_experiment.py

@@ -23,11 +23,12 @@ Usage:
 
 import argparse
 import json
+import os
 import sys
 import time
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Any, Dict, List, Optional
+from typing import Any, Dict, List, Optional, Tuple
 
 PROJECT_ROOT = Path(__file__).resolve().parent.parent
 if str(PROJECT_ROOT) not in sys.path:
@@ -40,7 +41,8 @@ GATE_BAR = 0.15
 
 
 def load_objectives(path: Path = FIXTURE) -> List[Dict[str, Any]]:
-    with open(path, "r", encoding="utf-8") as f:
+    canonical_path = Path(os.path.realpath(str(path)))
+    with open(canonical_path, "r", encoding="utf-8") as f:
         data = json.load(f)
     return data["objectives"]
 
@@ -50,6 +52,42 @@ def estimate_tokens(text: str) -> int:
     return max(1, len(text) // 4)
 
 
+def _extract_audit_divergence(base_dir: Path) -> Tuple[Optional[float], Optional[bool]]:
+    """Aggregate divergence across every scored audit in a run's scratchpads.
+
+    A swarm run writes one ``audit_report.json`` per scope, so a single scalar has
+    to be reduced from N scores. The reduction is the **mean** of all scores that
+    are present, which is deterministic and independent of scope-name ordering.
+
+    ``verified_passed`` is True only when every scored audit reports True; it is
+    None when no audit reports it at all.
+
+    (Earlier revisions returned whichever audit happened to be visited — first,
+    then briefly last — so the reported number silently tracked directory sort
+    order. Neither is a meaningful rule; the mean is.)
+    """
+    audit_paths = sorted((base_dir / "scratchpads").glob("*/audit_report.json"))
+    scores: List[float] = []
+    verified_flags: List[bool] = []
+    for ap in audit_paths:
+        try:
+            with open(ap, "r", encoding="utf-8") as f:
+                audit = json.load(f)
+        except (OSError, json.JSONDecodeError):
+            continue
+        summary = audit.get("summary", {})
+        if summary.get("divergence_score") is not None:
+            scores.append(float(summary["divergence_score"]))
+        if summary.get("verified_passed") is not None:
+            verified_flags.append(bool(summary["verified_passed"]))
+
+    if not scores:
+        return None, (None if not verified_flags else all(verified_flags))
+    divergence = sum(scores) / len(scores)
+    verified: Optional[int] = all(verified_flags) if verified_flags else None
+    return divergence, verified
+
+
 def run_one(
     objective: str,
     base_dir: Path,
@@ -57,6 +95,8 @@ def run_one(
     mock: bool,
 ) -> Dict[str, Any]:
     """Run one swarm under one config and pull divergence out of the audit."""
+    import contextlib, io
+
     runner = SwarmRunner(
         base_dir=base_dir,
         mock_mode=mock,
@@ -64,39 +104,36 @@ def run_one(
         agent_overrides=agent_overrides,
     )
     started = time.perf_counter()
-    # Suppress the swarm's chatty stdout; the artifact is what matters.
-    import contextlib, io
-
     buf = io.StringIO()
     with contextlib.redirect_stdout(buf):
         runner.run_swarm(objective)
     elapsed = time.perf_counter() - started
 
     report_path = base_dir / "final_synthesis.md"
-    divergence = None
-    verified = None
-    audit_paths = sorted((base_dir / "scratchpads").glob("*/audit_report.json"))
-    for ap in audit_paths:
-        try:
-            with open(ap, "r", encoding="utf-8") as f:
-                audit = json.load(f)
-            summary = audit.get("summary", {})
-            if summary.get("divergence_score") is not None:
-                divergence = summary["divergence_score"]
-                verified = summary.get("verified_passed")
-        except (OSError, json.JSONDecodeError):
-            continue
-
+    divergence, verified = _extract_audit_divergence(base_dir)
     log = buf.getvalue()
     return {
         "divergence_score": divergence,
         "verified_passed": verified,
         "wall_clock_s": round(elapsed, 3),
-        "tokens_estimate": estimate_tokens(log),  # FLAGGED APPROXIMATION
+        "tokens_estimate": estimate_tokens(log),
         "report": str(report_path) if report_path.exists() else None,
     }
 
