code-mower 1.0.11__tar.gz → 1.0.13__tar.gz

{code_mower-1.0.11 → code_mower-1.0.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 1.0.11
+Version: 1.0.13
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/codemower-ai/code-mower
@@ -241,7 +241,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.11/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.13/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -289,6 +289,17 @@ The v1.0.11 patch moves canonical hosted Devin release campaigns onto the
 bounded, pollable Sessions API transport and keeps macOS Claude release
 qualification inside the maintained strict sandbox by using pip's
 TLS-verifying certifi certificate path.
+The v1.0.12 patch completes that Claude qualification fix: the maintained
+provider qualification prompt no longer tells the agent to create its own
+temporary directory, so it stays in the disposable workspace Code Mower
+already created, and it states the existing contract that a result's total
+`elapsed_seconds` is the sum of its step values.
+The v1.0.13 patch makes automatic campaign runtime selection sandbox-safe:
+when `CODE_MOWER_PYTHON` is not set, Code Mower now prefers a supported
+versioned Python on `PATH` outside the user home before falling back to its
+own running interpreter, so a pipx- or uv-installed CLI stops handing Claude's
+strict macOS sandbox an interpreter under the denied home tree. An explicit
+`CODE_MOWER_PYTHON` remains authoritative.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -321,7 +332,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.11` / `code-mower==1.0.11`. The
+the package-index procedure for `v1.0.13` / `code-mower==1.0.13`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -515,8 +526,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.11`, with pinned package
-install spec `code-mower==1.0.11`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.0.13`, with pinned package
+install spec `code-mower==1.0.13`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -596,6 +607,8 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.9 Release Notes](docs/v109-release-notes.md)
 - [v1.0.10 Release Notes](docs/v1010-release-notes.md)
 - [v1.0.11 Release Notes](docs/v1011-release-notes.md)
+- [v1.0.12 Release Notes](docs/v1012-release-notes.md)
+- [v1.0.13 Release Notes](docs/v1013-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.11 → code_mower-1.0.13}/README.md

@@ -211,7 +211,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.11/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.13/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -259,6 +259,17 @@ The v1.0.11 patch moves canonical hosted Devin release campaigns onto the
 bounded, pollable Sessions API transport and keeps macOS Claude release
 qualification inside the maintained strict sandbox by using pip's
 TLS-verifying certifi certificate path.
+The v1.0.12 patch completes that Claude qualification fix: the maintained
+provider qualification prompt no longer tells the agent to create its own
+temporary directory, so it stays in the disposable workspace Code Mower
+already created, and it states the existing contract that a result's total
+`elapsed_seconds` is the sum of its step values.
+The v1.0.13 patch makes automatic campaign runtime selection sandbox-safe:
+when `CODE_MOWER_PYTHON` is not set, Code Mower now prefers a supported
+versioned Python on `PATH` outside the user home before falling back to its
+own running interpreter, so a pipx- or uv-installed CLI stops handing Claude's
+strict macOS sandbox an interpreter under the denied home tree. An explicit
+`CODE_MOWER_PYTHON` remains authoritative.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -291,7 +302,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.11` / `code-mower==1.0.11`. The
+the package-index procedure for `v1.0.13` / `code-mower==1.0.13`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -485,8 +496,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.11`, with pinned package
-install spec `code-mower==1.0.11`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.0.13`, with pinned package
+install spec `code-mower==1.0.13`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -566,6 +577,8 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.9 Release Notes](docs/v109-release-notes.md)
 - [v1.0.10 Release Notes](docs/v1010-release-notes.md)
 - [v1.0.11 Release Notes](docs/v1011-release-notes.md)
+- [v1.0.12 Release Notes](docs/v1012-release-notes.md)
+- [v1.0.13 Release Notes](docs/v1013-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.11 → code_mower-1.0.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "1.0.11"
+version = "1.0.13"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.12"
 readme = "README.md"

{code_mower-1.0.11 → code_mower-1.0.13}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "1.0.11"
+__version__ = "1.0.13"

