core-runtime 2.14.4__tar.gz → 2.14.5__tar.gz

{core_runtime-2.14.4 → core_runtime-2.14.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: core-runtime
-Version: 2.14.4
+Version: 2.14.5
 Summary: CORE: executable constitutional governance for AI-assisted software development.
 License-Expression: MIT
 License-File: LICENSE
@@ -58,10 +58,10 @@ Description-Content-Type: text/markdown
 > **Executable constitutional governance for AI-assisted software development.**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Release](https://img.shields.io/badge/Release-v2.14.4-blue)](https://github.com/DariuszNewecki/CORE/releases)
+[![Release](https://img.shields.io/badge/Release-v2.14.5-blue)](https://github.com/DariuszNewecki/CORE/releases)
 [![Docs](https://img.shields.io/badge/Docs-online-green)](https://dariusznewecki.github.io/CORE/)
 
-**Current Release:** v2.14.4 — see [CHANGELOG.md](CHANGELOG.md).
+**Current Release:** v2.14.5 — see [CHANGELOG.md](CHANGELOG.md).
 
 ## What CORE is
 

{core_runtime-2.14.4 → core_runtime-2.14.5}/README.md

@@ -3,10 +3,10 @@
 > **Executable constitutional governance for AI-assisted software development.**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Release](https://img.shields.io/badge/Release-v2.14.4-blue)](https://github.com/DariuszNewecki/CORE/releases)
+[![Release](https://img.shields.io/badge/Release-v2.14.5-blue)](https://github.com/DariuszNewecki/CORE/releases)
 [![Docs](https://img.shields.io/badge/Docs-online-green)](https://dariusznewecki.github.io/CORE/)
 
-**Current Release:** v2.14.4 — see [CHANGELOG.md](CHANGELOG.md).
+**Current Release:** v2.14.5 — see [CHANGELOG.md](CHANGELOG.md).
 
 ## What CORE is
 

{core_runtime-2.14.4 → core_runtime-2.14.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [project]
 name = "core-runtime"
-version = "2.14.4"
+version = "2.14.5"
 description = "CORE: executable constitutional governance for AI-assisted software development."
 authors = [
     { name = "Dariusz Newecki", email = "d.newecki@gmail.com" },

{core_runtime-2.14.4 → core_runtime-2.14.5}/src/cli/logic/mcp_server.py

@@ -39,10 +39,15 @@ _INSTRUCTIONS = (
     "limits. Before committing, call change_verdict on your change: BLOCKED "
     "means a blocking rule is violated; CLEAR_IN_SCOPE means none of the rules "
     "it evaluated is, and it names the rules it did not evaluate. It never says "
-    "PASS; the full audit (CI) is authoritative. To submit a change, "
-    "validate_change asks CORE to check a patch and submit_change records it as "
-    "a pending proposal; both need a running CORE. No tool can approve, waive or "
-    "act as the governor."
+    "PASS: the full audit is authoritative (`core-admin code audit --offline`, "
+    "and CORE's GitHub Action on every pull request). How a change lands "
+    "(#1044): without a running CORE (a plain pip install), call change_verdict, "
+    "commit only if it is not BLOCKED, and let the pull request's audit decide. "
+    "Use validate_change and submit_change only when this project runs CORE "
+    "(its API): validate_change has CORE check a patch in full and "
+    "submit_change records it as a pending proposal that the governor approves "
+    "instead of you committing it; without a running CORE both report that "
+    "they cannot reach it. No tool can approve, waive or act as the governor."
 )
 
 # The read tools only read the repository; none reaches outside it.

{core_runtime-2.14.4 → core_runtime-2.14.5}/src/cli/logic/project_scaffold.py

@@ -28,6 +28,7 @@ Nothing is ever git-added into CORE's repository.
 
 from __future__ import annotations
 
+import importlib.metadata
 import keyword
 import re
 import shutil
@@ -49,6 +50,46 @@ logger = getLogger(__name__)
 
 _INTENT_DIR = ".intent"
 _NAME_PATTERN = re.compile(r"^[A-Za-z][A-Za-z0-9_-]*$")
+# The GitHub Action that runs the full audit on every pull request (#1043:
+# an adopter repo had no authoritative verdict anywhere; "CI decides" named
+# a CI that did not exist).
+AUDIT_WORKFLOW = ".github/workflows/core-audit.yml"
+_RELEASE = re.compile(r"^\d+\.\d+\.\d+$")
+
+
+# ID: c5276db2-d259-4452-8383-91ca06646faf
+def render_audit_workflow(version: str | None = None) -> str:
+    """The workflow file for CORE's GitHub Action, pinned to the installed
+    release (``main`` when the installed version is not a release)."""
+    if version is None:
+        try:
+            version = importlib.metadata.version("core-runtime")
+        except importlib.metadata.PackageNotFoundError:
+            version = ""
+    ref = f"v{version}" if _RELEASE.match(version or "") else "main"
+    return (
+        "# CORE audits every pull request against this repository's .intent/.\n"
+        "# Written by `core-admin project init`; the verdict here is the\n"
+        "# authoritative one (change_verdict and pre-commit checks are feedback).\n"
+        "name: CORE audit\n"
+        "\n"
+        "on:\n"
+        "  pull_request:\n"
+        "  push:\n"
+        "    branches: [main]\n"
+        "\n"
+        "permissions:\n"
+        "  contents: read\n"
+        "\n"
+        "jobs:\n"
+        "  audit:\n"
+        "    runs-on: ubuntu-latest\n"
+        "    steps:\n"
+        "      - uses: actions/checkout@v4\n"
+        f"      - uses: DariuszNewecki/CORE@{ref}\n"
+        "        with:\n"
+        "          severity: block\n"
+    )
 
 
 @dataclass(frozen=True)
@@ -104,6 +145,7 @@ def plan_new_project(name: str, parent: Path, core_root: Path | None) -> NewProj
         ("README.md", _render_readme(name)),
         (f"src/{package}/__init__.py", f'"""{name}."""\n'),
         ("tests/__init__.py", ""),
+        (AUDIT_WORKFLOW, render_audit_workflow()),
     )
     return NewProjectPlan(
         name=name,
@@ -191,6 +233,9 @@ class InitPlan:
 
     target_root: Path
     floor_copies: tuple[tuple[Path, str], ...]
+    workflow: tuple[str, str] = (AUDIT_WORKFLOW, "")
+    """(target-relative path, text): CORE's GitHub Action, written unless a
+    file is already there (#1043)."""
 
 
 # ID: 8f485883-8756-4dba-a165-c0048f5ba34f
@@ -212,6 +257,7 @@ def plan_init(target: Path, core_root: Path | None) -> InitPlan:
             (src, f"{_INTENT_DIR}/{src.relative_to(floor_dir).as_posix()}")
             for src in _machinery_floor_files(floor_dir)
         ),
+        workflow=(AUDIT_WORKFLOW, render_audit_workflow()),
     )
 
 
@@ -227,7 +273,8 @@ def write_init(
     Refuses (``typer.Exit(1)``), in dry-run as well, when the target overlaps
     CORE's own repository or is a system directory, is not an existing
     directory, or already has a ``.intent/`` (ADR-111 D3: never overwrite a
-    constitution). Returns the file count.
+    constitution). Also writes CORE's GitHub Action workflow unless a file
+    is already at its path. Returns the floor file count.
     """
     target = plan.target_root
     _reject_unsafe_target(
@@ -261,6 +308,17 @@ def write_init(
             "Delivery incomplete at %s; missing: %s", target, ", ".join(missing)
         )
         raise typer.Exit(code=1)
+    rel, text = plan.workflow
+    workflow = target / rel
+    if not workflow.exists():
+        try:
+            workflow.parent.mkdir(parents=True, exist_ok=True)
+            workflow.write_text(text, encoding="utf-8")
+        except OSError as exc:
+            logger.error("Could not write %s: %s", workflow, exc)
+            raise typer.Exit(code=1) from exc
+        if outside is not None:
+            outside.wrote(workflow)
     return len(plan.floor_copies)
 
