chp-adapter-conformance 0.8.0__tar.gz

chp_adapter_conformance-0.8.0/.gitignore

@@ -0,0 +1,23 @@
+node_modules/
+dist/
+.yalc/
+yalc.lock
+*.tgz
+.env
+.env.*
+coverage/
+dashboard/
+components/
+.tech-hub-cache/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.chp/
+.DS_Store
+.coverage
+.forge/
+.hypothesis/
+.claude/
+
+# chp-agent evidence store
+.chp-agent/sessions.sqlite

chp_adapter_conformance-0.8.0/PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: chp-adapter-conformance
+Version: 0.8.0
+Summary: CHP capability adapter — static and runtime violation checker for capability implementations
+Author: Auxo
+License: Apache-2.0
+Keywords: adapter,capability-host-protocol,chp,conformance,linting
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.10
+Requires-Dist: chp-core>=0.7.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == 'dev'

chp_adapter_conformance-0.8.0/chp_adapter_conformance/__init__.py

@@ -0,0 +1,11 @@
+from .adapter import ConformanceAdapter
+from .checker import Violation, check_commit_message, check_registered_adapter, check_source_file, score
+
+__all__ = [
+    "ConformanceAdapter",
+    "Violation",
+    "check_source_file",
+    "check_registered_adapter",
+    "check_commit_message",
+    "score",
+]

chp_adapter_conformance-0.8.0/chp_adapter_conformance/adapter.py

@@ -0,0 +1,600 @@
+"""ConformanceAdapter — governed capability violation checker."""
+
+from __future__ import annotations
+
+import inspect
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from chp_core import BaseAdapter, capability
+
+from .checker import (
+    check_commit_message,
+    check_registered_adapter,
+    check_source_file,
+    score,
+)
+
+_SESSION_FILE = Path.home() / ".chp" / "active-session.json"
+
+# The sole adapter sanctioned to import an HTTP client directly: it IS the
+# governed transport. Every other adapter must compose through it
+# (ctx.ainvoke("chp.adapters.http.request", ...)).
+_HTTP_TRANSPORT_ADAPTER = "chp.adapters.http"
+
+# chp_core and chp_host are below/beside the adapter layer and cannot depend on
+# chp-adapter-http without creating a circular dependency.
+_CORE_PKG_SEGMENT = "chp_core"
+_HOST_PKG_SEGMENT = "chp_host"
+
+
+def _is_test_file(path: Path) -> bool:
+    """Test modules legitimately import httpx (MockTransport) etc.; they are not
+    capability code and are exempt from the I/O-isolation rules."""
+    return "tests" in path.parts or path.name.startswith("test_")
+
+
+def _is_core_file(path: Path) -> bool:
+    """chp_core and chp_host files are below/beside the adapter layer; they
+    cannot compose through chp-adapter-http without creating a circular
+    dependency."""
+    return _CORE_PKG_SEGMENT in path.parts or _HOST_PKG_SEGMENT in path.parts
+
+
+def _source_of_handler(handler: Any) -> str | None:
+    """Follow closure vars to find the adapter source file (handlers are wrappers in chp-core)."""
+    if hasattr(handler, "__closure__") and handler.__closure__:
+        for cell in handler.__closure__:
+            try:
+                cv = cell.cell_contents
+                if callable(cv):
+                    return inspect.getfile(cv)
+            except (ValueError, TypeError):
+                pass
+    try:
+        return inspect.getfile(handler)
+    except (TypeError, OSError):
+        return None
+
+
+class ConformanceAdapter(BaseAdapter):
+    """Static and runtime capability conformance checking."""
+
+    adapter_id = "chp.adapters.conformance"
+    adapter_name = "Conformance"
+    adapter_description = "Check capability implementations for CHP spec violations (raw I/O, missing schema, issue policy)."
+    adapter_category = "core"
+    adapter_tags = ["conformance", "linting", "policy", "quality"]
+
+    def __init__(self) -> None:
+        self._host: Any = None
+
+    def on_register(self, host: Any) -> None:
+        self._host = host
+
+    @capability(
+        id="chp.adapters.conformance.check_source",
+        version="1.0.0",
+        description="Run static AST analysis on an adapter source file and report violations.",
+        category="core",
+        risk="low",
+        input_schema={
+            "type": "object",
+            "properties": {
+                "source_path": {"type": "string", "description": "Absolute path to a Python adapter source file"},
+            },
+            "required": ["source_path"],
+            "additionalProperties": False,
+        },
+    )
+    async def check_source(self, ctx: Any, payload: dict) -> dict:
+        path = Path(payload["source_path"]).expanduser()
+        violations = check_source_file(path)
+        conformance_score = score(violations)
+        ctx.emit("source_checked", {
+            "source_path": str(path),
+            "violation_count": len(violations),
+            "error_count": sum(1 for v in violations if v.severity == "error"),
+            "warning_count": sum(1 for v in violations if v.severity == "warning"),
+            "score": conformance_score,
+        }, redacted=False)
+        return {
+            "source_path": str(path),
+            "violations": [v.to_dict() for v in violations],
+            "violation_count": len(violations),
+            "score": conformance_score,
+        }
+
+    @capability(
+        id="chp.adapters.conformance.check_adapter",
+        version="1.0.0",
+        description="Runtime introspection of a loaded adapter — checks schema, version, and metadata completeness.",
+        category="core",
+        risk="low",
+        input_schema={
+            "type": "object",
+            "properties": {
+                "adapter_id": {"type": "string", "description": "Adapter ID prefix, e.g. chp.adapters.messages"},
+            },
+            "required": ["adapter_id"],
+            "additionalProperties": False,
+        },
+    )
+    async def check_adapter(self, ctx: Any, payload: dict) -> dict:
+        if self._host is None:
+            raise RuntimeError("ConformanceAdapter must be registered with a host")
+
+        adapter_id = payload["adapter_id"]
+
+        # Find source files from registered capability handlers
+        src_files: set[str] = set()
+        for cap_key, reg_cap in self._host._capabilities.items():
+            if not cap_key.startswith(adapter_id):
+                continue
+            src = _source_of_handler(reg_cap.handler)
