devcouncil 0.3.1 → 0.4.1

package/src/devcouncil/cli/commands/go.py

@@ -1,7 +1,6 @@
 import asyncio
 import hashlib
 import logging
-import subprocess
 from pathlib import Path
 from types import SimpleNamespace
 
@@ -27,6 +26,7 @@ from devcouncil.integrations.github_intent import resolve_goal_intent
 from devcouncil.llm.provider import ProviderRequestError
 from devcouncil.llm.router import StructuredOutputError
 from devcouncil.storage.db import get_db
+from devcouncil.utils.proc import run_git
 from devcouncil.storage.repositories import ArtifactGraphRepository, GapRepository, StateRepository, TaskRepository
 from devcouncil.app.state_machine import ProjectPhase
 from devcouncil.gating.policy import topological_order
@@ -63,10 +63,7 @@ def _is_git_repo(root: Path) -> bool:
     non-git tree would spuriously flag unrelated files as orphan diffs.
     """
     try:
-        result = subprocess.run(
-            ["git", "rev-parse", "--is-inside-work-tree"],
-            cwd=root, capture_output=True, text=True,
-        )
+        result = run_git(["rev-parse", "--is-inside-work-tree"], cwd=root)
     except Exception:
         return False
     return result.returncode == 0 and result.stdout.strip() == "true"
@@ -98,6 +95,22 @@ def _max_repair_attempts(root: Path) -> int:
         return 0
 
 
+def _task_max_repairs(root: Path, task, base_max: int) -> int:
+    """Per-task repair budget: the base budget widened for HARD tasks per
+    ``verification.rigor.extra_repair_attempts_on_hard``. A disabled loop
+    (base 0) stays disabled. Never raises."""
+    if base_max <= 0:
+        return base_max
+    try:
+        from devcouncil.verification.difficulty import resolve_rigor_policy
+
+        config = load_config(root)
+        policy = resolve_rigor_policy(task, None, config=config)
+        return base_max + max(0, policy.extra_repair_attempts)
+    except Exception:
+        return base_max
+
+
 def _blocking_gap_signature(root: Path, task_id: str) -> str:
     """Fingerprint of a task's current blocking gaps, for no-progress detection.
 
@@ -130,9 +143,11 @@ def _remediable_incomplete_signature(root: Path, task_id: str) -> str:
 
 
 def _build_repair_service(root: Path):
-    """Best-effort LLM repair service used to sharpen the correction manifest's root
-    cause. Returns None when no provider key is configured — the manifest still has a
-    deterministic, task-scoped fallback (allowed files, commands, forbidden changes)."""
+    """Optional LLM advisory layer for sharpening correction-manifest root cause.
+
+    Returns None when no provider key is configured — the Stable repair contract
+    does not require this: ``write_correction_manifest`` still builds a deterministic,
+    task-scoped manifest from blocking gaps, next-actions, and task scope."""
     try:
         from devcouncil.app.config import get_api_key
         from devcouncil.llm.provider import create_provider, validate_model_provider
@@ -149,6 +164,61 @@ def _build_repair_service(root: Path):
         return None
 
