code-coordinator 0.5.550__tar.gz → 0.5.551__tar.gz

{code_coordinator-0.5.550 → code_coordinator-0.5.551}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.550
+Version: 0.5.551
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.550 → code_coordinator-0.5.551}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.550
+Version: 0.5.551
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.550 → code_coordinator-0.5.551}/code_coordinator.egg-info/SOURCES.txt

@@ -139,6 +139,7 @@ coord/reconcile.py
 coord/reconcile_tick.py
 coord/refine_chat.py
 coord/release_cordon.py
+coord/release_gate.py
 coord/release_propagate.py
 coord/release_verify.py
 coord/release_window.py
@@ -790,6 +791,7 @@ tests/test_release_cordon_daemon_leads_2176.py
 tests/test_release_cordon_deadlock_2240.py
 tests/test_release_cordon_drain_stall_3336.py
 tests/test_release_cordon_stuck_2490.py
+tests/test_release_gate.py
 tests/test_release_propagate.py
 tests/test_release_propagate_threshold.py
 tests/test_release_roll_between_legs_2854.py

{code_coordinator-0.5.550 → code_coordinator-0.5.551}/code_coordinator.egg-info/scm_file_list.json

@@ -256,6 +256,7 @@
     "coord/reconcile_tick.py",
     "coord/refine_chat.py",
     "coord/release_cordon.py",
+    "coord/release_gate.py",
     "coord/release_propagate.py",
     "coord/release_verify.py",
     "coord/release_window.py",
@@ -817,6 +818,7 @@
     "tests/test_release_cordon_deadlock_2240.py",
     "tests/test_release_cordon_drain_stall_3336.py",
     "tests/test_release_cordon_stuck_2490.py",
+    "tests/test_release_gate.py",
     "tests/test_release_propagate.py",
     "tests/test_release_propagate_threshold.py",
     "tests/test_release_roll_between_legs_2854.py",

code_coordinator-0.5.551/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.551",
+  "distance": 0,
+  "node": "g4a9a986d2a2bc934495d202b1197b82782c1d73f",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-01"
+}

{code_coordinator-0.5.550 → code_coordinator-0.5.551}/coord/commands/release.py

@@ -20,13 +20,16 @@ import re
 import subprocess
 import sys
 from pathlib import Path
-from typing import Any
+from typing import TYPE_CHECKING, Any
 
