code-mower 0.5.0b5__tar.gz

code_mower-0.5.0b5/CODE_OF_CONDUCT.md

@@ -0,0 +1,35 @@
+# Code Mower Community Code of Conduct
+
+Code Mower is built around careful technical disagreement: different AI systems,
+reviewers, and humans should be able to challenge one another without making the
+workspace hostile.
+
+## Expected Behavior
+
+- Be respectful and specific when giving feedback.
+- Assume good intent, but correct unsafe behavior quickly.
+- Keep discussions focused on evidence, reproducible commands, repository
+  context, and user impact.
+- Redact API tokens, private source, raw diffs, raw model transcripts,
+  credentials, auth output, and customer data before posting public examples;
+  use [SECURITY.md](SECURITY.md) for private reports.
+- Accept that maintainer decisions may prioritize safety, privacy, cost control,
+  or first-user reliability over a clever integration.
+
+## Unacceptable Behavior
+
+- Harassment, threats, discrimination, or personal attacks.
+- Publishing someone else's private code, credentials, identity details, or
+  proprietary repository information.
+- Pressuring maintainers or users to run untrusted commands, bypass security
+  controls, or expose provider credentials.
+- Using issues, discussions, or PRs to launder prompt injection, secret
+  exfiltration, or other unsafe automation patterns.
+
+## Reporting
+
+For conduct concerns, contact the maintainers privately. For security issues,
+use the process in [SECURITY.md](SECURITY.md) instead of opening a public issue.
+
+Maintainers may remove content, lock threads, block accounts, or revoke access
+when needed to protect users and the project.

code_mower-0.5.0b5/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

code_mower-0.5.0b5/MANIFEST.in

@@ -0,0 +1,13 @@
+recursive-include src/code_mower/templates *.yml *.yaml *.json
+recursive-include src/code_mower/templates *.md
+recursive-include src/code_mower/templates *.j2
+recursive-include src/code_mower/templates/product-support *
+include src/code_mower/*.json
+recursive-include templates *.j2 *.json *.md *.yml *.yaml
+include requirements/*.txt
+include LICENSE
+include NOTICE
+include CODE_OF_CONDUCT.md
+include SUPPORT.md
+global-exclude *.py[cod]
+global-exclude __pycache__

code_mower-0.5.0b5/NOTICE

@@ -0,0 +1,10 @@
+Code Mower
+Copyright 2026 Code Mower
+
+This product includes software developed for the Code Mower project.
+
+The Code Mower open-source core is licensed under the Apache License,
+Version 2.0. The Code Mower name, logos, hosted benchmarking and reporting
+services, managed integrations, private telemetry and benchmark data products,
+enterprise controls, and support offerings are separate commercial surfaces
+unless explicitly licensed otherwise.

