devcouncil 0.1.1 → 0.2.1

package/src/devcouncil/council/prompts/critic_a.md

@@ -1,10 +0,0 @@
-Requirements:
-{requirements_json}
-
-Target Plan:
-{target_plan_json}
-
-You are a hostile staff engineer reviewing another team's implementation plan.
-Find missing requirements, bad assumptions, missing tests, security risks, migration risks, and unverifiable claims.
-Do not praise. Do not rewrite the plan.
-Every finding must include a falsifiable_check.

package/src/devcouncil/council/prompts/critic_b.md

@@ -1,10 +0,0 @@
-Requirements:
-{requirements_json}
-
-Target Plan:
-{target_plan_json}
-
-You are a hostile staff engineer reviewing another team's implementation plan.
-Find missing requirements, bad assumptions, missing tests, security risks, migration risks, and unverifiable claims.
-Do not praise. Do not rewrite the plan.
-Every finding must include a falsifiable_check.

package/src/devcouncil/council/prompts/implementation_reviewer.md

@@ -1,16 +0,0 @@
-You are an expert software reviewer. Review the following code changes against the task requirements.
-Task: {task.title}
-Description: {task.description}
-
-Requirements:
-{requirements_json}
-
-Code Diff:
-{diff}
-
-Your task is to identify if the implementation is complete, correct, and follows best practices.
-- Identify missing edge cases.
-- Identify architectural drift.
-- Identify security risks not caught by static scans.
-
-Return a JSON object with 'is_satisfactory' and a list of 'findings' (as Gap objects).

package/src/devcouncil/council/prompts/planner_a.md

@@ -1,16 +0,0 @@
-Goal: {goal}
-
-Requirements:
-{requirements_json}
-
-Repository Map:
-{repo_map_json}
-
-Your task is to create a detailed implementation plan.
-- Break down the requirements into atomic implementation tasks.
-- For each task, specify which files will be created or modified.
-- Specify which tests are expected to verify the task.
-- Ensure each task maps back to at least one requirement.
-
-Role-specific instructions:
-You are the pragmatic tech lead. Optimize for simplicity and minimal dependencies.

package/src/devcouncil/council/prompts/planner_b.md

@@ -1,16 +0,0 @@
-Goal: {goal}
-
-Requirements:
-{requirements_json}
-
-Repository Map:
-{repo_map_json}
-
-Your task is to create a detailed implementation plan.
-- Break down the requirements into atomic implementation tasks.
-- For each task, specify which files will be created or modified.
-- Specify which tests are expected to verify the task.
-- Ensure each task maps back to at least one requirement.
-
-Role-specific instructions:
-You are the production-readiness architect. Optimize for security, performance, edge cases, failure modes, and maintainability. Assume the first plan will miss subtle requirements.

package/src/devcouncil/council/prompts/rebuttal.md

@@ -1,10 +0,0 @@
-Original Plan:
-{original_plan_json}
-
-Critique Findings:
-{findings_json}
-
-You are the planner who created the original plan. Review the critique findings.
-- A finding can be rejected only with artifact evidence or strong justification.
-- A finding can be accepted and converted into a requirement/task/test.
-- No hand-wavy rebuttals.

package/src/devcouncil/council/prompts/spec_writer.md

@@ -1,12 +0,0 @@
-Goal: {goal}
-
-Repository Map:
-{repo_map_json}
-
-Your task is to draft the initial software specification for this goal.
-1. Identify functional and non-functional requirements.
-2. Extract any assumptions you are making about the codebase or architecture.
-3. List any blocking questions that the user must answer before implementation can proceed.
-
-Each requirement MUST have clear acceptance criteria with verification methods.
-Each assumption MUST have a confidence and impact level.

package/src/devcouncil/domain/assumption.py

@@ -1,17 +0,0 @@
-from pydantic import BaseModel, Field
-from typing import Literal, List
-
-class Assumption(BaseModel):
-    id: str
-    statement: str
-    confidence: Literal["low", "medium", "high"]
-    impact: Literal["low", "medium", "high"]
-    reversible: bool
-    requires_user_confirmation: bool
-    linked_requirement_ids: List[str] = Field(default_factory=list)
-    status: Literal[
-        "open",
-        "confirmed",
-        "rejected",
-        "converted_to_requirement"
-    ] = "open"

