its-magic 0.1.2-9 → 0.1.3-0

package/scripts/intake_evidence_validate.py

@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+"""
+Validate intake_evidence JSON bundles (US-0078 / US-0083 / DEC-0060 / DEC-0067).
+
+Used by PO workflow preflight and CI fixtures.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+
+_SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+_REPO_ROOT = os.path.normpath(os.path.join(_SCRIPT_DIR, ".."))
+if _SCRIPT_DIR not in sys.path:
+    sys.path.insert(0, _SCRIPT_DIR)
+
+import intake_evidence_lib  # noqa: E402
+
+
+def main() -> int:
+    p = argparse.ArgumentParser(description="Validate intake_evidence JSON (US-0078/US-0083).")
+    p.add_argument("--file", help="Path to JSON file containing one intake_evidence object.")
+    p.add_argument(
+        "--stdin",
+        action="store_true",
+        help="Read JSON object from stdin.",
+    )
+    p.add_argument(
+        "--self-test",
+        action="store_true",
+        help="Run library sanity checks and exit.",
+    )
+    args = p.parse_args()
+
+    if args.self_test:
+        intake_evidence_lib.self_test()
+        print("[INTAKE_EVIDENCE_SELF_TEST_OK]")
+        return 0
+
+    raw = ""
+    if args.file:
+        with open(os.path.abspath(args.file), encoding="utf-8") as f:
+            raw = f.read()
+    elif args.stdin:
+        raw = sys.stdin.read()
+    else:
+        print("error: specify --file, --stdin, or --self-test", file=sys.stderr)
+        return 2
+
+    try:
+        bundle = json.loads(raw)
+    except json.JSONDecodeError as e:
+        print(f"error: invalid JSON: {e}", file=sys.stderr)
+        return 2
+
+    if not isinstance(bundle, dict):
+        print("error: root must be a JSON object", file=sys.stderr)
+        return 2
+
+    r = intake_evidence_lib.validate_intake_evidence(bundle)
+    if r.ok:
+        print("[INTAKE_EVIDENCE_VALIDATION_OK]")
+        return 0
+
+    print(intake_evidence_lib.format_blocked_message(r), file=sys.stderr)
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/materialize_codebase_map.py

@@ -0,0 +1,184 @@
+#!/usr/bin/env python3
+"""Idempotent codebase map bootstrap (US-0082 / DEC-0065).
+
+Writes only docs/engineering/codebase-map.md and docs/engineering/dependencies.json
+per /map-codebase contract. Does not append docs/engineering/state.md.
+
+Diagnostics on stdout use deterministic tokens: [CODEBASE_MAP_OK] ... and CODEBASE_MAP_BLOCKED:...
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+
+BOOTSTRAP_SENTINEL = "<!-- its-magic:codebase-map-bootstrap v1 -->"
+
+REMEDIATION = (
+    "Remediation: run `/map-codebase` for a full pass; see "
+    "`docs/engineering/runbook.md` (Codebase map bootstrap) and "
+    "`docs/engineering/architecture.md` (# US-0082)."
+)
+
+
+def _bootstrap_map_markdown() -> str:
+    lines = [
+        "# Codebase Map",
+        "",
+        BOOTSTRAP_SENTINEL,
+        "",
+        "This is a **bootstrap** codebase map created by the lifecycle materializer "
+        "(**US-0082** / **DEC-0065**). It satisfies the “map exists” contract for fresh repos.",
+        "",
+        "For a full repository analysis, run **`/map-codebase`** (explicit/manual).",
+        "",
+        "## Stack",
+        "",
+        "| Aspect | Detail |",
+        "|--------|--------|",
+        "| (pending) | Run `/map-codebase` or edit this table after local analysis |",
+        "",
+        "## Entry Points",
+        "",
+        "| Entry | File | Purpose |",
+        "|-------|------|---------|",
+        "| (pending) | — | Run `/map-codebase` to populate |",
+        "",
+        "## Next steps",
+        "",
+        "1. Run **`/map-codebase`** for a deep pass, **or**",
+        "2. Edit this file directly with project-specific structure.",
+        "",
+    ]
+    return "\n".join(lines)
+
+
+def _bootstrap_dependencies_obj() -> dict:
+    return {"libraries": [], "runtime": [], "tooling": []}
+
+
+def _bootstrap_dependencies_text() -> str:
+    return json.dumps(_bootstrap_dependencies_obj(), sort_keys=True, indent=2) + "\n"
+
+
+def _normalize_newlines(text: str) -> str:
+    return text.replace("\r\n", "\n").replace("\r", "\n")
+
+
+def _json_stable(obj: object) -> str:
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"))
+
+
+def sync_map(map_path: Path, desired: str) -> tuple[str, bool]:
+    """Returns (status_token, content_mutated)."""
