@r1z4x/tezgah 1.8.3 → 1.9.0

package/hooks/tezgah_paths.py

@@ -267,7 +267,10 @@ def _toplevel(real):
 
 
 def linked_main(path):
-    """The main checkout of the nearest linked worktree holding `path`, else None.
+    """The main checkout of the nearest linked worktree holding `path`, else None;
+    for a worktree of a bare repository, which has no main checkout, the bare
+    git directory (`_bare_repo`): its `.tezgah` is the workspace no `git worktree
+    remove`, detach or switch touches (plan 098).
 
     Nearest only: `worktrees` asks it about the repository it was handed, so a
     repo nested inside a worktree (a vendored clone, a submodule) answers None and
@@ -275,8 +278,8 @@ def linked_main(path):
     uses. Read from the `.git` pointer file (`gitdir: <main>/.git/worktrees/
     <name>`), never from git: `root_for` runs on every gate call and a session
     start's git forks are pinned. A plain checkout (`.git` is a directory), a
-    submodule (a `/modules/` pointer) and a bare main (no `.git` component)
-    answer None."""
+    submodule (a `/modules/` pointer) and a worktree of a git directory kept
+    apart from its main checkout (`--separate-git-dir`) answer None."""
     top = _toplevel(os.path.realpath(path))
     if not top:
         return None
@@ -314,27 +317,72 @@ def _linked_main_at(top):
     gitdir = os.path.normpath(os.path.join(top, line[len("gitdir:"):].strip()))
     dotgit = os.path.dirname(os.path.dirname(gitdir))
     if os.path.basename(os.path.dirname(gitdir)) != "worktrees" \
-            or os.path.basename(dotgit) != ".git" \
             or not os.path.isfile(os.path.join(gitdir, "commondir")):
         return None
-    return os.path.realpath(os.path.dirname(dotgit))
+    if os.path.basename(dotgit) == ".git":
+        return os.path.realpath(os.path.dirname(dotgit))
+    return os.path.realpath(dotgit) if _bare_repo(dotgit) else None
+
+
+def _bare_repo(path):
+    """True when `path` is the git directory of a bare repository: a `HEAD`, an
+    `objects/` and `core.bare` set in its config, read without a git fork."""
+    if not (os.path.isfile(os.path.join(path, "HEAD"))
+            and os.path.isdir(os.path.join(path, "objects"))):
+        return False
+    section = ""
+    try:
+        with open(os.path.join(path, "config"), encoding="utf-8", errors="replace") as fh:
+            for line in fh:
+                line = line.strip()
+                if not line or line[0] in "#;":
+                    continue
+                if line.startswith("["):
+                    section = line.strip("[]").split('"')[0].strip().lower()
+                    continue
+                key, eq, value = line.partition("=")
+                if section == "core" and key.strip().lower() == "bare":
+                    return not eq or value.strip().lower() in ("true", "yes", "on", "1")
+    except OSError:
+        pass
+    return False
+
+
+def _admin_dir(main):
+    """The git directory of the main checkout `main` (`<main>/.git`), or `main`
+    itself when it is a bare repository's; None for neither."""
+    dot = os.path.join(main, ".git")
+    if os.path.isdir(dot):
+        return dot
+    return main if _bare_repo(main) else None
+
+
+def work_tree(repo, cwd=None):
+    """The checkout whose project files a command about `repo` reads: `repo`
+    itself, unless it is a bare repository's git directory, which holds the
+    workspace and no project file (plan 098) - then the worktree of it holding
+    `cwd` (the process's by default), else `repo`."""
+    if not _bare_repo(repo):
+        return repo
+    top = _toplevel(os.path.realpath(cwd or os.getcwd()))
+    return top if top and linked_main(top) == os.path.realpath(repo) else repo
 
 
 def worktrees(repo):
     """Every checkout of the repository `repo` is in, main first, as real paths;
-    [] outside a git checkout.
+    [] outside a git checkout. A bare repository's git directory stands first,
+    in the main checkout's place (`linked_main`).
 
