agentic-dev-loop 1.0.0a36__tar.gz → 1.0.0a37__tar.gz

{agentic_dev_loop-1.0.0a36/src/agentic_dev_loop.egg-info → agentic_dev_loop-1.0.0a37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a36
+Version: 1.0.0a37
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -328,11 +328,13 @@ steps:
   a command like `curl ... -o spec.json` has no writable cwd to write into.
   Declare `mounts: [{ path: ".", mode: rw }]` (or a narrower rw path) for any
   networked step that needs to produce files.
-- **`network: true` is now scoped by the `egress:` allowlist.** A networked
-  step's traffic is forced through an engine-run per-policy egress proxy
-  (injected via `HTTP_PROXY`/`HTTPS_PROXY` and reached through the
-  `host.docker.internal` host-gateway); a request to an undeclared host is
-  denied and logged as an enforcement event. The engine never adds an
+- **`network: true` is scoped by the `egress:` allowlist, and egress is
+  structurally enforced.** A networked step runs on a per-run internal
+  docker network with no route to the host. Its traffic is forced
+  through a containerized egress proxy (injected via
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
+  on the internal network); a request to an undeclared host is denied
+  and logged as an enforcement event. The engine never adds an
   undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
@@ -342,16 +344,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
-- **Host-service reachability (planned - planning-docs/037, 038).** A host
-  service reached at `host.docker.internal` through the proxy fails today:
-  the policy admits it, but the proxy dials from the host, where that
-  container-only name does not resolve (a 502 for the client). 037 rewrites
-  `host.docker.internal` to host loopback at the proxy dial site, so signed
-  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
-  host through the enforced, logged path. 038 then replaces the
-  host-gateway model with a per-run internal network: sandboxes get no host
-  route, and a containerized proxy on a second host-access network is the
-  only egress path.
+- **Host-service reachability (planning-docs/037, 038).** The egress
+  proxy is a container on the run's internal network with a second
+  host-access attachment carrying the `host.docker.internal`
+  host-gateway alias, so the name resolves natively inside the proxy
+  container and host services (an S3 SDK against a local MinIO, say)
+  are reached through the enforced, logged path. Sandbox containers
+  have no host route: the internal network carries no default route to
+  the host, and sandbox containers get no host-gateway alias.
+  `dial_rewrites` on the proxy remains the platform override for hosts
+  where the alias does not resolve.
 
 ### Sync-back conflicts (host edits during a run)
 

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a37}/README.md

@@ -286,11 +286,13 @@ steps:
   a command like `curl ... -o spec.json` has no writable cwd to write into.
   Declare `mounts: [{ path: ".", mode: rw }]` (or a narrower rw path) for any
   networked step that needs to produce files.
-- **`network: true` is now scoped by the `egress:` allowlist.** A networked
-  step's traffic is forced through an engine-run per-policy egress proxy
-  (injected via `HTTP_PROXY`/`HTTPS_PROXY` and reached through the
-  `host.docker.internal` host-gateway); a request to an undeclared host is
-  denied and logged as an enforcement event. The engine never adds an
+- **`network: true` is scoped by the `egress:` allowlist, and egress is
+  structurally enforced.** A networked step runs on a per-run internal
+  docker network with no route to the host. Its traffic is forced
+  through a containerized egress proxy (injected via
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
+  on the internal network); a request to an undeclared host is denied
+  and logged as an enforcement event. The engine never adds an
   undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
@@ -300,16 +302,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
-- **Host-service reachability (planned - planning-docs/037, 038).** A host
-  service reached at `host.docker.internal` through the proxy fails today:
-  the policy admits it, but the proxy dials from the host, where that
-  container-only name does not resolve (a 502 for the client). 037 rewrites
-  `host.docker.internal` to host loopback at the proxy dial site, so signed
-  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
-  host through the enforced, logged path. 038 then replaces the
-  host-gateway model with a per-run internal network: sandboxes get no host
-  route, and a containerized proxy on a second host-access network is the
-  only egress path.
+- **Host-service reachability (planning-docs/037, 038).** The egress
+  proxy is a container on the run's internal network with a second
+  host-access attachment carrying the `host.docker.internal`
+  host-gateway alias, so the name resolves natively inside the proxy
+  container and host services (an S3 SDK against a local MinIO, say)
+  are reached through the enforced, logged path. Sandbox containers
+  have no host route: the internal network carries no default route to
+  the host, and sandbox containers get no host-gateway alias.
+  `dial_rewrites` on the proxy remains the platform override for hosts
+  where the alias does not resolve.
 
 ### Sync-back conflicts (host edits during a run)
 

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a37}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a36"
+version = "1.0.0a37"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a37}/src/agentic_dev_loop/engine/egress_proxy.py

@@ -13,6 +13,7 @@ import asyncio
 import json
 import sys
 import threading
+import time
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
@@ -56,24 +57,40 @@ class EgressProxy:
         """True while the proxy's server thread is running."""
         return self._thread is not None and self._thread.is_alive()
 
-    def start(self, host: str = "127.0.0.1", port: int = 0) -> int:
+    def start(self, host: str = "127.0.0.1", port: int = 0,
+              bind_timeout: float = 5.0) -> int:
         """Bind the proxy on ``host:port`` (ephemeral when port=0) and serve
-        in a background thread. Returns the bound port."""
+        in a background thread. Returns the bound port.
+
+        ``bind_timeout`` bounds how long the bind may wait for the requested
+        address to appear (the container-mode entrypoint binds an
+        internal-network IP that is attached after the container starts)."""
         self._loop = asyncio.new_event_loop()
 
         def _run() -> None:
             asyncio.set_event_loop(self._loop)
-            self._server = self._loop.run_until_complete(
-                asyncio.start_server(self._handle, host, port))
+            deadline = time.monotonic() + bind_timeout
+            while True:
+                try:
+                    self._server = self._loop.run_until_complete(
+                        asyncio.start_server(self._handle, host, port))
+                    break
+                except OSError:
+                    if time.monotonic() >= deadline:
+                        raise
+                    time.sleep(0.1)
             self._port = self._server.sockets[0].getsockname()[1]
             self._loop.run_forever()
 
         self._thread = threading.Thread(target=_run, daemon=True)
         self._thread.start()
-        deadline = datetime.now().timestamp() + 5.0
+        deadline = datetime.now().timestamp() + bind_timeout + 1.0
         while self._port is None:
+            if not self._thread.is_alive():
+                raise RuntimeError("egress proxy failed to bind")
             if datetime.now().timestamp() > deadline:
-                raise RuntimeError("egress proxy failed to bind within 5s")
+                raise RuntimeError(
+                    f"egress proxy failed to bind within {bind_timeout}s")
             threading.Event().wait(0.01)
         return self._port
 
@@ -323,8 +340,9 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--policy", required=True)
     parser.add_argument("--events", required=True)
     parser.add_argument("--dial-rewrites", default="{}")
-    parser.add_argument("--host", default="0.0.0.0")
+    parser.add_argument("--host", default="127.0.0.1")
     parser.add_argument("--port", type=int, default=0)
+    parser.add_argument("--bind-timeout", type=float, default=5.0)
     args = parser.parse_args(argv)
 
     proxy = EgressProxy(
@@ -332,7 +350,7 @@ def main(argv: list[str] | None = None) -> int:
         dial_rewrites=json.loads(args.dial_rewrites),
         event_file=Path(args.events),
     )
-    proxy.start(host=args.host, port=args.port)
+    proxy.start(host=args.host, port=args.port, bind_timeout=args.bind_timeout)
     threading.Event().wait()
     return 0
 

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a37}/src/agentic_dev_loop/engine/isolation.py

@@ -19,6 +19,7 @@ last-error.md) are never mounted - sandboxed code cannot reach them.
 from __future__ import annotations
 
 import hashlib
+import ipaddress
 import json
 import math
 import os
@@ -103,6 +104,14 @@ EGRESS_PROXY_PORT = 3128
 HOST_ACCESS_NETWORK = "bridge"
 EGRESS_EVENTS_PREFIX = "egress-events"
 
+# 039: hardened proxy-container runtime posture and readiness bounds.
+PROXY_USER = "65534:65534"
+PROXY_MEMORY = "64m"
+PROXY_CPUS = 0.5
+PROXY_BIND_TIMEOUT = 15.0
+PROXY_READY_ATTEMPTS = 5
+PROXY_READY_DELAY = 0.2
+
 
 class SandboxError(RuntimeError):
     """A loud fail-fast sandbox failure; the message names the problem and
@@ -301,6 +310,37 @@ def egress_events_path(iso_state_dir: str | Path, run_id: str) -> Path:
     return Path(iso_state_dir) / f"{EGRESS_EVENTS_PREFIX}-{run_id}.jsonl"
 
 
+def first_usable_ip(subnets: str) -> str | None:
+    """First usable non-gateway IPv4 address from one or more CIDR subnets."""
+    for token in subnets.split():
+        try:
+            network = ipaddress.ip_network(token, strict=False)
+        except ValueError:
+            continue
+        if network.version != 4:
+            continue
+        hosts = list(network.hosts())
+        if len(hosts) < 2:
+            continue
+        return str(hosts[1])
+    return None
+
+
+
+def proxy_readiness_argv(name: str, host: str,
+                         port: int = EGRESS_PROXY_PORT) -> list[str]:
+    """The in-container TCP-connect probe for proxy readiness (039, D2)."""
+    probe = (
+        "import socket,sys;"
+        "s=socket.socket();"
+        "s.settimeout(2);"
+        "s.connect((sys.argv[1], int(sys.argv[2])));"
+        "s.close()"
+    )
+    return ["docker", "exec", name, "python3", "-c", probe, host, str(port)]
+
+
+
 def mount_set_docker_flags(export_root: str, mount_set: MountSet) -> list[str]:
     """Translate a resolved MountSet into Docker ``-v`` flags over the
     export (ID-4/BR-1). Strict-by-default: an empty mount set mounts nothing
@@ -730,12 +770,16 @@ def docker_proxy_payload(*, run_id: str, image: str, name: str,
                          events_host_path: str,
                          egress_proxy_host_path: str,
                          egress_policy_host_path: str,
+                         bind_host: str,
                          port: int = EGRESS_PROXY_PORT,
                          host_network: str = HOST_ACCESS_NETWORK) -> list[str]:
-    """Exact argv for the containerized egress proxy (038, D2/D5). It is
-    created on the host-access network with a host-gateway mapping (D8), then
-    attached to the internal network so sandbox containers reach it only via
-    its internal DNS name. The policy is passed as JSON; the two engine
+    """Exact argv for the containerized egress proxy (038 D2/D5, 039 D1/D4).
+
+    Created on the host-access network with a host-gateway mapping (D8), then
+    attached to the internal network with the pinned ``bind_host``; the proxy
+    binds that internal address only, so the host-access attachment carries no
+    listener. Hardened with a read-only rootfs, dropped capabilities, a non-root
+    user, and memory/CPU limits. The policy is passed as JSON; the two engine
     modules are bind-mounted read-only so the image does not need the engine
     package installed."""
     payload = [
@@ -744,6 +788,10 @@ def docker_proxy_payload(*, run_id: str, image: str, name: str,
         "--label", f"agentic-dev-loop.run={run_id}",
         "--network", host_network,
         "--add-host", "host.docker.internal:host-gateway",
+        "--read-only",
+        "--cap-drop", "ALL",
+        "--user", PROXY_USER,
+        "--memory", PROXY_MEMORY, "--cpus", str(PROXY_CPUS),
         "-v", f"{egress_proxy_host_path}:/egress/egress_proxy.py:ro",
         "-v", f"{egress_policy_host_path}:/egress/egress_policy.py:ro",
         "-v", f"{events_host_path}:/egress/events.jsonl",
@@ -753,11 +801,13 @@ def docker_proxy_payload(*, run_id: str, image: str, name: str,
         "--policy", policy_json,
         "--events", "/egress/events.jsonl",
         "--dial-rewrites", dial_rewrites_json,
-        "--host", "0.0.0.0",
+        "--host", bind_host,
+        "--bind-timeout", str(PROXY_BIND_TIMEOUT),
         "--port", str(port),
     ]
     return payload
 
+
 def docker_provision_payload(*, run_id: str, image: str, workspace: str,
                              setup_cmd: str,
                              sandbox_venv_dir: str | None = None,
@@ -891,7 +941,8 @@ class DockerBackend(Sandbox):
                  export_root: str | None = None,
                  cache_mounts: list[tuple[str, str, str]] | None = None,
                  sync_excludes: list[str] | None = None,
-                 merge_on_conflict: list[str] | None = None):
+                 merge_on_conflict: list[str] | None = None,
+                 dial_rewrites: dict[str, str] | None = None):
         self._image = image
         self._workspace = workspace
         self._iso_state_dir = Path(iso_state_dir)  # host-only (audit)
@@ -927,6 +978,7 @@ class DockerBackend(Sandbox):
         # 029: append-style logs union-merged on a concurrent-edit conflict
         # instead of raising (host wins, export-only lines appended).
         self._merge_on_conflict = list(merge_on_conflict or ())
+        self._dial_rewrites = dict(dial_rewrites or {})
         self._baseline: dict[str, str] = {}
         # The profile-keyed pool (D-1/BR-10): profile key -> running container.
         self._pool: dict[tuple[str, bool], _ProfileContainer] = {}
@@ -1154,11 +1206,6 @@ class DockerBackend(Sandbox):
         if prof is None:
             prof = self._start_profile(key, mount_set, policy, request.network)
             self._pool[key] = prof
-        if request.network and not prof.started:
-            raise SandboxError(
-                "AE-SBX-013: networked execution requested but no networked "
-                "container is running - declare `network: true` on the step "
-                "(docs/setup.md §3)")
         if request.network:
             if prof.proxy_name is None:
                 raise SandboxError(
@@ -1238,7 +1285,8 @@ class DockerBackend(Sandbox):
         proxy_url_value: str | None = None
         if network and self._export_root is not None:
             proxy_name = proxy_container_name(self._run_id, key[0][:16])
-            self._start_proxy_container(proxy_name, policy)
+            self._start_proxy_container(proxy_name, policy,
+                                         self._dial_rewrites)
             proxy_url_value = proxy_url(proxy_name)
         payload = docker_create_payload(
             run_id=self._run_id, image=self._image, profile=self._profile,
@@ -1261,37 +1309,81 @@ class DockerBackend(Sandbox):
                                  egress_policy=policy, proxy_name=proxy_name,
                                  started=True)
 
-    def _start_proxy_container(self, name: str, policy: EgressPolicy) -> None:
-        """Create one containerized proxy (038, D2/D5): host-access network
-        at create time, then attach the internal network; the events file is
-        pre-created so the single-file bind mount is a file, not a dir."""
+    def _start_proxy_container(self, name: str, policy: EgressPolicy,
+                               dial_rewrites: dict[str, str] | None = None) -> None:
+        """Create one containerized proxy (038 D2/D5, 039 D1-D4): host-access
+        network at create time with a pinned internal IP, then attach the internal
+        network; the proxy binds that address only and is readiness probed from
+        inside the container before the first sandbox exec (D2)."""
         self._ensure_run_network()
         events_host = self._egress_events_path
         events_host.parent.mkdir(parents=True, exist_ok=True)
         events_host.touch(exist_ok=True)
+        try:
+            os.chmod(events_host, 0o666)
+        except OSError:
+            pass
         policy_json = egress_proxy_module.policy_to_json(policy)
+        dial_rewrites = dict(dial_rewrites or {})
+        dial_rewrites_json = json.dumps(dial_rewrites, sort_keys=True)
+        bind_host = self._proxy_internal_ip()
         payload = docker_proxy_payload(
             run_id=self._run_id, image=self._image, name=name,
-            policy_json=policy_json, dial_rewrites_json="{}",
+            policy_json=policy_json, dial_rewrites_json=dial_rewrites_json,
             events_host_path=str(events_host),
             egress_proxy_host_path=str(Path(egress_proxy_module.__file__)),
             egress_policy_host_path=str(Path(egress_policy_module.__file__)),
-            port=EGRESS_PROXY_PORT)
+            bind_host=bind_host, port=EGRESS_PROXY_PORT)
         res = self._runner.run(payload, timeout=60)
         if res.exit_code != 0:
             raise SandboxError(
                 f"AE-SBX-020: egress proxy container run failed: "
                 f"{res.stderr.strip() or res.stdout.strip()}")
         connect = self._runner.run(
-            ["docker", "network", "connect", self._run_net, name], timeout=60)
+            ["docker", "network", "connect", "--ip", bind_host,
+             self._run_net, name], timeout=60)
         if connect.exit_code != 0:
             self._rm_container(name)
             raise SandboxError(
                 f"AE-SBX-020: egress proxy network attach failed: "
                 f"{connect.stderr.strip() or connect.stdout.strip()}")
+        if not self._wait_proxy_ready(name, bind_host):
+            self._rm_container(name)
+            raise SandboxError(
+                f"AE-SBX-021: egress proxy failed to bind "
+                f"{bind_host}:{EGRESS_PROXY_PORT} after "
+                f"{PROXY_READY_ATTEMPTS} readiness probes")
         self._register_container(name)
         self._proxy_containers.append(name)
 
+    def _proxy_internal_ip(self) -> str:
+        """Return the pinned first-usable IPv4 address on the internal network."""
+        inspect = self._runner.run(
+            ["docker", "network", "inspect", "-f",
+             "{{range .IPAM.Config}}{{.Subnet}} {{end}}", self._run_net],
+            timeout=30)
+        if inspect.exit_code != 0:
+            raise SandboxError(
+                f"AE-SBX-021: internal network inspect failed: "
+                f"{inspect.stderr.strip() or inspect.stdout.strip()}")
+        ip = first_usable_ip(inspect.stdout)
+        if ip is None:
+            raise SandboxError(
+                f"AE-SBX-021: internal network has no usable IPv4 subnet: "
+                f"{inspect.stdout.strip()!r}")
+        return ip
+
+    def _wait_proxy_ready(self, name: str, host: str) -> bool:
+        """Bounded in-container TCP-connect readiness probe (039 D2)."""
+        for _ in range(PROXY_READY_ATTEMPTS):
+            res = self._runner.run(proxy_readiness_argv(name, host),
+                                   timeout=15)
+            if res.exit_code == 0:
+                return True
+            time.sleep(PROXY_READY_DELAY)
+        return False
+
+
     def _proxy_alive(self, name: str) -> bool:
         """Query the daemon for proxy liveness (038 AE-SBX-018)."""
         res = self._runner.run(
@@ -1809,7 +1901,8 @@ def _announce(msg: str) -> None:
 def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
                     state_dir: str | Path,
                     runner: CommandRunner | None = None,
-                    refresh: bool | None = None) -> Sandbox:
+                    refresh: bool | None = None,
+                    dial_rewrites: dict[str, str] | None = None) -> Sandbox:
     """Eager startup sequence (Q2): probe → image → materialise export →
     backend → ensure_image → create+start → pre-provision every declared setup
     (stamp-cached).
@@ -1866,7 +1959,8 @@ def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
         sandbox_venv_dir=sandbox_venv_dir, seccomp_profile=seccomp_profile,
         export_root=export_root, cache_mounts=cache_mounts,
         sync_excludes=list(cfg.sync_excludes),
-        merge_on_conflict=list(cfg.merge_on_conflict))
+        merge_on_conflict=list(cfg.merge_on_conflict),
+        dial_rewrites=dial_rewrites)
     _announce(f"preparing sandbox image {image} (first pull can take a while)")
     backend.ensure_image()
     _announce("sandbox image ready")

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a37/src/agentic_dev_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a36
+Version: 1.0.0a37
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -328,11 +328,13 @@ steps:
   a command like `curl ... -o spec.json` has no writable cwd to write into.
   Declare `mounts: [{ path: ".", mode: rw }]` (or a narrower rw path) for any
   networked step that needs to produce files.
-- **`network: true` is now scoped by the `egress:` allowlist.** A networked
-  step's traffic is forced through an engine-run per-policy egress proxy
-  (injected via `HTTP_PROXY`/`HTTPS_PROXY` and reached through the
-  `host.docker.internal` host-gateway); a request to an undeclared host is
-  denied and logged as an enforcement event. The engine never adds an
+- **`network: true` is scoped by the `egress:` allowlist, and egress is
+  structurally enforced.** A networked step runs on a per-run internal
+  docker network with no route to the host. Its traffic is forced
+  through a containerized egress proxy (injected via
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
+  on the internal network); a request to an undeclared host is denied
+  and logged as an enforcement event. The engine never adds an
   undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
@@ -342,16 +344,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
-- **Host-service reachability (planned - planning-docs/037, 038).** A host
-  service reached at `host.docker.internal` through the proxy fails today:
-  the policy admits it, but the proxy dials from the host, where that
-  container-only name does not resolve (a 502 for the client). 037 rewrites
-  `host.docker.internal` to host loopback at the proxy dial site, so signed
-  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
-  host through the enforced, logged path. 038 then replaces the
-  host-gateway model with a per-run internal network: sandboxes get no host
-  route, and a containerized proxy on a second host-access network is the
-  only egress path.
+- **Host-service reachability (planning-docs/037, 038).** The egress
+  proxy is a container on the run's internal network with a second
+  host-access attachment carrying the `host.docker.internal`
+  host-gateway alias, so the name resolves natively inside the proxy
+  container and host services (an S3 SDK against a local MinIO, say)
+  are reached through the enforced, logged path. Sandbox containers
+  have no host route: the internal network carries no default route to
+  the host, and sandbox containers get no host-gateway alias.
+  `dial_rewrites` on the proxy remains the platform override for hosts
+  where the alias does not resolve.
 
 ### Sync-back conflicts (host edits during a run)
 

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a37}/tests/test_e2e_fixtures.py

@@ -13,6 +13,7 @@ default viz port. Kill behavior itself is covered in test_actions.py.
 
 import shutil
 import subprocess
+import textwrap
 from pathlib import Path
 
 import pytest
@@ -74,6 +75,34 @@ def _passing_scripts(fake_agents, **overrides):
         fake_agents.set(agent, behaviors)
 
 
+def _materialize_referenced_docs(pipeline_path: Path, workspace: Path) -> None:
+    """Create a stub for every file the copied pipeline references, derived
+    from the pipeline config itself (additional_files plus the brief step's
+    brief_inputs.include) so future pipeline doc additions can never break
+    the fixture again. Replaces the hand-written stubs: a34 fixed the ERD
+    case by hand, 4b1cbd6 hand-fixed the 038/CHANGELOG/known-issues trio.
+    Literal include entries only: a wildcard cannot be stub-materialized,
+    so it raises instead of silently degrading."""
+    cfg = load_config(pipeline_path)
+    targets: list[Path] = []
+    for rel in cfg.additional_files:
+        targets.append(pipeline_path.parent / rel)
+    for step in cfg.steps:
+        if step.brief_inputs is None:
+            continue
+        for spec in step.brief_inputs.include:
+            if any(ch in spec for ch in "*?["):
+                raise RuntimeError(
+                    "e2e fixture cannot materialize wildcard "
+                    f"brief_inputs include: {spec!r}")
+            targets.append(workspace / spec)
+    for target in targets:
+        if target.is_file():
+            continue
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(f"# {target.name}\n", encoding="utf-8")
+
+
 @pytest.fixture
 def consumer_repo(tmp_path, monkeypatch, fake_agents, fake_sandbox):
     """Byte-identical copy of the shipped example as a clean git repo,
@@ -96,16 +125,13 @@ def consumer_repo(tmp_path, monkeypatch, fake_agents, fake_sandbox):
     example_pipeline.write_text(
         example_pipeline.read_text().replace(
             "agents_dir: sdk_agents", "agents_dir: sdk_agents\nstate_dir: .pr", 1))
-    (repo / "README.md").write_text("# README\n")
-    # 033 brief_inputs.include resolves against the workspace root - the
-    # shipped example lists these repo-rule files, so the consumer copy must
-    # carry them (the real repo does).
-    (repo / "AGENTS.md").write_text("# Repo rules\n")
-    (repo / "coding-standards-ddd.yaml").write_text("standards: true\n")
-    # The example pipeline lists the domain model as an additional_files
-    # sibling; the consumer copy must carry it (the real repo does).
-    (repo / "aidlc-docs").mkdir(exist_ok=True)
-    (repo / "aidlc-docs" / "domain-model-erd.md").write_text("# Domain model\n")
+    # Every file the shipped pipeline references (additional_files plus the
+    # brief step's brief_inputs.include) must exist in the consumer copy, or
+    # the engine fails fast at load. Derive stubs from the copied
+    # pipeline.yaml so future doc additions can never break the fixture
+    # again (a34 fixed the ERD case by hand; 4b1cbd6 hand-fixed the
+    # 038/CHANGELOG/known-issues trio; derivation ends the pattern).
+    _materialize_referenced_docs(example_pipeline, repo)
     monkeypatch.chdir(repo)
     subprocess.run(["git", "init", "-q"], check=True)
     subprocess.run(["git", "config", "user.email", "t@t"], check=True)
@@ -129,6 +155,61 @@ def _log(repo: Path) -> str:
                           capture_output=True, text=True, check=True).stdout
 
 
+def _stub_pipeline(tmp_path: Path, additional: list[str],
+                   include: list[str]) -> tuple[Path, Path]:
+    """Minimal valid pipeline.yaml whose referenced files are all missing,
+    for pinning the stub-derivation helper directly."""
+    workspace = tmp_path / "repo"
+    pdir = workspace / "agentic-dev-loop"
+    pdir.mkdir(parents=True)
+    pipeline = pdir / "pipeline.yaml"
+    pipeline.write_text(textwrap.dedent(f"""
+        name: stub-derivation
+        llm:
+          model: x
+          api_key_env: OPENAI_API_KEY
+        agents_dir: sdk_agents
+        deps_policy: open
+        additional_files: {additional}
+        steps:
+          - name: brief
+            agent: brief
+            produces: [attempt-brief.md]
+            brief_inputs:
+              include: {include}
+              env_facts: []
+        """))
+    return pipeline, workspace
+
+
+class TestMaterializeReferencedDocs:
+    """The consumer_repo fixture derives pipeline-referenced stubs from the
+    copied pipeline.yaml (see _materialize_referenced_docs). Pin the
+    derivation itself: missing additional_files and brief_inputs.include
+    entries get a stub, existing files are never overwritten, and wildcard
+    includes raise (a wildcard cannot be stub-materialized, and silent
+    fallbacks are forbidden)."""
+
+    def test_missing_entries_are_stubbed(self, tmp_path):
+        pipeline, workspace = _stub_pipeline(
+            tmp_path, ["../a.md", "../docs/b.md"], ["rules.md"])
+        _materialize_referenced_docs(pipeline, workspace)
+        assert (workspace / "a.md").is_file()
+        assert (workspace / "docs" / "b.md").is_file()
+        assert (workspace / "rules.md").is_file()
+
+    def test_existing_files_are_not_overwritten(self, tmp_path):
+        pipeline, workspace = _stub_pipeline(tmp_path, ["../a.md"], [])
+        (workspace / "a.md").write_text("keep\n")
+        _materialize_referenced_docs(pipeline, workspace)
+        assert (workspace / "a.md").read_text(encoding="utf-8") == "keep\n"
+
+    def test_wildcard_include_raises(self, tmp_path):
+        pipeline, workspace = _stub_pipeline(tmp_path, [], ["*.md"])
+        with pytest.raises(RuntimeError, match="wildcard"):
+            _materialize_referenced_docs(pipeline, workspace)
+
+
 class TestHistoricalFixtures:
     def test_run004_decorated_verdict_still_passes(self, consumer_repo,
                                                    fake_agents):