 

{core_runtime-2.14.4 → core_runtime-2.14.5}/src/cli/resources/code/audit.py

@@ -444,8 +444,14 @@ def _render_text_summary(
             f"{len(law.get('drift_paths') or [])} file(s) under .intent/ differ "
             "from the last commit; commit or revert them"
         )
+        # #1045: with a blocking violation the verdict is FAIL anyway.
+        effect = (
+            "the violations above stand"
+            if result.get("verdict") == "FAIL"
+            else "verdict DEGRADED, not PASS"
+        )
         console.print(
-            "[bold yellow]Law not committed (verdict DEGRADED, not PASS):"
+            f"[bold yellow]Law not committed ({effect}):"
             f"[/bold yellow] {reason}, then audit again."
         )
     if skipped:

{core_runtime-2.14.4 → core_runtime-2.14.5}/src/cli/resources/project/init.py

@@ -66,7 +66,8 @@ async def init_project_command(
     if not write:
         console.print(
             f"[bold cyan]Preview:[/bold cyan] {count} machinery-floor files would be "
-            f"copied into {plan.target_root / '.intent'}."
+            f"copied into {plan.target_root / '.intent'}, and CORE's GitHub Action "
+            f"workflow written to {plan.workflow[0]} unless one is there."
         )
         console.print("Pass [cyan]--write[/cyan] to copy them.")
         return
@@ -74,8 +75,19 @@ async def init_project_command(
         f"[bold green]Machinery floor delivered:[/bold green] {plan.target_root} "
         f"({count} files in .intent/)."
     )
+    workflow = plan.workflow[0]
+    if (plan.target_root / workflow).read_text(encoding="utf-8") == plan.workflow[1]:
+        console.print(
+            f"CORE's GitHub Action: [cyan]{workflow}[/cyan] audits every pull "
+            "request once committed; its verdict is the authoritative one."
+        )
+    else:
+        console.print(
+            f"[yellow]{workflow} already exists and was left as it is.[/yellow]"
+        )
     console.print(
         "Next: [cyan]core-admin project adopt-pack core/starter-python --write[/cyan], "
-        "commit .intent/ ([cyan]git add .intent && git commit[/cyan]), then "
+        "commit .intent/ and the workflow ([cyan]git add .intent .github && git "
+        "commit[/cyan]), then "
         "[cyan]core-admin code audit --offline[/cyan]."
     )

{core_runtime-2.14.4 → core_runtime-2.14.5}/src/mind/governance/auditor.py

@@ -223,10 +223,6 @@ class ConstitutionalAuditor:
         ):
             return AuditVerdict.DEGRADED
 
-        # ADR-169 D2: the law evaluated is not known to be the law of record.
-        if law_drift_degrades(policy, law_relationship):
-            return AuditVerdict.DEGRADED
-
         fail_sevs = {AuditSeverity[name] for name in policy["fail_severities"]}
         ignored_types = set(policy["ignored_finding_types"])
 
@@ -243,4 +239,10 @@ class ConstitutionalAuditor:
         if has_blocking_violations:
             return AuditVerdict.FAIL
 
+        # ADR-169 D2: the law evaluated is not known to be the law of record.
+        # After the FAIL check (#1045): uncommitted law does not hide a proven
+        # violation; it only keeps a clean result from being PASS.
+        if law_drift_degrades(policy, law_relationship):
+            return AuditVerdict.DEGRADED
+
         return AuditVerdict.PASS

