code-factory-2-forge 0.9.2__tar.gz → 0.10.1__tar.gz

{code_factory_2_forge-0.9.2/code_factory_2_forge.egg-info → code_factory_2_forge-0.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-factory-2-forge
-Version: 0.9.2
+Version: 0.10.1
 Summary: ForgeLine — the autonomous outer loop for AI software factories. A CLI-backed state machine that drives intent -> spec -> plan -> code -> adversarial review -> ship, orchestrating SpecLine (spec governance) and Harness Software Factory (compiled decisions), with self-improving skills and architecture-as-a-CI-gate.
 License-Expression: MIT OR Apache-2.0
 Project-URL: Homepage, https://github.com/zrk222/code-factory-2-forge
@@ -207,7 +207,7 @@ the build. Full PRD-to-production traceability, enforced — not documented.
 
 ForgeLine now audits quality quantitatively and **learns from its own runs**:
 
-**Deep QA audit** (`forge qa`) grades every build on coverage-intent (do tests
+**Deep QA audit** (`forge qa <feature> --ssat <feature.ssat.yaml>`) grades the declared feature slice on coverage-intent (do tests
 actually call the functions?), cyclomatic complexity, a scored security surface
 (eval/exec/shell/secrets/weak-crypto), and documentation — a composite A–F grade
 that gates shipping. A pretty build with untested, over-complex, or insecure
@@ -230,6 +230,44 @@ cycle in 15 seconds.
 (normal → elevated "fix all findings" → final "human review required") instead
 of a flat retry cap.
 
+## v0.10 - Safe feature QA and provenance
+
+ForgeLine now treats an SSAT as the ownership boundary for a gate. `forge review`
+uses only its declared source modules for adversarial and QA findings; unrelated
+repository observations do not decide a feature result. Run the same scoped
+check directly with:
+
+```bash
+forge qa my-feature --ssat specs/my-feature.ssat.yaml --root . --strict
+```
+
+`forge qa --repo-wide --root .` remains available for an explicit inventory,
+but is labeled `repo_wide` in its receipt and is not a substitute for reviewed
+feature evidence. Dependency, build, cache, virtual-environment, and generated
+receipt trees are pruned before either scan. Disappearing optional paths are
+reported as skipped instead of crashing the gate.
+
+Source parsing is extension-aware: Python uses its AST; JavaScript and
+TypeScript use Node/TypeScript when available. An unavailable parser is reported
+as `parser_unsupported`, never misreported as Python syntax. Complexity above
+the hard threshold (10) cannot receive a passing grade.
+
+Regex invariants must declare a reviewed bounded scope: SSAT module, symbol,
+and `max_lines`. An unscoped pattern blocks as `E_INVARIANT_SCOPE`; a match in
+the bounded symbol blocks as `E_INVARIANT`. This prevents a broad regex from
+accidentally judging unrelated code.
+
+Every installed CLI can identify the running package without guessing from a
+checkout:
+
+```bash
+forge --version --json
+forge version --json
+```
+
+The JSON includes package/version, install origin, Python version, and explicit
+`null` values when a source commit or build hash was not embedded in the wheel.
+
 ## The five-brick factory
 
 | Repo | Tier | Owns |
@@ -339,7 +377,7 @@ the mutant is the real generated stub.
 ## Failure attribution and refinement
 
 ForgeLine 0.5 reports review, architecture, QA, smoke, and intent failures at
-their smallest actionable unit. `forge qa --root .` includes function-level
+their smallest actionable unit. `forge qa <feature> --ssat <feature.ssat.yaml>` includes function-level
 metrics and attribution in its JSON output.
 
 The refinement engine accepts exactly one proposed edit at a time. Structural

{code_factory_2_forge-0.9.2 → code_factory_2_forge-0.10.1}/README.md

@@ -189,7 +189,7 @@ the build. Full PRD-to-production traceability, enforced — not documented.
 
