agentic-dev-loop 0.10.0__tar.gz → 0.10.3__tar.gz

{agentic_dev_loop-0.10.0/src/agentic_dev_loop.egg-info → agentic_dev_loop-0.10.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.10.0
+Version: 0.10.3
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -229,6 +229,7 @@ steps:
     agent: dev
     produces: implementation-summary.md
     terminal_timeout: 900
+    # forbidden_commands: ["npm install", "npm ci"]      # per-step tool deny-list; engine defaults are git mutations + docker
     on_pass: test
 
   - name: test
@@ -268,6 +269,7 @@ steps:
 | `brief_inputs:` | The discriminator for a native brief step: `{ include: [<paths/globs>], env_facts: [<strings>], sections: [<headings>] }`. There is no `agent:`, `produces:`, or `max_iterations:` - the prompt is engine-embedded, the capture file is `attempt-brief.md`, and the iteration cap is 12, all engine-owned. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as the step's task message, and regenerates the step only when those inputs change. `sections` is the ordered list of digest headings the brief must emit (default `[Repo rules digest, Unit scope digest, Environment facts, Open risks]`; non-empty and unique). `name` stays free-form, so multiple brief steps are allowed. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `forbidden_commands:` | Optional per-step list of regex patterns. The sandbox terminal matches them against each agent command before any shell spawn; a match returns a structured `[forbidden: <label>]` observation instead of running. A single string is coerced to a one-item list; an invalid regex fails at load. Defaults are run invariants only (git mutations, docker); tool-specific rules belong to the toolchain profile/recipe or the pipeline author. Command steps are unaffected. See [Banned commands](#banned-commands-forbidden_commands). |
 | `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `llms:` (top-level) / step `llm:` | Named LLM profiles, each a full `LlmConfig` (`model`, `base_url`, `api_key_env`, `timeout`, `reasoning_effort`). A step names one with `llm: <profile-name>`; the whole profile moves together (no partial merges). Allowed only on agent and brief steps. The top-level `llm:` block remains the default. Profile keys are host-side - sandbox access still goes through `secrets:`. |
 | `reasoning_effort:` | Optional `low` / `medium` / `high` / `xhigh` / `none`. Set on the `llm` block, a `llms:` profile, or per-step (a step value overrides the effective profile's). Unset anywhere = reasoning off: nothing is forwarded and reasoning is stripped from requests. A thinking model without an effort level is invalid config and fails at the first request (crap in, crap out). See [Reasoning effort](#reasoning-effort-opt-in). |
@@ -275,6 +277,7 @@ steps:
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` runs fresh at every step boundary in a one-shot provision container targeting the export (command or agent steps; network ON; no stamping); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
+| `profile:` (top-level) | Names a bundled toolchain profile (`python`, `dotnet-node`) or a consumer profile file path. `load_config` merges the profile at load time: isolation key-wise with the pipeline winning, caches unioned profile-first. Absent = today's behavior. |
 | `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
@@ -283,6 +286,22 @@ steps:
 | `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from host-side stores under `{state_dir}/caches/<name>` (auto-created); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names non-gitignored scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
+### Banned commands (`forbidden_commands:`)
+
+`forbidden_commands:` is a per-step list of regex patterns. The sandbox
+terminal checks them against every command the agent runs, before any shell
+spawn: a match returns a structured `[forbidden: <label>]` observation instead
+of executing. The engine defaults are run invariants only - git mutations and
+docker - so the deny-list is network-independent by design: `network:` stays a
+docker/egress concern. A single string is coerced to a one-item list; an
+invalid regex is a load error. Command steps bypass the filter by design.
+
+Tool-specific rules are not engine defaults. A toolchain profile or bundled
+recipe declares them per step (for example the `python` recipe denies
+`pip install`, `uv add`, and `pip-compile` on its agent steps), and a
+consumer pipeline authors its own for its toolchain. There is no disable
+escape hatch for the engine defaults.
+
 ### Reasoning effort (opt-in)
 
 `reasoning_effort` is an opt-in latency dial on the pipeline `llm` block, a
@@ -446,12 +465,39 @@ console.
 