+            if src:
+                src_files.add(src)
+
+        if not src_files:
+            raise KeyError(f"No capabilities found for adapter_id prefix={adapter_id!r}")
+
+        violations: list = []
+        for src in src_files:
+            violations.extend(check_source_file(src))
+
+        conformance_score = score(violations)
+        ctx.emit("adapter_checked", {
+            "adapter_id": adapter_id,
+            "violation_count": len(violations),
+            "score": conformance_score,
+        }, redacted=False)
+        return {
+            "adapter_id": adapter_id,
+            "violations": [v.to_dict() for v in violations],
+            "violation_count": len(violations),
+            "score": conformance_score,
+        }
+
+    @capability(
+        id="chp.adapters.conformance.check_all",
+        version="1.0.0",
+        description="Check all loaded adapters for violations and return a ranked summary.",
+        category="core",
+        risk="low",
+        input_schema={
+            "type": "object",
+            "properties": {},
+            "additionalProperties": False,
+        },
+    )
+    async def check_all(self, ctx: Any, payload: dict) -> dict:
+        if self._host is None:
+            raise RuntimeError("ConformanceAdapter must be registered with a host")
+
+        # Group capabilities by their source file (follow closure to original method)
+        src_to_prefix: dict[str, str] = {}
+        for cap_key, reg_cap in self._host._capabilities.items():
+            src = _source_of_handler(reg_cap.handler)
+            if src:
+                prefix = ".".join(cap_key.split(".")[:3])
+                src_to_prefix.setdefault(src, prefix)
+
+        results = []
+        for src_file, adapter_id in src_to_prefix.items():
+            violations = check_source_file(src_file)
+            conformance_score = score(violations)
+            results.append({
+                "adapter_id": adapter_id,
+                "violation_count": len(violations),
+                "score": conformance_score,
+                "violations": [v.to_dict() for v in violations],
+            })
+
+        results.sort(key=lambda r: r["score"])
+        total = sum(r["violation_count"] for r in results)
+        worst = [r["adapter_id"] for r in results if r["score"] < 80]
+
+        ctx.emit("all_checked", {
+            "adapter_count": len(results),
+            "total_violations": total,
+            "worst_adapters": worst,
+        }, redacted=False)
+        return {
+            "adapters": results,
+            "adapter_count": len(results),
+            "total_violations": total,
+            "worst_adapters": worst,
+        }
+
+    @capability(
+        id="chp.adapters.conformance.policy_check",
+        version="1.0.0",
+        description="Check a commit message for the Radicle issue reference policy (rad:XXXXXXX).",
+        category="core",
+        risk="low",
+        input_schema={
+            "type": "object",
+            "properties": {
+                "commit_message": {"type": "string"},
+            },
+            "required": ["commit_message"],
+            "additionalProperties": False,
+        },
+    )
+    async def policy_check(self, ctx: Any, payload: dict) -> dict:
+        msg = payload["commit_message"]
+        violations = check_commit_message(msg)
+        passes = len(violations) == 0
+        ctx.emit("policy_checked", {
+            "passes": passes,
+            "violation_count": len(violations),
+        }, redacted=False)
+        return {
+            "passes": passes,
+            "violations": [v.to_dict() for v in violations],
+        }
+
+    # ------------------------------------------------------------------
+    # Internal helpers
+    # ------------------------------------------------------------------
+
+    async def _run_baseline(self, ctx: Any) -> dict:
+        """Conformance scan via ctx.ainvoke(check_source) — each check is a governed evidence event."""
+        src_to_prefix: dict[str, str] = {}
+        for cap_key, reg_cap in self._host._capabilities.items():
+            src = _source_of_handler(reg_cap.handler)
+            if src:
+                prefix = ".".join(cap_key.split(".")[:3])
+                src_to_prefix.setdefault(src, prefix)
+
+        results = []
+        for src_file, adapter_id in src_to_prefix.items():
+            result = await ctx.ainvoke(
+                "chp.adapters.conformance.check_source",
+                {"source_path": src_file},
+            )
+            if result.success:
+                data = result.data
+                results.append({
+                    "adapter_id": adapter_id,
+                    "violation_count": data["violation_count"],
+                    "score": data["score"],
+                    "violations": data["violations"],
+                })
+            else:
+                # Fallback: direct call so a broken check_source doesn't block baseline
+                violations = check_source_file(src_file)
+                conformance_score = score(violations)
+                results.append({
+                    "adapter_id": adapter_id,
+                    "violation_count": len(violations),
+                    "score": conformance_score,
+                    "violations": [v.to_dict() for v in violations],
+                })
+
+        results.sort(key=lambda r: r["score"])
+        total = sum(r["violation_count"] for r in results)
+        return {"adapters": results, "adapter_count": len(results), "total_violations": total}
+
+    # ------------------------------------------------------------------
+    # Dev session management
+    # ------------------------------------------------------------------
+
+    @capability(
+        id="chp.adapters.conformance.open_dev_session",
+        version="1.0.0",
+        description="Open a tracked dev session: validate Radicle issue, snapshot baseline conformance, create plan, write active-session state.",
+        category="core",
+        risk="medium",
+        input_schema={
+            "type": "object",
+            "properties": {
+                "issue_id": {"type": "string", "description": "Radicle issue short-hash (7+ chars)"},
+                "description": {"type": "string", "description": "Optional work description"},
+            },