 
+def _executor_run_failed(root: Path, task_id: str) -> bool:
+    """True when the latest coding-agent run for ``task_id`` exited non-zero."""
+    from devcouncil.planning.correction_manifest import _latest_agent_run
+
+    run = _latest_agent_run(root, task_id)
+    if not run:
+        return False
+    returncode = run.get("returncode")
+    return returncode is not None and returncode != 0
+
+
+def _executor_run_unavailable(root: Path, task_id: str) -> bool:
+    """True when the agent failed for infra reasons (session/rate limit), not code defects."""
+    from devcouncil.executors.advisor_tool import ADVISOR_INFRA_FAILURE_MARKERS
+    from devcouncil.planning.correction_manifest import _latest_agent_run
+
+    run = _latest_agent_run(root, task_id)
+    if not run:
+        return False
+    returncode = run.get("returncode")
+    if returncode in (None, 0):
+        return False
+    parts: list[str] = [str(run.get("status") or "")]
+    for key in ("stderr_preview", "stdout_preview"):
+        val = run.get(key)
+        if isinstance(val, list):
+            parts.extend(str(x) for x in val)
+        elif val:
+            parts.append(str(val))
+    hay = " ".join(parts).lower()
+    needles = (
+        "session limit",
+        "rate limit",
+        "too many requests",
+        "limit_rpm",
+        "429",
+        *ADVISOR_INFRA_FAILURE_MARKERS,
+    )
+    return any(needle in hay for needle in needles)
+
+
+def _reverify_task(root: Path, task_id: str) -> str:
+    """Re-run verification for one task without invoking the coding agent."""
+    db = get_db(root)
+    if not db:
+        return _task_status(root, task_id)
+    try:
+        verify_command._run_verify_body(root, task_id, "local", True, db)
+    except typer.Exit:
+        pass
+    except Exception as exc:  # pragma: no cover - verify should not abort the loop
+        logger.warning("Verify-only pass for %s failed: %s", task_id, exc)
+    return _task_status(root, task_id)
+
+
 def _execute_task_with_repair(
     root: Path,
     task,
@@ -163,12 +233,17 @@ def _execute_task_with_repair(
     """Run a task, then self-repair in a bounded loop until it verifies or the budget
     is exhausted. Returns ``(final_status, repair_attempts_used)``.
 
-    Each repair attempt writes a correction manifest (which the coding-CLI executor
-    folds into its prompt) and re-runs the executor. Between attempts the prior work
-    is committed so the readiness gate's clean-tree requirement holds and the next
-    attempt builds on it; verification still recognises the committed work via the
-    task's checkpoint. The loop stops early when an attempt makes no progress (the
-    same blocking gaps reappear) so it never spins on an unfixable gate.
+    **Stable contract:** each repair attempt writes a deterministic correction manifest
+    (blocking gaps, next-actions, task scope, prior-attempt context), re-runs the
+    executor, respects ``max_repairs``, and stops on no-progress (identical gap
+    fingerprint). Optional ``repair_service`` LLM inference may sharpen the manifest but
+    is not required for the loop to function.
+
+    Between attempts the prior work is committed so the readiness gate's clean-tree
+    requirement holds and the next attempt builds on it; verification still recognises
+    the committed work via the task's checkpoint. The loop stops early when an attempt
+    makes no progress (the same blocking gaps reappear) so it never spins on an
+    unfixable gate.
 
     When the task ultimately verifies, the intermediate ``[blocked]`` commits made
     between attempts are squashed into a single verified commit (see
@@ -197,6 +272,13 @@ def _execute_task_with_repair(
     status = _task_status(root, task.id)
     logger.info("Initial run of %s finished as %s (max_repairs=%d)", task.id, status, max_repairs)
 
