agentic-dev-loop 1.0.0a10__tar.gz → 1.0.0a11__tar.gz

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a10
+Version: 1.0.0a11
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -35,6 +35,7 @@ Requires-Dist: langgraph-checkpoint-sqlite>=3.0
 Provides-Extra: dev
 Requires-Dist: hypothesis>=6.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pip-audit>=2.0; extra == "dev"
 Dynamic: license-file
 
 # agentic-dev-loop
@@ -213,6 +214,8 @@ steps:
 | `isolation:` (optional) | Configures the sandbox — image override, resource caps, `allow_git_mutations`. It can never disable it. |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` — artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve — defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
+| `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |
+| `lockfiles` | The pipeline's declared lockfile names (workspace-relative), injected into agent context and named by the missing-dependency fail-fast. Required (non-empty) when `deps_policy: locked` — a `locked` pipeline with no lockfiles fails fast at load. |
 
 ### Secrets (`secrets:`) — refs only, never values
 
@@ -278,6 +281,76 @@ steps:
   for stages that need it (QA, integration). The residual risk is documented
   in [docs/setup.md](docs/setup.md).
 
+## Dependency policy (locked by default)
+
+The supply-chain dial is a pipeline-level `deps_policy:` field, **locked by
+default**. The engine injects the policy into every agent step's context —
+the rule lives in the engine, not in hand-authored `dev.agent.md` prose (the
+class of rule that deadlocked the NuGet cache).
+
+```yaml
+deps_policy: locked    # or: open    (default: locked)
+lockfiles: [uv.lock]   # or: [packages.lock.json, package-lock.json]
+```
+
+- **`locked`** — the human-owned lockfile is the source of truth; the agent
+  may not add dependencies. The injected rule says *"You may only use
+  dependencies already present in `<lockfile>`. If the design requires a
+  dependency that is not present, declare it in your final response under the
+  fixed header `## Missing dependencies` (one `name==version` per line) and
+  finish what you can. Do not add it to the manifest."* A non-empty
+  `## Missing dependencies` declaration **fails the run fast** with
+  `Extend <lockfile> with these pins and re-run: …` — one human lockfile edit,
+  not a retry loop. The declaration is advisory to the human; the engine never
+  auto-fetches the declared packages.
+- **`open`** — the bootstrap protocol (018): the agent may add exact-pinned
+  manifest entries directly (never a package-manager `add` command); the
+  network-on restore step fetches them. The engine injects the same rule
+  canonically. Nothing about `open` is default.
+
+The **restore step** runs the toolchain's locked mode and fails when the
+manifest and lockfile disagree:
+
+| Toolchain | Locked restore | Lockfile |
+| --- | --- | --- |
+| .NET | `dotnet restore --locked-mode` | `packages.lock.json` (set `RestorePackagesWithLockFile=true`) |
+| node | `npm ci` | `package-lock.json` |
+| python | `uv sync --locked` (or pip-tools `pip-sync requirements.lock`) | `uv.lock` — pip has no native lockfile; `uv` is the canonical locked-install tool |
+
+### Audit escalation in the restore step
+
+The restore step also fails on known-CVE findings, at a per-toolchain
+threshold:
+
+| Toolchain | Audit (fails the step) |
+| --- | --- |
+| .NET | `NuGetAudit` at `error` — any audit finding fails the restore |
+| node | `npm audit --audit-level=high` |
+| python | `pip-audit` — any finding fails |
+
+Under `locked`, a failing audit means the lockfile pins a vulnerable version:
+the run fails and the human regenerates the lockfile at a patched version.
+Under `open`, the failure routes to `dev` like any restore failure — the dev
+agent can bump the pin, but that pin is audited again on the next pass, so
+the loop self-corrects.
+
+### Generating a lockfile
+
+A human generates the lockfile once, on a network machine, and commits it —
+the engine never fetches on the agent's behalf:
+
+```bash
+uv lock                 # python — writes uv.lock from pyproject.toml
+uv sync --locked        # installs exactly uv.lock; fails on any drift
+npm install --package-lock-only   # node — writes package-lock.json
+npm ci                  # installs exactly package-lock.json
+dotnet restore --use-lock-file   # .NET — writes packages.lock.json
+dotnet restore --locked-mode      # installs exactly packages.lock.json
+```
+
+Keep the lockfile tracked (do not gitignore it) and re-run the locked restore
+to prove it holds from a clean cache before setting `deps_policy: locked`.
+
 ## Host boundary (security model)
 
 The orchestrator, tool layer, and the `commit` action run in the **host

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/README.md

@@ -174,6 +174,8 @@ steps:
 | `isolation:` (optional) | Configures the sandbox — image override, resource caps, `allow_git_mutations`. It can never disable it. |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` — artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve — defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
+| `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |
+| `lockfiles` | The pipeline's declared lockfile names (workspace-relative), injected into agent context and named by the missing-dependency fail-fast. Required (non-empty) when `deps_policy: locked` — a `locked` pipeline with no lockfiles fails fast at load. |
 
 ### Secrets (`secrets:`) — refs only, never values
 
@@ -239,6 +241,76 @@ steps:
   for stages that need it (QA, integration). The residual risk is documented
   in [docs/setup.md](docs/setup.md).
 