+            "required": ["issue_id"],
+            "additionalProperties": False,
+        },
+    )
+    async def open_dev_session(self, ctx: Any, payload: dict) -> dict:
+        if self._host is None:
+            raise RuntimeError("ConformanceAdapter must be registered with a host")
+
+        issue_id = payload["issue_id"]
+
+        # 1. Validate issue exists and is open
+        issue_result = await ctx.ainvoke(
+            "chp.adapters.radicle.issue_show",
+            {"issue_id": issue_id},
+        )
+        if not issue_result.success:
+            raise ValueError(f"Issue {issue_id} not found: {issue_result.error}")
+        issue_data = issue_result.data
+        issue_title = issue_data.get("title", issue_id)
+        issue_state = str(issue_data.get("state", "open"))
+        if issue_state not in {"open", ""}:
+            raise ValueError(f"Issue {issue_id} is not open (state: {issue_state})")
+
+        # 2. Snapshot baseline conformance (governed — each file check appears in evidence)
+        baseline = await self._run_baseline(ctx)
+
+        # 3. Create a planning adapter plan tied to this session
+        plan_result = await ctx.ainvoke(
+            "chp.adapters.planning.create_plan",
+            {
+                "intent": f"Resolve rad:{issue_id[:7]} — {issue_title}",
+                "steps": [
+                    {"step_id": "baseline", "description": "Review violation baseline"},
+                    {"step_id": "implement", "description": "Implement fix"},
+                    {"step_id": "verify", "description": "Run check_staged — no new violations"},
+                    {"step_id": "close", "description": "Close dev session"},
+                ],
+            },
+        )
+        plan_id = plan_result.data.get("plan_id") if plan_result.success else None
+
+        # 4. Write session state (sanctioned local state — ~/.chp/ is CHP's own state dir)
+        _SESSION_FILE.parent.mkdir(parents=True, exist_ok=True)
+        session_data = {
+            "issue_id": issue_id,
+            "issue_title": issue_title,
+            "started_at": datetime.now(timezone.utc).isoformat(),
+            "baseline": baseline,
+            "plan_id": plan_id,
+            "session_correlation_id": ctx.correlation_id,
+        }
+        _SESSION_FILE.write_text(json.dumps(session_data, indent=2))
+
+        baseline_total = baseline["total_violations"]
+        ctx.emit("dev_session_opened", {
+            "issue_id": issue_id,
+            "issue_title": issue_title,
+            "baseline_total_violations": baseline_total,
+            "baseline_adapter_count": baseline["adapter_count"],
+            "plan_id": plan_id,
+        }, redacted=False)
+        return {
+            "issue_id": issue_id,
+            "issue_title": issue_title,
+            "baseline_total_violations": baseline_total,
+            "session_file": str(_SESSION_FILE),
+            "plan_id": plan_id,
+        }
+
+    @capability(
+        id="chp.adapters.conformance.check_staged",
+        version="1.0.0",
+        description="Check staged Python files against the active dev session baseline. Returns new violations only — existing baseline violations are not re-flagged.",
+        category="core",
+        risk="low",
+        input_schema={
+            "type": "object",
+            "properties": {
+                "staged_files": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Absolute paths to staged .py files (from git diff --staged --name-only)",
+                },
+            },
+            "required": ["staged_files"],
+            "additionalProperties": False,
+        },
+    )
+    async def check_staged(self, ctx: Any, payload: dict) -> dict:
+        if self._host is None:
+            raise RuntimeError("ConformanceAdapter must be registered with a host")
+
+        staged_files = payload.get("staged_files", [])
+
+        if not _SESSION_FILE.exists():
+            raise RuntimeError("No active dev session. Run open_dev_session first.")
+
+        session_data = json.loads(_SESSION_FILE.read_text())
+        baseline_adapters = session_data.get("baseline", {}).get("adapters", [])
+
+        # Build reverse map: source_file → baseline rule set
+        baseline_rules_by_adapter: dict[str, set[str]] = {
+            a["adapter_id"]: {v["rule"] for v in a.get("violations", [])}
+            for a in baseline_adapters
+        }
+
+        # Build map: source_file → adapter_id from currently loaded capabilities,
+        # plus directory → adapter_id so sibling isolation modules (_client.py,
+        # _backends.py) are attributed to their adapter (closes the blind spot
+        # where imported non-capability files were never checked).
+        file_to_adapter: dict[str, str] = {}
+        dir_to_adapter: dict[str, str] = {}
+        for cap_key, reg_cap in self._host._capabilities.items():
+            src = _source_of_handler(reg_cap.handler)
+            if src:
+                adapter_id = ".".join(cap_key.split(".")[:3])
+                resolved_src = str(Path(src).resolve())
+                file_to_adapter.setdefault(resolved_src, adapter_id)
+                dir_to_adapter.setdefault(str(Path(resolved_src).parent), adapter_id)
+
+        new_violations: list[dict] = []
+        files_checked: list[str] = []
+
+        for file_path in staged_files:
+            path = Path(file_path)
+            if not path.exists() or path.suffix != ".py":
+                continue
+            if _is_test_file(path):
+                continue  # tests may use httpx.MockTransport etc.
+            if _is_core_file(path):
+                continue  # chp_core is below the adapter layer; cannot depend on adapters
+
+            violations = check_source_file(path)
+            files_checked.append(str(path))
+
+            resolved = str(path.resolve())
+            # Capability file → its adapter; otherwise a sibling module in the
+            # same package directory → that adapter.
+            adapter_id = file_to_adapter.get(resolved) or dir_to_adapter.get(str(Path(resolved).parent))
+            baseline_rules = baseline_rules_by_adapter.get(adapter_id, set()) if adapter_id else set()
+
+            for v in violations:
+                # chp.adapters.http is the sanctioned transport — it alone may
+                # import an HTTP client.