package/src/devcouncil/domain/critique.py

@@ -1,32 +0,0 @@
-from pydantic import BaseModel
-from typing import Literal, Optional
-
-class CritiqueFinding(BaseModel):
-    id: str
-    source_agent: str
-    target_plan_id: str
-    severity: Literal["low", "medium", "high", "critical"]
-    finding_type: Literal[
-        "missing_requirement",
-        "missing_task",
-        "missing_test",
-        "bad_assumption",
-        "architecture_risk",
-        "security_risk",
-        "performance_risk",
-        "dependency_risk",
-        "migration_risk",
-        "unverifiable_acceptance_criteria"
-    ]
-    claim: str
-    linked_requirement_id: Optional[str] = None
-    suggested_requirement: Optional[str] = None
-    suggested_task: Optional[str] = None
-    falsifiable_check: str
-    status: Literal[
-        "open",
-        "accepted",
-        "rejected",
-        "converted",
-        "needs_user"
-    ] = "open"

package/src/devcouncil/domain/evidence.py

@@ -1,27 +0,0 @@
-from pydantic import BaseModel
-from typing import Literal, List
-
-class CommandResult(BaseModel):
-    command: str
-    exit_code: int
-    stdout_path: str
-    stderr_path: str
-    summary: str
-
-class DiffEvidence(BaseModel):
-    task_id: str
-    changed_files: List[str]
-    added_files: List[str]
-    deleted_files: List[str]
-    diff_summary: str
-
-class VerificationEvidence(BaseModel):
-    __test__ = False  # Prevent pytest from collecting this as a test class
-    requirement_id: str
-    acceptance_criterion_id: str
-    command: str
-    status: Literal["passed", "failed", "not_run"]
-    evidence_summary: str
-
-# Backward-compatible alias
-TestEvidence = VerificationEvidence

package/src/devcouncil/domain/gap.py

@@ -1,26 +0,0 @@
-from pydantic import BaseModel, Field
-from typing import Literal, List, Optional
-
-class Gap(BaseModel):
-    id: str
-    severity: Literal["low", "medium", "high", "critical"]
-    gap_type: Literal[
-        "requirement_not_planned",
-        "task_not_implemented",
-        "planned_file_not_changed",
-        "orphan_diff",
-        "missing_test",
-        "test_failed",
-        "acceptance_criteria_unproven",
-        "assumption_violated",
-        "architecture_drift",
-        "security_risk",
-        "dependency_risk",
-        "migration_gap"
-    ]
-    requirement_id: Optional[str] = None
-    task_id: Optional[str] = None
-    description: str
-    evidence: List[str] = Field(default_factory=list)
-    recommended_fix: str
-    blocking: bool

package/src/devcouncil/domain/requirement.py

@@ -1,22 +0,0 @@
-from pydantic import BaseModel, Field
-from typing import Literal, List
-
-class AcceptanceCriterion(BaseModel):
-    id: str
-    description: str
-    verification_method: Literal[
-        "unit_test",
-        "integration_test",
-        "manual",
-        "static_check",
-        "llm_review"
-    ]
-    required: bool = True
-
-class Requirement(BaseModel):
-    id: str
-    title: str
-    description: str
-    priority: Literal["low", "medium", "high", "critical"]
-    source: Literal["user", "planner", "critic", "arbiter"]
-    acceptance_criteria: List[AcceptanceCriterion] = Field(default_factory=list)

package/src/devcouncil/domain/task.py

@@ -1,26 +0,0 @@
-from pydantic import BaseModel, Field
-from typing import Literal, List
-
-class PlannedFile(BaseModel):
-    path: str
-    reason: str
-    allowed_change: Literal["create", "modify", "delete", "read_only"]
-
-class Task(BaseModel):
-    id: str
-    title: str
-    description: str
-    requirement_ids: List[str] = Field(default_factory=list)
-    acceptance_criterion_ids: List[str] = Field(default_factory=list)
-    planned_files: List[PlannedFile] = Field(default_factory=list)
-    expected_tests: List[str] = Field(default_factory=list)
-    allowed_commands: List[str] = Field(default_factory=list)
-    forbidden_changes: List[str] = Field(default_factory=list)
-    status: Literal[
-        "planned",
-        "ready",
-        "running",
-        "blocked",
-        "verified",
-        "done"
-    ] = "planned"

package/src/devcouncil/execution/__init__.py

@@ -1 +0,0 @@
-

package/src/devcouncil/execution/context_builder.py

@@ -1,60 +0,0 @@
-from pathlib import Path
-from typing import List
-from devcouncil.domain.task import Task
-from devcouncil.domain.requirement import Requirement
-from devcouncil.utils.redaction import redact_string
-import json
-
-class ContextBuilder:
-    """Gathers repo-level and task-level context for agent prompts."""
-    
-    def __init__(self, project_root: Path):
-        self.project_root = project_root
-
-    def build_task_context(self, task: Task, requirements: List[Requirement]) -> str:
-        """Collects all relevant information for implementing a task."""
-        
-        # 1. Map requirements relevant to this task
-        req_map = {r.id: r for r in requirements}
-        task_reqs = [req_map[rid] for rid in task.requirement_ids if rid in req_map]
-        
-        # 2. Gather content of planned files (if they exist)
-        file_contents = {}
-        for pf in task.planned_files:
-            file_path = self.project_root / pf.path
-            if file_path.exists() and file_path.is_file():
-                try:
-                    raw = file_path.read_text(encoding="utf-8")
-                    file_contents[pf.path] = redact_string(raw)
-                except Exception:
-                    file_contents[pf.path] = "[Error reading file]"
-            else:
-                file_contents[pf.path] = "[New file - does not exist yet]"
-
-        # 3. Assemble the context string
-        context = {
-            "task": task.model_dump(),
-            "relevant_requirements": [r.model_dump() for r in task_reqs],
-            "file_contents": file_contents,
-            "project_structure": self.get_structure_summary(task)
-        }
-        
-        return json.dumps(context, indent=2)
-
-    def get_structure_summary(self, task: Task = None) -> List[str]:
-        """Simple list of files in the project for context."""
-        try:
-            import subprocess
-            output = subprocess.check_output(
-                ["git", "ls-files", "--cached", "--others", "--exclude-standard"],
-                cwd=self.project_root,
-                stderr=subprocess.DEVNULL
-            ).decode().splitlines()
-            
-            if task and task.planned_files:
-                planned_paths = {pf.path for pf in task.planned_files}
-                output = [p for p in output if p in planned_paths] + [p for p in output if p not in planned_paths]
-                
-            return output[:100] # Limit to avoid context overflow
-        except Exception:
-            return []

package/src/devcouncil/execution/executor.py

@@ -1,15 +0,0 @@
-from abc import ABC, abstractmethod
-from typing import List
-from pydantic import BaseModel
-from devcouncil.domain.task import Task
-from devcouncil.domain.requirement import Requirement
-
-class ExecutionResult(BaseModel):
-    success: bool
-    message: str
-
-class Executor(ABC):
-    @abstractmethod
-    def run_task(self, task: Task, requirements: List[Requirement]) -> ExecutionResult:
-        """Execute the task and return the result."""
-        pass

