devex-cli 0.29.2__tar.gz → 0.30.1__tar.gz

devex_cli-0.30.1/.devague/frames/devex-now-reads-qodo-pr-review-findings-structural.json

@@ -0,0 +1,303 @@
+{
+  "slug": "devex-now-reads-qodo-pr-review-findings-structural",
+  "title": "devex now reads Qodo PR-review findings structurally through the installed qodo-cli instead of regex-scraping the bot's HTML comment \u2014 richer, more robust findings with a graceful fallback when qodo-cli is absent",
+  "schema_version": 1,
+  "status": "exported",
+  "created": "2026-06-19T07:04:36Z",
+  "updated": "2026-06-19T08:27:23Z",
+  "claims": [
+    {
+      "id": "c1",
+      "kind": "announcement",
+      "text": "devex now reads Qodo PR-review findings structurally through the installed qodo-cli instead of regex-scraping the bot's HTML comment \u2014 richer, more robust findings with a graceful fallback when qodo-cli is absent",
+      "origin": "user",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h3",
+          "text": "Installing 'devex-cli[qodo]' and running 'devex pr read' on a Qodo-reviewed PR produces a strictly richer briefing than today, while an install WITHOUT the extra is byte-for-byte unchanged \u2014 proving the integration is purely additive.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c2",
+      "kind": "audience",
+      "text": "The autonomous agent running 'devex pr read' / 'devex pr await' on an AgentCulture repo (and the human, e.g. Ori, reviewing the resulting briefing) \u2014 both currently get Qodo findings filtered through a fragile HTML scraper.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h6",
+          "text": "grep confirms _qodo.parse is today the SOLE source of Qodo findings feeding both 'pr read' and 'pr await' (read.py + await_.py call it), so both consumers inherit any improvement to that seam.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c3",
+      "kind": "before_state",
+      "text": "devex extracts Qodo findings by stdlib-regex-scraping the bot's 'Code Review by Qodo' HTML comment in _qodo.py \u2014 defensive, lossy (no severity/type/categories/agent_prompt), and the historical source of a ReDoS SonarCloud hotspot.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h7",
+          "text": "git history confirms _qodo.py parses the bot's HTML with stdlib regex and that a python:S5852 ReDoS hotspot was previously raised on a Qodo-parsing regex (commit history / SonarCloud).",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c4",
+      "kind": "after_state",
+      "text": "When qodo-cli is on PATH, devex sources Qodo findings from 'qodo review list --json' (the tool that owns Qodo's format) \u2014 gaining per-finding severity/type/categories and self-maintaining as the format evolves \u2014 and falls back to the existing HTML scraper unchanged when qodo-cli is absent or errors.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h8",
+          "text": "On a Qodo-reviewed PR with [qodo] installed, 'pr read' renders per-finding severity/type/categories that are absent from today's output; with the extra removed the rendered output is unchanged.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c5",
+      "kind": "why_it_matters",
+      "text": "It moves the parsing burden onto the tool that owns the format, shrinks devex's brittle regex surface (less ReDoS/maintenance risk), and enriches the briefing \u2014 all without adding a runtime dependency or changing the default install.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h9",
+          "text": "After the change pyproject's runtime 'dependencies' is still [] and a test proves the qodo-cli source is preferred over the regex scraper whenever the adapter reports the capability available.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c6",
+      "kind": "boundary",
+      "text": "v1 is READ-ONLY and confined to Qodo-finding extraction for 'pr read' / 'pr await'. It does NOT delegate comment resolution to 'qodo review resolve' (would expand the mutation surface), does NOT add 'qodo rules get' (new non-gh network egress), and does NOT remove the HTML scraper (it stays as the fallback).",
+      "origin": "llm",
+      "status": "rejected",
+      "honesty_conditions": [],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c7",
+      "kind": "success_signal",
+      "text": "With qodo-cli installed, 'devex pr read' on a PR with Qodo findings shows the same counts/total/url as before PLUS per-finding severity/type; with qodo-cli uninstalled, output is byte-identical to today; no new failing path (any qodo-cli error degrades silently to the scraper).",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h10",
+          "text": "Snapshot tests prove: qodo present -> briefing strictly a superset of today's; qodo absent -> output byte-identical; and no degradation path produces a non-zero exit.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c8",
+      "kind": "decision",
+      "text": "devex invokes qodo as a SUBPROCESS of its console script ('qodo review list --json'), not a Python import \u2014 matching devex's existing thin 'gh' shellout pattern (core/github.py) and binding only to qodo-cli's stable --json contract, never its private modules.",
+      "origin": "llm",
+      "status": "rejected",
+      "honesty_conditions": [],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c9",
+      "kind": "decision",
+      "text": "The optional extra is 'devex-cli[qodo] = [\"qodo-cli\"]' \u2014 it only ensures the 'qodo' console script lands on PATH; runtime dependencies = [] is unchanged, mirroring the reterminal-cli '[graphics]' optional-capability pattern.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c10",
+      "kind": "decision",
+      "text": "Availability is detected lazily at call time (shutil.which('qodo') + a bounded subprocess run); exit code != 0 (e.g. 2 = no ~/.qodo config / gh absent), a timeout, or unparseable JSON all degrade to the existing HTML scraper. Detection/parsing never raises out of _qodo.",
+      "origin": "llm",
+      "status": "rejected",
+      "honesty_conditions": [],
+      "hard_questions": [
+        {
+          "id": "q1",
+          "text": "risk: qodo-cli's exit-2 'env/setup error' (missing ~/.qodo/config.json, gh absent, API error) must be treated as 'degrade to scraper', NOT surfaced as a devex error \u2014 otherwise installing the extra could make pr read noisier than not installing it.",
+          "resolved": false,
+          "blocking": false
+        }
+      ],
+      "links": []
+    },
+    {
+      "id": "c11",
+      "kind": "requirement",
+      "text": "_qodo.parse must return the SAME {counts, total, findings, url} shape regardless of source, enriched with optional per-finding 'severity'/'type'/'categories' keys that are simply None/absent on the scraper path \u2014 so pr read / pr await templates need no branching on source.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h1",
+          "text": "The merged shape round-trips: a snapshot/unit test feeds a representative 'qodo review list --json' payload AND a representative HTML comment through _qodo.parse and asserts both yield the same {counts,total,findings,url} keys, with severity/type/categories present from JSON and None/absent from HTML.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c12",
+      "kind": "requirement",
+      "text": "When qodo-cli is not installed, every existing test and every byte of 'devex pr read' / 'pr await' output is unchanged \u2014 the structured path is strictly additive and gated on qodo-cli being present AND succeeding.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h2",
+          "text": "A guard test simulates 'qodo' absent (which() returns None / subprocess unavailable) and asserts _qodo.parse falls back to the scraper and pr read output byte-matches the existing snapshot.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c13",
+      "kind": "non_goal",
+      "text": "Delegating PR-comment resolution to 'qodo review resolve' and surfacing org rules via 'qodo rules get' are explicitly out of scope for v1 \u2014 they touch the mutation surface and a new network-egress class respectively, and belong in a follow-up.",
+      "origin": "llm",
+      "status": "rejected",
+      "honesty_conditions": [],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c14",
+      "kind": "boundary",
+      "text": "v1 ships a new 'reviewer' noun \u2014 devex's deterministic-markdown home for managing the Qodo reviewer (rules semantic-search, review-comment triage/resolve, repo reviewer config) \u2014 AND enriches existing 'pr read'/'pr await' findings, all through ONE qodo-cli adapter seam. devex wraps qodo-cli's output in its own markdown briefing + per-backend 'Next step:' footer; it never forks, vendors, or reimplements Qodo logic. When the [qodo] extra is absent every reviewer verb degrades to an exit-0 'unsupported' markdown notice (invariant #5).",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h11",
+          "text": "devex ships NO vendored copy of qodo logic (no qodo module under src/devex); a test asserts every 'reviewer' verb exits 0 with the unsupported markdown notice when 'qodo' is unimportable.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c15",
+      "kind": "decision",
+      "text": "Integration is IN-PROCESS: the [qodo] extra ('devex-cli[qodo] = [\"qodo-cli\"]') installs the 'qodo' package into devex's env; a single thin adapter gates on 'import qodo' and invokes 'qodo.cli.main([...,\"--json\"])' capturing stdout + catching SystemExit \u2014 binding ONLY to qodo-cli's stable --json/CLI contract, never its private 'qodo.cli._*' modules. The adapter is the one and only seam to qodo-cli.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c16",
+      "kind": "decision",
+      "text": "Two follow-ups are filed at design time: (a) an issue on agentculture/qodo-cli requesting a documented public Python API (e.g. 'qodo.api' returning structured data) for integration; (b) an issue on agentculture/devex to migrate the adapter from main()-capture onto that public API once it lands. The single adapter seam keeps that migration a one-file change.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c17",
+      "kind": "after_state",