 ForgeLine now audits quality quantitatively and **learns from its own runs**:
 
-**Deep QA audit** (`forge qa`) grades every build on coverage-intent (do tests
+**Deep QA audit** (`forge qa <feature> --ssat <feature.ssat.yaml>`) grades the declared feature slice on coverage-intent (do tests
 actually call the functions?), cyclomatic complexity, a scored security surface
 (eval/exec/shell/secrets/weak-crypto), and documentation — a composite A–F grade
 that gates shipping. A pretty build with untested, over-complex, or insecure
@@ -212,6 +212,44 @@ cycle in 15 seconds.
 (normal → elevated "fix all findings" → final "human review required") instead
 of a flat retry cap.
 
+## v0.10 - Safe feature QA and provenance
+
+ForgeLine now treats an SSAT as the ownership boundary for a gate. `forge review`
+uses only its declared source modules for adversarial and QA findings; unrelated
+repository observations do not decide a feature result. Run the same scoped
+check directly with:
+
+```bash
+forge qa my-feature --ssat specs/my-feature.ssat.yaml --root . --strict
+```
+
+`forge qa --repo-wide --root .` remains available for an explicit inventory,
+but is labeled `repo_wide` in its receipt and is not a substitute for reviewed
+feature evidence. Dependency, build, cache, virtual-environment, and generated
+receipt trees are pruned before either scan. Disappearing optional paths are
+reported as skipped instead of crashing the gate.
+
+Source parsing is extension-aware: Python uses its AST; JavaScript and
+TypeScript use Node/TypeScript when available. An unavailable parser is reported
+as `parser_unsupported`, never misreported as Python syntax. Complexity above
+the hard threshold (10) cannot receive a passing grade.
+
+Regex invariants must declare a reviewed bounded scope: SSAT module, symbol,
+and `max_lines`. An unscoped pattern blocks as `E_INVARIANT_SCOPE`; a match in
+the bounded symbol blocks as `E_INVARIANT`. This prevents a broad regex from
+accidentally judging unrelated code.
+
+Every installed CLI can identify the running package without guessing from a
+checkout:
+
+```bash
+forge --version --json
+forge version --json
+```
+
+The JSON includes package/version, install origin, Python version, and explicit
+`null` values when a source commit or build hash was not embedded in the wheel.
+
 ## The five-brick factory
 
 | Repo | Tier | Owns |
@@ -321,7 +359,7 @@ the mutant is the real generated stub.
 ## Failure attribution and refinement
 
 ForgeLine 0.5 reports review, architecture, QA, smoke, and intent failures at
-their smallest actionable unit. `forge qa --root .` includes function-level
+their smallest actionable unit. `forge qa <feature> --ssat <feature.ssat.yaml>` includes function-level
 metrics and attribution in its JSON output.
 
 The refinement engine accepts exactly one proposed edit at a time. Structural

{code_factory_2_forge-0.9.2 → code_factory_2_forge-0.10.1/code_factory_2_forge.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-factory-2-forge
-Version: 0.9.2
+Version: 0.10.1
 Summary: ForgeLine — the autonomous outer loop for AI software factories. A CLI-backed state machine that drives intent -> spec -> plan -> code -> adversarial review -> ship, orchestrating SpecLine (spec governance) and Harness Software Factory (compiled decisions), with self-improving skills and architecture-as-a-CI-gate.
 License-Expression: MIT OR Apache-2.0
 Project-URL: Homepage, https://github.com/zrk222/code-factory-2-forge
@@ -207,7 +207,7 @@ the build. Full PRD-to-production traceability, enforced — not documented.
 
 ForgeLine now audits quality quantitatively and **learns from its own runs**:
 
-**Deep QA audit** (`forge qa`) grades every build on coverage-intent (do tests
+**Deep QA audit** (`forge qa <feature> --ssat <feature.ssat.yaml>`) grades the declared feature slice on coverage-intent (do tests
 actually call the functions?), cyclomatic complexity, a scored security surface
 (eval/exec/shell/secrets/weak-crypto), and documentation — a composite A–F grade
 that gates shipping. A pretty build with untested, over-complex, or insecure
@@ -230,6 +230,44 @@ cycle in 15 seconds.
 (normal → elevated "fix all findings" → final "human review required") instead
 of a flat retry cap.
 