+## Dependency policy (locked by default)
+
+The supply-chain dial is a pipeline-level `deps_policy:` field, **locked by
+default**. The engine injects the policy into every agent step's context —
+the rule lives in the engine, not in hand-authored `dev.agent.md` prose (the
+class of rule that deadlocked the NuGet cache).
+
+```yaml
+deps_policy: locked    # or: open    (default: locked)
+lockfiles: [uv.lock]   # or: [packages.lock.json, package-lock.json]
+```
+
+- **`locked`** — the human-owned lockfile is the source of truth; the agent
+  may not add dependencies. The injected rule says *"You may only use
+  dependencies already present in `<lockfile>`. If the design requires a
+  dependency that is not present, declare it in your final response under the
+  fixed header `## Missing dependencies` (one `name==version` per line) and
+  finish what you can. Do not add it to the manifest."* A non-empty
+  `## Missing dependencies` declaration **fails the run fast** with
+  `Extend <lockfile> with these pins and re-run: …` — one human lockfile edit,
+  not a retry loop. The declaration is advisory to the human; the engine never
+  auto-fetches the declared packages.
+- **`open`** — the bootstrap protocol (018): the agent may add exact-pinned
+  manifest entries directly (never a package-manager `add` command); the
+  network-on restore step fetches them. The engine injects the same rule
+  canonically. Nothing about `open` is default.
+
+The **restore step** runs the toolchain's locked mode and fails when the
+manifest and lockfile disagree:
+
+| Toolchain | Locked restore | Lockfile |
+| --- | --- | --- |
+| .NET | `dotnet restore --locked-mode` | `packages.lock.json` (set `RestorePackagesWithLockFile=true`) |
+| node | `npm ci` | `package-lock.json` |
+| python | `uv sync --locked` (or pip-tools `pip-sync requirements.lock`) | `uv.lock` — pip has no native lockfile; `uv` is the canonical locked-install tool |
+
+### Audit escalation in the restore step
+
+The restore step also fails on known-CVE findings, at a per-toolchain
+threshold:
+
+| Toolchain | Audit (fails the step) |
+| --- | --- |
+| .NET | `NuGetAudit` at `error` — any audit finding fails the restore |
+| node | `npm audit --audit-level=high` |
+| python | `pip-audit` — any finding fails |
+
+Under `locked`, a failing audit means the lockfile pins a vulnerable version:
+the run fails and the human regenerates the lockfile at a patched version.
+Under `open`, the failure routes to `dev` like any restore failure — the dev
+agent can bump the pin, but that pin is audited again on the next pass, so
+the loop self-corrects.
+
+### Generating a lockfile
+
+A human generates the lockfile once, on a network machine, and commits it —
+the engine never fetches on the agent's behalf:
+
+```bash
+uv lock                 # python — writes uv.lock from pyproject.toml
+uv sync --locked        # installs exactly uv.lock; fails on any drift
+npm install --package-lock-only   # node — writes package-lock.json
+npm ci                  # installs exactly package-lock.json
+dotnet restore --use-lock-file   # .NET — writes packages.lock.json
+dotnet restore --locked-mode      # installs exactly packages.lock.json
+```
+
+Keep the lockfile tracked (do not gitignore it) and re-run the locked restore
+to prove it holds from a clean cache before setting `deps_policy: locked`.
+
 ## Host boundary (security model)
 
 The orchestrator, tool layer, and the `commit` action run in the **host

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a10"
+version = "1.0.0a11"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -55,6 +55,7 @@ agentic-dev-loop = "agentic_dev_loop.engine.cli:main"
 dev = [
     "hypothesis>=6.0",
     "pytest>=8.0",
+    "pip-audit>=2.0",
 ]
 
 [tool.setuptools.packages.find]

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/src/agentic_dev_loop/core/config.py

