guardian-framework 0.1.161 → 0.1.163

package/dist/cli.js

@@ -3206,7 +3206,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.161", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.163", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/dist/exports.js

@@ -1991,7 +1991,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.161", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.163", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "guardian-framework",
-	"version": "0.1.161",
+	"version": "0.1.163",
 	"description": "Token-optimized agentic framework scaffolder with pi-first architecture",
 	"type": "module",
 	"main": "dist/exports.js",

package/templates/pi/preflight_report.json

@@ -1,5 +1,5 @@
 {
-  "timestamp": "2026-11-13T20:08:59Z",
+  "timestamp": "2026-11-13T20:44:26Z",
   "mode": "all",
   "stages_run": [],
   "summary": {
@@ -8,7 +8,7 @@
     "failed": 1,
     "skipped": 12
   },
-  "duration_seconds": 1,
+  "duration_seconds": 0,
   "results": [
   {
     "name": "check_mr_traceability.sh",

package/templates/pi/scripts/freeze.sh

@@ -206,6 +206,20 @@ SHAPE_ASSERT = re.compile(
     r"\bnames\b|annotations\[|startswith\(\s*[\"']set_|__dict__|dir\()"
 )
 
+# Guardian's own generated scaffolding: `assert False, "TODO: ..."`. Red by
+# construction, proves nothing — accepting it is how a "freeze" ends up with no
+# net at all.
+PLACEHOLDER = re.compile(
+    r"(assert\s+False\b|fail\(\s*[\"']TODO|t\.Fatal\(\s*[\"']Test not yet implemented|"
+    r"throw new Error\(\s*[\"']TODO|panic!\(\s*[\"']Test not yet implemented|"
+    r"TODO: uncomment when|TODO: implement dependency test)",
+    re.I,
+)
+
+def is_placeholder(src):
+    return bool(PLACEHOLDER.search(src))
+
+
 def classify(code):
     """Return 'behaviour' | 'structural' | 'none'."""
     asserts = [l for l in code.splitlines() if re.match(r"\s*assert\b", l)]
@@ -231,6 +245,13 @@ def find_tests(slug):
                 if not re.search(r"\.(py|ts|rs|go|java)$", f):
                     continue
                 low = os.path.join(dp, f).lower()
+                if "__pycache__" in low:
+                    continue
+                # Only actual test files: conftest.py, _fixtures.py and
+                # __init__.py are support, not suites (they made counts lie).
+                stem = f.rsplit(".", 1)[0]
+                if not (stem.startswith("test_") or stem.endswith("_test") or stem in ("tests", "test")):
+                    continue
                 if slug in low or slug.replace("-", "") in low.replace("-", ""):
                     hits.append(os.path.join(dp, f))
         if hits:
@@ -239,13 +260,18 @@ def find_tests(slug):
 
 def analyse_tests(slug, tests):
     """Return (total, behaviour, structural_only, ac_named, details)."""
-    total = behaviour = struct_only = ac_named = 0
+    total = behaviour = struct_only = ac_named = placeholders = 0
     details = []
     for f in tests:
         src = read(f)
         if not src.strip():
             continue
         code = "\n".join(l for l in src.splitlines() if not l.strip().startswith("#"))
+        if is_placeholder(code):
+            placeholders += 1
+            details.append(f"{os.path.relpath(f, root)}: placeholder scaffolding (assert False/TODO)")
+            total += 1
+            continue
         kind = classify(code)
         body_struct = kind == "structural"
         body_behav = kind == "behaviour"
@@ -260,7 +286,7 @@ def analyse_tests(slug, tests):
             details.append(f"{os.path.relpath(f, root)}: structural assertions only")
         if acs:
             ac_named += 1
-    return total, behaviour, struct_only, ac_named, details
+    return total, behaviour, struct_only, ac_named, details, placeholders
 
 def run_python_tests(tests):
     """Return (status, reason, sample) where status: red_ok|red_wrong|green|unknown."""
@@ -318,6 +344,8 @@ def verify(slug):
     sig_files = []
     for d in src_dirs:
         for dp, _dn, fs in os.walk(d):
+            if "__pycache__" in dp:
+                continue
             sig_files += [os.path.join(dp, f) for f in fs if re.search(r"\.(py|ts|java|rs|go)$", f)]
     ok_sigs = bool(sig_files)
     checks.append(("frozen signatures", ok_sigs, f"{len(sig_files)} source file(s)" if ok_sigs else f"no src/{slug}/"))
@@ -325,11 +353,17 @@ def verify(slug):
 
     # 3. tests exist, are behaviour (not structural-only), and name ACs
     tests = find_tests(slug)
-    total, behaviour, struct_only, ac_named, tdetails = analyse_tests(slug, tests)
+    total, behaviour, struct_only, ac_named, tdetails, placeholders = analyse_tests(slug, tests)
     ok_tests = bool(tests)
     checks.append(("contract tests", ok_tests, f"{len(tests)} file(s)" if tests else "no tests referencing the module"))
     ok_all &= ok_tests
 