package/src/devcouncil/execution/hook_policy.py

@@ -1,165 +0,0 @@
-import fnmatch
-import re
-from dataclasses import dataclass
-from pathlib import Path
-from pathlib import PurePosixPath
-from typing import Any, Optional
-
-from devcouncil.domain.task import Task
-
-
-@dataclass(frozen=True)
-class HookDecision:
-    action: str
-    reason: str
-    target: Optional[str] = None
-
-    @property
-    def allowed(self) -> bool:
-        return self.action in {"allow", "warn"}
-
-
-class HookPolicy:
-    """Policy-backed hook checks for coding CLI tool-use events."""
-
-    def __init__(self, project_root: Path | None = None):
-        self.project_root = project_root.resolve() if project_root else None
-
-    secret_path_patterns = (
-        ".env",
-        ".env.*",
-        "**/.env",
-        "**/.env.*",
-        "**/credentials/**",
-        "**/secrets/**",
-        "**/*.pem",
-        "**/*.key",
-    )
-    protected_path_patterns = (
-        "package.json",
-        "pyproject.toml",
-        "uv.lock",
-        "Dockerfile",
-        "docker-compose.yml",
-        ".github/workflows/*.yml",
-        ".github/workflows/*.yaml",
-        "schema.prisma",
-        "wrangler.toml",
-        "index.html",
-    )
-    write_tools = {
-        "apply_patch",
-        "edit",
-        "edit_file",
-        "replace",
-        "write",
-        "write_file",
-        "Edit",
-        "MultiEdit",
-        "Write",
-    }
-    shell_tools = {
-        "bash",
-        "exec",
-        "exec_command",
-        "local_shell",
-        "run_command",
-        "run_shell_command",
-        "shell",
-        "shell_command",
-        "Bash",
-    }
-
-    def evaluate(self, call_data: dict[str, Any], active_task: Optional[Task]) -> HookDecision:
-        tool_name = str(call_data.get("name") or call_data.get("tool_name") or call_data.get("tool") or "")
-        arguments = call_data.get("arguments") or call_data.get("input") or call_data.get("tool_input") or {}
-        if not isinstance(arguments, dict):
-            arguments = {}
-
-        if tool_name in self.shell_tools:
-            command = self._extract_command(arguments)
-            return self.evaluate_command(command)
-
-        if tool_name in self.write_tools:
-            target = self._extract_path(arguments)
-            return self.evaluate_file_write(target, active_task)
-
-        return HookDecision("allow", "Tool is outside DevCouncil hook policy.")
-
-    def evaluate_command(self, command: str) -> HookDecision:
-        normalized = " ".join(command.split())
-        lowered = normalized.lower()
-        if not normalized:
-            return HookDecision("allow", "No command detected.")
-
-        if "--no-verify" in lowered or "--no-gpg-sign" in lowered:
-            return HookDecision("deny", "Verification bypass flags are not allowed.", normalized)
-
-        if re.search(r"\bgit\s+reset\s+--hard\s+(origin/)?(main|master)\b", lowered):
-            return HookDecision("deny", "Protected branch hard resets are not allowed.", normalized)
-
-        if re.search(r"\bgit\s+push\b.*(\s--force(?:-with-lease)?\b|\s-f\b)", lowered):
-            return HookDecision("deny", "Force pushes are not allowed.", normalized)
-
-        if re.search(r"\bgit\s+push\s+\S+\s+((head:)?(main|master)|(main|master):\S+)\b", lowered):
-            return HookDecision("warn", "Direct pushes to protected branches should go through verification gates.", normalized)
-
-        return HookDecision("allow", "Command is allowed.", normalized)
-
-    def evaluate_file_write(self, raw_path: Optional[str], active_task: Optional[Task]) -> HookDecision:
-        if not raw_path:
-            return HookDecision("allow", "No file path detected.")
-
-        path = self._normalize_path(raw_path)
-        if self._matches_any(path, self.secret_path_patterns):
-            return HookDecision("deny", "Secret and credential paths are never writable through hooks.", path)
-
-        if active_task is None:
-            return HookDecision("deny", "No running DevCouncil task authorizes this file write.", path)
-
-        if active_task and not self._is_planned_file(path, active_task):
-            return HookDecision("deny", f"Task {active_task.id} does not authorize changes to {path}.", path)
-
-        if self._matches_any(path, self.protected_path_patterns):
-            return HookDecision("warn", f"{path} is a protected high-impact file; verification gates must approve it.", path)
-
-        return HookDecision("allow", "File write is allowed.", path)
-
-    def _extract_command(self, arguments: dict[str, Any]) -> str:
-        value = arguments.get("command") or arguments.get("cmd") or arguments.get("script") or ""
-        return str(value)
-
-    def _extract_path(self, arguments: dict[str, Any]) -> Optional[str]:
-        value = (
-            arguments.get("path")
-            or arguments.get("file_path")
-            or arguments.get("filepath")
-            or arguments.get("filePath")
-            or arguments.get("target")
-            or arguments.get("target_file")
-        )
-        return str(value) if value else None
-
-    def _normalize_path(self, raw_path: str) -> str:
-        path = raw_path.strip().strip('"').replace("\\", "/")
-        if self.project_root:
-            try:
-                candidate = Path(path)
-                resolved = candidate.resolve() if candidate.is_absolute() else (self.project_root / path).resolve()
-                return resolved.relative_to(self.project_root).as_posix()
-            except (OSError, ValueError):
-                pass
-        if re.match(r"^[A-Za-z]:/", path):
-            parts = PurePosixPath(path).parts
-            path = "/".join(parts[1:])
-        return path[2:] if path.startswith("./") else path
-
-    def _is_planned_file(self, path: str, task: Task) -> bool:
-        for planned in task.planned_files:
-            planned_path = self._normalize_path(planned.path)
-            if path == planned_path or fnmatch.fnmatch(path, planned_path):
-                return True
-        return False
-
-    def _matches_any(self, path: str, patterns: tuple[str, ...]) -> bool:
-        return any(fnmatch.fnmatch(path, pattern) for pattern in patterns)

package/src/devcouncil/execution/patch.py

@@ -1,28 +0,0 @@
-import subprocess
-from pathlib import Path
-from devcouncil.app.errors import ExecutionError
-
-class PatchEngine:
-    """Handles applying unified diff patches to the codebase."""
-    
-    def __init__(self, project_root: Path):
-        self.project_root = project_root
-
-    def apply_patch(self, patch_content: str) -> bool:
-        """Applies a git-style patch to the repository."""
-        patch_file = self.project_root / ".devcouncil" / "temp.patch"
-        patch_file.parent.mkdir(parents=True, exist_ok=True)
-        patch_file.write_text(patch_content, encoding="utf-8")
-        
-        try:
-            # Using git apply for robust patch application
-            subprocess.check_call(
-                ["git", "apply", "--ignore-whitespace", str(patch_file)],
-                cwd=self.project_root
-            )
-            return True
-        except subprocess.CalledProcessError as e:
-            raise ExecutionError(f"Failed to apply patch: {e}")
-        finally:
-            if patch_file.exists():
-                patch_file.unlink()