 import click
 
 from coord import restart_cmd
 from coord.commands._common import _CONFIG_OPTION
 
+if TYPE_CHECKING:
+    from coord.release_gate import ShaComparator
+
 
 def _git(cwd: Path, *args: str) -> subprocess.CompletedProcess:
     return subprocess.run(
@@ -4434,3 +4437,316 @@ def release_window_history(limit: int, as_json: bool) -> None:
 # release verify` are one discoverable pair. The flat `coord
 # release-preflight` above keeps working unchanged.
 release_group.add_command(release_preflight, name="preflight")
+
+
+# ──────────────────────────────────────────────────────────────────────────
+# `coord release gate` — the opt-in cross-platform release gate (#3488)
+# ──────────────────────────────────────────────────────────────────────────
+#
+# vimcode shipped Win-GUI with no visible menu bar and no window controls —
+# a regression from two individually-correct fixes (quadraui#1199 plus
+# #1200) — and nothing at release time looked. This command is the "looked":
+# it refuses a release, naming the failing lane or step, unless every
+# Tier-2 smoke lane configured for *repo* (``release_gate.<repo>.lanes`` in
+# coordinator.yml) shows a PASSING result at the release SHA, and — when
+# ``bugbash: required`` — the most recent ``coord bugbash`` run reachable
+# from that SHA ended with zero new findings.
+#
+# The decision itself (:func:`coord.release_gate.evaluate_release_gate`) is
+# pure and unit-tested against fixtures in ``tests/test_release_gat.py``.
+# What lives here is the I/O shell: loading the observed lane/bugbash
+# results, resolving real SHA ancestry via git, and the Click surface.
+#
+# KNOWN GAP (mirrors ``coord/commands/bugbash.py``'s own documented gap):
+# no production store of Tier-2 lane results or bugbash runs exists yet in
+# this codebase — both are out of #3488's file scope. ``--from-json`` is the
+# seam until one is wired: a JSON file naming the observed
+# :class:`~coord.release_gate.LaneResult`/:class:`~coord.release_gate.
+# BugbashRunRecord` entries, in the same spirit as every other ``run_*``
+# report's injectable ``fetch=`` seam.
+
+
+def _release_gate_actor() -> str:
+    """Who is running ``coord release gate --override`` — same pattern as
+    ``coord.commands.gate_a._actor``: the local OS username, best-effort.
+
+    Populates :attr:`~coord.release_gate.GateOverride.by` (previously always
+    ``None``, so the verdict's rendered ``by=unknown`` branch was the only
+    one ever reachable) and the audit row's ``actor`` field."""
+    import getpass  # noqa: PLC0415
+
+    try:
+        return getpass.getuser()
+    except Exception:  # noqa: BLE001 — no passwd entry in some containers
+        return "unknown"
+
+
+def _sha_ancestry_comparator(repo_path_opt: str | None) -> "ShaComparator":
+    """The real ``sha_is_at_or_after`` for :func:`coord.release_gate.
+    evaluate_release_gate`: *release_sha* is an ancestor of (or equal to)
+    *candidate_sha*, via ``git merge-base --is-ancestor`` run against
+    *repo_path_opt* (default: the current directory).
+
+    #2096: any error at all (not a git checkout, unknown SHA, git missing,
+    a timeout) means "not proven" and returns ``False`` — the exact same
+    conservative default :func:`coord.release_gate._default_sha_at_or_after`
+    takes. This must never silently resolve to "assume it's fine".
+    """
+    repo_root = Path(repo_path_opt).expanduser() if repo_path_opt else Path.cwd()
+
+    def _is_at_or_after(candidate_sha: str, release_sha: str) -> bool:
+        if candidate_sha == release_sha:
+            return True
+        try:
+            result = subprocess.run(
+                [
+                    "git", "-C", str(repo_root), "merge-base", "--is-ancestor",
+                    release_sha, candidate_sha,
+                ],
+                capture_output=True,
+                timeout=30,
+                check=False,
+            )
+        except (OSError, subprocess.TimeoutExpired):
+            return False
+        return result.returncode == 0
+
+    return _is_at_or_after
+
+
+def _require_bool(value: Any, *, field_name: str) -> bool:
+    """Reject anything that isn't literally ``True``/``False``.
+
+    #2096-review: a hand-authored ``--from-json`` payload is the realistic
+    failure mode here — ``"passed": "false"``, ``"0"``, ``"no"`` are all
+    non-empty strings, so Python's own ``bool(...)`` coercion turns every
+    one of them into ``True`` with no error at all. That would let a
+    genuinely-red lane (or an unverified/lane-failed bugbash run) read as a
+    clean PASS, silently, which is exactly the failure mode this whole gate
+    exists to prevent. ``isinstance`` (not ``bool(x) == x`` or similar) is
+    deliberate: ``1``/``0`` are also not acceptable spellings of a boolean
+    here, only the real thing.
+    """
+    if not isinstance(value, bool):
+        raise ValueError(
+            f"{field_name!r} must be a JSON boolean (true/false), "
+            f"got {value!r} ({type(value).__name__})"
+        )
+    return value
+
+
+def _load_release_gate_observations(
+    payload: dict,
+) -> tuple[list, list]:
+    """Parse ``--from-json``'s payload into
+    (:class:`~coord.release_gate.LaneResult`, :class:`~coord.release_gate.
+    BugbashRunRecord`) lists. Raises ``KeyError``/``TypeError``/``ValueError``
+    on a malformed entry — the caller turns that into a clean CLI error."""
+    from coord import release_gate as rg  # noqa: PLC0415
+
+    lane_results = [
+        rg.LaneResult(
+            lane=entry["lane"],
+            sha=entry["sha"],
+            passed=_require_bool(entry["passed"], field_name="lanes[].passed"),
+            detail=entry.get("detail", ""),
+            checked_at=entry.get("checked_at"),
+        )
+        for entry in payload.get("lanes", []) or []
+    ]
+    bugbash_runs = [
+        rg.BugbashRunRecord(
+            sha=entry["sha"],
+            new_findings=int(entry["new_findings"]),
+            verified=_require_bool(
+                entry.get("verified", True), field_name="bugbash[].verified",
+            ),
+            ran_at=float(entry.get("ran_at", 0.0)),
+            detail=entry.get("detail", ""),
+        )
+        for entry in payload.get("bugbash", []) or []
+    ]
+    return lane_results, bugbash_runs
+
+
+def _gate_verdict_to_dict(verdict: "Any") -> dict[str, Any]:
+    return {
+        "repo": verdict.repo,
+        "release_sha": verdict.release_sha,
+        "gate_passed": verdict.gate_passed,
+        "effective_passed": verdict.effective_passed,
+        "steps": [
+            {"name": s.name, "passed": s.passed, "detail": s.detail}
+            for s in verdict.steps
+        ],
+        "override": None if verdict.override is None else {
+            "reason": verdict.override.reason,
+            "by": verdict.override.by,
+            "at": verdict.override.at,
+        },
+    }
+
+
+def _render_gate_verdict(verdict: "Any") -> str:
+    lines = [f"release gate: {verdict.repo} @ {verdict.release_sha}"]
+    for step in verdict.steps:
+        marker = "PASS" if step.passed else "FAIL"
+        lines.append(f"  [{marker}] {step.name}: {step.detail}")
+    if verdict.override is not None:
+        lines.append(
+            f"  OVERRIDE applied — reason: {verdict.override.reason!r} "
+            f"(by={verdict.override.by or 'unknown'})"
+        )
+    result_line = "RESULT: " + ("PASS" if verdict.effective_passed else "FAIL")
+    if verdict.override is not None and not verdict.gate_passed:
+        result_line += " (raw gate FAILED — released only via audited override)"
+    lines.append(result_line)
+    return "\n".join(lines)
+
+
+@release_group.command(
+    "gate",
+    help=(
+        "#3488: the opt-in cross-platform release gate. Refuses (naming the "
+        "failing lane/step) unless every Tier-2 smoke lane configured for "
+        "REPO passed at --sha, and (when release_gate.<repo>.bugbash: "
+        "required) the most recent `coord bugbash` run at or after --sha "
+        "found nothing new."
+    ),
+)
+@_CONFIG_OPTION
+@click.argument("repo")
+@click.option("--sha", "release_sha", required=True,
+              help="The release commit being gated.")
+@click.option(
+    "--from-json", "from_json_path",
+    type=click.Path(exists=True, dir_okay=False, path_type=Path),
+    required=True,
+    help=(
+        "JSON file with this run's OBSERVED lane/bugbash results: "
+        '{"lanes": [{"lane", "sha", "passed", "detail"?, "checked_at"?}, ...], '
+        '"bugbash": [{"sha", "new_findings", "verified"?, "ran_at"?, "detail"?}, ...]}. '
+        "No production Tier-2/bugbash store is wired yet (tracked follow-up, "
+        "out of #3488's file scope) — this is the seam until one is."
+    ),
+)
+@click.option(
+    "--repo-path", "repo_path_opt", default=None,
+    help="Local git checkout used to resolve bugbash SHA ancestry "
+         "(git merge-base --is-ancestor). Defaults to the current directory. "
+         "Only consulted when release_gate.<repo>.bugbash is 'required'.",
+)