 ## Authoring a loop for your own repo
 
-A consumer repo needs two things written by hand - a pipeline file and the
-agent files it names - both committed before the first run (the host-boundary
-check refuses dirty tooling, and the `commit` step never commits it). Two
-reference layouts ship today: this repo dogfoods the engine on itself
-(python + pytest, no frontend, CLI-only qa), and the consumer repo carries
-the wider shape (.NET + npm frontend + a networked browser-probing qa step).
+### Start with `agentic-dev-loop init`
+
+`init` writes the onboarding surface from a bundled toolchain profile:
+
+```bash
+agentic-dev-loop init --profile python        # or: --profile dotnet-node
+```
+
+It detects solution files, `package.json` directories, lockfiles, README, and
+AGENTS.md, asks only what detection cannot answer, and writes
+`agentic-dev-loop/pipeline.yaml`, the three agent files, an executable
+`trigger-agentic-dev-loop.sh`, `agentic-dev-loop/.engine-version` (the exact
+installed engine version), any missing premise files, gitignore additions, and
+an env-file template. It refuses to overwrite an existing
+`agentic-dev-loop/` directory. A consumer-authored profile file can be passed
+by path instead of a bundled name.
+
+Profiles carry the environment facts every app on a toolchain shares (image,
+cpus, caches, premise files, gitignore lines); recipes carry the gate shape and
+command vocabulary. The pipeline references a profile with the top-level
+`profile:` key, and `load_config` merges it at load time: the pipeline wins on
+scalars, caches union profile-first, and absence of the key behaves exactly as
+before.
+
+`agentic-dev-loop doctor --fast` is the per-run gate the trigger runs first.
+Hard failures abort the run (engine pin mismatch, engine runtime availability,
+API version, git repo, `.env*` files); warnings print and continue. `doctor
+--json` emits the same results mechanically. The trigger repairs a pin/install
+mismatch exactly once, then fails hard.
+
+A consumer repo needs a pipeline file and the agent files it names, both
+committed before the first run (the host-boundary check refuses dirty tooling,
+and the `commit` step never commits it). `init` writes them; the layout is:
 
 ```
 <repo>/agentic-dev-loop/pipeline.yaml
@@ -537,12 +583,11 @@ Adaptation checklist for a new repo:
 
 1. `llm:` - model, `base_url`, `api_key_env`.
 2. `llms:` (optional) - named profiles for multi-provider lanes (keep review on the strongest model); a step opts in with `llm: <name>`.
-3. `isolation:` - toolchain image override (the consumer repo pins a
-   toolchain image by digest) and `seccomp_profile: bundled:chromium-userns`
-   only if a stage runs Chromium.
-4. `caches:` - toolchain cache dirs as rw bind-mounts shared across runs
-   (`.nuget-packages`, `qa/node_modules`, `qa/.browsers`,
-   `frontend-editor/node_modules`); caches are never synced back, and a
+3. `profile:` - name a bundled profile (`python`, `dotnet-node`) or a
+   consumer profile path. The profile supplies `isolation:` (image,
+   `seccomp_profile`, cpus) and `caches:`; pipeline keys override its scalars.
+4. `caches:` - profile-supplied toolchain caches plus any run-specific dirs
+   (`.nuget-packages`, `qa/.browsers`); caches are never synced back, and a
    step's `setup:` hook runs with them mounted so it can warm them.
 5. `sync_excludes:` - build output trees (`**/bin/**`, `**/obj/**`).
 6. `secrets:` - refs only, resolved from host env; each step opts in to the

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.3}/README.md

@@ -185,6 +185,7 @@ steps:
     agent: dev
     produces: implementation-summary.md
     terminal_timeout: 900
+    # forbidden_commands: ["npm install", "npm ci"]      # per-step tool deny-list; engine defaults are git mutations + docker
     on_pass: test
 
   - name: test
@@ -224,6 +225,7 @@ steps:
 | `brief_inputs:` | The discriminator for a native brief step: `{ include: [<paths/globs>], env_facts: [<strings>], sections: [<headings>] }`. There is no `agent:`, `produces:`, or `max_iterations:` - the prompt is engine-embedded, the capture file is `attempt-brief.md`, and the iteration cap is 12, all engine-owned. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as the step's task message, and regenerates the step only when those inputs change. `sections` is the ordered list of digest headings the brief must emit (default `[Repo rules digest, Unit scope digest, Environment facts, Open risks]`; non-empty and unique). `name` stays free-form, so multiple brief steps are allowed. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `forbidden_commands:` | Optional per-step list of regex patterns. The sandbox terminal matches them against each agent command before any shell spawn; a match returns a structured `[forbidden: <label>]` observation instead of running. A single string is coerced to a one-item list; an invalid regex fails at load. Defaults are run invariants only (git mutations, docker); tool-specific rules belong to the toolchain profile/recipe or the pipeline author. Command steps are unaffected. See [Banned commands](#banned-commands-forbidden_commands). |
