agentic-dev-loop 0.15.3__tar.gz → 0.15.5__tar.gz

{agentic_dev_loop-0.15.3/src/agentic_dev_loop.egg-info → agentic_dev_loop-0.15.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.15.3
+Version: 0.15.5
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -562,10 +562,11 @@ Conventions that make a good agent file:
 - **dev enumerates its impossible set and stops at it.** List the commands
   the sandbox cannot run (offline package fetches, browser downloads), one
   attempt per command - keeps the productive loop and kills doomed retries.
-- **Failure output returns as *Previous attempt feedback*.** Steps route
-  `on_fail: { goto: dev, retry: true }`, so gate failure output lands in the
-  dev agent's next context; the dev prompt makes every listed issue a
-  required fix.
+- **Failure output is a required fix in dev's next context.** Agent verdict
+  steps land their failing output under *Previous attempt feedback*; command
+  gates (test, restore) land it under *Mechanical gate output*, with the exit
+  code under *Verified state*. Steps route `on_fail: { goto: dev, retry: true }`,
+  and the dev prompt makes every listed failure a required fix.
 - **No git mutations, ever.** The `commit` step is the single commit point.
 
 ### The pipeline file

{agentic_dev_loop-0.15.3 → agentic_dev_loop-0.15.5}/README.md

@@ -515,10 +515,11 @@ Conventions that make a good agent file:
 - **dev enumerates its impossible set and stops at it.** List the commands
   the sandbox cannot run (offline package fetches, browser downloads), one
   attempt per command - keeps the productive loop and kills doomed retries.
-- **Failure output returns as *Previous attempt feedback*.** Steps route
-  `on_fail: { goto: dev, retry: true }`, so gate failure output lands in the
-  dev agent's next context; the dev prompt makes every listed issue a
-  required fix.
+- **Failure output is a required fix in dev's next context.** Agent verdict
+  steps land their failing output under *Previous attempt feedback*; command
+  gates (test, restore) land it under *Mechanical gate output*, with the exit
+  code under *Verified state*. Steps route `on_fail: { goto: dev, retry: true }`,
+  and the dev prompt makes every listed failure a required fix.
 - **No git mutations, ever.** The `commit` step is the single commit point.
 
 ### The pipeline file

{agentic_dev_loop-0.15.3 → agentic_dev_loop-0.15.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "0.15.3"
+version = "0.15.5"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-0.15.3 → agentic_dev_loop-0.15.5}/src/agentic_dev_loop/engine/onboarding/templates/dev.agent.md

@@ -10,10 +10,11 @@ opinionated LangGraph + OpenHands SDK pipeline engine written in Python.
 ## WORKFLOW
 
 1. Read the plan documents and README.md in the context below.
-2. If the context contains a *Previous attempt feedback* section, treat every
-   issue listed there as a required fix from the pipeline's earlier stages -
-   address each one before anything else, and verify each fix landed (re-read
-   the edited file) before moving on.
+2. If the context contains a *Previous attempt feedback* section or a
+   *Mechanical gate output* section, treat every issue listed there as a
+   required fix from the pipeline's earlier stages - address each one before
+   anything else, and verify each fix landed (re-read the edited file) before
+   moving on. A mechanical entry names the attempt that produced it.
 3. Check for prior-attempt residue before implementing. The pipeline syncs
    every lane's edits back into this repo's working tree after each terminal
    action, so an earlier attempt that died at a later gate can leave the full
@@ -66,10 +67,23 @@ opinionated LangGraph + OpenHands SDK pipeline engine written in Python.
   exit code alone.
 - You do not need to prove anything here: fill in the verification matrix,
   write your final response, and stop.
-- If the gate fails, you are retried with the failing output in your notes
-  under *Previous attempt feedback*. Find the root cause - a regression in
-  your change, a stale test pinning old behavior, or a genuine library bug -
-  and fix it, never the symptom.
+- If the gate fails, you are retried with the failing output under
+  *Mechanical gate output* and the exit code under *Verified state* (command
+  gates do not write *Previous attempt feedback*). Find the root cause - a
+  regression in your change, a stale test pinning old behavior, or a genuine
+  library bug - and fix it, never the symptom.
+
+## AUDIT GATE
+
+- The restore step re-runs the install and a dependency audit on every pass.
+  A failing audit means a pin in the dependency manifest carries known CVEs;
+  it is a required fix, never "pre-existing" or "unrelated".
+- Fix it with a manifest edit, never a package-manager command (agent steps
+  are offline). Follow the floor-pin pattern: pin the vulnerable resolved
+  package to a CVE-free version, or pin the intermediate package to the last
+  release that admits it, so a fresh resolve lands on the fixed version.
+- Restore re-audits the bumped pins on the next pass, so the loop
+  self-corrects; report the audit as fixed only after that gate passes.
 
 ## TEST-FIRST
 
@@ -81,7 +95,8 @@ opinionated LangGraph + OpenHands SDK pipeline engine written in Python.
 
 - The moment your final response is written AND the full suite has passed
   locally (`.venv-sandbox/bin/python -m pytest tests/ -q` exits 0) AND every
-  *Previous attempt feedback* item is addressed, the step is COMPLETE. Stop.
+  *Previous attempt feedback* and *Mechanical gate output* item is addressed,
+  the step is COMPLETE. Stop.
 - Do not re-read files, re-run checks, or `cat`/`tail`/`grep` files you just
   wrote to confirm what already passed. A green suite is a green suite:
   re-running it buys nothing, since the mechanical test gate re-runs the

{agentic_dev_loop-0.15.3 → agentic_dev_loop-0.15.5}/src/agentic_dev_loop/engine/stages.py

@@ -446,7 +446,10 @@ def build_context(runtime: Runtime, docs: dict[str, str], subject: str,
     own mechanical section (process fact, never an agent claim), and only
     engine-verified facts (command exit codes, brief coverage, commit outcome)
     appear in the verified section. Nothing in the claims section is ever
-    routed on."""
+    routed on. The mechanical heading binds every failure it carries as a
+    required fix: command gates (test, restore) never write the notes channel,
+    so without that binding a retried dev agent has no required-fix trigger
+    (plan 065)."""
     parts = [f"You are working on {subject}.\n", guide_section()]
     for name, content in docs.items():
         parts.append(f"## {name}\n\n{content}")
@@ -470,7 +473,8 @@ def build_context(runtime: Runtime, docs: dict[str, str], subject: str,
         parts.extend(claims)
     if mechanical_notes:
         parts.append("## Mechanical gate output "
-                     "(pipeline-captured process output, not agent claims)")
+                     "(pipeline-captured process output, not agent claims; "
+                     "each failure here is a required fix)")
         parts.extend(mechanical_notes)
     verified_lines = [f"- {name}: {fact}" for name, fact in (verified or {}).items()]
     parts.append(