agentic-devtools 0.2.575__py3-none-any.whl → 0.2.577__py3-none-any.whl

agentic_devtools/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.2.575'
-__version_tuple__ = version_tuple = (0, 2, 575)
+__version__ = version = '0.2.577'
+__version_tuple__ = version_tuple = (0, 2, 577)
 
 __commit_id__ = commit_id = None

agentic_devtools/cli/checks/smart_module_tests.py

@@ -44,6 +44,17 @@ _MODULE_SPECS = {
     "tasks": _ModuleTestSpec(("tests/unit/cli/tasks",), (), ("agentic_devtools/cli/tasks",)),
     "github_module": _ModuleTestSpec(("tests/unit/cli/github",), (), ("agentic_devtools/cli/github",)),
     "copilot": _ModuleTestSpec(("tests/unit/cli/copilot",), (), ("agentic_devtools/cli/copilot",)),
+    "ci": _ModuleTestSpec(
+        (
+            "tests/unit/cli/ci/critique_adjudicator/test_critique_adjudicator.py",
+            "tests/unit/cli/ci/pipeline/critique_gate/test_critique_gate_exception_passed.py",
+        ),
+        (),
+        (
+            "agentic_devtools.cli.ci.critique_adjudicator",
+            "agentic_devtools.cli.ci.pipeline.critique_gate",
+        ),
+    ),
     "speckit": _ModuleTestSpec(("tests/unit/cli/speckit",), (), ("agentic_devtools/cli/speckit",)),
     "azure": _ModuleTestSpec(("tests/unit/cli/azure",), (), ("agentic_devtools/cli/azure",)),
     "issue_template": _ModuleTestSpec(("tests/unit/cli/issue_template",), (), ("agentic_devtools/cli/issue_template",)),