+    if not map_path.is_file():
+        map_path.write_text(desired, encoding="utf-8", newline="\n")
+        return "created", True
+    existing = _normalize_newlines(map_path.read_text(encoding="utf-8"))
+    if BOOTSTRAP_SENTINEL in existing:
+        if existing == desired:
+            return "noop", False
+        map_path.write_text(desired, encoding="utf-8", newline="\n")
+        return "refreshed_bootstrap", True
+    return "preserved_existing", False
+
+
+def sync_dependencies(deps_path: Path, map_allows_bootstrap_deps: bool) -> tuple[str, bool]:
+    """When map_allows_bootstrap_deps, deps may be created/updated to bootstrap empty schema."""
+    desired_txt = _bootstrap_dependencies_text()
+    want_obj = _bootstrap_dependencies_obj()
+    want_stable = _json_stable(want_obj)
+
+    if not deps_path.is_file():
+        deps_path.write_text(desired_txt, encoding="utf-8", newline="\n")
+        return "deps_created", True
+
+    raw = deps_path.read_text(encoding="utf-8")
+    try:
+        cur = json.loads(raw)
+    except json.JSONDecodeError:
+        if map_allows_bootstrap_deps:
+            deps_path.write_text(desired_txt, encoding="utf-8", newline="\n")
+            return "deps_repaired", True
+        return "deps_preserved_existing", False
+
+    if _json_stable(cur) == want_stable:
+        return "deps_noop", False
+
+    if map_allows_bootstrap_deps:
+        deps_path.write_text(desired_txt, encoding="utf-8", newline="\n")
+        return "deps_refreshed", True
+    return "deps_preserved_existing", False
+
+
+def main(argv: list[str] | None = None) -> int:
+    p = argparse.ArgumentParser(description="Materialize idempotent codebase map bootstrap.")
+    p.add_argument("--repo", default=".", help="Repository root")
+    p.add_argument(
+        "--trigger",
+        choices=("architecture", "map-codebase", "refresh-context"),
+        default="architecture",
+        help="Lifecycle trigger label (stdout diagnostics only)",
+    )
+    p.add_argument("--dry-run", action="store_true", help="Print actions; do not write files")
+    p.add_argument(
+        "--simulate-block",
+        metavar="SUBREASON",
+        default=None,
+        help="Emit CODEBASE_MAP_BLOCKED:SUBREASON and exit 2 (tests)",
+    )
+    p.add_argument(
+        "--check-present",
+        action="store_true",
+        help="Read-only: exit 0 if codebase-map.md exists, else CODEBASE_MAP_MISSING + exit 2",
+    )
+    args = p.parse_args(argv)
+
+    if args.simulate_block:
+        print(f"[CODEBASE_MAP_BLOCKED:{args.simulate_block}] trigger={args.trigger}")
+        print(REMEDIATION)
+        return 2
+
+    if os.environ.get("CODEBASE_MAP_LIFECYCLE_SKIP", "").strip() in ("1", "true", "yes"):
+        print(f"[CODEBASE_MAP_BLOCKED:policy_skip] trigger={args.trigger}")
+        print(REMEDIATION)
+        return 2
+
+    root = Path(args.repo).resolve()
+    eng = root / "docs" / "engineering"
+    map_path = eng / "codebase-map.md"
+    deps_path = eng / "dependencies.json"
+
+    if args.check_present:
+        if map_path.is_file():
+            print(f"[CODEBASE_MAP_OK] check_present trigger={args.trigger} path={map_path}")
+            return 0
+        print("[CODEBASE_MAP_MISSING]")
+        print(REMEDIATION)
+        return 2
+
+    desired_map = _bootstrap_map_markdown()
+
+    if args.dry_run:
+        print(f"[CODEBASE_MAP_OK] dry_run trigger={args.trigger} map={map_path} deps={deps_path}")
+        return 0
+
+    eng.mkdir(parents=True, exist_ok=True)
+
+    map_status, _ = sync_map(map_path, desired_map)
+    print(f"[CODEBASE_MAP_OK] {map_status} trigger={args.trigger} path={map_path}")
+
+    map_text = _normalize_newlines(map_path.read_text(encoding="utf-8"))
+    map_allows_bootstrap_deps = BOOTSTRAP_SENTINEL in map_text
+
+    dep_status, _ = sync_dependencies(deps_path, map_allows_bootstrap_deps)
+    if dep_status not in ("deps_noop", "deps_preserved_existing"):
+        print(f"[CODEBASE_MAP_OK] {dep_status} trigger={args.trigger} path={deps_path}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/remote_config_summary.py

@@ -0,0 +1,243 @@
+#!/usr/bin/env python3
+"""
+Summarize .cursor/remote.json for operators (US-0084 / US-0064 alignment).
+
+Stdout: non-secret labels and env-reference names only (no key material).
+Stderr: errors and skip reasons.
+
+Exit codes:
+  0 OK or REMOTE_EXECUTION=0 skip (DEC-0070)
+  1 usage / CLI error
+  2 config missing or unreadable
+  3 invalid JSON
+  4 schema / contract mismatch vs runbook remote.json contract
+  5 reserved (unused; DEC-0070 maps REMOTE_EXECUTION=0 to 0)
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+ENV_VAR_NAME = re.compile(r"^[A-Z][A-Z0-9_]*$")
+ALLOWED_TYPES = frozenset({"docker", "ssh", "vm"})
+AUTH_MODES = frozenset({"none", "env"})
+
+
+def _truthy_remote_execution(raw: str | None) -> bool:
+    if raw is None:
+        return False
+    return raw.strip() in {"1", "true", "TRUE", "yes", "YES", "on", "ON"}
+
+
+def _parse_args(argv: list[str]) -> tuple[argparse.Namespace, list[str]]:
+    p = argparse.ArgumentParser(description=__doc__.split("\n\n")[0], add_help=True)
+    p.add_argument(
+        "--config",
+        default=None,
+        help="Path to remote JSON (default: REMOTE_CONFIG env or .cursor/remote.json)",
+    )
+    return p.parse_known_args(argv)
+
+
+def _config_path(explicit: str | None) -> Path:
+    if explicit:
+        return Path(explicit).expanduser()
+    env = os.environ.get("REMOTE_CONFIG")
+    if env:
+        return Path(env).expanduser()
+    return Path(".cursor/remote.json")
+
+
+def _validate_env_ref(name: str, value: Any, prefix: str) -> str | None:
+    if not isinstance(value, str):
+        return f"{prefix}: {name} must be a string env-reference name"
+    if not ENV_VAR_NAME.match(value):
+        return f"{prefix}: {name} must look like an env var name (A-Z_0-9)"
+    return None
+
+
+def validate_and_summarize(path: Path, data: dict[str, Any]) -> tuple[list[str], list[str]]:
+    """Return (stdout_lines, error_messages)."""
+    errs: list[str] = []
+    out: list[str] = []
+    out.append(f"remote_config={path.as_posix()}")
+
+    if not isinstance(data.get("version"), int):
+        errs.append("[REMOTE_CONFIG_ERROR] root.version: expected integer")
+    if not isinstance(data.get("defaultTarget"), str) or not data["defaultTarget"]:
+        errs.append("[REMOTE_CONFIG_ERROR] root.defaultTarget: expected non-empty string")
+    targets = data.get("targets")
+    if not isinstance(targets, list) or not targets:
+        errs.append("[REMOTE_CONFIG_ERROR] root.targets: expected non-empty array")
+
+    if errs:
+        return out, errs
+
+    by_id: dict[str, dict[str, Any]] = {}
+    for i, t in enumerate(targets):
+        prefix = f"targets[{i}]"
+        if not isinstance(t, dict):
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}: expected object")
+            continue
+        tid = t.get("id")
+        if not isinstance(tid, str) or not tid:
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.id: expected non-empty string")
+        ttype = t.get("type")
+        if ttype not in ALLOWED_TYPES:
+            errs.append(
+                f"[REMOTE_CONFIG_ERROR] {prefix}.type: expected one of {sorted(ALLOWED_TYPES)}"
+            )
+        if not isinstance(t.get("enabled"), bool):
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.enabled: expected boolean")
+        if not isinstance(t.get("host"), str) or not t["host"]:
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.host: expected non-empty string")
+        port = t.get("port")
+        if not isinstance(port, int) or not (1 <= port <= 65535):
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.port: expected integer 1..65535")
+        if not isinstance(t.get("workspaceRoot"), str) or not t["workspaceRoot"]:
+            errs.append(
+                f"[REMOTE_CONFIG_ERROR] {prefix}.workspaceRoot: expected non-empty string"
+            )
+        auth = t.get("auth")
+        if auth is not None:
+            if not isinstance(auth, dict):
+                errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.auth: expected object")
+            else:
+                mode = auth.get("mode")
+                if mode not in AUTH_MODES:
+                    errs.append(
+                        f"[REMOTE_CONFIG_ERROR] {prefix}.auth.mode: expected one of {sorted(AUTH_MODES)}"
+                    )
+                elif mode == "env":
+                    env_keys = (
+                        "tokenEnv",
+                        "passwordEnv",
+                        "privateKeyPathEnv",
+                        "usernameEnv",
+                    )
+                    any_ref = False
+                    for k in env_keys:
+                        if k not in auth:
+                            continue
+                        any_ref = True
+                        err = _validate_env_ref(k, auth[k], f"{prefix}.auth")
+                        if err:
+                            errs.append(f"[REMOTE_CONFIG_ERROR] {err}")
+                    if not any_ref:
+                        errs.append(
+                            f"[REMOTE_CONFIG_ERROR] {prefix}.auth: mode=env requires at least one *Env field"
+                        )
+        if isinstance(tid, str) and tid:
+            by_id[tid] = t
+
+    default = data["defaultTarget"]
+    if default not in by_id:
+        errs.append(
+            f"[REMOTE_CONFIG_ERROR] defaultTarget={default!r} not found in targets[].id"
+        )
+    elif not by_id[default].get("enabled"):
+        errs.append(
+            f"[REMOTE_CONFIG_ERROR] defaultTarget={default!r} must reference an enabled target"
+        )
+
+    if errs:
+        return out, errs
+
+    out.append(f"defaultTarget={data['defaultTarget']}")
+    for t in targets:
+        assert isinstance(t, dict)
+        tid = t["id"]
+        parts = [
+            f"id={tid}",
+            f"type={t['type']}",
+            f"enabled={t['enabled']!s}",
+            f"host={t['host']}",
+            f"port={t['port']}",
+            f"workspaceRoot={t['workspaceRoot']}",
+        ]
+        auth = t.get("auth")
+        if isinstance(auth, dict):
+            parts.append(f"auth.mode={auth.get('mode')}")
+            for k in (
+                "tokenEnv",
+                "passwordEnv",
+                "privateKeyPathEnv",