+                if v.rule == "raw_http" and adapter_id == _HTTP_TRANSPORT_ADAPTER:
+                    continue
+                if v.rule not in baseline_rules:
+                    new_violations.append({**v.to_dict(), "file": str(path)})
+
+        ok = len(new_violations) == 0
+        ctx.emit("staged_checked", {
+            "files_checked": len(files_checked),
+            "new_violation_count": len(new_violations),
+            "ok": ok,
+        }, redacted=False)
+        return {
+            "ok": ok,
+            "new_violations": new_violations,
+            "files_checked": files_checked,
+        }
+
+    @capability(
+        id="chp.adapters.conformance.close_dev_session",
+        version="1.0.0",
+        description="Close the active dev session: run final conformance scan, compare vs baseline, delete session state.",
+        category="core",
+        risk="low",
+        input_schema={
+            "type": "object",
+            "properties": {
+                "outcome": {
+                    "type": "string",
+                    "enum": ["success", "abandoned"],
+                    "description": "Whether the work was completed or abandoned",
+                },
+            },
+            "additionalProperties": False,
+        },
+    )
+    async def close_dev_session(self, ctx: Any, payload: dict) -> dict:
+        if self._host is None:
+            raise RuntimeError("ConformanceAdapter must be registered with a host")
+
+        if not _SESSION_FILE.exists():
+            raise RuntimeError("No active dev session to close")
+
+        session_data = json.loads(_SESSION_FILE.read_text())
+        issue_id = session_data["issue_id"]
+        started_at = session_data.get("started_at", "")
+        baseline_total = session_data.get("baseline", {}).get("total_violations", 0)
+        outcome = payload.get("outcome", "success")
+
+        duration_s: int | None = None
+        if started_at:
+            try:
+                start = datetime.fromisoformat(started_at)
+                duration_s = int((datetime.now(timezone.utc) - start).total_seconds())
+            except ValueError:
+                duration_s = None  # malformed started_at — skip duration
+
+        final = await self._run_baseline(ctx)
+        violations_resolved = max(0, baseline_total - final["total_violations"])
+
+        # Delete session state (sanctioned local state)
+        _SESSION_FILE.unlink()
+
+        ctx.emit("dev_session_closed", {
+            "issue_id": issue_id,
+            "outcome": outcome,
+            "duration_s": duration_s,
+            "violations_resolved": violations_resolved,
+            "violations_remaining": final["total_violations"],
+        }, redacted=False)
+        return {
+            "issue_id": issue_id,
+            "outcome": outcome,
+            "duration_s": duration_s,
+            "violations_resolved": violations_resolved,
+            "violations_remaining": final["total_violations"],
+            "final_adapter_count": final["adapter_count"],
+        }
+
+    @capability(
+        id="chp.adapters.conformance.report_violations",
+        version="1.0.0",
+        description="Auto-open Radicle issues for adapters with conformance violations. Deduplicates against existing open issues.",
+        category="core",
+        risk="medium",
+        input_schema={
+            "type": "object",
+            "properties": {
+                "dry_run": {
+                    "type": "boolean",
+                    "description": "If true, report what would be opened without actually opening issues",
+                    "default": False,
+                },
+            },
+            "additionalProperties": False,
+        },
+    )
+    async def report_violations(self, ctx: Any, payload: dict) -> dict:
+        if self._host is None:
+            raise RuntimeError("ConformanceAdapter must be registered with a host")
+
+        dry_run = payload.get("dry_run", False)
+
+        all_results = await self._run_baseline(ctx)
+        adapters_with_violations = [r for r in all_results["adapters"] if r["violation_count"] > 0]
+
+        # Fetch existing open issues to deduplicate
+        existing_titles: set[str] = set()
+        if not dry_run:
+            issues_result = await ctx.ainvoke(
+                "chp.adapters.radicle.issue_list",
+                {"state": "open"},
+            )
+            if issues_result.success:
+                for issue in issues_result.data.get("issues", []):
+                    existing_titles.add(issue.get("title", ""))
+
+        issues_opened: list[dict] = []
+        issues_existing: list[str] = []
+
+        for adapter_result in adapters_with_violations:
+            adapter_id = adapter_result["adapter_id"]
+            title = f"fix: conformance violations in {adapter_id}"
+
+            if any(adapter_id in t for t in existing_titles):
+                issues_existing.append(adapter_id)
+                continue
+
+            violation_lines = "\n".join(
+                f"- [{v['severity'].upper()}] {v['rule']}: {v['message']} ({v['location']})"
+                for v in adapter_result["violations"]
+            )
+            body = (
+                f"Score: {adapter_result['score']}/100  "
+                f"Violations: {adapter_result['violation_count']}\n\n"
+                f"{violation_lines}"
+            )
+
+            if not dry_run:
+                open_result = await ctx.ainvoke(
+                    "chp.adapters.radicle.issue_open",
+                    {"title": title, "body": body, "labels": ["conformance", "p2"]},
+                )
+                opened_id = open_result.data.get("issue_id", "") if open_result.success else ""
+                issues_opened.append({"adapter_id": adapter_id, "issue_id": opened_id})
+            else:
+                issues_opened.append({"adapter_id": adapter_id, "title": title, "dry_run": True})
+
+        ctx.emit("violations_reported", {
+            "adapters_with_violations": len(adapters_with_violations),
+            "issues_opened": len(issues_opened),
+            "issues_existing": len(issues_existing),
+            "dry_run": dry_run,
+        }, redacted=False)
+        return {
+            "issues_opened": issues_opened,
+            "issues_existing": issues_existing,
+            "adapters_checked": all_results["adapter_count"],
+            "total_violations": all_results["total_violations"],
+            "dry_run": dry_run,
+        }

chp_adapter_conformance-0.8.0/chp_adapter_conformance/checker.py

@@ -0,0 +1,276 @@
+"""Static (AST) and runtime capability violation checker."""