     Fork-free, from `<main>/.git/worktrees/*/gitdir` (each names a linked
     worktree's `.git`). An entry whose target is gone - deleted without `git
     worktree remove` - is skipped: git itself keeps it, marked prunable, until
-    `git worktree prune`. Each checkout keeps its own `.tezgah`; this only names
-    them."""
-    main = linked_main(repo)
-    if not main:
-        main = _toplevel(os.path.realpath(repo))
-        if not main or not os.path.isdir(os.path.join(main, ".git")):
-            return []
-    base = os.path.join(main, ".git", "worktrees")
+    `git worktree prune`."""
+    real = os.path.realpath(repo)
+    main = linked_main(real) or (real if _bare_repo(real) else _toplevel(real))
+    admin = _admin_dir(main) if main else None
+    if not admin:
+        return []
+    base = os.path.join(admin, "worktrees")
     out = [main]
     try:
         names = sorted(os.listdir(base))
@@ -1225,14 +1273,18 @@ def _index_tracks_workspace(root):
 
 def ensure_workspace(repo):
     """`<repo>/.tezgah`, created, ignored by the project and holding its own git
-    repository; None when `repo` is not a git work tree or a step failed.
+    repository; None when `repo` is not a git work tree or a bare repository's
+    git directory, or a step failed.
 
     The ignore lines are appended to the project's `.gitignore` only when
-    missing, after every line the user wrote, and nothing is staged. A second
-    call costs three stats and one file read: the subprocess runs only when
-    `.tezgah/.git` does not exist yet. Fail-open: a read-only tree returns None
-    and the session goes on."""
-    if not os.path.exists(os.path.join(repo, ".git")):
+    missing, after every line the user wrote, and nothing is staged; a bare
+    repository gets none, since no worktree reads its git directory as content
+    (its worktrees' links are excluded by `link_workspace`). A second call costs
+    three stats and one file read: the subprocess runs only when `.tezgah/.git`
+    does not exist yet. Fail-open: a read-only tree returns None and the session
+    goes on."""
+    bare = _bare_repo(repo)
+    if not bare and not os.path.exists(os.path.join(repo, ".git")):
         return None
     ws = workspace(repo)
     # A `.tezgah` that is a symlink (or anything but a directory) came with the
@@ -1255,7 +1307,8 @@ def ensure_workspace(repo):
         except FileNotFoundError:
             body = ""
         have = {line.strip().strip("/") for line in body.splitlines()}
-        missing = [line for line in WORKSPACE_IGNORES if line.strip("/") not in have]
+        missing = [] if bare else [line for line in WORKSPACE_IGNORES
+                                   if line.strip("/") not in have]
         if missing:
             with open(path, "a", encoding="utf-8") as fh:
                 fh.write(("\n" if body and not body.endswith("\n") else "")
@@ -1273,16 +1326,17 @@ def ensure_workspace(repo):
 
 def link_workspace(checkout, main):
     """`<checkout>/.tezgah` as a link to the main checkout's workspace, for a
-    linked worktree (plan 100): a relative `.tezgah/...` write from the worktree
-    then lands in the one workspace every checkout reads, instead of a second
+    linked worktree (plan 100), or to a bare repository's when `main` is its git
+    directory (plan 098): a relative `.tezgah/...` write from the worktree then
+    lands in the one workspace every checkout reads, instead of a second
     `.tezgah` that `git worktree remove` deletes. `/.tezgah` goes to the
     repository's `info/exclude`, since the project's `/.tezgah/` ignores only a
     directory. Leaves any existing `.tezgah` alone; None when nothing was made."""
     link, target = workspace(checkout), workspace(main)
-    exclude = os.path.join(main, ".git", "info", "exclude")
-    if (os.path.lexists(link) or not os.path.isdir(target)
-            or not os.path.isdir(os.path.join(main, ".git"))):
+    admin = _admin_dir(main)
+    if os.path.lexists(link) or not os.path.isdir(target) or not admin:
         return None
+    exclude = os.path.join(admin, "info", "exclude")
     try:
         os.makedirs(os.path.dirname(exclude), exist_ok=True)
         try:
@@ -1319,8 +1373,10 @@ def _git_config_paths(repo):
             gitdir = gitdir if os.path.isabs(gitdir) else os.path.join(repo, gitdir)
             out += [os.path.join(gitdir, "config"),
                     os.path.join(gitdir, "..", "..", "config")]
-    elif os.path.isdir(dot):
-        out.append(os.path.join(dot, "config"))
+    else:
+        admin = _admin_dir(repo)
+        if admin:
+            out.append(os.path.join(admin, "config"))
     out.append(os.path.join(HOME, ".gitconfig"))
     out.append(os.path.join(CONFIG_DIR_GIT, "git", "config"))
     return out

package/hooks/tezgah_policy.py

@@ -233,7 +233,10 @@ in a cheaper, deferred, stubbed or partial stand-in for a requested item;
 silently narrowing the scope; deciding an item is unnecessary, "YAGNI" or "out
 of scope" and dropping it; a token gesture (a comment, a TODO, a mention)
 reported as if the item were done; stopping early because the work got long or
-the rest is hard. A requested item may leave scope only when the user takes it
+the rest is hard. Its kind is the ceiling: a research, analysis, review or plan
+ask ends at the written plan, and building that plan is a class-F step (see
+"Ask policy"): asked, and never started in the turn that wrote it. A finding
+outside the ask becomes a plan too, never code. A requested item may leave scope only when the user takes it
 out. If an item looks redundant, impossible or genuinely out of scope, put it in
 the approval batch with "keep it" as the recommended default and keep working on
 it: the work never proceeds on a cut. An unsafe item is a class-F step (see "Ask
@@ -298,7 +301,7 @@ whether the user already decided it (named it this session, or granted it).
 | C. Reversible choice the evidence settles | a fix's scope inside the ask, naming, a palette when tokens exist | decide from evidence; real taste goes in the batch with a default, taken this turn |
 | D. Intent fork | two readings of the ask with different deliverables | batch with a default; do the shared part first and proceed on the default |
 | E. Outward on the user's own remote | push, PR, tag, release, publishing the user's own package | act on a grant written in chat ({GRANT_EXAMPLES}); else ask once per session, never again after a grant |
-| F. Never on a default | force push or history rewrite on a shared ref; deleting data the session did not make; production deploy, stop or migration; a credential, account or identity change; sending to a third party; a spend over `spend_cap` | do all other work first, ask, and wait: silence is no consent, and only an answer that names the action and its target clears it |
+| F. Never on a default | force push or history rewrite on a shared ref; deleting data the session did not make; production deploy, stop or migration; a credential, account or identity change; sending to a third party; a spend over `spend_cap`; building a plan this turn wrote from a research, analysis, review or plan ask | do all other work first, ask, and wait: silence is no consent, and only an answer that names the action and its target clears it |
 | G. {ACCESS} | a credential or grant no tool supplies | take every route that needs none first, then ask once, naming what it unlocks |
 
 A grant is read from the user's prompt and recorded for the session; "artık
@@ -836,7 +839,9 @@ examples. Off: `tezgah-adhd off`, or the repo's `.no-adhd`.
 
 **Deliver the whole ask; never the shortcut.** The request defines the
 deliverable: every named item is in scope until the user says otherwise, and the
-ask is a floor, not a ceiling. Ponytail shrinks the solution, never the request.
+ask is a floor, not a ceiling - its kind is one: a research, analysis, review or
+plan ask ends at the written plan, and building it waits for the user's answer.
+Ponytail shrinks the solution, never the request.
 FORBIDDEN: swapping in a cheaper, deferred or partial stand-in for what was
 asked; silently narrowing scope; deciding a requested item is
 "unnecessary"/"YAGNI" and dropping it; a token gesture reported as done; stopping
@@ -880,7 +885,8 @@ lines: item - blocker - evidence - what unblocks it. No blockers: no heading.
 Work and process - the order, "shall I go on", a check, a plan, a consult
 member, a spend within `spend_cap`, a local merge of the session's branch,
 removing its worktree - are taken and stated in one line, never asked; a taste
-or intent fork goes in the batch with a default taken this turn. An outward step
+or intent fork goes in the batch with a default taken this turn, but building a
+plan this turn wrote waits for the answer. An outward step
 on the user's own remote (push, PR, release, their package) runs on a grant
 ({GRANT_EXAMPLES}), else is asked once. Never on a
 default - ask and wait for an answer naming action and target: a force push,

package/hooks/tezgah_research.py

@@ -2095,7 +2095,8 @@ def append_claim(repo, slug, claim):
         # The judgement runs under the lock and reads the ids from the descriptor
         # holding it (`_claim_ids`): the ids a claim is judged against are the ids
         # the append commits beside.
-        problems = claim_problems(claim, base, repo, held=_claim_ids(base, handle))
+        problems = claim_problems(claim, base, tp.work_tree(repo),
+                                  held=_claim_ids(base, handle))
         if problems:
             if created and os.path.getsize(path) == 0:
                 os.remove(path)
@@ -3556,7 +3557,9 @@ def check_line(repo, slug, git=True, strict=False, code=None):
     `strict=True` turns every guarantee the checker cannot decide into an error.
     `code` is the checkout the check runs in when it is not `repo`: the line
     lives in the main checkout's workspace (plan 097) and its citations and
-    proofs resolve against the checkout whose branch holds the code."""
+    proofs resolve against the checkout whose branch holds the code; unnamed, a
+    bare repository's worktree holding the cwd (`tp.work_tree`, plan 098)."""
+    code = code or tp.work_tree(repo)
     base = line_dir(repo, slug)
     errors, warnings = [], []
     if not os.path.isdir(base):
@@ -3723,12 +3726,13 @@ def done_seal(repo, slug):
     return _check_seal(base)[0], True
 
 
-def failing(repo, git=False):
+def failing(repo, git=False, code=None):
     """(slug, error) pairs, for a one-line session note. Structural only by
     default: the session context must not pay for git history. A line under
     `done/` is read by its seal hashes alone (`check` with `all_lines=False`), and
-    an unsealed one adds nothing (plan 058 part 4)."""
-    return [(slug, err) for slug, row in check(repo, git=git, all_lines=False).items()
+    an unsealed one adds nothing (plan 058 part 4). `code` as for `check_line`."""
+    return [(slug, err) for slug, row in check(repo, git=git, all_lines=False,
+                                               code=code).items()
             for err in row["errors"]]
 
 
@@ -4337,6 +4341,7 @@ def check_orx(repo, orx, strict=False):
         return {"errors": [], "warnings":
                 ["orx is not installed, so the run command registered against this "
                  "repository was not read (TEZGAH_ORX_BIN overrides the lookup)"]}
+    repo = tp.work_tree(repo)
     out, err = _run([orx, "projects", "--json"], cwd=repo)
     if err:
         return {"errors": [], "warnings": ["orx projects could not be read (%s)" % err]}
@@ -4526,7 +4531,7 @@ def _migrate_claims(base, repo, dry_run, problems):
             if claim.get("kind") in KINDS:
                 out.append(raw)
                 continue
-            kind = derive_kind(claim, (base, repo))
+            kind = derive_kind(claim, (base, tp.work_tree(repo)))
             if kind is None:
                 problems.append("claim %s: no kind derived - its proof names no "
                                 "artifact to be a proof of" % label)
@@ -5498,7 +5503,8 @@ def arena_record(repo, problem, budget, evaluator="", metric=""):
     arena = {"problem": problem, "budget": budget}
     if evaluator:
         arena.update({"evaluator": evaluator,
-                      "evaluator_sha256": _digest(os.path.join(repo, evaluator)),
+                      "evaluator_sha256": _digest(os.path.join(tp.work_tree(repo),
+                                                               evaluator)),
                       "metric": metric})
     return arena
 
@@ -5544,7 +5550,7 @@ def evaluator_problem(repo, state):
     if not _text(path):
         return None
     try:
-        now = _digest(os.path.join(repo, path))
+        now = _digest(os.path.join(tp.work_tree(repo), path))
     except OSError:
         now = None
     locked = str(arena.get("evaluator_sha256") or "")

package/hooks/tezgah_stopspec.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
-"""The Stop rule's evidence fold as a declared past-time temporal spec (plan 063,
-roadmap R16), run in shadow beside the imperative `_evidence_block`.
+"""The Stop rule's evidence fold, declared as a past-time temporal spec (plan 063,
+roadmap R16; the fold since plan 101 replaced the imperative one it ran in
+shadow beside).
 
 **What is declared.** `ROW_ATOMS` are the ten row-local predicates the spec reads,
 each computed once per row by the readers `tezgah_integrity` already has.
@@ -8,28 +9,26 @@ each computed once per row by the readers `tezgah_integrity` already has.
 of the trace: `("S", a, b)` is "a since b" (b held at some row and a at every row
 after it), `("O", a)` is "once a", plus `not`/`and`/`or`. `ORDER` is the
 decision list: the first class whose condition holds is the verdict, in the
-order the imperative fold returns them.
+order the Stop rule refuses them (docs/evidence.md, classes 5-10).
 
 **What is not a formula, stated so the bounds cannot be gamed.**
-- The scope selector is `tezgah_integrity._stop_block`, shared with the
-  imperative fold: which rows the fold reads (this turn, the session before this
-  turn, the settled-bookkeeping and idle-turn claim fallbacks), the lost-began
-  path, and the "evidence tampered" guard (a `ledger_damage` row says the trace
-  is not a trace; it is checked before any fold). The spec replaces only the
-  fold the selector calls.
+- The scope selector is `tezgah_integrity._stop_block`, which calls `fold`:
+  which rows the fold reads (this turn, the session before this turn, the
+  settled-bookkeeping and idle-turn claim fallbacks), the lost-began path, and
+  the "evidence tampered" guard (a `ledger_damage` row says the trace is not a
+  trace; it is checked before any fold).
 - `SCOPE_ATOMS`: the turn marker `T`, which scopes "partial failure" to the
   newest turn of the rows given (`_partial_state`).
 - The reply atoms - the external-state claim and the selector's work flag - are
   constants over one trace, passed in, never read off a row.
-- `ESCAPES` lists, before any shadow row exists, the predicates that are not
-  row-local and count against the "<= 3" bar; `NOT_COUNTED` lists the rest of
-  the candidates plan 063 named and why each does not count.
-
-**The monitor** (`fold`) is one in-process pass over the rows at Stop: atoms per
-row, then each formula's value from its value at the previous row. Nothing is
-persisted between Stops. `shadow` records its verdict beside the imperative one
-as a `stop_spec` row and never feeds the verdict; `TEZGAH_STOPSPEC_STRICT` turns a
-disagreement into an exception, for the test suite.
+- `ESCAPES` lists, fixed before the first shadow row, the predicates that are
+  not row-local and count against the "<= 3" bar; `NOT_COUNTED` lists the rest
+  of the candidates plan 063 named and why each does not count.
+
+**The monitor** (`verdict`) is one in-process pass over the rows at Stop: atoms
+per row, then each formula's value from its value at the previous row. Nothing
+is persisted between Stops. `fold` hands the class to
+`tezgah_integrity._evidence_text`, which words the refusal.
 """
 import os
 import sys
@@ -39,8 +38,6 @@ if HERE not in sys.path:
     sys.path.insert(0, HERE)
 import tezgah_integrity as ti  # noqa: E402
 
-STRICT = "TEZGAH_STOPSPEC_STRICT"
-ROW_KIND = "stop_spec"
 
 ROW_ATOMS = (
     "Vany",   # a verify-family row: verify, verify_ok, verify_fail (`_last_verify`)
@@ -107,11 +104,7 @@ NOT_COUNTED = (
 # given (`tezgah_integrity._admitted`: a check-repair class cleared after a check
 # that failed since the newest change), and `residual work` is a selector verdict
 # asked at every exit that would end the turn (`_residual_block`). Both reach the
-# spec's verdict through the shared selector, so neither is a formula here.
-
-# GO 2's live floor: shadow rows needed before the 99% bar is read. At 400 a
-# 99% rate is 4 disagreements, so one more or less moves it by 0.25 pp.
-MIN_LIVE_N = 400
+# spec's verdict through the selector, so neither is a formula here.
 
 
 def _nodes(formula, out):
@@ -249,13 +242,22 @@ class Trace:
         return out
 
 
-def verdict(rows, worked, external, table=None):
+def verdict(rows, worked, external):
     """The class `ORDER` picks, or None to allow; a formula is evaluated only
-    when the list reaches it."""
-    table, trace = table or _TABLE, Trace(rows, external)
+    when the list reaches it. `worked` is the selector's work flag, `external`
+    the reply's external-state claim or None.
+
+    The order is the classes' contract: the newest check failing decides before
+    anything else; a partial failure, then a UI write with no screen or design
+    proof newer than it, are stricter questions about the same rows than
+    freshness; a stale pass has another repair than none at all; and the
+    external read is asked last, only where the turn would otherwise end, so
+    it never changes the class another rule refused under. A screen proof
+    stands where a pass stands, and an external read only for its own claim."""
+    trace = Trace(rows, external)
 
     def holds(name):
-        return table[name](trace)
+        return _TABLE[name](trace)
 
     for cls in ("check failed", "partial failure", "no ui_ok"):
         if holds(cls):
@@ -271,57 +273,8 @@ def verdict(rows, worked, external, table=None):
     return "no external read" if unread else None
 
 
-def fold(rows, worked, external, where="this turn", table=None):
-    """`_evidence_block`'s signature and contract, the class from the spec. The
-    text is the class itself: shadow reads only the class (part 10, the switch,
-    would carry the imperative texts over)."""
-    cls = verdict(rows, worked, external, table)
-    return (cls, cls)
-
-
-def judge(text, session_id, rows, cwd, shape, table=None):
-    """(the spec's verdict class, whether the selector reached the fold) for one
-    Stop: the shared selector with the spec as its fold. A verdict the selector
-    made alone (a shape class, "evidence tampered", a lost check) is the
-    imperative one by construction."""
-    reached = []
-
-    def spec_fold(r, w, e, where="this turn"):
-        reached.append(True)
-        return fold(r, w, e, where, table)
-
-    cls = ti._stop_block(text, session_id, rows=rows, cwd=cwd, shape=shape,
-                         fold=spec_fold)[0]
-    return cls, bool(reached)
-
-
-def check(imperative, text, session_id, rows, cwd, shape):
-    """(spec class, agree, fold reached) for one Stop; raises under
-    `TEZGAH_STOPSPEC_STRICT` when the two disagree."""
-    spec, reached = judge(text, session_id, rows, cwd, shape)
-    agree = spec == imperative
-    if not agree and os.environ.get(STRICT):
-        raise AssertionError("stop spec disagrees: imperative %r, spec %r"
-                             % (imperative, spec))
-    return spec, agree, reached
-
-
-def shadow(imperative, text, session_id, rows, cwd, shape, key):
-    """Record the spec's verdict beside the imperative one as one `stop_spec`
-    row per reply per turn: `agree fold: <class>`, `disagree selector: <imp> ->
-    <spec>` and so on, where `fold` says the selector reached the fold and
-    `selector` says it decided alone (GO 2 reads only the first). Never returns
-    a verdict: the caller's is final. A failure of the spec is recorded as
-    `error: <type>` and re-raised only under the strict switch."""
-    if any(r.get("kind") == ROW_KIND and r.get("id") == key for r in rows):
-        return
-    try:
-        spec, agree, reached = check(imperative, text, session_id, rows, cwd, shape)
-        where = "fold" if reached else "selector"
-        detail = ("agree %s: %s" % (where, imperative or "ok") if agree else
-                  "disagree %s: %s -> %s" % (where, imperative or "ok", spec or "ok"))
-    except Exception as exc:
-        if os.environ.get(STRICT):
-            raise
-        detail = "error: %s" % type(exc).__name__
-    ti.note(session_id, ROW_KIND, detail, id=key)
+def fold(rows, worked, external, where="this turn"):
+    """The evidence fold `tezgah_integrity._stop_block` calls: (class, block
+    text) or (None, None). The class is the spec's (`verdict`); the text is the
+    one `tezgah_integrity._evidence_text` words that class with."""
+    return ti._evidence_text(verdict(rows, worked, external), rows, external, where)

package/hooks/tezgah_store.py

@@ -54,6 +54,13 @@ TASTE_ROWS = {
     "defects": ("id", "session", "day"),
     "labels": ("id", "provider", "day"),
     "injected": ("session", "day"),
+    # the verification-cost decision (plan 109): one row per measured run of one
+    # command at one sha, and one row per push of one sha. The tier map is read
+    # from these measured medians rather than declared, and the coalescing window
+    # is read from the pushes - so a second session in the same checkout reads the
+    # first one's measurements instead of re-deriving them.
+    "checks": ("repo", "sha", "command", "seconds", "exit", "ts"),
+    "pushes": ("repo", "sha", "branch", "at"),
 }
 IMPORT_SCHEMA = """
 CREATE TABLE IF NOT EXISTS imported (name TEXT NOT NULL, dev INTEGER NOT NULL,