@kernaut/kernaut-resources 0.1.17-beta.1 → 0.1.18

package/resources/kop-2026-10-23-0.1.17-beta.1/product_capabilities/kernel_optflow/skills/KernelWiki-private/scripts/check_dod_fixtures.py

@@ -1,251 +0,0 @@
-#!/usr/bin/env python3
-"""Check Phase 3 Definition-of-Done fixtures (AC-7).
-
-Reads data/phase3-dod-fixtures.yaml; for each entry, verifies that at least
-one file matches the `required_assets` globs, the file has >= required_min_lines,
-any `required_provenance_modes` restriction is met (by checking the file's
-ancestor PROVENANCE.yaml's files[*].mode), and any `required_content_patterns`
-regexes match across the matched files.
-
-Exit codes:
-  0 — all fixture entries pass
-  1 — at least one fixture entry fails
-  2 — invocation error (fixtures file missing)
-"""
-
-import argparse
-import re
-import sys
-from pathlib import Path
-import yaml
-
-REPO_ROOT = Path(__file__).resolve().parent.parent
-FIXTURES_PATH = REPO_ROOT / "data" / "phase3-dod-fixtures.yaml"
-
-
-def find_bundle_root_for(path):
-    """Walk up from path until a PROVENANCE.yaml is found; return the directory."""
-    p = path.parent
-    while p != p.parent:
-        if (p / "PROVENANCE.yaml").is_file():
-            return p
-        p = p.parent
-    return None
-
-
-def load_modes_for_file(file_path):
-    """Return the per-file `mode` declared in the enclosing bundle's files[*]
-    manifest, or None if not found."""
-    root = find_bundle_root_for(file_path)
-    if not root:
-        return None
-    prov_path = root / "PROVENANCE.yaml"
-    try:
-        prov = yaml.safe_load(prov_path.read_text(encoding="utf-8")) or {}
-    except yaml.YAMLError:
-        return None
-    try:
-        rel = file_path.relative_to(root).as_posix()
-    except ValueError:
-        return None
-    for entry in prov.get("files") or []:
-        if isinstance(entry, dict) and entry.get("local_path") == rel:
-            return entry.get("mode")
-    return None
-
-
-def load_bundle_mode_for_file(file_path):
-    """Return the bundle-level `asset_mode` default for the enclosing bundle,
-    or None if no PROVENANCE.yaml is found. This is distinct from the per-file
-    mode: a bundle can carry `asset_mode: verbatim` (all files are verbatim
-    upstream) or `asset_mode: derived` (all files are derived), and some DoD
-    fixtures need to enforce the bundle-level contract rather than file-level."""
-    root = find_bundle_root_for(file_path)
-    if not root:
-        return None
-    prov_path = root / "PROVENANCE.yaml"
-    try:
-        prov = yaml.safe_load(prov_path.read_text(encoding="utf-8")) or {}
-    except yaml.YAMLError:
-        return None
-    return prov.get("asset_mode")
-
-
-def check_entry(entry):
-    """Per-glob-independent fixture check.
-
-    Every glob in `required_assets` must independently match at least one file.
-    `required_min_lines` must be reached by at least one file matched by each
-    glob (so the line-count requirement is enforced against the intended set,
-    not just the union). `required_provenance_modes` and
-    `required_content_patterns` are enforced against the overall matched set
-    with the same per-glob coverage requirement.
-    """
-    errors = []
-    question = entry.get("question", "<unnamed>")
-    required_assets = entry.get("required_assets") or []
-    required_min_lines = entry.get("required_min_lines", 100)
-    required_modes = set(entry.get("required_provenance_modes") or [])
-    required_bundle_modes = set(entry.get("required_bundle_asset_mode") or [])
-    required_patterns = entry.get("required_content_patterns") or []
-
-    # Each entry in required_assets can be either:
-    #   - a string: a glob applied with the fixture-level required_min_lines
-    #   - a dict {glob, min_lines?}: a glob with its own min_lines override
-    # Resolve each glob independently so that a missing glob fails the fixture
-    # even if other globs matched files.
-    per_glob_matches = {}
-    per_glob_min_lines = {}
-    for a in required_assets:
-        if isinstance(a, dict):
-            glob = a.get("glob")
-            min_lines = a.get("min_lines", required_min_lines)
-        else:
-            glob = a
-            min_lines = required_min_lines
-        if not glob:
-            continue
-        hits = [p for p in REPO_ROOT.glob(glob) if p.is_file()]
-        per_glob_matches[glob] = hits
-        per_glob_min_lines[glob] = min_lines
-        if not hits:
-            errors.append(f"{question!r}: required_assets glob {glob!r} matched no files")
-
-    if errors:
-        return errors
-
-    # Per-glob line-count gate: at least one matched file per glob must reach
-    # that glob's min_lines (either the fixture-level required_min_lines or
-    # the glob's own override). Each asset group represents a distinct
-    # required piece of evidence for the question.