+
+from __future__ import annotations
+
+import ast
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+
+
+# ---------------------------------------------------------------------------
+# Violation model
+# ---------------------------------------------------------------------------
+
+@dataclass
+class Violation:
+    rule: str          # e.g. "raw_io", "missing_emit", "issue_policy"
+    severity: str      # "error" | "warning"
+    message: str
+    location: str = ""  # "line N" or "capability_id"
+
+    def to_dict(self) -> dict:
+        return {
+            "rule": self.rule,
+            "severity": self.severity,
+            "message": self.message,
+            "location": self.location,
+        }
+
+
+# ---------------------------------------------------------------------------
+# Static checker (AST)
+# ---------------------------------------------------------------------------
+
+_RAW_IO_CALLS = {"open", "read", "write"}
+# Top-level packages that are forbidden HTTP transports.
+# urllib.parse is NOT included — it is URL string manipulation, not a transport.
+_FORBIDDEN_TOP = {"httpx", "requests", "aiohttp"}
+# Specific urllib sub-packages that ARE HTTP transports.
+_FORBIDDEN_URLLIB = {"urllib.request", "urllib.error", "urllib.response"}
+_ISSUE_RE = re.compile(r"rad:[0-9a-f]{7,40}")
+_MERGE_RE = re.compile(r"^Merge ")
+_REVERT_RE = re.compile(r"^Revert ")
+
+
+class _CapabilityVisitor(ast.NodeVisitor):
+    """Walk a capability method body and collect violations."""
+
+    def __init__(self, method_name: str) -> None:
+        self.method_name = method_name
+        self.violations: list[Violation] = []
+        self._has_emit = False
+        self._in_capability = False
+
+    def _loc(self, node: ast.AST) -> str:
+        return f"line {node.lineno}" if hasattr(node, "lineno") else ""
+
+    def visit_Call(self, node: ast.Call) -> None:
+        # open() / read() / write() direct calls
+        if isinstance(node.func, ast.Name) and node.func.id in _RAW_IO_CALLS:
+            self.violations.append(Violation(
+                rule="raw_io",
+                severity="error",
+                message=f"Direct `{node.func.id}()` call — use filesystem adapter instead",
+                location=self._loc(node),
+            ))
+
+        # ctx.emit() — mark as found
+        if (
+            isinstance(node.func, ast.Attribute)
+            and node.func.attr == "emit"
+            and isinstance(node.func.value, ast.Name)
+            and node.func.value.id == "ctx"
+        ):
+            self._has_emit = True
+
+        # self._helper(ctx, ...) — private helper delegation counts as an emit
+        # (helpers receive ctx and are responsible for emitting on behalf of the capability)
+        if (
+            isinstance(node.func, ast.Attribute)
+            and isinstance(node.func.value, ast.Name)
+            and node.func.value.id == "self"
+            and node.func.attr.startswith("_")
+        ):
+            for arg in node.args:
+                if isinstance(arg, ast.Name) and arg.id == "ctx":
+                    self._has_emit = True
+                    break
+
+        # ctx.host.<anything except sanctioned> direct access
+        if (
+            isinstance(node.func, ast.Attribute)
+            and isinstance(node.func.value, ast.Attribute)
+            and node.func.value.attr == "host"
+            and isinstance(node.func.value.value, ast.Name)
+            and node.func.value.value.id == "ctx"
+        ):
+            method = node.func.attr
+            if method not in {"record_turn"}:
+                self.violations.append(Violation(
+                    rule="direct_host_call",
+                    severity="warning",
+                    message=f"ctx.host.{method}() bypasses invocation chain — use ctx.invoke() instead",
+                    location=self._loc(node),
+                ))
+        # No generic_visit: outer ast.walk already visits children
+
+    def visit_ExceptHandler(self, node: ast.ExceptHandler) -> None:
+        # Detect bare `except: pass` or `except Exception: pass`
+        if node.body and all(isinstance(s, ast.Pass) for s in node.body):
+            self.violations.append(Violation(
+                rule="silent_error",
+                severity="warning",
+                message="Silent exception handler (except: pass) swallows errors",
+                location=self._loc(node),
+            ))
+
+    def generic_visit(self, node: ast.AST) -> None:
+        # Suppress default recursion: outer ast.walk handles all traversal.
+        # Without this, nodes lacking a specific visit_* method recurse into
+        # children via the default generic_visit, causing N+1 visits per node.
+        pass
+
+
+def check_source_file(path: str | Path) -> list[Violation]:
+    """Parse a Python source file and return capability violations."""
+    source = Path(path).read_text()
+    try:
+        tree = ast.parse(source, filename=str(path))
+    except SyntaxError as exc:
+        return [Violation(rule="parse_error", severity="error", message=str(exc))]
+
+    violations: list[Violation] = []
+
+    # File-level: check all imports regardless of context
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                top = alias.name.split(".")[0]
+                full = alias.name
+                if top in _FORBIDDEN_TOP or full in _FORBIDDEN_URLLIB:
+                    violations.append(Violation(
+                        rule="raw_http",
+                        severity="error",
+                        message=f"Direct import of `{alias.name}` — use http/transport adapter instead",
+                        location=f"line {node.lineno}",
+                    ))
+        elif isinstance(node, ast.ImportFrom):
+            module = node.module or ""
+            top = module.split(".")[0]
+            if top in _FORBIDDEN_TOP or module in _FORBIDDEN_URLLIB:
+                violations.append(Violation(
+                    rule="raw_http",
+                    severity="error",
+                    message=f"Direct import from `{module}` — use http/transport adapter instead",
+                    location=f"line {node.lineno}",
+                ))
+
+    # Capability-level: check each @capability-decorated method
+    for node in ast.walk(tree):
+        if not isinstance(node, (ast.AsyncFunctionDef, ast.FunctionDef)):
+            continue
+        decorators = [
+            (d.func.id if isinstance(d, ast.Call) and isinstance(d.func, ast.Name) else
+             d.id if isinstance(d, ast.Name) else "")
+            for d in node.decorator_list
+        ]
+        if "capability" not in decorators:
+            continue
+
+        visitor = _CapabilityVisitor(node.name)
+        for child in ast.walk(node):
+            visitor.visit(child)
+
+        if not visitor._has_emit:
+            violations.append(Violation(
+                rule="missing_emit",
+                severity="error",
+                message=f"Capability `{node.name}` never calls ctx.emit() — evidence chain incomplete",
+                location=f"line {node.lineno}",
+            ))
+
+        violations.extend(visitor.violations)
+
+    return violations
+
+
+# ---------------------------------------------------------------------------
+# Runtime checker (introspection)
+# ---------------------------------------------------------------------------
+
+def check_registered_adapter(adapter: object) -> list[Violation]:
+    """Inspect a registered adapter instance for schema violations."""
+    violations: list[Violation] = []
+
+    if not getattr(adapter, "adapter_id", None):
+        violations.append(Violation(
+            rule="missing_adapter_id",
+            severity="error",
+            message=f"{type(adapter).__name__} has no adapter_id",
+        ))
+
+    if not getattr(adapter, "adapter_category", None):
+        violations.append(Violation(
+            rule="missing_category",
+            severity="warning",
+            message=f"{type(adapter).__name__} has no adapter_category",
+        ))
+
+    # Walk registered capabilities from the class
+    for attr_name in dir(type(adapter)):
+        method = getattr(type(adapter), attr_name, None)
+        if method is None:
+            continue
+        cap_meta = getattr(method, "_chp_capability", None)
+        if cap_meta is None:
+            continue
+        cap_id = getattr(cap_meta, "id", attr_name)
+
+        if not getattr(cap_meta, "input_schema", None):
+            violations.append(Violation(
+                rule="missing_schema",
+                severity="error",
+                message="No input_schema defined",
+                location=cap_id,
+            ))
+        else:
+            schema = cap_meta.input_schema
+            if not isinstance(schema, dict) or schema.get("type") != "object":
+                violations.append(Violation(
+                    rule="invalid_schema",
+                    severity="warning",
+                    message="input_schema should be an object schema",
+                    location=cap_id,
+                ))
+
+        if not getattr(cap_meta, "version", None):
+            violations.append(Violation(
+                rule="missing_version",
+                severity="warning",
+                message="No version declared on capability",
+                location=cap_id,
+            ))
+
+    return violations
+
+
+# ---------------------------------------------------------------------------
+# Issue policy check
+# ---------------------------------------------------------------------------
+
+def check_commit_message(msg: str) -> list[Violation]:
+    clean = "\n".join(l for l in msg.splitlines() if not l.startswith("#"))
+    if _ISSUE_RE.search(clean):
+        return []
+    if _MERGE_RE.match(clean.strip()):
+        return []
+    if _REVERT_RE.match(clean.strip()):
+        return []
+    return [Violation(
+        rule="issue_policy",
+        severity="error",
+        message="Commit message missing Radicle issue reference (rad:XXXXXXX)",
+    )]
+
+
+# ---------------------------------------------------------------------------
+# Score
+# ---------------------------------------------------------------------------
+
+def score(violations: list[Violation]) -> int:
+    """0–100 conformance score. 100 = no violations."""
+    errors = sum(1 for v in violations if v.severity == "error")
+    warnings = sum(1 for v in violations if v.severity == "warning")
+    deductions = errors * 15 + warnings * 5
+    return max(0, 100 - deductions)

chp_adapter_conformance-0.8.0/pyproject.toml

@@ -0,0 +1,35 @@
+[build-system]
+requires = ["hatchling>=1.25"]
+build-backend = "hatchling.build"
+
+[project]
+name = "chp-adapter-conformance"
+version = "0.8.0"
+description = "CHP capability adapter — static and runtime violation checker for capability implementations"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "Apache-2.0" }
+authors = [{ name = "Auxo" }]
+keywords = ["chp", "capability-host-protocol", "conformance", "linting", "adapter"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: Apache Software License",
+    "Programming Language :: Python :: 3",
+]
+dependencies = [
+    "chp-core>=0.7.0",
+]
+
+[project.entry-points."chp.adapters"]
+conformance = "chp_adapter_conformance:ConformanceAdapter"
+
+[project.optional-dependencies]
+dev = ["pytest>=8.0"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["."]
+
+[tool.hatch.build.targets.wheel]
+packages = ["chp_adapter_conformance"]

chp_adapter_conformance-0.8.0/tests/test_conformance.py

@@ -0,0 +1,353 @@
+"""Tests for chp-adapter-conformance."""
+
+from __future__ import annotations
+
+import textwrap
+from pathlib import Path
+
+import pytest
+
+from chp_adapter_conformance import (
+    ConformanceAdapter,
+    Violation,
+    check_commit_message,
+    check_registered_adapter,
+    check_source_file,
+    score,
+)
+from chp_core import LocalCapabilityHost, register_adapter
+from chp_core.store import SQLiteEvidenceStore
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _src(code: str, tmp_path: Path) -> Path:
+    p = tmp_path / "adapter.py"
+    p.write_text(textwrap.dedent(code))
+    return p
+
+
+def _rules(violations: list[Violation]) -> set[str]:
+    return {v.rule for v in violations}
+
+
+def _make_host() -> LocalCapabilityHost:
+    store = SQLiteEvidenceStore(":memory:")
+    host = LocalCapabilityHost(store=store)
+    register_adapter(host, ConformanceAdapter())
+    return host
+
+
+def _invoke(host, cap_id, payload=None):
+    return host.invoke(cap_id, payload or {})
+
+
+# ---------------------------------------------------------------------------
+# Static checker
+# ---------------------------------------------------------------------------
+
+class TestCheckSourceFile:
+    def test_clean_adapter_no_violations(self, tmp_path):
+        src = _src("""
+            from chp_core import capability
+
+            class Adapter:
+                @capability(id="x.y", version="1.0.0", input_schema={"type":"object","properties":{}})
+                async def my_cap(self, ctx, payload):
+                    ctx.emit("done", {})
+                    return {"ok": True}
+        """, tmp_path)
+        violations = check_source_file(src)
+        assert len(violations) == 0
+
+    def test_detects_raw_open(self, tmp_path):
+        src = _src("""
+            from chp_core import capability
+
+            class Adapter:
+                @capability(id="x.y", version="1.0.0", input_schema={"type":"object","properties":{}})
+                async def my_cap(self, ctx, payload):
+                    with open("/tmp/foo") as f:
+                        data = f.read()
+                    ctx.emit("done", {})
+                    return {"ok": True}
+        """, tmp_path)
+        violations = check_source_file(src)
+        assert "raw_io" in _rules(violations)
+
+    def test_detects_missing_emit(self, tmp_path):
+        src = _src("""
+            from chp_core import capability
+
+            class Adapter:
+                @capability(id="x.y", version="1.0.0", input_schema={"type":"object","properties":{}})
+                async def my_cap(self, ctx, payload):
+                    return {"ok": True}
+        """, tmp_path)
+        violations = check_source_file(src)
+        assert "missing_emit" in _rules(violations)
+
+    def test_detects_forbidden_import(self, tmp_path):
+        src = _src("""
+            import httpx
+            from chp_core import capability
+
+            class Adapter:
+                @capability(id="x.y", version="1.0.0", input_schema={"type":"object","properties":{}})
+                async def my_cap(self, ctx, payload):
+                    ctx.emit("done", {})
+                    return {"ok": True}
+        """, tmp_path)
+        violations = check_source_file(src)
+        assert "raw_http" in _rules(violations)
+
+    def test_detects_silent_error(self, tmp_path):
+        src = _src("""
+            from chp_core import capability
+
+            class Adapter:
+                @capability(id="x.y", version="1.0.0", input_schema={"type":"object","properties":{}})
+                async def my_cap(self, ctx, payload):
+                    try:
+                        pass
+                    except Exception:
+                        pass
+                    ctx.emit("done", {})
+                    return {"ok": True}
+        """, tmp_path)
+        violations = check_source_file(src)
+        assert "silent_error" in _rules(violations)
+
+    def test_detects_direct_host_call(self, tmp_path):
+        src = _src("""
+            from chp_core import capability
+
+            class Adapter:
+                @capability(id="x.y", version="1.0.0", input_schema={"type":"object","properties":{}})
+                async def my_cap(self, ctx, payload):
+                    ctx.host.some_method()
+                    ctx.emit("done", {})
+                    return {"ok": True}
+        """, tmp_path)
+        violations = check_source_file(src)
+        assert "direct_host_call" in _rules(violations)
+
+    def test_record_turn_is_sanctioned(self, tmp_path):
+        src = _src("""
+            from chp_core import capability
+
+            class Adapter:
+                @capability(id="x.y", version="1.0.0", input_schema={"type":"object","properties":{}})
+                async def my_cap(self, ctx, payload):
+                    ctx.host.record_turn(ctx.correlation_id, role="user", content="x")
+                    ctx.emit("done", {})
+                    return {"ok": True}
+        """, tmp_path)
+        violations = check_source_file(src)
+        assert "direct_host_call" not in _rules(violations)
+
+    def test_backfill_session_has_violations(self):
+        """Confirm the known violation in backfill_session is detected."""
+        from pathlib import Path
+        root = Path(__file__).resolve().parents[3]  # chp-dev/
+        path = root / "packages" / "chp-adapter-messages" / "chp_adapter_messages" / "adapter.py"
+        if not path.exists():
+            pytest.skip("chp-adapter-messages not available in test path")
+        violations = check_source_file(path)
+        # backfill_session now routes through ctx.ainvoke(filesystem.read_file) — no raw_io
+        assert not violations, f"Unexpected violations: {violations}"
+
+
+# ---------------------------------------------------------------------------
+# Issue policy
+# ---------------------------------------------------------------------------
+
+class TestCommitPolicy:
+    def test_valid_commit_with_issue(self):
+        msg = "feat: add thing\n\nrad:72fb420abc1234567890abcdef123456789012"
+        assert check_commit_message(msg) == []
+
+    def test_short_hash_accepted(self):
+        msg = "fix: bug\n\nrad:72fb420"
+        assert check_commit_message(msg) == []
+
+    def test_merge_commit_exempt(self):
+        msg = "Merge branch 'main' into feat/x"
+        assert check_commit_message(msg) == []
+
+    def test_revert_commit_exempt(self):
+        msg = "Revert \"feat: something\""
+        assert check_commit_message(msg) == []
+
+    def test_missing_issue_fails(self):
+        msg = "fix: something without an issue"
+        violations = check_commit_message(msg)
+        assert len(violations) == 1
+        assert violations[0].rule == "issue_policy"
+
+    def test_comment_lines_ignored(self):
+        msg = "fix: thing\n# rad:72fb420 this is a comment\nno issue ref"
+        violations = check_commit_message(msg)
+        assert "issue_policy" in {v.rule for v in violations}
+
+
+# ---------------------------------------------------------------------------
+# Score
+# ---------------------------------------------------------------------------
+
+class TestScore:
+    def test_no_violations_is_100(self):
+        assert score([]) == 100
+
+    def test_one_error_deducts_15(self):
+        v = Violation(rule="raw_io", severity="error", message="x")
+        assert score([v]) == 85
+
+    def test_one_warning_deducts_5(self):
+        v = Violation(rule="missing_category", severity="warning", message="x")
+        assert score([v]) == 95
+
+    def test_score_floors_at_zero(self):
+        errors = [Violation(rule="raw_io", severity="error", message="x")] * 10
+        assert score(errors) == 0
+
+
+# ---------------------------------------------------------------------------
+# Capability round-trips
+# ---------------------------------------------------------------------------
+
+class TestConformanceCapabilities:
+    def test_capabilities_registered(self):
+        host = _make_host()
+        caps = set(host._capabilities.keys())
+        assert any("check_source" in k for k in caps)
+        assert any("check_adapter" in k for k in caps)
+        assert any("check_all" in k for k in caps)
+        assert any("policy_check" in k for k in caps)
+        assert any("open_dev_session" in k for k in caps)
+        assert any("check_staged" in k for k in caps)
+        assert any("close_dev_session" in k for k in caps)
+        assert any("report_violations" in k for k in caps)
+
+    def test_policy_check_via_capability(self):
+        host = _make_host()
+        r = _invoke(host, "chp.adapters.conformance.policy_check", {
+            "commit_message": "feat: thing\n\nrad:72fb420"
+        })
+        assert r.success
+        assert r.data["passes"] is True
+
+    def test_policy_check_fails_without_issue(self):
+        host = _make_host()
+        r = _invoke(host, "chp.adapters.conformance.policy_check", {
+            "commit_message": "feat: thing without issue"
+        })
+        assert r.success
+        assert r.data["passes"] is False
+
+    def test_check_source_via_capability(self, tmp_path):
+        src = _src("""
+            from chp_core import capability
+
+            class Adapter:
+                @capability(id="x.y", version="1.0.0", input_schema={"type":"object","properties":{}})
+                async def my_cap(self, ctx, payload):
+                    open("/tmp/foo")
+                    ctx.emit("done", {})
+                    return {}
+        """, tmp_path)
+        host = _make_host()
+        r = _invoke(host, "chp.adapters.conformance.check_source", {
+            "source_path": str(src)
+        })
+        assert r.success
+        assert r.data["violation_count"] >= 1
+        assert r.data["score"] < 100
+
+    def test_check_all_via_capability(self):
+        host = _make_host()
+        r = _invoke(host, "chp.adapters.conformance.check_all")
+        assert r.success
+        assert r.data["adapter_count"] >= 1
+
+    def test_check_staged_no_session_raises(self, tmp_path):
+        """check_staged raises if no active session file exists."""
+        import json
+        from pathlib import Path
+        session = Path.home() / ".chp" / "active-session.json"
+        existed = session.exists()
+        backup = session.read_text() if existed else None
+        if existed:
+            session.unlink()
+        try:
+            host = _make_host()
+            r = _invoke(host, "chp.adapters.conformance.check_staged", {"staged_files": []})
+            assert not r.success or "No active dev session" in str(r.error)
+        finally:
+            if backup is not None:
+                session.write_text(backup)
+
+    def test_check_staged_empty_files_is_ok(self, tmp_path):
+        """check_staged with no staged files returns ok=True."""
+        import json
+        from pathlib import Path
+        session = Path.home() / ".chp" / "active-session.json"
+        existed = session.exists()
+        backup = session.read_text() if existed else None
+        session.parent.mkdir(parents=True, exist_ok=True)
+        session.write_text(json.dumps({
+            "issue_id": "test0001",
+            "baseline": {"adapters": [], "adapter_count": 0, "total_violations": 0},
+        }))
+        try:
+            host = _make_host()
+            r = _invoke(host, "chp.adapters.conformance.check_staged", {"staged_files": []})
+            assert r.success
+            assert r.data["ok"] is True
+            assert r.data["new_violations"] == []
+        finally:
+            if backup is not None:
+                session.write_text(backup)
+            elif session.exists():
+                session.unlink()
+
+    def test_check_staged_detects_new_violation(self, tmp_path):
+        """check_staged flags violations in staged files that aren't in baseline."""
+        import json
+        from pathlib import Path
+        # Write a Python file with a raw_io violation
+        bad_file = tmp_path / "bad_adapter.py"
+        bad_file.write_text(textwrap.dedent("""
+            from chp_core import capability
+
+            class Adapter:
+                @capability(id="x.y", version="1.0.0", input_schema={"type":"object","properties":{}})
+                async def my_cap(self, ctx, payload):
+                    open("/tmp/foo")
+                    ctx.emit("done", {})
+                    return {}
+        """))
+        session = Path.home() / ".chp" / "active-session.json"
+        existed = session.exists()
+        backup = session.read_text() if existed else None
+        session.parent.mkdir(parents=True, exist_ok=True)
+        session.write_text(json.dumps({
+            "issue_id": "test0001",
+            "baseline": {"adapters": [], "adapter_count": 0, "total_violations": 0},
+        }))
+        try:
+            host = _make_host()
+            r = _invoke(host, "chp.adapters.conformance.check_staged", {
+                "staged_files": [str(bad_file)],
+            })
+            assert r.success
+            assert r.data["ok"] is False
+            rules = {v["rule"] for v in r.data["new_violations"]}
+            assert "raw_io" in rules
+        finally:
+            if backup is not None:
+                session.write_text(backup)
+            elif session.exists():
+                session.unlink()