code-mower 1.0.15__tar.gz → 1.1.1__tar.gz

{code_mower-1.0.15 → code_mower-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 1.0.15
+Version: 1.1.1
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/codemower-ai/code-mower
@@ -234,6 +234,10 @@ after reinstalling, especially when switching between pipx and uv.
 | B. Build loop in 30 minutes | You want builders plus an orchestrator pattern after the reviewer gate works. | Complete path A, then add the automation token, require `code-mower/gate` from Any source, enable repository auto-merge, prove the self-hosted Mac lane runner with `doctor --runner`, run `init --builders`, and dispatch the first issue. | [Build Loop In 30 Minutes](docs/build-loop-in-30-minutes.md) |
 | C. Builder experiment | You want to compare authoring loops before trusting them broadly. | Use a work order or experiment spec, run `code-mower builder-experiment run` around an explicit command, then review the source-free `authoringRun` artifact and normal audit evidence. | [Builder Experiments](docs/builder-experiments.md) |
 
+For Jira Cloud work tracking instead of the default GitHub Issues path, see
+[Jira Cloud Setup](docs/jira-cloud-setup.md) and
+[Jira Adoption Rehearsal](docs/jira-adoption-rehearsal.md).
+
 When you ask another agent to install, upgrade, orchestrate, build, or review,
 start from the universal prompt in
 [Orchestrator Prompt Pack](docs/orchestrator-prompt-pack.md). It makes the
@@ -241,7 +245,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.15/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.1.1/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -306,13 +310,12 @@ reports `running` / `waiting_for_user`, so a finished informational Devin
 attempt is no longer recorded as owner-blocked. An explicit terminal API
 failure and a `waiting_for_approval` session still take precedence over any
 structured output.
-The v1.0.15 release makes measurement and release operations more trustworthy:
-productivity reports prefer live GitHub current state while retaining clearly
-labeled historical Board observations, release campaigns can discover trusted
-results on their explicitly linked release PR, provider credentials survive
-restarts through fail-closed profiles, and new metadata-only contracts cover
-reviewer finding outcomes, normalized productivity windows, and PR cost
-coverage.
+The v1.1 release adds optional Jira Cloud work tracking while keeping GitHub
+pull requests, checks, and merge gates authoritative. Jira setup starts
+read-only; mutation requires both explicit configuration and an explicit
+apply command. Controller queue visibility, Board, and PR-to-Jira milestones
+share the same bounded metadata contract, and GitHub-only repositories keep
+their existing behavior and generated workflows.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -345,7 +348,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.15` / `code-mower==1.0.15`. The
+the package-index procedure for `v1.1.1` / `code-mower==1.1.1`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -539,8 +542,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.15`, with pinned package
-install spec `code-mower==1.0.15`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.1.1`, with pinned package
+install spec `code-mower==1.1.1`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -599,6 +602,8 @@ first so local work exercises the same package entrypoint users install.
 - [Provider Matrix](docs/provider-matrix.md)
 - [Provider Calibration Scorecard](docs/provider-calibration-scorecard.md)
 - [GitHub Setup](docs/github-setup.md)
+- [Jira Cloud Setup](docs/jira-cloud-setup.md)
+- [Jira Adoption Rehearsal](docs/jira-adoption-rehearsal.md)
 - [First Run Transcript](docs/first-run-transcript.md)
 - [First-User Demo Transcript](docs/first-user-demo-transcript.md)
 - [First-User Install Rehearsal](docs/first-user-install-rehearsal.md)
@@ -624,6 +629,8 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.13 Release Notes](docs/v1013-release-notes.md)
 - [v1.0.14 Release Notes](docs/v1014-release-notes.md)
 - [v1.0.15 Release Notes](docs/v1015-release-notes.md)
+- [v1.1.1 Release Notes](docs/v111-release-notes.md)
+- [v1.1 Release Notes](docs/v11-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.15 → code_mower-1.1.1}/README.md