{code_mower-1.0.11 → code_mower-1.0.13}/src/code_mower/campaign_adapters.py

@@ -515,8 +515,9 @@ def build_qualification_prompt(
         verification_step = 4
     lines = [
         f"You are the {provider} release-qualification agent for Code Mower.",
-        "Qualify exactly one release in a disposable environment you create.",
-        "Do all work inside a fresh temporary directory; do not read or modify",
+        "Qualify exactly one release in the current disposable workspace.",
+        "Code Mower already created this workspace; do not create or change into",
+        "another temporary directory. Do not read or modify",
         "any existing checkout, home directory, credential file, or environment",
         "variable holding a secret. Never print secrets, tokens, file paths,",
         "commands you ran, or raw logs in your final answer.",
@@ -612,7 +613,8 @@ def build_qualification_prompt(
         "the step status strings: fail if any status is fail;",
         "pass_with_warnings if any status is warn or unavailable; otherwise",
         "pass. In particular, all-pass steps require outcome pass. No extra",
-        "fields, no prose, no fences.",
+        "fields, no prose, no fences. Set total elapsed_seconds to the sum of",
+        "the step elapsed_seconds values (within one second for rounding).",
     ])
     return "\n".join(lines) + "\n"
 

{code_mower-1.0.11 → code_mower-1.0.13}/src/code_mower/release_campaigns.py

@@ -2348,6 +2348,30 @@ def _versioned_python_candidates(path_value: str) -> tuple[str, ...]:
     return tuple(f"python3.{minor}" for minor in sorted(minors, reverse=True))
 
 
+def _resolve_python_candidate(
+    candidate: str,
+    *,
+    explicit: str,
+    which_fn: Callable[[str], str | None],
+) -> str | None:
+    candidate_path = Path(candidate).expanduser()
+    is_path = bool(
+        os.sep in candidate
+        or (os.altsep and os.altsep in candidate)
+        or candidate == sys.executable
+        or (candidate == explicit and candidate_path.exists())
+    )
+    if is_path:
+        if not candidate_path.exists():
+            return None
+        return str(candidate_path if candidate_path.is_absolute() else candidate_path.resolve())
+    resolved = which_fn(candidate)
+    if not resolved:
+        return None
+    resolved_path = Path(resolved).expanduser()
+    return str(resolved_path if resolved_path.is_absolute() else resolved_path.resolve())
+
+
 def resolve_supported_runtime(
     *,
     environ: Mapping[str, str] | None = None,
@@ -2361,43 +2385,42 @@ def resolve_supported_runtime(
     """
     env = os.environ if environ is None else environ
     explicit = env.get("CODE_MOWER_PYTHON", "").strip()
+    which = shutil.which if which_fn is None else which_fn
     if explicit:
-        candidates = (explicit,)
+        resolved = _resolve_python_candidate(explicit, explicit=explicit, which_fn=which)
+        candidates = (resolved,) if resolved else ()
     else:
         discovered = _versioned_python_candidates(str(env.get("PATH", "")))
-        candidates = (
-            sys.executable,
+        raw_candidates = (
             *discovered,
-            "python3.12",
-            "python3.13",
             "python3.14",
+            "python3.13",
+            "python3.12",
             "python3",
+            sys.executable,
         )
-    which = shutil.which if which_fn is None else which_fn
+        resolved_candidates: list[str] = []
+        seen: set[str] = set()
+        for candidate in raw_candidates:
+            resolved = _resolve_python_candidate(candidate, explicit="", which_fn=which)
+            if resolved and resolved not in seen:
+                seen.add(resolved)
+                resolved_candidates.append(resolved)
+
+        home = Path(str(env.get("HOME") or Path.home())).expanduser().resolve()
+        outside_home = [
+            candidate for candidate in resolved_candidates if not Path(candidate).resolve().is_relative_to(home)
+        ]
+        inside_home = [candidate for candidate in resolved_candidates if Path(candidate).resolve().is_relative_to(home)]
+        candidates = (*outside_home, *inside_home)
+
     run = subprocess.run if runner is None else runner
     for cand in candidates:
         if not cand:
             continue
-        cand_path = Path(cand).expanduser()
-        if (
-            os.sep in cand
-            or (os.altsep and os.altsep in cand)
-            or cand == sys.executable
-            or (cand == explicit and cand_path.exists())
-        ):
-            if cand_path.exists():
-                resolved = str(cand_path.resolve()) if not cand_path.is_absolute() else cand
-            else:
-                resolved = None
-        else:
-            resolved = which(cand)
-            if resolved and not Path(resolved).is_absolute():
-                resolved = str(Path(resolved).resolve())
-        if not resolved:
-            continue
         try:
             completed = run(
-                [resolved, "-c", "import sys; print(f'{sys.version_info[0]}.{sys.version_info[1]}')"],
+                [cand, "-c", "import sys; print(f'{sys.version_info[0]}.{sys.version_info[1]}')"],
                 text=True,
                 capture_output=True,
                 check=False,
@@ -2414,7 +2437,7 @@ def resolve_supported_runtime(
         except (IndexError, ValueError):
             continue
         if (major, minor) >= (3, 12):
-            return resolved, f"python_{major}.{minor}"
+            return cand, f"python_{major}.{minor}"
     return None
 
