core-runtime 2.10.0__tar.gz → 2.10.2__tar.gz

{core_runtime-2.10.0 → core_runtime-2.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: core-runtime
-Version: 2.10.0
+Version: 2.10.2
 Summary: CORE: executable constitutional governance for AI-assisted software development.
 License-Expression: MIT
 License-File: LICENSE
@@ -66,7 +66,7 @@ Description-Content-Type: text/markdown
 > Designed for environments where AI action traceability is not optional.
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Release](https://img.shields.io/badge/Release-v2.10.0-blue)](https://github.com/DariuszNewecki/CORE/releases)
+[![Release](https://img.shields.io/badge/Release-v2.10.2-blue)](https://github.com/DariuszNewecki/CORE/releases)
 [![Docs](https://img.shields.io/badge/Docs-online-green)](https://dariusznewecki.github.io/CORE/)
 [![Autonomy](https://img.shields.io/badge/Autonomy-A3-blue)](https://github.com/DariuszNewecki/CORE/issues/106)
 
@@ -331,7 +331,7 @@ CORE does not claim a status it has not earned. The gates are defined in [URS-pr
 
 **Production readiness: NOT ATTESTED.** All gates must hold simultaneously, and each `met` gate must carry dated, human-signed evidence. There is no composite score.
 
-Progress: **1/15 met** · 12 partial · 1 not demonstrated · 1 not started.
+Progress: **2/15 met** · 12 partial · 1 not demonstrated.
 
 | Gate | Status | Primary gap |
 |------|--------|-------------|
@@ -345,7 +345,7 @@ Progress: **1/15 met** · 12 partial · 1 not demonstrated · 1 not started.
 | G8 — Integration tests for the governed mutation chain | ✅ met | None — no G8 acceptance criterion remains outstanding. |
 | G9 — Enforcement integrity fails closed | ⚠️ partial | Skipped blocking rules not yet proven distinguishable-from-covered by CI fixture; empty-graph vacuous-pass guard not built (unmapped non-advisory PASS gap, #822, is closed) |
 | G10 — Operator observability | ⚠️ partial | Questions 4 (failure diagnosis) and 5 (rollback) not confirmed answerable by a non-author without source access |
-| G11 — Upgrade and migration safety | ⬜ not started | Schema-as-dump (db_schema_live.sql); core._migrations records only (id, applied_at) — no delta path, no version sequence. Most critical structural gap. |
+| G11 — Upgrade and migration safety | ✅ met | None — every URS acceptance criterion is proven executable on disposable PostgreSQL for both released baselines (v2.9.1, v2.10.1); the route ships with 2.10.2. Governor ruling 2026-09-19: the declared updated_at changes during a v2.9.1 upgrade (touch triggers fired by the 20260722 backfill; #885 draft->pending) are acceptable — G11 requires preservation of governance history, not byte-identical storage. |
 | G12 — Runtime trust boundary is audited and documented | ⚠️ partial | Rate-limiting posture not fully documented; user-facing route safety not fully confirmed per-route |
 | G13 — Documentation for operators | ⚠️ partial | No operator runbook; CLAUDE.md is comprehensive for Claude Code but is not an operator document |
 | G14 — Source reversibility | ⚠️ partial | Source-restoration-after-completed-mutation not proven by test; rollback-vs-forward audit distinction not verified |
@@ -376,6 +376,10 @@ The full gate definitions and acceptance criteria are in [`URS-production-readin
 >
 > **Fastest way to see CORE today: run it on itself, below.**
 
+> **Upgrading an existing database?** Supported since 2.10.2 and always operator-run — CORE never
+> migrates on its own, and the installer and every service start refuse a database that is not
+> current. Procedure: [Upgrading an existing CORE database](docs/getting-started.md#upgrading-an-existing-core-database).
+
 **Full local runtime** — one command. Clone, then run the installer:
 
 ```bash
@@ -420,7 +424,7 @@ CORE's tracker mixes governance-internal bookkeeping with ordinary engineering w
 
 ## Project Status
 
-**Current Release:** v2.10.0 — Honest Offline Verdicts, Prompts Ship in the Wheel
+**Current Release:** v2.10.2 — Supported Database Upgrades (ADR-162: migration ledger, baseline adoption, startup schema gate, fail-closed installer; G11 met)
 
 Active work: A3 Governed Autonomy — the daemon runs continuously, finds constitutional violations in its own codebase, proposes fixes, executes approved fixes, and verifies the result. The governor's role is to define intent, review proposals that require architectural judgment, and approve constitutional changes.
 

{core_runtime-2.10.0 → core_runtime-2.10.2}/README.md

@@ -5,7 +5,7 @@
 > Designed for environments where AI action traceability is not optional.
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Release](https://img.shields.io/badge/Release-v2.10.0-blue)](https://github.com/DariuszNewecki/CORE/releases)
+[![Release](https://img.shields.io/badge/Release-v2.10.2-blue)](https://github.com/DariuszNewecki/CORE/releases)
 [![Docs](https://img.shields.io/badge/Docs-online-green)](https://dariusznewecki.github.io/CORE/)
 [![Autonomy](https://img.shields.io/badge/Autonomy-A3-blue)](https://github.com/DariuszNewecki/CORE/issues/106)
 
@@ -270,7 +270,7 @@ CORE does not claim a status it has not earned. The gates are defined in [URS-pr
 
 **Production readiness: NOT ATTESTED.** All gates must hold simultaneously, and each `met` gate must carry dated, human-signed evidence. There is no composite score.
 
-Progress: **1/15 met** · 12 partial · 1 not demonstrated · 1 not started.
+Progress: **2/15 met** · 12 partial · 1 not demonstrated.
 
 | Gate | Status | Primary gap |
 |------|--------|-------------|
@@ -284,7 +284,7 @@ Progress: **1/15 met** · 12 partial · 1 not demonstrated · 1 not started.
 | G8 — Integration tests for the governed mutation chain | ✅ met | None — no G8 acceptance criterion remains outstanding. |
 | G9 — Enforcement integrity fails closed | ⚠️ partial | Skipped blocking rules not yet proven distinguishable-from-covered by CI fixture; empty-graph vacuous-pass guard not built (unmapped non-advisory PASS gap, #822, is closed) |
 | G10 — Operator observability | ⚠️ partial | Questions 4 (failure diagnosis) and 5 (rollback) not confirmed answerable by a non-author without source access |
-| G11 — Upgrade and migration safety | ⬜ not started | Schema-as-dump (db_schema_live.sql); core._migrations records only (id, applied_at) — no delta path, no version sequence. Most critical structural gap. |
+| G11 — Upgrade and migration safety | ✅ met | None — every URS acceptance criterion is proven executable on disposable PostgreSQL for both released baselines (v2.9.1, v2.10.1); the route ships with 2.10.2. Governor ruling 2026-09-19: the declared updated_at changes during a v2.9.1 upgrade (touch triggers fired by the 20260722 backfill; #885 draft->pending) are acceptable — G11 requires preservation of governance history, not byte-identical storage. |
 | G12 — Runtime trust boundary is audited and documented | ⚠️ partial | Rate-limiting posture not fully documented; user-facing route safety not fully confirmed per-route |
 | G13 — Documentation for operators | ⚠️ partial | No operator runbook; CLAUDE.md is comprehensive for Claude Code but is not an operator document |
 | G14 — Source reversibility | ⚠️ partial | Source-restoration-after-completed-mutation not proven by test; rollback-vs-forward audit distinction not verified |
@@ -315,6 +315,10 @@ The full gate definitions and acceptance criteria are in [`URS-production-readin
 >
 > **Fastest way to see CORE today: run it on itself, below.**
 
+> **Upgrading an existing database?** Supported since 2.10.2 and always operator-run — CORE never
+> migrates on its own, and the installer and every service start refuse a database that is not
+> current. Procedure: [Upgrading an existing CORE database](docs/getting-started.md#upgrading-an-existing-core-database).
+
 **Full local runtime** — one command. Clone, then run the installer:
 
 ```bash
@@ -359,7 +363,7 @@ CORE's tracker mixes governance-internal bookkeeping with ordinary engineering w
 
 ## Project Status
 
-**Current Release:** v2.10.0 — Honest Offline Verdicts, Prompts Ship in the Wheel
+**Current Release:** v2.10.2 — Supported Database Upgrades (ADR-162: migration ledger, baseline adoption, startup schema gate, fail-closed installer; G11 met)
 
 Active work: A3 Governed Autonomy — the daemon runs continuously, finds constitutional violations in its own codebase, proposes fixes, executes approved fixes, and verifies the result. The governor's role is to define intent, review proposals that require architectural judgment, and approve constitutional changes.
 

{core_runtime-2.10.0 → core_runtime-2.10.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [project]
 name = "core-runtime"
-version = "2.10.0"
+version = "2.10.2"
 description = "CORE: executable constitutional governance for AI-assisted software development."
 authors = [
     { name = "Dariusz Newecki", email = "d.newecki@gmail.com" },

{core_runtime-2.10.0 → core_runtime-2.10.2}/src/body/infrastructure/lifespan.py

@@ -19,6 +19,7 @@ from body.services.service_registry import service_registry
 from shared.config import settings
 from shared.infrastructure.config_service import ConfigService
 from shared.infrastructure.diagnostic_service import DiagnosticService
+from shared.infrastructure.repositories.db.schema_gate import run_startup_schema_gate
 from shared.logger import apply_log_level, getLogger
 
 
@@ -61,6 +62,15 @@ async def core_lifespan(app: FastAPI):
                 else:
                     logger.warning("⚠️ ADVISORY MODE: Continuing despite %s", msg)
 
+            # 2b. SCHEMA GATE (ADR-162 D2): read-only; refuses to serve against
+            # a schema the code does not match (pending / unledgered /
+            # contradictory), naming the remedy. CORE_STRICT_MODE does not
+            # relax it. An unreachable database was already handled above.
+            # uvicorn turns the raised refusal into "Application startup
+            # failed" (its own exit code); the daemon and the core-engine
+            # entrypoint exit 78 for the same verdict.
+            await run_startup_schema_gate("CORE API")
+
             # 3. WARM UP HEAVY SERVICES
             cognitive = await service_registry.get_cognitive_service()
             auditor = await service_registry.get_auditor_context()

{core_runtime-2.10.0 → core_runtime-2.10.2}/src/cli/commands/daemon.py

@@ -659,6 +659,20 @@ async def _run_daemon_locked(only: str | None = None) -> None:
 
     logger.info("CORE daemon starting...")
 
+    # Schema gate (ADR-162 D2): read-only; the daemon must not start workers
+    # against a schema the code does not match. Refusal exits 78 (EX_CONFIG)
+    # with the remedy named; CORE_STRICT_MODE does not relax it, and an
+    # unreachable database keeps today's behaviour (workers report it).
+    from shared.infrastructure.repositories.db.schema_gate import (
+        SchemaGateRefusal,
+        run_startup_schema_gate,
+    )
+
+    try:
+        await run_startup_schema_gate("CORE daemon")
+    except SchemaGateRefusal as exc:
+        raise typer.Exit(code=exc.exit_code) from exc
+
     # git_service, knowledge_service and file_handler are mandatory (#643) —
     # construct them up front so CoreContext is fully wired. These were already
     # wired unconditionally (no try/except) further down; moving them into the

core_runtime-2.10.2/src/cli/resources/database/migrate.py

@@ -0,0 +1,132 @@
+# src/cli/resources/database/migrate.py
+"""
+Database migration command (ADR-162 D1, D3, D7).
+
+Applies pending SQL migrations recorded in infra/migrations/manifest.yaml
+against core._migrations. The canonical schema for a fresh install is the
+repository-root ``schema.sql`` (which seeds the ledger, D9); this ledger
+handles incremental changes on existing databases.
+
+Modes — only ``--write`` mutates anything (``cli.command.dangerous_marking``):
+
+    core-admin database migrate                          # dry run: list pending
+    core-admin database migrate --write                  # apply pending, atomically
+    core-admin database migrate --adopt-baseline v2.9.1  # verify only (dry run)
+    core-admin database migrate --adopt-baseline v2.9.1 --write   # record baseline
+
+``--apply`` survives one release as a deprecated alias for ``--write``.
+``--bootstrap`` is retired: it recorded every manifest entry as applied without
+verifying anything, which marked a stale schema as current (ADR-162 D3).
+
+Execution (ADR-162 D7): each pending migration runs in ONE transaction
+together with its ``core._migrations`` row, under a fixed advisory lock with
+the ledger re-read inside the lock. A failure leaves that migration fully
+rolled back and unrecorded; earlier ones stay recorded; re-running is safe.
+Files may keep a leading ``BEGIN;`` / trailing ``COMMIT;`` (stripped by the
+engine); any other transaction control or non-transactional statement is
+refused before anything executes. An entry declared ``reconcilable`` whose
+verify probe already holds is recorded without execution (D12 §2).
+
+Refused (fail closed): an empty ledger on a populated schema (adopt a verified
+baseline first) and a ledger/schema contradiction (a recorded entry whose
+probe fails). Upgrading an existing database remains UNSUPPORTED until the
+release that ships ADR-162 U2-U7; these commands are unreleased.
+
+Workflow going forward:
+    # 1. Write infra/scripts/migrations/YYYYMMDD_description.sql
+    # 2. Append filename to infra/migrations/manifest.yaml order list
+    #    (with a `verify` probe under `probes:`)
+    # 3. core-admin database migrate --write
+"""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+
+from cli.utils import core_command
+from shared.infrastructure.repositories.db.migration_service import (
+    MigrationServiceError,
+    adopt_baseline,
+    migrate_db,
+)
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("migrate")
+@core_command(dangerous=True, requires_context=False, requires_brain_services=False)
+# ID: d8b7978f-d801-4ba2-a669-f0fd48851b01
+async def migrate_database(
+    ctx: typer.Context,
+    write: bool = typer.Option(
+        False,
+        "--write",
+        help="Execute pending migrations (or record the adopted baseline). "
+        "Without this flag nothing is mutated.",
+    ),
+    apply: bool = typer.Option(
+        False,
+        "--apply",
+        help="DEPRECATED alias for --write; removed next release.",
+    ),
+    adopt_baseline_tag: str | None = typer.Option(
+        None,
+        "--adopt-baseline",
+        metavar="TAG",
+        help=(
+            "Verify that the database is at the declared baseline TAG (e.g. v2.9.1) "
+            "and, with --write, record the manifest entries through it. Refuses "
+            "unless every probe of TAG holds and no later baseline also holds."
+        ),
+    ),
+) -> None:
+    """Show pending migrations, apply them, or adopt a verified baseline.
+
+    Dry run (default): prints pending migration IDs from the manifest.
+    --write: executes pending SQL files, each atomically with its ledger row.
+    --adopt-baseline TAG [--write]: verifies TAG's probes; records ≤ TAG.
+    """
+    if apply:
+        console.print(
+            "[yellow]--apply is deprecated;[/yellow] use --write. "
+            "Treating as --write for this release."
+        )
+        write = True
+    try:
+        if adopt_baseline_tag is not None:
+            adoption = await adopt_baseline(adopt_baseline_tag, write=write)
+            if write:
+                console.print(
+                    f"[green]Baseline {adoption.tag} adopted.[/green] "
+                    f"{len(adoption.recorded)} ledger row(s) recorded through "
+                    f"{adoption.through}."
+                )
+            else:
+                console.print(
+                    f"[green]Baseline {adoption.tag} verified.[/green] "
+                    f"{len(adoption.to_record)} ledger row(s) would be recorded "
+                    f"through {adoption.through}. Pass --write to record them."
+                )
+            return
+
+        report = await migrate_db(write=write)
+        if not write:
+            console.print(
+                f"[yellow]Dry run.[/yellow] {len(report.pending_before)} pending. "
+                "Pass --write to execute pending migrations."
+            )
+            for mig in report.pending_before:
+                console.print(f"  • {mig}")
+        else:
+            console.print(
+                f"[green]Migrations complete.[/green] "
+                f"{len(report.applied)} applied, {len(report.reconciled)} reconciled, "
+                f"{len(report.skipped)} skipped."
+            )
+    except MigrationServiceError as exc:
+        console.print(f"[red]Migration error:[/red] {exc}")
+        raise typer.Exit(code=exc.exit_code) from exc

{core_runtime-2.10.0 → core_runtime-2.10.2}/src/cli/resources/database/status.py

@@ -3,6 +3,15 @@
 Database status command.
 
 Shows health metrics, connection status, and diagnostics.
+
+Read-only (ADR-162 D2/D3): never creates the ledger or any other object.
+Reports pending migrations, ledger/schema contradictions (recorded entries
+whose verify probe fails) and, when the ledger is empty on a populated
+schema, the declared baseline that matches — a suggestion for
+``database migrate --adopt-baseline``, never an action.
+
+Exit codes (scriptable): 0 current; 2 pending, contradictory or unledgered;
+1 the check itself failed.
 """
 
 from __future__ import annotations
@@ -25,7 +34,7 @@ console = Console()
 
 
 @app.command("status")
-@core_command(dangerous=False, requires_context=False)
+@core_command(dangerous=False, requires_context=False, requires_brain_services=False)
 # ID: 7c22539d-3f8e-4d18-8457-9d194062a94e
 async def database_status(
     ctx: typer.Context,
@@ -76,15 +85,22 @@ async def database_status(
         result = {
             "connected": report.is_connected,
             "version": report.db_version,
-            "applied_migrations": list(report.applied_migrations),
+            "ledger_present": report.ledger_present,
+            "schema_present": report.schema_present,
+            "applied_migrations": sorted(report.applied_migrations),
             "pending_migrations": report.pending_migrations,
+            "probe_failures": report.probe_failures,
+            "baseline_suggestion": report.baseline_suggestion,
+            "assets": report.assets_origin,
+            "current": report.is_current,
         }
         sys.stdout.write(json.dumps(result, indent=2, default=str) + "\n")
-        return
-
-    console.print("[bold cyan]📊 Database Status[/bold cyan]")
-    console.print()
-    _display_status_table(report, detailed)
+    else:
+        console.print("[bold cyan]📊 Database Status[/bold cyan]")
+        console.print()
+        _display_status_table(report, detailed)
+    if not report.is_current:
+        raise typer.Exit(2)
 
 
 def _display_status_table(report, detailed: bool) -> None:
@@ -103,11 +119,35 @@ def _display_status_table(report, detailed: bool) -> None:
     mig_table = Table(show_header=False)
     mig_table.add_column("Metric", style="cyan")
     mig_table.add_column("Value")
+    mig_table.add_row("Assets", report.assets_origin or "N/A")
+    mig_table.add_row("Ledger", "present" if report.ledger_present else "absent")
     mig_table.add_row("Applied", str(len(report.applied_migrations)))
     mig_table.add_row("Pending", str(len(report.pending_migrations)))
+    mig_table.add_row("Probe failures", str(len(report.probe_failures)))
     console.print(mig_table)
+    if report.probe_failures:
+        console.print()
+        console.print(
+            "[red]✗ Ledger/schema contradiction — recorded but the probe fails:[/red]"
+        )
+        for mig in report.probe_failures:
+            console.print(f"  • {mig}")
+    if report.schema_present and not report.applied_migrations:
+        console.print()
+        if report.baseline_suggestion:
+            console.print(
+                "[yellow]⚠️  Empty ledger on a populated schema.[/yellow] Matches "
+                f"baseline [bold]{report.baseline_suggestion}[/bold]; adopt it with:\n"
+                f"  core-admin database migrate --adopt-baseline "
+                f"{report.baseline_suggestion} --write"
+            )
+        else:
+            console.print(
+                "[yellow]⚠️  Empty ledger on a populated schema[/yellow] and no "
+                "declared baseline matches it."
+            )
     if report.pending_migrations:
         console.print()
         console.print("[yellow]⚠️  Pending migrations:[/yellow]")
-        for mig in sorted(report.pending_migrations):
+        for mig in report.pending_migrations:
             console.print(f"  • {mig}")

core_runtime-2.10.2/src/shared/_migrations/__init__.py

@@ -0,0 +1,13 @@
+# src/shared/_migrations/__init__.py
+"""Wheel-side mirror of the migration assets (ADR-162 D8, U7).
+
+Package data, not a source of truth: ``infra/migrations/manifest.yaml``,
+every ``.sql`` file the manifest lists under ``infra/scripts/migrations/``
+and the repository-root ``schema.sql`` are copied here byte for byte in the
+same relative layout, so the ledger engine resolves paths identically from a
+source checkout and from an installed wheel. The parity test
+(``tests/infra/test_migrations_ship_in_wheel.py``) enforces that every
+change updates source and mirror in the same commit; there is no runtime
+synchronisation. Resolved through
+``shared.infrastructure.repositories.db.common.resolve_migration_assets``.
+"""