+## v0.10 - Safe feature QA and provenance
+
+ForgeLine now treats an SSAT as the ownership boundary for a gate. `forge review`
+uses only its declared source modules for adversarial and QA findings; unrelated
+repository observations do not decide a feature result. Run the same scoped
+check directly with:
+
+```bash
+forge qa my-feature --ssat specs/my-feature.ssat.yaml --root . --strict
+```
+
+`forge qa --repo-wide --root .` remains available for an explicit inventory,
+but is labeled `repo_wide` in its receipt and is not a substitute for reviewed
+feature evidence. Dependency, build, cache, virtual-environment, and generated
+receipt trees are pruned before either scan. Disappearing optional paths are
+reported as skipped instead of crashing the gate.
+
+Source parsing is extension-aware: Python uses its AST; JavaScript and
+TypeScript use Node/TypeScript when available. An unavailable parser is reported
+as `parser_unsupported`, never misreported as Python syntax. Complexity above
+the hard threshold (10) cannot receive a passing grade.
+
+Regex invariants must declare a reviewed bounded scope: SSAT module, symbol,
+and `max_lines`. An unscoped pattern blocks as `E_INVARIANT_SCOPE`; a match in
+the bounded symbol blocks as `E_INVARIANT`. This prevents a broad regex from
+accidentally judging unrelated code.
+
+Every installed CLI can identify the running package without guessing from a
+checkout:
+
+```bash
+forge --version --json
+forge version --json
+```
+
+The JSON includes package/version, install origin, Python version, and explicit
+`null` values when a source commit or build hash was not embedded in the wheel.
+
 ## The five-brick factory
 
 | Repo | Tier | Owns |
@@ -339,7 +377,7 @@ the mutant is the real generated stub.
 ## Failure attribution and refinement
 
 ForgeLine 0.5 reports review, architecture, QA, smoke, and intent failures at
-their smallest actionable unit. `forge qa --root .` includes function-level
+their smallest actionable unit. `forge qa <feature> --ssat <feature.ssat.yaml>` includes function-level
 metrics and attribution in its JSON output.
 
 The refinement engine accepts exactly one proposed edit at a time. Structural

{code_factory_2_forge-0.9.2 → code_factory_2_forge-0.10.1}/code_factory_2_forge.egg-info/SOURCES.txt

@@ -20,9 +20,11 @@ forgeline/intent_thread.py
 forgeline/learning.py
 forgeline/orchestrator.py
 forgeline/pr_optimizer.py
+forgeline/provenance.py
 forgeline/refinement.py
 forgeline/run_store.py
 forgeline/skill_memory.py
+forgeline/source_scope.py
 forgeline/ssat.py
 forgeline/states.py
 forgeline/gates/__init__.py

{code_factory_2_forge-0.9.2 → code_factory_2_forge-0.10.1}/forgeline/__init__.py

@@ -11,4 +11,4 @@ hard CI gate, and learning from every run via an evolving skill memory.
                          └──────── refine loop ─────────┘
                                    skill memory learns each pass
 """
-__version__ = "0.9.1"
+__version__ = "0.10.1"

{code_factory_2_forge-0.9.2 → code_factory_2_forge-0.10.1}/forgeline/adoption.py

@@ -7,13 +7,11 @@ import re
 
 import yaml
 
-
-IGNORED = {".git", "node_modules", "dist", "build", ".next", "coverage", ".forge", ".venv", "venv"}
+from .source_scope import iter_source_files
 
 
 def _files(root: Path, suffixes: set[str]) -> list[Path]:
-    return [path for path in root.rglob("*") if path.is_file() and path.suffix in suffixes
-            and not any(part in IGNORED for part in path.parts)]
+    return iter_source_files(root, suffixes=suffixes)
 
 
 def _functions(path: Path, language: str) -> list[dict]:

{code_factory_2_forge-0.9.2 → code_factory_2_forge-0.10.1}/forgeline/attribution.py