+    if status in {"verified", "done"} and _remediable_incomplete_signature(root, task.id):
+        console.print(
+            f"[dim]{task.id}: re-verifying (incomplete acceptance criteria only)...[/dim]"
+        )
+        status = _reverify_task(root, task.id)
+        logger.info("After initial verify-only pass, %s is %s", task.id, status)
+
     attempt = 0
     last_signature: str | None = None
     while attempt < max_repairs:
@@ -214,13 +296,68 @@ def _execute_task_with_repair(
             # (e.g. the executor failed to start).
             break
         if signature == last_signature:
-            logger.warning("%s: repair made no progress (identical gaps) after attempt %d; stopping loop", task.id, attempt)
+            if _executor_run_unavailable(root, task.id):
+                # Advisor/session/rate-limit failures are not code gaps — do not burn
+                # the remaining repair budget on identical executor invocations.
+                logger.warning(
+                    "%s: executor unavailable (infra); stopping self-repair loop",
+                    task.id,
+                )
+                console.print(
+                    f"[yellow]{task.id}: executor unavailable (infra failure); "
+                    "stopping the self-repair loop.[/yellow]"
+                )
+                break
+            if _executor_run_failed(root, task.id):
+                logger.warning(
+                    "%s: identical gaps but the last executor run failed to complete; "
+                    "continuing the repair budget (infra failure is not no-progress)",
+                    task.id,
+                )
+                console.print(
+                    f"[yellow]{task.id}: executor failed on the last repair attempt; "
+                    "retrying while repair budget remains.[/yellow]"
+                )
+            else:
+                logger.warning("%s: repair made no progress (identical gaps) after attempt %d; stopping loop", task.id, attempt)
+                console.print(
+                    f"[yellow]{task.id}: repair made no progress (identical blocking gaps); "
+                    "stopping the self-repair loop.[/yellow]"
+                )
+                break
+        last_signature = signature
+
+        incomplete_only = not blocked and bool(signature)
+        unavailable = _executor_run_unavailable(root, task.id)
+        # Verify-only when incomplete-only OR any infra unavailability (blocked or not).
+        if incomplete_only or unavailable:
             console.print(
-                f"[yellow]{task.id}: repair made no progress (identical blocking gaps); "
-                "stopping the self-repair loop.[/yellow]"
+                f"[dim]{task.id}: verify-only pass before repair "
+                f"(attempt {attempt + 1}/{max_repairs})...[/dim]"
             )
-            break
-        last_signature = signature
+            prev_sig = signature
+            status = _reverify_task(root, task.id)
+            blocked = status not in {"verified", "done"}
+            new_sig = (
+                _blocking_gap_signature(root, task.id) if blocked
+                else _remediable_incomplete_signature(root, task.id)
+            )
+            if not new_sig:
+                break
+            if new_sig != prev_sig:
+                last_signature = None
+                continue
+            if unavailable:
+                logger.warning(
+                    "%s: executor unavailable and verify-only did not clear gaps; "
+                    "skipping further executor invocations",
+                    task.id,
+                )
+                console.print(
+                    f"[yellow]{task.id}: executor unavailable; gaps remain after "
+                    "verify-only — not burning more repair budget.[/yellow]"
+                )
+                break
 
         # Record where history started before the first failed-attempt commit, so the
         # squash collapses exactly this task's intermediate commits and nothing earlier.
@@ -239,14 +376,36 @@ def _execute_task_with_repair(
         if manifest_path is None:
             break
         attempt += 1
-        logger.info("Self-repair attempt %d/%d for %s (was %s); manifest=%s", attempt, max_repairs, task.id, status, manifest_path)
-        console.print(
-            f"\n[bold]Self-repair attempt {attempt}/{max_repairs}[/bold] for "
-            f"[bold]{task.id}[/bold] (was {status})..."
-        )
-        _run_once()
-        status = _task_status(root, task.id)
-        logger.info("After repair attempt %d, %s is now %s", attempt, task.id, status)
+        with log_stage(
+            "repair",
+            project_root=root,
+            task_id=task.id,
+            attempt=attempt,
+            max_repairs=max_repairs,
+        ):
+            log_step(
+                f"repair attempt {attempt}/{max_repairs} for {task.id}",
+                project_root=root,
+                task_id=task.id,
+                manifest=str(manifest_path),
+                prior_status=status,
+                trace=True,
+            )
+            logger.info("Self-repair attempt %d/%d for %s (was %s); manifest=%s", attempt, max_repairs, task.id, status, manifest_path)
+            console.print(
+                f"\n[bold]Self-repair attempt {attempt}/{max_repairs}[/bold] for "
+                f"[bold]{task.id}[/bold] (was {status})..."
+            )
+            _run_once()
+            status = _task_status(root, task.id)
+            logger.info("After repair attempt %d, %s is now %s", attempt, task.id, status)
+            log_step(
+                f"repair attempt {attempt}/{max_repairs} finished for {task.id}",
+                project_root=root,
+                task_id=task.id,
+                status=status,
+                trace=True,
+            )
 
     if status not in {"verified", "done"} and attempt >= max_repairs and max_repairs > 0:
         logger.warning("%s: gave up after %d repair attempt(s); still %s", task.id, attempt, status)
@@ -254,6 +413,11 @@ def _execute_task_with_repair(
             f"[yellow]{task.id}: gave up after {attempt} repair attempt(s); still {status}.[/yellow]"
         )
 
+    if _remediable_incomplete_signature(root, task.id):
+        console.print(f"[dim]{task.id}: final verify-only pass for remaining incomplete gaps...[/dim]")
+        status = _reverify_task(root, task.id)
+        logger.info("After final verify-only pass, %s is %s", task.id, status)
+
     # On success, squash the [blocked] attempt commits into one verified commit so the
     # user's history isn't littered with failed attempts. Only do this when the task
     # actually verified — a still-blocked task keeps its attempt commits so the work
@@ -272,10 +436,7 @@ def _execute_task_with_repair(
 def _current_head(root: Path) -> str | None:
     """Resolve the current HEAD commit, or None when there is no commit / no git."""
     try:
-        result = subprocess.run(
-            ["git", "rev-parse", "HEAD"],
-            cwd=root, capture_output=True, text=True,
-        )
+        result = run_git(["rev-parse", "HEAD"], cwd=root)
     except Exception:
         return None
     if result.returncode != 0:
@@ -305,41 +466,31 @@ def _squash_repair_commits(root: Path, task_id: str, base: str, status: str) ->
         head = _current_head(root)
         if not head or head == base:
             return False
-        base_ok = subprocess.run(
-            ["git", "rev-parse", "--verify", f"{base}^{{commit}}"],
-            cwd=root, capture_output=True, text=True,
-        )
+        base_ok = run_git(["rev-parse", "--verify", f"{base}^{{commit}}"], cwd=root)
         if base_ok.returncode != 0:
             return False
         # Soft reset keeps the working tree + index exactly as-is; only the branch
         # pointer moves back to base, so the next commit captures the whole task.
-        reset = subprocess.run(
-            ["git", "reset", "--soft", base],
-            cwd=root, capture_output=True, text=True,
-        )
+        reset = run_git(["reset", "--soft", base], cwd=root)
         if reset.returncode != 0:
             return False
         # Stage the FINAL (verified) attempt's still-uncommitted changes too, so they land
         # in this single squash commit. Without this they'd be committed separately by the
         # caller afterward, producing two commits for what the message calls "one verified
         # commit" (and leaving the squash to capture only the [blocked] diffs).
-        add = subprocess.run(
-            ["git", "add", "-A"],
-            cwd=root, capture_output=True, text=True,
-        )
+        add = run_git(["add", "-A"], cwd=root)
         if add.returncode != 0:
             return False
         # Re-commit the squashed tree. There may be nothing staged if every attempt's
         # changes cancelled out (unlikely for a verified task) — tolerate that.
-        commit = subprocess.run(
+        commit = run_git(
             [
-                "git",
                 "-c", "user.name=DevCouncil",
                 "-c", "user.email=devcouncil@local",
                 "commit", "--no-verify", "--allow-empty",
                 "-m", f"devcouncil(e2e): {task_id} [{status}]",
             ],
-            cwd=root, capture_output=True, text=True,
+            cwd=root,
         )
         return commit.returncode == 0
     except Exception:
@@ -356,22 +507,18 @@ def _commit_task_changes(root: Path, task_id: str, status: str) -> bool:
     and can be squashed or reset afterwards. Returns True if a commit was made.
     """
     try:
-        status_out = subprocess.run(
-            ["git", "status", "--porcelain"],
-            cwd=root, capture_output=True, text=True,
-        )
+        status_out = run_git(["status", "--porcelain"], cwd=root)
         if status_out.returncode != 0 or not status_out.stdout.strip():
             return False
-        subprocess.run(["git", "add", "-A"], cwd=root, check=True, capture_output=True)
-        commit = subprocess.run(
+        run_git(["add", "-A"], cwd=root, check=True)
+        commit = run_git(
             [
-                "git",
                 "-c", "user.name=DevCouncil",
                 "-c", "user.email=devcouncil@local",
                 "commit", "--no-verify",
                 "-m", f"devcouncil(e2e): {task_id} [{status}]",
             ],
-            cwd=root, capture_output=True, text=True,
+            cwd=root,
         )
         return commit.returncode == 0
     except Exception:
@@ -626,12 +773,14 @@ def go(
         executed_task_ids.append(task.id)
         # Run, then self-repair in a bounded loop (closes the autonomous loop: the
         # one-shot executor no longer needs a human to run `dev repair` and re-run).
+        # Hard tasks get a wider budget per verification.rigor.
+        task_max_repairs = _task_max_repairs(root, task, max_repairs)
         with log_stage(
             "execute_task",
             project_root=root,
             task_id=task.id,
             executor=normalized_executor,
-            max_repairs=max_repairs,
+            max_repairs=task_max_repairs,
         ):
             latest_status, repairs_used = _execute_task_with_repair(
                 root,
@@ -639,7 +788,7 @@ def go(
                 executor=normalized_executor,
                 profile=profile,
                 stream=stream,
-                max_repairs=max_repairs,
+                max_repairs=task_max_repairs,
                 repair_service=repair_service,
                 config=repair_config,
             )
@@ -685,17 +834,18 @@ def go(
     # refreshes statuses/gaps cheaply for an honest final report.
     if executed_task_ids and _is_git_repo(root):
         console.print("\n[bold]Reconciling verification against the final integrated state...[/bold]")
-        log_step("reconcile: re-verifying against integrated state", project_root=root)
-        try:
-            verify_command.verify(task_id=None, sandbox="local", json_format=True, project_root=root)
-        except typer.Exit:
-            # Expected signal: verify() raises Exit(code=1) when any task is blocked,
-            # but it has already persisted every task status before raising. The
-            # reconciliation pass therefore completed — fall through to the reload so
-            # blocked statuses are refreshed honestly. (Only real errors should skip.)
-            pass
-        except Exception as exc:  # pragma: no cover - reconciliation is best-effort
-            console.print(f"[yellow]Reconciliation pass skipped: {exc}[/yellow]")
+        with log_stage("reconcile", project_root=root, tasks=len(executed_task_ids)):
+            log_step("reconcile: re-verifying against integrated state", project_root=root)
+            try:
+                verify_command.verify(task_id=None, sandbox="local", json_format=True, project_root=root)
+            except typer.Exit:
+                # Expected signal: verify() raises Exit(code=1) when any task is blocked,
+                # but it has already persisted every task status before raising. The
+                # reconciliation pass therefore completed — fall through to the reload so
+                # blocked statuses are refreshed honestly. (Only real errors should skip.)
+                pass
+            except Exception as exc:  # pragma: no cover - reconciliation is best-effort
+                console.print(f"[yellow]Reconciliation pass skipped: {exc}[/yellow]")
         reconciled = {item.id: item for item in _load_tasks(root)}
         # Rebuild from the FULL planned set, not just executed_task_ids: a task skipped
         # for an unmet dependency, or one reconciliation downgraded from done->blocked,
@@ -715,7 +865,7 @@ def go(
         logger.warning("dev go finished with %d unfinished task(s): %s", len(failed), ", ".join(failed))
         _record_project_blocked(root)
 
-    log_step("generating final report", project_root=root)
+    log_step("generating final report", project_root=root, trace=True)
     console.print("\n[bold]Final DevCouncil report[/bold]")
     report_command.report(
         SimpleNamespace(invoked_subcommand=None),  # type: ignore[arg-type]
@@ -724,6 +874,8 @@ def go(
         github=False,
         github_pr_comment=False,
         gitlab_pr_comment=False,
+        evidence_json=None,
+        fail_on_blocking=False,
         project_root=root,
     )
     if report_file is not None: