devtime-ei 0.1.3__tar.gz → 0.3.0__tar.gz

{devtime_ei-0.1.3 → devtime_ei-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devtime-ei
-Version: 0.1.3
+Version: 0.3.0
 Summary: Local-first Engineering Intelligence for software repositories
 Author-email: Aviad Shakargi <aviad94@gmail.com>
 Maintainer-email: Aviad Shakargi <aviad94@gmail.com>
@@ -8,7 +8,7 @@ License: Apache-2.0
 Project-URL: Homepage, https://github.com/Shakargy/devtime
 Project-URL: Repository, https://github.com/Shakargy/devtime
 Project-URL: Issues, https://github.com/Shakargy/devtime/issues
-Project-URL: Release Notes, https://github.com/Shakargy/devtime/releases/tag/v0.1.3
+Project-URL: Release Notes, https://github.com/Shakargy/devtime/releases/tag/v0.3.0
 Project-URL: Demo, https://youtu.be/1Hiu3Y9J_SI
 Keywords: devtools,cli,static-analysis,repository-analysis,engineering-intelligence,local-first
 Classifier: Development Status :: 3 - Alpha
@@ -204,6 +204,7 @@ Anything outside these six is out of scope for V0. See [LIMITATIONS.md](LIMITATI
 | `dtc context <concept>` | Create a governed Context Pack for agents or humans. |
 | `dtc risk --diff` | Review a git diff for risky changes using local evidence (advisory). |
 | `dtc decision add` | Add a local decision record that can reduce uncertainty. |
+| `dtc verify [claim]` | Verify a repository claim against evidence: status, contradictions, freshness (experimental). |
 
 (Also available: `dtc evidence`, `dtc debt`, `dtc status`, `dtc doctor --privacy`,
 `dtc export`, `dtc reset`, `dtc mcp start`.)
@@ -246,9 +247,10 @@ Or in any MCP client that reads `.mcp.json`:
 }
 ```
 
-The agent gets three read-only tools: `list_concepts`, `explain_concept`, and
+The agent gets four read-only tools: `list_concepts`, `explain_concept`,
 `get_context_pack` (governed context with do-not-change-without-review paths, tests
-to run, and agent guidance). Local stdio only - no network listener, no write tools,
+to run, and agent guidance), and `verify_claim` (claim status, contradictions, and
+missing evidence, computed fresh and never persisted). Local stdio only - no network listener, no write tools,
 no source code returned, only evidence file paths.
 
 DevTime is listed in the official MCP Registry as `io.github.Shakargy/devtime`.
@@ -294,6 +296,30 @@ python -m venv .venv
 pip install -e ".[dev]"
 ```
 
+## Verify claims (experimental)
+
+DevTime is growing into a verification layer: ask whether a statement about the
+repository is actually supported.
+
+```bash
+dtc verify billing-webhook-signature
+```
+
+```
+Billing Webhook Signature Verification
+Claim: Incoming billing webhooks verify the payment provider's signature.
+Status: CONTRADICTED
+
+Contradictions:
+  - The billing webhook endpoint cannot verify signatures because it is a disabled stub.
+      claimed:  apps/web/pages/api/stripe/webhook.ts is named and routed as a billing webhook endpoint.
+      observed: The handler's only behavior is a 404/501 response.
+```
+
+Statuses are SUPPORTED, WEAK, CONTRADICTED, or UNKNOWN; contradictions always
+show both sides; changed evidence marks a claim STALE. Two built-in claims ship
+(billing webhook signatures, JWT authentication). See **[VERIFICATION.md](VERIFICATION.md)**.
+
 ## Example output
 
 ```

{devtime_ei-0.1.3 → devtime_ei-0.3.0}/README.md

@@ -165,6 +165,7 @@ Anything outside these six is out of scope for V0. See [LIMITATIONS.md](LIMITATI
 | `dtc context <concept>` | Create a governed Context Pack for agents or humans. |
 | `dtc risk --diff` | Review a git diff for risky changes using local evidence (advisory). |
 | `dtc decision add` | Add a local decision record that can reduce uncertainty. |
+| `dtc verify [claim]` | Verify a repository claim against evidence: status, contradictions, freshness (experimental). |
 
 (Also available: `dtc evidence`, `dtc debt`, `dtc status`, `dtc doctor --privacy`,
 `dtc export`, `dtc reset`, `dtc mcp start`.)
@@ -207,9 +208,10 @@ Or in any MCP client that reads `.mcp.json`:
 }
 ```
 
-The agent gets three read-only tools: `list_concepts`, `explain_concept`, and
+The agent gets four read-only tools: `list_concepts`, `explain_concept`,
 `get_context_pack` (governed context with do-not-change-without-review paths, tests
-to run, and agent guidance). Local stdio only - no network listener, no write tools,
+to run, and agent guidance), and `verify_claim` (claim status, contradictions, and
+missing evidence, computed fresh and never persisted). Local stdio only - no network listener, no write tools,
 no source code returned, only evidence file paths.
 
 DevTime is listed in the official MCP Registry as `io.github.Shakargy/devtime`.
@@ -255,6 +257,30 @@ python -m venv .venv
 pip install -e ".[dev]"
 ```
 
+## Verify claims (experimental)
+
+DevTime is growing into a verification layer: ask whether a statement about the
+repository is actually supported.
+
+```bash
+dtc verify billing-webhook-signature
+```
+
+```
+Billing Webhook Signature Verification
+Claim: Incoming billing webhooks verify the payment provider's signature.
+Status: CONTRADICTED
+
+Contradictions:
+  - The billing webhook endpoint cannot verify signatures because it is a disabled stub.
+      claimed:  apps/web/pages/api/stripe/webhook.ts is named and routed as a billing webhook endpoint.
+      observed: The handler's only behavior is a 404/501 response.
+```
+
+Statuses are SUPPORTED, WEAK, CONTRADICTED, or UNKNOWN; contradictions always
+show both sides; changed evidence marks a claim STALE. Two built-in claims ship
+(billing webhook signatures, JWT authentication). See **[VERIFICATION.md](VERIFICATION.md)**.
+
 ## Example output
 
 ```

{devtime_ei-0.1.3 → devtime_ei-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devtime-ei"
-version = "0.1.3"
+version = "0.3.0"
 description = "Local-first Engineering Intelligence for software repositories"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -50,7 +50,7 @@ dev = [
 Homepage = "https://github.com/Shakargy/devtime"
 Repository = "https://github.com/Shakargy/devtime"
 Issues = "https://github.com/Shakargy/devtime/issues"
-"Release Notes" = "https://github.com/Shakargy/devtime/releases/tag/v0.1.3"
+"Release Notes" = "https://github.com/Shakargy/devtime/releases/tag/v0.3.0"
 Demo = "https://youtu.be/1Hiu3Y9J_SI"
 
 [project.scripts]

{devtime_ei-0.1.3 → devtime_ei-0.3.0}/src/devtime/__init__.py

@@ -1,6 +1,6 @@
 """DevTime - local-first Engineering Intelligence for repository memory."""
 
-__version__ = "0.1.3"
+__version__ = "0.3.0"
 
 # Version metadata (Builder Edition, Chapter 20).
 EVIDENCE_MODEL = "2026.06.1"

{devtime_ei-0.1.3 → devtime_ei-0.3.0}/src/devtime/cli.py

@@ -78,6 +78,119 @@ def demo_init(
     console.print('  dtc explain "Billing Webhooks"')
 
 
+@app.command()
+def verify(
+    claim: str = typer.Argument(None, help="Claim id to verify. Omit to verify all built-in claims."),
+    list_claims: bool = typer.Option(False, "--list", help="List built-in claims with last status and freshness."),
+    as_json: bool = typer.Option(False, "--json", help="Stable machine-readable output."),
+) -> None:
+    """Verify a repository claim against scanned evidence (v0.2 experimental)."""
+    import json as _json
+
+    from devtime.db import connection
+    from devtime.intelligence import verification as ver
+
+    if not paths.is_initialized():
+        console.print("[red]Not initialized.[/red] Run dtc init first.")
+        raise typer.Exit(code=2)
+
+    conn = connection.connect()
+    try:
+        if list_claims:
+            rows = []
+            for slug, definition in ver.BUILTIN_CLAIMS.items():
+                latest = ver.load_latest_verification(conn, slug)
+                freshness, changed = ver.freshness_for(conn, slug)
+                rows.append(
+                    {
+                        "claim_id": slug,
+                        "name": definition.name,
+                        "statement": definition.statement,
+                        "last_status": latest[0]["status"] if latest else None,
+                        "freshness": freshness,
+                        "changed_evidence": changed,
+                    }
+                )
+            if as_json:
+                console.print_json(_json.dumps({"schema_version": "1", "claims": rows}))
+            else:
+                console.print("[bold]Built-in claims[/bold]\n")
+                for r in rows:
+                    status_txt = r["last_status"] or "never verified"
+                    console.print(f"  {r['claim_id']}")
+                    console.print(f"    {r['statement']}")
+                    console.print(f"    last status: {status_txt}   freshness: {r['freshness']}")
+                    for p in r["changed_evidence"]:
+                        console.print(f"      changed since verification: {p}", markup=False)
+                    console.print("")
+            return
+
+        slugs = [claim] if claim else list(ver.BUILTIN_CLAIMS.keys())
+        results = []
+        for slug in slugs:
+            try:
+                result = ver.verify_claim(conn, slug)
+            except KeyError:
+                console.print(f"[red]Unknown claim:[/red] {slug}")
+                console.print("Run [bold]dtc verify --list[/bold] to see built-in claims.")
+                raise typer.Exit(code=1)
+            ver.save_verification(conn, result)
+            results.append(result)
+
+        if as_json:
+            console.print_json(
+                _json.dumps(
+                    {
+                        "schema_version": "1",
+                        "command": "verify",
+                        "results": [r.to_dict() for r in results],
+                    }
+                )
+            )
+            return
+
+        for result in results:
+            _print_verification(result)
+    finally:
+        conn.close()
+
+
+def _print_verification(result) -> None:
+    color = {
+        "SUPPORTED": "green",
+        "WEAK": "yellow",
+        "CONTRADICTED": "red",
+        "UNKNOWN": "cyan",
+    }.get(result.status, "white")
+    console.print(f"[bold]{result.claim_name}[/bold]")
+    console.print(f"Claim: {result.statement}")
+    console.print(f"Status: [{color}]{result.status}[/{color}]")
+    console.print("")
+    console.print("Why:")
+    for line in result.why:
+        console.print(f"  - {line}", markup=False)
+    if result.supporting:
+        console.print("\nSupporting evidence:")
+        for e in result.supporting[:6]:
+            loc = f":{e.start_line}" if e.start_line else ""
+            console.print(f"  - {e.path}{loc}  [{e.strength}]", markup=False)
+            console.print(f"      {e.observation}", markup=False)
+    if result.contradictions:
+        console.print("\n[red]Contradictions:[/red]")
+        for c in result.contradictions:
+            console.print(f"  - {c.summary}", markup=False)
+            console.print(f"      claimed:  {c.claimed_side}", markup=False)
+            console.print(f"      observed: {c.observed_side}", markup=False)
+    if result.missing:
+        console.print("\nMissing evidence:")
+        for m in result.missing:
+            console.print(f"  - {m}", markup=False)
+    console.print("\nLimitations:")
+    for lim in result.limitations:
+        console.print(f"  - {lim}", markup=False)
+    console.print("")
+
+
 @app.command()
 def status() -> None:
     """Show local storage, AI, cloud, telemetry, MCP, and scan status."""

{devtime_ei-0.1.3 → devtime_ei-0.3.0}/src/devtime/db/schema.sql

@@ -135,6 +135,21 @@ CREATE TABLE IF NOT EXISTS risk_findings (
     created_at TEXT NOT NULL
 );
 
+-- v0.2.0: immutable claim verification results (the verification slice).
+-- Databases created before v0.2.0 get this table lazily via
+-- verification.ensure_verifications_table (idempotent, no migration needed).
+CREATE TABLE IF NOT EXISTS verifications (
+    id TEXT PRIMARY KEY,
+    repository_id TEXT NOT NULL,
+    claim_slug TEXT NOT NULL,
+    status TEXT NOT NULL,
+    scan_id TEXT,
+    result_json TEXT NOT NULL,
+    evidence_fingerprints_json TEXT NOT NULL DEFAULT '[]',
+    engine_version TEXT NOT NULL,
+    created_at TEXT NOT NULL
+);
+
 CREATE TABLE IF NOT EXISTS context_packs (
     id TEXT PRIMARY KEY,
     concept_id TEXT NOT NULL,