+@click.option(
+    "--override", "override_reason", default=None, metavar="REASON",
+    help=(
+        "#1251-style audited override (same pattern as `coord merge "
+        "--override-human-required`): allow the release despite a failing "
+        "gate. Requires a non-empty reason, echoed in the verdict/--json "
+        "output. Never erases the underlying failing step(s) — they still "
+        "report FAIL; only the exit code and RESULT line change."
+    ),
+)
+@click.option("--json", "as_json", is_flag=True, help="Emit the verdict as JSON.")
+def release_gate_cmd(
+    config_path: Path,
+    repo: str,
+    release_sha: str,
+    from_json_path: Path,
+    repo_path_opt: str | None,
+    override_reason: str | None,
+    as_json: bool,
+) -> None:
+    import json as _json  # noqa: PLC0415
+
+    from coord import release_gate as rg  # noqa: PLC0415
+    from coord.commands._common import _load_config  # noqa: PLC0415
+
+    # Validate the override up front, before any config/file I/O, mirroring
+    # `coord merge --override-human-required`'s own early exit (#1251) — a
+    # thin client should never partially run and THEN discover its override
+    # reason was rejected.
+    if override_reason is not None:
+        try:
+            rg.validate_override_reason(override_reason)
+        except ValueError as exc:
+            click.echo(f"error: {exc}", err=True)
+            sys.exit(1)
+
+    config = _load_config(config_path)
+    if config.repo(repo) is None:
+        click.echo(f"error: repo {repo!r} not in coordinator.yml", err=True)
+        sys.exit(2)
+
+    gate_cfg = config.release_gate.for_repo(repo)
+    if gate_cfg is None:
+        click.echo(
+            f"error: repo {repo!r} has no 'release_gate:' entry in "
+            "coordinator.yml — it has not opted into the cross-platform "
+            "release gate (#3488), so there is nothing to evaluate",
+            err=True,
+        )
+        sys.exit(2)
+
+    try:
+        payload = _json.loads(from_json_path.read_text())
+    except (OSError, ValueError) as exc:
+        click.echo(f"error: could not read {from_json_path}: {exc}", err=True)
+        sys.exit(2)
+    if not isinstance(payload, dict):
+        click.echo(f"error: {from_json_path} must contain a JSON object", err=True)
+        sys.exit(2)
+
+    try:
+        lane_results, bugbash_runs = _load_release_gate_observations(payload)
+    except (KeyError, TypeError, ValueError) as exc:
+        click.echo(f"error: malformed {from_json_path}: {exc}", err=True)
+        sys.exit(2)
+
+    verdict = rg.evaluate_release_gate(
+        repo=repo,
+        release_sha=release_sha,
+        required_lanes=gate_cfg.lanes,
+        lane_results=lane_results,
+        bugbash_required=gate_cfg.bugbash_required,
+        bugbash_runs=bugbash_runs,
+        sha_is_at_or_after=_sha_ancestry_comparator(repo_path_opt),
+    )
+    if override_reason:
+        actor = _release_gate_actor()
+        verdict = rg.apply_override(verdict, reason=override_reason, by=actor)
+        # #1251-style audit trail — mirrors `coord merge
+        # --override-human-required`'s own `record_audit(...)` call
+        # (coord/commands/merge.py) and `coord acceptance expected-red
+        # --clear`'s: an audited override must land somewhere durable and
+        # queryable (the audit log), not just stdout/--json, which nobody
+        # but the invoking operator's own terminal ever sees. Without this,
+        # an operator could override a release gate repeatedly with zero
+        # durable record of who did it, when, or why — the opposite of
+        # "audited".
+        from coord.audit import record_audit  # noqa: PLC0415
+
+        record_audit(
+            tier="business",
+            category="release_gate",
+            event_type="release_gate_override",
+            actor=actor,
+            summary=(
+                f"release gate override: {repo} @ {release_sha} — "
+                f"{override_reason}"
+            ),
+            repo=repo,
+            details={
+                "release_sha": release_sha,
+                "reason": override_reason,
+                "gate_passed": verdict.gate_passed,
+                "failing_steps": [s.name for s in verdict.failing_steps],
+            },
+        )
+
+    if as_json:
+        click.echo(_json.dumps(_gate_verdict_to_dict(verdict), indent=2, sort_keys=True))
+    else:
+        click.echo(_render_gate_verdict(verdict))
+
+    if not verdict.effective_passed:
+        sys.exit(1)

