code-mower 0.5.0b43__tar.gz → 0.5.0b45__tar.gz

{code_mower-0.5.0b43 → code_mower-0.5.0b45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b43
+Version: 0.5.0b45
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b43
+pipx install --python python3.12 code-mower==0.5.0b45
 code-mower --version
 ```
 
-`0.5.0b43` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b45` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -155,7 +155,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b43`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b45`.
 
 ## Optional: Plan Before Coding
 
@@ -310,9 +310,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.43` from
+The current public beta is `v0.5.0-beta.45` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b43` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b45` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b43 → code_mower-0.5.0b45}/README.md

@@ -88,11 +88,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b43
+pipx install --python python3.12 code-mower==0.5.0b45
 code-mower --version
 ```
 
-`0.5.0b43` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b45` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -140,7 +140,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b43`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b45`.
 
 ## Optional: Plan Before Coding
 
@@ -295,9 +295,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.43` from
+The current public beta is `v0.5.0-beta.45` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b43` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b45` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b43 → code_mower-0.5.0b45}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b43"
+version = "0.5.0b45"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b43 → code_mower-0.5.0b45}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b43"
+__version__ = "0.5.0b45"

{code_mower-0.5.0b43 → code_mower-0.5.0b45}/src/code_mower/calibration/auto_discovery.py

@@ -12,6 +12,7 @@ from typing import Any, Mapping, Sequence
 from .corpus import parse_int
 from .identity import safe_slug
 from .run_status import RUN_STATUS_BLOCKED, RUN_STATUS_PASS, RUN_STATUS_UNKNOWN
+from ..provider_runners import is_fixture_verdict_comment
 
 AUTO_DISCOVERY_SCHEMA = "code_mower.calibrationAutoDiscover.v1"
 TRUTH_EXPECTATION_UNKNOWN = "unknown"
@@ -147,6 +148,8 @@ def _audit_runs_from_comments(comments: Sequence[Any]) -> list[dict[str, Any]]:
         body = str(comment.get("body") or "")
         if not body:
             continue
+        if is_fixture_verdict_comment(body):
+            continue
         for match in AUDIT_STATE_RE.finditer(body):
             state = match.group("state")
             reviewer = _provider_from_audit_state(match.group("provider"), state)

{code_mower-0.5.0b43 → code_mower-0.5.0b45}/src/code_mower/claude_audit_pr.py

@@ -32,11 +32,13 @@ if __package__ in {None, "", "tools"}:
         from tools.audit_progress import AuditProgress, run_subprocess_with_progress
         from tools.claude_cli_environment import clean_claude_cli_env, env_flag
         from tools.provider_runners import (
+            audit_runtime_quarantine_reason as _audit_runtime_quarantine_reason,
             clip_text as _clip_text,
             fetch_pull_request,
             fetch_base_ref_sha as _shared_fetch_base_ref_sha,
             fetch_pr_head_sha as _shared_fetch_pr_head_sha,
             fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
+            is_fixture_structured_verdict as _is_fixture_structured_verdict,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -58,11 +60,13 @@ if __package__ in {None, "", "tools"}:
         from audit_progress import AuditProgress, run_subprocess_with_progress  # type: ignore
         from claude_cli_environment import clean_claude_cli_env, env_flag  # type: ignore
         from provider_runners import (  # type: ignore
+            audit_runtime_quarantine_reason as _audit_runtime_quarantine_reason,
             clip_text as _clip_text,
             fetch_pull_request,
             fetch_base_ref_sha as _shared_fetch_base_ref_sha,
             fetch_pr_head_sha as _shared_fetch_pr_head_sha,
             fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
+            is_fixture_structured_verdict as _is_fixture_structured_verdict,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -82,11 +86,13 @@ else:  # pragma: no cover - exercised after package extraction.
     from .claude_cli_environment import clean_claude_cli_env, env_flag
     from .provider_runners import (
         FetchedHeadMismatch,
+        audit_runtime_quarantine_reason as _audit_runtime_quarantine_reason,
         clip_text as _clip_text,
         fetch_base_ref_sha as _shared_fetch_base_ref_sha,
         fetch_pull_request,
         fetch_pr_head_sha as _shared_fetch_pr_head_sha,
         fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
+        is_fixture_structured_verdict as _is_fixture_structured_verdict,
         limit_comment_body,
         one_line as _one_line,
         parse_repo_paths as _parse_repo_paths,
@@ -445,6 +451,29 @@ def _apply_claude_verdict_guardrails(
     return _unknown_structured_verdict(reason), reason
 