 | `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `llms:` (top-level) / step `llm:` | Named LLM profiles, each a full `LlmConfig` (`model`, `base_url`, `api_key_env`, `timeout`, `reasoning_effort`). A step names one with `llm: <profile-name>`; the whole profile moves together (no partial merges). Allowed only on agent and brief steps. The top-level `llm:` block remains the default. Profile keys are host-side - sandbox access still goes through `secrets:`. |
 | `reasoning_effort:` | Optional `low` / `medium` / `high` / `xhigh` / `none`. Set on the `llm` block, a `llms:` profile, or per-step (a step value overrides the effective profile's). Unset anywhere = reasoning off: nothing is forwarded and reasoning is stripped from requests. A thinking model without an effort level is invalid config and fails at the first request (crap in, crap out). See [Reasoning effort](#reasoning-effort-opt-in). |
@@ -231,6 +233,7 @@ steps:
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` runs fresh at every step boundary in a one-shot provision container targeting the export (command or agent steps; network ON; no stamping); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
+| `profile:` (top-level) | Names a bundled toolchain profile (`python`, `dotnet-node`) or a consumer profile file path. `load_config` merges the profile at load time: isolation key-wise with the pipeline winning, caches unioned profile-first. Absent = today's behavior. |
 | `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
@@ -239,6 +242,22 @@ steps:
 | `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from host-side stores under `{state_dir}/caches/<name>` (auto-created); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names non-gitignored scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
+### Banned commands (`forbidden_commands:`)
+
+`forbidden_commands:` is a per-step list of regex patterns. The sandbox
+terminal checks them against every command the agent runs, before any shell
+spawn: a match returns a structured `[forbidden: <label>]` observation instead
+of executing. The engine defaults are run invariants only - git mutations and
+docker - so the deny-list is network-independent by design: `network:` stays a
+docker/egress concern. A single string is coerced to a one-item list; an
+invalid regex is a load error. Command steps bypass the filter by design.
+
+Tool-specific rules are not engine defaults. A toolchain profile or bundled
+recipe declares them per step (for example the `python` recipe denies
+`pip install`, `uv add`, and `pip-compile` on its agent steps), and a
+consumer pipeline authors its own for its toolchain. There is no disable
+escape hatch for the engine defaults.
+
 ### Reasoning effort (opt-in)
 
 `reasoning_effort` is an opt-in latency dial on the pipeline `llm` block, a
@@ -402,12 +421,39 @@ console.
 
 ## Authoring a loop for your own repo
 
-A consumer repo needs two things written by hand - a pipeline file and the
-agent files it names - both committed before the first run (the host-boundary
-check refuses dirty tooling, and the `commit` step never commits it). Two
-reference layouts ship today: this repo dogfoods the engine on itself
-(python + pytest, no frontend, CLI-only qa), and the consumer repo carries
-the wider shape (.NET + npm frontend + a networked browser-probing qa step).
+### Start with `agentic-dev-loop init`
+
+`init` writes the onboarding surface from a bundled toolchain profile:
+
+```bash
+agentic-dev-loop init --profile python        # or: --profile dotnet-node
+```
+
+It detects solution files, `package.json` directories, lockfiles, README, and
+AGENTS.md, asks only what detection cannot answer, and writes
+`agentic-dev-loop/pipeline.yaml`, the three agent files, an executable
+`trigger-agentic-dev-loop.sh`, `agentic-dev-loop/.engine-version` (the exact
+installed engine version), any missing premise files, gitignore additions, and
+an env-file template. It refuses to overwrite an existing
+`agentic-dev-loop/` directory. A consumer-authored profile file can be passed
+by path instead of a bundled name.
+
+Profiles carry the environment facts every app on a toolchain shares (image,
+cpus, caches, premise files, gitignore lines); recipes carry the gate shape and
+command vocabulary. The pipeline references a profile with the top-level
+`profile:` key, and `load_config` merges it at load time: the pipeline wins on
+scalars, caches union profile-first, and absence of the key behaves exactly as
+before.
+
+`agentic-dev-loop doctor --fast` is the per-run gate the trigger runs first.
+Hard failures abort the run (engine pin mismatch, engine runtime availability,
+API version, git repo, `.env*` files); warnings print and continue. `doctor
+--json` emits the same results mechanically. The trigger repairs a pin/install
+mismatch exactly once, then fails hard.
+
+A consumer repo needs a pipeline file and the agent files it names, both
+committed before the first run (the host-boundary check refuses dirty tooling,
+and the `commit` step never commits it). `init` writes them; the layout is:
 