{code_coordinator-0.5.550 → code_coordinator-0.5.551}/coord/config.py

@@ -1595,6 +1595,52 @@ class PropagationConfig:
     min_releases_behind: int = 1
 
 
+@dataclass
+class ReleaseGateRepoConfig:
+    """One entry under ``release_gate.<repo_name>`` in coordinator.yml
+    (#3488): this repo has opted into the cross-platform release gate.
+
+    ``lanes`` names the Tier-2 smoke lanes (acceptance-driver kinds, e.g.
+    ``tui-pty``/``win-native``/``mac-native``/``gtk-native`` —
+    :data:`coord.acceptance_drivers.SUPPORTED_KINDS` is the source of truth
+    for which actually exist) that must each show a PASSING result at the
+    release SHA before a release is cuttable. ``bugbash_required`` (from the
+    YAML's ``bugbash: required|off``) additionally requires the most recent
+    ``coord bugbash`` run reachable from that SHA to have ended with zero
+    new findings.
+
+    Nothing here runs the lanes or the bugbash loop itself — this is only
+    the declaration the gate evaluates against observed results (see
+    :mod:`coord.release_gate`). An empty ``lanes`` list is rejected at parse
+    time (see :func:`_parse_release_gate`) UNLESS ``bugbash_required`` is
+    set — a repo that opts in with no lanes and no bugbash requirement has
+    declared a gate that can never observe anything to fail on, which is
+    exactly the "gate that cannot fail" trap (#2096); a lanes-less,
+    bugbash-only gate can still fail on a red/unverified bugbash run, so
+    that combination is allowed.
+    """
+
+    lanes: list[str] = field(default_factory=list)
+    bugbash_required: bool = False
+
+
+@dataclass
+class ReleaseGateConfig:
+    """``release_gate:`` — repo name -> :class:`ReleaseGateRepoConfig`
+    (#3488). Same per-repo-name-keyed-mapping shape as
+    :class:`AcceptanceConfig`'s ``drivers`` (#944): opt-in, one entry per
+    repo that wants the gate, nothing at all for every other repo. Absent
+    entirely -> no repo has a release gate, and ``coord release gate``
+    refuses to run for an unlisted repo rather than silently reporting a
+    vacuous pass.
+    """
+
+    repos: dict[str, ReleaseGateRepoConfig] = field(default_factory=dict)
+
+    def for_repo(self, name: str) -> ReleaseGateRepoConfig | None:
+        return self.repos.get(name)
+
+
 @dataclass
 class MilestoneConfig:
     """Milestone-driven-workflow configuration (#767 / #769 Phase 1).
@@ -2514,6 +2560,9 @@ class Config:
     # #2583 — absent block == min_releases_behind=1 == today's behaviour
     # (any delta at all rolls, subject to quiescence/cordon as before).
     propagation: PropagationConfig = field(default_factory=PropagationConfig)
+    # #3488 — absent block == no repo has a cross-platform release gate ==
+    # today's behaviour (nothing stops a release from cutting).
+    release_gate: ReleaseGateConfig = field(default_factory=ReleaseGateConfig)
     milestone: MilestoneConfig = field(default_factory=MilestoneConfig)
     providers: ProvidersConfig = field(default_factory=ProvidersConfig)
     audit: AuditConfig = field(default_factory=AuditConfig)
@@ -2785,6 +2834,7 @@ def parse_mapping(raw: Any, *, path: Path | None = None) -> Config:
     store = _parse_store(raw.get("store"))
     merge = _parse_merge(raw.get("merge"))
     propagation = _parse_propagation(raw.get("propagation"))
+    release_gate = _parse_release_gate(raw.get("release_gate"), {r.name for r in repos})
     milestone = _parse_milestone(raw.get("milestone"))
     audit = _parse_audit(raw.get("audit"))
     forge_availability = _parse_forge_availability(raw.get("forge_availability"))
@@ -2810,6 +2860,7 @@ def parse_mapping(raw: Any, *, path: Path | None = None) -> Config:
         store=store,
         merge=merge,
         propagation=propagation,
+        release_gate=release_gate,
         milestone=milestone,
         providers=providers,
         audit=audit,
@@ -4688,6 +4739,76 @@ def _parse_propagation(raw: Any) -> PropagationConfig:
     return cfg
 
