agentic-dev-loop 0.10.0__tar.gz → 0.10.2__tar.gz

{agentic_dev_loop-0.10.0/src/agentic_dev_loop.egg-info → agentic_dev_loop-0.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.10.0
+Version: 0.10.2
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -275,6 +275,7 @@ steps:
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` runs fresh at every step boundary in a one-shot provision container targeting the export (command or agent steps; network ON; no stamping); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
+| `profile:` (top-level) | Names a bundled toolchain profile (`python`, `dotnet-node`) or a consumer profile file path. `load_config` merges the profile at load time: isolation key-wise with the pipeline winning, caches unioned profile-first. Absent = today's behavior. |
 | `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
@@ -446,12 +447,39 @@ console.
 
 ## Authoring a loop for your own repo
 
-A consumer repo needs two things written by hand - a pipeline file and the
-agent files it names - both committed before the first run (the host-boundary
-check refuses dirty tooling, and the `commit` step never commits it). Two
-reference layouts ship today: this repo dogfoods the engine on itself
-(python + pytest, no frontend, CLI-only qa), and the consumer repo carries
-the wider shape (.NET + npm frontend + a networked browser-probing qa step).
+### Start with `agentic-dev-loop init`
+
+`init` writes the onboarding surface from a bundled toolchain profile:
+
+```bash
+agentic-dev-loop init --profile python        # or: --profile dotnet-node
+```
+
+It detects solution files, `package.json` directories, lockfiles, README, and
+AGENTS.md, asks only what detection cannot answer, and writes
+`agentic-dev-loop/pipeline.yaml`, the three agent files, an executable
+`trigger-agentic-dev-loop.sh`, `agentic-dev-loop/.engine-version` (the exact
+installed engine version), any missing premise files, gitignore additions, and
+an env-file template. It refuses to overwrite an existing
+`agentic-dev-loop/` directory. A consumer-authored profile file can be passed
+by path instead of a bundled name.
+
+Profiles carry the environment facts every app on a toolchain shares (image,
+cpus, caches, premise files, gitignore lines); recipes carry the gate shape and
+command vocabulary. The pipeline references a profile with the top-level
+`profile:` key, and `load_config` merges it at load time: the pipeline wins on
+scalars, caches union profile-first, and absence of the key behaves exactly as
+before.
+
+`agentic-dev-loop doctor --fast` is the per-run gate the trigger runs first.
+Hard failures abort the run (engine pin mismatch, engine runtime availability,
+API version, git repo, `.env*` files); warnings print and continue. `doctor
+--json` emits the same results mechanically. The trigger repairs a pin/install
+mismatch exactly once, then fails hard.
+
+A consumer repo needs a pipeline file and the agent files it names, both
+committed before the first run (the host-boundary check refuses dirty tooling,
+and the `commit` step never commits it). `init` writes them; the layout is:
 
 ```
 <repo>/agentic-dev-loop/pipeline.yaml
@@ -537,12 +565,11 @@ Adaptation checklist for a new repo:
 
 1. `llm:` - model, `base_url`, `api_key_env`.
 2. `llms:` (optional) - named profiles for multi-provider lanes (keep review on the strongest model); a step opts in with `llm: <name>`.
-3. `isolation:` - toolchain image override (the consumer repo pins a
-   toolchain image by digest) and `seccomp_profile: bundled:chromium-userns`
-   only if a stage runs Chromium.
-4. `caches:` - toolchain cache dirs as rw bind-mounts shared across runs
-   (`.nuget-packages`, `qa/node_modules`, `qa/.browsers`,
-   `frontend-editor/node_modules`); caches are never synced back, and a
+3. `profile:` - name a bundled profile (`python`, `dotnet-node`) or a
+   consumer profile path. The profile supplies `isolation:` (image,
+   `seccomp_profile`, cpus) and `caches:`; pipeline keys override its scalars.
+4. `caches:` - profile-supplied toolchain caches plus any run-specific dirs
+   (`.nuget-packages`, `qa/.browsers`); caches are never synced back, and a
    step's `setup:` hook runs with them mounted so it can warm them.
 5. `sync_excludes:` - build output trees (`**/bin/**`, `**/obj/**`).
 6. `secrets:` - refs only, resolved from host env; each step opts in to the

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.2}/README.md

@@ -231,6 +231,7 @@ steps:
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` runs fresh at every step boundary in a one-shot provision container targeting the export (command or agent steps; network ON; no stamping); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
+| `profile:` (top-level) | Names a bundled toolchain profile (`python`, `dotnet-node`) or a consumer profile file path. `load_config` merges the profile at load time: isolation key-wise with the pipeline winning, caches unioned profile-first. Absent = today's behavior. |
 | `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
@@ -402,12 +403,39 @@ console.
 
 ## Authoring a loop for your own repo
 
-A consumer repo needs two things written by hand - a pipeline file and the
-agent files it names - both committed before the first run (the host-boundary
-check refuses dirty tooling, and the `commit` step never commits it). Two
-reference layouts ship today: this repo dogfoods the engine on itself
-(python + pytest, no frontend, CLI-only qa), and the consumer repo carries
-the wider shape (.NET + npm frontend + a networked browser-probing qa step).
+### Start with `agentic-dev-loop init`
+
+`init` writes the onboarding surface from a bundled toolchain profile:
+
+```bash
+agentic-dev-loop init --profile python        # or: --profile dotnet-node
+```
+
+It detects solution files, `package.json` directories, lockfiles, README, and
+AGENTS.md, asks only what detection cannot answer, and writes
+`agentic-dev-loop/pipeline.yaml`, the three agent files, an executable
+`trigger-agentic-dev-loop.sh`, `agentic-dev-loop/.engine-version` (the exact
+installed engine version), any missing premise files, gitignore additions, and
+an env-file template. It refuses to overwrite an existing
+`agentic-dev-loop/` directory. A consumer-authored profile file can be passed
+by path instead of a bundled name.
+
+Profiles carry the environment facts every app on a toolchain shares (image,
+cpus, caches, premise files, gitignore lines); recipes carry the gate shape and
+command vocabulary. The pipeline references a profile with the top-level
+`profile:` key, and `load_config` merges it at load time: the pipeline wins on
+scalars, caches union profile-first, and absence of the key behaves exactly as
+before.
+
+`agentic-dev-loop doctor --fast` is the per-run gate the trigger runs first.
+Hard failures abort the run (engine pin mismatch, engine runtime availability,
+API version, git repo, `.env*` files); warnings print and continue. `doctor
+--json` emits the same results mechanically. The trigger repairs a pin/install
+mismatch exactly once, then fails hard.
+
+A consumer repo needs a pipeline file and the agent files it names, both
+committed before the first run (the host-boundary check refuses dirty tooling,
+and the `commit` step never commits it). `init` writes them; the layout is:
 
