drydock-cli 3.1.5__tar.gz → 3.1.7__tar.gz

{drydock_cli-3.1.5/drydock_cli.egg-info → drydock_cli-3.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.1.5
+Version: 3.1.7
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -112,6 +112,10 @@ A full agentic CLI harness — every tool below is clean-room and dependency-fre
 - **Cross-platform** — runs natively on Linux, macOS, and **Windows via PowerShell/cmd**
   (no WSL or Git-Bash required); `/shell` shows which shell your commands run in.
 - **Loops** — `/loop <count> <prompt>` runs a prompt iteratively (Esc stops).
+- **Ratchet** — `/ratchet <goal>` keeps solving across rounds, snapshotting the
+  workspace whenever more tests pass and rolling back regressions, until it goes
+  green. The verifier auto-detects (pytest/cargo/go/npm/make); `--verify "<cmd>"`
+  overrides. Progress can't slip backward.
 
 ## Slash commands
 
@@ -129,6 +133,7 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/skills new <name> <prompt>` | Create a reusable `/<name>` skill (use `$ARGS` for input) |
 | `/<name>` | Run a skill |
 | `/loop <count> <prompt>` | Repeat a prompt N times (Esc stops) |
+| `/ratchet <goal>` | Solve across rounds, snapshotting on verifier gains, rolling back regressions. Verifier auto-detects; override with `--verify "<cmd>"` (`--rounds N`, `--fitness auto\|exitcode\|<regex>`) |
 | `/mcp` | List connected MCP servers + their tools |
 | `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
 | `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
@@ -267,6 +272,22 @@ exports the open findings to a deterministic **eMASS POA&M CSV** — Control (fr
 the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
 Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
+### FIAR audit-readiness (DoD financial-statement audit)
+
+Model a Financial Improvement and Audit Readiness engagement — a seeded key-control
+matrix per business cycle (FBWT, P2P, PP&E, INV, CIVPAY, REIM, FR, ITGC), the five FS
+assertions, a deterministic **evidence-chain validator** (a control can't be called
+effective on an incomplete population→sample→…→GL→assertion trace), findings (NFRs), and
+CAPs. `python -m drydock.fiar new|controls|control|assess|reconcile|package`; skills
+`/fiar-assess /fiar-evidence /fiar-readiness /fiar-cap`.
+
+**KSD evidence packaging.** `fiar package <engagement> <out> --evidence-dir <dir>` assembles
+an audit binder — `index.md` + `index.json` mapping every control → assertions → KSDs →
+status → evidence-chain completeness → findings — and **collects the actual evidence files
+each test cited**, zipped. Add `--redact "<term>"` (repeatable) to **red-box** names/secrets
+in the evidence *and* the manifest for a releasable version (verified via the Document
+Canvas); the original engagement is never touched. Also exposed as the `FiarPackage` tool.
+
 ### Document Canvas — editing documents far larger than the context window
 
 Edit a 300-, 800-, 1000-page document the way you edit a large codebase: **search,
@@ -351,6 +372,54 @@ docker run -it --add-host=host.docker.internal:host-gateway \
 `-v "$PWD:/work"` mounts your project so the agent can read/edit it. Tags:
 `fbobe3/drydock:latest` and `fbobe3/drydock:<version>` (e.g. `:3.0.135`).
 
+### Serving Gemma-4-31B
+
+Drydock is provider-agnostic, but its primary target is dense **Gemma-4-31B**.
+Two proven ways to serve it on a 2×GPU box, both exposing an OpenAI-compatible
+API on `:8000` as model `gemma4`:
+
+**llama.cpp** — QAT GGUF, flexible concurrency (more slots if you need them):
+
+```
+llama-server -m gemma-4-31B-it-qat-UD-Q4_K_XL.gguf \
+  -c 65536 -np 2 --host 0.0.0.0 --port 8000 --alias gemma4
+```
+
+**vLLM** — w4a16 QAT, ~2× faster per request, 128K context:
+
+```
+docker run -d --name vllm-prod --gpus all --ipc=host --restart unless-stopped \
+  -v /data3/Models:/models -p 8000:8000 \
+  -e NCCL_P2P_DISABLE=1 \
+  vllm/vllm-openai:v0.26.0 \
+  --model /models/gemma-4-31B-it-qat-w4a16-ct \
+  --served-model-name gemma4 \
+  --tensor-parallel-size 2 \
+  --max-model-len 131072 \
+  --max-num-seqs 2 \
+  --gpu-memory-utilization 0.97 \
+  --kv-cache-dtype fp8 \
+  --tool-call-parser gemma4 \
+  --enable-auto-tool-choice
+```
+
+Point drydock at either with
+`--provider vllm --base-url http://<host>:8000/v1 --model gemma4`.
+
+**vLLM-on-Gemma-4 notes** (drydock handles these for you as of **3.1.7**):
+
+- **`skip_special_tokens: false`** is sent on every request — without it, a turn
+  truncated at `max_tokens` (tool-call / reasoning tails) comes back with *empty*
+  content, which looks like a refusal. If `finish_reason == "length"`, retry with
+  a larger `max_tokens` (≥ 2000 for reasoning-heavy calls).
+- **Reasoning is off by default.** Enable per-request via
+  `chat_template_kwargs.enable_thinking`; the vLLM reasoning parser is disabled,
+  so `<|channel>thought …` markers arrive inside `content` (stripped client-side).
+- **`--max-num-seqs 2`** caps concurrency at 2 — the cost of fitting 128K context
+  into the VRAM. Use llama.cpp if you need more concurrent sessions than context.
+- Tool-calling is the standard OpenAI format; `/props` is llama.cpp-only (vLLM
+  404s it — drydock falls back to `/v1/models` for the context length).
+
 ## Using it
 
 Type a task and press **Enter**. Drydock reads/writes/edits files and runs

{drydock_cli-3.1.5 → drydock_cli-3.1.7}/README.md

@@ -88,6 +88,10 @@ A full agentic CLI harness — every tool below is clean-room and dependency-fre
 - **Cross-platform** — runs natively on Linux, macOS, and **Windows via PowerShell/cmd**
   (no WSL or Git-Bash required); `/shell` shows which shell your commands run in.
 - **Loops** — `/loop <count> <prompt>` runs a prompt iteratively (Esc stops).
+- **Ratchet** — `/ratchet <goal>` keeps solving across rounds, snapshotting the
+  workspace whenever more tests pass and rolling back regressions, until it goes
+  green. The verifier auto-detects (pytest/cargo/go/npm/make); `--verify "<cmd>"`
+  overrides. Progress can't slip backward.
 
 ## Slash commands
 
@@ -105,6 +109,7 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/skills new <name> <prompt>` | Create a reusable `/<name>` skill (use `$ARGS` for input) |
 | `/<name>` | Run a skill |
 | `/loop <count> <prompt>` | Repeat a prompt N times (Esc stops) |
+| `/ratchet <goal>` | Solve across rounds, snapshotting on verifier gains, rolling back regressions. Verifier auto-detects; override with `--verify "<cmd>"` (`--rounds N`, `--fitness auto\|exitcode\|<regex>`) |
 | `/mcp` | List connected MCP servers + their tools |
 | `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
 | `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
@@ -243,6 +248,22 @@ exports the open findings to a deterministic **eMASS POA&M CSV** — Control (fr
 the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
 Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
+### FIAR audit-readiness (DoD financial-statement audit)
+
+Model a Financial Improvement and Audit Readiness engagement — a seeded key-control
+matrix per business cycle (FBWT, P2P, PP&E, INV, CIVPAY, REIM, FR, ITGC), the five FS
+assertions, a deterministic **evidence-chain validator** (a control can't be called
+effective on an incomplete population→sample→…→GL→assertion trace), findings (NFRs), and
+CAPs. `python -m drydock.fiar new|controls|control|assess|reconcile|package`; skills
+`/fiar-assess /fiar-evidence /fiar-readiness /fiar-cap`.
+
+**KSD evidence packaging.** `fiar package <engagement> <out> --evidence-dir <dir>` assembles
+an audit binder — `index.md` + `index.json` mapping every control → assertions → KSDs →
+status → evidence-chain completeness → findings — and **collects the actual evidence files
+each test cited**, zipped. Add `--redact "<term>"` (repeatable) to **red-box** names/secrets
+in the evidence *and* the manifest for a releasable version (verified via the Document
+Canvas); the original engagement is never touched. Also exposed as the `FiarPackage` tool.
+
 ### Document Canvas — editing documents far larger than the context window
 
 Edit a 300-, 800-, 1000-page document the way you edit a large codebase: **search,
@@ -327,6 +348,54 @@ docker run -it --add-host=host.docker.internal:host-gateway \
 `-v "$PWD:/work"` mounts your project so the agent can read/edit it. Tags:
 `fbobe3/drydock:latest` and `fbobe3/drydock:<version>` (e.g. `:3.0.135`).
 
+### Serving Gemma-4-31B
+
+Drydock is provider-agnostic, but its primary target is dense **Gemma-4-31B**.
+Two proven ways to serve it on a 2×GPU box, both exposing an OpenAI-compatible
+API on `:8000` as model `gemma4`:
+
+**llama.cpp** — QAT GGUF, flexible concurrency (more slots if you need them):
+
+```
+llama-server -m gemma-4-31B-it-qat-UD-Q4_K_XL.gguf \
+  -c 65536 -np 2 --host 0.0.0.0 --port 8000 --alias gemma4
+```
+
+**vLLM** — w4a16 QAT, ~2× faster per request, 128K context:
+
+```
+docker run -d --name vllm-prod --gpus all --ipc=host --restart unless-stopped \
+  -v /data3/Models:/models -p 8000:8000 \
+  -e NCCL_P2P_DISABLE=1 \
+  vllm/vllm-openai:v0.26.0 \
+  --model /models/gemma-4-31B-it-qat-w4a16-ct \
+  --served-model-name gemma4 \
+  --tensor-parallel-size 2 \
+  --max-model-len 131072 \
+  --max-num-seqs 2 \
+  --gpu-memory-utilization 0.97 \
+  --kv-cache-dtype fp8 \
+  --tool-call-parser gemma4 \
+  --enable-auto-tool-choice
+```
+
+Point drydock at either with
+`--provider vllm --base-url http://<host>:8000/v1 --model gemma4`.
+
+**vLLM-on-Gemma-4 notes** (drydock handles these for you as of **3.1.7**):
+
+- **`skip_special_tokens: false`** is sent on every request — without it, a turn
+  truncated at `max_tokens` (tool-call / reasoning tails) comes back with *empty*
+  content, which looks like a refusal. If `finish_reason == "length"`, retry with
+  a larger `max_tokens` (≥ 2000 for reasoning-heavy calls).
+- **Reasoning is off by default.** Enable per-request via
+  `chat_template_kwargs.enable_thinking`; the vLLM reasoning parser is disabled,
+  so `<|channel>thought …` markers arrive inside `content` (stripped client-side).
+- **`--max-num-seqs 2`** caps concurrency at 2 — the cost of fitting 128K context
+  into the VRAM. Use llama.cpp if you need more concurrent sessions than context.
+- Tool-calling is the standard OpenAI format; `/props` is llama.cpp-only (vLLM
+  404s it — drydock falls back to `/v1/models` for the context length).
+
 ## Using it
 
 Type a task and press **Enter**. Drydock reads/writes/edits files and runs

{drydock_cli-3.1.5 → drydock_cli-3.1.7}/drydock/fiar.py

@@ -20,6 +20,9 @@ not render an audit judgement.
 from __future__ import annotations
 
 import json
+import re
+import shutil
+import zipfile
 from dataclasses import dataclass, field, asdict
 from datetime import date
 from pathlib import Path
@@ -466,6 +469,139 @@ def new_engagement(name: str, cycle: str, wave: int | None = None) -> Engagement
     })
 
 
+# ── KSD evidence package (audit binder) ────────────────────────────────────
+# Assemble the Key Supporting Documents behind an engagement into a reviewable
+# package: a manifest (control → assertion → KSDs → status → evidence chain →
+# findings) plus the actual evidence files, zipped. Optionally red-box text
+# evidence for a releasable version. Deterministic, stdlib only.
+_FILENAME_RE = re.compile(r"[\w][\w./-]*\.[A-Za-z0-9]{1,6}")
+
+
+def _referenced_files(control: dict, evidence_dir: Path | None) -> list[str]:
+    """Filenames named in the control's evidence / chain text that actually exist
+    in evidence_dir (so the binder collects the KSDs the test cited)."""
+    if not evidence_dir or not evidence_dir.is_dir():
+        return []
+    avail = {p.name: p for p in evidence_dir.iterdir() if p.is_file()}
+    text = " ".join([str(control.get("evidence", "")),
+                     *[str(v) for v in (control.get("evidence_chain") or {}).values()]])
+    found: list[str] = []
+    for m in _FILENAME_RE.findall(text):
+        name = Path(m).name
+        if name in avail and name not in found:
+            found.append(name)
+    return found
+
+
+def build_ksd_package(engagement_path: str | Path, out_dir: str | Path, *,
+                      evidence_dir: str | Path | None = None, cycle: str | None = None,
+                      status: str | None = None, redact: list[str] | None = None) -> dict:
+    """Build a KSD evidence package from an engagement. Collects the cited evidence
+    files (from evidence_dir), writes index.json + index.md, optionally red-boxes
+    text evidence, and zips the binder. Returns a summary dict."""
+    eng = Engagement.load(engagement_path)
+    out = Path(out_dir)
+    (out / "evidence").mkdir(parents=True, exist_ok=True)
+    ev_dir = Path(evidence_dir) if evidence_dir else None
+    redact_terms = [t for t in (redact or []) if t.strip()]
+
+    findings_by_control: dict[str, list] = {}
+    for f in eng._d.get("findings", []):
+        findings_by_control.setdefault(f.get("control_id", ""), []).append(f)
+
+    controls = list(eng._d.get("controls", []))
+    if cycle:
+        controls = [c for c in controls if str(c.get("cycle", "")).upper() == cycle.upper()]
+    if status:
+        controls = [c for c in controls if c.get("status") == status]
+
+    entries = []
+    collected = 0
+    redactions = []
+    for c in controls:
+        cid = c["id"]
+        copied = []
+        for name in _referenced_files(c, ev_dir):
+            dest = out / "evidence" / cid
+            dest.mkdir(parents=True, exist_ok=True)
+            dst = dest / name
+            shutil.copy(ev_dir / name, dst)  # type: ignore[arg-type]
+            if redact_terms and dst.suffix.lower() in (".txt", ".md", ".markdown"):
+                from drydock import doccanvas as dc
+                fmt = "text" if dst.suffix.lower() == ".txt" else "markdown"
+                doc = dc.parse(dst.read_text("utf-8", "replace"), fmt, str(dst))
+                n = 0
+                for term in redact_terms:
+                    try:
+                        n += dc.redact(doc, query=term)["redacted"]
+                    except dc.PatchError:
+                        pass
+                if n:
+                    dst.write_text(dc.render(doc), "utf-8")
+                    redactions.append({"file": f"{cid}/{name}", "redacted": n})
+            copied.append(name)
+            collected += 1
+        entries.append({
+            "id": cid, "cycle": c.get("cycle"), "objective": c.get("objective"),
+            "assertions": c.get("assertions"), "status": c.get("status", "not_tested"),
+            "ksds": c.get("ksds", []), "evidence": c.get("evidence", ""),
+            "evidence_chain": validate_chain(c.get("evidence_chain")),
+            "evidence_files": copied,
+            "findings": [{"id": f.get("id"), "severity": f.get("severity"),
