agent-lifecycle-kit 2.35.0__tar.gz → 2.36.0__tar.gz

{agent_lifecycle_kit-2.35.0/src/agent_lifecycle_kit.egg-info → agent_lifecycle_kit-2.36.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-lifecycle-kit
-Version: 2.35.0
+Version: 2.36.0
 Summary: Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion.
 Author: Agent Lifecycle Kit contributors
 License: Apache-2.0
@@ -33,7 +33,7 @@ Dynamic: license-file
 
 **Agent Lifecycle Kit (ALK)** coordinates coding-agent work through a verifiable finish. It keeps the requested outcome, reviewed plan, execution boundaries, evidence and acceptance decisions connected while the external agent changes the project.
 
-Release 2.35 documents the [external AI SDLC CLI contract](docs/guides/ai-sdlc-integration.md) and eight bounded consumer cases. Wheel/sdist include both guides and case JSON; the plugin ships the paired CLI contract. Native authority and release gates remain required.
+Release 2.36 secures imports. Release 2.35 documents the [external AI SDLC CLI contract](docs/guides/ai-sdlc-integration.md) and eight bounded consumer cases. Wheel/sdist include both guides and case JSON; the plugin ships the paired CLI contract. Native authority and release gates remain required.
 
 The provider-neutral workflow works with Codex, Claude Code, Qwen Code, Goose, OpenInterpreter, Pi, Grok Build, or another CLI. Provider commands, model choice and secret handling stay in adapters or host-local profiles.
 
@@ -42,7 +42,7 @@ Release 2.28 adds [bounded lifecycle and accounting baselines](docs/reference/pe
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md). Release 2.23 adds [compact S0/S1 authoring](docs/reference/tier-proportional-plan-packages.md) with explicit checklist completion and unchanged approval gates. Release 2.22 adds [conservative plan-review reuse](docs/reference/conservative-delta-review.md) with independent current applicability and no automatic full reruns. Release 2.21 adds [command accounting, bounded preparation and response recovery](docs/reference/source-native-workflow-accounting.md). Release 2.20 adds [target-bound initialization](docs/reference/cli.md#release-220-composed-initialization-and-digest-display), [bounded local continuation](docs/reference/workflow-continuation.md) and batched Git snapshots. Release 2.19 adds [safe artifact authoring and planning preflight](docs/reference/safe-artifact-authoring.md), [bounded review handoff](docs/reference/review-mesh.md#bounded-review-handoff) and thin skills with complete references. Release 2.18 bounds process/Git diagnostics, hardens signing and distinguishes OpenCode 1.x/2.x compatibility ([adapter notes](docs/adapters/opencode.md)); 2.17 strengthens [workflow validation and recovery](docs/reference/workflow-completeness.md). Release 2.16 introduced cumulative accounting within verified host capabilities; see [retention maintenance](docs/operations/retention-maintenance.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.35.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
+It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.36.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
 
 For a quick start, run:
 

{agent_lifecycle_kit-2.35.0 → agent_lifecycle_kit-2.36.0}/README.md

@@ -10,7 +10,7 @@
 
 **Agent Lifecycle Kit (ALK)** coordinates coding-agent work through a verifiable finish. It keeps the requested outcome, reviewed plan, execution boundaries, evidence and acceptance decisions connected while the external agent changes the project.
 
-Release 2.35 documents the [external AI SDLC CLI contract](docs/guides/ai-sdlc-integration.md) and eight bounded consumer cases. Wheel/sdist include both guides and case JSON; the plugin ships the paired CLI contract. Native authority and release gates remain required.
+Release 2.36 secures imports. Release 2.35 documents the [external AI SDLC CLI contract](docs/guides/ai-sdlc-integration.md) and eight bounded consumer cases. Wheel/sdist include both guides and case JSON; the plugin ships the paired CLI contract. Native authority and release gates remain required.
 
 The provider-neutral workflow works with Codex, Claude Code, Qwen Code, Goose, OpenInterpreter, Pi, Grok Build, or another CLI. Provider commands, model choice and secret handling stay in adapters or host-local profiles.
 
@@ -19,7 +19,7 @@ Release 2.28 adds [bounded lifecycle and accounting baselines](docs/reference/pe
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md). Release 2.23 adds [compact S0/S1 authoring](docs/reference/tier-proportional-plan-packages.md) with explicit checklist completion and unchanged approval gates. Release 2.22 adds [conservative plan-review reuse](docs/reference/conservative-delta-review.md) with independent current applicability and no automatic full reruns. Release 2.21 adds [command accounting, bounded preparation and response recovery](docs/reference/source-native-workflow-accounting.md). Release 2.20 adds [target-bound initialization](docs/reference/cli.md#release-220-composed-initialization-and-digest-display), [bounded local continuation](docs/reference/workflow-continuation.md) and batched Git snapshots. Release 2.19 adds [safe artifact authoring and planning preflight](docs/reference/safe-artifact-authoring.md), [bounded review handoff](docs/reference/review-mesh.md#bounded-review-handoff) and thin skills with complete references. Release 2.18 bounds process/Git diagnostics, hardens signing and distinguishes OpenCode 1.x/2.x compatibility ([adapter notes](docs/adapters/opencode.md)); 2.17 strengthens [workflow validation and recovery](docs/reference/workflow-completeness.md). Release 2.16 introduced cumulative accounting within verified host capabilities; see [retention maintenance](docs/operations/retention-maintenance.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.35.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
+It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.36.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
 
 For a quick start, run:
 

{agent_lifecycle_kit-2.35.0 → agent_lifecycle_kit-2.36.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-lifecycle-kit"
-version = "2.35.0"
+version = "2.36.0"
 description = "Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion."
 readme = "README.md"
 requires-python = ">=3.11,<3.16"

{agent_lifecycle_kit-2.35.0 → agent_lifecycle_kit-2.36.0}/src/agent_lifecycle/_version.py

@@ -1,3 +1,3 @@
 """Package version."""
 
-__version__ = "2.35.0"
+__version__ = "2.36.0"

{agent_lifecycle_kit-2.35.0 → agent_lifecycle_kit-2.36.0}/src/agent_lifecycle/contracts/redaction.py

@@ -19,6 +19,7 @@ _SENSITIVE_EXACT_KEYS = {
     "api_key",
     "apikey",
     "authorization",
+    "cookie",
     "credential",
     "credentials",
     "id_token",
@@ -30,6 +31,7 @@ _SENSITIVE_EXACT_KEYS = {
     "refresh_token",
     "refreshtoken",
     "secret",
+    "set_cookie",
     "session_token",
     "sessiontoken",
     "token",
@@ -66,6 +68,8 @@ _BARE_TOKEN = re.compile(
     r"sk-(?:proj-)?[A-Za-z0-9_-]{20,}|"
     r"eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|"
     r"gh[pousr]_[A-Za-z0-9_]{20,}|"
+    r"github"
+    r"_pat_[A-Za-z0-9_]{20,}|"
     r"glpat-[A-Za-z0-9_-]{20,}|"
     r"npm_[A-Za-z0-9]{20,}|"
     r"(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}|"
@@ -102,6 +106,13 @@ _AUTHORIZATION_HEADER = re.compile(
     r"(?:" + _AUTH_PARAMETER + r"(?:\s*,\s*" + _AUTH_PARAMETER + r")*|[^\s,;}\]]+)",
     re.IGNORECASE,
 )
+_COOKIE_HEADER = re.compile(
+    r"(?<![A-Za-z0-9_.-])(?P<key>(?:\\*[\"'])?(?:set[-_])?cookie(?:\\*[\"'])?)"
+    r"(?P<separator>\s*[:=]\s*)"
+    r"(?P<value>(?P<escaped_quote>\\+[\"'])(?:\\.|[^\\])*?(?P=escaped_quote)|"
+    r"\"(?:\\.|[^\"])*\"|'(?:\\.|[^'])*'|[^\r\n]*(?:\r?\n[ \t]+[^\r\n]*)*)",
+    re.IGNORECASE,
+)
 _HTTP_URL = re.compile(r"https?://[^\s\"'<>]+", re.IGNORECASE)
 _HTTP_AUTHORITY = re.compile(r"https?://[^/?#]*", re.IGNORECASE)
 _MAX_NESTED_URL_DEPTH = 8
@@ -210,10 +221,11 @@ def _replace_matches(pattern: re.Pattern[str], value: str, replacement: str) ->
 
 
 def _redact_common_secret_markers(value: str) -> tuple[str, int]:
+    value, cookie_count = _COOKIE_HEADER.subn(_replace_sensitive_assignment, value)
     value, private_key_count = _replace_matches(_PRIVATE_KEY, value, REDACTED_VALUE)
     value, bearer_count = _replace_matches(_BEARER, value, f"Bearer {REDACTED_VALUE}")
     value, token_count = _replace_matches(_BARE_TOKEN, value, REDACTED_VALUE)
-    return value, private_key_count + bearer_count + token_count
+    return value, cookie_count + private_key_count + bearer_count + token_count
 
 
 def _has_secret_outside_urls(value: str, url_spans: list[tuple[int, int]]) -> bool:

{agent_lifecycle_kit-2.35.0 → agent_lifecycle_kit-2.36.0}/src/agent_lifecycle/imports/external_dialects.py

@@ -3,12 +3,14 @@
 from __future__ import annotations
 
 import json
+import os
 import re
 from pathlib import Path
 from typing import Any
 
 from agent_lifecycle.context.rendering import estimate_tokens
 from agent_lifecycle.contracts import LifecycleError, canonical_digest, sha256_hex
+from agent_lifecycle.contracts.authority_io import open_authority_read
 from agent_lifecycle.imports.dialect_profiles import (
     DEFAULT_PROFILE_ID,
     external_dialect_profile,
@@ -175,14 +177,18 @@ def require_external_import_pass(validation: dict[str, Any]) -> dict[str, Any]:
 
 
 def _read_source(source_path: Path, *, max_input_bytes: int, blockers: list[dict[str, Any]]) -> bytes:
-    if not source_path.is_file():
+    try:
+        with open_authority_read(Path(os.path.normpath(source_path.absolute()))) as stream:
+            data = stream.read(max_input_bytes + 1)
+    except FileNotFoundError:
         blockers.append({"code": "external-dialect-source-missing", "sourceLabel": source_path.name})
         return b""
-    size = source_path.stat().st_size
-    if size > max_input_bytes:
-        blockers.append({"code": "external-dialect-input-cap-exceeded", "inputBytes": size, "cap": max_input_bytes})
+    if len(data) > max_input_bytes:
+        blockers.append(
+            {"code": "external-dialect-input-cap-exceeded", "inputBytes": len(data), "cap": max_input_bytes}
+        )
         return b""
-    return source_path.read_bytes()
+    return data
 
 
 def _decode_source(data: bytes, blockers: list[dict[str, Any]]) -> str:

{agent_lifecycle_kit-2.35.0 → agent_lifecycle_kit-2.36.0}/src/agent_lifecycle/imports/planning.py

@@ -2,12 +2,14 @@
 
 from __future__ import annotations
 
+import os
 import re
 from pathlib import Path
 from typing import Any
 
 from agent_lifecycle.context.rendering import estimate_tokens
 from agent_lifecycle.contracts import LifecycleError, canonical_digest, load_json_object, sha256_hex
+from agent_lifecycle.contracts.authority_io import open_authority_read
 from agent_lifecycle.contracts.redaction import is_sensitive_key, redact_text_with_stats
 from agent_lifecycle.planning import validate_plan_manifest
 
@@ -47,16 +49,15 @@ def import_planning_input(
     _check_positive_cap(max_input_bytes, "maxInputBytes")
     _check_positive_cap(target_tokens, "targetTokens")
     blockers: list[dict[str, Any]] = []
-    if not source_path.is_file():
+    try:
+        with open_authority_read(Path(os.path.normpath(source_path.absolute()))) as stream:
+            data = stream.read(max_input_bytes + 1)
+    except FileNotFoundError:
         blockers.append({"code": "planning-import-source-missing", "sourceLabel": source_path.name})
         data = b""
-    else:
-        size = source_path.stat().st_size
-        if size > max_input_bytes:
-            blockers.append({"code": "planning-import-input-cap-exceeded", "inputBytes": size, "cap": max_input_bytes})
-            data = b""
-        else:
-            data = source_path.read_bytes()
+    if len(data) > max_input_bytes:
+        blockers.append({"code": "planning-import-input-cap-exceeded", "inputBytes": len(data), "cap": max_input_bytes})
+        data = b""
     return _build_import_result(
         data,
         source_label=source_path.name,

{agent_lifecycle_kit-2.35.0 → agent_lifecycle_kit-2.36.0/src/agent_lifecycle_kit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-lifecycle-kit
-Version: 2.35.0
+Version: 2.36.0
 Summary: Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion.
 Author: Agent Lifecycle Kit contributors
 License: Apache-2.0
@@ -33,7 +33,7 @@ Dynamic: license-file
 
 **Agent Lifecycle Kit (ALK)** coordinates coding-agent work through a verifiable finish. It keeps the requested outcome, reviewed plan, execution boundaries, evidence and acceptance decisions connected while the external agent changes the project.
 
-Release 2.35 documents the [external AI SDLC CLI contract](docs/guides/ai-sdlc-integration.md) and eight bounded consumer cases. Wheel/sdist include both guides and case JSON; the plugin ships the paired CLI contract. Native authority and release gates remain required.
+Release 2.36 secures imports. Release 2.35 documents the [external AI SDLC CLI contract](docs/guides/ai-sdlc-integration.md) and eight bounded consumer cases. Wheel/sdist include both guides and case JSON; the plugin ships the paired CLI contract. Native authority and release gates remain required.
 
 The provider-neutral workflow works with Codex, Claude Code, Qwen Code, Goose, OpenInterpreter, Pi, Grok Build, or another CLI. Provider commands, model choice and secret handling stay in adapters or host-local profiles.
 
@@ -42,7 +42,7 @@ Release 2.28 adds [bounded lifecycle and accounting baselines](docs/reference/pe
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md). Release 2.23 adds [compact S0/S1 authoring](docs/reference/tier-proportional-plan-packages.md) with explicit checklist completion and unchanged approval gates. Release 2.22 adds [conservative plan-review reuse](docs/reference/conservative-delta-review.md) with independent current applicability and no automatic full reruns. Release 2.21 adds [command accounting, bounded preparation and response recovery](docs/reference/source-native-workflow-accounting.md). Release 2.20 adds [target-bound initialization](docs/reference/cli.md#release-220-composed-initialization-and-digest-display), [bounded local continuation](docs/reference/workflow-continuation.md) and batched Git snapshots. Release 2.19 adds [safe artifact authoring and planning preflight](docs/reference/safe-artifact-authoring.md), [bounded review handoff](docs/reference/review-mesh.md#bounded-review-handoff) and thin skills with complete references. Release 2.18 bounds process/Git diagnostics, hardens signing and distinguishes OpenCode 1.x/2.x compatibility ([adapter notes](docs/adapters/opencode.md)); 2.17 strengthens [workflow validation and recovery](docs/reference/workflow-completeness.md). Release 2.16 introduced cumulative accounting within verified host capabilities; see [retention maintenance](docs/operations/retention-maintenance.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.35.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
+It includes macOS, Linux and Windows instructions, Python 3.11-3.15, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.36.0`, and common `agent-lifecycle version` errors. See [2.15 migration notes](docs/reference/cli.md#migrating-authority-artifacts-to-215) and [authority boundaries](docs/reference/authority-artifact-boundaries.md).
 
 For a quick start, run:
 

agent_lifecycle_kit-2.36.0/tests/cli/fixtures/external-consumer-cases.json

@@ -0,0 +1,49 @@
+{
+  "schemaVersion": "external-consumer-cases.v1",
+  "evidenceBoundary": "UNIT_ONLY",
+  "testedVersions": [
+    "2.34.0",
+    "2.35.0",
+    "2.36.0"
+  ],
+  "versionSchema": "agent-lifecycle-version.v1",
+  "continuationSchema": "agent-workflow-continuation-receipt.v1",
+  "actionSchema": "agent-workflow-continuation-action.v1",
+  "cases": [
+    {
+      "id": "readonly-projection",
+      "outcome": "READY"
+    },
+    {
+      "id": "guarded-action",
+      "outcome": "APPLIED"
+    },
+    {
+      "id": "stale-guards",
+      "codes": [
+        "continuation-projection-state-mismatch",
+        "continuation-projection-action-mismatch"
+      ]
+    },
+    {
+      "id": "missing-input",
+      "outcome": "INPUT_REQUIRED"
+    },
+    {
+      "id": "unattested-usage",
+      "code": "model-usage-validation-failed"
+    },
+    {
+      "id": "critical-route",
+      "code": "model-route-unsupported"
+    },
+    {
+      "id": "lost-reply",
+      "outcome": "RECONCILED"
+    },
+    {
+      "id": "incompatible-contract",
+      "outcome": "CONSUMER_REFUSED"
+    }
+  ]
+}

agent_lifecycle_kit-2.35.0/tests/cli/fixtures/external-consumer-cases.json

@@ -1,18 +0,0 @@
-{
-  "schemaVersion": "external-consumer-cases.v1",
-  "evidenceBoundary": "UNIT_ONLY",
-  "testedVersions": ["2.34.0", "2.35.0"],
-  "versionSchema": "agent-lifecycle-version.v1",
-  "continuationSchema": "agent-workflow-continuation-receipt.v1",
-  "actionSchema": "agent-workflow-continuation-action.v1",
-  "cases": [
-    {"id": "readonly-projection", "outcome": "READY"},
-    {"id": "guarded-action", "outcome": "APPLIED"},
-    {"id": "stale-guards", "codes": ["continuation-projection-state-mismatch", "continuation-projection-action-mismatch"]},
-    {"id": "missing-input", "outcome": "INPUT_REQUIRED"},
-    {"id": "unattested-usage", "code": "model-usage-validation-failed"},
-    {"id": "critical-route", "code": "model-route-unsupported"},
-    {"id": "lost-reply", "outcome": "RECONCILED"},
-    {"id": "incompatible-contract", "outcome": "CONSUMER_REFUSED"}
-  ]
-}