devlyn-cli 2.10.0 → 3.0.0

package/config/skills/_shared/expected.schema.json

@@ -6,6 +6,67 @@
   "type": "object",
   "additionalProperties": false,
   "properties": {
+    "process_evidence": {
+      "type": "array",
+      "description": "Declared process obligations captured during implementation. Each id is unique within its phase; the shared process-evidence runner records raw streams and validates the expectation before IMPLEMENT can pass.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "phase"],
+        "oneOf": [
+          { "required": ["cmd"], "not": { "required": ["argv"] } },
+          { "required": ["argv"], "not": { "required": ["cmd"] } }
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$",
+            "description": "Stable evidence id, unique within its phase and safe as one path component."
+          },
+          "phase": {
+            "const": "implement",
+            "description": "The phase that must produce this expected-contract obligation."
+          },
+          "cmd": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Exact shell command executed by the shared runner."
+          },
+          "argv": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string" },
+            "description": "Exact argv executed without a shell; argv[0] must be non-empty."
+          },
+          "exit_code": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "Required exit code. Default 0 if omitted.",
+            "default": 0
+          },
+          "timeout_sec": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 600,
+            "description": "Per-command timeout in seconds. Default 60 if omitted.",
+            "default": 60
+          },
+          "stdout_contains": {
+            "type": "array",
+            "items": { "type": "string", "minLength": 1 },
+            "description": "Each UTF-8 substring must occur in the concatenated raw stdout and stderr bytes.",
+            "default": []
+          },
+          "stdout_not_contains": {
+            "type": "array",
+            "items": { "type": "string", "minLength": 1 },
+            "description": "No UTF-8 substring may occur in the concatenated raw stdout and stderr bytes.",
+            "default": []
+          }
+        }
+      },
+      "default": []
+    },
     "verification_commands": {
       "type": "array",
       "description": "Each command is executed against the post-BUILD code. Each pass/fail contributes to verify_score. At least one entry is required when the spec has any observable runtime check (CLI, test command, HTTP request).",
@@ -24,6 +85,13 @@
             "description": "Required exit code. Default 0 if omitted.",
             "default": 0
           },
+          "timeout_sec": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 600,
+            "description": "Per-command timeout in seconds. Default 60 if omitted; maximum 600.",
+            "default": 60
+          },
           "stdout_contains": {
             "type": "array",
             "description": "Each substring must appear verbatim in (stdout + stderr) for pass.",

package/config/skills/_shared/finish-gate.py

@@ -277,13 +277,11 @@ def run_gate(work: pathlib.Path, devlyn_dir: pathlib.Path) -> int:
         return 0
 
     findings: list[dict] = []
-    failed = False
     reverted = 0
     revert_failed = 0
     for seq, path in enumerate(offenders, start=1):
         ok, detail, existed_at_base = revert_offender(work, base_sha, path)
         status = "reverted" if ok else "revert-failed"
-        failed = failed or not ok
         if ok:
             reverted += 1
         else:
@@ -305,7 +303,10 @@ def run_gate(work: pathlib.Path, devlyn_dir: pathlib.Path) -> int:
             ),
         ))
     write_findings(devlyn_dir, findings)
-    exit_code = 2 if failed else 0
+    # Exit 0 let a real run treat reverted orchestrator commits as a clean pass.
+    # Any offender is therefore unclean even when every automatic revert succeeds;
+    # the caller maps exit 1/2 to BLOCKED:finish-gate-unclean.
+    exit_code = 2
     write_summary(devlyn_dir, {
         "mode": state.get("mode"),
         "checked": len(checked),
@@ -386,25 +387,25 @@ def self_test() -> int:
 
         work, devlyn, _base = make_fixture(root, "tracked-mutation")
         write_text(work / "notes.txt", "polluted\n")
-        assert checked_run_gate(work, devlyn) == 0
+        assert checked_run_gate(work, devlyn) == 2
         assert (work / "notes.txt").read_text(encoding="utf-8") == "base notes\n"
         findings = read_findings(devlyn)
         assert findings[0]["rule_id"] == "scope.finish-unaudited-file"
         assert findings[0]["status"] == "reverted"
         assert_summary(devlyn, {
             "mode": "full", "checked": 1, "offenders": 1,
-            "reverted": 1, "revert_failed": 0, "exit": 0,
+            "reverted": 1, "revert_failed": 0, "exit": 2,
         })
 
         work, devlyn, _base = make_fixture(root, "added-file")
         write_text(work / "runtime.txt", "late\n")
         git_check(work, "add", "runtime.txt")
-        assert checked_run_gate(work, devlyn) == 0
+        assert checked_run_gate(work, devlyn) == 2
         assert not (work / "runtime.txt").exists()
         assert "runtime.txt" not in git_check(work, "diff", "--name-only", _base).splitlines()
         assert_summary(devlyn, {
             "mode": "full", "checked": 1, "offenders": 1,
-            "reverted": 1, "revert_failed": 0, "exit": 0,
+            "reverted": 1, "revert_failed": 0, "exit": 2,
         })
 
         work, devlyn, _base = make_fixture(root, "devlyn-owned-tracked-mutation")
@@ -414,7 +415,7 @@ def self_test() -> int:
         git_check(work, "-c", "user.email=t@t", "-c", "user.name=t", "commit", "-q", "-m", "track devlyn state")
         write_text(archived, "mutated devlyn state\n")
         write_text(work / "notes.txt", "polluted\n")
-        assert checked_run_gate(work, devlyn) == 0
+        assert checked_run_gate(work, devlyn) == 2
         assert archived.read_text(encoding="utf-8") == "mutated devlyn state\n"
         assert (work / "notes.txt").read_text(encoding="utf-8") == "base notes\n"
         findings = read_findings(devlyn)
@@ -422,7 +423,7 @@ def self_test() -> int:
         assert findings[0]["status"] == "reverted"
         assert_summary(devlyn, {
             "mode": "full", "checked": 1, "offenders": 1,
-            "reverted": 1, "revert_failed": 0, "exit": 0,
+            "reverted": 1, "revert_failed": 0, "exit": 2,
         })
 
         work, devlyn, base = make_fixture(root, "cleanup-window")
@@ -469,12 +470,12 @@ def self_test() -> int:
 
         work, devlyn, _base = make_fixture(root, "deleted-file")
         (work / "notes.txt").unlink()
-        assert checked_run_gate(work, devlyn) == 0
+        assert checked_run_gate(work, devlyn) == 2
         assert (work / "notes.txt").read_text(encoding="utf-8") == "base notes\n"
         assert read_findings(devlyn)[0]["status"] == "reverted"
         assert_summary(devlyn, {
             "mode": "full", "checked": 1, "offenders": 1,
-            "reverted": 1, "revert_failed": 0, "exit": 0,
+            "reverted": 1, "revert_failed": 0, "exit": 2,
         })
 
         work, devlyn, _base = make_fixture(root, "git-diff-failure")

package/config/skills/_shared/grok-anchor-guard.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""Deny pair-judge shell outside the probe anchor, with a model-readable reason.
+
+Registered as a native grok `PreToolUse` hook. It fires at step 1 of the
+authorization pipeline, before the permission rules and before the mode policy
+whose auto-deny silently terminates the review at exit 0 (iter-0081).
+
+The anchor is supplied via DEVLYN_PROBE_ANCHOR, derived by the orchestrator from
+the same source as the --allow rule.
+
+Measured (iter-0081 M-C6 v2, external isolation, admissible cell): Line A 6/6 —
+the denial arrives as a model-visible tool_result, the judge re-routes to
+read_file, the anchor still executes inside the grok process, EndTurn with zero
+PermissionCancelled. Line A-chain 1/1 — `<anchor> && <write>` is denied
+model-visibly, neither segment executes, and the judge then runs the bare anchor.
+"""
+import json
+import os
+import sys
+
+REASON = (
+    "DEVLYN-0081-HOOK-DENY: this shell command is outside the permitted probe "
+    "anchor. Use the read_file tool for file reads. The only permitted shell "
+    "command is the anchor named in your prompt, unchained."
+)
+
+SHELL_TOOLS = {"run_terminal_command", "run_terminal_cmd", "Bash"}
+
+# A conservative, quote-OBLIVIOUS lexical veto — deliberately not a shell parser.
+# It rejects these characters even inside quotes, over-denying rather than ever
+# under-denying a chain. Adding quote-, escape-, or operator-aware exceptions is
+# how this becomes a parser; that is a registered falsifier, not a polish.
+FORBIDDEN = set(";&|`$()<>") | {"\n", "\r"}
+
+
+def reject_json_constant(token):
+    raise ValueError(f"invalid JSON numeric constant: {token}")
+
+
+def reject_duplicate_keys(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError(f"duplicate JSON key: {key}")
+        result[key] = value
+    return result
+
+
+def main():
+    anchor = os.environ.get("DEVLYN_PROBE_ANCHOR", "")
+    payload = json.load(
+        sys.stdin,
+        parse_constant=reject_json_constant,
+        object_pairs_hook=reject_duplicate_keys,
+    )
+
+    if payload.get("toolName") not in SHELL_TOOLS or not anchor:
+        print(json.dumps({"decision": "allow"}))
+        return
+
+    # The anchor, or the anchor plus argv, and nothing that could start a second
+    # command. A bare prefix rule would allow `<anchor> && <other>` — the vendor's
+    # own documented footgun. Exact match would instead deny `<anchor> --n 5`,
+    # mechanically destroying the "bounded input variations" that verify.md
+    # requires of every engine. Both were rejected by both seats (iter-0081 v2).
+    command = (payload.get("toolInput") or {}).get("command", "").strip()
+    if command == anchor or (
+        command.startswith(anchor + " ")
+        and not any(ch in FORBIDDEN for ch in command)
+    ):
+        print(json.dumps({"decision": "allow"}))
+        return
+
+    print(json.dumps({"decision": "deny", "reason": REASON}))
+
+
+if __name__ == "__main__":
+    main()