+                "usernameEnv",
+            ):
+                if k in auth and isinstance(auth[k], str):
+                    parts.append(f"auth.{k}={auth[k]}")
+        out.append("target:" + " ".join(parts))
+
+    return out, []
+
+
+def main(argv: list[str] | None = None) -> int:
+    args, rest = _parse_args(argv or sys.argv[1:])
+    if rest:
+        print(
+            f"[REMOTE_CONFIG_SUMMARY] unknown arguments: {' '.join(rest)}",
+            file=sys.stderr,
+        )
+        return 1
+    if not _truthy_remote_execution(os.environ.get("REMOTE_EXECUTION")):
+        print(
+            "[REMOTE_CONFIG_SUMMARY] REMOTE_EXECUTION!=1: skip validation/summary "
+            "(zero overhead; DEC-0070 / US-0084).",
+            file=sys.stderr,
+        )
+        return 0
+
+    path = _config_path(args.config)
+    if not path.is_file():
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: file missing or unreadable. "
+            "Fix: create config or set REMOTE_EXECUTION=0.",
+            file=sys.stderr,
+        )
+        return 2
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except OSError as e:
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: read failed ({e}). Fix: permissions/path.",
+            file=sys.stderr,
+        )
+        return 2
+    try:
+        data = json.loads(raw)
+    except json.JSONDecodeError as e:
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: invalid JSON ({e}). Fix: syntax.",
+            file=sys.stderr,
+        )
+        return 3
+    if not isinstance(data, dict):
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: expected JSON object at root.",
+            file=sys.stderr,
+        )
+        return 4
+
+    lines, errs = validate_and_summarize(path, data)
+    if errs:
+        for line in errs:
+            print(line, file=sys.stderr)
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: contract check failed. "
+            "Fix: align with docs/engineering/runbook.md remote contract (US-0084).",
+            file=sys.stderr,
+        )
+        return 4
+    for line in lines:
+        print(line)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/template/.cursor/agents/curator.mdc

@@ -0,0 +1,35 @@
+---
+description: "Curator agent"
+---
+
+You are the Curator. Keep context compact and artifacts current.
+You start in a fresh agent context for this phase.
+
+Inputs:
+- `docs/engineering/state.md`
+- `docs/engineering/decisions.md`
+- Sprint summaries and handoffs
+
+Outputs:
+- Refreshed `docs/engineering/state.md`
+- Refreshed `docs/engineering/decisions.md`
+- Updated sprint summary
+- `handoffs/resume_brief.md`
+
+Rules:
+- Avoid context bloat. Summarize and prune.
+- Ensure pause/resume is reliable.
+- Use only artifact files and handoffs as context, not prior chat history.
+- After writing the requested artifact updates, stop.
+
+Isolation evidence (US-0048 / DEC-0029):
+- When running `/pause` or `/resume`, append isolation evidence entries to
+  `docs/engineering/state.md` (`phase_id=pause|resume`, `role=curator`,
+  `fresh_context_marker`, `timestamp`, `evidence_ref`).
+
+Research knowledge base maintenance:
+- During `/refresh-context`, review `docs/engineering/research.md` for freshness.
+- Mark entries as "outdated" if sources are stale or context has changed.
+- Consolidate duplicate entries (point newer to older or merge).
+- Flag entries not linked to any active story/decision for potential pruning.
+

package/template/.cursor/agents/dev.mdc

@@ -0,0 +1,29 @@
+---
+description: "Developer agent"
+---
+
+You are the Dev. Implement tasks and maintain artifacts.
+You start in a fresh agent context for this phase.
+
+Inputs:
+- `sprints/S0001/tasks.md`
+- `handoffs/tl_to_dev.md`
+
+Outputs:
+- Code changes
+- `sprints/S0001/summary.md`
+- `docs/engineering/state.md`
+- `handoffs/dev_to_qa.md` (when ready)
+
+Rules:
+- Implement one task at a time.
+- Update summaries and state after each task.
+- Use only artifact files and handoffs as context, not prior chat history.
+- After writing `handoffs/dev_to_qa.md`, stop and require `/qa` in a new
+  subagent/chat.
+
+Isolation evidence (US-0048 / DEC-0029):
+- Append isolation evidence to `docs/engineering/state.md` for `phase_id=execute`,
+  including: `phase_id`, `role`, `fresh_context_marker`, `timestamp`,
+  `evidence_ref`.
+