atomadic-forge 0.3.2__tar.gz → 0.3.4__tar.gz

{atomadic_forge-0.3.2 → atomadic_forge-0.3.4}/CHANGELOG.md

@@ -1,5 +1,128 @@
 # Changelog
 
+## 0.3.4 — `forge whoami` for agents and humans
+
+Adds the agent-empowerment QOL win that 0.3.3 was missing: when the
+MCP gate refuses with `subscription required`, agents (and humans)
+need a cheap way to ask **"who is the gate seeing me as, and from
+which source?"** without burning a real tool call. `forge whoami` is
+that command.
+
+### Added
+
+- **`forge whoami`** new top-level CLI verb (and `--json` for scripted
+  consumers). Returns:
+  ```json
+  {
+    "ok": true,
+    "source": "credentials_file" | "env" | "missing",
+    "key_prefix": "fk_live_b3502…",
+    "email": "tom@example.com",
+    "plan": "pro",
+    "verify_ok": true,
+    "verify_reason": "",
+    "credentials_path": "~/.atomadic-forge/credentials.toml",
+    "env_var": "FORGE_API_KEY"
+  }
+  ```
+  Resolution order matches the MCP gate exactly (env → credentials.toml).
+  `--no-verify` skips the network roundtrip for offline triage.
+- **6 new unit tests** for whoami covering missing-key, env-key,
+  credentials-file-key, env-wins-over-file, --no-verify, and
+  verify-rejection.
+
+### Why this matters for agents
+
+Before 0.3.4, an agent that hit `MCP error -32001: Forge subscription
+required` had two options: ask the human to restart the MCP, or fail.
+With 0.3.4 the agent can call `forge whoami --json` (via Bash) and
+get a structured answer it can act on:
+
+  * `source == "missing"` → tell the user to run `forge login`
+  * `source == "credentials_file"` + `verify_ok == false` → key is
+    revoked or stale; `forge login` again
+  * `source == "env"` + `verify_ok == false` → CI env var is wrong
+  * everything green → restart the MCP host (the running subprocess
+    needs a respawn to see the new env)
+
+This closes the loop for the auth experience — the agent can diagnose
+its own failure mode.
+
+### Tests
+
+902 passing, 2 skipped. `forge wire src/atomadic_forge` PASS,
+`forge certify .` holds at **100/100**.
+
+---
+
+## 0.3.3 — MCP gate reads credentials.toml + actionable error message
+
+Hot-fix release. Closes the gap where `forge login` writes a key to
+`~/.atomadic-forge/credentials.toml` but `forge mcp serve` rejects every
+tool call with `Forge subscription required` because it only checks
+`FORGE_API_KEY` env. After 0.3.3, `forge login` once is enough — every
+MCP host (Claude Code / Cursor / Aider / Devin / VS Code Copilot) picks
+the key up automatically with no shell-scoped env-var ritual.
+
+### Added
+
+- **`read_api_key_from_credentials_file(path)`** — pure a1 helper that
+  parses `~/.atomadic-forge/credentials.toml` (the file `forge login`
+  writes) and returns the `[forge_auth].api_key` value, only when it
+  has the `fk_live_` prefix. Six new unit tests cover missing file,
+  wrong prefix, missing section, malformed TOML, string-path argument,
+  and the canonical login output.
+- **MCP `_auth_check` falls back to credentials.toml** when
+  `FORGE_API_KEY` is not in env. Resolution order is documented in the
+  docstring: env first (CI / explicit override), then credentials file
+  (one-time `forge login`).
+- **Actionable auth-error message** — when neither env nor credentials
+  file yields a key, the JSON-RPC error now reads
+  `"Forge subscription key not configured. Run forge login once …"`
+  (was: `"FORGE_API_KEY not set or wrong prefix"`).
+
+### Tests
+
+896 passing, 2 skipped (was 841/2 at 0.3.2 — +6 new tests for the
+credentials.toml fallback). `forge wire src/atomadic_forge` PASS,
+`forge certify .` holds at **100/100**.
+
+---
+
+## 0.3.2 — Cyberpunk Forge Studio UI + recovery fixes
+
+841 tests passing, 2 skipped. `forge wire src/atomadic_forge` PASS,
+`forge certify .` = **100/100**.
+
+### Added
+
+- **Forge Studio cyberpunk UI reskin** — Full visual overhaul from
+  slate/blue inline-styles to the Atomadic cyber design system.
+  Tailwind v4 (`@tailwindcss/vite`), `motion` (Framer Motion v12),
+  `lucide-react`. New primitives: `NeonButton`, `ActionableCard`,
+  `ScoreGauge`, `PipelineStepper`. Collapsible sidebar with `layoutId`
+  animated active indicator, mobile bottom bar.
+- **ProjectScanDashboard** — animated stat cards, wire verdict banner,
+  motion tier bars, F-code violation list with severity colours.
+- **All panels reskinned** — ArchitectureGraph, ComplexityHeatmap,
+  DebtCounter, AgentTopologyMap, ErrorBanner all use cyber palette.
+- **`forge status` verb** — shows MCP connection status.
+
+### Fixed
+
+- **Wire scan phantom violations** — `.pytest_tmp_run/` test fixtures
+  no longer pollute wire results; `path_parts_contain_ignored_dir()`
+  now used throughout.
+- **`forge audit list` / `forge audit log`** — default to CWD
+  (`Path(".")`) instead of requiring explicit path argument.
+- **DebtCounter** — `fCodeSeverity(v.f_code)` replaces broken
+  `SEVERITY_WEIGHTS[v.severity]` (was always returning weight 1).
+- **WireViolation TypeScript interface** — aligned with actual JSON
+  schema (`f_code`, `from_tier`, `to_tier`).
+- **ArchitectureGraph** — staircase node layout instead of single column.
+- **`forge doctor`** — optional dep checks (complexipy, bandit, mypy).
+- **`commandsmith smoke`** — `--include-core` flag tests all 23 core verbs.
+
 ## 0.3.1 — Golden Path lanes B/C/D/F/G ship
 
 783 tests passing, 2 skipped. `forge wire src/atomadic_forge` PASS,

{atomadic_forge-0.3.2 → atomadic_forge-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: atomadic-forge
-Version: 0.3.2
+Version: 0.3.4
 Summary: Atomadic Forge — absorb, enforce, emerge. Polyglot (Python + JavaScript/TypeScript) architecture guardian for AI-generated code.
 Author: Atomadic
 License-Expression: BUSL-1.1
@@ -76,6 +76,8 @@ For deeper paths once you have done the 10-minute path:
 - [docs/CI_CD.md](docs/CI_CD.md) — GitHub Actions, GitLab CI, pre-commit.
 - [docs/AIR_GAPPED.md](docs/AIR_GAPPED.md) — offline / on-prem install.
 - [docs/SHOWCASE.md](docs/SHOWCASE.md) — live trajectories of real runs.
+- [docs/MARKET_POSITIONING.md](docs/MARKET_POSITIONING.md) — why Forge matters in the AI coding market.
+- [docs/RELEASE_MESSAGING.md](docs/RELEASE_MESSAGING.md) — launch copy, HN post, outreach, and demo script.
 
 ### Polyglot recon (JS/TS in a single pass)
 
@@ -135,6 +137,11 @@ AI agents produce 30–50% of new code in many teams. The output is **fast and o
 
 Forge is **not a style checker**. It's an **architecture rebuilder**. It absorbs your code (including AI-generated code), re-tiers it, enforces the 5-tier monadic law, and emits a clean, verifiable structure with certification scores.
 
+Release positioning: **AI coding agents create implementation velocity.
+Forge adds architectural gravity.** See
+[docs/MARKET_POSITIONING.md](docs/MARKET_POSITIONING.md) for the
+market frame and source-backed claims.
+
 ## The 5-tier monadic law
 
 Every source file (Python `.py`, JavaScript `.js`/`.mjs`/`.cjs`/`.jsx`, or
@@ -177,7 +184,7 @@ Each tier is a layer of **verified building blocks**. Higher tiers never invent
 
 ```bash
 pip install atomadic-forge
-forge --version   # atomadic-forge 0.3.1
+forge --version   # atomadic-forge 0.3.2
 forge doctor      # environment check
 ```
 
@@ -190,7 +197,7 @@ generate).
 ```bash
 git clone https://github.com/atomadictech/atomadic-forge && cd atomadic-forge
 pip install -e ".[dev]"
-python -m pytest               # 783 passing, 2 skipped
+python -m pytest               # 841 passing, 2 skipped
 ```
 
 ## AI Agent integration (MCP)
@@ -216,6 +223,30 @@ Forge ships a **Model Context Protocol server** — add it to Cursor, Claude Cod
 forge mcp serve --help   # full tool + resource listing with examples
 ```
 
+### Subscription required for `forge mcp serve`
+
+Every `tools/call` against the MCP server is gated behind a paid Forge
+subscription. Get a key at [https://atomadic.tech/forge](https://atomadic.tech/forge),
+then run:
+
+```bash
+forge login                          # interactive: paste your fk_live_* key
+export FORGE_API_KEY=fk_live_xxxxx   # or set the env var directly
+forge mcp serve --project .
+```
+
+Read-only handshake methods (`initialize`, `ping`, `tools/list`,
+`resources/list`) work without a key so MCP clients can complete the
+connect handshake; `tools/call` and `resources/read` require an active
+subscription. The verify endpoint at
+`https://forge-auth.atomadic.tech/v1/forge/auth/verify` is contacted
+on first call and the result is cached for 5 minutes; offline grace
+keeps you running for 24 hours after the last successful verify.
+
+Without a key (or with a revoked one), `tools/call` returns the
+JSON-RPC error code `-32001` with `message="Forge subscription
+required"` and an `upgrade_url` pointing back to the dashboard.
+
 ## Forge Studio — desktop GUI
 
 A native Tauri 2 + React desktop app that connects to your project via the MCP server:
@@ -410,7 +441,7 @@ Forge ships with named limits. No overpromise.
 | Product | What it is | Status |
 |---------|------------|--------|
 | **AAAA-Nexus** | Trust/safety/payments substrate for autonomous agents | Live at [atomadic.tech](https://atomadic.tech) |
-| **Atomadic Forge** | Absorb-and-emerge engine for developers (this repo) | **0.3.1** — on PyPI, 783 tests, MCP server, desktop GUI |
+| **Atomadic Forge** | Absorb-and-emerge engine for developers (this repo) | **0.3.2** — on PyPI, 841 tests, 100/100, MCP server, desktop GUI |
 | **Atomadic Assistant** | Sovereign AI assistant with cognitive loop on Cloudflare | In development |
 
 ## License
@@ -438,7 +469,7 @@ Apache 2.0.
 **Forge itself is monadic.** Every source file belongs to one tier. The repo is a worked example:
 
 ```bash
-python -m pytest                     # 783 passing, 2 skipped
+python -m pytest                     # 841 passing, 2 skipped
 forge doctor                         # Environment check
 forge wire src/atomadic_forge        # Scan for violations (PASS)
 forge certify . --fail-under 100     # Score and gate the repo (100/100)
@@ -456,7 +487,7 @@ forge commandsmith smoke             # Smoke-test all 36+ registered verbs
 
 **Production-ready for architecture enforcement. Working, honest, self-eating.**
 
-- ✓ **783 tests** passing (2 skipped)
+- ✓ **841 tests** passing, 2 skipped
 - ✓ **100/100 certify** — forge scores itself on every CI run
 - ✓ **0 wire violations** — forge passes its own import-law scan
 - ✓ **On PyPI** — `pip install atomadic-forge`

{atomadic_forge-0.3.2 → atomadic_forge-0.3.4}/README.md

@@ -44,6 +44,8 @@ For deeper paths once you have done the 10-minute path:
 - [docs/CI_CD.md](docs/CI_CD.md) — GitHub Actions, GitLab CI, pre-commit.
 - [docs/AIR_GAPPED.md](docs/AIR_GAPPED.md) — offline / on-prem install.
 - [docs/SHOWCASE.md](docs/SHOWCASE.md) — live trajectories of real runs.
+- [docs/MARKET_POSITIONING.md](docs/MARKET_POSITIONING.md) — why Forge matters in the AI coding market.
+- [docs/RELEASE_MESSAGING.md](docs/RELEASE_MESSAGING.md) — launch copy, HN post, outreach, and demo script.
 
 ### Polyglot recon (JS/TS in a single pass)
 
@@ -103,6 +105,11 @@ AI agents produce 30–50% of new code in many teams. The output is **fast and o
 
 Forge is **not a style checker**. It's an **architecture rebuilder**. It absorbs your code (including AI-generated code), re-tiers it, enforces the 5-tier monadic law, and emits a clean, verifiable structure with certification scores.
 
+Release positioning: **AI coding agents create implementation velocity.
+Forge adds architectural gravity.** See
+[docs/MARKET_POSITIONING.md](docs/MARKET_POSITIONING.md) for the
+market frame and source-backed claims.
+
 ## The 5-tier monadic law
 
 Every source file (Python `.py`, JavaScript `.js`/`.mjs`/`.cjs`/`.jsx`, or
@@ -145,7 +152,7 @@ Each tier is a layer of **verified building blocks**. Higher tiers never invent
 
 ```bash
 pip install atomadic-forge
-forge --version   # atomadic-forge 0.3.1
+forge --version   # atomadic-forge 0.3.2
 forge doctor      # environment check
 ```
 
@@ -158,7 +165,7 @@ generate).
 ```bash
 git clone https://github.com/atomadictech/atomadic-forge && cd atomadic-forge
 pip install -e ".[dev]"
-python -m pytest               # 783 passing, 2 skipped
+python -m pytest               # 841 passing, 2 skipped
 ```
 
 ## AI Agent integration (MCP)
@@ -184,6 +191,30 @@ Forge ships a **Model Context Protocol server** — add it to Cursor, Claude Cod
 forge mcp serve --help   # full tool + resource listing with examples
 ```
 
+### Subscription required for `forge mcp serve`
+
+Every `tools/call` against the MCP server is gated behind a paid Forge
+subscription. Get a key at [https://atomadic.tech/forge](https://atomadic.tech/forge),
+then run:
+
+```bash
+forge login                          # interactive: paste your fk_live_* key
+export FORGE_API_KEY=fk_live_xxxxx   # or set the env var directly
+forge mcp serve --project .
+```
+
+Read-only handshake methods (`initialize`, `ping`, `tools/list`,
+`resources/list`) work without a key so MCP clients can complete the
+connect handshake; `tools/call` and `resources/read` require an active
+subscription. The verify endpoint at
+`https://forge-auth.atomadic.tech/v1/forge/auth/verify` is contacted
+on first call and the result is cached for 5 minutes; offline grace
+keeps you running for 24 hours after the last successful verify.
+
+Without a key (or with a revoked one), `tools/call` returns the
+JSON-RPC error code `-32001` with `message="Forge subscription
+required"` and an `upgrade_url` pointing back to the dashboard.
+
 ## Forge Studio — desktop GUI
 
 A native Tauri 2 + React desktop app that connects to your project via the MCP server:
@@ -378,7 +409,7 @@ Forge ships with named limits. No overpromise.
 | Product | What it is | Status |
 |---------|------------|--------|
 | **AAAA-Nexus** | Trust/safety/payments substrate for autonomous agents | Live at [atomadic.tech](https://atomadic.tech) |
-| **Atomadic Forge** | Absorb-and-emerge engine for developers (this repo) | **0.3.1** — on PyPI, 783 tests, MCP server, desktop GUI |
+| **Atomadic Forge** | Absorb-and-emerge engine for developers (this repo) | **0.3.2** — on PyPI, 841 tests, 100/100, MCP server, desktop GUI |
 | **Atomadic Assistant** | Sovereign AI assistant with cognitive loop on Cloudflare | In development |
 
 ## License
@@ -406,7 +437,7 @@ Apache 2.0.
 **Forge itself is monadic.** Every source file belongs to one tier. The repo is a worked example:
 
 ```bash
-python -m pytest                     # 783 passing, 2 skipped
+python -m pytest                     # 841 passing, 2 skipped
 forge doctor                         # Environment check
 forge wire src/atomadic_forge        # Scan for violations (PASS)
 forge certify . --fail-under 100     # Score and gate the repo (100/100)
@@ -424,7 +455,7 @@ forge commandsmith smoke             # Smoke-test all 36+ registered verbs
 
 **Production-ready for architecture enforcement. Working, honest, self-eating.**
 
-- ✓ **783 tests** passing (2 skipped)
+- ✓ **841 tests** passing, 2 skipped
 - ✓ **100/100 certify** — forge scores itself on every CI run
 - ✓ **0 wire violations** — forge passes its own import-law scan
 - ✓ **On PyPI** — `pip install atomadic-forge`

atomadic_forge-0.3.4/docs/MARKET_POSITIONING.md

@@ -0,0 +1,136 @@
+# Atomadic Forge — Market Positioning
+
+Forge is the architectural substrate for AI-generated code.
+
+The release stance is simple: Forge does not compete with Copilot,
+Cursor, Claude Code, Devin, or Lovable. Those tools make code faster.
+Forge keeps that code from turning into architectural debt.
+
+## The Market Signal
+
+AI coding is now large enough that architecture failure is no longer a
+local nuisance. It is becoming a platform risk.
+
+- MarketsandMarkets forecasts the AI code assistants market growing
+  from USD 8.14B in 2025 to USD 127.05B by 2032.
+- Fortune Business Insights forecasts the AI code tools market reaching
+  USD 70.55B by 2034.
+- Grand View Research estimates the AI code assistants market at USD
+  8.5B in 2025, with continued growth through 2033.
+- Recent empirical work on agentic refactoring finds AI refactors skew
+  toward local, consistency-oriented edits, while higher-level design
+  changes remain harder.
+
+Use market-size claims carefully. They are directional proof of demand,
+not the core technical proof. The core proof is that teams can now
+generate code faster than they can review architecture.
+
+## The Gap
+
+Current tools cluster into three groups:
+
+| Category | What they do well | What they miss |
+|---|---|---|
+| AI coding agents | Generate and modify code quickly | No deterministic architectural law |
+| Linters / analyzers | Detect local quality and style issues | Do not restructure the repo |
+| Refactoring engines | Apply known transformations safely | Reactive; no opinionated target architecture |
+
+Forge fills the missing layer: an architecture compiler that can absorb
+messy or AI-generated code, enforce a 5-tier import law, and certify the
+result.
+
+## Competitive Frame
+
+Forge should be described as a complement, not an alternative.
+
+- **Copilot/Cursor/Claude Code/Devin**: write code.
+- **Semgrep/Ruff/ESLint/ArchUnit**: catch local violations.
+- **OpenRewrite/Moderne**: modernize known patterns.
+- **Forge**: rebuilds and certifies architectural shape.
+
+The strongest one-line frame:
+
+> AI coding agents create implementation velocity. Forge adds
+> architectural gravity.
+
+## Unique Value Proposition
+
+Forge is differentiated by the combination of:
+
+- **Absorb** — classify Python, JavaScript, and TypeScript repos into
+  a 5-tier monadic layout.
+- **Enforce** — block upward-import violations across languages.
+- **Emerge** — surface composable capabilities and agent action cards.
+- **Certify** — emit an honest 0-100 architecture score with receipts,
+  lineage, policy, SBOM, and CI-friendly gates.
+- **Agent-native operation** — CLI, MCP tools, recipes, preflight,
+  score-patch, test selection, and context packs.
+
+Individually, pieces of this exist elsewhere. The full loop does not.
+
+## Best Audience
+
+Initial release should target builders already feeling the pain:
+
+- AI-native product teams using Cursor, Claude Code, Codex, Devin, or
+  Aider daily.
+- Founders building quickly with AI agents and worried about code rot.
+- Platform / DevEx engineers who need CI gates for AI-heavy repos.
+- Regulated teams that need receipts, lineage, auditability, and
+  explainable architecture constraints.
+- Agent developers who need a "copilot's copilot" for repo context,
+  preflight, and deployment safety.
+
+## Messaging Pillars
+
+1. **AI made code cheap. Architecture is now the scarce resource.**
+2. **Forge is not a linter. It is an architecture substrate.**
+3. **The 5-tier law turns repo shape into something agents can obey.**
+4. **Receipts make every architectural decision auditable.**
+5. **MCP makes Forge usable by any capable coding agent.**
+
+## Claims To Make
+
+Use these confidently:
+
+- "Polyglot architecture guardian for Python, JavaScript, and
+  TypeScript."
+- "Enforces upward-only imports across a 5-tier monadic layout."
+- "Complements AI coding agents by governing the code they generate."
+- "Designed for CI, MCP, and agentic development workflows."
+- "Forge itself self-certifies at 100/100."
+
+## Claims To Avoid
+
+Avoid these unless backed by a fresh benchmark in the repo:
+
+- "Only tool in the world."
+- "Prevents all technical debt."
+- "Guarantees maintainability."
+- "Beats Copilot/Cursor/Devin."
+- "Production-ready for every enterprise codebase."
+
+The honest claim is better: Forge makes architectural drift visible,
+repairable, and enforceable at agent speed.
+
+## Release Position
+
+Atomadic Forge v0.3.2 should launch as:
+
+> The architecture compiler for AI-generated code.
+
+Supporting line:
+
+> Use any coding agent you want. Run Forge before the codebase forgets
+> its shape.
+
+## Sources
+
+- MarketsandMarkets, "AI Code Assistants Market worth $127.05 billion
+  by 2032": https://www.marketsandmarkets.com/PressReleases/ai-code-assistants.asp
+- Fortune Business Insights, "AI Code Tools Market Size, Share, Trends,
+  2034": https://www.fortunebusinessinsights.com/ai-code-tools-market-111725
+- Grand View Research, "AI Code Assistants Market Size, Share &
+  Trends": https://www.grandviewresearch.com/industry-analysis/ai-code-assistants-market-report
+- Li et al., "Agentic Refactoring: An Empirical Study of AI Coding
+  Agents": https://arxiv.org/abs/2511.04824

{atomadic_forge-0.3.2 → atomadic_forge-0.3.4}/docs/README.md

@@ -52,6 +52,22 @@ Shippability gates for local development, demos, and release candidates:
 - Local Ollama low-load and idle-machine profiles
 - Documentation and release-note review points
 
+### [Market Positioning](MARKET_POSITIONING.md)
+Release narrative and gap analysis:
+- AI coding market signal
+- Competitive frame
+- Claims to make and claims to avoid
+- Source-backed positioning for launch copy
+
+### [Release Messaging](RELEASE_MESSAGING.md)
+Copy blocks for launch:
+- One-liners and product descriptions
+- HN post draft
+- X thread
+- LinkedIn launch post
+- Developer / journalist outreach templates
+- Demo script
+
 ## ❓ FAQ & Troubleshooting
 
 **[FAQ](05-faq.md)** — Common questions:
@@ -85,6 +101,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md) for:
 - **GitHub:** https://github.com/atomadictech/atomadic-forge
 - **License:** [BSL-1.1](../LICENSE) (free for non-production, commercial license for production, converts to Apache 2.0 in 2030)
 - **Status:** Experimental, working, honest (0.2.2)
+- **Launch positioning:** [Market Positioning](MARKET_POSITIONING.md) and [Release Messaging](RELEASE_MESSAGING.md)
 
 ## 📊 Versions