package/src/devcouncil/execution/paths.py

@@ -1,14 +0,0 @@
-from pathlib import Path
-
-from devcouncil.app.errors import ExecutionError
-
-
-def resolve_project_path(project_root: Path, path: str) -> Path:
-    """Resolve a repository-relative path and reject paths outside the project."""
-    root_resolved = project_root.resolve()
-    resolved = (root_resolved / path).resolve()
-    try:
-        resolved.relative_to(root_resolved)
-    except ValueError as exc:
-        raise ExecutionError(f"Path traversal blocked: {path} resolves outside project root.") from exc
-    return resolved

package/src/devcouncil/execution/permissions.py

@@ -1,92 +0,0 @@
-import fnmatch
-from pathlib import Path
-from typing import List, Literal, Optional
-from pydantic import BaseModel, Field
-from devcouncil.domain.task import PlannedFile, Task
-from devcouncil.app.errors import GatingError
-
-class PermissionPolicy(BaseModel):
-    """Defines the security boundaries for task execution."""
-    allow_file_create: bool = False
-    allow_file_delete: bool = False
-    allowed_shell_commands: List[str] = Field(default_factory=list)
-    restricted_paths: List[str] = Field(default_factory=lambda: [".git/*", ".devcouncil/*", ".env*"])
-
-class PermissionManager:
-    def __init__(self, policy: PermissionPolicy, project_root: Path = Path(".")):
-        self.policy = policy
-        self.project_root = project_root
-        self.dynamic_ignores = self._load_devcouncilignore()
-
-    def _load_devcouncilignore(self) -> List[str]:
-        """Load additional restricted paths from .devcouncilignore."""
-        ignore_file = self.project_root / ".devcouncilignore"
-        if ignore_file.exists():
-            try:
-                lines = ignore_file.read_text().splitlines()
-                return [line.strip() for line in lines if line.strip() and not line.startswith("#")]
-            except Exception:
-                pass
-        return []
-
-    def is_file_change_allowed(
-        self,
-        path: str,
-        task: Task,
-        operation: Literal["create", "modify", "delete", "write"] = "write",
-    ) -> bool:
-        """Check if a file change is authorized by the task or policy."""
-        # 1. Check restricted paths (e.g. .git) and dynamic ignores
-        all_restricted = self.policy.restricted_paths + self.dynamic_ignores
-        for restricted in all_restricted:
-            if fnmatch.fnmatch(path, restricted) or path.startswith(restricted.strip("*")):
-                return False
-
-        # 2. Check if path is in task's planned files with a compatible operation.
-        planned = self._planned_file_for(path, task)
-        if not planned:
-            return False
-
-        if planned.allowed_change == "read_only":
-            return False
-        if operation == "write":
-            return planned.allowed_change in {"create", "modify"}
-        return planned.allowed_change == operation
-
-    def _planned_file_for(self, path: str, task: Task) -> Optional[PlannedFile]:
-        normalized = path.replace("\\", "/")
-        for planned in task.planned_files:
-            planned_path = planned.path.replace("\\", "/")
-            if normalized == planned_path or fnmatch.fnmatch(normalized, planned_path):
-                return planned
-        return None
-
-    def is_command_allowed(self, command: str, task: Task) -> bool:
-        """Check if a shell command is authorized by the task or global allowlist."""
-        # 1. Check task-specific allowlist
-        if any(fnmatch.fnmatch(command, allowed) for allowed in task.allowed_commands):
-            return True
-            
-        # 2. Check global policy allowlist
-        if any(fnmatch.fnmatch(command, allowed) for allowed in self.policy.allowed_shell_commands):
-            return True
-            
-        return False
-
-    def validate_action(
-        self,
-        action_type: str,
-        target: str,
-        task: Task,
-        operation: Literal["create", "modify", "delete", "write"] = "write",
-    ):
-        """Raise GatingError if an execution action violates permissions."""
-        if action_type == "file_write":
-            if not self.is_file_change_allowed(target, task, operation):
-                raise GatingError(
-                    f"Unauthorized file {operation}: {target}. "
-                    "File and operation must match task planned_files."
-                )
-        elif action_type == "shell":
-            if not self.is_command_allowed(target, task):
-                raise GatingError(f"Unauthorized shell command: {target}. Command must be in task's allowed_commands.")