@lamentis/naome 1.3.17 → 1.4.1

package/crates/naome-core/src/task_state/status/transition.rs

@@ -0,0 +1,73 @@
+use super::control::agent_loop;
+use super::model::{finding, TaskProofStatus, TaskStatusFinding, TransitionReadinessReport};
+use super::report_context::TaskStatusContext;
+
+pub(super) fn transition_report(
+    context: TaskStatusContext,
+    target_state: &str,
+) -> TransitionReadinessReport {
+    let agent_loop = agent_loop(
+        &context.state,
+        &context.proof,
+        &context.findings,
+        &context.scope,
+    );
+    let blocking_findings = transition_blockers(&context.state, &context.findings, &context.proof);
+    let required_before_transition = blocking_findings
+        .iter()
+        .map(|finding| finding.suggested_fix.clone())
+        .collect::<Vec<_>>();
+    TransitionReadinessReport {
+        schema: "naome.task.transition-readiness.v1".to_string(),
+        target_state: target_state.to_string(),
+        allowed: blocking_findings.is_empty(),
+        blocking_findings,
+        required_before_transition,
+        agent_loop,
+    }
+}
+
+fn transition_blockers(
+    state: &str,
+    findings: &[TaskStatusFinding],
+    proof: &TaskProofStatus,
+) -> Vec<TaskStatusFinding> {
+    let mut blockers = findings
+        .iter()
+        .filter(|finding| {
+            finding.severity == "error" || finding.id == "task.state.completed_task_has_diff"
+        })
+        .cloned()
+        .collect::<Vec<_>>();
+    if matches!(state, "idle" | "missing") {
+        blockers.push(finding(
+            "task.transition.no_active_task",
+            "error",
+            "No active task can transition to complete.",
+            None,
+            "Create or recover an active task before completing.",
+            "Do not complete an idle or missing task.",
+        ));
+    }
+    if matches!(state, "blocked" | "needs_human_review") {
+        blockers.push(finding(
+            "task.transition.blocked_state",
+            "error",
+            format!("Task state {state} cannot transition to complete."),
+            None,
+            "Resolve the blocker or required human review before completing the task.",
+            "Do not complete a blocked task state.",
+        ));
+    }
+    if !proof.stale_checks.is_empty() {
+        blockers.push(finding(
+            "task.transition.stale_proof",
+            "error",
+            "Task has stale proof.",
+            None,
+            "Rerun stale checks and record fresh proof.",
+            "Do not complete a task with stale proof.",
+        ));
+    }
+    blockers
+}

package/crates/naome-core/src/task_state/status.rs

@@ -0,0 +1,23 @@
+mod agent_model;
+mod control;
+mod git;
+mod model;
+mod proof;
+mod proof_read;
+mod report;
+mod report_context;
+mod report_support;
+mod scope;
+mod transition;
+
+pub use agent_model::{
+    AgentLoop, NextActionV2, PolicyHints, ProofRecording, ProofRecordingAfterSuccess,
+    RecoveryGuidance, RepairPlanItem,
+};
+pub use control::task_status_exit_code;
+pub use model::{
+    TaskFeedback, TaskGitStatus, TaskModeStatus, TaskProofPlanReport, TaskProofStatus,
+    TaskRecommendedCommand, TaskScopeStatus, TaskStatusFinding, TaskStatusReportV1,
+    TransitionReadinessReport,
+};
+pub use report::{task_proof_plan, task_status_report, task_transition_readiness};