@@ -214,6 +214,27 @@ class PipelineConfig(BaseModel):
     max_attempts: int = 3
     agents_dir: str
     steps: list[StepConfig] = Field(min_length=1)
+    # 021 supply-chain dependency dial: `locked` (default) = the human-owned
+    # lockfile is the source of truth and the agent may not add dependencies;
+    # `open` = the bootstrap protocol (the agent may add exact-pinned manifest
+    # entries for the restore step to fetch). `lockfiles` names the pipeline's
+    # declared lockfile(s) — injected into agent context and named by the
+    # missing-dependency fail-fast.
+    deps_policy: str = "locked"
+    lockfiles: list[str] = []
+
+    @field_validator("deps_policy")
+    @classmethod
+    def _known_deps_policy(cls, v: str) -> str:
+        if v not in ("locked", "open"):
+            raise ValueError(
+                f"deps_policy must be 'locked' or 'open', got {v!r}")
+        return v
+
+    @field_validator("lockfiles", mode="before")
+    @classmethod
+    def _coerce_lockfiles(cls, v: Any) -> Any:
+        return [v] if isinstance(v, str) else v
 
     @field_validator("secrets", mode="before")
     @classmethod
@@ -232,6 +253,15 @@ class PipelineConfig(BaseModel):
                     "values never belong in the pipeline yaml")
         return v
 
+    @model_validator(mode="after")
+    def _locked_requires_lockfiles(self) -> "PipelineConfig":
+        if self.deps_policy == "locked" and not self.lockfiles:
+            raise ValueError(
+                "deps_policy 'locked' requires at least one entry in "
+                "'lockfiles:' — name the lockfile(s) the locked boundary "
+                "enforces, or set 'deps_policy: open'")
+        return self
+
     @model_validator(mode="after")
     def _check_graph(self) -> "PipelineConfig":
         names = [s.name for s in self.steps]

agentic_dev_loop-1.0.0a11/src/agentic_dev_loop/engine/deps.py

@@ -0,0 +1,77 @@
+"""Supply-chain dependency dial (021): canonical policy injection and
+missing-dependency declaration parsing.
+
+The rule text lives HERE, in the engine, not in consumer `dev.agent.md` prose
+— the hand-authored rule is exactly the class that deadlocked the NuGet cache
+in 018. `deps_policy: locked` (the default) bounds the agent to the
+human-owned lockfile and fails a run fast when an agent declares a missing
+dependency; `deps_policy: open` injects the bootstrap protocol (the agent may
+add exact-pinned manifest entries for the restore step to fetch).
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from agentic_dev_loop.core.config import PipelineConfig
+
+MISSING_DEPS_HEADER = "## Missing dependencies"
+
+_LOCKED_TEMPLATE = (
+    "You may only use dependencies already present in {lockfiles}. If the "
+    "design requires a dependency that is not present, declare it in your "
+    "final response under the fixed header `{header}` (one `name==version` "
+    "per line) and finish what you can. Do not add it to the manifest."
+)
+
+_OPEN_TEXT = (
+    "If the design needs a dependency that is not already present, add the "
+    "exact-pinned entry to the dependency manifest directly (do not run a "
+    "package-manager `add` command — it may need the network). Your offline "
+    "builds may fail until the restore step fetches it — that is expected; "
+    "write the code to match and leave the manifest entry in place."
+)
+
+
+def _lockfile_label(cfg: "PipelineConfig") -> str:
+    if cfg.lockfiles:
+        return ", ".join(f"`{name}`" for name in cfg.lockfiles)
+    return "the lockfile"
+
+
+def policy_injection(cfg: "PipelineConfig") -> str:
+    """The canonical dependency-policy paragraph injected into every agent
+    step's context, keyed on ``deps_policy`` and the declared lockfiles."""
+    if cfg.deps_policy == "open":
+        return _OPEN_TEXT
+    return _LOCKED_TEMPLATE.format(
+        lockfiles=_lockfile_label(cfg), header=MISSING_DEPS_HEADER)
+
+
+def parse_missing_dependencies(text: str | None) -> list[str]:
+    """Parse a final agent response for the fixed ``## Missing dependencies``
+    section. Returns the declared pins (one non-empty line each) beneath the
+    header, until the next ``## `` section or end of text. An absent header or
+    an empty/malformed section yields an empty list — only a non-empty
+    declaration triggers the fail-fast."""
+    if not text:
+        return []
+    lines = text.splitlines()
+    for i, line in enumerate(lines):
+        if line.strip() == MISSING_DEPS_HEADER:
+            pins: list[str] = []
+            for rest in lines[i + 1:]:
+                if rest.startswith("## "):
+                    break
+                stripped = rest.strip()
+                if stripped:
+                    pins.append(stripped)
+            return pins
+    return []
+
+
+def extension_message(cfg: "PipelineConfig", pins: list[str]) -> str:
+    """The fail-fast message naming the lockfile(s) and the declared pins."""
+    return (f"Extend {_lockfile_label(cfg)} with these pins and re-run:\n\n"
+            + "\n".join(pins))

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/src/agentic_dev_loop/engine/stages.py

