codd-dev 2.89.0__tar.gz → 2.91.0__tar.gz

{codd_dev-2.89.0 → codd_dev-2.91.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codd-dev
-Version: 2.89.0
+Version: 2.91.0
 Summary: CoDD: Coherence-Driven Development — cross-artifact change impact analysis
 Project-URL: Homepage, https://github.com/yohey-w/codd-dev
 Project-URL: Repository, https://github.com/yohey-w/codd-dev

{codd_dev-2.89.0 → codd_dev-2.91.0}/codd/__init__.py

@@ -1,3 +1,3 @@
 """CoDD — Coherence-Driven Development."""
 
-__version__ = "2.89.0"
+__version__ = "2.91.0"

{codd_dev-2.89.0 → codd_dev-2.91.0}/codd/cli.py

@@ -5023,11 +5023,13 @@ def verify(
         if not runtime:
             return
 
-    # Stack contract intake (Contract Kernel v2.77a) — bring the project's declared
-    # framework-stack contract into the live verify run's trace, mirroring the
-    # greenfield intake. INTAKE ONLY: no obligation is enforced and NO verdict
-    # changes (that is v2.77b-e). A project with no `stack:` block is unaffected; a
-    # declared-but-broken stack fails HONESTLY (anti-false-green), never a silent skip.
+    # Stack contract intake + lock enforcement (Contract Kernel v2.77a/v2.77b) —
+    # bring the project's declared framework-stack contract into the live verify
+    # run's trace (v2.77a, mirroring the greenfield intake), then ENFORCE the stack
+    # lock as a gate (v2.77b): a stack project whose committed lock has drifted from
+    # the resolved contract — or that has no committed lock at all — is RED. A
+    # project with no `stack:` block is unaffected; a declared-but-broken stack
+    # fails HONESTLY (anti-false-green), never a silent skip.
     _intake_stack_contract_for_verify(Path(path).resolve())
 
     verify_kwargs: dict[str, Any] = {"path": path, "prefer_standalone": True}
@@ -7598,7 +7600,7 @@ def _load_optional_project_config(project_root: Path) -> dict[str, Any]:
         return {}
 
 
-def _intake_stack_contract_for_verify(project_root: Path) -> None:
+def _intake_stack_contract_for_verify(project_root: Path, *, stack_command_executor=None) -> None:
     """Resolve the project's declared stack contract into the verify run trace.
 
     Contract Kernel v2.77a (intake only) — the verify-path mirror of the greenfield
@@ -7607,6 +7609,11 @@ def _intake_stack_contract_for_verify(project_root: Path) -> None:
     the run trace), WITHOUT enforcing any obligation or changing the verify verdict
     (obligation enforcement is v2.77b-e).
 
+    ``stack_command_executor`` is the v2.77c materialization seam (default: the real
+    subprocess executor): an injectable executor that invokes each composed stack
+    command slot (exit-code only). Tests pass a recording/sentinel executor so the
+    declared slots are provably invoked without real Next.js/Playwright.
+
     * No ``stack:`` block → no-op (the opt-in framework layer is unused; the vast
       majority of projects — emits a single trace line, no behaviour change).
     * A declared stack → its ``stack_contract_hash`` is echoed to the run trace.
@@ -7627,6 +7634,15 @@ def _intake_stack_contract_for_verify(project_root: Path) -> None:
         raise SystemExit(1) from exc
 
     if contract is None:
+        # No `stack:` block → byte-identical, UNLESS a committed lock still exists
+        # (a removed stack declaration on a still-pinned project = RED; closes the
+        # "drop stack: to dodge the gate" bypass — v2.77b anti-false-green).
+        from codd.stack.lock import orphan_stack_lock
+
+        orphan = orphan_stack_lock(project_root)
+        if orphan is not None and orphan.red:
+            click.echo(f"[verify] stack lock gate: {orphan.message}", err=True)
+            raise SystemExit(1)
         return
     trace = stack_contract_trace(contract)
     click.echo(
@@ -7634,6 +7650,47 @@ def _intake_stack_contract_for_verify(project_root: Path) -> None:
         f"stack_contract_hash={trace['stack_contract_hash']}"
     )
 