 ```
 <repo>/agentic-dev-loop/pipeline.yaml
@@ -493,12 +521,11 @@ Adaptation checklist for a new repo:
 
 1. `llm:` - model, `base_url`, `api_key_env`.
 2. `llms:` (optional) - named profiles for multi-provider lanes (keep review on the strongest model); a step opts in with `llm: <name>`.
-3. `isolation:` - toolchain image override (the consumer repo pins a
-   toolchain image by digest) and `seccomp_profile: bundled:chromium-userns`
-   only if a stage runs Chromium.
-4. `caches:` - toolchain cache dirs as rw bind-mounts shared across runs
-   (`.nuget-packages`, `qa/node_modules`, `qa/.browsers`,
-   `frontend-editor/node_modules`); caches are never synced back, and a
+3. `profile:` - name a bundled profile (`python`, `dotnet-node`) or a
+   consumer profile path. The profile supplies `isolation:` (image,
+   `seccomp_profile`, cpus) and `caches:`; pipeline keys override its scalars.
+4. `caches:` - profile-supplied toolchain caches plus any run-specific dirs
+   (`.nuget-packages`, `qa/.browsers`); caches are never synced back, and a
    step's `setup:` hook runs with them mounted so it can warm them.
 5. `sync_excludes:` - build output trees (`**/bin/**`, `**/obj/**`).
 6. `secrets:` - refs only, resolved from host env; each step opts in to the

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "0.10.0"
+version = "0.10.2"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -76,8 +76,10 @@ where = ["src"]
 
 [tool.setuptools.package-data]
 agentic_dev_loop = ["py.typed"]
+"agentic_dev_loop.core.profiles" = ["data/*.yaml"]
 "agentic_dev_loop.engine" = ["*.md"]
 "agentic_dev_loop.engine.seccomp" = ["*.json"]
+"agentic_dev_loop.engine.onboarding" = ["recipes/*.yaml", "templates/*"]
 
 [tool.pytest.ini_options]
 markers = [

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.2}/src/agentic_dev_loop/core/config.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import hashlib
+import importlib.metadata
 import re
 import warnings
 from pathlib import Path
@@ -647,6 +648,9 @@ class PipelineConfig(BaseModel):
     # edit instead of raising. Same declared-path vocabulary as
     # ``sync_excludes:``.
     merge_on_conflict: list[str] = []
+    # 055: the toolchain profile resolved at load time. Kept on the validated
+    # config so the run records which profile supplied its defaults.
+    profile: str | None = None
 
     @field_validator("deps_policy")
     @classmethod
@@ -892,6 +896,21 @@ def load_config(path: Path) -> PipelineConfig:
         raise ValueError(
             f"pipeline config must be a mapping, got {type(data).__name__}: {path}"
         )
+    profile_ref = data.pop("profile", None)
+    if profile_ref is not None:
+        from agentic_dev_loop.core.profiles import (
+            ProfileError,
+            load_profile,
+            merge_profile,
+        )
+
+        try:
+            installed = importlib.metadata.version("agentic-dev-loop")
+            profile = load_profile(str(profile_ref), installed)
+            data = merge_profile(data, profile)
+        except ProfileError as exc:
+            raise ValueError(f"pipeline {path}: {exc}") from exc
+        data["profile"] = profile_ref
     if "state_dir" not in data:
         data["state_dir"] = default_state_dir(path)
     cfg = PipelineConfig.model_validate(data)

agentic_dev_loop-0.10.2/src/agentic_dev_loop/core/profiles/__init__.py

@@ -0,0 +1,178 @@
+"""Toolchain profiles: bundled data plus the load-time merge into a pipeline.
+
+A profile supplies the environment facts every app on a toolchain shares
+(isolation image, caches, premise files, gitignore lines, doctor probes).
+Profiles never carry commands, gates, or steps - those live in
+engine-resident recipes. The subpackage is intentionally dependency-light
+(stdlib + pydantic + PyYAML) so ``core`` can resolve a profile at config
+load time without importing the engine.
+"""
+
+from __future__ import annotations
+
+import re
+from importlib import resources
+from pathlib import Path
+
+import yaml
+from pydantic import BaseModel, ConfigDict, Field
+
+__all__ = [
+    "PremiseFile",
+    "Profile",
+    "ProfileError",
+    "ProfileIsolation",
+    "bundled_profile_names",
+    "check_engine_min",
+    "load_profile",
+    "merge_profile",
+    "parse_version",
+]
+
+_VERSION_RE = re.compile(r"^(\d+)\.(\d+)\.(\d+)(?:(a|b|rc)(\d+))?$")
+_RANK = {"a": 0, "b": 1, "rc": 2}
+_FINAL = 3
+
+
+class ProfileError(ValueError):
+    """Any profile load, parse, or compatibility failure."""
+
+
+class PremiseFile(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    path: str
+    content: str
+
+
+class ProfileIsolation(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    image: str
+    seccomp_profile: str | None = None
+    cpus: int
+
+
+class Profile(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    name: str
+    engine_min: str
+    description: str = ""
+    isolation: ProfileIsolation
+    caches: list[str] = Field(default_factory=list)
+    premise_files: list[PremiseFile] = Field(default_factory=list)
+    gitignore_additions: list[str] = Field(default_factory=list)
+    doctor_checks: list = Field(default_factory=list)
+
+
+def parse_version(text: str) -> tuple[int, int, int, int, int]:
+    """Parse ``X.Y.Z[a|b|rcN]`` into a directly comparable 5-tuple.
+
+    Rank ordering is alpha < beta < rc < final; the prerelease number is 0
+    for a final release so ``1.0.0rc9 < 1.0.0``.
+    """
+    match = _VERSION_RE.match(text.strip())
+    if match is None:
+        raise ProfileError(f"unparseable version: {text!r}")
+    major, minor, patch, pre, num = match.groups()
+    if pre is None:
+        return (int(major), int(minor), int(patch), _FINAL, 0)
+    return (int(major), int(minor), int(patch), _RANK[pre], int(num))
+
+
+def check_engine_min(engine_min: str, installed: str,
+                     latest: str | None = None) -> None:
+    """Raise unless ``installed`` satisfies ``engine_min``.
+
+    ``latest`` is substituted into the fix line by the caller (doctor); when
+    omitted the floor itself is used.
+    """
+    if parse_version(installed) < parse_version(engine_min):
+        target = latest or engine_min
+        raise ProfileError(
+            f"profile requires engine >= {engine_min}; installed {installed}. "
+            f'Upgrade: pipx install --force "agentic-dev-loop=={target}"')
+
+
+def _data_dir():
+    return resources.files(__package__).joinpath("data")
+
+
+def bundled_profile_names() -> list[str]:
+    return sorted(
+        entry.name[: -len(".yaml")]
+        for entry in _data_dir().iterdir()
+        if entry.name.endswith(".yaml")
+    )
+
+
+def _read_yaml(text: str, source: str) -> dict:
+    try:
+        data = yaml.safe_load(text)
+    except yaml.YAMLError as exc:
+        raise ProfileError(f"profile {source!r}: invalid YAML: {exc}") from exc
+    if not isinstance(data, dict):
+        raise ProfileError(f"profile {source!r} must be a mapping")
+    return data
+
+
+def _validate(data: dict, source: str) -> Profile:
+    try:
+        return Profile.model_validate(data)
+    except Exception as exc:
+        raise ProfileError(f"profile {source!r}: {exc}") from exc
+
+
+def load_profile(reference: str, installed_version: str) -> Profile:
+    """Load a bundled profile by name or a consumer profile by path.
+
+    Existence decides: a filesystem path that exists is read as a consumer
+    profile; anything else must name a bundled profile.
+    """
+    candidate = Path(reference)
+    if candidate.is_file():
+        data = _read_yaml(candidate.read_text(encoding="utf-8"), reference)
+        profile = _validate(data, reference)
+    else:
+        names = bundled_profile_names()
+        if reference not in names:
+            raise ProfileError(
+                f"unknown profile '{reference}'; bundled profiles: "
+                + ", ".join(names))
+        entry = _data_dir().joinpath(f"{reference}.yaml")
+        data = _read_yaml(entry.read_text(encoding="utf-8"), reference)
+        if data.get("name") != reference:
+            raise ProfileError(
+                f"profile {reference!r}: declared name {data.get('name')!r} "
+                f"does not match its filename")
+        profile = _validate(data, reference)
+    check_engine_min(profile.engine_min, installed_version)
+    return profile
+
+
+def _dedupe(items: list[str]) -> list[str]:
+    seen: set[str] = set()
+    out: list[str] = []
+    for item in items:
+        if item not in seen:
+            seen.add(item)
+            out.append(item)
+    return out
+
+
+def merge_profile(data: dict, profile: Profile) -> dict:
+    """Merge a profile into a pipeline dict; the pipeline wins.
+
+    Isolation merges key-wise (profile under, pipeline over). Caches union
+    profile-first, dedupe-preserving-order. Every other key is untouched.
+    """
+    merged = dict(data)
+    profile_iso = profile.isolation.model_dump(exclude_none=True)
+    pipeline_iso = merged.get("isolation") or {}
+    if not isinstance(pipeline_iso, dict):
+        pipeline_iso = {}
+    merged["isolation"] = {**profile_iso, **pipeline_iso}
+    caches = _dedupe(list(profile.caches) + list(merged.get("caches") or []))
+    merged["caches"] = caches
+    return merged

agentic_dev_loop-0.10.2/src/agentic_dev_loop/core/profiles/data/dotnet-node.yaml

@@ -0,0 +1,22 @@
+name: dotnet-node
+engine_min: 0.9.2
+description: .NET backend with a Node.js frontend
+isolation:
+  image: ghcr.io/lukedawilson/agentic-dev-loop/dev-dotnet@sha256:d15d1c6115fafc3d5f3bfb567338d61441081e5d7ff83d7770bc0b5f14f977fc
+  seccomp_profile: bundled:chromium-userns
+  cpus: 6
+caches:
+  - .nuget-packages
+premise_files:
+  - path: NuGet.Config
+    content: |
+      <configuration>
+        <config>
+          <add key="globalPackagesFolder" value=".nuget-packages" />
+        </config>
+      </configuration>
+gitignore_additions:
+  - bin/
+  - obj/
+  - node_modules/
+  - .nuget-packages/

agentic_dev_loop-0.10.2/src/agentic_dev_loop/core/profiles/data/python.yaml

@@ -0,0 +1,8 @@
+name: python
+engine_min: 0.9.2
+description: Python project; the sandbox builds its own venv per run
+isolation:
+  image: ghcr.io/lukedawilson/agentic-dev-loop/dev@sha256:890105209c127446caf20ce3dc05f0c0f5527e9d679e18cc0075e6b0ee917434
+  cpus: 2
+gitignore_additions:
+  - .venv-sandbox/

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.2}/src/agentic_dev_loop/engine/cli.py

@@ -165,6 +165,12 @@ def main(argv: list[str] | None = None) -> int:
         argv = list(argv)
     if argv and argv[0] == "containers":
         return _run_containers(argv[1:])
+    if argv and argv[0] == "init":
+        from .onboarding.init import run_init
+        return run_init(argv[1:])
+    if argv and argv[0] == "doctor":
+        from .onboarding.doctor import run_doctor
+        return run_doctor(argv[1:])
     probe = argparse.ArgumentParser(add_help=False)
     probe.add_argument("pipeline", type=Path, nargs="?")
     _add_version_flag(probe)

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.2}/src/agentic_dev_loop/engine/hostboundary.py

@@ -32,6 +32,8 @@ if TYPE_CHECKING:
 # the dogfood pipeline and the consumer repo use); the other tooling paths are config- or
 # pipeline-file-relative.
 TOOLING_DIR_NAMES = ("aidlc-docs", "tools")
+TOOLING_FILE_NAMES = ("trigger-agentic-dev-loop.sh",
+                      "agentic-dev-loop/.engine-version")
 
 
 class HostBoundaryError(RuntimeError):
@@ -73,6 +75,7 @@ def tooling_rel_paths(cfg: "PipelineConfig", pipeline_path: str | Path,
         (base / cfg.agents_dir).resolve(),
         *((base / rel).resolve() for rel in cfg.additional_files),
         *(ws / name for name in TOOLING_DIR_NAMES),
+        *(ws / name for name in TOOLING_FILE_NAMES),
     ]
     rels = {p.relative_to(ws).as_posix() for p in candidates
             if p.is_relative_to(ws)}

agentic_dev_loop-0.10.2/src/agentic_dev_loop/engine/onboarding/__init__.py

@@ -0,0 +1,6 @@
+"""Consumer onboarding: init, doctor, recipes, and templates.
+
+These modules are engine concerns (they render pipelines and probe the host);
+the only core dependency is ``agentic_dev_loop.core.profiles``, the allowed
+engineering direction.
+"""