@@ -32,6 +32,7 @@ from openhands.sdk import Conversation
 
 from .agents import load_agent, register_sandbox_terminal
 from agentic_dev_loop.core.config import TERMINALS, PipelineConfig, Route, StepConfig, route_target
+from .deps import extension_message, parse_missing_dependencies, policy_injection
 from .isolation import SandboxExecutionRequest, command_argv, resolve_sandbox_env
 from .outputs import CapturedOutput
 from .secrets import redact_values, step_secret_env
@@ -198,11 +199,13 @@ def _run_command(command: str, workspace: Path, timeout: float,
 def build_context(runtime: Runtime, docs: dict[str, str], subject: str,
                   notes: list[str] | None = None) -> str:
     """Assemble the attempt's shared message: subject, doc bundle, the
-    expected-output-paths section generated from step defs (a prompt merely
-    naming files lets agents skip them), and previous-attempt notes."""
+    canonical dependency-policy paragraph (021), the expected-output-paths
+    section generated from step defs (a prompt merely naming files lets agents
+    skip them), and previous-attempt notes."""
     parts = [f"You are working on {subject}.\n"]
     for name, content in docs.items():
         parts.append(f"## {name}\n\n{content}")
+    parts.append("## Dependency policy\n\n" + policy_injection(runtime.cfg))
     lines = []
     for step in runtime.cfg.steps:
         if step.agent is None:
@@ -301,6 +304,22 @@ def make_agent_node(runtime: Runtime, step: StepConfig):
                                             result.truncated, max_iterations)],
                     "retry_target": _unclear_target(runtime, step)}
 
+        # 021: under `locked`, a declared missing dependency is a fail-fast —
+        # one human lockfile edit, never a retry loop. The extension message
+        # is written to last-error.md (the run-failure channel) and printed.
+        if (runtime.cfg.deps_policy == "locked"
+                and result.response is not None):
+            pins = parse_missing_dependencies(result.response)
+            if pins:
+                msg = extension_message(runtime.cfg, pins)
+                runtime.state_dir.mkdir(parents=True, exist_ok=True)
+                (runtime.state_dir / LAST_ERROR).write_text(
+                    f"# Missing dependencies\n\n```\n{msg}\n```\n",
+                    encoding="utf-8")
+                print(redact_values(msg, runtime.secrets.values()),
+                      file=sys.stderr, flush=True)
+                return {"failed": True, "failed_step": step.name}
+
         if verdicts_map is None:
             merged = {**state["step_verdicts"], step.name: "pass"} if captures else \
                 state["step_verdicts"]

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/src/agentic_dev_loop.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a10
+Version: 1.0.0a11
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -35,6 +35,7 @@ Requires-Dist: langgraph-checkpoint-sqlite>=3.0
 Provides-Extra: dev
 Requires-Dist: hypothesis>=6.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pip-audit>=2.0; extra == "dev"
 Dynamic: license-file
 
 # agentic-dev-loop
@@ -213,6 +214,8 @@ steps:
 | `isolation:` (optional) | Configures the sandbox — image override, resource caps, `allow_git_mutations`. It can never disable it. |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` — artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve — defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
+| `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |
+| `lockfiles` | The pipeline's declared lockfile names (workspace-relative), injected into agent context and named by the missing-dependency fail-fast. Required (non-empty) when `deps_policy: locked` — a `locked` pipeline with no lockfiles fails fast at load. |
 
 ### Secrets (`secrets:`) — refs only, never values
 
@@ -278,6 +281,76 @@ steps:
   for stages that need it (QA, integration). The residual risk is documented
   in [docs/setup.md](docs/setup.md).
 