@@ -10,6 +10,9 @@ class FailureClass(str, Enum):
     INVENTED_PARAM = "invented_param"
     SIGNATURE_DRIFT = "signature_drift"
     STUB_UNFILLED = "stub_unfilled"
+    PARSER_UNSUPPORTED = "parser_unsupported"
+    SYNTAX_ERROR = "syntax_error"
+    INVARIANT_VIOLATION = "invariant_violation"
     COMPLEXITY_EXCEEDED = "complexity_exceeded"
     INCONSISTENT_LOGIC = "inconsistent_logic"
     RUNTIME_CRASH = "runtime_crash"

{code_factory_2_forge-0.9.2 → code_factory_2_forge-0.10.1}/forgeline/cli.py

@@ -1,6 +1,6 @@
 """forge CLI — the state-machine driver."""
 from __future__ import annotations
-import argparse, json
+import argparse, json, sys
 from pathlib import Path
 from .states import State, TRANSITIONS, HUMAN_GATES
 from .run_store import RunStore
@@ -20,10 +20,20 @@ NEXT_ACTION = {
     State.SHIPPED: "done ✓",
 }
 
+def _emit_version(as_json: bool) -> None:
+    from .provenance import provenance
+    payload = provenance()
+    print(json.dumps(payload, indent=2, sort_keys=True) if as_json else f"forge {payload['version']}")
+
+
 def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    if argv and argv[0] == "--version":
+        _emit_version("--json" in argv)
+        return
     p = argparse.ArgumentParser(prog="forge", description="ForgeLine — autonomous software factory outer loop")
     sub = p.add_subparsers(required=True, dest="cmd")
-    for name in ["init","adopt","status","expand","gate","architect","fill","review","arch-gate","verify-tests","verify-tests-ts","challenge","smoke","ship","handoff","agent","lessons","policy","qa","optimize-pr","demo","demo-learning"]:
+    for name in ["init","adopt","status","expand","gate","architect","fill","review","arch-gate","verify-tests","verify-tests-ts","challenge","smoke","ship","handoff","agent","lessons","policy","qa","optimize-pr","demo","demo-learning","version"]:
         sp = sub.add_parser(name)
         if name == "init": sp.add_argument("--root", default=".")
         elif name in {"architect","fill","review","arch-gate","verify-tests"}:
@@ -43,15 +53,21 @@ def main(argv=None):
         elif name == "handoff": sp.add_argument("feature"); sp.add_argument("spec"); sp.add_argument("--root", default=".")
         elif name == "lessons": sp.add_argument("--root", default=".")
         elif name == "policy": sp.add_argument("--root", default=".")
-        elif name == "qa": sp.add_argument("--root", default="."); sp.add_argument("--strict", action="store_true")
+        elif name == "qa":
+            sp.add_argument("feature", nargs="?"); sp.add_argument("--ssat", default=None)
+            sp.add_argument("--repo-wide", action="store_true")
+            sp.add_argument("--root", default="."); sp.add_argument("--strict", action="store_true")
         elif name == "optimize-pr": sp.add_argument("feature", nargs="?"); sp.add_argument("--root", default="."); sp.add_argument("--base", default="main")
+        elif name == "version": sp.add_argument("--json", action="store_true")
         elif name == "demo": pass
         elif name == "demo-learning": pass
         elif name == "demo-learning": pass
         else: sp.add_argument("feature", nargs="?"); sp.add_argument("--root", default=".")
     a = p.parse_args(argv); root = Path(getattr(a, "root", "."))
 
-    if a.cmd == "init":
+    if a.cmd == "version":
+        _emit_version(a.json)
+    elif a.cmd == "init":
         (root/".forge").mkdir(parents=True, exist_ok=True)
         (root/"skills").mkdir(exist_ok=True)
         print("ForgeLine initialized. Next: forge agent claude|codex, then forge expand <feature>")
@@ -138,7 +154,17 @@ def main(argv=None):
         print(json.dumps(LearningKernel(root).policy_summary(), indent=2))
     elif a.cmd == "qa":
         from .gates.qa_audit import qa_audit
-        r = qa_audit(root)
+        from .source_scope import declared_paths
+        from .ssat import load_ssat
+        if not a.repo_wide and not a.ssat:
+            print(json.dumps({"passed": False, "error": {
+                "code": "E_SCOPE_REQUIRED",
+                "message": "feature QA requires --ssat; use --repo-wide only for an explicitly non-gating inventory",
+                "next": "forge qa <feature> --ssat <feature.ssat.yaml> --root .",
+            }}, indent=2))
+            raise SystemExit(2)
+        source_paths = None if a.repo_wide else declared_paths(root, load_ssat(Path(a.ssat)))
+        r = qa_audit(root, source_paths=source_paths)
         print(json.dumps({"grade": r.grade, "passed": r.passed, "metrics": r.metrics,
                           "findings": r.findings,
                           "attribution": r.attribution.to_dict()}, indent=2))

code_factory_2_forge-0.10.1/forgeline/gates/adversary.py

@@ -0,0 +1,66 @@
+"""The grumpy adversary — assumes the code is broken/insecure and makes the
+generator prove otherwise. Executable heuristics (no LLM needed to be
+useful); an optional LLM adversary can be layered behind the same interface.
+It does NOT need to be right — it needs to force proof (tests + arch completeness)."""
+from __future__ import annotations
+import ast, re
+from pathlib import Path
+from typing import Iterable
+
+from ..source_scope import SOURCE_SUFFIXES, analyze_source, iter_source_files
+
+DANGER = {
+    "eval(": "A_EVAL arbitrary eval",
+    "exec(": "A_EXEC arbitrary exec",
+    "os.system": "A_SHELL shell execution",
+    "subprocess": "A_SUBPROC subprocess use",
+    "pickle.load": "A_PICKLE unsafe deserialization",
+    "verify=False": "A_TLS TLS verification disabled",
+    "shell=True": "A_SHELL_TRUE shell=True injection surface",
+}
+SECRET = re.compile(r"(?i)(api[_-]?key|secret|password|token)\s*=\s*['\"][A-Za-z0-9/\+_-]{12,}['\"]")
+
+def grumpy_review(
+    src_dir: Path,
+    require_tests: bool = True,
+    *,
+    source_paths: Iterable[Path] | None = None,
+    test_paths: Iterable[Path] | None = None,
+) -> tuple[bool, list[str]]:
+    """Returns (satisfied, complaints). Grumpy is satisfied only when it can
+    find NO obvious sin AND the generator supplied tests to prove correctness."""
+    src_dir = Path(src_dir).resolve(); complaints = []
+    inventory = (
+        iter_source_files(src_dir, paths=source_paths)
+        if source_paths is not None
+        else iter_source_files(src_dir, suffixes=SOURCE_SUFFIXES)
+    )
+    for p in inventory:
+        if p.name.startswith("test_") or p.parent.name in {"tests", "test", "__tests__"} or ".test." in p.name or ".spec." in p.name:
+            continue
+        parsed = analyze_source(p, src_dir)
+        text = parsed["text"]
+        for needle, msg in DANGER.items():
+            if needle in text:
+                complaints.append(f"{msg} in {p.relative_to(src_dir).as_posix()}")
+        if SECRET.search(text):
+            complaints.append(f"A_SECRET hard-coded credential in {p.relative_to(src_dir).as_posix()}")
+        # bare except = hiding failure, which grumpy hates
+        if parsed["language"] == "python" and parsed["status"] == "ok":
+            for node in ast.walk(parsed["tree"]):
+                if isinstance(node, ast.ExceptHandler) and node.type is None:
+                    complaints.append(f"A_BARE_EXCEPT swallowed error in {p.relative_to(src_dir).as_posix()}")
+        elif parsed["status"] == "syntax_error":
+            complaints.append(f"A_SYNTAX {p.relative_to(src_dir).as_posix()} does not parse")
+        elif parsed["status"] == "parser_unsupported":
+            complaints.append(f"A_PARSER_UNSUPPORTED {p.relative_to(src_dir).as_posix()}: {parsed.get('reason', parsed['language'])}")
+    if require_tests:
+        test_inventory = (
+            iter_source_files(src_dir, paths=test_paths)
+            if test_paths is not None
+            else iter_source_files(src_dir, suffixes=SOURCE_SUFFIXES)
+        )
+        test_files = [p for p in test_inventory if p.name.startswith("test_") or p.parent.name in {"tests", "test", "__tests__"} or ".test." in p.name or ".spec." in p.name]
+        if not test_files:
+            complaints.append("A_NO_PROOF no tests supplied — prove it works")
+    return (len(complaints) == 0, complaints)

{code_factory_2_forge-0.9.2 → code_factory_2_forge-0.10.1}/forgeline/gates/judge.py

@@ -2,9 +2,9 @@
 Checks the filled code matches the SSAT scaffold: no stubs left, every
 declared function implemented, imports resolve within the tree."""
 from __future__ import annotations
-import ast
 from pathlib import Path
 from ..ssat import check_erosion
+from ..source_scope import analyze_source
 
 def judge_consistency(ssat: dict, src_dir: Path) -> tuple[bool, list[str]]:
     findings = []
@@ -13,13 +13,14 @@ def judge_consistency(ssat: dict, src_dir: Path) -> tuple[bool, list[str]]:
         p = src_dir/mod["path"]
         if not p.exists():
             findings.append(f"J_MISSING {mod['path']}"); continue
-        text = p.read_text()
-        if "raise NotImplementedError" in text or "# FILL" in text or "TODO" in text:
+        parsed = analyze_source(p, src_dir)
+        text = parsed["text"]
+        if "raise NotImplementedError" in text or "# FILL" in text:
             findings.append(f"J_STUB unfilled body in {mod['path']}")
-        try:
-            ast.parse(text)
-        except SyntaxError as e:
-            findings.append(f"J_SYNTAX {mod['path']}: {e}")
+        if parsed["status"] == "syntax_error":
+            findings.append(f"J_SYNTAX {mod['path']}: {parsed['error']}")
+        elif parsed["status"] == "parser_unsupported":
+            findings.append(f"J_PARSER_UNSUPPORTED {mod['path']}: {parsed.get('reason', parsed['language'])}")
     # structural erosion is a judge concern too
     for v in check_erosion(ssat, src_dir):
         findings.append(f"J_ARCH {v.code} {v.message}")