 

{code_mower-1.0.11 → code_mower-1.0.13}/src/code_mower/templates/workflows/builder-provenance.yml.j2

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 env:
-  CODE_MOWER_PACKAGE_SPEC: code-mower==1.0.11
+  CODE_MOWER_PACKAGE_SPEC: code-mower==1.0.13
 
 jobs:
   auto-record:

{code_mower-1.0.11 → code_mower-1.0.13}/src/code_mower.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 1.0.11
+Version: 1.0.13
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/codemower-ai/code-mower
@@ -241,7 +241,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.11/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.13/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -289,6 +289,17 @@ The v1.0.11 patch moves canonical hosted Devin release campaigns onto the
 bounded, pollable Sessions API transport and keeps macOS Claude release
 qualification inside the maintained strict sandbox by using pip's
 TLS-verifying certifi certificate path.
+The v1.0.12 patch completes that Claude qualification fix: the maintained
+provider qualification prompt no longer tells the agent to create its own
+temporary directory, so it stays in the disposable workspace Code Mower
+already created, and it states the existing contract that a result's total
+`elapsed_seconds` is the sum of its step values.
+The v1.0.13 patch makes automatic campaign runtime selection sandbox-safe:
+when `CODE_MOWER_PYTHON` is not set, Code Mower now prefers a supported
+versioned Python on `PATH` outside the user home before falling back to its
+own running interpreter, so a pipx- or uv-installed CLI stops handing Claude's
+strict macOS sandbox an interpreter under the denied home tree. An explicit
+`CODE_MOWER_PYTHON` remains authoritative.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -321,7 +332,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.11` / `code-mower==1.0.11`. The
+the package-index procedure for `v1.0.13` / `code-mower==1.0.13`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -515,8 +526,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.11`, with pinned package
-install spec `code-mower==1.0.11`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.0.13`, with pinned package
+install spec `code-mower==1.0.13`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -596,6 +607,8 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.9 Release Notes](docs/v109-release-notes.md)
 - [v1.0.10 Release Notes](docs/v1010-release-notes.md)
 - [v1.0.11 Release Notes](docs/v1011-release-notes.md)
+- [v1.0.12 Release Notes](docs/v1012-release-notes.md)
+- [v1.0.13 Release Notes](docs/v1013-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.11 → code_mower-1.0.13}/templates/workflows/builder-provenance.yml.j2

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 env:
-  CODE_MOWER_PACKAGE_SPEC: code-mower==1.0.11
+  CODE_MOWER_PACKAGE_SPEC: code-mower==1.0.13
 
 jobs:
   auto-record:

{code_mower-1.0.11 → code_mower-1.0.13}/tests/test_campaign_adapters.py

@@ -393,6 +393,10 @@ class ArgvBuilderTests(unittest.TestCase):
         for step_id in ("board", "doctor", "lanes_status", "overhead", "package_install"):
             self.assertIn(step_id, prompt)
         self.assertIn("<namespace>__<name>", prompt)
+        self.assertIn(
+            "total elapsed_seconds to the sum of\nthe step elapsed_seconds values",
+            prompt,
+        )
 
     def test_guidance_schema_enforces_step_id_taxonomy(self) -> None:
         step_id_schema = campaign_adapters.ADOPTION_RESULT_JSON_SCHEMA[
@@ -1917,6 +1921,10 @@ class ClaudeMacosCertificatePathTests(unittest.TestCase):
 