{core_runtime-2.14.4 → core_runtime-2.14.5}/src/mind/governance/fast_verdict.py

@@ -54,7 +54,8 @@ NOT_EVALUATED = "NOT_EVALUATED"
 _BLOCKING = {"block", "blocking"}
 _AUTHORITY_NOTE = (
     "Producer feedback, not the authoritative verdict. PASS is given only by the "
-    "full audit (CI), which evaluates every rule."
+    "full audit, which evaluates every rule: `core-admin code audit --offline` "
+    "locally, and CORE's GitHub Action on every pull request (#1043)."
 )
 
 

{core_runtime-2.14.4 → core_runtime-2.14.5}/src/mind/governance/stateless_audit.py

@@ -390,17 +390,22 @@ async def run_stateless_audit(
     # ADR-169 D2: same precondition, same helper as the online auditor.
     law_drift = law_drift_degrades(verdict_policy, law_state.relationship)
 
-    if (
-        verdict_policy.get("_error")
-        or degraded_findings
-        or blocking_skipped
-        or law_drift
-    ):
+    # #1045 (proof run 2): uncommitted law does not hide a proven blocking
+    # violation. Law drift means the law evaluated is not the law of record,
+    # not that the instrument failed; the code still violates the law it was
+    # judged against, so FAIL, with the drift finding alongside. An
+    # adopter's first audit before committing .intent/ showed a BLOCK finding
+    # under DEGRADED. The instrument conditions (policy, unavailable or
+    # skipped blocking rules) keep their precedence (#847/#856 rulings).
+    if verdict_policy.get("_error") or degraded_findings or blocking_skipped:
         verdict = "DEGRADED"
         passed = False
     elif genuine_blocking_findings:
         verdict = "FAIL"
         passed = False
+    elif law_drift:
+        verdict = "DEGRADED"
+        passed = False
     else:
         verdict = "PASS"
         passed = True

{core_runtime-2.14.4 → core_runtime-2.14.5}/src/shared/_packs/python_hygiene.yaml

@@ -1,6 +1,6 @@
 kind: governance_pack
 id: "core/python-hygiene"
-version: "1.1.0"
+version: "1.2.0"
 title: "Python Hygiene (Intermediate)"
 description: >
   Stricter baseline for teams that have outgrown the starter pack and want
@@ -138,7 +138,7 @@ enforcement_mappings:
     engine: regex_gate
     params:
       forbidden_patterns:
-        - "(?i)\\b(password|passwd|secret_key|api_key|access_token|auth_token)\\s*=\\s*['\"][^'\"\\s]{8,}['\"]"
+        - "(?i)\\b\\w*(?:password|passwd|pwd|secret_?key|client_?secret|api_?key|access_?token|auth_?token|private_?key)\\w*\\s*(?::\\s*[\\w\\[\\]., |]+)?=\\s*['\"][^'\"\\s]{4,}['\"]"
     scope:
       applies_to: ["**/*.py"]
       excludes:

{core_runtime-2.14.4 → core_runtime-2.14.5}/src/shared/_packs/starter_python.yaml

@@ -1,6 +1,6 @@
 kind: governance_pack
 id: "core/starter-python"
-version: "1.1.0"
+version: "1.2.0"
 title: "Starter Python Hygiene"
 description: >
   Zero-friction baseline for any Python project. Four proven rules covering
@@ -106,7 +106,7 @@ enforcement_mappings:
     engine: regex_gate
     params:
       forbidden_patterns:
-        - "(?i)\\b(password|passwd|secret_key|api_key|access_token|auth_token)\\s*=\\s*['\"][^'\"\\s]{8,}['\"]"
+        - "(?i)\\b\\w*(?:password|passwd|pwd|secret_?key|client_?secret|api_?key|access_?token|auth_?token|private_?key)\\w*\\s*(?::\\s*[\\w\\[\\]., |]+)?=\\s*['\"][^'\"\\s]{4,}['\"]"
     scope:
       applies_to: ["**/*.py"]
       excludes: