core-runtime 2.16.0__tar.gz → 3.0.0__tar.gz

{core_runtime-2.16.0 → core_runtime-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: core-runtime
-Version: 2.16.0
+Version: 3.0.0
 Summary: CORE: executable constitutional governance for AI-assisted software development.
 License-Expression: MIT
 License-File: LICENSE
@@ -27,7 +27,7 @@ Requires-Dist: cryptography (>=50.0.1,<51.0.0)
 Requires-Dist: dependency-injector (>=4.49.1,<5.0.0)
 Requires-Dist: email-validator (>=2.0,<3.0)
 Requires-Dist: fastapi (>=0.136.0,<0.137.0)
-Requires-Dist: filelock (>=3.32.7,<4.0.0)
+Requires-Dist: filelock (>=4.2.1,<5.0.0)
 Requires-Dist: httpx (>=0.28.0,<0.29.0)
 Requires-Dist: jsonschema (>=4.26.0,<5)
 Requires-Dist: mcp (>=2.3.0,<2.4.0)
@@ -43,7 +43,7 @@ Requires-Dist: radon (>=6.0.1,<7.0.0)
 Requires-Dist: redis (>=5.0,<6.0)
 Requires-Dist: rich (>=13,<16)
 Requires-Dist: scikit-learn (>=1.9.1,<2.0.0)
-Requires-Dist: setuptools (>=84.0.0)
+Requires-Dist: setuptools (>=84.1.0)
 Requires-Dist: sqlalchemy[asyncio] (>=2.1.2,<3.0.0)
 Requires-Dist: sqlparse (>=0.6.0,<0.7.0)
 Requires-Dist: typer (>=0.26.0,<0.28.0)
@@ -58,10 +58,10 @@ Description-Content-Type: text/markdown
 > **Executable constitutional governance for AI-assisted software development.**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/DariuszNewecki/CORE/blob/main/LICENSE)
-[![Release](https://img.shields.io/badge/Release-v2.16.0-blue)](https://github.com/DariuszNewecki/CORE/releases)
+[![Release](https://img.shields.io/badge/Release-v3.0.0-blue)](https://github.com/DariuszNewecki/CORE/releases)
 [![Docs](https://img.shields.io/badge/Docs-online-green)](https://dariusznewecki.github.io/CORE/)
 
-**Current Release:** v2.16.0 — see [CHANGELOG.md](https://github.com/DariuszNewecki/CORE/blob/main/CHANGELOG.md).
+**Current Release:** v3.0.0 — see [CHANGELOG.md](https://github.com/DariuszNewecki/CORE/blob/main/CHANGELOG.md).
 
 ## What CORE is
 
@@ -126,7 +126,7 @@ claude mcp add --scope project core -- core-admin mcp run
 Claude Code starts `core-admin` itself, so it must be on `PATH` in the shell
 you start `claude` from: activate the virtual environment first, or install
 with `pipx install core-runtime` (then `pipx ensurepath`) so it is on `PATH` in
-every shell. Everyone who uses the committed `.mcp.json` needs the same.
+every shell; get pipx first with `sudo apt install pipx` on Debian/Ubuntu. Everyone who uses the committed `.mcp.json` needs the same.
 
 A new project:
 

{core_runtime-2.16.0 → core_runtime-3.0.0}/README.md

@@ -3,10 +3,10 @@
 > **Executable constitutional governance for AI-assisted software development.**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/DariuszNewecki/CORE/blob/main/LICENSE)
-[![Release](https://img.shields.io/badge/Release-v2.16.0-blue)](https://github.com/DariuszNewecki/CORE/releases)
+[![Release](https://img.shields.io/badge/Release-v3.0.0-blue)](https://github.com/DariuszNewecki/CORE/releases)
 [![Docs](https://img.shields.io/badge/Docs-online-green)](https://dariusznewecki.github.io/CORE/)
 
-**Current Release:** v2.16.0 — see [CHANGELOG.md](https://github.com/DariuszNewecki/CORE/blob/main/CHANGELOG.md).
+**Current Release:** v3.0.0 — see [CHANGELOG.md](https://github.com/DariuszNewecki/CORE/blob/main/CHANGELOG.md).
 
