cuff-cli 0.2.0__tar.gz → 0.2.2__tar.gz

{cuff_cli-0.2.0/core/cuff_cli.egg-info → cuff_cli-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cuff-cli
-Version: 0.2.0
+Version: 0.2.2
 Summary: Cuff subject-bound claim, evidence, and verification gate.
 Author: Fab7
 License-Expression: Apache-2.0
@@ -38,7 +38,7 @@ worktree, or stages, commits, fetches, pushes, releases, or deploys anything.
 Install a released version as a standard uv-managed tool:
 
 ```bash
-uv tool install cuff-cli==0.2.0
+uv tool install cuff-cli==0.2.2
 cuff --version
 ```
 
@@ -77,6 +77,15 @@ cuff seal \
 cuff check --work-item task-1 --json
 ```
 
+Recovery controllers that need the latest linked observation, including a
+recorded verifier failure, may opt into the closed seven-field projection:
+
+```bash
+cuff check --work-item task-1 --json --include-latest-record
+```
+
+Without that flag, `check --json` retains its exact six-field response.
+
 The split path is available when the claim must exist before verification:
 
 ```bash
@@ -142,19 +151,29 @@ Validate the built candidate and both host payloads without touching the
 normal host configuration:
 
 ```bash
-uv build --out-dir ../sandbox/cuff-01/dist
+uv build --out-dir ../sandbox/cuff-02/dist
 uv run python tools/local_release_check.py --host all
 uv run python tools/local_release_check.py --host all --prepare-auth \
   --candidate-commit COMMIT \
-  --evidence-dir ../sandbox/cuff-01/e2e
+  --evidence-dir ../sandbox/cuff-02/e2e
 # Log each CLI in using the isolated home paths printed by the prepare phase.
 uv run python tools/local_release_check.py --host all --live --reuse-prepared \
   --candidate-commit COMMIT \
-  --evidence-dir ../sandbox/cuff-01/e2e \
+  --evidence-dir ../sandbox/cuff-02/e2e \
+  --qualification-manifest ../sandbox/cuff-02/control/qualification.json \
+  --preflight-evidence ../sandbox/cuff-02/control/preflight.json \
   --codex-model MODEL \
   --claude-model MODEL
 ```
 
+Before `--live`, freeze the exact candidate, host order, `current` and `stale`
+cases, three-valid-sample rule, prompts, tool policies, and containment policies
+in the qualification manifest. A trusted non-LLM runner must then record a
+passing containment preflight for the same qualification and policy digests.
+The checker rejects missing or mismatched controls and runs six fresh
+workspaces and host sessions per host. Follow the root `LLM_VERIFICATION.md`;
+unsupported isolation is `INCONCLUSIVE`, not a release pass.
+
 See [RUNBOOK.md](RUNBOOK.md) for operations, [the architecture overview](docs/architecture/overview.md)
 for ownership, and [the ledger contract](docs/architecture/ledger.md) for the
 record and gate invariants.

{cuff_cli-0.2.0 → cuff_cli-0.2.2}/README.md

@@ -27,7 +27,7 @@ worktree, or stages, commits, fetches, pushes, releases, or deploys anything.
 Install a released version as a standard uv-managed tool:
 
 ```bash
-uv tool install cuff-cli==0.2.0
+uv tool install cuff-cli==0.2.2
 cuff --version
 ```
 
@@ -66,6 +66,15 @@ cuff seal \
 cuff check --work-item task-1 --json
 ```
 
+Recovery controllers that need the latest linked observation, including a
+recorded verifier failure, may opt into the closed seven-field projection:
+
+```bash
+cuff check --work-item task-1 --json --include-latest-record
+```
+
+Without that flag, `check --json` retains its exact six-field response.
+
 The split path is available when the claim must exist before verification:
 
 ```bash
@@ -131,19 +140,29 @@ Validate the built candidate and both host payloads without touching the
 normal host configuration:
 
 ```bash
-uv build --out-dir ../sandbox/cuff-01/dist
+uv build --out-dir ../sandbox/cuff-02/dist
 uv run python tools/local_release_check.py --host all
 uv run python tools/local_release_check.py --host all --prepare-auth \
   --candidate-commit COMMIT \
-  --evidence-dir ../sandbox/cuff-01/e2e
+  --evidence-dir ../sandbox/cuff-02/e2e
 # Log each CLI in using the isolated home paths printed by the prepare phase.
 uv run python tools/local_release_check.py --host all --live --reuse-prepared \
   --candidate-commit COMMIT \
-  --evidence-dir ../sandbox/cuff-01/e2e \
+  --evidence-dir ../sandbox/cuff-02/e2e \
+  --qualification-manifest ../sandbox/cuff-02/control/qualification.json \
+  --preflight-evidence ../sandbox/cuff-02/control/preflight.json \
   --codex-model MODEL \
   --claude-model MODEL
 ```
 
+Before `--live`, freeze the exact candidate, host order, `current` and `stale`
+cases, three-valid-sample rule, prompts, tool policies, and containment policies
+in the qualification manifest. A trusted non-LLM runner must then record a
+passing containment preflight for the same qualification and policy digests.
+The checker rejects missing or mismatched controls and runs six fresh
+workspaces and host sessions per host. Follow the root `LLM_VERIFICATION.md`;
+unsupported isolation is `INCONCLUSIVE`, not a release pass.
+
 See [RUNBOOK.md](RUNBOOK.md) for operations, [the architecture overview](docs/architecture/overview.md)
 for ownership, and [the ledger contract](docs/architecture/ledger.md) for the
 record and gate invariants.

{cuff_cli-0.2.0 → cuff_cli-0.2.2}/core/cuff/__init__.py

@@ -1,4 +1,4 @@
 """Cuff's host-neutral claim and evidence gate."""
 
 __all__ = ["__version__"]
-__version__ = "0.2.0"
+__version__ = "0.2.2"

{cuff_cli-0.2.0 → cuff_cli-0.2.2}/core/cuff/cli.py

@@ -57,6 +57,7 @@ def build_parser() -> argparse.ArgumentParser:
     readiness.add_argument("--work-item", required=True)
     readiness.add_argument("--base")
     readiness.add_argument("--head")
+    readiness.add_argument("--include-latest-record", action="store_true")
     readiness.add_argument("--json", action="store_true")
     return parser
 
@@ -129,7 +130,13 @@ def main(argv: list[str] | None = None) -> int:
                 f"exit {sealed.evidence['exit_code']}",
             )
         if args.command == "check":
-            data = check(root, args.work_item, base=args.base, head=args.head)
+            data = check(
+                root,
+                args.work_item,
+                base=args.base,
+                head=args.head,
+                include_latest_record=args.include_latest_record,
+            )
             return _finish_result(args, data, "Cuff readiness")
         parser.error("unknown command")
     except CuffError as exc:
@@ -231,7 +238,7 @@ def _check_error(args: argparse.Namespace, error: dict[str, Any]) -> dict[str, A
         work_item = normalize_work_item(work_item)
     except CuffError:
         pass
-    return {
+    result = {
         "ok": False,
         "errors": [error],
         "work_item": work_item,
@@ -239,6 +246,9 @@ def _check_error(args: argparse.Namespace, error: dict[str, Any]) -> dict[str, A
         "selected_evidence": None,
         "record_count": 0,
     }
+    if getattr(args, "include_latest_record", False):
+        result["latest_record"] = None
+    return result
 
 
 def _replay(content: bytes, stream: Any) -> None:

{cuff_cli-0.2.0 → cuff_cli-0.2.2}/core/cuff/gate.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from typing import Any
 
 from .errors import CuffError
-from .ledger import RECORDS_DIR, normalize_work_item, read, read_all
+from .ledger import RECORDS_DIR, normalize_work_item, read, read_all, record_path
 from .subject import current_subject
 
 
@@ -16,6 +16,7 @@ def check(
     *,
     base: str | None = None,
     head: str | None = None,
+    include_latest_record: bool = False,
 ) -> dict[str, Any]:
     normalized = normalize_work_item(work_item)
     result: dict[str, Any] = {
@@ -26,6 +27,8 @@ def check(
         "selected_evidence": None,
         "record_count": 0,
     }
+    if include_latest_record:
+        result["latest_record"] = None
     try:
         read_all(root)
         records = read(root, normalized)
@@ -37,6 +40,17 @@ def check(
     claims = [record for record in records if record["type"] == "claim"]
     claim = claims[-1] if claims else None
     result["latest_claim"] = claim
+    if claim is not None and include_latest_record:
+        linked = [
+            record
+            for record in records
+            if record["type"] == "evidence" and record["claim"] == claim["id"]
+        ]
+        result["latest_record"] = {
+            "path": _relative_record_path(root, normalized),
+            "claim": claim,
+            "evidence": linked[-1] if linked else None,
+        }
 
     git_context = _check_git_workspace(root, base, head, result["errors"])
     if claim is None:
@@ -46,8 +60,7 @@ def check(
     linked = [
         record
         for record in records
-        if record["type"] == "evidence"
-        and record["claim"] == claim["id"]
+        if record["type"] == "evidence" and record["claim"] == claim["id"]
     ]
     if not linked:
         _fail(
@@ -97,6 +110,19 @@ def check(
     return result
 
 
+def _relative_record_path(root: Path, work_item: str) -> str:
+    workspace = root.resolve()
+    path = record_path(workspace, work_item).resolve()
+    try:
+        return path.relative_to(workspace).as_posix()
+    except ValueError as exc:
+        raise CuffError(
+            "CUFF_PATH_INVALID",
+            "Cuff ledger path escapes the workspace",
+            {"path": str(path), "workspace": str(workspace)},
+        ) from exc
+
+
 def _subject_fresh(root: Path, claim: dict[str, Any]) -> bool:
     try:
         return current_subject(root, claim["subject"]) == claim["subject"]

{cuff_cli-0.2.0 → cuff_cli-0.2.2/core/cuff_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cuff-cli
-Version: 0.2.0
+Version: 0.2.2
 Summary: Cuff subject-bound claim, evidence, and verification gate.
 Author: Fab7
 License-Expression: Apache-2.0
@@ -38,7 +38,7 @@ worktree, or stages, commits, fetches, pushes, releases, or deploys anything.
 Install a released version as a standard uv-managed tool:
 
 ```bash
-uv tool install cuff-cli==0.2.0
+uv tool install cuff-cli==0.2.2
 cuff --version
 ```
 
@@ -77,6 +77,15 @@ cuff seal \
 cuff check --work-item task-1 --json
 ```
 
+Recovery controllers that need the latest linked observation, including a
+recorded verifier failure, may opt into the closed seven-field projection:
+
+```bash
+cuff check --work-item task-1 --json --include-latest-record
+```
+
+Without that flag, `check --json` retains its exact six-field response.
+
 The split path is available when the claim must exist before verification:
 
 ```bash
@@ -142,19 +151,29 @@ Validate the built candidate and both host payloads without touching the
 normal host configuration:
 
 ```bash
-uv build --out-dir ../sandbox/cuff-01/dist
+uv build --out-dir ../sandbox/cuff-02/dist
 uv run python tools/local_release_check.py --host all
 uv run python tools/local_release_check.py --host all --prepare-auth \
   --candidate-commit COMMIT \
-  --evidence-dir ../sandbox/cuff-01/e2e
+  --evidence-dir ../sandbox/cuff-02/e2e
 # Log each CLI in using the isolated home paths printed by the prepare phase.
 uv run python tools/local_release_check.py --host all --live --reuse-prepared \
   --candidate-commit COMMIT \
-  --evidence-dir ../sandbox/cuff-01/e2e \
+  --evidence-dir ../sandbox/cuff-02/e2e \
+  --qualification-manifest ../sandbox/cuff-02/control/qualification.json \
+  --preflight-evidence ../sandbox/cuff-02/control/preflight.json \
   --codex-model MODEL \
   --claude-model MODEL
 ```
 
+Before `--live`, freeze the exact candidate, host order, `current` and `stale`
+cases, three-valid-sample rule, prompts, tool policies, and containment policies
+in the qualification manifest. A trusted non-LLM runner must then record a
+passing containment preflight for the same qualification and policy digests.
+The checker rejects missing or mismatched controls and runs six fresh
+workspaces and host sessions per host. Follow the root `LLM_VERIFICATION.md`;
+unsupported isolation is `INCONCLUSIVE`, not a release pass.
+
 See [RUNBOOK.md](RUNBOOK.md) for operations, [the architecture overview](docs/architecture/overview.md)
 for ownership, and [the ledger contract](docs/architecture/ledger.md) for the
 record and gate invariants.

{cuff_cli-0.2.0 → cuff_cli-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cuff-cli"
-version = "0.2.0"
+version = "0.2.2"
 description = "Cuff subject-bound claim, evidence, and verification gate."
 readme = "README.md"
 requires-python = ">=3.11"