+## Dependency policy (locked by default)
+
+The supply-chain dial is a pipeline-level `deps_policy:` field, **locked by
+default**. The engine injects the policy into every agent step's context —
+the rule lives in the engine, not in hand-authored `dev.agent.md` prose (the
+class of rule that deadlocked the NuGet cache).
+
+```yaml
+deps_policy: locked    # or: open    (default: locked)
+lockfiles: [uv.lock]   # or: [packages.lock.json, package-lock.json]
+```
+
+- **`locked`** — the human-owned lockfile is the source of truth; the agent
+  may not add dependencies. The injected rule says *"You may only use
+  dependencies already present in `<lockfile>`. If the design requires a
+  dependency that is not present, declare it in your final response under the
+  fixed header `## Missing dependencies` (one `name==version` per line) and
+  finish what you can. Do not add it to the manifest."* A non-empty
+  `## Missing dependencies` declaration **fails the run fast** with
+  `Extend <lockfile> with these pins and re-run: …` — one human lockfile edit,
+  not a retry loop. The declaration is advisory to the human; the engine never
+  auto-fetches the declared packages.
+- **`open`** — the bootstrap protocol (018): the agent may add exact-pinned
+  manifest entries directly (never a package-manager `add` command); the
+  network-on restore step fetches them. The engine injects the same rule
+  canonically. Nothing about `open` is default.
+
+The **restore step** runs the toolchain's locked mode and fails when the
+manifest and lockfile disagree:
+
+| Toolchain | Locked restore | Lockfile |
+| --- | --- | --- |
+| .NET | `dotnet restore --locked-mode` | `packages.lock.json` (set `RestorePackagesWithLockFile=true`) |
+| node | `npm ci` | `package-lock.json` |
+| python | `uv sync --locked` (or pip-tools `pip-sync requirements.lock`) | `uv.lock` — pip has no native lockfile; `uv` is the canonical locked-install tool |
+
+### Audit escalation in the restore step
+
+The restore step also fails on known-CVE findings, at a per-toolchain
+threshold:
+
+| Toolchain | Audit (fails the step) |
+| --- | --- |
+| .NET | `NuGetAudit` at `error` — any audit finding fails the restore |
+| node | `npm audit --audit-level=high` |
+| python | `pip-audit` — any finding fails |
+
+Under `locked`, a failing audit means the lockfile pins a vulnerable version:
+the run fails and the human regenerates the lockfile at a patched version.
+Under `open`, the failure routes to `dev` like any restore failure — the dev
+agent can bump the pin, but that pin is audited again on the next pass, so
+the loop self-corrects.
+
+### Generating a lockfile
+
+A human generates the lockfile once, on a network machine, and commits it —
+the engine never fetches on the agent's behalf:
+
+```bash
+uv lock                 # python — writes uv.lock from pyproject.toml
+uv sync --locked        # installs exactly uv.lock; fails on any drift
+npm install --package-lock-only   # node — writes package-lock.json
+npm ci                  # installs exactly package-lock.json
+dotnet restore --use-lock-file   # .NET — writes packages.lock.json
+dotnet restore --locked-mode      # installs exactly packages.lock.json
+```
+
+Keep the lockfile tracked (do not gitignore it) and re-run the locked restore
+to prove it holds from a clean cache before setting `deps_policy: locked`.
+
 ## Host boundary (security model)
 
 The orchestrator, tool layer, and the `commit` action run in the **host

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/src/agentic_dev_loop.egg-info/SOURCES.txt

@@ -17,6 +17,7 @@ src/agentic_dev_loop/engine/__init__.py
 src/agentic_dev_loop/engine/actions.py
 src/agentic_dev_loop/engine/agents.py
 src/agentic_dev_loop/engine/cli.py
+src/agentic_dev_loop/engine/deps.py
 src/agentic_dev_loop/engine/dryrun.py
 src/agentic_dev_loop/engine/graph.py
 src/agentic_dev_loop/engine/hostboundary.py
@@ -38,6 +39,7 @@ tests/test_agents.py
 tests/test_aidlc.py
 tests/test_cli.py
 tests/test_config.py
+tests/test_deps.py
 tests/test_dry_run.py
 tests/test_e2e_fixtures.py
 tests/test_graph.py

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/src/agentic_dev_loop.egg-info/requires.txt

@@ -9,3 +9,4 @@ langgraph-checkpoint-sqlite>=3.0
 [dev]
 hypothesis>=6.0
 pytest>=8.0
+pip-audit>=2.0

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_cli.py

@@ -22,6 +22,7 @@ llm:
   api_key_env: TEST_LLM_KEY
 state_dir: .pr
 agents_dir: sdk_agents
+deps_policy: open
 steps:
   - name: dev
     agent: dev
@@ -37,6 +38,7 @@ llm:
   api_key_env: TEST_LLM_KEY
 state_dir: .pr
 agents_dir: sdk_agents
+deps_policy: open
 steps:
   - name: dev
     agent: dev
@@ -58,6 +60,7 @@ llm:
   api_key_env: TEST_LLM_KEY
 max_attempts: 1
 agents_dir: sdk_agents
+deps_policy: open
 steps:
   - name: dev
     agent: dev
@@ -329,6 +332,7 @@ llm:
   api_key_env: TEST_LLM_KEY
 state_dir: .pr
 agents_dir: sdk_agents
+deps_policy: open
 isolation:
   state_dir: {iso_state_dir}
 steps:

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_config.py

@@ -29,6 +29,7 @@ llm:
 state_dir: .pr
 max_attempts: 3
 agents_dir: sdk_agents
+deps_policy: open
 
 steps:
   - name: dev
@@ -69,6 +70,7 @@ def _base() -> dict:
         "name": "test-pipeline",
         "llm": {"model": "m", "api_key_env": "K"},
         "agents_dir": "sdk_agents",
+        "lockfiles": ["uv.lock"],
         "steps": [{"name": "dev", "agent": "dev", "on_pass": "success"}],
     }
 