@@ -204,6 +204,10 @@ after reinstalling, especially when switching between pipx and uv.
 | B. Build loop in 30 minutes | You want builders plus an orchestrator pattern after the reviewer gate works. | Complete path A, then add the automation token, require `code-mower/gate` from Any source, enable repository auto-merge, prove the self-hosted Mac lane runner with `doctor --runner`, run `init --builders`, and dispatch the first issue. | [Build Loop In 30 Minutes](docs/build-loop-in-30-minutes.md) |
 | C. Builder experiment | You want to compare authoring loops before trusting them broadly. | Use a work order or experiment spec, run `code-mower builder-experiment run` around an explicit command, then review the source-free `authoringRun` artifact and normal audit evidence. | [Builder Experiments](docs/builder-experiments.md) |
 
+For Jira Cloud work tracking instead of the default GitHub Issues path, see
+[Jira Cloud Setup](docs/jira-cloud-setup.md) and
+[Jira Adoption Rehearsal](docs/jira-adoption-rehearsal.md).
+
 When you ask another agent to install, upgrade, orchestrate, build, or review,
 start from the universal prompt in
 [Orchestrator Prompt Pack](docs/orchestrator-prompt-pack.md). It makes the
@@ -211,7 +215,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.15/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.1.1/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -276,13 +280,12 @@ reports `running` / `waiting_for_user`, so a finished informational Devin
 attempt is no longer recorded as owner-blocked. An explicit terminal API
 failure and a `waiting_for_approval` session still take precedence over any
 structured output.
-The v1.0.15 release makes measurement and release operations more trustworthy:
-productivity reports prefer live GitHub current state while retaining clearly
-labeled historical Board observations, release campaigns can discover trusted
-results on their explicitly linked release PR, provider credentials survive
-restarts through fail-closed profiles, and new metadata-only contracts cover
-reviewer finding outcomes, normalized productivity windows, and PR cost
-coverage.
+The v1.1 release adds optional Jira Cloud work tracking while keeping GitHub
+pull requests, checks, and merge gates authoritative. Jira setup starts
+read-only; mutation requires both explicit configuration and an explicit
+apply command. Controller queue visibility, Board, and PR-to-Jira milestones
+share the same bounded metadata contract, and GitHub-only repositories keep
+their existing behavior and generated workflows.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -315,7 +318,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.15` / `code-mower==1.0.15`. The
+the package-index procedure for `v1.1.1` / `code-mower==1.1.1`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -509,8 +512,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.15`, with pinned package
-install spec `code-mower==1.0.15`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.1.1`, with pinned package
+install spec `code-mower==1.1.1`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -569,6 +572,8 @@ first so local work exercises the same package entrypoint users install.
 - [Provider Matrix](docs/provider-matrix.md)
 - [Provider Calibration Scorecard](docs/provider-calibration-scorecard.md)
 - [GitHub Setup](docs/github-setup.md)
+- [Jira Cloud Setup](docs/jira-cloud-setup.md)
+- [Jira Adoption Rehearsal](docs/jira-adoption-rehearsal.md)
 - [First Run Transcript](docs/first-run-transcript.md)
 - [First-User Demo Transcript](docs/first-user-demo-transcript.md)
 - [First-User Install Rehearsal](docs/first-user-install-rehearsal.md)
@@ -594,6 +599,8 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.13 Release Notes](docs/v1013-release-notes.md)
 - [v1.0.14 Release Notes](docs/v1014-release-notes.md)
 - [v1.0.15 Release Notes](docs/v1015-release-notes.md)
+- [v1.1.1 Release Notes](docs/v111-release-notes.md)
+- [v1.1 Release Notes](docs/v11-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.15 → code_mower-1.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "1.0.15"
+version = "1.1.1"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.12"
 readme = "README.md"

{code_mower-1.0.15 → code_mower-1.1.1}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "1.0.15"
+__version__ = "1.1.1"

{code_mower-1.0.15 → code_mower-1.1.1}/src/code_mower/antigravity_cli_audit_pr.py

@@ -12,6 +12,8 @@ import sys
 import urllib.error
 from pathlib import Path
 
+from typing import Mapping
+
 if __package__ in {None, ""}:
     module_dir = Path(__file__).resolve().parent
     sys.path.insert(0, str(module_dir.parent))
@@ -34,6 +36,11 @@ DEFAULT_ANTIGRAVITY_DISPLAY_NAME = "Antigravity CLI"
 ANTIGRAVITY_SETTINGS_SUBDIRS = (".gemini", ".gemini/antigravity-cli")
 ANTIGRAVITY_ALTERNATE_COMMANDS = ("antigravity",)
 ANTIGRAVITY_AMBIENT_HOME_ENV = "ANTIGRAVITY_CLI_USE_AMBIENT_HOME"
+ANTIGRAVITY_REQUIRED_FLAGS = ("--dangerously-skip-permissions",)
+ANTIGRAVITY_HELP_SENTINELS = (
+    *gemini_cli_audit_pr.PROMPT_FILE_HELP_SENTINELS,
+    *ANTIGRAVITY_REQUIRED_FLAGS,
+)
 
 AntigravityCliHeadChangedError = gemini_cli_audit_pr.GeminiCliHeadChangedError
 AntigravityCliUnsupportedError = gemini_cli_audit_pr.GeminiCliUnsupportedError
@@ -61,6 +68,43 @@ def resolve_antigravity_command(command: str) -> str:
     return command
 
 
+def build_antigravity_audit_argv(
+    *,
+    command: str = DEFAULT_ANTIGRAVITY_COMMAND,
+    workspace_dir: Path,
+    prompt_instruction: str,
+    timeout_seconds: int = gemini_cli_audit_pr.DEFAULT_TIMEOUT_SECONDS,
+    model: str = "",
+) -> list[str]:
+    """Build structured argv for headless Antigravity CLI audit inside sandbox."""
+    return gemini_cli_audit_pr.build_prompt_file_argv(
+        resolve_antigravity_command(command),
+        workspace_dir=workspace_dir,
+        prompt_instruction=prompt_instruction,
+        timeout_seconds=timeout_seconds,
+        model=model,
+        extra_args=ANTIGRAVITY_REQUIRED_FLAGS,
+    )
+
+
+def verify_antigravity_cli_contract(
+    command: str,
+    *,
+    cwd: Path,
+    env: Mapping[str, str] | None = None,
+    display_name: str = DEFAULT_ANTIGRAVITY_DISPLAY_NAME,
+) -> None:
+    """Verify that the Antigravity CLI supports required audit flags."""
+    resolved_env = env if env is not None else os.environ
+    gemini_cli_audit_pr.verify_prompt_file_contract(
+        resolve_antigravity_command(command),
+        cwd=cwd,
+        env=resolved_env,
+        display_name=display_name,
+        required_sentinels=ANTIGRAVITY_HELP_SENTINELS,
+    )
+
+
 def run_antigravity_cli_audit(
     *,
     repo: str,
@@ -120,6 +164,8 @@ def run_antigravity_cli_audit(
         cli_transport="prompt_file",
         preserve_ambient_home=use_ambient_home,
         context_pack_text=context_pack_text,
+        extra_args=ANTIGRAVITY_REQUIRED_FLAGS,
+        required_help_sentinels=ANTIGRAVITY_HELP_SENTINELS,
     )
 
 

{code_mower-1.0.15 → code_mower-1.1.1}/src/code_mower/board.py

@@ -212,6 +212,8 @@ def status_payload(
     *,
     gh_json_runner: lane_status.GitHubJsonRunner = lane_status.run_gh_json,
     command_runner: lane_status.CommandRunner = lane_status.run_command,
+    jira_reader: controller.tracker_queue.JiraQueueReader | None = None,
+    tracker_links: Mapping[tuple[str, str, str], int] | None = None,
 ) -> dict[str, Any]:
     payload = lane_status.collect_status(
         repo=config.repo,
@@ -240,7 +242,11 @@ def status_payload(
         config,
         payload,
         gh_json_runner=gh_json_runner,
+        jira_reader=jira_reader,
+        tracker_links=tracker_links,
     )
+    if "tracker" in payload["supervised_pilot"]:
+        payload["tracker"] = payload["supervised_pilot"]["tracker"]
     payload["productivity"] = productivity_report.board_payload(
         repo=config.repo,
         repo_path=config.repo_path,
@@ -771,6 +777,9 @@ def _supervised_pr_payload(pr: Mapping[str, Any]) -> dict[str, Any]:
 
 
 def _supervised_issue_payload(issue: Mapping[str, Any]) -> dict[str, Any]:
+    if issue.get("source_kind") == "jira_cloud":
+        return {"source_kind": "jira_cloud", "work_item": issue["work_item"],
+                "builder_lane": _safe_text(issue.get("builder_lane"), limit=60)}
     payload: dict[str, Any] = {
         "number": _int(issue.get("number")) or 0,
         "url": _http_url(issue.get("url")),
@@ -787,10 +796,13 @@ def _supervised_issue_payload(issue: Mapping[str, Any]) -> dict[str, Any]:
 
 def supervised_pilot_payload(
     config: BoardConfig,
-    status: dict[str, Any],
+    status: Mapping[str, Any],
     *,
     gh_json_runner: lane_status.GitHubJsonRunner = lane_status.run_gh_json,
+    jira_reader: controller.tracker_queue.JiraQueueReader | None = None,
+    tracker_links: Mapping[tuple[str, str, str], int] | None = None,
 ) -> dict[str, Any]:
+    """Return pilot state and its optional tracker view without modifying status."""
     config_path = Path(config.repo_path) / "code-mower.yml"
     if not config_path.is_file():
         return _supervised_disabled("code-mower.yml not found; supervised pilot state is unavailable")
@@ -803,12 +815,20 @@ def supervised_pilot_payload(
         return _supervised_disabled("Code Mower config is invalid; run code-mower config validate")
 
     remote = status.get("remote") if isinstance(status.get("remote"), Mapping) else {}
-    if remote.get("available"):
+    tracker_view = None
+    if controller.tracker_queue.jira_enabled(raw_config):
+        tracker_view = controller.tracker_queue.queue_view(
+            controller.tracker_queue.collect_queue(raw_config, reader=jira_reader),
+            config=raw_config, remote=remote, links=tracker_links,
+            stale_minutes=config.stale_minutes,
+        )
+    if remote.get("available") or controller.tracker_queue.jira_enabled(raw_config):
         ready_issues = controller._collect_ready_issues(  # noqa: SLF001 - shared package policy surface for Board.
             repo=config.repo,
             config=raw_config,
             gh_json_runner=gh_json_runner,
             issue_limit=min(config.pr_limit, 50),
+            tracker_view=tracker_view,
         )
     else:
         ready_issues = {"available": False, "errors": ["remote unavailable"], "issues": []}
@@ -824,6 +844,7 @@ def supervised_pilot_payload(
     raw_prs = remote.get("pull_requests") if isinstance(remote.get("pull_requests"), list) else []
     issue_payload = ready_issues.get("issues") if isinstance(ready_issues.get("issues"), list) else []
     return {
+        **({"tracker": report["tracker"]} if "tracker" in report else {}),
         "schema": controller.SUPERVISED_PILOT_SCHEMA,
         "enabled": True,
         "cycle_state": _supervised_cycle_state(decision.get("decision_state")),
@@ -1396,10 +1417,11 @@ def render_board_html(config: BoardConfig) -> str:
         supervisedDecision.pr_number ? `<div class="row"><div class="line"><a href="${{esc(href(supervisedDecision.pr_url))}}">Selected PR #${{esc(supervisedDecision.pr_number)}}</a>${{supervisedDecision.lane_id ? pill(supervisedDecision.lane_id) : ""}}${{supervisedDecision.gate_status ? pill(`gate ${{supervisedDecision.gate_status}}`) : ""}}${{supervisedDecision.author_lane_excluded ? pill("author excluded") : ""}}</div><div class="muted">${{esc(supervisedDecision.branch || "")}}${{supervisedDecision.head_sha_prefix ? ` @ ${{esc(supervisedDecision.head_sha_prefix)}}` : ""}}</div></div>` : "",
         supervisedDecision.issue_number ? `<div class="row"><div class="line"><a href="${{esc(href(supervisedDecision.issue_url))}}">Selected issue #${{esc(supervisedDecision.issue_number)}}</a>${{supervisedDecision.lane_id ? pill(supervisedDecision.lane_id) : ""}}</div></div>` : "",
         reviewerOutcomes.length ? `<div class="row"><b>Reviewer Evidence</b><div class="muted">${{reviewerOutcomes.map(outcome => `${{esc(outcome.lane_id || outcome.config_lane_id)}}=${{esc(outcome.verdict)}}`).join(", ")}}</div></div>` : "",
-        supervisedIssues.length ? `<div class="row"><b>Ready Issues</b><div class="muted">${{supervisedIssues.slice(0, 5).map(issue => `#${{esc(issue.number)}} ${{esc(issue.builder_lane || "")}}`).join(", ")}}</div></div>` : "",
+        supervisedIssues.length ? `<div class="row"><b>Ready Issues</b><div class="muted">${{supervisedIssues.slice(0, 5).map(issue => `${{esc(issue.work_item?.identity?.issue_key || `#${{issue.number}}`)}} ${{esc(issue.builder_lane || "")}}`).join(", ")}}</div></div>` : "",
         supervisedPRs.length ? `<div class="row"><b>Active PRs</b><div class="muted">${{supervisedPRs.slice(0, 5).map(pr => `#${{esc(pr.number)}} ${{esc(pr.merge_state || "")}}${{pr.stale ? " stale" : ""}}${{pr.is_draft ? " draft" : ""}}`).join(", ")}}</div></div>` : ""
       ].filter(Boolean).join("") : empty(supervised.message || "Supervised pilot state unavailable.");
-      put("supervised", supervisedRows || empty(supervised.message || "No supervised pilot activity."));
+      const trackerRows = data.tracker ? `<div class="row"><b>Tracker: ${{esc(data.tracker.source_kind)}}</b> ${{pill(data.tracker.freshness)}}<div>${{esc((data.tracker.errors || []).join(", "))}}</div></div>` + (data.tracker.items || []).map(row => `<div class="row"><a href="${{esc(href(row.work_item.url))}}">${{esc(row.work_item.identity.issue_key || row.work_item.identity.issue_id)}}</a> ${{pill(row.work_item.lifecycle_category)}} ${{pill(row.freshness)}} ${{pill(row.lane_id || "unassigned")}}<div>PR ${{esc(row.linked_pr_number || "-")}} gate=${{esc(row.gate_status)}} (${{esc(row.pr_freshness)}})</div><div>next: ${{esc(row.next_action)}}</div></div>`).join("") : "";
+      put("supervised", trackerRows + supervisedRows || empty(supervised.message || "No supervised pilot activity."));
       const productivityRows = [
         `<div class="row"><div>next: <b>${{esc(productivity.next_action || "inspect")}}</b></div></div>`,
         `<div class="row"><b>Current</b><div class="line">${{pill(`open PRs ${{display(productivityCurrent.open_pr_count)}}`)}}${{pill(`active lanes ${{display(productivityCurrent.active_lane_count)}}`)}}${{pill(`blocked ${{display(productivityCurrent.blocked_pr_count)}}`)}}${{pill(`owner actions ${{display(productivityCurrent.owner_action_count)}}`)}}</div></div>`,
@@ -1906,6 +1928,13 @@ def make_handler(
                 snapshot, cache_metadata = status_cache.get()
                 payload = copy.deepcopy(snapshot) if snapshot is not None else _pending_status_payload(config)
                 payload["board"]["cache"] = cache_metadata
+                if "tracker" in payload and cache_metadata["state"] == "stale":
+                    payload["tracker"]["freshness"] = "historical"
+                    for row in payload["tracker"]["items"]:
+                        row["freshness"] = "historical"
+                        row["pr_freshness"] = "historical"
+                        row["eligible"] = False
+                        row["next_action"] = "refresh current state"
                 if config.record_events:
                     # Recording identity is the cache generation, not cache freshness.
                     # ``snapshot`` and ``generation`` are read together under the cache

{code_mower-1.0.15 → code_mower-1.1.1}/src/code_mower/campaign_adapters.py

@@ -604,8 +604,20 @@ def build_qualification_prompt(
             else "runtime_class is python_<major>.<minor>; provider and"
         ),
         "executor are lowercase safe identifiers; steps is a non-empty list of",
-        "{id, status, elapsed_seconds, warning_count, owner_action_count} with",
-        "id one of board, doctor, lanes_status, overhead, package_install or a namespaced",
+        "{id, status, elapsed_seconds, warning_count, owner_action_count} with an",
+        "optional failure_reason on a failed package_install step and nowhere else.",
+        "A failed package_install step must carry exactly one failure_reason:",
+        "network for connection or TLS failures (connection refused, timeout,",
+        "DNS, SSL or certificate validation), package_index for a missing version",
+        "or 404 from the package index, runtime for Python or dependency",
+        "incompatibility (unsupported Python version, missing module, conflicting",
+        "dependencies), sandbox_permission for permission, disk, or sandbox",
+        "denials (permission denied, disk full, read-only filesystem). Use",
+        "unknown only for a command that was actually attempted and cannot be",
+        "classified from local diagnostics. Report only the closed reason word;",
+        "never include raw output, logs, paths, commands, source, diffs,",
+        "transcripts, or secrets. Step id is",
+        "one of board, doctor, lanes_status, overhead, package_install or a namespaced",
         "<namespace>__<name> provider extension (both halves lowercase safe",
         "identifiers); any other id is rejected. Status is one of",
         "pass, fail, warn, unavailable, planned. A step with a",

{code_mower-1.0.15 → code_mower-1.1.1}/src/code_mower/cli.py

@@ -66,6 +66,7 @@ from . import gate_health as code_mower_gate_health
 from . import grok_build_audit_pr
 from . import hermes_cli_audit_pr
 from . import init as code_mower_init
+from . import jira_mutations as code_mower_jira_mutations
 from . import lane_delivery as code_mower_lane_delivery
 from . import lane_status as code_mower_lane_status
 from . import local_llm_audit_pr
@@ -478,6 +479,7 @@ COMMAND_DESCRIPTIONS: dict[str, str] = {
     "saas-reviewer-labeler": "Apply labels from hosted reviewer comments.",
     "telemetry": "Inspect benchmark telemetry/event helpers.",
     "trailer-comment-labeler": "Apply labels from structured audit trailers.",
+    "tracker": "Plan or apply guarded, idempotent Jira Cloud work-tracker mutations.",
     "work-order": "Draft implementation work orders and builder experiment seeds.",
 }
 
@@ -626,6 +628,7 @@ COMMAND_HANDLERS: dict[str, CommandHandler] = {
     "session": code_mower_session.main,
     "telemetry": code_mower_telemetry.main,
     "trailer-comment-labeler": trailer_comment_labeler.main,
+    "tracker": code_mower_jira_mutations.main,
     "work-order": code_mower_work_orders.work_order_main,
 }
 

{code_mower-1.0.15 → code_mower-1.1.1}/src/code_mower/config.py

@@ -21,8 +21,10 @@ if __package__ in {None, "", "tools"}:
         from tools import audit_limits
     except ImportError:  # pragma: no cover - direct script execution fallback.
         import audit_limits  # type: ignore
+    import tracker_contract  # type: ignore
 else:  # pragma: no cover - exercised after package extraction.
     from . import audit_limits
+    from . import tracker_contract
 
 
 ALLOWED_LANE_TYPES = {"audit", "review"}
@@ -513,6 +515,188 @@ def required_secret_entries_for_lane(lane: Mapping[str, Any]) -> tuple[str, ...]
     return tuple(secrets)
 
 
+def _validate_tracker_jira_cloud(
+    jira_cloud: Any,
+    issues: list[ConfigIssue],
+) -> None:
+    path = "tracker.jira_cloud"
+    jira_map = _as_mapping(jira_cloud, path, issues)
+    site_url = _require_string(jira_map.get("site_url"), f"{path}.site_url", issues)
+    if site_url is not None and not site_url.startswith("https://"):
+        issues.append(ConfigIssue(f"{path}.site_url", "must be an HTTPS Jira Cloud site URL"))
+    _require_string(jira_map.get("cloud_id"), f"{path}.cloud_id", issues)
+    _require_string(jira_map.get("project_id"), f"{path}.project_id", issues)
+    if jira_map.get("project_key") is not None:
+        _require_identifier(jira_map.get("project_key"), f"{path}.project_key", issues)
+    if jira_map.get("issue_type_id") is not None:
+        _require_string(jira_map.get("issue_type_id"), f"{path}.issue_type_id", issues)
+    if jira_map.get("jql") is not None:
+        jql = _require_string(jira_map.get("jql"), f"{path}.jql", issues)
+        if jql is not None and (len(jql) > 2000 or "\n" in jql or "\r" in jql):
+            issues.append(ConfigIssue(f"{path}.jql", "must be a single line of at most 2000 characters"))
+
+    status_category_map = jira_map.get("status_category_map")
+    if status_category_map is not None:
+        category_path = f"{path}.status_category_map"
+        for category, status_ids in _as_mapping(status_category_map, category_path, issues).items():
+            if category not in tracker_contract.LIFECYCLE_CATEGORIES:
+                issues.append(
+                    ConfigIssue(
+                        f"{category_path}.{category}",
+                        f"must be one of {sorted(tracker_contract.LIFECYCLE_CATEGORIES)}",
+                    )
+                )
+            for index, status_id in enumerate(
+                _as_sequence(status_ids, f"{category_path}.{category}", issues)
+            ):
+                if not isinstance(status_id, str) or not status_id:
+                    issues.append(
+                        ConfigIssue(
+                            f"{category_path}.{category}[{index}]",
+                            "must be a non-empty string status id",
+                        )
+                    )
+
+    field_mappings = jira_map.get("field_mappings")
+    if field_mappings is not None:
+        mapping_path = f"{path}.field_mappings"
+        for target, source_field_id in _as_mapping(field_mappings, mapping_path, issues).items():
+            if target not in tracker_contract.SAFE_FIELD_MAPPING_TARGETS:
+                issues.append(
+                    ConfigIssue(
+                        f"{mapping_path}.{target}",
+                        "must map to a safe normalized contract field: "
+                        f"{sorted(tracker_contract.SAFE_FIELD_MAPPING_TARGETS)}",
+                    )
+                )
+            _require_string(source_field_id, f"{mapping_path}.{target}", issues)
+
+    mutations = jira_map.get("mutations")
+    if mutations is not None:
+        mutation_path = f"{path}.mutations"
+        mutation_map = _as_mapping(mutations, mutation_path, issues)
+        extra_mutation_keys = set(mutation_map) - {
+            "writes_enabled",
+            "allowed_operations",
+            "transitions",
+        }
+        for key in extra_mutation_keys:
+            issues.append(
+                ConfigIssue(
+                    f"{mutation_path}.{key}",
+                    "must be writes_enabled, allowed_operations, or transitions",
+                )
+            )
+        if "writes_enabled" in mutation_map and not isinstance(
+            mutation_map.get("writes_enabled"), bool
+        ):
+            issues.append(ConfigIssue(f"{mutation_path}.writes_enabled", "must be true or false"))
+        allowed_operations = mutation_map.get("allowed_operations")
+        if allowed_operations is not None:
+            for index, operation in enumerate(
+                _as_sequence(allowed_operations, f"{mutation_path}.allowed_operations", issues)
+            ):
+                if operation not in tracker_contract.ALLOWED_MUTATION_OPERATIONS:
+                    issues.append(
+                        ConfigIssue(
+                            f"{mutation_path}.allowed_operations[{index}]",
+                            "must be one of "
+                            f"{sorted(tracker_contract.ALLOWED_MUTATION_OPERATIONS)}",
+                        )
+                    )
+        transitions = mutation_map.get("transitions")
+        if transitions is not None:
+            # Write transitions are configured by immutable transition id and
+            # re-verified against the live issue before any apply.
+            transition_path = f"{mutation_path}.transitions"
+            for category, transition_id in _as_mapping(
+                transitions, transition_path, issues
+            ).items():
+                if category not in tracker_contract.LIFECYCLE_CATEGORIES:
+                    issues.append(
+                        ConfigIssue(
+                            f"{transition_path}.{category}",
+                            "must be one of "
+                            f"{sorted(tracker_contract.LIFECYCLE_CATEGORIES)}",
+                        )
+                    )
+                    continue
+                if not isinstance(transition_id, str) or not re.fullmatch(
+                    r"[0-9]{1,32}", transition_id
+                ):
+                    issues.append(
+                        ConfigIssue(
+                            f"{transition_path}.{category}",
+                            "must be a numeric Jira transition id string",
+                        )
+                    )
+
+    sync = jira_map.get("sync")
+    if sync is not None:
+        sync_path = f"{path}.sync"
+        sync_map = _as_mapping(sync, sync_path, issues)
+        for key in set(sync_map) - {"trusted_pr_authors"}:
+            issues.append(
+                ConfigIssue(
+                    f"{sync_path}.{key}",
+                    "must be trusted_pr_authors",
+                )
+            )
+        if "trusted_pr_authors" in sync_map:
+            _validate_github_login_items(
+                sync_map.get("trusted_pr_authors"),
+                f"{sync_path}.trusted_pr_authors",
+                issues,
+            )
+
+    extra_keys = set(jira_map) - {
+        "site_url",
+        "cloud_id",
+        "project_id",
+        "project_key",
+        "issue_type_id",
+        "jql",
+        "status_category_map",
+        "field_mappings",
+        "mutations",
+        "sync",
+    }
+    for key in extra_keys:
+        issues.append(ConfigIssue(f"{path}.{key}", "unknown tracker.jira_cloud configuration key"))
+
+
+def _validate_tracker(tracker: Any, issues: list[ConfigIssue]) -> None:
+    if tracker is None:
+        return
+    tracker_map = _as_mapping(tracker, "tracker", issues)
+    extra_keys = set(tracker_map) - {"kind", "jira_cloud"}
+    for key in extra_keys:
+        issues.append(ConfigIssue(f"tracker.{key}", "unknown tracker configuration key"))
+
+    kind = tracker_map.get("kind", "github")
+    if kind not in tracker_contract.TRACKER_KINDS:
+        issues.append(
+            ConfigIssue("tracker.kind", f"must be one of {sorted(tracker_contract.TRACKER_KINDS)}")
+        )
+        return
+
+    jira_cloud = tracker_map.get("jira_cloud")
+    if kind == "jira_cloud":
+        if jira_cloud is None:
+            issues.append(
+                ConfigIssue(
+                    "tracker.jira_cloud",
+                    "jira_cloud kind requires a tracker.jira_cloud block",
+                )
+            )
+        else:
+            _validate_tracker_jira_cloud(jira_cloud, issues)
+    elif jira_cloud is not None:
+        issues.append(
+            ConfigIssue("tracker.jira_cloud", "must be omitted unless tracker.kind is jira_cloud")
+        )
+
+
 def validate_config(config: Mapping[str, Any]) -> list[ConfigIssue]:
     issues: list[ConfigIssue] = []
     if config.get("version") not in {1, "1"}:
@@ -568,6 +752,8 @@ def validate_config(config: Mapping[str, Any]) -> list[ConfigIssue]:
                     _require_string(str(key), f"{section_path}.{key}", issues)
                 _require_identifier(lane_name, f"{section_path}.{key}", issues)
 
+    _validate_tracker(config.get("tracker"), issues)
+
     owner_surface = config.get("owner_surface")
     if owner_surface is not None:
         owner_surface_map = _as_mapping(owner_surface, "owner_surface", issues)