code_mower-0.5.0b5/PKG-INFO

@@ -0,0 +1,302 @@
+Metadata-Version: 2.4
+Name: code-mower
+Version: 0.5.0b5
+Summary: Multi-reviewer AI code audit orchestration
+License-Expression: Apache-2.0
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: PyYAML>=6.0
+Dynamic: license-file
+
+# Code Mower
+
+Code Mower helps teams set up AI peer-programmer and reviewer lanes on real
+GitHub pull requests, then measure which builders and reviewers are useful on
+their actual codebase.
+
+The short version:
+
+- create safe, manual-first reviewer lanes for Codex, Claude, Gitar, and other
+  AI review tools;
+- run setup diagnostics before a lane can surprise you with spend, source
+  exposure, or GitHub Actions churn;
+- generate local reviewer value reports from known-clean and known-blocked PRs;
+  and
+- optionally share sanitized metadata with [CodeMower.com](https://codemower.com)
+  for private team dashboards today and aggregate benchmarks as that dataset
+  becomes useful.
+
+Code Mower is local-first. The OSS tool works without the hosted service.
+Default cloud bundles exclude source code, raw diffs, raw model transcripts,
+raw stdout/stderr, auth output, and secrets.
+
+## Design Principles
+
+Code Mower should feel like an engineering tool, not a demo harness:
+
+- **Local first:** install, diagnose, audit, and report without a hosted
+  account.
+- **Manual first:** new reviewer lanes start explicit and observable before
+  they can affect merge policy.
+- **Evidence first:** promote lanes from real calibration data on your
+  repository, not from generic benchmark claims.
+- **Privacy first:** cloud sharing is opt-in metadata by default, with source,
+  diffs, transcripts, auth output, and secrets excluded.
+- **Composable by design:** providers, lenses, context packs, calibration, and
+  cloud upload stay separate so teams can adopt only the parts they trust.
+
+## What It Looks Like
+
+`code-mower doctor --preflight` is the first useful command. It checks your
+runtime, GitHub setup, provider CLIs, token posture, optional cloud setup, and
+private-repo Actions cost traps. `--preflight` is the friendly name for the
+versioned v0.5 first-run preset, so `doctor --v05` remains equivalent for
+scripts.
+
+Example, shortened:
+
+```text
+$ code-mower doctor --preflight
+PASS  config.validate             config validates
+PASS  profile.select              selected profile: codex, claude_audit, gitar
+PASS  runtime.python              Python 3.12 satisfies Code Mower requirements
+PASS  runtime.github_auth         GitHub CLI auth probe succeeded
+PASS  runtime.local_cli codex     codex found
+PASS  runtime.local_cli claude    claude auth smoke probe succeeded
+WARN  env.tokens codex            missing CODEX_AUDIT_LABEL_TOKEN or GITHUB_TOKEN
+WARN  github.actions_cost         private repo has high-frequency metadata workflows
+PASS  cloud.token                 optional Code Mower Cloud token file is configured
+
+Summary: warn, 20 checks, 0 failures, 5 warnings
+Next: fix token warnings, keep paid lanes manual, then generate a value report.
+```
+
+The warnings are the point: Code Mower should make setup, cost, and trust
+boundaries visible before you promote any reviewer lane.
+
+See a fuller static transcript: [docs/first-run-transcript.md](docs/first-run-transcript.md).
+
+## See The Value Shape First
+
+If you want to understand the product before installing anything, start with
+the checked-in demo calibration package:
+
+- [examples/demo-calibration/README.md](examples/demo-calibration/README.md)
+- [examples/demo-calibration/reviewer-value-report.md](examples/demo-calibration/reviewer-value-report.md)
+- [docs/first-user-demo-transcript.md](docs/first-user-demo-transcript.md)
+
+The example is intentionally tiny and synthetic: one known-clean control, one
+known-blocked control, and three reviewer lanes. It shows the decision Code
+Mower is built to support: which AI reviewers are useful, noisy, expensive,
+fast, or eligible for stronger merge policy on your actual codebase.
+
+## Try It First
+
+Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
+
+```bash
+python3.12 --version
+pipx install --python python3.12 "git+https://github.com/codemower-ai/code-mower.git@v0.5.0-beta.5"
+code-mower --version
+```
+
+From the repository you want to pilot:
+
+```bash
+code-mower init --easy
+code-mower doctor --preflight
+code-mower checks detect --json
+```
+
+When those look sane, write the generated setup to a reviewable folder and
+produce the starter local report:
+
+```bash
+code-mower init --easy --apply --output-dir .code-mower.generated
+code-mower calibration value-report .code-mower.generated/calibration-corpus.json \
+  --output .code-mower/reviewer-value-report.md
+```
+
+The generated starter corpus proves the command path. To bootstrap a draft from
+your repository history:
+
+```bash
+code-mower calibration auto-discover \
+  --repo OWNER/REPO \
+  --last-n 20 \
+  --output .code-mower/draft-calibration-corpus.json
+```
+
+Auto-discovery uses recent merged PR metadata, structured audit trailers, and
+review-request signals to propose known-clean and known-blocked cases. Review
+every disposition before using it for lane promotion or merge policy.
+
+Full walkthrough: [docs/try-in-10-minutes.md](docs/try-in-10-minutes.md).
+First-time command map: [docs/launch-command-surface.md](docs/launch-command-surface.md).
+
+## Why Not Just Run Codex Or Claude Yourself?
+
+You should, at first. Code Mower is not a replacement for a good local agent or
+reviewer CLI.
+
+Code Mower adds the operating layer around those tools:
+
+- consistent reviewer lanes on real pull requests;
+- setup checks for auth, Python, GitHub permissions, private-repo Actions cost,
+  provider CLIs, and cloud-token posture;
+- calibration against known-clean and known-blocked PRs instead of vibes;
+- evidence-gated lane promotion: informational, selective, or merge-gating;
+- spend/latency/usefulness reporting across providers and lenses; and
+- privacy boundaries for optional metadata sharing.
+
+The goal is to learn which AI builders and reviewers are worth trusting on your
+actual codebase, at what cost, and under which merge policy.
+
+## Optional Cloud Sharing
+
+Code Mower Cloud currently provides private team dashboards from opt-in
+metadata. Cross-team cohort benchmarking is a roadmap feature that becomes
+valuable only as enough teams contribute sanitized data. The local OSS path
+stays useful without the hosted service.
+
+The cloud value loop is:
+
+1. run local Code Mower reports;
+2. inspect the metadata-only bundle or dogfood preview;
+3. upload only with `--yes`; and
+4. use [CodeMower.com](https://codemower.com) to see repo rollups, provider/lens
+   signal, cost/latency, noisy lanes, and next-lane recommendations over time.
+
+Start with a dry run:
+
+```bash
+code-mower cloud dogfood --json
+```
+
+Nothing uploads unless you pass `--yes`.
+
+To connect to [CodeMower.com](https://codemower.com), sign in at
+[https://codemower.com/login](https://codemower.com/login), create or receive a
+team token, then run:
+
+```bash
+code-mower cloud setup \
+  --token-stdin \
+  --team-id "YOUR_TEAM_SLUG" \
+  --install-id "your-laptop" \
+  --out ~/.config/code-mower/tokens/your-laptop.env
+```
+
+Cloud sharing details, historical catch-up, and repo-sync commands live in
+[docs/cloud-sharing.md](docs/cloud-sharing.md).
+
+## Provider Posture
+
+The first recommended lanes are local/manual:
+
+| Lane | Default role | Merge posture |
+| --- | --- | --- |
+| Codex audit | structured local peer audit | merge-gating eligible after setup |
+| Claude audit | structured local peer audit | merge-gating eligible after setup |
+| Gitar | advisory third signal | informational until calibrated |
+
+Everything else starts manual or informational until your own calibration data
+proves it is useful: Antigravity/Gemini, Hermes, CodeRabbit CLI, Cursor BugBot,
+Qodo, Greptile, Devin, local LLMs, and future ACP bridges.
+
+Provider details: [docs/provider-matrix.md](docs/provider-matrix.md).
+Setup/auth fixes: [docs/troubleshooting.md](docs/troubleshooting.md).
+
+## Road To v1.0
+
+The v1.0 bar is not "every provider works." The v1.0 bar is that a fresh senior
+engineer can:
+
+1. install Code Mower in a clean repo;
+2. understand the local/cloud trust boundary;
+3. run `init --easy` and `doctor --preflight`;
+4. detect and run the repo's native lint/test/build surface instead of assuming
+   every project uses the same tools;
+5. produce a local value report from known PR outcomes;
+6. decide which lanes should stay informational, selective, or merge-gating;
+   and
+7. optionally upload sanitized metadata to CodeMower.com and see useful team
+   dashboard signal.
+
+Future builder/orchestrator experiments extend the same loop from "who reviews
+best?" to "which AI builder plus reviewer loop ships best on this product?" See
+[docs/builder-experiments.md](docs/builder-experiments.md) and
+[docs/authoring-intelligence.md](docs/authoring-intelligence.md).
+
+## Installation Status
+
+The current public beta is `v0.5.0-beta.5` from
+[codemower-ai/code-mower](https://github.com/codemower-ai/code-mower). PyPI
+distribution builds now run from GitHub Releases. Publishing to PyPI remains
+off by default until trusted publishing is configured, so use the tagged GitHub
+install command above for this beta.
+
+For source checkout development and release rehearsal, use:
+
+```bash
+scripts/dev-python
+scripts/dev-python -m venv .venv
+.venv/bin/python -m pip install -e . ruff
+```
+
+The wrapper resolves Python 3.12+ and refuses stale or old system Python shims.
+
+## Known Limitations
+
+- PyPI distribution builds exist, but publishing is gated until trusted
+  publishing is configured; use the tagged GitHub install command. See
+  [docs/pypi-release.md](docs/pypi-release.md) for the TestPyPI/PyPI
+  activation path.
+- GitHub is the primary supported forge. GitLab, Bitbucket, and ACP bridges are
+  roadmap items.
+- Hosted/SaaS reviewers start informational or manual until calibration data
+  supports promotion.
+- `calibration auto-discover` is a bootstrap tool, not an adjudicator. It
+  proposes a draft corpus from PR history; humans still confirm the ground truth.
+- CodeMower.com currently provides private team dashboards; cohort benchmarks
+  are roadmap work and should not be treated as live product value yet.
+- Self-service cloud data deletion/export basics are live. Retention remains
+  conservative and team-controlled while automated retention jobs are roadmap
+  work.
+- Advanced/provider/operator commands remain available behind
+  `code-mower --help-all`. The default help path stays focused on `init`,
+  `doctor`, calibration, value reports, and optional cloud export/upload.
+
+## Docs Map
+
+- [Try Code Mower In 10 Minutes](docs/try-in-10-minutes.md)
+- [Quickstart](docs/quickstart.md)
+- [First Run Transcript](docs/first-run-transcript.md)
+- [First-User Demo Transcript](docs/first-user-demo-transcript.md)
+- [First-User Install Rehearsal](docs/first-user-install-rehearsal.md)
+- [Launch Command Surface](docs/launch-command-surface.md)
+- [Demo Calibration Example](examples/demo-calibration/README.md)
+- [PyPI Release Runbook](docs/pypi-release.md)
+- [Sample Doctor Output](docs/sample-doctor-output.md)
+- [Architecture](docs/architecture.md)
+- [Provider Matrix](docs/provider-matrix.md)
+- [GitHub Setup](docs/github-setup.md)
+- [Cloud Sharing](docs/cloud-sharing.md)
+- [Cloud Data Contract](docs/cloud-data-contract.md)
+- [Privacy And Threat Model](docs/privacy-threat-model.md)
+- [Current State And Roadmap](docs/current-state-and-roadmap.md)
+- [Public Release Checklist](docs/public-release-checklist.md)
+- [Changelog](CHANGELOG.md)
+- [Contributing](CONTRIBUTING.md)
+- [Support](SUPPORT.md)
+- [Security Policy](SECURITY.md)
+- [Code of Conduct](CODE_OF_CONDUCT.md)
+
+## License
+
+The Code Mower open-source core is licensed under Apache-2.0. Hosted
+benchmarking and reporting, managed integrations, private telemetry and
+benchmark data products, enterprise controls, and support are commercial
+surfaces unless licensed otherwise.