devagent-ai 0.8.0__tar.gz → 0.8.2__tar.gz

{devagent_ai-0.8.0/devagent_ai.egg-info → devagent_ai-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devagent-ai
-Version: 0.8.0
+Version: 0.8.2
 Summary: Evidence-driven local autonomous software engineering agent
 Author: Tom Ha
 Maintainer: Tom Ha
@@ -216,6 +216,112 @@ devagent --input ../specs/release.requirement
 
 Binary data, invalid UTF-8, secret-like paths, and files above the input-size bound are refused.
 
+## Practical examples
+
+DevAgent is intended for real repository work, not only one-line code generation. Run it from the repository you want to change and describe the engineering outcome you need.
+
+### 1. Fix a bug and prove the regression is covered
+
+```bash
+cd my-service
+devagent "Fix the websocket reconnect bug that duplicates subscriptions after a network drop. Add a regression test and keep the public API unchanged."
+```
+
+**Benefit:** DevAgent first discovers the relevant implementation and tests, turns the request into explicit acceptance criteria, makes a bounded patch, runs repository-supported verification, independently reviews the final diff, and only reports `VERIFIED` when the required evidence supports it.
+
+### 2. Add a feature on a dedicated branch
+
+```bash
+cd my-app
+devagent \
+  --publish-branch feature/csv-export \
+  "Add CSV export for filtered reports. Preserve the existing JSON export behavior and add tests."
+```
+
+**Benefit:** a verified change can be committed and pushed to the requested feature branch while DevAgent stops before PR creation or merge, leaving integration control with the developer or repository owner.
+
+### 3. Give DevAgent a longer product or customer requirement
+
+```bash
+cd my-repo
+devagent --input requirements/customer-billing-retry.md
+```
+
+The input can be any bounded UTF-8 text file; it does not need a special extension or DevAgent-specific format.
+
+**Benefit:** long requirements stay in a reviewable file instead of being compressed into a short prompt, while DevAgent still derives bounded implementation and verification work from repository evidence.
+
+### 4. Perform a refactor that includes rename/move/delete operations
+
+```bash
+cd my-repo
+devagent "Rename LegacyOrderService to OrderService, move it into the services package, update all references, remove the obsolete module, and preserve behavior."
+```
+
+**Benefit:** structural changes go through backup-first workspace operations, path/scope checks, repository verification, and final-diff review instead of uncontrolled file manipulation.
+
+### 5. Change a database schema with forward/rollback verification
+
+```bash
+cd my-python-service
+devagent "Add a nullable status column to the SQLite orders table, provide a forward and rollback migration, update the data-access layer, and verify both migration directions."
+```
+
+**Benefit:** migration work can be treated as high-risk engineering work with explicit acceptance evidence instead of assuming that a generated migration is correct because it looks plausible. The current qualified production fixture covers SQLite forward/rollback migration behavior; broader PostgreSQL/MySQL coverage remains an external-validation area.
+
+### 6. Work in Java or .NET repositories
+
+```bash
+cd my-java-service
+devagent "Add validation for duplicate customer IDs in this Maven service and add the appropriate JUnit regression test."
+```
+
+```bash
+cd my-dotnet-service
+devagent "Fix the null-handling bug in the order import path and verify the .NET project still builds successfully."
+```
+
+**Benefit:** DevAgent discovers repository-native Maven/Gradle and .NET project evidence instead of forcing every repository through a Python-centric workflow.
+
+### 7. Keep all changes local for inspection
+
+```bash
+cd my-repo
+devagent --no-publish "Refactor retry handling to remove duplicate logic and keep behavior unchanged."
+```
+
+**Benefit:** you still get implementation, verification, independent review, and the engineering report, but DevAgent does not commit or push the result.
+
+### 8. Use the model/provider you prefer
+
+```bash
+# Configure once
+devagent setup --provider anthropic --model YOUR_MODEL
+export ANTHROPIC_API_KEY=...
+
+# Then use the same DevAgent engineering workflow
+devagent "Fix the failing checkout integration test without weakening the assertion."
+```
+
+You can similarly configure OpenAI, Gemini, Grok/xAI, or an OpenAI-compatible endpoint.
+
+**Benefit:** the model supplies reasoning, while DevAgent keeps the same deterministic acceptance, safety, verification, reporting, and publication rules around it.
+
+## What DevAgent adds around an AI coding model
+
+| Common engineering risk | DevAgent behavior |
+| --- | --- |
+| The model says “done” without enough proof | Required acceptance criteria remain `UNPROVEN` or the run becomes `PARTIALLY_VERIFIED` / `BLOCKED` instead of falsely claiming success. |
+| A patch touches unrelated code | Evidence gathering, explicit scope, minimal-change planning, and independent diff review constrain the change. |
+| Existing developer work is damaged | Clean repositories use isolated worktrees by default; dirty tracked/untracked developer work is protected; files are backed up before first modification. |
+| Tests passed before a later edit | Verification is revision-aware, so older successful evidence does not prove a newer tree. |
+| A generated change breaks the build or tests | DevAgent runs repository-supported targeted/broad checks and can diagnose/replan before final verification. |
+| An agent pushes directly to a protected primary branch | Starting from `main`, `master`, or `trunk` causes DevAgent to work on a safe branch; runtime DevAgent does not merge or deploy. |
+| You are locked to one model vendor | OpenAI, Claude, Gemini, Grok/xAI, and compatible endpoints can use the same engineering harness. |
+| It is hard to audit what the agent actually did | DevAgent emits an engineering report with decisions, changed symbols, tests, acceptance evidence, verification, failures, gaps, and source-control status. |
+
+The goal is not to replace developer judgment. The goal is to make autonomous engineering work **bounded, reviewable, reproducible, and harder to falsely declare complete**.
+
 Useful commands:
 
 ```bash
@@ -230,7 +336,7 @@ devagent benchmark --help
 
 ### Pinned real-world benchmark
 
-DevAgent 0.5 adds an opt-in benchmark runner for pinned GitHub repositories. A benchmark case injects a deterministic defect into an exact commit and uses an **external oracle** before and after DevAgent. This avoids treating DevAgent's own report as the benchmark oracle.
+DevAgent includes an opt-in benchmark runner for pinned GitHub repositories. A benchmark case injects a deterministic defect into an exact commit and uses an **external oracle** before and after DevAgent. This avoids treating DevAgent's own report as the benchmark oracle.
 
 ```bash
 devagent benchmark \
@@ -278,7 +384,7 @@ DevAgent uses defense-in-depth controls around repository modification, command
 - protected targets are refused and force push is never used;
 - no runtime PR, merge, rebase, force-push, or deployment automation.
 
-DevAgent is **not an operating-system sandbox**. Review the report and pushed branch before integrating customer or production code.
+On Linux, DevAgent can execute engineering commands inside a bubblewrap-based operating-system sandbox. Production qualification exercises required sandbox mode with network access denied. Required mode fails closed when isolation cannot be established rather than silently falling back. Review the report and pushed branch before integrating customer or production code: sandboxing reduces execution risk, but it does not make arbitrary generated changes universally safe.
 
 ## Repository intelligence and verification
 
@@ -298,13 +404,20 @@ Verification can include baseline tests, targeted tests, component/broad checks,
 
 ## Production qualification
 
-DevAgent 0.5.0 uses **production qualification v4**. It extends the v3 release gate with large-repository bounded-retrieval and real-world benchmark truthfulness contracts while preserving the primary invariant:
+DevAgent 0.8.0 uses cumulative production qualification rather than replacing older evidence with a smaller new suite.
+
+- **v4 — 70 required cases** covering end-to-end engineering behavior, acceptance truthfulness, task/risk scope, provider contracts and parity, model routing, worktree and Git publication safety, CLI input, review/repair loops, report/evaluation integrity, release integrity, large-repository behavior, structural refactors, Java/.NET discovery and execution, SQLite migration forward/rollback, and real repository-native stacks.
+- **v5 — 9 required autonomy cases** covering bounded parallel coordination, dirty-source refusal, real isolated parallel DevAgent runs, bounded/relevant skills and provider injection, automation overlap claim/recovery, and provider-benchmark deduplication, live structured-contract behavior, and secret redaction.
+
+The v0.8 merge commit on `main` passed both catalogs in required Linux sandbox mode:
 
 ```text
-false_verified == 0
+v4: 70/70 passed
+v5:  9/9 passed
+combined: 79/79 passed
 ```
 
-It covers end-to-end engineering behavior, acceptance truthfulness, task scope, provider contracts/parity, model routing, worktree and Git publication safety, CLI input, review/repair loops, report/evaluation integrity, release integrity, and actual repository-native toolchain execution for:
+The qualification environment exercises real local toolchains for:
 
 ```text
 Python / pytest
@@ -312,21 +425,30 @@ Node + TypeScript repository discovery
 Go
 Rust / Cargo
 C++ / Make
+Java / Maven
+.NET build
+SQLite migration forward + rollback
 ```
 
-Run the release qualification locally on a machine with those toolchains:
+Run the same release qualification catalogs locally on a machine with the required toolchains:
 
 ```bash
+DEVAGENT_SANDBOX=required DEVAGENT_NETWORK=deny \
 python -m devagent.qualification \
   --catalog evaluation/benchmark_v4.json \
   --report .devagent/production-qualification-v4.json
+
+DEVAGENT_SANDBOX=required DEVAGENT_NETWORK=deny \
+python -m devagent.qualification \
+  --catalog evaluation/benchmark_v5.json \
+  --report .devagent/production-qualification-v5.json
 ```
 
-Production CI runs Python 3.10/3.11/3.12, a clean wheel install, and this production qualification gate. The qualification JSON is retained as CI evidence.
+Production CI also runs Python 3.10/3.11/3.12, a clean wheel build/install, real bubblewrap sandbox smoke, and both qualification catalogs. Qualification JSON is retained as CI evidence.
 
-**100% qualified means 100% of this explicit catalog passed.** It does not mean mathematical correctness for every unseen repository, environment, model response, language, or engineering task.
+**100% qualified means 100% of these explicit catalogs passed on that revision and environment.** It does not mean mathematical correctness for every unseen repository, environment, model response, language, provider, or engineering task, and it is not a claim that DevAgent is universally superior to every hosted coding platform.
 
-See [docs/production-readiness.md](docs/production-readiness.md) for the evidence behind the 0.4.0 production-readiness assessment and its explicit limitations.
+See [docs/production-readiness.md](docs/production-readiness.md) for the project's earlier readiness assessment and its explicit limitations.
 
 ## Provider architecture
 
@@ -380,11 +502,15 @@ Automated provider tests normally use deterministic or mocked clients and do not
 
 ## Project status
 
-DevAgent 0.5 is **beta software**. Its qualification and benchmark results are bounded claims tied to explicit cases, pinned revisions, and external oracles; they are not a claim of universal correctness or parity with every hosted coding platform.
+DevAgent 0.8.0 is **beta software with a verified core release baseline**. The exact v0.8 merge revision on `main` passed Production CI across Python 3.10/3.11/3.12, clean wheel installation, real Linux bubblewrap sandbox execution, production qualification v4 (**70/70**), and autonomy qualification v5 (**9/9**), for **79/79 cumulative required qualification cases**.
+
+The current core includes evidence-backed `VERIFIED` / `PARTIALLY_VERIFIED` / `BLOCKED` outcomes, backup-first editing, isolated worktrees, bounded structural file operations, repository-native verification, independent review, safe branch publication, provider/model choice, Java and .NET engineering discovery/execution, SQLite migration forward/rollback verification, large-monorepo deep-manifest discovery, bounded parallel agents, repository-local skills, foreground automations, Linux OS sandboxing, bounded browser/local-UI verification, and real-provider structured-contract benchmarking.
+
+These results are **bounded engineering claims**, not universal-correctness or market-superiority claims. They are tied to explicit qualification cases, pinned revisions, deterministic fixtures/external oracles where applicable, and the environments actually exercised by CI.
 
-Remaining gaps include a larger published corpus of pinned upstream benchmark cases, browser/UI runtime qualification, a broader Java/.NET/database-migration matrix, very large monorepo stress runs above the current bounded inventory, parallel multi-agent orchestration, operating-system sandboxing, and continuous paid real-provider testing across every model/provider combination.
+Remaining work is primarily **breadth and external validation**, not missing core architecture: a larger public corpus of pinned upstream repositories and tasks; broader browser/UI coverage across dynamic applications and multiple browser environments; a wider Java/Gradle, .NET test-framework, and PostgreSQL/MySQL migration matrix beyond the current qualified fixtures; larger and more diverse monorepo stress cases beyond the current >12,000-file deep-manifest case; more real-world multi-agent workload studies; and continuous paid real-provider benchmarking across a broader set of model/provider combinations. GitHub branch protection/rulesets are external repository settings and must be configured separately; DevAgent does not claim to configure them itself.
 
-The project intentionally prioritizes trustworthy outcomes over feature count.
+The project intentionally prioritizes trustworthy outcomes, reproducible evidence, and safe engineering behavior over feature count or unsupported "best agent" claims.
 
 ## Contributing
 

{devagent_ai-0.8.0 → devagent_ai-0.8.2}/README.md

@@ -185,6 +185,112 @@ devagent --input ../specs/release.requirement
 
 Binary data, invalid UTF-8, secret-like paths, and files above the input-size bound are refused.
 
+## Practical examples
+
+DevAgent is intended for real repository work, not only one-line code generation. Run it from the repository you want to change and describe the engineering outcome you need.
+
+### 1. Fix a bug and prove the regression is covered
+
+```bash
+cd my-service
+devagent "Fix the websocket reconnect bug that duplicates subscriptions after a network drop. Add a regression test and keep the public API unchanged."
+```
+
+**Benefit:** DevAgent first discovers the relevant implementation and tests, turns the request into explicit acceptance criteria, makes a bounded patch, runs repository-supported verification, independently reviews the final diff, and only reports `VERIFIED` when the required evidence supports it.
+
+### 2. Add a feature on a dedicated branch
+
+```bash
+cd my-app
+devagent \
+  --publish-branch feature/csv-export \
+  "Add CSV export for filtered reports. Preserve the existing JSON export behavior and add tests."
+```
+
+**Benefit:** a verified change can be committed and pushed to the requested feature branch while DevAgent stops before PR creation or merge, leaving integration control with the developer or repository owner.
+
+### 3. Give DevAgent a longer product or customer requirement
+
+```bash
+cd my-repo
+devagent --input requirements/customer-billing-retry.md
+```
+
+The input can be any bounded UTF-8 text file; it does not need a special extension or DevAgent-specific format.
+
+**Benefit:** long requirements stay in a reviewable file instead of being compressed into a short prompt, while DevAgent still derives bounded implementation and verification work from repository evidence.
+
+### 4. Perform a refactor that includes rename/move/delete operations
+
+```bash
+cd my-repo
+devagent "Rename LegacyOrderService to OrderService, move it into the services package, update all references, remove the obsolete module, and preserve behavior."
+```
+
+**Benefit:** structural changes go through backup-first workspace operations, path/scope checks, repository verification, and final-diff review instead of uncontrolled file manipulation.
+
+### 5. Change a database schema with forward/rollback verification
+
+```bash
+cd my-python-service
+devagent "Add a nullable status column to the SQLite orders table, provide a forward and rollback migration, update the data-access layer, and verify both migration directions."
+```
+
+**Benefit:** migration work can be treated as high-risk engineering work with explicit acceptance evidence instead of assuming that a generated migration is correct because it looks plausible. The current qualified production fixture covers SQLite forward/rollback migration behavior; broader PostgreSQL/MySQL coverage remains an external-validation area.
+
+### 6. Work in Java or .NET repositories
+
+```bash
+cd my-java-service
+devagent "Add validation for duplicate customer IDs in this Maven service and add the appropriate JUnit regression test."
+```
+
+```bash
+cd my-dotnet-service
+devagent "Fix the null-handling bug in the order import path and verify the .NET project still builds successfully."
+```
+
+**Benefit:** DevAgent discovers repository-native Maven/Gradle and .NET project evidence instead of forcing every repository through a Python-centric workflow.
+
+### 7. Keep all changes local for inspection
+
+```bash
+cd my-repo
+devagent --no-publish "Refactor retry handling to remove duplicate logic and keep behavior unchanged."
+```
+
+**Benefit:** you still get implementation, verification, independent review, and the engineering report, but DevAgent does not commit or push the result.
+
+### 8. Use the model/provider you prefer
+
+```bash
+# Configure once
+devagent setup --provider anthropic --model YOUR_MODEL
+export ANTHROPIC_API_KEY=...
+
+# Then use the same DevAgent engineering workflow
+devagent "Fix the failing checkout integration test without weakening the assertion."
+```
+
+You can similarly configure OpenAI, Gemini, Grok/xAI, or an OpenAI-compatible endpoint.
+
+**Benefit:** the model supplies reasoning, while DevAgent keeps the same deterministic acceptance, safety, verification, reporting, and publication rules around it.
+
+## What DevAgent adds around an AI coding model
+
+| Common engineering risk | DevAgent behavior |
+| --- | --- |
+| The model says “done” without enough proof | Required acceptance criteria remain `UNPROVEN` or the run becomes `PARTIALLY_VERIFIED` / `BLOCKED` instead of falsely claiming success. |
+| A patch touches unrelated code | Evidence gathering, explicit scope, minimal-change planning, and independent diff review constrain the change. |
+| Existing developer work is damaged | Clean repositories use isolated worktrees by default; dirty tracked/untracked developer work is protected; files are backed up before first modification. |
+| Tests passed before a later edit | Verification is revision-aware, so older successful evidence does not prove a newer tree. |
+| A generated change breaks the build or tests | DevAgent runs repository-supported targeted/broad checks and can diagnose/replan before final verification. |
+| An agent pushes directly to a protected primary branch | Starting from `main`, `master`, or `trunk` causes DevAgent to work on a safe branch; runtime DevAgent does not merge or deploy. |
+| You are locked to one model vendor | OpenAI, Claude, Gemini, Grok/xAI, and compatible endpoints can use the same engineering harness. |
+| It is hard to audit what the agent actually did | DevAgent emits an engineering report with decisions, changed symbols, tests, acceptance evidence, verification, failures, gaps, and source-control status. |
+
+The goal is not to replace developer judgment. The goal is to make autonomous engineering work **bounded, reviewable, reproducible, and harder to falsely declare complete**.
+
 Useful commands:
 
 ```bash
@@ -199,7 +305,7 @@ devagent benchmark --help
 
 ### Pinned real-world benchmark
 
-DevAgent 0.5 adds an opt-in benchmark runner for pinned GitHub repositories. A benchmark case injects a deterministic defect into an exact commit and uses an **external oracle** before and after DevAgent. This avoids treating DevAgent's own report as the benchmark oracle.
+DevAgent includes an opt-in benchmark runner for pinned GitHub repositories. A benchmark case injects a deterministic defect into an exact commit and uses an **external oracle** before and after DevAgent. This avoids treating DevAgent's own report as the benchmark oracle.
 
 ```bash
 devagent benchmark \
@@ -247,7 +353,7 @@ DevAgent uses defense-in-depth controls around repository modification, command
 - protected targets are refused and force push is never used;
 - no runtime PR, merge, rebase, force-push, or deployment automation.
 
-DevAgent is **not an operating-system sandbox**. Review the report and pushed branch before integrating customer or production code.
+On Linux, DevAgent can execute engineering commands inside a bubblewrap-based operating-system sandbox. Production qualification exercises required sandbox mode with network access denied. Required mode fails closed when isolation cannot be established rather than silently falling back. Review the report and pushed branch before integrating customer or production code: sandboxing reduces execution risk, but it does not make arbitrary generated changes universally safe.
 
 ## Repository intelligence and verification
 
@@ -267,13 +373,20 @@ Verification can include baseline tests, targeted tests, component/broad checks,
 
 ## Production qualification
 
-DevAgent 0.5.0 uses **production qualification v4**. It extends the v3 release gate with large-repository bounded-retrieval and real-world benchmark truthfulness contracts while preserving the primary invariant:
+DevAgent 0.8.0 uses cumulative production qualification rather than replacing older evidence with a smaller new suite.
+
+- **v4 — 70 required cases** covering end-to-end engineering behavior, acceptance truthfulness, task/risk scope, provider contracts and parity, model routing, worktree and Git publication safety, CLI input, review/repair loops, report/evaluation integrity, release integrity, large-repository behavior, structural refactors, Java/.NET discovery and execution, SQLite migration forward/rollback, and real repository-native stacks.
+- **v5 — 9 required autonomy cases** covering bounded parallel coordination, dirty-source refusal, real isolated parallel DevAgent runs, bounded/relevant skills and provider injection, automation overlap claim/recovery, and provider-benchmark deduplication, live structured-contract behavior, and secret redaction.
+
+The v0.8 merge commit on `main` passed both catalogs in required Linux sandbox mode:
 
 ```text
-false_verified == 0
+v4: 70/70 passed
+v5:  9/9 passed
+combined: 79/79 passed
 ```
 
-It covers end-to-end engineering behavior, acceptance truthfulness, task scope, provider contracts/parity, model routing, worktree and Git publication safety, CLI input, review/repair loops, report/evaluation integrity, release integrity, and actual repository-native toolchain execution for:
+The qualification environment exercises real local toolchains for:
 
 ```text
 Python / pytest
@@ -281,21 +394,30 @@ Node + TypeScript repository discovery
 Go
 Rust / Cargo
 C++ / Make
+Java / Maven
+.NET build
+SQLite migration forward + rollback
 ```
 
-Run the release qualification locally on a machine with those toolchains:
+Run the same release qualification catalogs locally on a machine with the required toolchains:
 
 ```bash
+DEVAGENT_SANDBOX=required DEVAGENT_NETWORK=deny \
 python -m devagent.qualification \
   --catalog evaluation/benchmark_v4.json \
   --report .devagent/production-qualification-v4.json
+
+DEVAGENT_SANDBOX=required DEVAGENT_NETWORK=deny \
+python -m devagent.qualification \
+  --catalog evaluation/benchmark_v5.json \
+  --report .devagent/production-qualification-v5.json
 ```
 
-Production CI runs Python 3.10/3.11/3.12, a clean wheel install, and this production qualification gate. The qualification JSON is retained as CI evidence.
+Production CI also runs Python 3.10/3.11/3.12, a clean wheel build/install, real bubblewrap sandbox smoke, and both qualification catalogs. Qualification JSON is retained as CI evidence.
 
-**100% qualified means 100% of this explicit catalog passed.** It does not mean mathematical correctness for every unseen repository, environment, model response, language, or engineering task.
+**100% qualified means 100% of these explicit catalogs passed on that revision and environment.** It does not mean mathematical correctness for every unseen repository, environment, model response, language, provider, or engineering task, and it is not a claim that DevAgent is universally superior to every hosted coding platform.
 
-See [docs/production-readiness.md](docs/production-readiness.md) for the evidence behind the 0.4.0 production-readiness assessment and its explicit limitations.
+See [docs/production-readiness.md](docs/production-readiness.md) for the project's earlier readiness assessment and its explicit limitations.
 
 ## Provider architecture
 
@@ -349,11 +471,15 @@ Automated provider tests normally use deterministic or mocked clients and do not
 
 ## Project status
 
-DevAgent 0.5 is **beta software**. Its qualification and benchmark results are bounded claims tied to explicit cases, pinned revisions, and external oracles; they are not a claim of universal correctness or parity with every hosted coding platform.
+DevAgent 0.8.0 is **beta software with a verified core release baseline**. The exact v0.8 merge revision on `main` passed Production CI across Python 3.10/3.11/3.12, clean wheel installation, real Linux bubblewrap sandbox execution, production qualification v4 (**70/70**), and autonomy qualification v5 (**9/9**), for **79/79 cumulative required qualification cases**.
+
+The current core includes evidence-backed `VERIFIED` / `PARTIALLY_VERIFIED` / `BLOCKED` outcomes, backup-first editing, isolated worktrees, bounded structural file operations, repository-native verification, independent review, safe branch publication, provider/model choice, Java and .NET engineering discovery/execution, SQLite migration forward/rollback verification, large-monorepo deep-manifest discovery, bounded parallel agents, repository-local skills, foreground automations, Linux OS sandboxing, bounded browser/local-UI verification, and real-provider structured-contract benchmarking.
+
+These results are **bounded engineering claims**, not universal-correctness or market-superiority claims. They are tied to explicit qualification cases, pinned revisions, deterministic fixtures/external oracles where applicable, and the environments actually exercised by CI.
 
-Remaining gaps include a larger published corpus of pinned upstream benchmark cases, browser/UI runtime qualification, a broader Java/.NET/database-migration matrix, very large monorepo stress runs above the current bounded inventory, parallel multi-agent orchestration, operating-system sandboxing, and continuous paid real-provider testing across every model/provider combination.
+Remaining work is primarily **breadth and external validation**, not missing core architecture: a larger public corpus of pinned upstream repositories and tasks; broader browser/UI coverage across dynamic applications and multiple browser environments; a wider Java/Gradle, .NET test-framework, and PostgreSQL/MySQL migration matrix beyond the current qualified fixtures; larger and more diverse monorepo stress cases beyond the current >12,000-file deep-manifest case; more real-world multi-agent workload studies; and continuous paid real-provider benchmarking across a broader set of model/provider combinations. GitHub branch protection/rulesets are external repository settings and must be configured separately; DevAgent does not claim to configure them itself.
 
-The project intentionally prioritizes trustworthy outcomes over feature count.
+The project intentionally prioritizes trustworthy outcomes, reproducible evidence, and safe engineering behavior over feature count or unsupported "best agent" claims.
 