code_factory_2_forge-0.10.1/forgeline/gates/qa_audit.py

@@ -0,0 +1,157 @@
+"""Feature-scoped, language-aware QA evidence with explicit hard thresholds."""
+from __future__ import annotations
+
+import ast
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Iterable
+
+from ..source_scope import SOURCE_SUFFIXES, analyze_source, iter_source_files, read_text
+
+COMPLEXITY_LIMIT = 10
+
+
+@dataclass
+class QAReport:
+    coverage_intent: float = 0.0
+    max_complexity: int = 0
+    security_score: int = 100
+    doc_ratio: float = 0.0
+    grade: str = "F"
+    findings: list[str] = field(default_factory=list)
+    metrics: dict = field(default_factory=dict)
+    function_metrics: list[dict] = field(default_factory=list)
+    skipped_paths: list[str] = field(default_factory=list)
+    scope: dict = field(default_factory=dict)
+
+    @property
+    def passed(self) -> bool:
+        return self.grade in ("A", "B") and self.security_score >= 80 and self.max_complexity <= COMPLEXITY_LIMIT
+
+    @property
+    def attribution(self):
+        from ..attribution import Attribution, FailureClass, UnitResult
+        units = []
+        for metric in self.function_metrics:
+            failures = []
+            failure_class = metric.get("failure_class")
+            if metric["complexity"] > COMPLEXITY_LIMIT:
+                failures.append(f"complexity={metric['complexity']}; threshold={COMPLEXITY_LIMIT}; policy=hard")
+                failure_class = FailureClass.COMPLEXITY_EXCEEDED
+            if not metric["tested"]:
+                failures.append("coverage_intent=0; required=1")
+                failure_class = failure_class or FailureClass.INCONSISTENT_LOGIC
+            units.append(UnitResult(
+                unit=f"qa_audit:{metric['function']}", stage="qa_audit", passed=not failures,
+                evidence="metrics within thresholds" if not failures else "; ".join(failures),
+                failure_class=failure_class,
+            ))
+        for finding in self.findings:
+            if finding.startswith("QA_PARSER_UNSUPPORTED"):
+                units.append(UnitResult(f"qa_audit:{finding.split()[1]}", "qa_audit", False, finding, FailureClass.PARSER_UNSUPPORTED))
+            elif finding.startswith("QA_SYNTAX"):
+                units.append(UnitResult(f"qa_audit:{finding.split()[1]}", "qa_audit", False, finding, FailureClass.SYNTAX_ERROR))
+        if not units:
+            units.append(UnitResult("qa_audit:<no-public-functions>", "qa_audit", False,
+                                    "no supported public functions were available to grade", FailureClass.PARSER_UNSUPPORTED))
+        return Attribution("qa_audit", len(units), sum(unit.passed for unit in units), units)
+
+
+def _complexity(node: ast.FunctionDef) -> int:
+    value = 1
+    for child in ast.walk(node):
+        if isinstance(child, (ast.If, ast.For, ast.While, ast.ExceptHandler, ast.With, ast.Assert)):
+            value += 1
+        elif isinstance(child, ast.BoolOp):
+            value += len(child.values) - 1
+        elif isinstance(child, ast.IfExp):
+            value += 1
+    return value
+
+
+SEC_PATTERNS = {
+    r"\beval\(": ("CRITICAL", 40, "eval() - arbitrary code execution"),
+    r"\bexec\(": ("CRITICAL", 40, "exec() - arbitrary code execution"),
+    r"shell\s*=\s*True": ("HIGH", 25, "shell=True - command injection surface"),
+    r"pickle\.loads?\(": ("HIGH", 20, "pickle - unsafe deserialization"),
+    r"verify\s*=\s*False": ("HIGH", 20, "TLS verification disabled"),
+    r"(?i)(password|secret|api_key|token)\s*=\s*['\"][^'\"]{8,}": ("CRITICAL", 40, "hard-coded credential"),
+    r"md5\(": ("MEDIUM", 10, "MD5 - weak hash"),
+    r"random\.random\(\)": ("LOW", 5, "non-cryptographic randomness"),
+}
+
+
+def _is_test(path: Path) -> bool:
+    return path.name.startswith("test_") or path.parent.name in {"tests", "test", "__tests__"} or ".test." in path.name or ".spec." in path.name
+
+
+def _metric(report: QAReport, path: Path, name: str, complexity: int, documented: bool, test_text: str, root: Path) -> None:
+    tested = bool(re.search(rf"\b{re.escape(name)}\b", test_text)) and not name.startswith("<anonymous")
+    report.function_metrics.append({
+        "function": f"{path.relative_to(root).as_posix()}:{name}", "complexity": complexity,
+        "tested": tested, "documented": documented,
+    })
+
+
+def qa_audit(src_dir: Path, *, source_paths: Iterable[Path] | None = None) -> QAReport:
+    """Grade a reviewed feature slice, or an explicitly requested pruned repository scan."""
+    root = Path(src_dir).resolve()
+    report = QAReport(scope={"kind": "feature" if source_paths is not None else "repo_wide"})
+    inventory = (
+        iter_source_files(root, paths=source_paths, skipped=report.skipped_paths)
+        if source_paths is not None
+        else iter_source_files(root, suffixes=SOURCE_SUFFIXES, skipped=report.skipped_paths)
+    )
+    code_files = [path for path in inventory if not _is_test(path)]
+    test_files = [path for path in iter_source_files(root, suffixes=SOURCE_SUFFIXES, skipped=report.skipped_paths) if _is_test(path)]
+    report.scope["code_files"] = [path.relative_to(root).as_posix() for path in code_files]
+    test_text = "\n".join(text for path in test_files if (text := read_text(path, report.skipped_paths)) is not None)
+
+    for path in code_files:
+        parsed = analyze_source(path, root)
+        status = parsed["status"]
+        if status == "parser_unsupported":
+            report.findings.append(f"QA_PARSER_UNSUPPORTED {path.relative_to(root).as_posix()}: {parsed.get('reason', parsed['language'])}")
+            continue
+        if status == "syntax_error":
+            report.findings.append(f"QA_SYNTAX {path.relative_to(root).as_posix()}: {parsed['error']}")
+            continue
+        text = parsed["text"]
+        if parsed["language"] == "python":
+            for node in ast.walk(parsed["tree"]):
+                if isinstance(node, ast.FunctionDef) and not node.name.startswith("_"):
+                    _metric(report, path, node.name, _complexity(node), bool(ast.get_docstring(node)), test_text, root)
+        else:
+            for function in parsed.get("functions", []):
+                _metric(report, path, function["name"], function["complexity"], bool(function["documented"]), test_text, root)
+        for pattern, (severity, deduction, message) in SEC_PATTERNS.items():
+            if re.search(pattern, text):
+                report.security_score -= deduction
+                report.findings.append(f"QA_SEC[{severity}] {message} in {path.relative_to(root).as_posix()}")
+
+    count = len(report.function_metrics) or 1
+    report.coverage_intent = round(sum(metric["tested"] for metric in report.function_metrics) / count, 2)
+    report.doc_ratio = round(sum(metric["documented"] for metric in report.function_metrics) / count, 2)
+    report.max_complexity = max((metric["complexity"] for metric in report.function_metrics), default=0)
+    report.security_score = max(report.security_score, 0)
+    for metric in report.function_metrics:
+        if metric["complexity"] > COMPLEXITY_LIMIT:
+            report.findings.append(f"QA_COMPLEXITY {metric['function']} complexity {metric['complexity']} > {COMPLEXITY_LIMIT}; policy=hard")
+
+    score = 35 * report.coverage_intent
+    score += 25 * (1 if report.max_complexity <= COMPLEXITY_LIMIT else max(0, 1 - (report.max_complexity - COMPLEXITY_LIMIT) / 10))
+    score += 25 * (report.security_score / 100)
+    score += 15 * report.doc_ratio
+    report.grade = "A" if score >= 85 else "B" if score >= 70 else "C" if score >= 55 else "D" if score >= 40 else "F"
+    if report.max_complexity > COMPLEXITY_LIMIT and report.grade in {"A", "B"}:
+        report.grade = "C"
+    if any(finding.startswith(("QA_SYNTAX", "QA_PARSER_UNSUPPORTED")) for finding in report.findings):
+        report.grade = "F"
+    report.metrics = {
+        "coverage_intent": report.coverage_intent, "max_complexity": report.max_complexity,
+        "security_score": report.security_score, "doc_ratio": report.doc_ratio,
+        "composite": round(score, 1), "complexity_policy": "hard",
+        "scope": report.scope, "skipped_paths": report.skipped_paths,
+    }
+    return report

{code_factory_2_forge-0.9.2 → code_factory_2_forge-0.10.1}/forgeline/gates/typescript_mutants.py

@@ -24,7 +24,11 @@ def verify_typescript_tests(root: Path, feature: str, manifest_path: Path | None
         return GateResult(False, Attribution("verify_tests_ts", 1, 0, [UnitResult("typescript:manifest", "verify_tests_ts", False, "TypeScript mutant manifest declares no reviewed mutants", FailureClass.HOLLOW_MANIFEST)]))
     tmp = Path(tempfile.mkdtemp(prefix="forge-ts-mutant-"))
     try:
-        shutil.copytree(root, tmp, dirs_exist_ok=True, ignore=shutil.ignore_patterns(".git", "node_modules", "dist", "build", ".next", "coverage", ".forge"))
+        shutil.copytree(root, tmp, dirs_exist_ok=True, ignore=shutil.ignore_patterns(
+            ".git", ".pnpm", "node_modules", "dist", "build", ".next", ".nuxt",
+            "coverage", ".forge", ".cache", "cache", "out", "output", "target",
+            ".venv", "venv", "__pycache__",
+        ))
         units = []
         for mutant in mutants:
             required = ("name", "path", "replace_regex", "command")