-    for glob, hits in per_glob_matches.items():
-        floor = per_glob_min_lines[glob]
-        long_enough = False
-        for p in hits:
-            try:
-                lines = p.read_text(encoding="utf-8", errors="replace").splitlines()
-                if len(lines) >= floor:
-                    long_enough = True
-                    break
-            except OSError:
-                pass
-        if not long_enough:
-            errors.append(
-                f"{question!r}: no file matching {glob!r} reached "
-                f"required_min_lines={floor}"
-            )
-
-    # Per-file mode restriction: every glob must have at least one file whose
-    # file-level mode is in the allowed set. A fixture cannot pass by borrowing
-    # mode evidence from a different glob's match.
-    if required_modes:
-        for glob, hits in per_glob_matches.items():
-            ok = False
-            for p in hits:
-                m = load_modes_for_file(p)
-                if m in required_modes:
-                    ok = True
-                    break
-            if not ok:
-                errors.append(
-                    f"{question!r}: no file matching {glob!r} has per-file provenance "
-                    f"mode in {sorted(required_modes)}"
-                )
-
-    # Bundle-level mode restriction: every glob must have at least one file
-    # whose ENCLOSING BUNDLE declares asset_mode in the allowed set. This is
-    # what lets a fixture demand e.g. "this question must be backed by at least
-    # one verbatim-bundle asset" even when the bundle is mixed at the per-file
-    # level.
-    if required_bundle_modes:
-        for glob, hits in per_glob_matches.items():
-            ok = False
-            for p in hits:
-                bm = load_bundle_mode_for_file(p)
-                if bm in required_bundle_modes:
-                    ok = True
-                    break
-            if not ok:
-                errors.append(
-                    f"{question!r}: no file matching {glob!r} lives in a bundle with "
-                    f"asset_mode in {sorted(required_bundle_modes)}"
-                )
-
-    # Content regexes must match across the full matched set. Aggregating is
-    # still appropriate here because the content pattern is a statement about
-    # the combined evidence, not per-glob.
-    if required_patterns:
-        aggregate = ""
-        for hits in per_glob_matches.values():
-            for p in hits:
-                try:
-                    aggregate += p.read_text(encoding="utf-8", errors="replace") + "\n"
-                except OSError:
-                    continue
-        for pat in required_patterns:
-            try:
-                if not re.search(pat, aggregate, re.IGNORECASE):
-                    errors.append(f"{question!r}: required_content_pattern {pat!r} not found")
-            except re.error as e:
-                errors.append(f"{question!r}: invalid regex {pat!r}: {e}")
-
-    return errors
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__.split("\n")[0])
-    args = parser.parse_args()
-
-    if not FIXTURES_PATH.is_file():
-        # R27: the module docstring classifies a missing fixture file
-        # as an invocation error (the AC-7 gate is a required input).
-        # `install_precommit_hook.sh` also guards against invoking this
-        # script when the file is absent, so reaching this branch means
-        # the caller bypassed that guard — fail loud (exit 2) instead
-        # of reporting a clean skip that would silently remove the gate
-        # in CI.
-        print(
-            f"ERROR: {FIXTURES_PATH.relative_to(REPO_ROOT)} not found; "
-            f"the AC-7 DoD fixture gate requires this file. If the gate "
-            f"is intentionally being retired, remove the invocation from "
-            f"the pre-commit hook and delete this script instead of "
-            f"deleting the fixtures file.",
-            file=sys.stderr,
-        )
-        sys.exit(2)
-
-    try:
-        data = yaml.safe_load(FIXTURES_PATH.read_text(encoding="utf-8")) or {}
-    except yaml.YAMLError as e:
-        print(f"ERROR: could not parse {FIXTURES_PATH}: {e}", file=sys.stderr)
-        sys.exit(2)
-
-    entries = data.get("fixtures") or []
-    if not entries:
-        # R27: an empty `fixtures:` list collapses the AC-7 gate just
-        # like a missing file. Reject as invocation error rather than
-        # reporting "nothing to check" which looks like a clean pass.
-        print(
-            f"ERROR: {FIXTURES_PATH.relative_to(REPO_ROOT)} has no "
-            f"`fixtures:` entries; AC-7 requires at least one fixture.",
-            file=sys.stderr,
-        )
-        sys.exit(2)
-
-    all_errors = []
-    for entry in entries:
-        if not isinstance(entry, dict):
-            continue
-        all_errors.extend(check_entry(entry))
-
-    print(f"Checked {len(entries)} DoD fixture entries.")
-    if all_errors:
-        for e in all_errors:
-            print(f"  FAIL: {e}", file=sys.stderr)
-        sys.exit(1)
-    print("All fixtures pass.")
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

package/resources/kop-2026-10-23-0.1.17-beta.1/product_capabilities/kernel_optflow/skills/KernelWiki-private/scripts/check_version_freshness.py

@@ -1,207 +0,0 @@
-#!/usr/bin/env python3
-"""Offline freshness checker for the KernelWiki version-claim registry.
-
-Reads checked-in inputs only:
-  - data/tool-versions.yaml      (release-of-record snapshot)
-  - data/version-claims.yaml     (per-claim metadata)
-  - candidates/<repo>.yaml       (ledger searched_at)
-  - data/refresh-cutoff.yaml     (optional; round's refresh cutoff date)
-  - plan-phase*.md               (read first 3 lines for supersession marker)
-
-Prints structured warnings; exits 0 in advisory mode (default), 1 in --strict
-mode when any warning fires.
-
-This script is required to be NETWORK-FREE. A static-analysis check (in CI)
-rejects any future PR that imports HTTP libraries or shells out to git/gh
-for remote fetches; see tests/check_freshness_offline.sh for the exact grep.
-Do not import or shell out to network tools from here.
-"""
-
-from __future__ import annotations
-
-import argparse
-import re
-import sys
-from datetime import date, timedelta
-from pathlib import Path
-
-import yaml
-
-REPO_ROOT = Path(__file__).parent.parent
-DATA_DIR = REPO_ROOT / "data"
-CANDIDATES_DIR = REPO_ROOT / "candidates"
-
-DEFAULT_VERSION_STALENESS_DAYS = 180
-DEFAULT_LEDGER_STALENESS_DAYS = 30
-
-
-def load_yaml(path):
-    if not path.is_file():
-        return None
-    return yaml.safe_load(path.read_text(encoding="utf-8"))
-
-
-def parse_iso(value):
-    """Return a date from a YAML scalar value or raise ValueError. Accepts
-    a string, a datetime.date, or a datetime.datetime (PyYAML may decode
-    YYYY-MM-DD as date and YYYY-MM-DD HH:MM as datetime)."""
-    if hasattr(value, "isoformat") and not isinstance(value, str):
-        # PyYAML already gave us a date / datetime.
-        if hasattr(value, "date"):
-            return value.date()
-        return value
-    return date.fromisoformat(str(value))
-
-
-def is_superseded(plan_path):
-    """Return True if the first three lines of plan_path contain a
-    supersession marker pointing to a successor plan. Honors AC-9 per
-    DEC-7 (per-file header mode)."""
-    if not plan_path.is_file():
-        return False
-    head = plan_path.read_text(encoding="utf-8").splitlines()[:3]
-    return any(re.search(r"^>\s*Superseded by", line, re.IGNORECASE) for line in head)
-
-
-def check_tool_versions(tool_versions, today, version_staleness_days):
-    """Yield (severity, message) tuples for each tool/release entry."""
-    threshold = today - timedelta(days=version_staleness_days)
-    for tool in tool_versions.get("tools", []):
-        for rel in tool.get("releases", []):
-            name = rel.get("name", "?")
-            ra = rel.get("released_at")
-            if ra in (None, "needs-verification"):
-                yield "warn", f"tool-versions: {tool['tool']} {name} has released_at={ra!r} (needs-verification)"
-                continue
-            try:
-                ra_date = parse_iso(ra)
-            except ValueError:
-                yield "warn", f"tool-versions: {tool['tool']} {name} has unparseable released_at={ra!r}"
-                continue
-            if ra_date < threshold:
-                age_days = (today - ra_date).days
-                yield "info", f"tool-versions: {tool['tool']} {name} released {age_days}d ago (>= {version_staleness_days}d staleness threshold)"
-
-
-def check_version_claims(claims_data, tool_versions, today, version_staleness_days):
-    """Yield (severity, message) tuples for each version-claim registry entry."""
-    if claims_data is None:
-        return
-    threshold = today - timedelta(days=version_staleness_days)
-    # Build a release-name set from tool-versions for forward resolution.
-    known_releases = set()
-    for tool in tool_versions.get("tools", []):
-        for rel in tool.get("releases", []):
-            known_releases.add(rel.get("name"))
-    for claim in claims_data.get("claims", []) or []:
-        cid = claim.get("id", "?")
-        verified_at = claim.get("last_verified_at")
-        verified_release = claim.get("last_verified_release")
-        if verified_at is None:
-            yield "warn", f"version-claims: {cid} missing last_verified_at"
-        else:
-            try:
-                va_date = parse_iso(verified_at)
-                if va_date < threshold:
-                    age_days = (today - va_date).days
-                    yield "warn", f"version-claims: {cid} last_verified_at={va_date.isoformat()} ({age_days}d ago, >= {version_staleness_days}d threshold)"
-            except ValueError:
-                yield "warn", f"version-claims: {cid} unparseable last_verified_at={verified_at!r}"
-        if verified_release and verified_release not in known_releases:
-            yield "warn", f"version-claims: {cid} last_verified_release={verified_release!r} not in data/tool-versions.yaml"
-
-
-def check_ledger_freshness(today, ledger_staleness_days, refresh_cutoff):
-    """Yield (severity, message) tuples for each candidate ledger whose
-    searched_at is older than the threshold (or older than the refresh
-    cutoff, whichever is tighter)."""
-    if not CANDIDATES_DIR.is_dir():
-        return
-    threshold = today - timedelta(days=ledger_staleness_days)
-    for ledger_file in sorted(CANDIDATES_DIR.glob("*.yaml")):
-        data = load_yaml(ledger_file)
-        if not isinstance(data, dict):
-            continue
-        sa = data.get("searched_at")
-        if sa is None:
-            yield "warn", f"ledger {ledger_file.name}: missing searched_at"
-            continue
-        try:
-            sa_date = parse_iso(sa)
-        except ValueError:
-            yield "warn", f"ledger {ledger_file.name}: unparseable searched_at={sa!r}"
-            continue
-        if refresh_cutoff and sa_date != refresh_cutoff:
-            yield "info", f"ledger {ledger_file.name}: searched_at={sa_date.isoformat()} disagrees with refresh-cutoff {refresh_cutoff.isoformat()}"
-        elif not refresh_cutoff and sa_date < threshold:
-            age_days = (today - sa_date).days
-            yield "warn", f"ledger {ledger_file.name}: searched_at={sa_date.isoformat()} ({age_days}d ago, >= {ledger_staleness_days}d threshold)"
-
-
-def check_supersession(today):
-    """Yield (severity, message) tuples for each plan-phase*.md not
-    properly marked superseded. Honors AC-9 per DEC-7."""
-    for plan_path in sorted(REPO_ROOT.glob("plan-phase*.md")):
-        # plan-phase4.md is the current round and should NOT have a supersession header.
-        if plan_path.name == "plan-phase4.md":
-            if is_superseded(plan_path):
-                yield "warn", f"{plan_path.name}: current-round plan should not be superseded"
-            continue
-        if not is_superseded(plan_path):
-            yield "warn", f"{plan_path.name}: missing supersession header in first 3 lines (AC-9)"
-
-
-def main():
-    parser = argparse.ArgumentParser(description="Offline freshness checker for KernelWiki")
-    parser.add_argument("--strict", action="store_true",
-                        help="Exit 1 if any warning fires (default: advisory exit 0).")
-    parser.add_argument("--today", default=None,
-                        help="Override today's date for testing (YYYY-MM-DD).")
-    parser.add_argument("--version-staleness-days", type=int,
-                        default=DEFAULT_VERSION_STALENESS_DAYS)
-    parser.add_argument("--ledger-staleness-days", type=int,
-                        default=DEFAULT_LEDGER_STALENESS_DAYS)
-    args = parser.parse_args()
-
-    if args.today:
-        today = date.fromisoformat(args.today)
-    else:
-        today = date.today()
-
-    tool_versions = load_yaml(DATA_DIR / "tool-versions.yaml") or {}
-    claims = load_yaml(DATA_DIR / "version-claims.yaml") or {}
-    refresh_cutoff_data = load_yaml(DATA_DIR / "refresh-cutoff.yaml")
-    refresh_cutoff = None
-    if refresh_cutoff_data and "cutoff_date" in refresh_cutoff_data:
-        try:
-            refresh_cutoff = parse_iso(refresh_cutoff_data["cutoff_date"])
-        except ValueError:
-            print(f"WARN: data/refresh-cutoff.yaml::cutoff_date is unparseable: "
-                  f"{refresh_cutoff_data['cutoff_date']!r}", file=sys.stderr)
-
-    findings = []
-    findings.extend(check_tool_versions(tool_versions, today, args.version_staleness_days))
-    findings.extend(check_version_claims(claims, tool_versions, today, args.version_staleness_days))
-    findings.extend(check_ledger_freshness(today, args.ledger_staleness_days, refresh_cutoff))
-    findings.extend(check_supersession(today))
-
-    warns = [m for s, m in findings if s == "warn"]
-    infos = [m for s, m in findings if s == "info"]
-
-    print(f"check_version_freshness.py — today={today.isoformat()}, "
-          f"version-staleness={args.version_staleness_days}d, "
-          f"ledger-staleness={args.ledger_staleness_days}d")
-    print(f"  {len(warns)} warnings, {len(infos)} info messages")
-    for m in warns:
-        print(f"  WARN: {m}")
-    for m in infos:
-        print(f"  INFO: {m}")
-
-    if args.strict and warns:
-        print(f"\n--strict: {len(warns)} warning(s) -> exit 1", file=sys.stderr)
-        sys.exit(1)
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()