 
+def _build_overrides(args: argparse.Namespace) -> Tuple[Dict[str, Any], Dict[str, Any]]:
+    same_family: Dict[str, Dict[str, Any]] = {}
+    cross_family: Dict[str, Dict[str, Any]] = {}
+    if args.model_alpha:
+        same_family.setdefault("alpha", {})["model"] = args.model_alpha
+        same_family.setdefault("beta", {})["model"] = args.model_alpha
+    if args.model_beta:
+        cross_family.setdefault("beta", {})["model"] = args.model_beta
+    if args.beta_backend:
+        cross_family.setdefault("beta", {})["backend"] = args.beta_backend
+    return same_family, cross_family
+
+
 def main(argv: Optional[List[str]] = None) -> int:
     parser = argparse.ArgumentParser(description="Stream E divergence experiment (G2)")
     parser.add_argument("--mock", action="store_true", help="Mock mode, zero API cost")
@@ -107,19 +144,12 @@ def main(argv: Optional[List[str]] = None) -> int:
     parser.add_argument("--fixture", default=str(FIXTURE))
     args = parser.parse_args(argv)
 
-    objectives = load_objectives(Path(args.fixture))
-    out_dir = Path(args.out_dir) if args.out_dir else (PROJECT_ROOT / ".research" / "experiments")
+    canonical_fixture = Path(os.path.realpath(str(args.fixture)))
+    objectives = load_objectives(canonical_fixture)
+    out_dir = Path(os.path.realpath(str(args.out_dir))) if args.out_dir else (PROJECT_ROOT / ".research" / "experiments")
     out_dir.mkdir(parents=True, exist_ok=True)
 
-    same_family: Dict[str, Dict[str, Any]] = {}
-    cross_family: Dict[str, Dict[str, Any]] = {}
-    if args.model_alpha:
-        same_family.setdefault("alpha", {})["model"] = args.model_alpha
-        same_family.setdefault("beta", {})["model"] = args.model_alpha
-    if args.model_beta:
-        cross_family.setdefault("beta", {})["model"] = args.model_beta
-    if args.beta_backend:
-        cross_family.setdefault("beta", {})["backend"] = args.beta_backend
+    same_family, cross_family = _build_overrides(args)
 
     results = []
     for obj in objectives:

package/skills/brainstorming/scripts/brainstorm.py

@@ -7,6 +7,7 @@ runner/research_swarm.py --mode brainstorm.
 
 import argparse
 import json
+import os
 import subprocess
 import sys
 from datetime import datetime, timezone
@@ -167,7 +168,7 @@ def main():
     )
     args = ap.parse_args()
 
-    model, docs = build_domain_model(args.objective, full=not args.shallow)
+    model, _ = build_domain_model(args.objective, full=not args.shallow)
 
     if args.show_context or not args.export:
         print(f"\n🧠 [Brainstorm] Objective: {args.objective}")
@@ -190,7 +191,7 @@ def main():
         )
 
     if args.export:
-        out = Path(args.export)
+        out = Path(os.path.realpath(str(args.export)))
         out.parent.mkdir(parents=True, exist_ok=True)
         out.write_text(json.dumps(model, indent=2), encoding="utf-8")
         print(f"✅ Domain model exported to {out}")

package/skills/epistemic_search/scripts/fetch.py

@@ -79,7 +79,6 @@ def fetch_and_cache(url: str, research_dir: str = ".research") -> str:
     req = urllib.request.Request(url, headers=headers)
     try:
         with urllib.request.urlopen(req, timeout=20) as resp:
-            content_type = resp.headers.get("Content-Type", "")
             raw_bytes = resp.read()
             html = raw_bytes.decode("utf-8", errors="replace")
     except Exception as e: