countersign-cli 0.2.0__py3-none-any.whl

countersign/reportclaims.py

@@ -0,0 +1,182 @@
+# audited on 20260905
+"""Claims proposed from an agent's own completion report.
+
+An agent ends its work with prose: "All tests pass. Created src/pricing.ts.
+The endpoint at http://localhost:3000/api returns the price." Every one of
+those is a claim, and most of them are checkable with one command. This
+module turns the checkable sentences into proposed claims, deterministically,
+with the agent's own sentence kept as the statement so the receipt later
+says exactly which promise held and which did not.
+
+Only English patterns, and only sentences whose disproof command can be
+derived from the repository itself (its test runner, its build script, a
+file path, a URL). A sentence that is checkable in principle but has no
+derivable command is reported as unresolved with the reason, never guessed.
+No model reads the report.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from .claims import Claim
+from .starter import TESTS_PASS, StarterClaim, _package_manager, detect_starter_claims
+
+
+@dataclass(frozen=True)
+class Proposal:
+    claim: Claim
+    sentence: str
+    source: str
+
+
+@dataclass(frozen=True)
+class Unresolved:
+    sentence: str
+    reason: str
+
+
+@dataclass
+class Proposals:
+    claims: list[Proposal] = field(default_factory=list)
+    unresolved: list[Unresolved] = field(default_factory=list)
+
+
+_BULLET = re.compile(r"^\s*(?:[-*•]|\d+[.)])\s+")
+_URL = re.compile(r"https?://[^\s'\"`<>()]+")
+_PATH = re.compile(r"(?<![\w/])(?:[\w@.-]+/)*[\w@-][\w@.-]*\.[A-Za-z][A-Za-z0-9]{0,9}(?![\w/])")
+
+_TESTS = re.compile(r"\b(?:tests?|test suite|specs?)\b.{0,40}?\b(?:pass|passes|passing|passed|green|succeed|succeeds)\b|\b(?:pass|passes|passing|passed)\b.{0,20}?\btests?\b", re.IGNORECASE)
+_BUILD = re.compile(r"\bbuild(?:s|ing)?\b.{0,30}?\b(?:succeed|succeeds|succeeded|successful|successfully|passes|clean|cleanly|without errors|no errors)\b|\bbuilt successfully\b", re.IGNORECASE)
+_LINT = re.compile(r"\blint(?:er|ing)?\b.{0,30}?\b(?:pass|passes|passing|passed|clean|no (?:errors|warnings))\b", re.IGNORECASE)
+_TYPES = re.compile(r"\b(?:type ?checks?|type ?checking|typechecks?|tsc|types)\b.{0,30}?\b(?:pass|passes|passing|passed|clean|no (?:type )?errors)\b", re.IGNORECASE)
+_CREATED = re.compile(r"\b(?:created|added|wrote|generated|introduced|updated|modified|edited|implemented|saved)\b", re.IGNORECASE)
+_REMOVED = re.compile(r"\b(?:removed|deleted|dropped)\b", re.IGNORECASE)
+
+
+def _sentences(text: str) -> list[str]:
+    out: list[str] = []
+    for line in text.splitlines():
+        line = _BULLET.sub("", line).strip()
+        if not line:
+            continue
+        for piece in re.split(r"(?<=[.!?])\s+(?=[A-Z])", line):
+            piece = piece.strip()
+            if piece:
+                out.append(piece)
+    return out
+
+
+def _slug(text: str) -> str:
+    return re.sub(r"-+", "-", re.sub(r"[^a-z0-9]+", "-", text.lower())).strip("-")
+
+
+def _quote(value: str) -> str:
+    return "'" + value.replace("'", "'\\''") + "'"
+
+
+def _statement(sentence: str) -> str:
+    flat = " ".join(sentence.split())
+    return "Agent report: " + (flat if len(flat) <= 160 else flat[:157] + "...")
+
+
+def _build_command(root: Path) -> str | None:
+    package_json = root / "package.json"
+    if package_json.is_file():
+        try:
+            data = json.loads(package_json.read_text(encoding="utf-8-sig"))
+        except (OSError, ValueError):
+            data = {}
+        scripts = data.get("scripts") if isinstance(data, dict) else None
+        if isinstance(scripts, dict) and isinstance(scripts.get("build"), str) and scripts["build"].strip():
+            return f"{_package_manager(root)} run build"
+    if (root / "Cargo.toml").is_file():
+        return "cargo build"
+    if (root / "go.mod").is_file():
+        return "go build ./..."
+    return None
+
+
+def claims_from_report(text: str, root: Path) -> Proposals:
+    """Checkable sentences of ``text`` as proposed claims for the repository at ``root``."""
+    root = Path(root)
+    starters: dict[str, StarterClaim] = {c.claim_id: c for c in detect_starter_claims(root)}
+    proposals = Proposals()
+    seen: set[str] = set()
+
+    def propose(claim_id: str, sentence: str, command: str, source: str, expect: str = "exit 0") -> None:
+        if claim_id in seen:
+            return
+        seen.add(claim_id)
+        proposals.claims.append(Proposal(Claim(claim_id, _statement(sentence), command, expect), sentence, source))
+
+    def from_starter(claim_id: str, sentence: str, missing_reason: str) -> None:
+        starter = starters.get(claim_id)
+        if starter is None:
+            if claim_id not in seen:
+                proposals.unresolved.append(Unresolved(sentence, missing_reason))
+            return
+        propose(claim_id, sentence, starter.command, starter.source)
+
+    for sentence in _sentences(text):
+        urls = _URL.findall(sentence)
+        for url in urls:
+            url = url.rstrip(".,;:")
+            bare = re.sub(r"^https?://", "", url)
+            propose(f"url-{_slug(bare)}", sentence, f"curl -sf -o /dev/null {_quote(url)}", "URL in the report")
+        without_urls = _URL.sub(" ", sentence)
+
+        if _TESTS.search(without_urls):
+            from_starter(TESTS_PASS, sentence, "no test runner recognised in this repository (no package.json test script, pytest, go.mod, Cargo.toml or Gemfile with spec/)")
+        if _BUILD.search(without_urls):
+            command = _build_command(root)
+            if command:
+                propose("build-succeeds", sentence, command, "build command of the repository")
+            elif "build-succeeds" not in seen:
+                proposals.unresolved.append(Unresolved(sentence, "no build command recognised (no package.json build script, Cargo.toml or go.mod)"))
+        if _LINT.search(without_urls):
+            from_starter("lint-clean", sentence, "no linter configuration recognised (no package.json lint script, ruff configuration)")
+        if _TYPES.search(without_urls):
+            from_starter("types-check", sentence, "no type checker recognised (no typecheck script, tsconfig with typescript, or mypy configuration)")
+
+        removed = _REMOVED.search(without_urls)
+        created = _CREATED.search(without_urls)
+        if removed or created:
+            verb = removed if removed and (not created or removed.start() < created.start()) else created
+            rest = without_urls[verb.end():]
+            path_match = _PATH.search(rest)
+            if path_match:
+                path = path_match.group(0).rstrip(".")
+                if verb is removed:
+                    propose(f"file-gone-{_slug(path)}", sentence, f"test ! -e {_quote(path)}", "file named in the report")
+                else:
+                    propose(f"file-{_slug(path)}", sentence, f"test -f {_quote(path)}", "file named in the report")
+
+    return proposals
+
+
+def without_ids(proposals: Proposals, ids: set[str]) -> Proposals:
+    """The proposals whose claim id is not in ``ids`` (those already declared)."""
+    return Proposals(claims=[p for p in proposals.claims if p.claim.claim_id not in ids], unresolved=list(proposals.unresolved))
+
+
+def render_proposals_toml(proposals: Proposals) -> str:
+    lines: list[str] = []
+    for proposal in proposals.claims:
+        lines += [
+            f"# from the agent's report, {proposal.source}",
+            "[[claim]]",
+            f'id = "{proposal.claim.claim_id}"',
+            f"statement = {_toml(proposal.claim.statement)}",
+            f"command = {_toml(proposal.claim.command)}",
+            f'expect = "{proposal.claim.expect}"',
+            "",
+        ]
+    return "\n".join(lines)
+
+
+def _toml(value: str) -> str:
+    return json.dumps(value)

countersign/reproduce.py

@@ -0,0 +1,167 @@
+# audited on 20260903
+"""Prove that a recorded run still reproduces.
+
+The promise this module keeps: any verification run can be re-run later,
+from the same inputs, and produce the same findings. It takes a receipt,
+confirms the config and claims files are byte for byte the ones the run
+read, re-runs the marker scan and every claim, and compares what comes out
+against what the receipt recorded.
+
+Commands that touch the outside world may legitimately diverge (a test that
+pings a live service can pass today and fail in a year); each divergence is
+reported, not excused. The marker scan has no such excuse: it is pure
+arithmetic over files, and any difference means the files changed.
+
+A receipt that cannot be read is a verdict (not reproduced), never a crash:
+the file may have been hand-edited, and that is exactly the case this
+command exists to catch.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from .claims import ClaimsError, load_claims, run_claim
+from .config import Config, ConfigError, file_sha256
+from .receipt import find_receipt, load_receipt
+from .register import Register
+from .stubscan import scan_tree
+
+
+def _finding_key(finding: dict) -> str:
+    return json.dumps(
+        {k: finding.get(k) for k in ("path", "line", "rule_id", "evidence")},
+        sort_keys=True,
+    )
+
+
+def _load_receipt_or_explain(receipt_path: Path) -> tuple[dict | None, str | None]:
+    try:
+        receipt = load_receipt(receipt_path)
+    except (OSError, ValueError) as exc:  # json.JSONDecodeError is a ValueError
+        return None, f"receipt {receipt_path.name} cannot be read: {exc}"
+    if not isinstance(receipt, dict):
+        return None, f"receipt {receipt_path.name} cannot be read: not a receipt object"
+    for key in ("verdict", "recorded_at", "config", "findings", "scan"):
+        if key not in receipt:
+            return None, f"receipt {receipt_path.name} cannot be read: missing '{key}'"
+    if not isinstance(receipt["config"], dict) or "sha256" not in receipt["config"]:
+        return None, f"receipt {receipt_path.name} cannot be read: config fingerprint missing"
+    if not isinstance(receipt["findings"], list):
+        return None, f"receipt {receipt_path.name} cannot be read: findings are not a list"
+    return receipt, None
+
+
+def reproduce_run(config: Config, run_id: str) -> tuple[bool, list[str]]:
+    """Re-derive a recorded run. Returns (reproduced, human readable notes)."""
+    notes: list[str] = []
+
+    receipt_path = find_receipt(config.receipts_root(), run_id)
+    if receipt_path is None:
+        return False, [f"no receipt for run {run_id} under {config.receipts_root()}"]
+
+    receipt, problem = _load_receipt_or_explain(receipt_path)
+    if receipt is None:
+        return False, [problem or "receipt cannot be read"]
+    notes.append(f"receipt: {receipt_path.name}, verdict {receipt['verdict']}, recorded {receipt['recorded_at']}")
+
+    register = Register(config.register_path())
+    intact, chain_note = register.verify_chain()
+    if not intact:
+        return False, notes + [f"register: {chain_note}"]
+    notes.append(f"register: {chain_note}")
+
+    recorded_config_sha = str(receipt["config"]["sha256"])
+    actual_config_sha = file_sha256(config.config_path)
+    if recorded_config_sha != actual_config_sha:
+        notes.append(
+            f"config: CHANGED since the run ({recorded_config_sha[:12]}... then, {actual_config_sha[:12]}... now); "
+            "findings may differ for that reason"
+        )
+    else:
+        notes.append(f"config: sha256 matches ({actual_config_sha[:12]}...)")
+
+    recorded_claims_sha = (receipt.get("claims_file") or {}).get("sha256")
+    if recorded_claims_sha:
+        claims_path = config.claims_path()
+        if claims_path is None:
+            notes.append("claims: the file the run read is no longer present")
+        else:
+            actual_claims_sha = file_sha256(claims_path)
+            if actual_claims_sha != recorded_claims_sha:
+                notes.append(
+                    f"claims: CHANGED since the run ({recorded_claims_sha[:12]}... then, {actual_claims_sha[:12]}... now)"
+                )
+            else:
+                notes.append(f"claims: sha256 matches ({actual_claims_sha[:12]}...)")
+
+    try:
+        rerun_findings, _exemptions, _inert, files_scanned = scan_tree(config)
+    except ConfigError as exc:
+        return False, notes + [f"marker scan: cannot re-run, {exc}", "overall: NOT REPRODUCED"]
+    recorded_findings = receipt["findings"]
+    rerun_keys = sorted(_finding_key(f.__dict__) for f in rerun_findings)
+    recorded_keys = sorted(_finding_key(f) for f in recorded_findings if isinstance(f, dict))
+
+    recorded_files = receipt["scan"].get("files_scanned") if isinstance(receipt["scan"], dict) else None
+    if isinstance(recorded_files, int) and recorded_files != files_scanned:
+        notes.append(f"tree: {recorded_files} file(s) then, {files_scanned} now; files were added or removed since the run")
+
+    scan_reproduced = rerun_keys == recorded_keys
+    if scan_reproduced:
+        notes.append(f"marker scan: {len(rerun_keys)} findings re-derived, identical ({files_scanned} files)")
+    else:
+        only_recorded = [k for k in recorded_keys if k not in rerun_keys][:3]
+        only_now = [k for k in rerun_keys if k not in recorded_keys][:3]
+        notes.append(
+            f"marker scan: DOES NOT reproduce, {len(recorded_keys)} recorded vs {len(rerun_keys)} re-derived"
+        )
+        for item in only_recorded:
+            notes.append(f"  recorded but not re-derived: {json.loads(item).get('path')}:{json.loads(item).get('line')}")
+        for item in only_now:
+            notes.append(f"  re-derived but not recorded: {json.loads(item).get('path')}:{json.loads(item).get('line')}")
+
+    claims_reproduced = True
+    recorded_claims = receipt.get("claims")
+    if recorded_claims is None:
+        notes.append("claims: the run skipped the claims check; nothing to re-run")
+    elif not isinstance(recorded_claims, list):
+        claims_reproduced = False
+        notes.append("claims: the receipt's claims section cannot be read")
+    elif config.claims_path() is None:
+        claims_reproduced = False
+        notes.append("claims: the claims file has since been removed; cannot re-run")
+    else:
+        try:
+            claims = load_claims(config.claims_path()) or []
+        except ClaimsError as exc:
+            claims = []
+            claims_reproduced = False
+            notes.append(f"claims: the claims file can no longer be honoured as written: {exc}")
+        for recorded in recorded_claims:
+            if not isinstance(recorded, dict) or "claim_id" not in recorded or "status" not in recorded:
+                claims_reproduced = False
+                notes.append("claim: a recorded claim entry cannot be read")
+                continue
+            match = next((c for c in claims if c.claim_id == recorded["claim_id"]), None)
+            if match is None:
+                claims_reproduced = False
+                notes.append(f"claim {recorded['claim_id']}: no longer declared in the claims file")
+                continue
+            rerun_result = run_claim(match, config.root, config.timeout_s, config.max_output_bytes)
+            if rerun_result.status == recorded["status"]:
+                notes.append(f"claim {recorded['claim_id']}: {str(recorded['status']).upper()}, reproduced ({rerun_result.duration_ms} ms)")
+            else:
+                claims_reproduced = False
+                notes.append(
+                    f"claim {recorded['claim_id']}: was {str(recorded['status']).upper()}, re-ran {rerun_result.status.upper()}"
+                )
+
+    # The verdict is a pure function of the findings and the claim statuses,
+    # so if both of those reproduced, the verdict reproduced with them. The
+    # gate itself is never re-run here: appending evidence while checking
+    # evidence would put reproduce output into the register.
+    reproduced = scan_reproduced and claims_reproduced
+    notes.append(f"overall: {'REPRODUCED' if reproduced else 'NOT REPRODUCED'}")
+    return reproduced, notes

countersign/starter.py

@@ -0,0 +1,242 @@
+# audited on 20260903
+"""Starter claims for ``countersign init``: what this repository can already
+prove about itself, read from the build files that are actually there.
+
+Nothing here guesses. A claim is proposed only when the file that makes its
+command meaningful exists (a ``test`` script in package.json, a pytest
+configuration, a go.mod). The proposed commands are the stack's own
+conventional ones; the team edits them like any other claim.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+
+TESTS_PASS = "tests-pass"
+
+# Where customers' workflows point. Moves only with a release; the tag it
+# names must exist on that repository before this constant changes.
+ACTION_REF = "krishnaflipprr/countersign@v0.2"
+WORKFLOW_RELATIVE_PATH = Path(".github") / "workflows" / "countersign.yml"
+
+
+@dataclass(frozen=True)
+class GitHubRepository:
+    toplevel: Path
+    default_branch: str
+
+
+def _git(root: Path, *args: str) -> str | None:
+    try:
+        completed = subprocess.run(["git", *args], cwd=str(root), capture_output=True, text=True, timeout=15)
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    if completed.returncode != 0:
+        return None
+    return completed.stdout.strip()
+
+
+def detect_github_repository(root: Path) -> GitHubRepository | None:
+    """The repository around ``root`` when its origin is on github.com.
+
+    Nothing is guessed: no git, no origin, or an origin elsewhere means None.
+    The default branch comes from origin's HEAD when the clone knows it,
+    else from the current branch, else ``main``.
+    """
+    toplevel = _git(root, "rev-parse", "--show-toplevel")
+    if not toplevel:
+        return None
+    origin = _git(root, "remote", "get-url", "origin")
+    if not origin or "github.com" not in origin:
+        return None
+    head = _git(root, "symbolic-ref", "--short", "refs/remotes/origin/HEAD")
+    if head and head.startswith("origin/"):
+        branch = head[len("origin/"):]
+    else:
+        branch = _git(root, "branch", "--show-current") or "main"
+    return GitHubRepository(Path(toplevel).resolve(), branch or "main")
+
+
+def render_workflow(config_path_in_repo: str, default_branch: str) -> str:
+    return f"""# Countersign: verifies every push to {default_branch} and every pull request.
+# Written by `countersign init`. Safe to edit; the action's inputs are
+# documented at https://github.com/{ACTION_REF.split('@')[0]}.
+name: countersign
+on:
+  push:
+    branches: [{json.dumps(default_branch)}]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  countersign:
+    name: countersign verify
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: {ACTION_REF}
+        with:
+          config: {json.dumps(config_path_in_repo)}
+"""
+
+
+@dataclass(frozen=True)
+class StarterClaim:
+    claim_id: str
+    statement: str
+    command: str
+    source: str
+
+
+def _package_manager(root: Path) -> str:
+    if (root / "pnpm-lock.yaml").exists():
+        return "pnpm"
+    if (root / "yarn.lock").exists():
+        return "yarn"
+    if (root / "bun.lockb").exists() or (root / "bun.lock").exists():
+        return "bun"
+    return "npm"
+
+
+def _node_claims(root: Path) -> list[StarterClaim]:
+    package_json = root / "package.json"
+    if not package_json.is_file():
+        return []
+    try:
+        data = json.loads(package_json.read_text(encoding="utf-8-sig"))
+    except (OSError, ValueError):
+        return []
+    scripts = data.get("scripts") if isinstance(data, dict) else None
+    if not isinstance(scripts, dict):
+        return []
+    manager = _package_manager(root)
+    run = f"{manager} run"
+    # `bun test` is bun's own runner, not the package's test script; every
+    # other manager treats `<manager> test` as the script.
+    test_command = "bun run test" if manager == "bun" else f"{manager} test"
+    claims: list[StarterClaim] = []
+    if isinstance(scripts.get("test"), str) and scripts["test"].strip():
+        claims.append(StarterClaim(TESTS_PASS, "The full test suite passes", test_command, "package.json scripts.test"))
+    if isinstance(scripts.get("lint"), str) and scripts["lint"].strip():
+        claims.append(StarterClaim("lint-clean", "The linter reports nothing", f"{run} lint", "package.json scripts.lint"))
+    for name in ("typecheck", "type-check", "tsc"):
+        if isinstance(scripts.get(name), str) and scripts[name].strip():
+            claims.append(StarterClaim("types-check", "The type checker reports nothing", f"{run} {name}", f"package.json scripts.{name}"))
+            break
+    else:
+        deps = {}
+        for key in ("devDependencies", "dependencies"):
+            if isinstance(data.get(key), dict):
+                deps.update(data[key])
+        if "typescript" in deps and (root / "tsconfig.json").is_file():
+            claims.append(StarterClaim("types-check", "The type checker reports nothing", "npx tsc --noEmit", "tsconfig.json with typescript installed"))
+    return claims
+
+
+def _python_claims(root: Path) -> list[StarterClaim]:
+    pyproject = root / "pyproject.toml"
+    pyproject_text = ""
+    if pyproject.is_file():
+        try:
+            pyproject_text = pyproject.read_text(encoding="utf-8-sig")
+        except OSError:
+            pyproject_text = ""
+    has_python = bool(pyproject_text) or (root / "setup.py").is_file() or (root / "setup.cfg").is_file() or (root / "requirements.txt").is_file()
+    claims: list[StarterClaim] = []
+    pytest_configured = (
+        "[tool.pytest" in pyproject_text
+        or re.search(r"\bpytest\b", pyproject_text) is not None
+        or (root / "pytest.ini").is_file()
+        or (root / "conftest.py").is_file()
+    )
+    if pytest_configured:
+        claims.append(StarterClaim(TESTS_PASS, "The full test suite passes", "python3 -m pytest -q", "pytest configuration"))
+    elif has_python and ((root / "tests").is_dir() or (root / "test").is_dir()):
+        start = "tests" if (root / "tests").is_dir() else "test"
+        claims.append(StarterClaim(TESTS_PASS, "The full test suite passes", f"python3 -m unittest discover -s {start} -t .", f"{start}/ directory"))
+    if "[tool.ruff" in pyproject_text or (root / "ruff.toml").is_file() or (root / ".ruff.toml").is_file():
+        claims.append(StarterClaim("lint-clean", "The linter reports nothing", "ruff check .", "ruff configuration"))
+    if "[tool.mypy" in pyproject_text or (root / "mypy.ini").is_file():
+        claims.append(StarterClaim("types-check", "The type checker reports nothing", "mypy .", "mypy configuration"))
+    return claims
+
+
+def _go_claims(root: Path) -> list[StarterClaim]:
+    if not (root / "go.mod").is_file():
+        return []
+    return [
+        StarterClaim(TESTS_PASS, "The full test suite passes", "go test ./...", "go.mod"),
+        StarterClaim("vet-clean", "go vet reports nothing", "go vet ./...", "go.mod"),
+    ]
+
+
+def _rust_claims(root: Path) -> list[StarterClaim]:
+    if not (root / "Cargo.toml").is_file():
+        return []
+    return [StarterClaim(TESTS_PASS, "The full test suite passes", "cargo test", "Cargo.toml")]
+
+
+def _ruby_claims(root: Path) -> list[StarterClaim]:
+    if (root / "Gemfile").is_file() and (root / "spec").is_dir():
+        return [StarterClaim(TESTS_PASS, "The full test suite passes", "bundle exec rspec", "Gemfile with spec/")]
+    return []
+
+
+def detect_starter_claims(root: Path) -> list[StarterClaim]:
+    """Starter claims for ``root``, at most one per claim id, first stack wins."""
+    root = Path(root)
+    seen: set[str] = set()
+    claims: list[StarterClaim] = []
+    for detector in (_node_claims, _python_claims, _go_claims, _rust_claims, _ruby_claims):
+        for claim in detector(root):
+            if claim.claim_id in seen:
+                continue
+            seen.add(claim.claim_id)
+            claims.append(claim)
+    return claims
+
+
+def _toml_string(value: str) -> str:
+    return json.dumps(value)
+
+
+def render_claims_toml(claims: list[StarterClaim]) -> str:
+    lines = [
+        "# What is true about this repository, each claim paired with the command",
+        "# that fails if the claim is false. Countersign runs every command from",
+        "# the repository root through your shell and judges it exactly as declared.",
+        "#",
+        '# expect = "exit 0"           the command must succeed (default)',
+        '# expect = "nonzero exit"     the command must fail (negative tests)',
+        '# expect = "output contains"  the needle must appear in the combined output',
+        "",
+    ]
+    if not claims:
+        lines += [
+            "# No build files were recognised, so no claim was written for you.",
+            "# Declare your first claim by editing the example below.",
+            "#",
+            "# [[claim]]",
+            '# id = "tests-pass"',
+            '# statement = "The full test suite passes"',
+            '# command = "make test"',
+            '# expect = "exit 0"',
+            "",
+        ]
+    for claim in claims:
+        lines += [
+            f"# proposed from {claim.source}",
+            "[[claim]]",
+            f"id = {_toml_string(claim.claim_id)}",
+            f"statement = {_toml_string(claim.statement)}",
+            f"command = {_toml_string(claim.command)}",
+            'expect = "exit 0"',
+            "",
+        ]
+    return "\n".join(lines)