+    # Stack lock ENFORCEMENT (Contract Kernel v2.77b) — verify is always an
+    # enforcement context (it never CREATES a project), so it uses the strictly
+    # READ-ONLY gate: a stack project with no committed lock, or a lock that has
+    # drifted from (or cannot be parsed against) the resolved contract, is RED
+    # (honest non-zero exit). The gate never writes or refreshes the lock, so a
+    # drift cannot be silenced on the verify path.
+    from codd.stack.lock import enforce_stack_lock
+
+    gate = enforce_stack_lock(contract, project_root)
+    click.echo(f"[verify] stack lock gate: {gate.message}", err=gate.red)
+    if gate.red:
+        raise SystemExit(1)
+
+    # Stack command MATERIALIZATION (Contract Kernel v2.77c) — the verify-path mirror
+    # of the greenfield pipeline's :meth:`_materialize_stack_commands`. (1) CONFLICT
+    # GATE: a composition conflict (command collision / unproved replace / weakened
+    # obligation / exclusive / deny) is RED (honest non-zero exit) — the composer
+    # already refuses a silent last-wins merge by recording a Conflict; this makes it
+    # a gate. (2) PLAN + EXECUTE: build a deterministic, contract-driven command plan
+    # (NO framework literal) and INVOKE each composed slot by exit code, so a declared
+    # framework_build/e2e_test is genuinely run on verify (not silently skipped while
+    # the language verify greens alone). Exit-code ONLY here; command AUTHENTICITY is
+    # v2.77d and the obligation-checker gate is v2.77e (out of lane).
+    from codd.stack.command_plan import (
+        StackCommandMaterializationError,
+        StackContractConflictError,
+        materialize_stack_command_plan,
+    )
+
+    try:
+        plan, _result = materialize_stack_command_plan(
+            contract, project_root, executor=stack_command_executor
+        )
+    except (StackContractConflictError, StackCommandMaterializationError) as exc:
+        click.echo(f"[verify] stack command materialization: {exc}", err=True)
+        raise SystemExit(1) from exc
+    click.echo(
+        f"[verify] stack command materialization: {len(plan.slots)} slot(s) invoked "
+        f"({', '.join(plan.command_ids)})"
+    )
+
 
 def _run_verify_once(
     path: str,

{codd_dev-2.89.0 → codd_dev-2.91.0}/codd/greenfield/pipeline.py

@@ -313,6 +313,11 @@ CiScaffoldRunner = Callable[..., str]
 PropagateRunner = Callable[..., str]
 CheckRunner = Callable[[Path], str]
 Notifier = Callable[[str, str], bool]
+#: Injectable seam for the v2.77c stack-command materialization executor (a slot →
+#: exit-code outcome). Default (None) uses the real subprocess executor in
+#: ``codd.stack.command_plan``; tests inject a recording/sentinel executor so the
+#: declared stack command slots are provably invoked without real Next.js/Playwright.
+StackCommandExecutor = Callable[..., Any]
 
 
 class GreenfieldPipeline:
@@ -351,6 +356,7 @@ class GreenfieldPipeline:
         propagate_runner: PropagateRunner | None = None,
         check_runner: CheckRunner | None = None,
         notifier: Notifier | None = None,
+        stack_command_executor: StackCommandExecutor | None = None,
         echo: Callable[[str], None] = print,
     ) -> None:
         self.project_name = project_name
@@ -380,6 +386,7 @@ class GreenfieldPipeline:
         self.propagate_runner = propagate_runner
         self.check_runner = check_runner
         self.notifier = notifier
+        self.stack_command_executor = stack_command_executor
         self.echo = echo
 
     def _restore_session_options(self, session: dict[str, Any]) -> None:
@@ -452,14 +459,80 @@ class GreenfieldPipeline:
         # failed GreenfieldResult instead of raising to the caller. Its own
         # pseudo-stage name (not a real STAGES entry) so the failure is attributed
         # honestly to intake, not to ``init``.
+        # Whether THIS run is a genuine first generation (the project is being
+        # created now) vs a re-run/resume of an already-progressed project. This is
+        # the ONLY context in which the stack-lock gate may bootstrap a missing lock
+        # (anti-gaming). It is read from the ON-DISK session INDEPENDENTLY of the
+        # ``resume`` flag — because a re-run WITHOUT ``--resume`` builds a fresh
+        # in-memory ``session`` (all-pending), which must NOT be mistaken for a first
+        # generation on an already-built project (GPT-consult leak: "absence of
+        # session ≠ first generation"). Fail-closed: any persisted completed stage ⇒
+        # not first-gen, so a deleted lock on a built project is RED, never silently
+        # re-bootstrapped to green.
+        on_disk = load_session(project_root)
+        first_generation = on_disk is None or not any(
+            rec.get("status") in _COMPLETE_STATUSES
+            for rec in on_disk.get("stages", {}).values()
+        )
+
         try:
-            self._intake_stack_contract(project_root, session)
+            contract = self._intake_stack_contract(project_root, session)
         except StageError as exc:
             return self._fail(
                 project_root, session, options, "stack_intake",
                 {"status": STATUS_PENDING, "detail": ""}, str(exc),
             )
 
+        # Stack lock ENFORCEMENT (Contract Kernel v2.77b) — turn the already-live
+        # stack contract into a red/green GATE. For stack-declared projects
+        # (contract is not None): drift / missing-in-resume = RED (anti-false-green);
+        # a first-generation missing lock is bootstrapped once (never overwritten —
+        # anti-gaming). For projects with NO stack block: byte-identical UNLESS a
+        # committed lock still exists (a removed declaration on a still-pinned
+        # project = RED, closing the "drop stack: to dodge the gate" bypass).
+        # Routed through _fail like intake so the autopilot reports it honestly.
+        try:
+            if contract is not None:
+                self._enforce_stack_lock(project_root, session, contract, first_generation)
+            else:
+                from codd.stack.lock import orphan_stack_lock
+
+                orphan = orphan_stack_lock(project_root)
+                if orphan is not None and orphan.red:
+                    self.echo(f"[greenfield] stack lock gate: {orphan.message}")
+                    raise StageError(orphan.message)
+        except StageError as exc:
+            return self._fail(
+                project_root, session, options, "stack_lock",
+                {"status": STATUS_PENDING, "detail": ""}, str(exc),
+            )
+
+        # Stack command MATERIALIZATION (Contract Kernel v2.77c) — connect the
+        # composed stack commands (and thus the stack obligations) to the run's
+        # ACTUAL verify/build/test command plan. Two parts (both RED-routed through
+        # _fail, like intake/lock):
+        #   1. CONFLICT GATE — a composition conflict (command collision / unproved
+        #      replace / weakened obligation / exclusive / deny) is RED. The composer
+        #      already records these (it refuses last-wins); this makes that a gate.
+        #   2. PLAN + EXECUTE — build a deterministic, contract-driven command plan
+        #      from contract.commands (NO framework literal) and INVOKE each slot by
+        #      exit code, so a declared framework_build/e2e_test is genuinely run (not
+        #      silently skipped while the language verify greens alone — the false
+        #      green this step closes). Exit-code ONLY here; command AUTHENTICITY
+        #      (no-op/"build":"true"/observed-no-tests) is v2.77d and the obligation-
+        #      checker gate is v2.77e — both deliberately out of lane.
+        # Only for stack-declared projects (contract is not None) — a non-stack run
+        # never reaches here, so it is byte-identical (no plan, no execution, no new
+        # trace keys).
+        try:
+            if contract is not None:
+                self._materialize_stack_commands(project_root, session, contract)
+        except StageError as exc:
+            return self._fail(
+                project_root, session, options, "stack_commands",
+                {"status": STATUS_PENDING, "detail": ""}, str(exc),
+            )
+
         runners: dict[str, Callable[[Path, dict[str, Any], dict[str, Any]], None]] = {
             "init": self._stage_init,
             "elicit": self._stage_elicit,
@@ -544,7 +617,7 @@ class GreenfieldPipeline:
 
     # ── stack contract intake (Contract Kernel v2.77a, intake only) ──
 
-    def _intake_stack_contract(self, project_root: Path, session: dict[str, Any]) -> None:
+    def _intake_stack_contract(self, project_root: Path, session: dict[str, Any]):
         """Resolve the project's declared stack contract into the live run record + trace.
 
         See the call site in :meth:`run`. INTAKE ONLY — proves the framework-stack
@@ -554,10 +627,11 @@ class GreenfieldPipeline:
 
         * No ``stack:`` block → no-op: nothing is added to the record and only a
           single debug ``self.echo`` is emitted, so a non-stack project (the vast
-          majority) is behaviour-preserving.
+          majority) is behaviour-preserving. Returns ``None``.
         * A declared stack → its :func:`stack_contract_trace` payload (incl.
           ``stack_contract_hash``) is written to ``session["stack_contract"]`` and
-          echoed to the run trace.
+          echoed to the run trace. Returns the resolved ``ResolvedStackContract`` so
+          the v2.77b lock-enforcement gate (run after intake) can pin it.
         * A declared-but-BROKEN stack → :class:`StageError` (honest error), never a
           silent skip (anti-false-green / no-silent-fallback).
         """
@@ -577,7 +651,7 @@ class GreenfieldPipeline:
         if contract is None:
             # The opt-in framework layer is unused — byte-identical behaviour.
             self.echo("[greenfield] stack contract intake: no `stack:` block (framework layer opt-out)")
-            return
+            return None
 
         trace = stack_contract_trace(contract)
         session["stack_contract"] = dict(trace)
@@ -586,6 +660,92 @@ class GreenfieldPipeline:
             f"{trace['resolved_stack_id']} "
             f"stack_contract_hash={trace['stack_contract_hash']}"
         )
+        return contract
+
+    # ── stack lock enforcement (Contract Kernel v2.77b) ──
+
+    def _enforce_stack_lock(self, project_root: Path, session: dict[str, Any], contract, first_generation: bool) -> None:
+        """Enforce the project's stack lock as a red/green gate (v2.77b).
+
+        Only called for stack-declared projects (``contract is not None``); non-stack
+        projects never reach here, so they are byte-identical (no lock gate at all).
+
+        Design B′ (split read-only gate vs. creation-path bootstrap):
+
+        * genuine FIRST GENERATION (``first_generation`` True — no prior completed
+          stage) → :func:`bootstrap_stack_lock` writes the first lock (exclusive
+          create) and immediately enforces it read-only; ``generated`` is traced.
+        * otherwise (RESUME / already-progressed project) → read-only
+          :func:`enforce_stack_lock`: a missing lock is RED (an already-progressed
+          stack project with no committed pin is unverifiable; a deleted lock cannot
+          be silently regenerated), drift is RED, a valid lock is GREEN.
+
+        Anti-gaming (exit gate 3): the read-only gate NEVER writes/refreshes a lock;
+        ``bootstrap_stack_lock`` writes only when the lock is ABSENT (exclusive
+        create) on this creation path, so a drift cannot be silenced by regenerating
+        the lock. See :func:`enforce_stack_lock` / :func:`bootstrap_stack_lock`.
+        """
+        from codd.stack.lock import bootstrap_stack_lock, enforce_stack_lock
+
+        if first_generation:
+            gate = bootstrap_stack_lock(contract, project_root)
+        else:
+            gate = enforce_stack_lock(contract, project_root)
+        # Record the lock verdict in the run trace (observable, like the intake hash).
+        record = session.get("stack_contract")
+        if isinstance(record, dict):
+            record["stack_lock_status"] = gate.status
+            record["stack_lock_path"] = gate.lock_path
+        self.echo(f"[greenfield] stack lock gate: {gate.message}")
+        if gate.red:
+            raise StageError(gate.message)
+
+    # ── stack command materialization (Contract Kernel v2.77c) ──
+
+    def _materialize_stack_commands(self, project_root: Path, session: dict[str, Any], contract) -> None:
+        """Conflict-gate + materialize the composed stack commands into the run plan (v2.77c).
+
+        See the call site in :meth:`run`. Only invoked for stack-declared projects.
+
+        1. CONFLICT GATE — :func:`assert_stack_contract_clean` (inside
+           :func:`stack_command_plan`) raises :class:`StackContractConflictError` on
+           ANY composition conflict (command collision / unproved replace / weakened
+           obligation / exclusive / deny). That is RED — the composer already refuses
+           a silent last-wins merge by recording a ``Conflict``; this makes it a gate.
+        2. MATERIALIZE — build a deterministic, contract-driven command plan and
+           INVOKE each composed slot by exit code (via the injectable
+           ``stack_command_executor`` seam). A failing slot raises
+           :class:`StackCommandMaterializationError`. Both domain errors become a
+           :class:`StageError` so the autopilot reports them honestly (the run does
+           NOT advance to the stage loop with a conflicted/failing stack plan).
+
+        The materialized plan + executed slot ids are recorded in the run trace
+        (observable, like the intake hash + lock verdict) so "the declared stack
+        command slots were invoked" is provable. Exit-code only — authenticity is
+        v2.77d, the obligation-checker gate is v2.77e.
+        """
+        from codd.stack.command_plan import (
+            StackCommandMaterializationError,
+            StackContractConflictError,
+            materialize_stack_command_plan,
+        )
+
+        try:
+            plan, result = materialize_stack_command_plan(
+                contract, project_root, executor=self.stack_command_executor
+            )
+        except (StackContractConflictError, StackCommandMaterializationError) as exc:
+            self.echo(f"[greenfield] stack command materialization: {exc}")
+            raise StageError(str(exc)) from exc
+
+        record = session.get("stack_contract")
+        if isinstance(record, dict):
+            record["stack_command_plan"] = plan.to_record()
+            record["stack_commands_executed"] = list(result.executed_slot_ids)
+        self.echo(
+            "[greenfield] stack command materialization: "
+            f"{len(plan.slots)} slot(s) invoked ({', '.join(plan.command_ids)})"
+        )
 
     # ── option resolution ───────────────────────────────────