@@ -494,3 +496,36 @@ class TestStepNetwork:
         data["steps"] = [{"name": "commit", "action": "commit", "network": False,
                           "on_pass": "success"}]
         assert _load(tmp_path, data).steps[0].network is False
+
+
+class TestDepsPolicy:
+    def test_defaults_to_locked_with_declared_lockfiles(self, tmp_path):
+        cfg = _load(tmp_path, _base())
+        assert cfg.deps_policy == "locked"
+        assert cfg.lockfiles == ["uv.lock"]
+
+    def test_locked_without_lockfiles_rejected(self, tmp_path):
+        data = {k: v for k, v in _base().items() if k != "lockfiles"}
+        with pytest.raises(ValidationError,
+                           match="requires at least one entry"):
+            _load(tmp_path, data)
+
+    def test_open_policy_loads_without_lockfiles(self, tmp_path):
+        data = {k: v for k, v in _base().items() if k != "lockfiles"} \
+            | {"deps_policy": "open"}
+        assert _load(tmp_path, data).deps_policy == "open"
+        assert _load(tmp_path, data).lockfiles == []
+
+    def test_unknown_policy_rejected(self, tmp_path):
+        data = _base() | {"deps_policy": "bootstrap"}
+        with pytest.raises(ValidationError,
+                           match="deps_policy must be 'locked' or 'open'"):
+            _load(tmp_path, data)
+
+    def test_lockfiles_accepts_a_list(self, tmp_path):
+        data = _base() | {"lockfiles": ["uv.lock", "package-lock.json"]}
+        assert _load(tmp_path, data).lockfiles == ["uv.lock", "package-lock.json"]
+
+    def test_lockfiles_accepts_a_single_string(self, tmp_path):
+        data = _base() | {"lockfiles": "uv.lock"}
+        assert _load(tmp_path, data).lockfiles == ["uv.lock"]

agentic_dev_loop-1.0.0a11/tests/test_deps.py

@@ -0,0 +1,76 @@
+"""Dependency-policy injection and missing-dependency parsing (021)."""
+
+from agentic_dev_loop.core.config import PipelineConfig
+from agentic_dev_loop.engine.deps import (
+    MISSING_DEPS_HEADER, extension_message, parse_missing_dependencies,
+    policy_injection)
+
+
+def _cfg(**over):
+    base = {"name": "t", "llm": {"model": "m", "api_key_env": "K"},
+            "agents_dir": "a", "lockfiles": ["uv.lock"],
+            "steps": [{"name": "d", "agent": "dev", "on_pass": "success"}]}
+    base.update(over)
+    return PipelineConfig.model_validate(base)
+
+
+class TestPolicyInjection:
+    def test_locked_names_declared_lockfiles(self):
+        cfg = _cfg(deps_policy="locked", lockfiles=["uv.lock"])
+        text = policy_injection(cfg)
+        assert "`uv.lock`" in text
+        assert MISSING_DEPS_HEADER in text
+        assert "Do not add it to the manifest." in text
+
+    def test_locked_with_multiple_lockfiles_joins_them(self):
+        cfg = _cfg(lockfiles=["packages.lock.json", "package-lock.json"])
+        text = policy_injection(cfg)
+        assert "`packages.lock.json`, `package-lock.json`" in text
+
+    def test_open_injects_bootstrap_protocol(self):
+        cfg = _cfg(deps_policy="open")
+        text = policy_injection(cfg)
+        assert "add the exact-pinned entry to the dependency manifest" in text
+        assert MISSING_DEPS_HEADER not in text
+
+
+class TestParseMissingDependencies:
+    def test_header_with_pins(self):
+        text = ("Done.\n\n"
+                + MISSING_DEPS_HEADER + "\n\nrequests==2.32.0\n"
+                "pydantic==2.7.0\n")
+        assert parse_missing_dependencies(text) == \
+            ["requests==2.32.0", "pydantic==2.7.0"]
+
+    def test_header_absent(self):
+        assert parse_missing_dependencies("No dependencies needed.") == []
+
+    def test_none_text(self):
+        assert parse_missing_dependencies(None) == []
+
+    def test_header_present_but_empty(self):
+        text = f"All done.\n\n{MISSING_DEPS_HEADER}\n\n\n"
+        assert parse_missing_dependencies(text) == []
+
+    def test_section_ends_at_next_header(self):
+        text = (MISSING_DEPS_HEADER + "\nrequests==2.32.0\n"
+                "## Summary\n\nDone.\n")
+        assert parse_missing_dependencies(text) == ["requests==2.32.0"]
+
+    def test_header_name_is_exact(self):
+        # Only the fixed header matches — decoration or case drift is malformed.
+        assert parse_missing_dependencies("### Missing dependencies\nfoo==1.0\n") == []
+        assert parse_missing_dependencies("## missing dependencies\nfoo==1.0\n") == []
+
+    def test_blank_and_padded_lines_are_pins(self):
+        text = f"{MISSING_DEPS_HEADER}\n\n  requests==2.32.0  \n"
+        assert parse_missing_dependencies(text) == ["requests==2.32.0"]
+
+
+class TestExtensionMessage:
+    def test_names_lockfile_and_pins(self):
+        cfg = _cfg(lockfiles=["uv.lock"])
+        msg = extension_message(cfg, ["requests==2.32.0"])
+        assert msg == ("Extend `uv.lock` with these pins and re-run:\n\n"
+                       "requests==2.32.0")
+

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_dry_run.py

@@ -26,6 +26,7 @@ llm:
   api_key_env: OPENAI_API_KEY
 state_dir: .pr
 agents_dir: sdk_agents
+deps_policy: open
 steps:
   - name: dev
     agent: dev

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_graph.py

@@ -34,6 +34,7 @@ llm:
 state_dir: .pr
 max_attempts: 3
 agents_dir: sdk_agents
+deps_policy: open
 steps:
   - name: dev
     agent: dev
@@ -76,6 +77,7 @@ llm:
 state_dir: .pr
 max_attempts: 3
 agents_dir: sdk_agents
+deps_policy: open
 steps:
   - name: dev
     agent: dev
@@ -265,6 +267,42 @@ class TestRunPipeline:
         assert fake_agents.calls == []
 
 
+LOCKED_YAML = YOSK_YAML.replace(
+    "deps_policy: open\n",
+    "deps_policy: locked\nlockfiles: [uv.lock]\n",
+    1)
+
+
+class TestDependencyDial:
+    def _write_locked(self, repo):
+        (repo / "locked.yaml").write_text(LOCKED_YAML)
+        git(repo, "add", "-A")
+        git(repo, "commit", "-m", "add locked pipeline")
+
+    def test_missing_dependency_fails_fast_not_retry_loop(self, repo,
+                                                          fake_agents):
+        self._write_locked(repo)
+        fake_agents.set("dev", [("write", "implementation-summary.md",
+            "## Missing dependencies\n\nrequests==2.32.0\n")])
+        ok, attempts = run_pipeline("locked.yaml", args())
+        assert (ok, attempts) == (False, 1)
+        assert fake_agents.agents_called() == ["dev"]
+        err = (repo / ".pr" / "last-error.md").read_text()
+        assert "Extend `uv.lock`" in err
+        assert "requests==2.32.0" in err
+
+    def test_locked_context_names_lockfile_in_dev_message(self, repo,
+                                                          fake_agents):
+        self._write_locked(repo)
+        script_all_pass(fake_agents)
+        ok, attempts = run_pipeline("locked.yaml", args())
+        assert (ok, attempts) == (True, 1)
+        (dev_msg,) = fake_agents.messages_for("dev")
+        assert "## Dependency policy" in dev_msg
+        assert "`uv.lock`" in dev_msg
+        assert "Do not add it to the manifest." in dev_msg
+
+
 class TestCommandStep:
     def _write(self, repo: Path, text: str) -> None:
         (repo / "commandstage.yaml").write_text(text)

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_hostboundary.py

@@ -21,6 +21,7 @@ def _cfg(agents_dir="sdk_agents", additional_files=()):
         "llm": {"model": "m", "api_key_env": "K"},
         "agents_dir": agents_dir,
         "additional_files": list(additional_files),
+        "lockfiles": ["uv.lock"],
         "steps": [{"name": "dev", "agent": "dev", "on_pass": "success"}],
     })
 

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_hostboundary_integration.py

@@ -60,6 +60,7 @@ def _runtime(backend, ws, script, tmp_path):
         "name": "probe",
         "llm": {"model": "openai/test-model", "api_key_env": "K"},
         "agents_dir": "agents",
+        "lockfiles": ["uv.lock"],
         "steps": [{"name": "probe", "action": "probe", "on_pass": "success"}],
     })
     runtime = Runtime(cfg=cfg, registry=reg,

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_isolation.py

@@ -790,6 +790,7 @@ class TestStartupSandbox:
         return PipelineConfig.model_validate({
             "name": "p", "llm": {"model": "m", "api_key_env": "K"},
             "agents_dir": "agents", "steps": steps,
+            "lockfiles": ["uv.lock"],
             "isolation": {"state_dir": str(tmp_path / "iso-state")},
         })
 
@@ -835,6 +836,7 @@ class TestStartupSandbox:
         cfg = PipelineConfig.model_validate({
             "name": "p", "llm": {"model": "m", "api_key_env": "K"},
             "agents_dir": "agents",
+            "lockfiles": ["uv.lock"],
             "steps": [{"name": "dev", "agent": "dev", "on_pass": "test"},
                       {"name": "test", "command": "make", "network": True,
                        "on_pass": "success"}],

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_secrets.py

@@ -23,6 +23,7 @@ def _base() -> dict:
         "name": "test-pipeline",
         "llm": {"model": "m", "api_key_env": "K"},
         "agents_dir": "sdk_agents",
+        "lockfiles": ["uv.lock"],
         "steps": [{"name": "dev", "agent": "dev", "on_pass": "success"}],
     }
 

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_secrets_pipeline.py

@@ -19,6 +19,7 @@ llm:
   model: m
   api_key_env: TEST_LLM_KEY
 agents_dir: agents
+deps_policy: open
 secrets:
   probe-secret:
     from: env
@@ -37,6 +38,7 @@ llm:
   model: m
   api_key_env: TEST_LLM_KEY
 agents_dir: agents
+deps_policy: open
 steps:
   - name: dev
     agent: dev

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_stages.py

@@ -24,7 +24,7 @@ from agentic_dev_loop.engine.stages import (
 
 def make_cfg(steps, **over):
     base = {"name": "t", "llm": {"model": "m", "api_key_env": "K"},
-            "agents_dir": "agents", "steps": steps}
+            "agents_dir": "agents", "lockfiles": ["uv.lock"], "steps": steps}
     base.update(over)
     return PipelineConfig.model_validate(base)
 
@@ -115,6 +115,57 @@ class TestBuildContext:
         assert "test agent writes:" not in ctx
 
 
+class TestDepsPolicyContext:
+    def test_locked_policy_injected(self, runtime):
+        cfg = make_cfg(STEPS, deps_policy="locked", lockfiles=["uv.lock"])
+        rt = dataclasses.replace(runtime, cfg=cfg)
+        ctx = build_context(rt, {}, "s", [])
+        assert "## Dependency policy" in ctx
+        assert "`uv.lock`" in ctx
+        assert "## Missing dependencies" in ctx
+        assert "Do not add it to the manifest." in ctx
+
+    def test_open_policy_injected(self, runtime):
+        cfg = make_cfg(STEPS, deps_policy="open")
+        rt = dataclasses.replace(runtime, cfg=cfg)
+        ctx = build_context(rt, {}, "s", [])
+        assert "## Dependency policy" in ctx
+        assert "add the exact-pinned entry to the dependency manifest" in ctx
+        assert "## Missing dependencies" not in ctx
+
+
+class TestMissingDependencyFailFast:
+    def _rt(self, runtime, **over):
+        cfg = make_cfg(STEPS, **over)
+        return dataclasses.replace(runtime, cfg=cfg)
+
+    def test_locked_dev_declaring_missing_dep_fails_fast(self, runtime,
+                                                         fake_agents):
+        rt = self._rt(runtime, deps_policy="locked", lockfiles=["uv.lock"])
+        fake_agents.set("dev", [("write", "implementation-summary.md",
+            "Built most of it.\n\n## Missing dependencies\n\n"
+            "requests==2.32.0\n")])
+        update = make_agent_node(rt, rt.cfg.steps[0])(make_state())
+        assert update == {"failed": True, "failed_step": "dev"}
+        err = (rt.state_dir / "last-error.md").read_text()
+        assert "Extend `uv.lock`" in err
+        assert "requests==2.32.0" in err
+
+    def test_no_header_no_fail(self, runtime, fake_agents):
+        rt = self._rt(runtime, deps_policy="locked", lockfiles=["uv.lock"])
+        fake_agents.set("dev", [("write", "implementation-summary.md",
+                                 "no new deps")])
+        update = make_agent_node(rt, rt.cfg.steps[0])(make_state())
+        assert update["failed"] is False
+
+    def test_open_policy_does_not_fail_on_header(self, runtime, fake_agents):
+        rt = self._rt(runtime, deps_policy="open")
+        fake_agents.set("dev", [("write", "implementation-summary.md",
+            "## Missing dependencies\n\nrequests==2.32.0\n")])
+        update = make_agent_node(rt, rt.cfg.steps[0])(make_state())
+        assert update["failed"] is False
+
+
 class TestAgentNode:
     def test_pass_verdict(self, runtime, fake_agents):
         fake_agents.set("check", [("write", "ci-fix.md", "all good\nVERDICT: PASS\n")])

{agentic_dev_loop-1.0.0a10 → agentic_dev_loop-1.0.0a11}/tests/test_viz.py

@@ -141,6 +141,7 @@ class TestTopologyMermaid:
             "name": "viz-topology",
             "llm": {"model": "m", "api_key_env": "K"},
             "agents_dir": "sdk_agents",
+            "lockfiles": ["uv.lock"],
             "steps": steps,
         })