 
+def _fixture_structured_quarantine_reason(parsed: ClaudeVerdict) -> Optional[str]:
+    if _is_fixture_structured_verdict(parsed.summary, list(parsed.findings)):
+        return "fixture-shaped structured verdict rejected by guardrail"
+    return None
+
+
+def _quarantine_is_test_only(reason: Optional[str]) -> bool:
+    return reason == "PYTEST_CURRENT_TEST is set"
+
+
+def _comment_with_runtime_quarantine_note(comment_body: str, reason: str) -> str:
+    note = (
+        "\nRuntime quarantine: local verdict artifact was quarantined because "
+        f"{reason}. Posting UNKNOWN so the lane requeues visibly.\n"
+    )
+    marker = f"\n\n{STALE_TRAILER}"
+    if marker in comment_body:
+        body = comment_body.replace(marker, note + "\n" + STALE_TRAILER, 1)
+    else:
+        body = comment_body.rstrip() + note + "\n" + STALE_TRAILER + "\n"
+    return limit_comment_body(body, STALE_TRAILER, provider_name="Claude")
+
+
 def _write_claude_raw_output_sidecar(
     artifact_path: Optional[Path],
     attempts: List[Dict[str, Any]],
@@ -917,6 +946,7 @@ def format_comment(
 
 
 def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAuditResult:
+    audit_started = time.monotonic()
     local_repo = config.repo_paths.get(repo)
     if local_repo is None:
         raise ValueError(
@@ -996,6 +1026,9 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             parsed=parsed,
         )
         if not config.dry_run:
+            quarantine_reason = _audit_runtime_quarantine_reason(
+                comment_body=comment_body,
+            )
             artifact_path = write_audit_verdict_artifact(
                 lane_id="claude-audit",
                 repo=repo,
@@ -1005,6 +1038,8 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                 verdict=result.verdict,
                 trailer=result.trailer,
                 comment_body=comment_body,
+                quarantine_reason=quarantine_reason,
+                duration_seconds=time.monotonic() - audit_started,
             )
             result.verdict_artifact_path = artifact_path
             if artifact_path is not None:
@@ -1013,17 +1048,35 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                     file=sys.stderr,
                     flush=True,
                 )
-            posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
-            result.posted_comment_url = posted.get("html_url")
-            _record_posted_comment_url(
-                result.verdict_artifact_path,
-                result.posted_comment_url,
-            )
-            print(
-                f"posted {repo}#{pr_number} verdict=STALE "
-                f"url={result.posted_comment_url}",
-                file=sys.stderr,
-            )
+            if quarantine_reason:
+                print(
+                    "  runtime guard quarantined verdict artifact: "
+                    f"{quarantine_reason}",
+                    file=sys.stderr,
+                    flush=True,
+                )
+            if quarantine_reason and _quarantine_is_test_only(quarantine_reason):
+                print("  skipped GitHub post for pytest-only quarantine", file=sys.stderr, flush=True)
+            else:
+                if quarantine_reason:
+                    result.verdict = "UNKNOWN"
+                    result.trailer = STALE_TRAILER
+                    comment_body = _comment_with_runtime_quarantine_note(
+                        comment_body,
+                        quarantine_reason,
+                    )
+                    result.comment_body = comment_body
+                posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
+                result.posted_comment_url = posted.get("html_url")
+                _record_posted_comment_url(
+                    result.verdict_artifact_path,
+                    result.posted_comment_url,
+                )
+                print(
+                    f"posted {repo}#{pr_number} verdict=STALE "
+                    f"url={result.posted_comment_url}",
+                    file=sys.stderr,
+                )
         config.progress.emit(
             "audit",
             status="finish",
@@ -1082,6 +1135,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
     claude_stdout = ""
     claude_stderr = ""
     attempt_prompt = prompt
+    final_fixture_reason: Optional[str] = None
     t0 = time.time()
     for attempt in range(1, MAX_CLAUDE_AUDIT_ATTEMPTS + 1):
         parsed_candidate, attempt_stdout, attempt_stderr = run_claude_audit(
@@ -1094,6 +1148,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             parsed_candidate,
             diff_context.changed_files,
         )
+        final_fixture_reason = _fixture_structured_quarantine_reason(parsed_candidate)
         raw_output_attempts.append(
             {
                 "attempt": attempt,
@@ -1172,6 +1227,10 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
     )
 
     if not config.dry_run:
+        quarantine_reason = _audit_runtime_quarantine_reason(
+            comment_body=comment_body,
+            fixture_reason=final_fixture_reason if parsed.verdict == "UNKNOWN" else None,
+        )
         artifact_path = write_audit_verdict_artifact(
             lane_id="claude-audit",
             repo=repo,
@@ -1181,6 +1240,8 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             verdict=result_verdict,
             trailer=trailer,
             comment_body=comment_body,
+            quarantine_reason=quarantine_reason,
+            duration_seconds=time.monotonic() - audit_started,
         )
         result.verdict_artifact_path = artifact_path
         if artifact_path is not None:
@@ -1190,21 +1251,39 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                 flush=True,
             )
             _write_claude_raw_output_sidecar(artifact_path, raw_output_attempts)
-        posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
-        result.posted_comment_url = posted.get("html_url")
-        _record_posted_comment_url(
-            result.verdict_artifact_path,
-            result.posted_comment_url,
-        )
-        print(
-            f"posted {repo}#{pr_number} verdict={result_verdict} "
-            f"url={result.posted_comment_url}",
-            file=sys.stderr,
-        )
+        if quarantine_reason:
+            print(
+                "  runtime guard quarantined verdict artifact: "
+                f"{quarantine_reason}",
+                file=sys.stderr,
+                flush=True,
+            )
+        if quarantine_reason and _quarantine_is_test_only(quarantine_reason):
+            print("  skipped GitHub post for pytest-only quarantine", file=sys.stderr, flush=True)
+        else:
+            if quarantine_reason:
+                result.verdict = "UNKNOWN"
+                result.trailer = STALE_TRAILER
+                comment_body = _comment_with_runtime_quarantine_note(
+                    comment_body,
+                    quarantine_reason,
+                )
+                result.comment_body = comment_body
+            posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
+            result.posted_comment_url = posted.get("html_url")
+            _record_posted_comment_url(
+                result.verdict_artifact_path,
+                result.posted_comment_url,
+            )
+            print(
+                f"posted {repo}#{pr_number} verdict={result_verdict} "
+                f"url={result.posted_comment_url}",
+                file=sys.stderr,
+            )
     config.progress.emit(
         "audit",
         status="finish",
-        detail=f"{repo}#{pr_number} verdict={result_verdict}",
+        detail=f"{repo}#{pr_number} verdict={result.verdict}",
     )
     return result
 

{code_mower-0.5.0b43 → code_mower-0.5.0b45}/src/code_mower/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 if __package__ in {None, ""}:
     raise SystemExit(
         "code_mower.cli is a packaged entrypoint. Install Code Mower with "
-        "`pipx install code-mower==0.5.0b43`, or run source checkouts with "
+        "`pipx install code-mower==0.5.0b45`, or run source checkouts with "
         "`PYTHONPATH=src python -m code_mower.cli`."
     )
 
@@ -40,6 +40,7 @@ from . import code_mower_telemetry
 from . import config as code_mower_config
 from . import doctor as code_mower_doctor
 from . import gemini_cli_audit_pr
+from . import gate_health as code_mower_gate_health
 from . import grok_build_audit_pr
 from . import hermes_cli_audit_pr
 from . import init as code_mower_init
@@ -398,6 +399,7 @@ COMMAND_DESCRIPTIONS: dict[str, str] = {
     "codex-audit-schema-smoke": "Smoke-test Codex audit schema parsing.",
     "doctor": "Check runtime, GitHub, providers, privacy, and cloud setup.",
     "gemini-cli": "Run a Gemini CLI structured audit lane.",
+    "gate-health": "Alert when audit gate infrastructure stalls.",
     "grok-build": "Run a Grok Build informational audit lane.",
     "hermes-cli": "Run a Hermes CLI structured audit lane.",
     "init": "Render safe easy-mode setup output.",
@@ -529,6 +531,7 @@ COMMAND_HANDLERS: dict[str, CommandHandler] = {
     "codex-audit-schema-smoke": codex_audit_schema_smoke.main,
     "doctor": code_mower_doctor.main,
     "gemini-cli": gemini_cli_audit_pr.main,
+    "gate-health": code_mower_gate_health.main,
     "grok-build": grok_build_audit_pr.main,
     "hermes-cli": hermes_cli_audit_pr.main,
     "init": _init_main,

{code_mower-0.5.0b43 → code_mower-0.5.0b45}/src/code_mower/code_mower_telemetry.py

@@ -6,6 +6,7 @@ from __future__ import annotations
 import argparse
 import hashlib
 import json
+import math
 import os
 import re
 import sys
@@ -18,12 +19,16 @@ if __package__ in {None, ""}:
     sys.path.insert(0, str(module_dir.parent))
     if module_dir.name == "code_mower":  # pragma: no cover - extracted direct CLI.
         from code_mower import audit_handoff_log
+        from code_mower.provider_runners import is_fixture_verdict_artifact
     else:
         from tools import audit_handoff_log
+        from tools.provider_runners import is_fixture_verdict_artifact
 elif __package__ == "tools":
     from tools import audit_handoff_log
+    from tools.provider_runners import is_fixture_verdict_artifact
 else:  # pragma: no cover - exercised after package extraction.
     from . import audit_handoff_log
+    from .provider_runners import is_fixture_verdict_artifact
 
 
 PASS_VERDICTS = {"completed", "done", "pass", "passed", "success", "succeeded"}
@@ -31,7 +36,6 @@ BLOCKED_VERDICTS = {"block", "blocked", "fail", "failed", "failure"}
 VERDICT_ARTIFACT_SCHEMA = "code_mower.auditVerdictArtifact.v1"
 BENCHMARK_EVENT_SCHEMA = "code_mower.benchmarkEvent.v1"
 VERDICT_ARTIFACT_DIR_ENV = "CODE_MOWER_VERDICT_ARTIFACT_DIR"
-DEFAULT_VERDICT_ARTIFACT_DIR = Path.home() / ".cache" / "code-mower-audits" / "verdicts"
 SEVERITY_RE = re.compile(r"\b(P[0-3])=(\d+)\b")
 AUDIT_TRAILER_RE = re.compile(
     r"<!--\s*(?P<prefix>[A-Z0-9_]+_AUDIT_STATE)\s*:\s*(?P<label>[a-z0-9_.-]+)\s*-->",
@@ -43,7 +47,10 @@ def default_verdict_artifact_dir() -> Path:
     configured = os.environ.get(VERDICT_ARTIFACT_DIR_ENV, "").strip()
     if configured:
         return Path(configured).expanduser()
-    return DEFAULT_VERDICT_ARTIFACT_DIR
+    cache_home = os.environ.get("XDG_CACHE_HOME", "").strip()
+    if cache_home:
+        return Path(cache_home).expanduser() / "code-mower-audits" / "verdicts"
+    return Path.home() / ".cache" / "code-mower-audits" / "verdicts"
 
 
 def _normalize_repo_slug(value: str) -> str:
@@ -115,6 +122,19 @@ def _artifact_severity_counts(payload: Mapping[str, Any]) -> tuple[dict[str, int
     return comment_counts, "unavailable"
 
 
+def _artifact_duration_seconds(payload: Mapping[str, Any]) -> float | None:
+    raw = payload.get("duration_seconds")
+    if raw is None:
+        return None
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        return None
+    if not math.isfinite(value) or value < 0:
+        return None
+    return round(value, 3)
+
+
 def _normal_artifact_verdict(value: Any) -> str:
     verdict = str(value or "").strip().lower()
     if verdict in PASS_VERDICTS:
@@ -199,6 +219,17 @@ def reviewer_run_event_from_verdict_artifact(
         head = str(payload.get("head_sha_end") or payload.get("head_sha_start") or "")
         dimensions["head_sha"] = head
         dimensions["head_sha_short"] = head[:12]
+    metrics: dict[str, Any] = {
+        "finding_count": finding_count,
+        "p0_count": severities["p0"],
+        "p1_count": severities["p1"],
+        "p2_count": severities["p2"],
+        "p3_count": severities["p3"],
+    }
+    duration_seconds = _artifact_duration_seconds(payload)
+    if duration_seconds is not None:
+        metrics["duration_seconds_total"] = duration_seconds
+        dimensions["duration_source"] = "verdict_artifact"
     return {
         "schema": BENCHMARK_EVENT_SCHEMA,
         "event_type": "reviewer_run",
@@ -209,13 +240,7 @@ def reviewer_run_event_from_verdict_artifact(
         "provider": _lane_provider(lane_id),
         "lens": "base",
         "status": status,
-        "metrics": {
-            "finding_count": finding_count,
-            "p0_count": severities["p0"],
-            "p1_count": severities["p1"],
-            "p2_count": severities["p2"],
-            "p3_count": severities["p3"],
-        },
+        "metrics": metrics,
         "dimensions": dimensions,
     }
 
@@ -249,6 +274,8 @@ def export_reviewer_run_events_from_verdicts(
             raise ValueError(f"{path}: verdict artifact must be a JSON object")
         if payload.get("schema") != VERDICT_ARTIFACT_SCHEMA:
             continue
+        if is_fixture_verdict_artifact(payload):
+            continue
         artifact_repo = _normalize_repo_slug(
             str(payload.get("repo") or _repo_slug_from_artifact_path(path))
         )