 ## Contributing
 
@@ -371,4 +497,4 @@ DevAgent is open source under the [MIT License](LICENSE).
 Copyright (c) 2026 Tom Ha
 ```
 
-DevAgent was created by **Tom Ha**. Original repository: **https://github.com/tomha85/devagent**. See [NOTICE](NOTICE) and [COPYRIGHT](COPYRIGHT) for project attribution.
+DevAgent was created by **Tom Ha**. Original repository: **https://github.com/tomha85/devagent**. See [NOTICE](NOTICE) and [COPYRIGHT](COPYRIGHT) for project attribution.

{devagent_ai-0.8.0 → devagent_ai-0.8.2}/devagent/__init__.py

@@ -1,3 +1,3 @@
 """DevAgent: evidence-driven local software engineering automation."""
 
-__version__ = "0.8.0"
+__version__ = "0.8.2"

{devagent_ai-0.8.0 → devagent_ai-0.8.2}/devagent/models.py

@@ -186,6 +186,19 @@ class EngineeringPlan:
     verification: list[tuple[str, ...]]
     rationale: str
 
+    def __post_init__(self) -> None:
+        # A path-scoped `git diff -- <paths...>` is planner inspection, not a
+        # repository verification capability. DevAgent already captures and
+        # independently reviews the final diff. Keeping this command in the
+        # executable verification plan makes an otherwise valid plan fail the
+        # evidence-backed command allowlist before implementation can begin.
+        # Preserve real Git verification such as `git diff --check`.
+        self.verification = [
+            command
+            for command in self.verification
+            if not (len(command) > 3 and command[:3] == ("git", "diff", "--"))
+        ]
+
 
 _PRESERVATION_PATTERNS = (
     re.compile(r"\bpreserv(?:e|es|ed|ing)\s+(?:the\s+)?existing\s+([^.;\n]+)", re.IGNORECASE),

{devagent_ai-0.8.0 → devagent_ai-0.8.2}/devagent/tasking.py

@@ -63,6 +63,18 @@ _DIRECTIVE = re.compile(
     re.IGNORECASE,
 )
 
+# Bounded normalization for terse user intent. This is deliberately not a fuzzy
+# "guess what the user meant" layer: it corrects common engineering shorthand,
+# grammatical number, and operation wording while preserving identifiers,
+# quoted contracts, values, and explicit constraints. Task policy and repository
+# evidence still provide the verification/safety contract.
+_OPERATION_ALIASES: tuple[tuple[str, str], ...] = (
+    ("substraction", "subtraction"),
+    ("substract", "subtract"),
+    ("multipy", "multiply"),
+    ("mutiply", "multiply"),
+)
+
 
 def _classify(text: str) -> TaskType:
     lowered = text.lower()
@@ -98,6 +110,60 @@ def _dedupe(items: list[str]) -> list[str]:
     return result
 
 
+def _normalize_terse_requirement(requirement: str) -> str:
+    """Compile common rough one-line prompts into a clearer engineering request.
+
+    The compiler is intentionally bounded. It may repair shorthand/grammar and
+    make an operation explicit, but it must not add product behavior the user did
+    not request. Structured/multi-line requirements are left intact.
+    """
+
+    value = re.sub(r"\s+", " ", requirement).strip()
+    if not value or "\n" in requirement or _section_header(value) is not None:
+        return value
+    # An explicit callable name is already a precise user contract; never rename it.
+    if re.search(r"\b[A-Za-z_][A-Za-z0-9_]*\s*\(", value):
+        return value
+
+    for source, destination in _OPERATION_ALIASES:
+        value = re.sub(rf"\b{re.escape(source)}\b", destination, value, flags=re.IGNORECASE)
+
+    # Common shorthand from natural prompts such as "addition 2 matrix 2x2".
+    # Keep both "matrix" and "matrices" in the normalized contract so
+    # deterministic evidence can link either conventional symbol spelling.
+    matrix_match = re.search(
+        r"\b(add(?:ition)?|sum|subtract(?:ion)?|multiply|multiplication|divide|division)\b"
+        r"(?:\s+(?:of|for))?\s+(?:2|two)\s+matrix(?:es)?\s+(\d+x\d+)\b",
+        value,
+        flags=re.IGNORECASE,
+    )
+    if matrix_match:
+        operation = matrix_match.group(1).lower()
+        dimension = matrix_match.group(2).lower()
+        canonical_operation = {
+            "add": "addition",
+            "addition": "addition",
+            "sum": "addition",
+            "subtract": "subtraction",
+            "subtraction": "subtraction",
+            "multiply": "multiplication",
+            "multiplication": "multiplication",
+            "divide": "division",
+            "division": "division",
+        }[operation]
+        prefix = "Add" if re.search(r"\b(add|new|function|implement)\b", value, re.IGNORECASE) else "Implement"
+        return (
+            f"{prefix} a matrix {canonical_operation} function for two {dimension} matrices "
+            f"(matrix inputs)"
+        )
+
+    # Repair simple count+noun shorthand without inventing domain behavior.
+    value = re.sub(r"\b2\s+matrix\b", "two matrices", value, flags=re.IGNORECASE)
+    value = re.sub(r"\b2\s+file\b", "two files", value, flags=re.IGNORECASE)
+    value = re.sub(r"\b2\s+test\b", "two tests", value, flags=re.IGNORECASE)
+    return value
+
+
 def _section_header(line: str) -> tuple[str, str] | None:
     stripped = line.strip()
     markdown = re.match(r"^#{1,6}\s+(.+?)\s*$", stripped)
@@ -182,15 +248,21 @@ def _append_criterion(
 
 
 def compile_task(requirement: str) -> TaskSpec:
-    goal = re.sub(r"\s+", " ", requirement).strip()
-    if not goal:
+    raw_goal = re.sub(r"\s+", " ", requirement).strip()
+    if not raw_goal:
         raise ValueError("Engineering requirement cannot be empty")
+    goal = _normalize_terse_requirement(requirement)
     task_type = _classify(goal)
     code_change = task_type is not TaskType.UNIT_TEST or "only" not in goal.lower()
     requires_tests = task_type is not TaskType.BUILD_FAILURE
 
     criteria: list[AcceptanceCriterion] = []
-    for item in _user_acceptance_items(requirement):
+    # Structured user requirements remain authoritative. Only an unstructured,
+    # terse prompt is compiled into the clearer canonical request.
+    user_items = _user_acceptance_items(requirement)
+    if len(user_items) == 1 and user_items[0] == raw_goal and goal != raw_goal:
+        user_items = [goal]
+    for item in user_items:
         _append_criterion(criteria, item, source=AcceptanceSource.USER)
 
     if task_type in {TaskType.BUG_FIX, TaskType.RUNTIME_ERROR, TaskType.TEST_FAILURE}:
@@ -240,9 +312,61 @@ def compile_task(requirement: str) -> TaskSpec:
     )
 
 
+def _repository_language(repository: Any) -> str | None:
+    languages = [
+        language.lower()
+        for component in repository.components
+        for language in component.languages
+    ]
+    for preferred in ("python", "java", "csharp", "c#", "javascript", "typescript", "go", "rust"):
+        if preferred in languages:
+            return preferred
+    return languages[0] if languages else None
+
+
+def _matrix_operation_contract(task: TaskSpec, repository: Any) -> None:
+    """Turn the bounded matrix shorthand compiler output into a repo-style callable contract."""
+
+    match = re.fullmatch(
+        r"(?:Add|Implement) a matrix (addition|subtraction|multiplication|division) "
+        r"function for two (\d+x\d+) matrices \(matrix inputs\)",
+        task.goal,
+    )
+    if match is None:
+        return
+
+    operation, dimension = match.groups()
+    verb = {
+        "addition": "add",
+        "subtraction": "subtract",
+        "multiplication": "multiply",
+        "division": "divide",
+    }[operation]
+    compact_dimension = dimension.replace("x", "x")
+    language = _repository_language(repository)
+    if language in {"java", "javascript", "typescript"}:
+        symbol = f"{verb}Matrices{compact_dimension}"
+    elif language in {"csharp", "c#"}:
+        symbol = f"{verb.capitalize()}Matrices{compact_dimension}"
+    else:
+        symbol = f"{verb}_matrices_{compact_dimension}"
+
+    compiled = (
+        f"Add {symbol}(a, b) to perform element-wise matrix {operation} "
+        f"for two {dimension} matrices"
+    )
+    task.goal = compiled
+    user_criteria = [
+        criterion for criterion in task.acceptance_criteria if criterion.source is AcceptanceSource.USER
+    ]
+    if len(user_criteria) == 1:
+        user_criteria[0].description = compiled
+
+
 def enrich_acceptance_contract(task: TaskSpec, repository: Any) -> TaskSpec:
-    """Add checks derived from trusted repository capabilities without replacing user intent."""
+    """Compile safe repository-aware defaults, then add trusted repository checks."""
 
+    _matrix_operation_contract(task, repository)
     seen_commands: set[tuple[str, ...]] = set()
     for capability in repository.capabilities:
         if not capability.trusted: