@lamentis/naome 1.3.17 → 1.4.1

package/Cargo.lock

@@ -76,7 +76,7 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "naome-cli"
-version = "1.3.17"
+version = "1.4.1"
 dependencies = [
  "naome-core",
  "serde_json",
@@ -84,7 +84,7 @@ dependencies = [
 
 [[package]]
 name = "naome-core"
-version = "1.3.17"
+version = "1.4.1"
 dependencies = [
  "serde",
  "serde_json",

package/crates/naome-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "naome-cli"
-version = "1.3.17"
+version = "1.4.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

package/crates/naome-cli/src/architecture_commands.rs

@@ -2,9 +2,9 @@ use std::fs;
 use std::path::{Path, PathBuf};
 
 use naome_core::{
-    config_findings_for, format_architecture_explain, format_architecture_scan,
-    format_architecture_validation, scan_architecture, validate_architecture,
-    ArchitectureScanOptions, ARCHITECTURE_RULE_IDS,
+    architecture_validation_sarif_with_root, config_findings_for, format_architecture_explain,
+    format_architecture_scan, format_architecture_validation, scan_architecture,
+    validate_architecture, ArchitectureScanOptions, ARCHITECTURE_RULE_IDS,
 };
 
 use crate::architecture_init::architecture_init_config_text;
@@ -88,6 +88,19 @@ fn run_arch_validate(root: &Path, args: &[String]) -> Result<(), Box<dyn std::er
         root,
         scan_options(root, args, has_flag(args, "--changed-only")),
     )?;
+    if has_flag(args, "--sarif") {
+        let output =
+            serde_json::to_string_pretty(&architecture_validation_sarif_with_root(&report, root))?;
+        if let Some(path) = option_value(args, "--output") {
+            fs::write(root.join(path), output)?;
+        } else {
+            println!("{output}");
+        }
+        if report.status == "fail" {
+            std::process::exit(1);
+        }
+        return Ok(());
+    }
     let json = has_flag(args, "--json") || has_flag(args, "--agent-feedback");
     if json {
         if has_flag(args, "--agent-feedback") {

package/crates/naome-cli/src/main.rs

@@ -37,6 +37,15 @@ const HELP: &str = r#"Usage:
   naome sync [--package-root <path>] [--installer-js <path>]
   naome install-plan [--harness-version <version>]
   naome seed-verification
+  naome task status [--json] [--exit-code]
+  naome task proof-plan [--json] [--exit-code]
+  naome task can-transition --to complete [--json]
+  naome task can-commit --json
+  naome task repair --plan <id> --dry-run --json
+  naome task record-proof --from-proof-plan [--dry-run] --json
+  naome task request-scope --path <path> --reason <reason> --json
+  naome task timeline --json
+  naome task loop-snapshot --json
   naome task render-state [--write] [--json]
   naome task migrate-ledger [--write] [--json]
   naome refresh-integrity [--root <path>] [--json]
@@ -62,7 +71,7 @@ const HELP: &str = r#"Usage:
   naome arch init [--config <path>] [--json]
   naome arch explain [--config <path>] [--json]
   naome arch scan [--config <path>] [--changed-only] [--write] [--output <path>] [--json]
-  naome arch validate [--config <path>] [--changed-only] [--agent-feedback] [--json]
+  naome arch validate [--config <path>] [--changed-only] [--agent-feedback] [--json|--sarif] [--output <path>]
   naome workflow search-profile [--json]
   naome workflow agent-plan [--json]
   naome workflow context-delta [--read-path <path>...] [--json]

package/crates/naome-cli/src/task_commands/common.rs

@@ -0,0 +1,32 @@
+use std::fs;
+use std::path::Path;
+
+use serde_json::Value;
+
+pub(super) fn read_task_state(root: &Path) -> Result<Value, Box<dyn std::error::Error>> {
+    Ok(serde_json::from_str(&fs::read_to_string(
+        root.join(".naome/task-state.json"),
+    )?)?)
+}
+
+pub(super) fn print_json(value: Value) -> Result<(), Box<dyn std::error::Error>> {
+    println!("{}", serde_json::to_string_pretty(&value)?);
+    Ok(())
+}
+
+pub(super) fn value_after<'a>(args: &'a [String], flag: &str) -> Option<&'a str> {
+    args.windows(2)
+        .find(|window| window[0] == flag)
+        .map(|window| window[1].as_str())
+}
+
+pub(super) fn repeated_values(args: &[String], flag: &str) -> Vec<String> {
+    let mut values = args
+        .windows(2)
+        .filter(|window| window[0] == flag)
+        .map(|window| window[1].clone())
+        .collect::<Vec<_>>();
+    values.sort();
+    values.dedup();
+    values
+}

package/crates/naome-cli/src/task_commands/readiness.rs

@@ -0,0 +1,40 @@
+use std::collections::BTreeSet;
+use std::path::Path;
+
+use naome_core::{task_status_report, task_transition_readiness};
+use serde_json::json;
+
+use super::common::print_json;
+
+pub(super) fn can_commit(root: &Path, _args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let status = task_status_report(root)?;
+    let transition = task_transition_readiness(root, "complete")?;
+    let required = commit_requirements(&status, &transition.blocking_findings);
+    print_json(json!({
+        "schema": "naome.task.commit-readiness.v1",
+        "allowed": transition.allowed && status.agent_loop.can_commit && required.is_empty(),
+        "commitPaths": status.scope.in_scope_changed_paths,
+        "blockingFindings": transition.blocking_findings,
+        "requiredBeforeCommit": required,
+        "agentLoop": status.agent_loop
+    }))
+}
+
+fn commit_requirements(
+    status: &naome_core::TaskStatusReportV1,
+    blockers: &[naome_core::TaskStatusFinding],
+) -> Vec<String> {
+    let mut requirements = BTreeSet::new();
+    for check in status
+        .proof
+        .missing_checks
+        .iter()
+        .chain(status.proof.stale_checks.iter())
+    {
+        requirements.insert(format!("Run and record required check: {check}."));
+    }
+    for finding in blockers {
+        requirements.insert(finding.suggested_fix.clone());
+    }
+    requirements.into_iter().collect()
+}

package/crates/naome-cli/src/task_commands/record.rs

@@ -0,0 +1,134 @@
+use std::fs;
+use std::path::Path;
+
+use naome_core::task_proof_plan;
+use serde_json::{json, Value};
+
+use super::common::{print_json, read_task_state};
+
+pub(super) fn record_proof(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    if !args.iter().any(|arg| arg == "--from-proof-plan") {
+        return Err("naome task record-proof requires --from-proof-plan".into());
+    }
+    let plan = task_proof_plan(root)?;
+    let dry_run = args.iter().any(|arg| arg == "--dry-run");
+    let recorded = !dry_run && !plan.proof_recording.checks_to_record.is_empty();
+    let recorded_ids = if recorded {
+        write_proof_batch(root, &plan.proof_recording)?
+    } else {
+        RecordedProof {
+            path_set_id: plan.proof_recording.path_set_id.clone(),
+            proof_batch_id: plan.proof_recording.proof_batch_id.clone(),
+        }
+    };
+    if dry_run && !plan.proof_recording.checks_to_record.is_empty() {
+        print_json(json!({
+            "schema": "naome.task.record-proof.v1",
+            "dryRun": dry_run,
+            "recorded": recorded,
+            "pathSetId": recorded_ids.path_set_id,
+            "paths": plan.proof_recording.paths,
+            "proofBatchId": recorded_ids.proof_batch_id,
+            "checksRecorded": plan.proof_recording.checks_to_record,
+            "agentInstruction": "Record proof only after the listed checks exited 0 for the current task diff."
+        }))?;
+        return Ok(());
+    }
+    print_json(json!({
+        "schema": "naome.task.record-proof.v1",
+        "dryRun": dry_run,
+        "recorded": recorded,
+        "pathSetId": recorded_ids.path_set_id,
+        "paths": plan.proof_recording.paths,
+        "proofBatchId": recorded_ids.proof_batch_id,
+        "checksRecorded": plan.proof_recording.checks_to_record,
+        "agentInstruction": "Record proof only after the listed checks exited 0 for the current task diff."
+    }))
+}
+
+struct RecordedProof {
+    path_set_id: String,
+    proof_batch_id: String,
+}
+
+fn write_proof_batch(
+    root: &Path,
+    recording: &naome_core::ProofRecording,
+) -> Result<RecordedProof, Box<dyn std::error::Error>> {
+    let path = root.join(".naome/task-state.json");
+    let mut state = read_task_state(root)?;
+    let checked_at = state
+        .get("updatedAt")
+        .and_then(Value::as_str)
+        .unwrap_or("1970-01-01T00:00:00.000Z")
+        .to_string();
+    let active = state
+        .get_mut("activeTask")
+        .and_then(Value::as_object_mut)
+        .ok_or("task-state has no activeTask object")?;
+    let path_sets = active
+        .entry("proofPathSets")
+        .or_insert_with(|| json!({}))
+        .as_object_mut()
+        .ok_or("activeTask.proofPathSets must be an object")?;
+    let path_set_id = unique_path_set_id(path_sets, &recording.path_set_id);
+    path_sets.insert(path_set_id.clone(), json!(recording.paths));
+    let batches = active
+        .entry("proofBatches")
+        .or_insert_with(|| json!([]))
+        .as_array_mut()
+        .ok_or("activeTask.proofBatches must be an array")?;
+    let proof_batch_id = unique_proof_batch_id(batches, &recording.proof_batch_id);
+    batches.push(proof_batch(
+        recording,
+        &checked_at,
+        &path_set_id,
+        &proof_batch_id,
+    ));
+    fs::write(path, format!("{}\n", serde_json::to_string_pretty(&state)?))?;
+    Ok(RecordedProof {
+        path_set_id,
+        proof_batch_id,
+    })
+}
+
+fn proof_batch(
+    recording: &naome_core::ProofRecording,
+    checked_at: &str,
+    path_set_id: &str,
+    proof_batch_id: &str,
+) -> Value {
+    json!({
+        "id": proof_batch_id,
+        "checkedAt": checked_at,
+        "evidencePathSet": path_set_id,
+        "proofs": recording.checks_to_record.iter().map(|check_id| {
+            json!({ "checkId": check_id, "exitCode": 0 })
+        }).collect::<Vec<_>>()
+    })
+}
+
+fn unique_path_set_id(path_sets: &serde_json::Map<String, Value>, base: &str) -> String {
+    unique_id(base, |candidate| path_sets.contains_key(candidate))
+}
+
+fn unique_proof_batch_id(batches: &[Value], base: &str) -> String {
+    unique_id(base, |candidate| {
+        batches
+            .iter()
+            .any(|batch| batch.get("id").and_then(Value::as_str) == Some(candidate))
+    })
+}
+
+fn unique_id(base: &str, exists: impl Fn(&str) -> bool) -> String {
+    if !exists(base) {
+        return base.to_string();
+    }
+    for index in 2.. {
+        let candidate = format!("{base}-{index}");
+        if !exists(&candidate) {
+            return candidate;
+        }
+    }
+    unreachable!("unbounded proof id suffix search must find an available id")
+}

package/crates/naome-cli/src/task_commands/repair.rs

@@ -0,0 +1,30 @@
+use std::path::Path;
+
+use naome_core::task_status_report;
+use serde_json::json;
+
+use super::common::{print_json, value_after};
+
+pub(super) fn repair_preview(
+    root: &Path,
+    args: &[String],
+) -> Result<(), Box<dyn std::error::Error>> {
+    if !args.iter().any(|arg| arg == "--dry-run") {
+        return Err("naome task repair requires --dry-run in v1.4.1".into());
+    }
+    let plan_id = value_after(args, "--plan").ok_or("naome task repair requires --plan <id>")?;
+    let status = task_status_report(root)?;
+    let plan = status
+        .repair_plan
+        .iter()
+        .find(|item| item.id == plan_id)
+        .cloned();
+    print_json(json!({
+        "schema": "naome.task.repair-preview.v1",
+        "planId": plan_id,
+        "found": plan.is_some(),
+        "wouldExecute": false,
+        "plan": plan,
+        "agentInstruction": "Review this dry-run output and execute only safe commands explicitly allowed by NAOME."
+    }))
+}

package/crates/naome-cli/src/task_commands/scope_request.rs

@@ -0,0 +1,24 @@
+use std::path::Path;
+
+use serde_json::json;
+
+use super::common::{print_json, repeated_values, value_after};
+
+pub(super) fn request_scope(
+    _root: &Path,
+    args: &[String],
+) -> Result<(), Box<dyn std::error::Error>> {
+    let requested_paths = repeated_values(args, "--path");
+    if requested_paths.is_empty() {
+        return Err("naome task request-scope requires at least one --path".into());
+    }
+    let reason = value_after(args, "--reason").unwrap_or("No reason provided.");
+    print_json(json!({
+        "schema": "naome.task.scope-request.v1",
+        "wouldMutate": false,
+        "requestedPaths": requested_paths,
+        "reason": reason,
+        "suggestedFix": "Ask for an explicit task-scope revision before editing these paths.",
+        "agentInstruction": "Do not edit requested paths until a human or deterministic task revision admits them."
+    }))
+}

package/crates/naome-cli/src/task_commands/timeline.rs

@@ -0,0 +1,71 @@
+use std::path::Path;
+
+use naome_core::task_status_report;
+use serde_json::{json, Value};
+
+use super::common::{print_json, read_task_state};
+
+pub(super) fn timeline(root: &Path, _args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let status = task_status_report(root)?;
+    let state = read_task_state(root)?;
+    let active = state.get("activeTask").unwrap_or(&Value::Null);
+    let mut events = admission_events(active);
+    events.extend(proof_events(active));
+    events.push(json!({ "type": "current_diff", "paths": status.scope.changed_paths }));
+    print_json(json!({
+        "schema": "naome.task.timeline.v1",
+        "state": status.state,
+        "taskId": status.task_id,
+        "events": events
+    }))
+}
+
+pub(super) fn loop_snapshot(
+    root: &Path,
+    _args: &[String],
+) -> Result<(), Box<dyn std::error::Error>> {
+    let status = task_status_report(root)?;
+    print_json(json!({
+        "schema": "naome.task.loop-snapshot.v1",
+        "taskId": status.task_id,
+        "state": status.state,
+        "status": {
+            "agentLoop": status.agent_loop,
+            "nextActionV2": status.next_action_v2,
+            "findings": status.findings,
+            "repairPlan": status.repair_plan,
+            "policyHints": status.policy_hints,
+            "recoveryGuidance": status.recovery_guidance
+        },
+        "proof": status.proof
+    }))
+}
+
+fn admission_events(active: &Value) -> Vec<Value> {
+    active
+        .get("admission")
+        .map(|admission| {
+            vec![json!({
+                "type": "admission",
+                "gitHead": admission.get("gitHead").cloned().unwrap_or(Value::Null),
+                "checkedAt": admission.get("checkedAt").cloned().unwrap_or(Value::Null)
+            })]
+        })
+        .unwrap_or_default()
+}
+
+fn proof_events(active: &Value) -> Vec<Value> {
+    active
+        .get("proofBatches")
+        .and_then(Value::as_array)
+        .into_iter()
+        .flatten()
+        .map(|batch| {
+            json!({
+                "type": "proof_batch",
+                "id": batch.get("id").cloned().unwrap_or(Value::Null),
+                "checkedAt": batch.get("checkedAt").cloned().unwrap_or(Value::Null)
+            })
+        })
+        .collect()
+}

package/crates/naome-cli/src/task_commands.rs

@@ -1,15 +1,83 @@
 use std::path::Path;
 
-use naome_core::{migrate_task_state_to_ledger, render_task_state_from_ledger};
+mod common;
+mod readiness;
+mod record;
+mod repair;
+mod scope_request;
+mod timeline;
+
+use naome_core::{
+    format_task_proof_plan, format_task_status, migrate_task_state_to_ledger,
+    render_task_state_from_ledger, task_proof_plan, task_status_exit_code, task_status_report,
+    task_transition_readiness,
+};
 
 pub fn run_task_command(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
     match args.get(1).map(String::as_str) {
         Some("render-state") => render_state(root, args),
         Some("migrate-ledger") => migrate_ledger(root, args),
+        Some("status") => task_status(root, args),
+        Some("proof-plan") => proof_plan(root, args),
+        Some("can-transition") => can_transition(root, args),
+        Some("repair") => repair::repair_preview(root, args),
+        Some("record-proof") => record::record_proof(root, args),
+        Some("request-scope") => scope_request::request_scope(root, args),
+        Some("can-commit") => readiness::can_commit(root, args),
+        Some("timeline") => timeline::timeline(root, args),
+        Some("loop-snapshot") => timeline::loop_snapshot(root, args),
         _ => Err("unknown task command".into()),
     }
 }
 
+fn task_status(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let report = task_status_report(root)?;
+    if args.iter().any(|arg| arg == "--json") {
+        println!("{}", serde_json::to_string_pretty(&report)?);
+    } else {
+        print!("{}", format_task_status(&report));
+    }
+    exit_if_requested(args, task_status_exit_code(&report.findings, &report.proof));
+    Ok(())
+}
+
+fn proof_plan(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let report = task_proof_plan(root)?;
+    if args.iter().any(|arg| arg == "--json") {
+        println!("{}", serde_json::to_string_pretty(&report)?);
+    } else {
+        print!("{}", format_task_proof_plan(&report));
+    }
+    exit_if_requested(args, task_status_exit_code(&report.findings, &report.proof));
+    Ok(())
+}
+
+fn can_transition(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let Some(target) = args
+        .windows(2)
+        .find(|window| window[0] == "--to")
+        .map(|window| window[1].as_str())
+    else {
+        return Err("naome task can-transition requires --to complete".into());
+    };
+    let report = task_transition_readiness(root, target)?;
+    if args.iter().any(|arg| arg == "--json") {
+        println!("{}", serde_json::to_string_pretty(&report)?);
+    } else {
+        println!(
+            "NAOME task transition {target}: {}",
+            if report.allowed { "allowed" } else { "blocked" }
+        );
+    }
+    Ok(())
+}
+
+fn exit_if_requested(args: &[String], code: i32) {
+    if args.iter().any(|arg| arg == "--exit-code") {
+        std::process::exit(code);
+    }
+}
+
 fn render_state(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
     let write = args.iter().any(|arg| arg == "--write");
     let json = args.iter().any(|arg| arg == "--json");

package/crates/naome-cli/tests/task_cli.rs

@@ -0,0 +1,58 @@
+use std::process::Command;
+
+use serde_json::{json, Value};
+
+mod task_cli_support;
+
+use task_cli_support::{fixture_root, init_git, task_state, write_fixture_file};
+
+#[test]
+fn task_status_json_reports_scope_and_next_action() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let output = Command::new(env!("CARGO_BIN_EXE_naome"))
+        .args(["task", "status", "--json"])
+        .current_dir(&root)
+        .output()
+        .unwrap();
+
+    assert_success(&output);
+    let payload: Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(payload["schema"], "naome.task.status.v1");
+    assert_eq!(
+        payload["scope"]["inScopeChangedPaths"],
+        json!(["README.md"])
+    );
+    assert_eq!(payload["nextActionV2"]["type"], "rerun_checks");
+    assert_eq!(payload["agentLoop"]["state"], "blocked_by_missing_proof");
+}
+
+#[test]
+fn task_proof_plan_human_output_lists_recommended_commands() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let output = Command::new(env!("CARGO_BIN_EXE_naome"))
+        .args(["task", "proof-plan"])
+        .current_dir(root)
+        .output()
+        .unwrap();
+
+    assert_success(&output);
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("agent loop: blocked_by_missing_proof"));
+    assert!(stdout.contains("recommended commands:"));
+    assert!(stdout.contains("diff-check: git diff --check"));
+}
+
+fn assert_success(output: &std::process::Output) {
+    assert!(
+        output.status.success(),
+        "{}{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+}