 ## What CORE is
 
@@ -71,7 +71,7 @@ claude mcp add --scope project core -- core-admin mcp run
 Claude Code starts `core-admin` itself, so it must be on `PATH` in the shell
 you start `claude` from: activate the virtual environment first, or install
 with `pipx install core-runtime` (then `pipx ensurepath`) so it is on `PATH` in
-every shell. Everyone who uses the committed `.mcp.json` needs the same.
+every shell; get pipx first with `sudo apt install pipx` on Debian/Ubuntu. Everyone who uses the committed `.mcp.json` needs the same.
 
 A new project:
 

{core_runtime-2.16.0 → core_runtime-3.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [project]
 name = "core-runtime"
-version = "2.16.0"
+version = "3.0.0"
 description = "CORE: executable constitutional governance for AI-assisted software development."
 authors = [
     { name = "Dariusz Newecki", email = "d.newecki@gmail.com" },
@@ -70,7 +70,7 @@ dependencies = [
     "scikit-learn>=1.9.1,<2.0.0",
     # Utilities
     "msgpack>=1.2.3,<2.0.0",
-    "filelock>=3.32.7,<4.0.0",
+    "filelock>=4.2.1,<5.0.0",
     "pathspec>=1.1.0,<2.0.0",
     # Dependency Injection
     "dependency-injector>=4.49.1,<5.0.0",
@@ -80,9 +80,9 @@ dependencies = [
     "redis>=5.0,<6.0",
     # Security floors for transitive deps (pip-audit; not directly imported):
     # click via typer/uvicorn/httpx — PYSEC-2026-2132 (click.edit command injection, fixed 8.3.3)
-    # setuptools via greenlet/uvloop — PYSEC-2026-3447 (MANIFEST NFD/NFC bypass, fixed 83.0.0)
+    # setuptools via greenlet/uvloop — PYSEC-2026-3447 (fixed 83.0.0), GHSA-xmj3-9gf7-h52w (fixed 84.1.0)
     "click>=8.5.0",
-    "setuptools>=84.0.0",
+    "setuptools>=84.1.0",
 ]
 
 [project.urls]

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/api/cli/client.py

@@ -134,24 +134,12 @@ class CoreApiClient:
             response.raise_for_status()
             return response.json()
 
-    # ID: 1205e380-4b68-4a53-b56d-0eec74896962
-    async def _poll_run(self, run_id: str, timeout_seconds: float = 300.0) -> dict:
-        """Poll GET /v1/fix/runs/{run_id} until status is completed or failed.
-
-        Returns the terminal run payload. Raises TimeoutError if the run
-        does not reach a terminal state within `timeout_seconds`. Used by
-        CLIs over async /fix and /quality endpoints (ADR-055 D2/D3).
-        """
-        return await self._poll_at_path(
-            f"/v1/fix/runs/{run_id}", timeout_seconds=timeout_seconds
-        )
-
     # ID: c19f4d5e-2b7a-4f8e-bd03-6a8c5d1f9e02
     async def _poll_at_path(self, path: str, timeout_seconds: float = 300.0) -> dict:
         """Poll an arbitrary `GET {path}` until status terminal.
 
-        Generalisation of `_poll_run` for Phase 3 resources whose poll
-        paths differ from /v1/fix/runs/ (e.g. /v1/coverage/runs/,
+        Used by Phase 3 resources whose poll paths are not
+        /v1/fix/runs/ (e.g. /v1/coverage/runs/,
         /v1/refactor/runs/, /v1/audit/remediations/).
         """
         async with asyncio.timeout(timeout_seconds):

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/body/governance/intent_guard.py

@@ -47,7 +47,7 @@ CORE_ROLE = "facade"  # ADR-095 D3
 #    declares itself context-level (``is_context_level_for``) and its per-file
 #    ``verify()`` explicitly rejects per-file dispatch as a mapping error:
 #       ast_gate, glob_gate, knowledge_gate, llm_gate, regex_gate,
-#       taxonomy_gate, cli_gate, workflow_gate, contracts_gate, runtime_gate
+#       taxonomy_gate, cli_gate, workflow_gate, contracts_gate
 #
 # 2. Passive-marker engines (no write-time check exists; enforcement happens
 #    elsewhere — at runtime, at parse time, at decoration, or by code review,
@@ -103,7 +103,6 @@ _CONTEXT_LEVEL_ENGINES = frozenset(
         "cli_gate",
         "workflow_gate",
         "contracts_gate",
-        "runtime_gate",
     }
 )
 

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/body/infrastructure/delivery_branch.py

@@ -17,7 +17,9 @@ out:
   clone never change;
 * when main moves, the branch merges it (``follow``); a path both sides
   changed takes main's version — CORE's stale change to it is dropped and
-  logged, and the symbol becomes a gap again;
+  logged, and the symbol becomes a gap again; a waiting generated test
+  whose source module main deleted is dropped the same way (it could only
+  fail to import);
 * with a GitHub token the branch is pushed and ONE pull request into main
   carries everything waiting (``deliver``); without one the commits wait on
   the local branch and the caller reports how many.
@@ -38,6 +40,9 @@ from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
 from shared.infrastructure.git_service import autonomous_identity
+from shared.infrastructure.intent.test_coverage_paths import (
+    load_test_coverage_config,
+)
 from shared.logger import getLogger
 
 
@@ -102,7 +107,7 @@ class DeliveryBranch:
         if tip is None:
             return {"state": "none", "dropped": []}
         if self._git.is_ancestor(target, tip):
-            return {"state": "current", "dropped": []}
+            return {"state": "current", "dropped": self._drop_orphans(target)}
         if self._git.is_ancestor(tip, target):
             self._git.update_ref(DELIVERY_REF, target, tip)
             return {"state": "caught_up", "dropped": []}
@@ -125,7 +130,51 @@ class DeliveryBranch:
             tree, [tip, target], message, identity=autonomous_identity()
         )
         self._git.update_ref(DELIVERY_REF, sha, tip)
-        return {"state": "merged", "dropped": conflicts}
+        return {"state": "merged", "dropped": conflicts + self._drop_orphans(target)}
+
+    def _drop_orphans(self, target: str) -> list[str]:
+        """Give ``target``'s version back to every waiting path under a
+        generated test's directory whose source module ``target`` lacks
+        (#1355: a test for a deleted module stops pytest collection)."""
+        tip = self.tip()
+        if tip is None:
+            return []
+        config = load_test_coverage_config()
+        test_prefix = f"{config.get('test_root', 'tests')}/"
+        suffix = config.get("test_file_suffix", "/test_generated.py")
+        source_root = config.get("source_root", "src")
+        pending = self._git.diff_names(target, tip)
+        tests = [p for p in pending if p.startswith(test_prefix) and p.endswith(suffix)]
+        if not tests:
+            return []
+        sources = self._git.ls_tree_blobs(target, source_root)
+        orphan_dirs = [
+            p[: -len(suffix)] + "/"
+            for p in tests
+            if f"{source_root}/{p[len(test_prefix) : -len(suffix)]}.py" not in sources
+        ]
+        dropped = sorted(
+            p for p in pending if any(p.startswith(d) for d in orphan_dirs)
+        )
+        if not dropped:
+            return []
+        upstream = {p: self._git.ls_tree_blobs(target, p).get(p) for p in dropped}
+        tree = self._git.tree_with(tip, upstream)
+        message = (
+            f"Drop generated tests whose source {target[:12]} removed\n\n"
+            + "\n".join(f"- {p}" for p in dropped)
+        )
+        sha = self._git.commit_tree(
+            tree, [tip], message, identity=autonomous_identity()
+        )
+        self._git.update_ref(DELIVERY_REF, sha, tip)
+        logger.warning(
+            "DeliveryBranch: dropped %d waiting path(s) whose source module "
+            "is gone: %s",
+            len(dropped),
+            dropped,
+        )
+        return dropped
 
     # ID: 7c2d5a9f-1e6b-4d38-8f4a-3b0e9c7d2a56
     def base(self) -> str:

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/body/self_healing/header_service.py

@@ -1,8 +1,8 @@
 # src/body/self_healing/header_service.py
 
 """
-HeaderService — enforces the constitutional file header law.
-Refactored to use the canonical ActionExecutor Gateway for all mutations.
+fix.headers — enforces the constitutional file header law.
+All mutations go through the canonical ActionExecutor Gateway.
 """
 
 from __future__ import annotations
@@ -25,124 +25,6 @@ if TYPE_CHECKING:
 logger = getLogger(__name__)
 
 
-# ID: e1e63d42-0626-40d7-84bc-5d3469a00bc5
-class HeaderService:
-    """Detects and fixes missing or incorrect file path headers in src/**/*.py files."""
-
-    def __init__(self, repo_root: Path) -> None:
-        self.repo_root = repo_root
-
-    def _get_expected_header(self, file_path: Path) -> str:
-        rel_path = file_path.relative_to(self.repo_root).as_posix()
-        return f"# {rel_path}"
-
-    def _get_current_header(self, file_path: Path) -> str | None:
-        try:
-            lines = file_path.read_text(encoding="utf-8").splitlines()
-        except Exception:
-            return None
-
-        for line in lines:
-            stripped = line.strip()
-            if not stripped:
-                continue
-            # Check if it's a path comment (starts with # followed by a path)
-            if stripped.startswith("#") and "/" in stripped:
-                return stripped
-            # First non-blank, non-comment line means no header found
-            if not stripped.startswith("#"):
-                return None
-        return None
-
-    # ID: 8d49b70c-95b6-4aea-b392-6b3c30fac7aa
-    def analyze(self, paths: list[str]) -> list[dict[str, Any]]:
-        """Identifies header violations in the provided paths."""
-        issues = []
-        for p in paths:
-            path = Path(p)
-            # Ensure we only target source files within the repo
-            if path.suffix != ".py" or not str(path.resolve()).startswith(
-                str(self.repo_root.resolve() / "src")
-            ):
-                continue
-
-            expected = self._get_expected_header(path)
-            current = self._get_current_header(path)
-
-            if current != expected:
-                issues.append(
-                    {
-                        "file": str(path),
-                        "issue": (
-                            "missing_header" if current is None else "incorrect_header"
-                        ),
-                        "current_header": current,
-                        "expected_header": expected,
-                    }
-                )
-        return issues
-
-    # ID: fbb21920-5457-4aa2-9ae7-23da72fff8fd
-    async def fix(
-        self, context: CoreContext, paths: list[str], write: bool = False
-    ) -> None:
-        """Fixes headers for specific paths via the Action Gateway."""
-        issues = self.analyze(paths)
-        for issue in issues:
-            await self._apply_fix(
-                context, Path(issue["file"]), issue["expected_header"], write
-            )
-
-    async def _apply_fix(
-        self, context: CoreContext, file_path: Path, expected_header: str, write: bool
-    ) -> None:
-        """Prepares the new source and dispatches to ActionExecutor."""
-        rel_path = str(file_path.relative_to(self.repo_root))
-        executor = ActionExecutor(context)
-
-        try:
-            content = file_path.read_text(encoding="utf-8")
-        except Exception as e:
-            logger.error("Could not read %s for header fix: %s", rel_path, e)
-            return
-
-        lines = content.splitlines(keepends=True)
-        new_lines = []
-        skip_next_blank = False
-
-        for line in lines:
-            stripped = line.strip()
-            # Skip existing header line
-            if stripped.startswith("# src/"):
-                skip_next_blank = True
-                continue
-            # Skip blank line immediately after removed header
-            if skip_next_blank and not stripped:
-                skip_next_blank = False
-                continue
-            skip_next_blank = False
-            new_lines.append(line)
-
-        # Reconstruct with the correct header
-        final_lines = [expected_header + "\n"]
-        if new_lines and new_lines[0].strip():
-            final_lines.append("\n")
-        final_lines.extend(new_lines)
-
-        final_code = "".join(final_lines)
-
-        # CONSTITUTIONAL GATEWAY: Mutation is audited and guarded
-        result = await executor.execute(
-            action_id="file.edit", write=write, file_path=rel_path, code=final_code
-        )
-
-        if result.ok:
-            status = "Fixed" if write else "Proposed (Dry Run)"
-            logger.info("   -> [%s] Header in %s", status, rel_path)
-        else:
-            logger.error("   -> [BLOCKED] %s: %s", rel_path, result.data.get("error"))
-
-
 # ID: 4828affd-f7da-4995-9493-7037211b4144
 async def _run_header_fix_cycle(
     context: CoreContext, dry_run: bool, all_py_files: list[str]