+      "text": "An agent can run 'devex reviewer rules \"<q>\"', 'devex reviewer review list|resolve', and 'devex reviewer config show|validate|init' to manage Qodo entirely through devex's uniform markdown+footer surface, and 'pr read'/'pr await' gain per-finding severity/type/categories \u2014 all powered by the in-process qodo-cli adapter, with a clean unsupported-notice when the extra isn't installed.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h12",
+          "text": "A test enumerates each 'reviewer' verb (rules / review list / review resolve / config show|validate|init) and asserts it maps to the expected 'qodo.cli.main([...])' argv through the adapter.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c18",
+      "kind": "requirement",
+      "text": "Invariant docs must be updated: 'reviewer review resolve' MUTATES GitHub (reply+ack+resolve), so invariant #4's side-effect set is extended to name it; and the rules/review network I/O performed inside qodo-cli (Qodo rules API + gh) is documented as an extension of the 'pr' namespace network carve-out. No new egress originates in devex itself \u2014 it all flows through the imported qodo-cli.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h4",
+          "text": "The PR updates CLAUDE.md invariant #4 to name 'reviewer review resolve' in the side-effect set and documents the qodo-cli-mediated network egress as a pr-namespace carve-out extension; a doc/guard test or explicit review confirms devex itself opens no new socket (all network is inside the imported qodo-cli).",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c19",
+      "kind": "requirement",
+      "text": "The adapter degrades silently and uniformly: missing [qodo] extra (ImportError), qodo-cli env/setup failure (its exit 2 \u2014 no ~/.qodo/config.json, gh absent, API error), a non-zero exit, or unparseable JSON ALL map to 'capability unavailable' \u2014 pr read/await fall back to the HTML scraper byte-for-byte, and reviewer verbs print the exit-0 unsupported notice. The adapter never raises out to the CLI.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [
+        {
+          "id": "h5",
+          "text": "A test matrix exercises each degradation path \u2014 extra absent (ImportError), simulated qodo exit 2, non-zero exit, and bad JSON \u2014 and asserts: pr read/await output byte-matches the scraper snapshot, every reviewer verb exits 0 with the unsupported notice, and nothing propagates out of the adapter.",
+          "status": "confirmed"
+        }
+      ],
+      "hard_questions": [],
+      "links": []
+    },
+    {
+      "id": "c20",
+      "kind": "decision",
+      "text": "Availability is detected lazily inside the adapter by attempting 'import qodo' (the [qodo] extra makes it importable). ImportError (extra absent), qodo's exit-2/non-zero surfaced as SystemExit from main(), a captured-output guard, or unparseable JSON ALL map to 'capability unavailable' \u2014 pr read/await fall back to the HTML scraper; reviewer verbs emit the exit-0 unsupported notice. The adapter never raises out to the CLI.",
+      "origin": "llm",
+      "status": "confirmed",
+      "honesty_conditions": [],
+      "hard_questions": [],
+      "links": []
+    }
+  ],
+  "open_vagueness": [
+    {
+      "id": "v1",
+      "text": "Exact field names + nesting of 'qodo review list --json' (severity/type/categories/description/agent_prompt) are documented from qodo --help but NOT yet verified against live output \u2014 needs a PR carrying real Qodo bot comments + ~/.qodo/config.json. Implementation must probe the real schema and map defensively.",
+      "kind": "unknown_nonblocking",
+      "claim_id": null
+    },
+    {
+      "id": "v2",
+      "text": "Whether qodo-cli reliably maps a Qodo finding to file:line the same way the scraper's permalink extraction does (so dedupe/identity stays stable across sources).",
+      "kind": "unknown_nonblocking",
+      "claim_id": null
+    }
+  ]
+}

devex_cli-0.30.1/.devague/plans/devex-now-reads-qodo-pr-review-findings-structural.json

@@ -0,0 +1,271 @@
+{
+  "slug": "devex-now-reads-qodo-pr-review-findings-structural",
+  "title": "devex now reads Qodo PR-review findings structurally through the installed qodo-cli instead of regex-scraping the bot's HTML comment \u2014 richer, more robust findings with a graceful fallback when qodo-cli is absent",
+  "frame_slug": "devex-now-reads-qodo-pr-review-findings-structural",
+  "schema_version": 1,
+  "status": "exported",
+  "created": "2026-06-19T08:28:26Z",
+  "updated": "2026-06-19T08:34:30Z",
+  "targets": [
+    {
+      "id": "c1",
+      "kind": "announcement",
+      "text": "devex now reads Qodo PR-review findings structurally through the installed qodo-cli instead of regex-scraping the bot's HTML comment \u2014 richer, more robust findings with a graceful fallback when qodo-cli is absent"
+    },
+    {
+      "id": "h3",
+      "kind": "honesty",
+      "text": "Installing 'devex-cli[qodo]' and running 'devex pr read' on a Qodo-reviewed PR produces a strictly richer briefing than today, while an install WITHOUT the extra is byte-for-byte unchanged \u2014 proving the integration is purely additive."
+    },
+    {
+      "id": "c2",
+      "kind": "audience",
+      "text": "The autonomous agent running 'devex pr read' / 'devex pr await' on an AgentCulture repo (and the human, e.g. Ori, reviewing the resulting briefing) \u2014 both currently get Qodo findings filtered through a fragile HTML scraper."
+    },
+    {
+      "id": "h6",
+      "kind": "honesty",
+      "text": "grep confirms _qodo.parse is today the SOLE source of Qodo findings feeding both 'pr read' and 'pr await' (read.py + await_.py call it), so both consumers inherit any improvement to that seam."
+    },
+    {
+      "id": "c3",
+      "kind": "before_state",
+      "text": "devex extracts Qodo findings by stdlib-regex-scraping the bot's 'Code Review by Qodo' HTML comment in _qodo.py \u2014 defensive, lossy (no severity/type/categories/agent_prompt), and the historical source of a ReDoS SonarCloud hotspot."
+    },
+    {
+      "id": "h7",
+      "kind": "honesty",
+      "text": "git history confirms _qodo.py parses the bot's HTML with stdlib regex and that a python:S5852 ReDoS hotspot was previously raised on a Qodo-parsing regex (commit history / SonarCloud)."
+    },
+    {
+      "id": "c4",
+      "kind": "after_state",
+      "text": "When qodo-cli is on PATH, devex sources Qodo findings from 'qodo review list --json' (the tool that owns Qodo's format) \u2014 gaining per-finding severity/type/categories and self-maintaining as the format evolves \u2014 and falls back to the existing HTML scraper unchanged when qodo-cli is absent or errors."
+    },
+    {
+      "id": "h8",
+      "kind": "honesty",
+      "text": "On a Qodo-reviewed PR with [qodo] installed, 'pr read' renders per-finding severity/type/categories that are absent from today's output; with the extra removed the rendered output is unchanged."
+    },
+    {
+      "id": "c5",
+      "kind": "why_it_matters",
+      "text": "It moves the parsing burden onto the tool that owns the format, shrinks devex's brittle regex surface (less ReDoS/maintenance risk), and enriches the briefing \u2014 all without adding a runtime dependency or changing the default install."
+    },
+    {
+      "id": "h9",
+      "kind": "honesty",
+      "text": "After the change pyproject's runtime 'dependencies' is still [] and a test proves the qodo-cli source is preferred over the regex scraper whenever the adapter reports the capability available."
+    },
+    {
+      "id": "c7",
+      "kind": "success_signal",
+      "text": "With qodo-cli installed, 'devex pr read' on a PR with Qodo findings shows the same counts/total/url as before PLUS per-finding severity/type; with qodo-cli uninstalled, output is byte-identical to today; no new failing path (any qodo-cli error degrades silently to the scraper)."
+    },
+    {
+      "id": "h10",
+      "kind": "honesty",
+      "text": "Snapshot tests prove: qodo present -> briefing strictly a superset of today's; qodo absent -> output byte-identical; and no degradation path produces a non-zero exit."
+    },
+    {
+      "id": "c11",
+      "kind": "requirement",
+      "text": "_qodo.parse must return the SAME {counts, total, findings, url} shape regardless of source, enriched with optional per-finding 'severity'/'type'/'categories' keys that are simply None/absent on the scraper path \u2014 so pr read / pr await templates need no branching on source."
+    },
+    {
+      "id": "h1",
+      "kind": "honesty",
+      "text": "The merged shape round-trips: a snapshot/unit test feeds a representative 'qodo review list --json' payload AND a representative HTML comment through _qodo.parse and asserts both yield the same {counts,total,findings,url} keys, with severity/type/categories present from JSON and None/absent from HTML."
+    },
+    {
+      "id": "c12",
+      "kind": "requirement",
+      "text": "When qodo-cli is not installed, every existing test and every byte of 'devex pr read' / 'pr await' output is unchanged \u2014 the structured path is strictly additive and gated on qodo-cli being present AND succeeding."
+    },
+    {
+      "id": "h2",
+      "kind": "honesty",
+      "text": "A guard test simulates 'qodo' absent (which() returns None / subprocess unavailable) and asserts _qodo.parse falls back to the scraper and pr read output byte-matches the existing snapshot."
+    },
+    {
+      "id": "c14",
+      "kind": "boundary",
+      "text": "v1 ships a new 'reviewer' noun \u2014 devex's deterministic-markdown home for managing the Qodo reviewer (rules semantic-search, review-comment triage/resolve, repo reviewer config) \u2014 AND enriches existing 'pr read'/'pr await' findings, all through ONE qodo-cli adapter seam. devex wraps qodo-cli's output in its own markdown briefing + per-backend 'Next step:' footer; it never forks, vendors, or reimplements Qodo logic. When the [qodo] extra is absent every reviewer verb degrades to an exit-0 'unsupported' markdown notice (invariant #5)."
+    },
+    {
+      "id": "h11",
+      "kind": "honesty",
+      "text": "devex ships NO vendored copy of qodo logic (no qodo module under src/devex); a test asserts every 'reviewer' verb exits 0 with the unsupported markdown notice when 'qodo' is unimportable."
+    },
+    {
+      "id": "c17",
+      "kind": "after_state",
+      "text": "An agent can run 'devex reviewer rules \"<q>\"', 'devex reviewer review list|resolve', and 'devex reviewer config show|validate|init' to manage Qodo entirely through devex's uniform markdown+footer surface, and 'pr read'/'pr await' gain per-finding severity/type/categories \u2014 all powered by the in-process qodo-cli adapter, with a clean unsupported-notice when the extra isn't installed."
+    },
+    {
+      "id": "h12",
+      "kind": "honesty",
+      "text": "A test enumerates each 'reviewer' verb (rules / review list / review resolve / config show|validate|init) and asserts it maps to the expected 'qodo.cli.main([...])' argv through the adapter."
+    },
+    {
+      "id": "c18",
+      "kind": "requirement",
+      "text": "Invariant docs must be updated: 'reviewer review resolve' MUTATES GitHub (reply+ack+resolve), so invariant #4's side-effect set is extended to name it; and the rules/review network I/O performed inside qodo-cli (Qodo rules API + gh) is documented as an extension of the 'pr' namespace network carve-out. No new egress originates in devex itself \u2014 it all flows through the imported qodo-cli."
+    },
+    {
+      "id": "h4",
+      "kind": "honesty",
+      "text": "The PR updates CLAUDE.md invariant #4 to name 'reviewer review resolve' in the side-effect set and documents the qodo-cli-mediated network egress as a pr-namespace carve-out extension; a doc/guard test or explicit review confirms devex itself opens no new socket (all network is inside the imported qodo-cli)."
+    },
+    {
+      "id": "c19",
+      "kind": "requirement",
+      "text": "The adapter degrades silently and uniformly: missing [qodo] extra (ImportError), qodo-cli env/setup failure (its exit 2 \u2014 no ~/.qodo/config.json, gh absent, API error), a non-zero exit, or unparseable JSON ALL map to 'capability unavailable' \u2014 pr read/await fall back to the HTML scraper byte-for-byte, and reviewer verbs print the exit-0 unsupported notice. The adapter never raises out to the CLI."
+    },
+    {
+      "id": "h5",
+      "kind": "honesty",
+      "text": "A test matrix exercises each degradation path \u2014 extra absent (ImportError), simulated qodo exit 2, non-zero exit, and bad JSON \u2014 and asserts: pr read/await output byte-matches the scraper snapshot, every reviewer verb exits 0 with the unsupported notice, and nothing propagates out of the adapter."
+    }
+  ],
+  "tasks": [
+    {
+      "id": "t1",
+      "summary": "Add core/qodo.py \u2014 the single in-process qodo-cli adapter seam (import gate + main()-capture)",
+      "origin": "llm",
+      "status": "confirmed",
+      "acceptance_criteria": [
+        "available() returns False without raising when 'import qodo' fails, True when importable",
+        "run_json(argv) invokes qodo.cli.main inside redirect_stdout, catches SystemExit for the exit code, returns the parsed JSON on exit 0, and the 'unavailable' sentinel on ImportError / non-zero exit / unparseable JSON \u2014 and NEVER raises out",
+        "degradation-matrix test: ImportError, SystemExit(2), SystemExit(1), and bad-JSON all map to 'unavailable'; a valid --json payload maps to the parsed object"
+      ],
+      "deps": [],
+      "covers": [
+        "c19",
+        "h5"
+      ]
+    },
+    {
+      "id": "t2",
+      "summary": "Declare the optional [qodo] extra in pyproject (qodo-cli) + dev group",
+      "origin": "llm",
+      "status": "confirmed",
+      "acceptance_criteria": [
+        "[project.optional-dependencies].qodo == ['qodo-cli'] and runtime [project].dependencies is still []",
+        "a packaging test asserts dependencies==[] and that the 'qodo' extra exists and names qodo-cli"
+      ],
+      "deps": [],
+      "covers": [
+        "c5"
+      ]
+    },
+    {
+      "id": "t3",
+      "summary": "Build the 'reviewer' noun (rules / review list|resolve / config) wrapping the adapter + wire into cli.py",
+      "origin": "llm",
+      "status": "confirmed",
+      "acceptance_criteria": [
+        "each verb maps to the expected qodo argv: rules->['rules','get',q,'--json']; review list->['review','list','--json']; review resolve->['review','resolve',id,...]; config show|validate|init->['config',sub,'--json'] (enumerated mapping test)",
+        "with qodo unimportable every reviewer verb exits 0 and emits the markdown 'unsupported' notice (invariant #5); a test asserts no vendored qodo module exists under src/devex",
+        "each verb's stdout is devex markdown wrapping qodo output + a per-backend 'Next step:' footer"
+      ],
+      "deps": [
+        "t1"
+      ],
+      "covers": [
+        "c14",
+        "h11",
+        "c17",
+        "h12"
+      ]
+    },
+    {
+      "id": "t4",
+      "summary": "Make _qodo.parse prefer adapter-sourced structured findings, else fall back to the HTML scraper",
+      "origin": "llm",
+      "status": "confirmed",
+      "acceptance_criteria": [
+        "round-trip shape test: a representative 'qodo review list --json' payload AND a representative HTML comment both yield {counts,total,findings,url}; severity/type/categories present from JSON, None/absent from HTML",
+        "when the adapter is unavailable, _qodo.parse falls back to the existing scraper and 'pr read' output byte-matches the pre-change snapshot",
+        "_qodo.parse stays the sole Qodo-finding source for read.py and await_.py (call sites unchanged); a test proves the qodo source is preferred whenever available"
+      ],
+      "deps": [
+        "t1"
+      ],
+      "covers": [
+        "c11",
+        "h1",
+        "c12",
+        "h2",
+        "c2",
+        "h6",
+        "c3",
+        "h7",
+        "h9"
+      ]
+    },
+    {
+      "id": "t5",
+      "summary": "Render per-finding severity/type/categories in the pr read / pr await briefing",
+      "origin": "llm",
+      "status": "confirmed",
+      "acceptance_criteria": [
+        "with structured findings present, 'pr read' renders per-finding severity/type/categories absent from today's output",
+        "snapshot tests: qodo present -> briefing is a strict superset of today's; qodo absent -> byte-identical; no degradation path returns a non-zero exit"
+      ],
+      "deps": [
+        "t4"
+      ],
+      "covers": [
+        "c4",
+        "h8",
+        "c7",
+        "h10",
+        "c1",
+        "h3"
+      ]
+    },
+    {
+      "id": "t6",
+      "summary": "Update invariant docs \u2014 CLAUDE.md #4 side-effect set + qodo-mediated network carve-out",
+      "origin": "llm",
+      "status": "confirmed",
+      "acceptance_criteria": [
+        "CLAUDE.md invariant #4 names 'reviewer review resolve' in the GitHub-mutating side-effect set",
+        "docs state the qodo-cli-mediated egress (Qodo rules API + gh) is a pr-namespace carve-out extension and that devex itself opens no new socket"