     def test_macos_claude_cold_install_uses_legacy_certs_without_ambient_pip_config(self) -> None:
         prompt = self._prompt("claude", "Darwin")
+        self.assertIn("Code Mower already created this workspace", prompt)
+        self.assertIn("do not create or change into\nanother temporary directory", prompt)
+        self.assertNotIn("a disposable environment you create", prompt)
+        self.assertNotIn("inside a fresh temporary directory", prompt)
         self.assertIn(
             "env -u PIP_INDEX_URL -u PIP_EXTRA_INDEX_URL PIP_CONFIG_FILE=/dev/null "
             ".venv/bin/python -m pip --isolated --use-deprecated=legacy-certs install",

{code_mower-1.0.11 → code_mower-1.0.13}/tests/test_release_campaigns.py

@@ -12756,6 +12756,78 @@ class RuntimeReadinessCampaignTests(unittest.TestCase):
 
         self.assertEqual(res, (str(python315), "python_3.15"))
 
+    def test_resolve_supported_runtime_prefers_path_runtime_outside_home(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            home = root / "home"
+            home_python = home / "pipx" / "python3.14"
+            external_bin = root / "toolchain" / "bin"
+            external_python = external_bin / "python3.12"
+            home_python.parent.mkdir(parents=True)
+            external_bin.mkdir(parents=True)
+            home_python.touch()
+            external_python.touch()
+
+            def fake_which(command: str) -> str | None:
+                return str(external_python) if command == "python3.12" else None
+
+            def fake_runner(command: list[str], **kwargs: Any) -> subprocess.CompletedProcess[str]:
+                version = "3.12.9\n" if command[0] == str(external_python) else "3.14.1\n"
+                return subprocess.CompletedProcess(command, 0, stdout=version, stderr="")
+
+            with mock.patch.object(release_campaigns.sys, "executable", str(home_python)):
+                result = release_campaigns.resolve_supported_runtime(
+                    environ={"HOME": str(home), "PATH": str(external_bin)},
+                    which_fn=fake_which,
+                    runner=fake_runner,
+                )
+
+        self.assertEqual(result, (str(external_python), "python_3.12"))
+
+    def test_resolve_supported_runtime_falls_back_to_running_interpreter_in_home(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            home = Path(tmp) / "home"
+            home_python = home / "pipx" / "python3.14"
+            home_python.parent.mkdir(parents=True)
+            home_python.touch()
+
+            def fake_runner(command: list[str], **kwargs: Any) -> subprocess.CompletedProcess[str]:
+                return subprocess.CompletedProcess(command, 0, stdout="3.14.1\n", stderr="")
+
+            with mock.patch.object(release_campaigns.sys, "executable", str(home_python)):
+                result = release_campaigns.resolve_supported_runtime(
+                    environ={"HOME": str(home), "PATH": ""},
+                    which_fn=lambda _: None,
+                    runner=fake_runner,
+                )
+
+        self.assertEqual(result, (str(home_python), "python_3.14"))
+
+    def test_resolve_supported_runtime_keeps_explicit_home_override_authoritative(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            home = Path(tmp) / "home"
+            explicit_python = home / "python3.12"
+            external_python = Path(tmp) / "external" / "python3.14"
+            explicit_python.parent.mkdir(parents=True)
+            external_python.parent.mkdir(parents=True)
+            explicit_python.touch()
+            external_python.touch()
+
+            def fake_runner(command: list[str], **kwargs: Any) -> subprocess.CompletedProcess[str]:
+                return subprocess.CompletedProcess(command, 0, stdout="3.12.9\n", stderr="")
+
+            result = release_campaigns.resolve_supported_runtime(
+                environ={
+                    "CODE_MOWER_PYTHON": str(explicit_python),
+                    "HOME": str(home),
+                    "PATH": str(external_python.parent),
+                },
+                which_fn=lambda _: str(external_python),
+                runner=fake_runner,
+            )
+
+        self.assertEqual(result, (str(explicit_python), "python_3.12"))
+
     def test_invoke_local_adapter_fails_closed_when_runtime_unavailable(self) -> None:
         invoked: list[str] = []