agentic_devtools/cli/ci/pipeline/conflict_reconciliation.py

@@ -0,0 +1,308 @@
+"""Versioned reconciliation claims, not authentication or a merge authorization.
+
+All identities, digests, inventories, and verdicts here are unverified payload
+data. Provider verification, original-criteria digest verification, live-head
+binding, and every independent pipeline gate remain the caller's responsibility.
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import hashlib
+import json
+import re
+from dataclasses import asdict, dataclass, fields
+from typing import Any, Literal
+
+__all__ = [
+    "ReconciliationAttestation",
+    "ReconciliationCriterionVerdict",
+    "ReconciliationFileVerdict",
+    "ReconciliationValidationError",
+    "validate_reconciliation_attestation",
+    "encode_reconciliation_review_body",
+    "decode_reconciliation_review_body",
+]
+
+_LOGIN = r"[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,38}"
+_CRITERIA_SOURCE = "https://github.com/swai-factory/agentic-devtools/issues/4299#acceptance-and-safety-tests"
+_CRITERION_IDS = ("AC1", "AC2", "AC3", "AC4", "AC5", "AC6", "AC7")
+_MAX_BODY_LENGTH = 58_000
+_FOOTER = "<!-- /agdt-reconciliation -->"
+_Verdict = Literal["accepted", "rejected", "unresolved"]
+
+
+@dataclass(frozen=True)
+class ReconciliationFileVerdict:
+    """Claim about raw file bytes and intended behavior at the reviewed head."""
+
+    path: str
+    content_sha256: str
+    verdict: _Verdict
+    behavior: str
+
+
+@dataclass(frozen=True)
+class ReconciliationCriterionVerdict:
+    """Claim about one original parent acceptance criterion."""
+
+    criterion_id: str
+    verdict: _Verdict
+    rationale: str
+
+
+@dataclass(frozen=True)
+class ReconciliationAttestation:
+    """Immutable schema-v1 claims with separate repair-output and reviewed heads."""
+
+    schema_version: int
+    repository: str
+    pr_number: int
+    pre_repair_sha: str
+    pinned_base_sha: str
+    repair_output_sha: str
+    reviewed_head_sha: str
+    changed_files: tuple[str, ...]
+    file_verdicts: tuple[ReconciliationFileVerdict, ...]
+    criteria_source: str
+    criteria_source_sha256: str
+    criterion_verdicts: tuple[ReconciliationCriterionVerdict, ...]
+    provider_evidence_ref: str
+    configured_approver_login: str
+    reviewer_login: str
+    repair_writer_login: str
+
+
+class ReconciliationValidationError(ValueError):
+    """Contract failure with a stable machine-readable reason."""
+
+    def __init__(self, reason: str) -> None:
+        self.reason = reason
+        super().__init__(reason)
+
+
+def _require_pattern(value: str, pattern: str, reason: str) -> None:
+    """Require a string matching the entire ASCII contract pattern."""
+    if not isinstance(value, str) or re.fullmatch(pattern, value) is None:
+        raise ReconciliationValidationError(reason)
+
+
+def _validate_path(path: str) -> None:
+    """Validate a repository-relative Git path without normalization."""
+    if (
+        not isinstance(path, str)
+        or not path
+        or path.startswith("/")
+        or re.match(r"[A-Za-z]:/", path) is not None
+        or "\\" in path
+        or "\0" in path
+        or any(segment in ("", ".", "..") for segment in path.split("/"))
+    ):
+        raise ReconciliationValidationError("invalid_file_path")
+
+
+def validate_reconciliation_attestation(attestation: ReconciliationAttestation) -> None:
+    """Validate payload structure and consistency only; never authorize a repair."""
+    if type(attestation) is not ReconciliationAttestation:
+        raise ReconciliationValidationError("invalid_record_type")
+    if type(attestation.schema_version) is not int or attestation.schema_version != 1:
+        raise ReconciliationValidationError("unsupported_schema_version")
+    _require_pattern(attestation.repository, rf"{_LOGIN}/[a-z0-9._-]{{1,100}}", "invalid_repository")
+    if type(attestation.pr_number) is not int or attestation.pr_number <= 0:
+        raise ReconciliationValidationError("invalid_pr_number")
+    for sha in (
+        attestation.pre_repair_sha,
+        attestation.pinned_base_sha,
+        attestation.repair_output_sha,
+        attestation.reviewed_head_sha,
+    ):
+        _require_pattern(sha, r"[0-9a-f]{40}", "invalid_commit_sha")
+    _require_pattern(attestation.criteria_source_sha256, r"[0-9a-f]{64}", "invalid_sha256")
+    if attestation.criteria_source != _CRITERIA_SOURCE:
+        raise ReconciliationValidationError("criterion_coverage_mismatch")
+    _validate_identities(attestation)
+    for collection in (attestation.changed_files, attestation.file_verdicts, attestation.criterion_verdicts):
+        if type(collection) is not tuple:
+            raise ReconciliationValidationError("invalid_collection_type")
+    _validate_files(attestation)
+    _validate_criteria(attestation.criterion_verdicts)
+
+
+def _validate_identities(attestation: ReconciliationAttestation) -> None:
+    """Check claimed login and locator consistency, not provider identity."""
+    for login in (
+        attestation.configured_approver_login,
+        attestation.reviewer_login,
+        attestation.repair_writer_login,
+    ):
+        _require_pattern(login, _LOGIN, "invalid_login")
+    if attestation.reviewer_login != attestation.configured_approver_login:
+        raise ReconciliationValidationError("reviewer_not_configured_approver")
+    if attestation.reviewer_login == attestation.repair_writer_login:
+        raise ReconciliationValidationError("reviewer_is_repair_writer")
+    expected_ref = f"github://{attestation.repository}/pull/{attestation.pr_number}/reviews"
+    if attestation.provider_evidence_ref != expected_ref:
+        raise ReconciliationValidationError("invalid_provider_evidence_ref")
+
+
+def _require_inventory(values: tuple[str, ...], duplicate_reason: str) -> None:
+    """Require unique identifiers in lexicographic order."""
+    if len(set(values)) != len(values):
+        raise ReconciliationValidationError(duplicate_reason)
+    if tuple(sorted(values)) != values:
+        raise ReconciliationValidationError("noncanonical_order")
+
+
+def _validate_files(attestation: ReconciliationAttestation) -> None:
+    """Require exact, accepted, behavior-described coverage of the claimed inventory."""
+    if not attestation.changed_files:
+        raise ReconciliationValidationError("file_inventory_empty")
+    for path in attestation.changed_files:
+        _validate_path(path)
+    _require_inventory(attestation.changed_files, "duplicate_file")
+    for file_record in attestation.file_verdicts:
+        _validate_file_record(file_record)
+    file_paths = tuple(record.path for record in attestation.file_verdicts)
+    _require_inventory(file_paths, "duplicate_file")
+    if file_paths != attestation.changed_files:
+        raise ReconciliationValidationError("file_verdict_coverage_mismatch")
+
+
+def _validate_file_record(file_record: ReconciliationFileVerdict) -> None:
+    """Require a structurally valid accepted file claim."""
+    if type(file_record) is not ReconciliationFileVerdict:
+        raise ReconciliationValidationError("invalid_record_type")
+    _validate_path(file_record.path)
+    _require_pattern(file_record.content_sha256, r"[0-9a-f]{64}", "invalid_sha256")
+    if file_record.verdict not in ("accepted", "rejected", "unresolved"):
+        raise ReconciliationValidationError("invalid_file_verdict")
+    if file_record.verdict != "accepted":
+        raise ReconciliationValidationError(f"file_verdict_{file_record.verdict}")
+    if not isinstance(file_record.behavior, str) or not file_record.behavior.strip():
+        raise ReconciliationValidationError("empty_file_behavior")
+
+
+def _validate_criteria(records: tuple[ReconciliationCriterionVerdict, ...]) -> None:
+    """Require accepted claims covering all seven original criterion IDs."""
+    for criterion_record in records:
+        if type(criterion_record) is not ReconciliationCriterionVerdict:
+            raise ReconciliationValidationError("invalid_record_type")
+        if criterion_record.criterion_id not in _CRITERION_IDS:
+            raise ReconciliationValidationError("criterion_coverage_mismatch")
+        if criterion_record.verdict not in ("accepted", "rejected", "unresolved"):
+            raise ReconciliationValidationError("invalid_criterion_verdict")
+        if criterion_record.verdict != "accepted":
+            raise ReconciliationValidationError(f"criterion_verdict_{criterion_record.verdict}")
+        if not isinstance(criterion_record.rationale, str) or not criterion_record.rationale.strip():
+            raise ReconciliationValidationError("empty_criterion_rationale")
+    criterion_ids = tuple(record.criterion_id for record in records)
+    _require_inventory(criterion_ids, "duplicate_criterion")
+    if criterion_ids != _CRITERION_IDS:
+        raise ReconciliationValidationError("criterion_coverage_mismatch")
+
+
+def _canonical_json(payload: Any) -> bytes:
+    """Serialize canonical ASCII JSON as UTF-8 bytes."""
+    return json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=True, allow_nan=False).encode(
+        "utf-8"
+    )
+
+
+def encode_reconciliation_review_body(attestation: ReconciliationAttestation) -> str:
+    """Encode a complete claim, enforcing the envelope size before field validation."""
+    if type(attestation) is not ReconciliationAttestation:
+        raise ReconciliationValidationError("invalid_record_type")
+    try:
+        payload = _canonical_json(asdict(attestation))
+    except TypeError, ValueError, RecursionError:
+        # Non-JSON caller values have no encodable body to size. Validation
+        # supplies their precise reason without coercing the original records.
+        validate_reconciliation_attestation(attestation)
+        raise ReconciliationValidationError("invalid_record_type") from None
+    encoded = base64.urlsafe_b64encode(payload).decode("ascii").rstrip("=")
+    digest = hashlib.sha256(payload).hexdigest()
+    body = f"<!-- agdt-reconciliation:v1 sha256={digest} -->\n{encoded}\n{_FOOTER}"
+    if len(body) > _MAX_BODY_LENGTH:
+        raise ReconciliationValidationError("review_body_too_large")
+    validate_reconciliation_attestation(attestation)
+    return body
+
+
+def _json_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    """Reject duplicate keys at every JSON object depth."""
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            raise ReconciliationValidationError("invalid_json")
+        result[key] = value
+    return result
+
+
+def _record_from_json[Record: ReconciliationAttestation | ReconciliationFileVerdict | ReconciliationCriterionVerdict](
+    record_type: type[Record], payload: Any
+) -> Record:
+    """Require the exact key set before constructing a frozen record."""
+    if type(payload) is not dict:
+        raise ReconciliationValidationError("invalid_record_type")
+    expected = {field.name for field in fields(record_type)}
+    if payload.keys() - expected:
+        raise ReconciliationValidationError("unknown_field")
+    if expected - payload.keys():
+        raise ReconciliationValidationError("missing_field")
+    return record_type(**payload)
+
+
+def _decode_base64url(encoded: str) -> bytes:
+    """Decode strictly unpadded, canonical RFC 4648 URL-safe Base64."""
+    if re.fullmatch(r"[A-Za-z0-9_-]+", encoded) is None:
+        raise ReconciliationValidationError("invalid_base64url")
+    try:
+        payload = base64.b64decode(encoded + "=" * (-len(encoded) % 4), altchars=b"-_", validate=True)
+    except binascii.Error as exc:
+        raise ReconciliationValidationError("invalid_base64url") from exc
+    if base64.urlsafe_b64encode(payload).decode("ascii").rstrip("=") != encoded:
+        raise ReconciliationValidationError("invalid_base64url")
+    return payload
+
+
+def decode_reconciliation_review_body(body: str) -> ReconciliationAttestation:
+    """Decode only one exact canonical block; do not authenticate its claims."""
+    if not isinstance(body, str):
+        raise ReconciliationValidationError("malformed_metadata")
+    if len(body) > _MAX_BODY_LENGTH:
+        raise ReconciliationValidationError("review_body_too_large")
+    lines = body.split("\n")
+    if len(lines) != 3:
+        raise ReconciliationValidationError("malformed_metadata")
+    header = re.fullmatch(r"<!-- agdt-reconciliation:v1 sha256=([0-9a-f]{64}) -->", lines[0])
+    if header is None or lines[2] != _FOOTER:
+        raise ReconciliationValidationError("malformed_metadata")
+    payload = _decode_base64url(lines[1])
+    if hashlib.sha256(payload).hexdigest() != header[1]:
+        raise ReconciliationValidationError("payload_digest_mismatch")
+    try:
+        data = json.loads(payload.decode("utf-8"), object_pairs_hook=_json_object)
+        canonical = _canonical_json(data)
+    except (ValueError, RecursionError) as exc:
+        raise ReconciliationValidationError("invalid_json") from exc
+    if canonical != payload:
+        raise ReconciliationValidationError("noncanonical_payload")
+    _record_from_json(ReconciliationAttestation, data)
+    record_types: tuple[
+        tuple[str, type[ReconciliationFileVerdict] | type[ReconciliationCriterionVerdict] | None], ...
+    ] = (
+        ("changed_files", None),
+        ("file_verdicts", ReconciliationFileVerdict),
+        ("criterion_verdicts", ReconciliationCriterionVerdict),
+    )
+    for key, record_type in record_types:
+        collection = data[key]
+        if type(collection) is not list:
+            raise ReconciliationValidationError("invalid_collection_type")
+        data[key] = tuple(
+            _record_from_json(record_type, record) if record_type is not None else record for record in collection
+        )
+    attestation = _record_from_json(ReconciliationAttestation, data)
+    validate_reconciliation_attestation(attestation)
+    return attestation

{agentic_devtools-0.2.575.dist-info → agentic_devtools-0.2.577.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-devtools
-Version: 0.2.575
+Version: 0.2.577
 Summary: Agentic devtools integrate Jira, DevOps & more
 Author: ayaiayorg
 License-Expression: MIT

{agentic_devtools-0.2.575.dist-info → agentic_devtools-0.2.577.dist-info}/RECORD

@@ -1,5 +1,5 @@
 agentic_devtools/__init__.py,sha256=J_Zw_vWKghk-cLmqI83hXQmSiS8zMhGIHM5WPLDkZuo,242
-agentic_devtools/_version.py,sha256=Kwc4VXVEzGORnf7xChq1gdA9uZ6IF4gqkLChshs24TA,524
+agentic_devtools/_version.py,sha256=TIWdW15l89P8z-XtWYdluJmDXV7ryxUz-CBFY28AsZc,524
 agentic_devtools/agdt_gitignore.py,sha256=vVVqTjBZ_ijn6U3Lnh_JGrARLschYVN-fFal9jDk0Ak,2694
 agentic_devtools/background_tasks.py,sha256=sFgmqOnCdCjclABJ8V__yDwBXDyi45b1Z-MVv3G2zB8,17664
 agentic_devtools/config.py,sha256=DEVxTVZhsQbVQwO9qdB_1h19aBpjMzF6xJY_ePYLGLs,15629
@@ -220,7 +220,7 @@ agentic_devtools/cli/checks/quality_baseline.py,sha256=PbSYAiJdWwEDP8SGGUXNpJVxk
 agentic_devtools/cli/checks/setup_drift.py,sha256=bVR0F4wpwt8rOl829tGXKqI1PDUbg9JsXTShgYaJSSM,7666
 agentic_devtools/cli/checks/setup_drift_changed_files.py,sha256=73IuzquyLDKhWderCvFE5TXnHuBxBcQTSbg2p15-wKE,3719
 agentic_devtools/cli/checks/skill_classification.py,sha256=vZGv2IjT-uEMEDguWhdZPyTLB2QD4rTVnATS7Agrjrc,8521
-agentic_devtools/cli/checks/smart_module_tests.py,sha256=HxMM1VAP44N4IsNy1ELOaFtuJ2-ryqahU3jBRjhGOJ4,7675
+agentic_devtools/cli/checks/smart_module_tests.py,sha256=wYr_o9ojqQStEA8VfFS0YbBYrwsGNHtfEgoPk2067dk,8063
 agentic_devtools/cli/checks/structure.py,sha256=b6Z_eXoV4D6WU2EDaFBDRTHmHzHYos1dv5pNLTbs80E,1771
 agentic_devtools/cli/checks/tests.py,sha256=ZJoMkTdbo3H2_ojadG3nEOw4xUmUciER4N_2mO_5sUg,5237
 agentic_devtools/cli/checks/xdist_policy.py,sha256=JSb3HijPjpiSV0Gh7PLX4nWc0Bvb2Bi5rAl4Ww8l0NY,1156
@@ -299,6 +299,7 @@ agentic_devtools/cli/ci/evaluator/snapshot_markdown_blocks.py,sha256=0myRRK4CpYP
 agentic_devtools/cli/ci/pipeline/__init__.py,sha256=kVtyTqirPi_pXeEPpa3nYqW15ILPiAVpGGWML3CEl3s,755
 agentic_devtools/cli/ci/pipeline/base.py,sha256=KanjtOEcz6myQPoNqNYO5bsbHL5LPhm-PFnL8yT7Q2M,1268
 agentic_devtools/cli/ci/pipeline/command.py,sha256=f4KfVWkKheIb4xaUbyO9dF1idy5wLR-qPtZHEXy1MQg,12428
+agentic_devtools/cli/ci/pipeline/conflict_reconciliation.py,sha256=H_O67JPHeqByOfsDvKXg9bsN2CIYhMcJpO_xIduEDto,13662
 agentic_devtools/cli/ci/pipeline/critique_gate.py,sha256=OGaaTy_21pbPBvJSNyjTXvxWTAWYLbCSmrKARc4JYaw,3763
 agentic_devtools/cli/ci/pipeline/critique_snapshot.py,sha256=_lJyfCLqeEw9WDMV7qQsYZljgfdDhalhoGtG9Lw0Hvo,9203
 agentic_devtools/cli/ci/pipeline/deferral.py,sha256=M0WSLAJol9xLe1RuWNKiuRAw3EqU8VULDJqUSwM0HCw,19426
@@ -1288,8 +1289,8 @@ agentic_devtools/_bundled_skills/skills/speckit-plan/SKILL.md,sha256=qYLpzgLCIZ6
 agentic_devtools/_bundled_skills/skills/speckit-specify/SKILL.md,sha256=HbHRbdphMqbtNw6fL6NcYCj6sSFmUyk2S4U0bZ9p_l4,13681
 agentic_devtools/_bundled_skills/skills/write-github-commit-message/SKILL.md,sha256=Ep1lR8NDN117Iytj172VZgqazFiLpJ56Z7RXgaTnxR8,2626
 agentic_devtools/_bundled_skills/skills/write-github-commit-message/commit-types.md,sha256=bTy_t68ZD6R87rFIzq9wybTu8Wudoahb7nB9IWC4bFo,1839
-agentic_devtools-0.2.575.dist-info/METADATA,sha256=HividaPOs7GGox5SsbY7PViXXa8lQCKtzLL3wRzKuOA,35393
-agentic_devtools-0.2.575.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-agentic_devtools-0.2.575.dist-info/entry_points.txt,sha256=kL35_Y5OHI6XpPneeBTcX82ORjjfx2VIK6XfmKHgNm4,13630
-agentic_devtools-0.2.575.dist-info/licenses/LICENSE,sha256=yBEDdICksxhBYLWoERKp9MTqwGnUF6Ryj9BTLwXTc6k,1082
-agentic_devtools-0.2.575.dist-info/RECORD,,
+agentic_devtools-0.2.577.dist-info/METADATA,sha256=UDLYuI2Tr9N_i5CYmG3b1TL9uHo8cntMfnpr8BWPO1E,35393
+agentic_devtools-0.2.577.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+agentic_devtools-0.2.577.dist-info/entry_points.txt,sha256=kL35_Y5OHI6XpPneeBTcX82ORjjfx2VIK6XfmKHgNm4,13630
+agentic_devtools-0.2.577.dist-info/licenses/LICENSE,sha256=yBEDdICksxhBYLWoERKp9MTqwGnUF6Ryj9BTLwXTc6k,1082
+agentic_devtools-0.2.577.dist-info/RECORD,,