+      ],
+      "deps": [],
+      "covers": [
+        "c18",
+        "h4"
+      ]
+    },
+    {
+      "id": "t7",
+      "summary": "File the two follow-up issues (qodo-cli public API; devex adapter migration)",
+      "origin": "llm",
+      "status": "confirmed",
+      "acceptance_criteria": [
+        "an issue is opened on agentculture/qodo-cli requesting a documented public Python API for integration",
+        "an issue is opened on agentculture/devex to migrate the adapter from main()-capture onto that public API once it lands; both issue URLs recorded in the PR body / CHANGELOG"
+      ],
+      "deps": [],
+      "covers": []
+    },
+    {
+      "id": "t8",
+      "summary": "Version bump in pyproject + CHANGELOG section",
+      "origin": "llm",
+      "status": "confirmed",
+      "acceptance_criteria": [
+        "pyproject version is greater than main's (version-check passes)",
+        "CHANGELOG.md gains a new section covering the reviewer noun, the [qodo] extra, and the pr read/await enrichment"
+      ],
+      "deps": [
+        "t2"
+      ],
+      "covers": []
+    }
+  ],
+  "risks": []
+}

{devex_cli-0.29.2 → devex_cli-0.30.1}/.github/workflows/test.yml

@@ -5,13 +5,23 @@ on:
     branches: [main]
   pull_request:
 
+# Cancel superseded runs on the same ref so a rapid push sequence doesn't pile
+# up parallel matrices (Actions-quota savings — see issue #84).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  # Linux-only matrix. macOS (runner ×10) and Windows (×2) were dropped to cut
+  # GitHub Actions quota — see issue #84 (devex was the org's #2 private-repo
+  # consumer; the 4 macOS legs were 65% of the quota cost from 19% of raw
+  # minutes). Trade-off: the Windows-specific guards this repo cares about
+  # (portalocker over fcntl/msvcrt; utf-8 encoding) are no longer exercised in CI.
   test:
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
         python: ["3.10", "3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

{devex_cli-0.29.2 → devex_cli-0.30.1}/CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.30.1] - 2026-06-19
+
+### Added
+
+- devex.core.qodo.MIN_PYTHON + python_supported() — the single in-code source of truth for qodo-cli's Python floor (mirrors the pyproject [qodo] marker).
+
+### Changed
+
+- CI: trimmed test.yml to a Linux-only matrix (was 3 OS x 4 Python, 12 jobs) and added workflow-level concurrency with cancel-in-progress to cut GitHub Actions quota (#84).
+
+### Fixed
+
+- devex reviewer unavailable notice and its "Next step:" footer no longer recommend pip install 'devex-cli[qodo]' on Python < 3.12, where the marker-gated extra cannot install at all — they now explain the interpreter is too old and show how to recreate the environment on Python >= 3.12.
+
+## [0.30.0] - 2026-06-19
+
+### Added
+
+- `reviewer` noun — devex's deterministic-markdown home for managing the Qodo reviewer through the optional sibling qodo-cli: `reviewer rules "<q>"` (semantic-search org rules), `reviewer review list` / `reviewer review resolve <id…>` (triage / reply+ack+resolve the bot's PR comments — the only mutating verb), and `reviewer config show|validate|init`. Each wraps qodo-cli's `--json` output in a devex briefing + per-backend "Next step:" footer.
+- Optional `devex-cli[qodo]` extra (declares `qodo-cli`; runtime dependencies unchanged). qodo-cli requires Python ≥3.12, so the extra is marker-gated and is a graceful no-op on 3.10/3.11.
+- `core/qodo.py` — the single in-process seam to qodo-cli. Binds only to the stable `qodo.cli.main(argv)` + `--json` contract (never private modules); uniformly fail-open (ImportError / exit-2 / non-zero / bad JSON all degrade to "capability unavailable"); never raises.
+
+### Changed
+
+- `pr read` / `pr await`: when the `[qodo]` extra is installed, Qodo findings are sourced from qodo-cli's structured `review list --json` and enriched with per-finding severity/type/categories. Counts/total/url stay byte-stable from the HTML summary; without the extra the briefing is byte-identical to before. The HTML scraper remains the fallback.
+- Docs: invariant #4 now names `reviewer review resolve` as a GitHub-mutating side effect; the qodo-cli-mediated network egress is documented as a `pr`-namespace carve-out extension (devex itself opens no new socket).
+
 ## [0.29.2] - 2026-06-13
 
 ### Changed