package/crates/naome-core/src/task_state/status_output.rs

@@ -0,0 +1,103 @@
+use super::status::{TaskProofPlanReport, TaskProofStatus, TaskStatusFinding, TaskStatusReportV1};
+
+pub fn format_task_status(report: &TaskStatusReportV1) -> String {
+    let mut lines = vec![
+        format!("NAOME task status {}", report.state),
+        format!("agent loop: {}", report.agent_loop.state),
+        format!("next machine action: {}", report.next_action_v2.action_type),
+        format!("task: {}", report.task_id.as_deref().unwrap_or("<none>")),
+        format!("request: {}", report.request.as_deref().unwrap_or("<none>")),
+        format!(
+            "git head: {}",
+            report.git.head.as_deref().unwrap_or("<none>")
+        ),
+        format!(
+            "admission head: {}",
+            report.git.admission_head.as_deref().unwrap_or("<none>")
+        ),
+        format!(
+            "admission reachable: {}",
+            report.git.admission_head_reachable
+        ),
+        format!("changed files: {}", report.scope.changed_paths.len()),
+        format!(
+            "in scope: {}",
+            display_list(&report.scope.in_scope_changed_paths)
+        ),
+        format!(
+            "out of scope: {}",
+            display_list(&report.scope.out_of_scope_changed_paths)
+        ),
+    ];
+    append_proof_summary(&mut lines, &report.proof);
+    append_findings(&mut lines, &report.findings);
+    lines.push(format!("next action: {}", report.next_action));
+    lines.push(String::new());
+    lines.join("\n")
+}
+
+pub fn format_task_proof_plan(report: &TaskProofPlanReport) -> String {
+    let mut lines = vec![
+        format!(
+            "NAOME task proof plan {}",
+            report.task_id.as_deref().unwrap_or("<none>")
+        ),
+        format!("agent loop: {}", report.agent_loop.state),
+        format!("next machine action: {}", report.next_action_v2.action_type),
+    ];
+    append_proof_summary(&mut lines, &report.proof);
+    if !report.recommended_commands.is_empty() {
+        lines.push("recommended commands:".to_string());
+        for command in &report.recommended_commands {
+            lines.push(format!(
+                "- {}: {} (cwd {})",
+                command.check_id, command.command, command.cwd
+            ));
+        }
+    }
+    append_findings(&mut lines, &report.findings);
+    lines.push(format!("next action: {}", report.next_action));
+    lines.push(String::new());
+    lines.join("\n")
+}
+
+fn append_proof_summary(lines: &mut Vec<String>, proof: &TaskProofStatus) {
+    lines.push(format!(
+        "required checks: {}",
+        display_list(&proof.required_checks)
+    ));
+    lines.push(format!(
+        "passed checks: {}",
+        display_list(&proof.passed_checks)
+    ));
+    lines.push(format!(
+        "missing checks: {}",
+        display_list(&proof.missing_checks)
+    ));
+    lines.push(format!(
+        "stale checks: {}",
+        display_list(&proof.stale_checks)
+    ));
+}
+
+fn append_findings(lines: &mut Vec<String>, findings: &[TaskStatusFinding]) {
+    if findings.is_empty() {
+        return;
+    }
+    lines.push("findings:".to_string());
+    for finding in findings {
+        lines.push(format!(
+            "- {} {} {}",
+            finding.severity, finding.id, finding.message
+        ));
+        lines.push(format!("  fix: {}", finding.suggested_fix));
+    }
+}
+
+fn display_list(values: &[String]) -> String {
+    if values.is_empty() {
+        "<none>".to_string()
+    } else {
+        values.join(", ")
+    }
+}

package/crates/naome-core/tests/architecture_cache.rs

@@ -210,7 +210,7 @@ fn changed_only_degrades_when_cache_extractor_version_is_stale() {
     let cache_path = repo.path().join(".naome/cache/architecture/cache.json");
     let stale_cache = std::fs::read_to_string(&cache_path)
         .unwrap()
-        .replace("architecture-cache-v1.3.17", "architecture-cache-v1.3.14");
+        .replace("architecture-cache-v1.4.0", "architecture-cache-v1.3.17");
     std::fs::write(cache_path, stale_cache).unwrap();
 
     let report = validate_architecture(repo.path(), changed_only()).unwrap();

package/crates/naome-core/tests/architecture_config.rs

@@ -1,4 +1,7 @@
-use naome_core::{format_architecture_validation, validate_architecture, ArchitectureScanOptions};
+use naome_core::{
+    architecture_validation_sarif_with_root, format_architecture_validation, validate_architecture,
+    ArchitectureScanOptions,
+};
 
 mod architecture_support;
 
@@ -152,3 +155,67 @@ fn validation_reports_unresolved_repo_absolute_imports() {
                 .any(|item| item.contains("unresolved imports"))
     }));
 }
+
+#[test]
+fn validation_sarif_includes_violations_and_config_findings() {
+    let repo = FixtureRepo::new();
+    repo.write(
+        "naome.arch.yaml",
+        r#"
+layers:
+  domain:
+    paths:
+      - "src/domain/**"
+  infrastructure:
+    paths:
+      - "src/infrastructure/**"
+  unused:
+    paths:
+      - "src/unused/**"
+allowed_dependencies:
+  domain:
+  infrastructure:
+rules:
+  no_forbidden_layer_dependencies:
+    enabled: true
+    severity: error
+"#,
+    );
+    repo.write(
+        "src/domain/event.ts",
+        "import { db } from '../infrastructure/db';\nimport missing from './missing';\n",
+    );
+    repo.write("src/infrastructure/db.ts", "export const db = 1;\n");
+
+    let report = validate_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+    let sarif = architecture_validation_sarif_with_root(&report, repo.path());
+    let results = sarif["runs"][0]["results"].as_array().unwrap();
+
+    assert_eq!(sarif["version"], "2.1.0");
+    assert!(sarif["runs"][0]["originalUriBaseIds"]["REPO_ROOT"]["uri"]
+        .as_str()
+        .is_some_and(|uri| uri.starts_with("file://") && uri.ends_with('/')));
+    assert!(results.iter().any(|result| {
+        result["ruleId"] == "arch.no_forbidden_layer_dependencies"
+            && result["level"] == "error"
+            && result["locations"][0]["physicalLocation"]["artifactLocation"]["uri"]
+                == "src/domain/event.ts"
+            && result["locations"][0]["physicalLocation"]["artifactLocation"]["uriBaseId"]
+                == "REPO_ROOT"
+    }));
+    assert!(results.iter().any(|result| {
+        result["ruleId"] == "arch.import.unresolved"
+            && result["level"] == "warning"
+            && result["properties"]["agentInstruction"]
+                .as_str()
+                .is_some_and(|instruction| instruction.contains("./missing"))
+    }));
+    assert!(results.iter().any(|result| {
+        result["ruleId"] == "arch.config.layer_matches_no_files"
+            && result["level"] == "warning"
+            && result["locations"][0]["physicalLocation"]["artifactLocation"]["uri"]
+                == "naome.arch.yaml"
+            && result["locations"][0]["physicalLocation"]["artifactLocation"]["uriBaseId"]
+                == "REPO_ROOT"
+    }));
+}

package/crates/naome-core/tests/task_state_support/mod.rs

@@ -1,3 +1,5 @@
+#![allow(dead_code, unused_imports)]
+
 mod states;
 
 use std::collections::HashMap;
@@ -12,7 +14,7 @@ use serde_json::{json, Value};
 use sha2::{Digest, Sha256};
 pub use states::{
     active_task, complete_task_state, idle_task_state, ready_empty_verification_fixture,
-    successful_admission, successful_proof,
+    successful_admission, successful_proof, task_state_with_status,
 };
 
 static FIXTURE_COUNTER: AtomicU64 = AtomicU64::new(0);
@@ -88,6 +90,18 @@ impl TaskFixture {
         self.refresh_admission_head();
     }
 
+    pub fn set_admission_head(&self, head: &str) {
+        let path = self.root.join(".naome/task-state.json");
+        let mut task_state: Value =
+            serde_json::from_str(&fs::read_to_string(&path).unwrap()).unwrap();
+        task_state["activeTask"]["admission"]["gitHead"] = json!(head);
+        fs::write(
+            path,
+            format!("{}\n", serde_json::to_string_pretty(&task_state).unwrap()),
+        )
+        .unwrap();
+    }
+
     pub fn git<const N: usize>(&self, args: [&str; N]) -> String {
         let output = Command::new("git")
             .args(args)

package/crates/naome-core/tests/task_state_support/states.rs

@@ -12,6 +12,10 @@ pub fn complete_task_state(overrides: Value) -> Value {
     )
 }
 
+pub fn task_state_with_status(status: &str, active_task: Value) -> Value {
+    task_state_record(status, active_task, json!("2026-05-04T12:00:00.000Z"))
+}
+
 fn task_state_record(status: &str, active_task: Value, updated_at: Value) -> Value {
     let mut state: Value = serde_json::from_str(include_str!(
         "../../../../templates/naome-root/.naome/task-state.json"

package/crates/naome-core/tests/task_status.rs

@@ -0,0 +1,301 @@
+#![allow(dead_code, unused_imports)]
+
+use std::fs;
+
+use naome_core::{
+    task_proof_plan, task_status_exit_code, task_status_report, task_transition_readiness,
+};
+use serde_json::{json, Value};
+
+mod task_state_support;
+
+use task_state_support::{
+    active_task, complete_task_state, idle_task_state, successful_proof, task_state_with_status,
+    TaskFixture,
+};
+
+#[test]
+fn clean_idle_status_is_actionable_and_stable_json() {
+    let repo = TaskFixture::new(idle_task_state());
+    repo.init_git();
+
+    let status = task_status_report(repo.path()).unwrap();
+    let value = serde_json::to_value(&status).unwrap();
+
+    assert_eq!(value["schema"], "naome.task.status.v1");
+    assert_eq!(value["state"], "idle");
+    assert_eq!(value["blocked"], false);
+    assert_eq!(value["scope"]["changedPaths"], json!([]));
+    assert!(value["nextAction"]
+        .as_str()
+        .is_some_and(|action| action.contains("Create a NAOME task")));
+    assert_eq!(value["nextActionV2"]["type"], "create_task");
+    assert_eq!(value["agentLoop"]["state"], "ready_for_new_task");
+}
+
+#[test]
+fn implementing_status_splits_in_scope_and_out_of_scope_changes() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "allowedPaths": ["README.md"],
+            "requiredCheckIds": ["diff-check"],
+            "proofResults": []
+        })),
+    ));
+    repo.init_git();
+    repo.write("README.md", "changed\n");
+    repo.write("src/lib.rs", "pub fn outside() {}\n");
+
+    let status = task_status_report(repo.path()).unwrap();
+
+    assert_eq!(status.scope.in_scope_changed_paths, vec!["README.md"]);
+    assert_eq!(status.scope.out_of_scope_changed_paths, vec!["src/lib.rs"]);
+    assert!(status.findings.iter().any(|finding| {
+        finding.id == "task.scope.out_of_scope_change"
+            && finding.path.as_deref() == Some("src/lib.rs")
+            && finding.agent_instruction.contains("Do not commit")
+    }));
+    assert_eq!(status.next_action_v2.action_type, "repair_scope");
+    assert_eq!(status.agent_loop.state, "blocked_by_scope_drift");
+    assert!(status
+        .repair_plan
+        .iter()
+        .any(|item| item.id == "remove_out_of_scope_change_src_lib_rs"
+            && item.paths == vec!["src/lib.rs"]));
+    assert!(status.blocked);
+}
+
+#[test]
+fn completed_task_with_new_diff_reports_unbaselined_diff() {
+    let repo = TaskFixture::new(complete_task_state(json!({
+        "allowedPaths": ["README.md"],
+        "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))],
+    })));
+    repo.init_git();
+    repo.write("README.md", "new diff after completion\n");
+
+    let status = task_status_report(repo.path()).unwrap();
+
+    assert!(status.findings.iter().any(|finding| {
+        finding.id == "task.state.completed_task_has_diff"
+            && finding.path.as_deref() == Some("README.md")
+    }));
+    let transition = task_transition_readiness(repo.path(), "complete").unwrap();
+    assert!(!transition.allowed);
+    assert!(transition
+        .blocking_findings
+        .iter()
+        .any(|finding| finding.id == "task.state.completed_task_has_diff"));
+}
+
+#[test]
+fn proof_plan_reports_missing_and_stale_required_checks() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "allowedPaths": ["README.md", "docs/**"],
+            "requiredCheckIds": ["diff-check"],
+            "proofPathSets": {
+                "old": ["README.md"]
+            },
+            "proofBatches": [{
+                "id": "old-proof",
+                "checkedAt": "2026-05-04T12:00:00.000Z",
+                "evidencePathSet": "old",
+                "proofs": [{ "checkId": "diff-check", "exitCode": 0 }]
+            }]
+        })),
+    ));
+    repo.init_git();
+    repo.write("README.md", "covered\n");
+    repo.write("docs/task.md", "not covered\n");
+
+    let plan = task_proof_plan(repo.path()).unwrap();
+
+    assert_eq!(plan.proof.missing_checks, Vec::<String>::new());
+    assert_eq!(plan.proof.stale_checks, vec!["diff-check"]);
+    assert_eq!(plan.next_action_v2.action_type, "rerun_checks");
+    assert_eq!(plan.agent_loop.state, "blocked_by_stale_proof");
+    assert_eq!(
+        plan.proof_recording.paths,
+        vec!["README.md", "docs/task.md"]
+    );
+    assert_eq!(plan.proof_recording.checks_to_record, vec!["diff-check"]);
+    assert!(plan
+        .repair_plan
+        .iter()
+        .any(|item| item.kind == "rerun_check" && item.check_ids == vec!["diff-check"]));
+    assert!(plan.recommended_commands.iter().any(|command| {
+        command.check_id == "diff-check" && command.command == "git diff --check"
+    }));
+    assert!(plan.task_feedback.iter().any(|feedback| {
+        feedback.problem.contains("Proof evidence") && feedback.files == vec!["docs/task.md"]
+    }));
+}
+
+#[test]
+fn proof_plan_next_action_reports_missing_proof_without_command_metadata() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "allowedPaths": ["README.md"],