 ```
 <repo>/agentic-dev-loop/pipeline.yaml
@@ -493,12 +539,11 @@ Adaptation checklist for a new repo:
 
 1. `llm:` - model, `base_url`, `api_key_env`.
 2. `llms:` (optional) - named profiles for multi-provider lanes (keep review on the strongest model); a step opts in with `llm: <name>`.
-3. `isolation:` - toolchain image override (the consumer repo pins a
-   toolchain image by digest) and `seccomp_profile: bundled:chromium-userns`
-   only if a stage runs Chromium.
-4. `caches:` - toolchain cache dirs as rw bind-mounts shared across runs
-   (`.nuget-packages`, `qa/node_modules`, `qa/.browsers`,
-   `frontend-editor/node_modules`); caches are never synced back, and a
+3. `profile:` - name a bundled profile (`python`, `dotnet-node`) or a
+   consumer profile path. The profile supplies `isolation:` (image,
+   `seccomp_profile`, cpus) and `caches:`; pipeline keys override its scalars.
+4. `caches:` - profile-supplied toolchain caches plus any run-specific dirs
+   (`.nuget-packages`, `qa/.browsers`); caches are never synced back, and a
    step's `setup:` hook runs with them mounted so it can warm them.
 5. `sync_excludes:` - build output trees (`**/bin/**`, `**/obj/**`).
 6. `secrets:` - refs only, resolved from host env; each step opts in to the

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "0.10.0"
+version = "0.10.3"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -76,8 +76,10 @@ where = ["src"]
 
 [tool.setuptools.package-data]
 agentic_dev_loop = ["py.typed"]
+"agentic_dev_loop.core.profiles" = ["data/*.yaml"]
 "agentic_dev_loop.engine" = ["*.md"]
 "agentic_dev_loop.engine.seccomp" = ["*.json"]
+"agentic_dev_loop.engine.onboarding" = ["recipes/*.yaml", "templates/*"]
 
 [tool.pytest.ini_options]
 markers = [

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.3}/src/agentic_dev_loop/core/config.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import hashlib
+import importlib.metadata
 import re
 import warnings
 from pathlib import Path
@@ -647,6 +648,9 @@ class PipelineConfig(BaseModel):
     # edit instead of raising. Same declared-path vocabulary as
     # ``sync_excludes:``.
     merge_on_conflict: list[str] = []
+    # 055: the toolchain profile resolved at load time. Kept on the validated
+    # config so the run records which profile supplied its defaults.
+    profile: str | None = None
 
     @field_validator("deps_policy")
     @classmethod
@@ -892,6 +896,21 @@ def load_config(path: Path) -> PipelineConfig:
         raise ValueError(
             f"pipeline config must be a mapping, got {type(data).__name__}: {path}"
         )
+    profile_ref = data.pop("profile", None)
+    if profile_ref is not None:
+        from agentic_dev_loop.core.profiles import (
+            ProfileError,
+            load_profile,
+            merge_profile,
+        )
+
+        try:
+            installed = importlib.metadata.version("agentic-dev-loop")
+            profile = load_profile(str(profile_ref), installed)
+            data = merge_profile(data, profile)
+        except ProfileError as exc:
+            raise ValueError(f"pipeline {path}: {exc}") from exc
+        data["profile"] = profile_ref
     if "state_dir" not in data:
         data["state_dir"] = default_state_dir(path)
     cfg = PipelineConfig.model_validate(data)