+    ok_placeholder = placeholders == 0
+    checks.append(("no placeholders", ok_placeholder,
+                   "no generated scaffolding" if ok_placeholder
+                   else f"{placeholders} suite(s) are guardian scaffolding (assert False / TODO), not tests"))
+    ok_all &= ok_placeholder
+
     # Advisory only: a syntactic shape-vs-behaviour classifier is always
     # arguable. The objective gate is the RED check below — tests that are GREEN
     # over NotImplementedError bodies are structural by definition, whatever the
@@ -347,12 +381,72 @@ def verify(slug):
     # 4. RED for the right reason
     status, reason, sample = run_python_tests(tests) if tests else ("unknown", "no tests", "")
     ok_red = status == "red_ok"
+    if placeholders > 0 and status == "red_ok":
+        ok_red = False
+        reason = (f"{placeholders} placeholder suite(s) fail by construction — "
+                  f"red is not evidence until they assert a rule")
     if status == "green":
         reason = ("tests are GREEN while the module is unimplemented — they assert shape, "
                   "not rules; a freeze needs failing behaviour tests")
     checks.append(("red state", ok_red, f"{status}: {reason}"))
     ok_all &= ok_red
 
+    # 4b. recorded evidence must still hold (spec: a contract change means
+    #     the module is no longer frozen and must be re-frozen).
+    st_rec = load_state()
+    ent = entry(st_rec, slug)
+    if ent.get("state") == "frozen" and (ent.get("evidence") or {}).get("commit"):
+        ev = ent["evidence"]
+        sha = ev["commit"]
+        base_ref = ev.get("branch") or base
+        # realpath both sides: on macOS /tmp is a symlink to /private/tmp, and a
+        # symlinked project dir made relpath produce ../../../tmp/... so git saw
+        # a path outside the repo and reported "no changes".
+        rel = os.path.relpath(os.path.realpath(root), os.path.realpath(git_top))
+        prefix = "" if rel == "." else f"{rel}/"
+
+        on_base = subprocess.run(
+            ["git", "-C", git_top, "merge-base", "--is-ancestor", sha, base_ref],
+            capture_output=True).returncode == 0
+        checks.append(("recorded commit", on_base,
+                       f"{sha[:8]} is an ancestor of {base_ref}" if on_base
+                       else f"{sha[:8]} is NOT an ancestor of {base_ref}"))
+        ok_all &= on_base
+
+        missing = [p for p in (ev.get("contracts") or []) if not os.path.exists(os.path.join(root, p))]
+        checks.append(("evidence files", not missing,
+                       "recorded contract/test files exist" if not missing
+                       else "missing: " + ", ".join(missing)))
+        ok_all &= not missing
+
+        def changed_since(paths):
+            """Files changed since the freeze — committed OR uncommitted.
+
+            `git diff <sha> -- <paths>` compares the recorded commit against the
+            WORKING TREE, so it catches both later commits and local edits.
+            Diffing commit-to-commit silently ignored uncommitted tampering.
+            """
+            if not paths:
+                return []
+            args = ["git", "-C", git_top, "diff", "--name-only", sha, "--"]
+            args += [f"{prefix}{p}" for p in paths]
+            out = subprocess.run(args, capture_output=True, text=True).stdout.strip()
+            if os.environ.get("GUARDIAN_FREEZE_DEBUG"):
+                print(f"DEBUG changed_since args={args} out={out!r}", file=sys.stderr)
+            return [l for l in out.splitlines() if l.strip()]
+
+        contract_changes = changed_since(ev.get("contracts") or [])
+        checks.append(("contracts unchanged", not contract_changes,
+                       "contracts unchanged since the freeze" if not contract_changes
+                       else "changed after the freeze — re-freeze: " + ", ".join(contract_changes)))
+        ok_all &= not contract_changes
+
+        test_changes = changed_since(ev.get("tests") or [])
+        checks.append(("tests unchanged", not test_changes,
+                       "frozen test files unchanged" if not test_changes
+                       else "tests changed after the freeze — re-freeze: " + ", ".join(test_changes[:3])))
+        ok_all &= not test_changes
+
     # 5. dependencies frozen/implemented
     bad_deps = []
     st = load_state()
@@ -443,8 +537,8 @@ if cmd == "list":
 
 if cmd == "status":
     if not module:
-        print("usage: freeze.sh status --module <m>", file=sys.stderr)
-        raise SystemExit(2)
+        # no module given: same as list
+        cmd = "list"
     slug = slugify(module)
     st = load_state()
     e = entry(st, slug)