+            "requiredCheckIds": ["unknown-check"],
+            "proofResults": []
+        })),
+    ));
+    repo.write_json(
+        ".naome/verification.json",
+        json!({
+            "schema": "naome.verification.v1",
+            "version": 1,
+            "status": "ready",
+            "checks": []
+        }),
+    );
+    repo.init_git();
+    repo.write("README.md", "changed\n");
+
+    let plan = task_proof_plan(repo.path()).unwrap();
+
+    assert!(plan.recommended_commands.is_empty());
+    assert_eq!(plan.proof.missing_checks, vec!["unknown-check"]);
+    assert!(plan.next_action.contains("Recover verification metadata"));
+}
+
+#[test]
+fn transition_readiness_blocks_missing_proof_and_allows_fresh_proof() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "allowedPaths": ["README.md"],
+            "requiredCheckIds": ["diff-check"],
+            "proofResults": []
+        })),
+    ));
+    repo.init_git();
+    repo.write("README.md", "changed\n");
+
+    let blocked = task_transition_readiness(repo.path(), "complete").unwrap();
+    assert!(!blocked.allowed);
+    assert!(blocked
+        .blocking_findings
+        .iter()
+        .any(|finding| finding.id == "task.proof.missing_check"));
+
+    let mut state: Value = serde_json::from_str(
+        &fs::read_to_string(repo.path().join(".naome/task-state.json")).unwrap(),
+    )
+    .unwrap();
+    state["activeTask"]["proofResults"] =
+        json!([successful_proof(json!({ "evidence": ["README.md"] }))]);
+    fs::write(
+        repo.path().join(".naome/task-state.json"),
+        format!("{}\n", serde_json::to_string_pretty(&state).unwrap()),
+    )
+    .unwrap();
+
+    let allowed = task_transition_readiness(repo.path(), "complete").unwrap();
+    assert!(allowed.allowed);
+    assert_eq!(allowed.agent_loop.state, "ready_to_commit");
+}
+
+#[test]
+fn legacy_proof_results_remain_readable_when_fresh() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "allowedPaths": ["README.md"],
+            "requiredCheckIds": ["diff-check"],
+            "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))]
+        })),
+    ));
+    repo.init_git();
+    repo.write("README.md", "covered\n");
+
+    let plan = task_proof_plan(repo.path()).unwrap();
+
+    assert_eq!(plan.proof.passed_checks, vec!["diff-check"]);
+    assert!(plan.proof.missing_checks.is_empty());
+    assert!(plan.proof.stale_checks.is_empty());
+}
+
+#[test]
+fn task_status_reports_no_active_task_and_control_state_only_changes() {
+    let repo = TaskFixture::new(task_state_with_status("idle", Value::Null));
+    repo.init_git();
+    repo.write("README.md", "unowned\n");
+
+    let status = task_status_report(repo.path()).unwrap();
+    assert!(status
+        .findings
+        .iter()
+        .all(|finding| finding.id != "task.scope.out_of_scope_change"));
+    assert!(status
+        .findings
+        .iter()
+        .any(|finding| finding.id == "task.state.no_active_task_with_diff"));
+    assert_eq!(status.next_action_v2.action_type, "create_task");
+    assert_eq!(task_status_exit_code(&status.findings, &status.proof), 50);
+
+    fs::remove_file(repo.path().join("README.md")).unwrap();
+    repo.write(".naome/task-state.json", "{\n  \"status\": \"idle\"\n}\n");
+    let status = task_status_report(repo.path()).unwrap();
+    assert!(status
+        .findings
+        .iter()
+        .any(|finding| finding.id == "task.scope.control_state_only_change"));
+}
+
+#[test]
+fn malformed_task_state_reports_deterministic_status_finding() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({})),
+    ));
+    repo.init_git();
+    repo.write(".naome/task-state.json", "{ invalid json\n");
+
+    let status = task_status_report(repo.path()).unwrap();
+
+    assert!(status
+        .findings
+        .iter()
+        .any(|finding| finding.id == "task.state.invalid_json"));
+    assert_eq!(task_status_exit_code(&status.findings, &status.proof), 40);
+}
+
+#[test]
+fn active_state_without_active_task_is_corrupt_and_cannot_complete() {
+    let repo = TaskFixture::new(task_state_with_status("implementing", Value::Null));
+    repo.init_git();
+
+    let status = task_status_report(repo.path()).unwrap();
+    let transition = task_transition_readiness(repo.path(), "complete").unwrap();
+
+    assert!(status
+        .findings
+        .iter()
+        .any(|finding| finding.id == "task.state.active_task_missing"));
+    assert!(!transition.allowed);
+}
+
+#[test]
+fn blocked_task_states_cannot_transition_to_complete() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "blocked",
+        active_task(json!({
+            "requiredCheckIds": ["diff-check"],
+            "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))]
+        })),
+    ));
+    repo.init_git();
+
+    let transition = task_transition_readiness(repo.path(), "complete").unwrap();
+
+    assert!(!transition.allowed);
+    assert!(transition
+        .blocking_findings
+        .iter()
+        .any(|finding| finding.id == "task.transition.blocked_state"));
+}