 
+_RELEASE_GATE_BUGBASH_VALUES = ("required", "off")
+
+
+def _parse_release_gate(raw: Any, repo_names: set[str]) -> ReleaseGateConfig:
+    """Parse the ``release_gate:`` block (#3488, opt-in cross-platform
+    release gate). Absent entirely -> no repo has one, matching
+    ``_parse_acceptance``'s own "absent means nothing is sealed/gated"
+    stance — this is opt-in per repo, never a default every app inherits.
+    """
+    if raw is None:
+        return ReleaseGateConfig()
+    if not isinstance(raw, dict):
+        raise ConfigError("'release_gate' must be a mapping of repo name -> gate config")
+
+    repos: dict[str, ReleaseGateRepoConfig] = {}
+    for repo_name, entry in raw.items():
+        if repo_name not in repo_names:
+            raise ConfigError(
+                f"release_gate references unknown repo {repo_name!r} — "
+                "it must match a name under 'repos:'"
+            )
+        if not isinstance(entry, dict):
+            raise ConfigError(f"release_gate[{repo_name!r}] must be a mapping")
+
+        known = {"lanes", "bugbash"}
+        unknown = sorted(set(entry) - known)
+        if unknown:
+            raise ConfigError(
+                f"release_gate[{repo_name!r}]: unknown option(s) {', '.join(unknown)} "
+                f"(valid: {', '.join(sorted(known))})"
+            )
+
+        lanes_raw = entry.get("lanes", []) or []
+        if not isinstance(lanes_raw, list) or not all(
+            isinstance(x, str) and x for x in lanes_raw
+        ):
+            raise ConfigError(
+                f"release_gate[{repo_name!r}].lanes must be a list of non-empty strings"
+            )
+
+        bugbash_raw = entry.get("bugbash", "off")
+        if bugbash_raw not in _RELEASE_GATE_BUGBASH_VALUES:
+            raise ConfigError(
+                f"release_gate[{repo_name!r}].bugbash must be one of "
+                f"{_RELEASE_GATE_BUGBASH_VALUES!r}, got {bugbash_raw!r}"
+            )
+
+        if not lanes_raw and bugbash_raw != "required":
+            # #2096: a gate declared over zero lanes AND no bugbash
+            # requirement can never observe a failure — it would always
+            # report a vacuous pass. Reject it at parse time rather than
+            # let an operator believe a repo is gated when it cannot
+            # actually fail on anything. A lanes-less, bugbash-only gate
+            # (`bugbash: required`) is fine — `evaluate_release_gate` can
+            # still fail it on a red/unverified bugbash run — so that
+            # combination is allowed through.
+            raise ConfigError(
+                f"release_gate[{repo_name!r}].lanes must be non-empty unless "
+                "bugbash: required is set — a repo opted into the release "
+                "gate must be able to observe at least one failure"
+            )
+
+        repos[repo_name] = ReleaseGateRepoConfig(
+            lanes=list(lanes_raw),
+            bugbash_required=(bugbash_raw == "required"),
+        )
+
+    return ReleaseGateConfig(repos=repos)
+
+
 def _parse_milestone(raw: Any) -> MilestoneConfig:
     """Parse the optional ``milestone:`` block from coordinator.yml.