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/body/services/blackboard_service/blackboard_claim_service.py

@@ -70,78 +70,6 @@ class BlackboardClaimService:
             )
         return findings
 
-    # ID: f3a8d1c2-7e45-4b09-a3f6-9d2c0e5b1a87
-    async def claim_violation_findings(
-        self, prefix: str, limit: int, claimed_by: uuid.UUID | None = None
-    ) -> list[dict[str, Any]]:
-        """
-        Atomically claim up to *limit* open findings whose subject matches
-        *prefix*, ordered by severity (critical first) then creation time.
-        Uses FOR UPDATE SKIP LOCKED to prevent double-claiming across
-        concurrent worker instances.
-
-        Returns list of dicts with keys: id, subject, payload.
-
-        Covers:
-          - ViolationRemediator._claim_open_findings
-        """
-        from body.services.service_registry import ServiceRegistry
-
-        async with ServiceRegistry.session() as session:
-            async with session.begin():
-                result = await session.execute(
-                    text(
-                        """
-                        UPDATE core.blackboard_entries
-                        SET status = 'claimed',
-                            claimed_by = :claimed_by,
-                            claimed_at = now(),
-                            updated_at = now()
-                        WHERE id IN (
-                            SELECT id FROM core.blackboard_entries
-                            WHERE entry_type = 'finding'
-                              AND subject LIKE :prefix
-                              AND status = 'open'
-                            ORDER BY
-                                CASE (payload->>'severity')
-                                    WHEN 'critical' THEN 1
-                                    WHEN 'error'    THEN 2
-                                    WHEN 'warning'  THEN 3
-                                    WHEN 'info'     THEN 4
-                                    ELSE 5
-                                END ASC,
-                                created_at ASC
-                            LIMIT :limit
-                            FOR UPDATE SKIP LOCKED
-                        )
-                        RETURNING id, subject, payload
-                        """
-                    ),
-                    {
-                        "prefix": prefix,
-                        "limit": limit,
-                        "claimed_by": str(claimed_by) if claimed_by else None,
-                    },
-                )
-                rows = result.fetchall()
-
-        findings = []
-        for row in rows:
-            raw_payload = row[2]
-            payload = (
-                raw_payload
-                if isinstance(raw_payload, dict)
-                else json.loads(raw_payload)
-            )
-            findings.append(
-                {
-                    "id": str(row[0]),
-                    "subject": row[1],
-                    "payload": payload,
-                }
-            )
-        return findings
-
     # ID: a992bd84-4ff3-4b37-bbb1-6ce94b13d9d3
     async def claim_findings_by_patterns(
         self,
@@ -150,15 +78,12 @@ class BlackboardClaimService:
         claimed_by: uuid.UUID | None = None,
     ) -> list[dict[str, Any]]:
         """
-        Multi-pattern counterpart to ``claim_violation_findings`` — claims
-        open findings whose subject matches any of *patterns* under
+        Claims open findings whose subject matches any of *patterns* under
         SQL ``LIKE ANY``, ordered by severity then creation time.
 
         Introduced by ADR-091 D5 Phase 3. The audit-violation consumer surface
         derives its filter from ``audit_violation_like_patterns()`` rather
-        than a single static prefix; ``claim_violation_findings(prefix)`` is
-        retained for callers that still genuinely use a single prefix
-        (e.g. ``test_remediator`` until Phase 5 migrates it).
+        than a single static prefix.
 
         An empty *patterns* list returns an empty result without executing
         SQL — mirrors ``fetch_open_findings_by_patterns``.

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/body/services/blackboard_service/blackboard_proposal_service.py

@@ -82,53 +82,6 @@ class BlackboardProposalService:
                     deferred_count += result.rowcount
         return deferred_count
 
-    # ID: 96677af7-969f-4c5b-8271-87bf885b1d33
-    async def defer_delegated_finding_to_proposal(
-        self, entry_id: str, proposal_id: str
-    ) -> int:
-        """
-        Defer a DELEGATED finding to an assisted-lane proposal (ADR-109 D4).
-
-        The assisted-lane analogue of ``defer_entries_to_proposal``. A
-        delegated finding lives at ``status='indeterminate'`` with
-        ``resolution_mechanism='human'`` — the governor-inbox predicate — NOT
-        at 'open'/'claimed'. The autonomous defer predicate would therefore
-        silently match zero rows on it. This method owns the
-        delegated→deferred transition for the lane so the assisted and
-        autonomous paths stay distinct surfaces (the autonomous
-        ``defer_entries_to_proposal`` predicate is left untouched).
-
-        Writes ``proposal_id`` into the finding payload (CORE-Finding §7 row 4)
-        and moves the finding out of the governor inbox into
-        'deferred_to_proposal' (tracked, not parked). On proposal reject the
-        lane revives it back to ``indeterminate+human`` (ADR-109 D4, ADR-010
-        §7a) rather than the autonomous ``awaiting_reaudit`` path.
-
-        Returns the count of rows actually updated (0 or 1).
-        """
-        from body.services.service_registry import ServiceRegistry
-
-        async with ServiceRegistry.session() as session:
-            async with session.begin():
-                result = await session.execute(
-                    text(
-                        """
-                        UPDATE core.blackboard_entries
-                        SET status = 'deferred_to_proposal',
-                            resolved_at = now(),
-                            updated_at = now(),
-                            payload = payload || jsonb_build_object(
-                                'proposal_id', cast(:proposal_id as text)
-                            )
-                        WHERE id = cast(:entry_id as uuid)
-                          AND status = 'indeterminate'
-                          AND resolution_mechanism = 'human'
-                        """
-                    ),
-                    {"entry_id": entry_id, "proposal_id": proposal_id},
-                )
-                return result.rowcount
-
     # ID: 6b658019-7399-466b-bfc9-642f144cc03a
     async def claim_delegated_finding(self, entry_id: str, agent: str) -> int:
         """Mark a delegated finding as being worked by an external agent (ADR-109 §2).
@@ -192,8 +145,8 @@ class BlackboardProposalService:
         ``resolved_at`` so the row matches a freshly-delegated finding (the
         governor-inbox predicate is status='indeterminate' AND
         resolution_mechanism='human'). ``payload.proposal_id`` is left as-is; the
-        next ``defer_delegated_finding_to_proposal`` overwrites it (last-writer
-        -wins) if the finding is proposed again.
+        next deferral to a proposal overwrites it (last-writer-wins) if the
+        finding is proposed again.
 
         "Clear any claim" means both claim surfaces: the worker
         ``claimed_by``/``claimed_at`` columns (unused on this lane, cleared for

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/cli/commands/tests.py

@@ -325,6 +325,7 @@ async def tests_symbols(
         load_operational_config,
     )
     from shared.infrastructure.intent.test_coverage_paths import (
+        in_test_scope,
         load_test_coverage_config,
     )
     from shared.utils.public_symbols import has_public_testable_symbols
@@ -336,13 +337,19 @@ async def tests_symbols(
     repo_root = BootstrapRegistry.get_repo_path()
     config = load_test_coverage_config()
     cap_n = load_operational_config().blackboard.remediation_cap_n
-    source_files = [
+    source_root = repo_root / config.get("source_root", "src")
+    excluded = set(config.get("excluded_filenames") or [])
+    source_files = sorted(
         f
-        for f in config.get("include_files") or []
-        if (repo_root / f).exists()
+        for f in (
+            str(p.relative_to(repo_root))
+            for p in source_root.rglob("*.py")
+            if p.name not in excluded
+        )
+        if in_test_scope(f, config)
         and (file is None or f == file)
         and has_public_testable_symbols(repo_root / f)
-    ]
+    )
 
     async with get_session() as session:
         attempt_rows: Sequence[Any] = (

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/cli/resources/code/audit.py

@@ -253,8 +253,10 @@ async def _run_offline_audit(
 
     Routes to mind.governance.stateless_audit (F-10.1a). Exit code matrix:
 
-    - EXIT_OK (0)             : no findings >= severity floor, verdict PASS
-    - EXIT_FINDINGS (1)       : N findings >= severity floor; merge-block.
+    - EXIT_OK (0)             : verdict PASS, at any --severity (#1315:
+                                --severity only chooses which findings
+                                are listed, never the exit code)
+    - EXIT_FINDINGS (1)       : verdict FAIL (a blocking finding); merge-block.
                                 Also the exit for verdict DEGRADED (#907):
                                 a blocking rule was skipped / not
                                 evaluated, so compliance is unknown. This
@@ -337,10 +339,6 @@ async def _run_offline_audit(
             console.print(f"[bold red]Governance error:[/bold red] {msg}")
         raise typer.Exit(EXIT_CONFIG_ERROR)
 
-    blocking_findings = [
-        f for f in result["findings"] if to_audit_finding(f).severity >= min_severity
-    ]
-
     if output_format == "json":
         sys.stdout.write(json.dumps(result, indent=2, default=str) + "\n")
     elif output_format == "github-annotations":
@@ -350,11 +348,11 @@ async def _run_offline_audit(
     else:
         _render_text_summary(result, min_severity, verbose=verbose)
 
-    # #907 / ADR-005 S3: DEGRADED must never be silently treated as PASS.
-    # A skipped BLOCKING rule is "not evaluated", which is never "passed",
-    # so the gate exits non-success even when every executed rule is clean.
-    degraded = result.get("verdict") == "DEGRADED"
-    raise typer.Exit(EXIT_FINDINGS if (blocking_findings or degraded) else EXIT_OK)
+    # The exit follows the verdict alone (#1315): --severity only chooses
+    # which findings are listed. #907 / ADR-005 S3: DEGRADED is never PASS --
+    # a skipped BLOCKING rule is "not evaluated", so the gate exits non-success
+    # even when every executed rule is clean.
+    raise typer.Exit(EXIT_OK if result.get("verdict") == "PASS" else EXIT_FINDINGS)
 
 
 # ID: 4d8287ab-678e-4fb9-bcf5-05eab155ace1

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/cli/resources/dev/smell_test.py

@@ -126,7 +126,7 @@ async def smell_test_command(
 
     # Both runs use the static-engine cohort (run_shadow_audit) so the
     # diff is computed over identical rule sets. Runtime-introspection
-    # engines (cli_gate / knowledge_gate / runtime_gate / llm_gate) are
+    # engines (cli_gate / knowledge_gate / llm_gate) are
     # partitioned out on principle: they ask post-commit questions and
     # cannot honestly sense a pre-commit shadow workspace. See module
     # docstring on mind.governance.shadow_audit for the category split.

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/cli/resources/docs/generate.py

@@ -79,7 +79,9 @@ def _change_summary(old: str | None, new: str) -> str:
     summary="Regenerate the CLI reference pages and the OpenAPI contract.",
     dangerous=True,
 )
-@core_command(dangerous=True, requires_context=False)
+# Renders the CLI trees and the OpenAPI document only; no Qdrant, LLM or
+# auditor context, so it runs in any checkout without services (#1167).
+@core_command(dangerous=True, requires_context=False, requires_brain_services=False)
 # ID: 0cd24900-c622-40cd-8fde-6653c6c1e52a
 async def generate_docs_command(
     ctx: typer.Context,

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/cli/resources/project/adopt_pack.py

@@ -264,9 +264,12 @@ async def adopt_pack_command(
     if tree_update is not None:
         console.print(f"  Updated: {tree_yaml} (packs: section)")
 
+    # #1317: name the workflow too when init wrote it, as init and the README do.
+    paths = ".intent .github" if (target_dir / ".github").is_dir() else ".intent"
+    what = "Commit .intent/ and the workflow" if " " in paths else "Commit .intent/"
     console.print(
-        "\n[bold green]Pack applied.[/bold green] Commit .intent/ "
-        "('git add .intent && git commit'), then run "
+        f"\n[bold green]Pack applied.[/bold green] {what} "
+        f"('git add {paths} && git commit'), then run "
         "'core-admin code audit --offline' to see findings: until the law is "
         "committed the verdict is DEGRADED."
     )

{core_runtime-2.16.0 → core_runtime-3.0.0}/src/cli/resources/workers/blackboard.py

@@ -235,7 +235,8 @@ async def workers_blackboard_purge_cmd(
 
 
 @workers_app.command("resolve")
-@core_command(dangerous=True)
+# A client of the API: the governor account has no Qdrant or DB settings.
+@core_command(dangerous=True, requires_brain_services=False)
 # ID: 0dcd5509-ff34-42aa-b866-de1d76c242ae
 async def workers_blackboard_resolve_cmd(
     ctx: typer.Context,