core-runtime 2.12.0__tar.gz → 2.12.1__tar.gz

{core_runtime-2.12.0 → core_runtime-2.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: core-runtime
-Version: 2.12.0
+Version: 2.12.1
 Summary: CORE: executable constitutional governance for AI-assisted software development.
 License-Expression: MIT
 License-File: LICENSE
@@ -64,7 +64,7 @@ Description-Content-Type: text/markdown
 > Designed for environments where AI action traceability is not optional.
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Release](https://img.shields.io/badge/Release-v2.12.0-blue)](https://github.com/DariuszNewecki/CORE/releases)
+[![Release](https://img.shields.io/badge/Release-v2.12.1-blue)](https://github.com/DariuszNewecki/CORE/releases)
 [![Docs](https://img.shields.io/badge/Docs-online-green)](https://dariusznewecki.github.io/CORE/)
 [![Autonomy](https://img.shields.io/badge/Autonomy-A3%20unproven-orange)](https://github.com/DariuszNewecki/CORE/blob/main/.specs/attestations/production-readiness.yaml)
 
@@ -450,7 +450,7 @@ CORE's tracker mixes governance-internal bookkeeping with ordinary engineering w
 
 ## Project Status
 
-**Current Release:** v2.12.0 — CORE knows its own state: every verdict names the law it evaluated, an append-only state ledger, a stale daemon stops acting; verdicts mean the same for every project; PyPI publishes only from a green-CI commit
+**Current Release:** v2.12.1 — both install paths verified on a clean Ubuntu 26.04 LTS machine; adopter projects load their capability taxonomy again; a clean first audit with no warnings
 
 Active work: A3 Governed Autonomy. The mechanism is built — the daemon runs continuously,
 finds constitutional violations in its own codebase, proposes fixes, routes them through the

{core_runtime-2.12.0 → core_runtime-2.12.1}/README.md

@@ -5,7 +5,7 @@
 > Designed for environments where AI action traceability is not optional.
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Release](https://img.shields.io/badge/Release-v2.12.0-blue)](https://github.com/DariuszNewecki/CORE/releases)
+[![Release](https://img.shields.io/badge/Release-v2.12.1-blue)](https://github.com/DariuszNewecki/CORE/releases)
 [![Docs](https://img.shields.io/badge/Docs-online-green)](https://dariusznewecki.github.io/CORE/)
 [![Autonomy](https://img.shields.io/badge/Autonomy-A3%20unproven-orange)](https://github.com/DariuszNewecki/CORE/blob/main/.specs/attestations/production-readiness.yaml)
 
@@ -391,7 +391,7 @@ CORE's tracker mixes governance-internal bookkeeping with ordinary engineering w
 
 ## Project Status
 
-**Current Release:** v2.12.0 — CORE knows its own state: every verdict names the law it evaluated, an append-only state ledger, a stale daemon stops acting; verdicts mean the same for every project; PyPI publishes only from a green-CI commit
+**Current Release:** v2.12.1 — both install paths verified on a clean Ubuntu 26.04 LTS machine; adopter projects load their capability taxonomy again; a clean first audit with no warnings
 
 Active work: A3 Governed Autonomy. The mechanism is built — the daemon runs continuously,
 finds constitutional violations in its own codebase, proposes fixes, routes them through the

{core_runtime-2.12.0 → core_runtime-2.12.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [project]
 name = "core-runtime"
-version = "2.12.0"
+version = "2.12.1"
 description = "CORE: executable constitutional governance for AI-assisted software development."
 authors = [
     { name = "Dariusz Newecki", email = "d.newecki@gmail.com" },

{core_runtime-2.12.0 → core_runtime-2.12.1}/src/cli/commands/check/formatters.py

@@ -18,6 +18,7 @@ from rich.table import Table
 
 from shared.logger import getLogger
 from shared.models import AuditFinding, AuditSeverity, EvidenceClass
+from shared.models.audit_rendering import is_not_evaluated
 
 
 logger = getLogger(__name__)
@@ -32,12 +33,28 @@ _EVIDENCE_STYLES = {
 }
 
 
+# #956: a check that could not run established no verdict, so it has no
+# evidence class to show and is not a violation of its severity.
+_NOT_EVALUATED_SEVERITY = "[bold yellow]NOT EVALUATED[/bold yellow]"
+_NOT_EVALUATED_EVIDENCE = "[yellow]unavailable[/yellow]"
+
+
 # ID: 7b5e2a91-3c64-4d8f-9a1e-6f2b8c4d7e03
 def _evidence_label(evidence_class: EvidenceClass) -> str:
     """Render a finding's evidence class (ADR-113) for the Rich tables."""
     return _EVIDENCE_STYLES.get(evidence_class, str(evidence_class))
 
 
+def _row_labels(finding: AuditFinding, severity_styles: dict) -> tuple[str, str]:
+    """Severity and evidence cells; a not-evaluated finding shows as such (#956)."""
+    if is_not_evaluated(finding):
+        return _NOT_EVALUATED_SEVERITY, _NOT_EVALUATED_EVIDENCE
+    return (
+        severity_styles.get(finding.severity, str(finding.severity)),
+        _evidence_label(finding.evidence_class),
+    )
+
+
 # ID: b0dc9c82-dd40-4970-94e8-911fd3354930
 def print_verbose_findings(findings: list[AuditFinding]) -> None:
     """Prints every single finding in a detailed table for verbose output."""
@@ -64,9 +81,10 @@ def print_verbose_findings(findings: list[AuditFinding]) -> None:
         issue_count = finding.context.get("issue_count")
         if isinstance(issue_count, int) and issue_count > 1 and finding.file_path:
             location += f" (x{issue_count})"
+        severity_cell, evidence_cell = _row_labels(finding, severity_styles)
         table.add_row(
-            severity_styles.get(finding.severity, str(finding.severity)),
-            _evidence_label(finding.evidence_class),
+            severity_cell,
+            evidence_cell,
             escape(finding.check_id),
             escape(finding.message),
             escape(location),
@@ -105,9 +123,10 @@ def print_summary_findings(findings: list[AuditFinding]) -> None:
     )
     for (check_id, severity), finding_list in sorted_items:
         representative_message = finding_list[0].message
+        severity_cell, evidence_cell = _row_labels(finding_list[0], severity_styles)
         table.add_row(
-            severity_styles.get(severity, str(severity)),
-            _evidence_label(finding_list[0].evidence_class),
+            severity_cell,
+            evidence_cell,
             escape(check_id),
             escape(representative_message),
             str(len(finding_list)),

{core_runtime-2.12.0 → core_runtime-2.12.1}/src/cli/renderers/audit_overview.py

@@ -8,7 +8,11 @@ from rich.table import Table
 from rich.text import Text
 
 from shared.logger import getLogger
-from shared.models.audit_rendering import SeverityGroup, get_severity_style
+from shared.models.audit_rendering import (
+    SeverityGroup,
+    get_severity_style,
+    is_not_evaluated,
+)
 
 
 logger = getLogger(__name__)
@@ -29,13 +33,23 @@ def render_overview(console: Console, groups: list[SeverityGroup]) -> None:
     table.add_column("Severity", style="dim")
     table.add_column("Count", justify="right", style="cyan")
     table.add_column("%", justify="right", style="magenta")
+    not_evaluated = 0
     for group in groups:
-        count = len(group.findings)
+        # #956: a check that could not run is not a finding of its severity.
+        skipped = sum(1 for f in group.findings if is_not_evaluated(f))
+        not_evaluated += skipped
+        count = len(group.findings) - skipped
         if count == 0:
             continue
         pct = count / total * 100
         sev_text = Text(group.severity.name, style=get_severity_style(group.severity))
         table.add_row(sev_text, str(count), f"{pct:.1f}%")
+    if not_evaluated:
+        table.add_row(
+            Text("NOT EVALUATED", style="bold yellow"),
+            str(not_evaluated),
+            f"{not_evaluated / total * 100:.1f}%",
+        )
     console.print(table)
     _render_iceberg_rollup(console, groups)
 

{core_runtime-2.12.0 → core_runtime-2.12.1}/src/mind/logic/engines/registry.py

@@ -114,10 +114,18 @@ class EngineRegistry:
         from shared.infrastructure.intent.intent_repository import get_intent_repository
 
         global PASSIVE_ALIASES
-        try:
-            data = get_intent_repository().load_policy(
-                "taxonomies/substrate_enforcement"
+        repo = get_intent_repository()
+        if not repo.has_policy("taxonomies/substrate_enforcement"):
+            # An adopter project need not declare the taxonomy; the built-in set
+            # is the substrate default, not a degraded state (#957). A declared
+            # but unreadable taxonomy still warns below.
+            logger.debug(
+                "EngineRegistry: no substrate_enforcement taxonomy declared; "
+                "using the built-in PASSIVE_ALIASES."
             )
+            return
+        try:
+            data = repo.load_policy("taxonomies/substrate_enforcement")
             entries = data.get("entries", {})
             if isinstance(entries, dict) and entries:
                 PASSIVE_ALIASES = set(entries.keys())

{core_runtime-2.12.0 → core_runtime-2.12.1}/src/shared/_machinery_floor/enforcement/config/action_risk.yaml

@@ -25,6 +25,7 @@
 # VALUES: safe | moderate | dangerous
 
 actions:
+  action.execute: moderate
   assisted.apply_diff: moderate
   assisted.validate_diff: safe
   author.llm_resource: moderate
@@ -32,7 +33,10 @@ actions:
   build.tests: safe
   check.imports: safe
   claim.proposal: safe
+  cleanup.action_results: moderate
+  cleanup.agent_memory: moderate
   crate.create: safe
+  crate.create_from_spec: moderate
   document.gap_analysis: safe
   file.create: moderate
   file.edit: moderate
@@ -54,6 +58,7 @@ actions:
   fix.vulture_heal: dangerous
   log.archive_partitions: moderate
   log.maintain_partitions: safe
+  logging.reconfigure: safe
   project.cognitive_roles: moderate
   refactor.apply_split: dangerous
   remediate.cognitive_role: moderate
@@ -63,8 +68,10 @@ actions:
   # safe-auto-approval envelope.
   seed.external_run_resources: moderate
   sync.db: moderate
+  sync.knowledge_graph: moderate
   sync.vectors_code: moderate
   sync.vectors_constitution: moderate
   test.candidate_validate: safe
   test.execute: moderate
   test.sandbox_validate: safe
+  test.system: safe

{core_runtime-2.12.0 → core_runtime-2.12.1}/src/shared/_migrations/infra/migrations/manifest.yaml

@@ -376,3 +376,35 @@ migrations:
                          where table_schema = 'core' and table_name = 'users'
                            and column_name = 'display_name')
         - select to_regclass('core.runtime_settings') is null
+        # discriminator: the v2.10.2..v2.12.0 span's first structural change
+        # (ADR-169 D1); v2.11.0 shipped no migration, so its database is
+        # v2.10.2-shaped and recognised here
+        - select to_regclass('core.state_observations') is null
+    # v2.12.0 (2026-10-06): ADR-169's state ledger. `through` is the last
+    # manifest entry, as for v2.10.2: a v2.12.0 database is fully ledgered by
+    # its own schema.sql seed, so adoption records nothing and the hop replay
+    # is empty. Probes carry v2.10.2's markers plus the three ADR-169 tables
+    # and the widened trigger CHECK.
+    v2.12.0:
+      through: 20261005c_adr169_changes_and_outside_writes.sql
+      probes:
+        - select to_regclass('core._migrations') is not null
+        - select to_regclass('core.blackboard_entries') is not null
+        - >-
+          select exists (select 1 from information_schema.columns
+                         where table_schema = 'core' and table_name = '_migrations'
+                           and column_name = 'reconciled' and is_nullable = 'NO')
+        - >-
+          select exists (select 1 from information_schema.columns
+                         where table_schema = 'core' and table_name = 'autonomous_proposals'
+                           and column_name = 'consequence_recorded_at')
+        - select exists (select 1 from pg_namespace where nspname = 'core_archive')
+        - select to_regclass('core.runtime_settings') is null
+        - select to_regclass('core.state_observations') is not null
+        - >-
+          select exists (select 1 from pg_constraint
+                         where conrelid = to_regclass('core.state_observations')
+                           and conname = 'state_observations_trigger_check'
+                           and pg_get_constraintdef(oid) like '%cycle%')
+        - select to_regclass('core.state_changes') is not null
+        - select to_regclass('core.outside_writes') is not null

{core_runtime-2.12.0 → core_runtime-2.12.1}/src/shared/infrastructure/git_service.py

@@ -127,6 +127,22 @@ class GitService:
         """Returns the hash of the current HEAD commit."""
         return self._run_command(["rev-parse", "HEAD"])
 
+    # ID: d139c53d-af81-4ced-88d9-58fb673179e5
+    def has_head(self) -> bool:
+        """True when HEAD resolves to a commit. A freshly initialised repository
+        has none yet; that is a state, not a failure, so nothing is logged."""
+        try:
+            subprocess.run(
+                ["git", "rev-parse", "--verify", "--quiet", "HEAD^{commit}"],
+                cwd=self.repo_path,
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+        except subprocess.CalledProcessError:
+            return False
+        return True
+
     # ID: e7a5c19d-2f48-4b6c-9d3a-1f0b4e8c5d72
     def get_current_branch(self) -> str:
         """

{core_runtime-2.12.0 → core_runtime-2.12.1}/src/shared/infrastructure/intent/intent_repository.py

@@ -261,6 +261,14 @@ class IntentRepository(RootedRepository):
 
         raise GovernanceError(f"Policy not found for id: {policy_id}")
 
+    # ID: 74ac4a96-ee1f-40da-9ae0-43ffcbca2964
+    def has_policy(self, policy_id: str) -> bool:
+        """True when a policy id (the slash form load_policy accepts) resolves
+        to a file. Lets a caller tell "not declared" from "declared but
+        unreadable", which load_policy reports with the same error type."""
+        policy_id = policy_id.strip().lstrip("/")
+        return any(p.exists() for p in self._candidate_paths_for_id(policy_id))
+
     # ID: 375428ca-11be-4c31-b12b-9e0f7c11b766
     def list_workflows(self) -> list[str]:
         base = self.resolve_rel("workflows/definitions")

{core_runtime-2.12.0 → core_runtime-2.12.1}/src/shared/infrastructure/intent/law_state.py

@@ -83,6 +83,16 @@ def observe_law_state(intent_root: Path) -> LawState:
         )
     rel = root.relative_to(top).as_posix()
     git = GitService(top)
+    if not git.has_head():
+        # A repository with no commit has no law of record yet. A known state,
+        # reported in the finding, not a git failure (#958).
+        return LawState(
+            relationship="UNKNOWN",
+            reason=(
+                "the repository has no commit yet, so there is no law of record; "
+                "commit .intent/ to establish it"
+            ),
+        )
     try:
         head_sha = git.get_current_commit()
         record = git.ls_tree_blobs("HEAD", rel)

{core_runtime-2.12.0 → core_runtime-2.12.1}/src/shared/models/audit_rendering.py

@@ -28,3 +28,18 @@ def get_severity_style(severity: AuditSeverity) -> str:
         AuditSeverity.HIGH: "bold yellow",
         AuditSeverity.INFO: "cyan",
     }.get(severity, "white")
+
+
+# #956: findings that record a check which could not run (ADR-005 §3,
+# #847/#856). They carry the rule's severity for the verdict machinery, but
+# they assert no violation, so presentation must not show them as one.
+NOT_EVALUATED_FINDING_TYPES = frozenset(
+    {"ENFORCEMENT_UNAVAILABLE", "ENFORCEMENT_FAILURE"}
+)
+
+
+# ID: 1aece734-6bf6-40d9-877c-45628a8ea8da
+def is_not_evaluated(finding: AuditFinding) -> bool:
+    """True when the finding records a check that could not be evaluated."""
+    context = finding.context if isinstance(finding.context, dict) else {}
+    return context.get("finding_type") in NOT_EVALUATED_FINDING_TYPES