agentic_dev_loop-0.10.3/src/agentic_dev_loop/core/profiles/__init__.py

@@ -0,0 +1,178 @@
+"""Toolchain profiles: bundled data plus the load-time merge into a pipeline.
+
+A profile supplies the environment facts every app on a toolchain shares
+(isolation image, caches, premise files, gitignore lines, doctor probes).
+Profiles never carry commands, gates, or steps - those live in
+engine-resident recipes. The subpackage is intentionally dependency-light
+(stdlib + pydantic + PyYAML) so ``core`` can resolve a profile at config
+load time without importing the engine.
+"""
+
+from __future__ import annotations
+
+import re
+from importlib import resources
+from pathlib import Path
+
+import yaml
+from pydantic import BaseModel, ConfigDict, Field
+
+__all__ = [
+    "PremiseFile",
+    "Profile",
+    "ProfileError",
+    "ProfileIsolation",
+    "bundled_profile_names",
+    "check_engine_min",
+    "load_profile",
+    "merge_profile",
+    "parse_version",
+]
+
+_VERSION_RE = re.compile(r"^(\d+)\.(\d+)\.(\d+)(?:(a|b|rc)(\d+))?$")
+_RANK = {"a": 0, "b": 1, "rc": 2}
+_FINAL = 3
+
+
+class ProfileError(ValueError):
+    """Any profile load, parse, or compatibility failure."""
+
+
+class PremiseFile(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    path: str
+    content: str
+
+
+class ProfileIsolation(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    image: str
+    seccomp_profile: str | None = None
+    cpus: int
+
+
+class Profile(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    name: str
+    engine_min: str
+    description: str = ""
+    isolation: ProfileIsolation
+    caches: list[str] = Field(default_factory=list)
+    premise_files: list[PremiseFile] = Field(default_factory=list)
+    gitignore_additions: list[str] = Field(default_factory=list)
+    doctor_checks: list = Field(default_factory=list)
+
+
+def parse_version(text: str) -> tuple[int, int, int, int, int]:
+    """Parse ``X.Y.Z[a|b|rcN]`` into a directly comparable 5-tuple.
+
+    Rank ordering is alpha < beta < rc < final; the prerelease number is 0
+    for a final release so ``1.0.0rc9 < 1.0.0``.
+    """
+    match = _VERSION_RE.match(text.strip())
+    if match is None:
+        raise ProfileError(f"unparseable version: {text!r}")
+    major, minor, patch, pre, num = match.groups()
+    if pre is None:
+        return (int(major), int(minor), int(patch), _FINAL, 0)
+    return (int(major), int(minor), int(patch), _RANK[pre], int(num))
+
+
+def check_engine_min(engine_min: str, installed: str,
+                     latest: str | None = None) -> None:
+    """Raise unless ``installed`` satisfies ``engine_min``.
+
+    ``latest`` is substituted into the fix line by the caller (doctor); when
+    omitted the floor itself is used.
+    """
+    if parse_version(installed) < parse_version(engine_min):
+        target = latest or engine_min
+        raise ProfileError(
+            f"profile requires engine >= {engine_min}; installed {installed}. "
+            f'Upgrade: pipx install --force "agentic-dev-loop=={target}"')
+
+
+def _data_dir():
+    return resources.files(__package__).joinpath("data")
+
+
+def bundled_profile_names() -> list[str]:
+    return sorted(
+        entry.name[: -len(".yaml")]
+        for entry in _data_dir().iterdir()
+        if entry.name.endswith(".yaml")
+    )
+
+
+def _read_yaml(text: str, source: str) -> dict:
+    try:
+        data = yaml.safe_load(text)
+    except yaml.YAMLError as exc:
+        raise ProfileError(f"profile {source!r}: invalid YAML: {exc}") from exc
+    if not isinstance(data, dict):
+        raise ProfileError(f"profile {source!r} must be a mapping")
+    return data
+
+
+def _validate(data: dict, source: str) -> Profile:
+    try:
+        return Profile.model_validate(data)
+    except Exception as exc:
+        raise ProfileError(f"profile {source!r}: {exc}") from exc
+
+
+def load_profile(reference: str, installed_version: str) -> Profile:
+    """Load a bundled profile by name or a consumer profile by path.
+
+    Existence decides: a filesystem path that exists is read as a consumer
+    profile; anything else must name a bundled profile.
+    """
+    candidate = Path(reference)
+    if candidate.is_file():
+        data = _read_yaml(candidate.read_text(encoding="utf-8"), reference)
+        profile = _validate(data, reference)
+    else:
+        names = bundled_profile_names()
+        if reference not in names:
+            raise ProfileError(
+                f"unknown profile '{reference}'; bundled profiles: "
+                + ", ".join(names))
+        entry = _data_dir().joinpath(f"{reference}.yaml")
+        data = _read_yaml(entry.read_text(encoding="utf-8"), reference)
+        if data.get("name") != reference:
+            raise ProfileError(
+                f"profile {reference!r}: declared name {data.get('name')!r} "
+                f"does not match its filename")
+        profile = _validate(data, reference)
+    check_engine_min(profile.engine_min, installed_version)
+    return profile
+
+
+def _dedupe(items: list[str]) -> list[str]:
+    seen: set[str] = set()
+    out: list[str] = []
+    for item in items:
+        if item not in seen:
+            seen.add(item)
+            out.append(item)
+    return out
+
+
+def merge_profile(data: dict, profile: Profile) -> dict:
+    """Merge a profile into a pipeline dict; the pipeline wins.
+
+    Isolation merges key-wise (profile under, pipeline over). Caches union
+    profile-first, dedupe-preserving-order. Every other key is untouched.
+    """
+    merged = dict(data)
+    profile_iso = profile.isolation.model_dump(exclude_none=True)
+    pipeline_iso = merged.get("isolation") or {}
+    if not isinstance(pipeline_iso, dict):
+        pipeline_iso = {}
+    merged["isolation"] = {**profile_iso, **pipeline_iso}
+    caches = _dedupe(list(profile.caches) + list(merged.get("caches") or []))
+    merged["caches"] = caches
+    return merged

agentic_dev_loop-0.10.3/src/agentic_dev_loop/core/profiles/data/dotnet-node.yaml

@@ -0,0 +1,22 @@
+name: dotnet-node
+engine_min: 0.9.2
+description: .NET backend with a Node.js frontend
+isolation:
+  image: ghcr.io/lukedawilson/agentic-dev-loop/dev-dotnet@sha256:d15d1c6115fafc3d5f3bfb567338d61441081e5d7ff83d7770bc0b5f14f977fc
+  seccomp_profile: bundled:chromium-userns
+  cpus: 6
+caches:
+  - .nuget-packages
+premise_files:
+  - path: NuGet.Config
+    content: |
+      <configuration>
+        <config>
+          <add key="globalPackagesFolder" value=".nuget-packages" />
+        </config>
+      </configuration>
+gitignore_additions:
+  - bin/
+  - obj/
+  - node_modules/
+  - .nuget-packages/

agentic_dev_loop-0.10.3/src/agentic_dev_loop/core/profiles/data/python.yaml

@@ -0,0 +1,8 @@
+name: python
+engine_min: 0.9.2
+description: Python project; the sandbox builds its own venv per run
+isolation:
+  image: ghcr.io/lukedawilson/agentic-dev-loop/dev@sha256:890105209c127446caf20ce3dc05f0c0f5527e9d679e18cc0075e6b0ee917434
+  cpus: 2
+gitignore_additions:
+  - .venv-sandbox/

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.3}/src/agentic_dev_loop/engine/cli.py

@@ -165,6 +165,12 @@ def main(argv: list[str] | None = None) -> int:
         argv = list(argv)
     if argv and argv[0] == "containers":
         return _run_containers(argv[1:])
+    if argv and argv[0] == "init":
+        from .onboarding.init import run_init
+        return run_init(argv[1:])
+    if argv and argv[0] == "doctor":
+        from .onboarding.doctor import run_doctor
+        return run_doctor(argv[1:])
     probe = argparse.ArgumentParser(add_help=False)
     probe.add_argument("pipeline", type=Path, nargs="?")
     _add_version_flag(probe)

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.3}/src/agentic_dev_loop/engine/forbidden.py

@@ -1,4 +1,4 @@
-"""Banned-command deny-list (036 D1).
+"""Banned-command deny-list (036 D1, revised by 056).
 
 The sandbox terminal enforces a deny-list before any shell spawn: a command
 whose argv matches a step's ``forbidden_commands:`` regex (merged with the
@@ -6,11 +6,15 @@ engine defaults) returns a structured observation instead of reaching the
 sandbox. Command steps are unaffected - they are declared infrastructure and
 already fail fast on their exit code.
 
+The defaults are run invariants only: git mutations and docker.
+Tool-specific rules are not engine defaults - a step declares them with
+``forbidden_commands`` (the bundled onboarding recipes carry the engine's
+own toolchain guidance). The deny-list is network-independent by design;
+network is a sandbox egress concern.
+
 The default list carries human-readable labels; custom entries use their
-regex text as the label. ``dotnet restore`` and ``dotnet add`` are network
-gated: denied only while the step's ``network:`` flag is off.
+regex text as the label.
 """
-
 from __future__ import annotations
 
 import re
@@ -30,22 +34,9 @@ _DEFAULT_PATTERNS: tuple[tuple[str, str], ...] = (
     ("git checkout", r"\bgit\s+checkout\b"),
     ("git reset", r"\bgit\s+reset\b"),
     ("git tag", r"\bgit\s+tag\b"),
-    ("npm install", r"\bnpm\s+install\b"),
-    ("npm ci", r"\bnpm\s+ci\b"),
-    ("pip install", r"\bpip\s+install\b"),
-    ("uv add", r"\buv\s+add\b"),
-    ("pip-compile", r"\bpip-compile\b"),
-    ("dotnet add package", r"\bdotnet\s+add\s+package\b"),
-    ("npx playwright", r"\bnpx\s+playwright\b"),
-    ("playwright", r"\bplaywright\b"),
     ("docker", r"\bdocker\b"),
 )
 
-_NETWORK_GATED_PATTERNS: tuple[tuple[str, str], ...] = (
-    ("dotnet restore", r"\bdotnet\s+restore\b"),
-    ("dotnet add", r"\bdotnet\s+add\b"),
-)
-
 
 def _compile(label: str, pattern: str) -> ForbiddenRule:
     return ForbiddenRule(label=label, regex=re.compile(pattern, re.IGNORECASE))
@@ -54,21 +45,16 @@ def _compile(label: str, pattern: str) -> ForbiddenRule:
 DEFAULT_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
     _compile(label, pattern) for label, pattern in _DEFAULT_PATTERNS)
 
-NETWORK_GATED_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
-    _compile(label, pattern) for label, pattern in _NETWORK_GATED_PATTERNS)
-
 
-def resolve_forbidden_rules(custom_patterns: list[str] | tuple[str, ...] | None,
-                            network: bool) -> tuple[ForbiddenRule, ...]:
+def resolve_forbidden_rules(
+        custom_patterns: list[str] | tuple[str, ...] | None,
+) -> tuple[ForbiddenRule, ...]:
     """Merge the engine defaults with a step's custom regex list.
 
     Custom entries are appended after the defaults, so the first match wins
-    on overlap. Network-gated defaults are included only while ``network`` is
-    off; there is no disable escape hatch for the engine defaults.
+    on overlap; there is no disable escape hatch for the engine defaults.
     """
     rules = list(DEFAULT_FORBIDDEN_RULES)
-    if not network:
-        rules.extend(NETWORK_GATED_FORBIDDEN_RULES)
     for pattern in custom_patterns or ():
         rules.append(_compile(pattern, pattern))
     return tuple(rules)

{agentic_dev_loop-0.10.0 → agentic_dev_loop-0.10.3}/src/agentic_dev_loop/engine/hostboundary.py

@@ -32,6 +32,8 @@ if TYPE_CHECKING:
 # the dogfood pipeline and the consumer repo use); the other tooling paths are config- or
 # pipeline-file-relative.
 TOOLING_DIR_NAMES = ("aidlc-docs", "tools")
+TOOLING_FILE_NAMES = ("trigger-agentic-dev-loop.sh",
+                      "agentic-dev-loop/.engine-version")
 
 
 class HostBoundaryError(RuntimeError):
@@ -73,6 +75,7 @@ def tooling_rel_paths(cfg: "PipelineConfig", pipeline_path: str | Path,
         (base / cfg.agents_dir).resolve(),
         *((base / rel).resolve() for rel in cfg.additional_files),
         *(ws / name for name in TOOLING_DIR_NAMES),
+        *(ws / name for name in TOOLING_FILE_NAMES),
     ]
     rels = {p.relative_to(ws).as_posix() for p in candidates
             if p.is_relative_to(ws)}

agentic_dev_loop-0.10.3/src/agentic_dev_loop/engine/onboarding/__init__.py

@@ -0,0 +1,6 @@
+"""Consumer onboarding: init, doctor, recipes, and templates.
+
+These modules are engine concerns (they render pipelines and probe the host);
+the only core dependency is ``agentic_dev_loop.core.profiles``, the allowed
+engineering direction.
+"""