+                          "condition": f.get("condition")} for f in findings_by_control.get(cid, [])],
+        })
+
+    # For a releasable package, scrub the redaction terms from the MANIFEST too
+    # (not just the collected files) so a name/secret can't leak via the binder.
+    if redact_terms:
+        marker = "[REDACTED]"
+        for e in entries:
+            for term in redact_terms:
+                e["evidence"] = e["evidence"].replace(term, marker)
+                for f in e["findings"]:
+                    f["condition"] = (f.get("condition") or "").replace(term, marker)
+
+    manifest = {
+        "engagement": eng.name, "assessable_unit": eng.cycle, "wave": eng.wave,
+        "generated": date.today().isoformat(), "source": Path(engagement_path).name,
+        "control_count": len(entries), "evidence_files_collected": collected,
+        "redactions": redactions, "controls": entries,
+    }
+    (out / "index.json").write_text(json.dumps(manifest, indent=2), encoding="utf-8")
+    (out / "index.md").write_text(_ksd_index_md(manifest), encoding="utf-8")
+
+    zip_path = str(out) + ".zip"
+    with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_DEFLATED) as z:
+        for p in sorted(out.rglob("*")):
+            if p.is_file():
+                z.write(p, p.relative_to(out.parent))
+    return {"package": str(out), "zip": zip_path, "controls": len(entries),
+            "files_collected": collected, "redactions": len(redactions),
+            "missing_evidence": [e["id"] for e in entries if not e["evidence_files"]]}
+
+
+def _ksd_index_md(m: dict) -> str:
+    lines = [f"# KSD Evidence Package — {m['engagement']}",
+             f"Assessable unit: {m['assessable_unit']} · Wave {m['wave']} · "
+             f"generated {m['generated']} from {m['source']}",
+             f"Controls: {m['control_count']} · evidence files collected: "
+             f"{m['evidence_files_collected']} · redactions: {len(m['redactions'])}", ""]
+    for e in m["controls"]:
+        lines.append(f"## {e['id']} — {e['objective']}")
+        lines.append(f"- Cycle: {e['cycle']}  ·  Assertions: {', '.join(e['assertions'] or [])}"
+                     f"  ·  Status: **{e['status']}**")
+        lines.append(f"- KSDs required: {', '.join(e['ksds']) or '(none listed)'}")
+        ch = e["evidence_chain"]
+        lines.append(f"- Evidence chain: {'COMPLETE' if ch['complete'] else 'INCOMPLETE — missing ' + ', '.join(ch['missing'])}")
+        if e["evidence"]:
+            lines.append(f"- Evidence examined: {e['evidence']}")
+        lines.append(f"- Evidence files: {', '.join('evidence/'+e['id']+'/'+f for f in e['evidence_files']) or '⚠ NONE collected'}")
+        for f in e["findings"]:
+            lines.append(f"- FINDING {f['id']} ({f['severity']}): {f['condition']}")
+        lines.append("")
+    return "\n".join(lines)
+
+
 # ── CLI ───────────────────────────────────────────────────────────────────
 def _main(argv: list[str]) -> int:
     import argparse
@@ -482,6 +618,9 @@ def _main(argv: list[str]) -> int:
     q = sub.add_parser("reconcile"); q.add_argument("entity", type=float)
     q.add_argument("source", type=float); q.add_argument("--tolerance", type=float, default=0.0)
     q = sub.add_parser("cycles")
+    q = sub.add_parser("package"); q.add_argument("path"); q.add_argument("out")
+    q.add_argument("--evidence-dir"); q.add_argument("--cycle"); q.add_argument("--status")
+    q.add_argument("--redact", action="append", default=[])
     a = p.parse_args(argv)
 
     if a.cmd == "cycles":
@@ -491,6 +630,15 @@ def _main(argv: list[str]) -> int:
     if a.cmd == "reconcile":
         r = reconcile(a.entity, a.source, tolerance=a.tolerance)
         print(json.dumps(r, indent=2)); return 0 if r["reconciled"] else 1
+    if a.cmd == "package":
+        r = build_ksd_package(a.path, a.out, evidence_dir=a.evidence_dir,
+                              cycle=a.cycle, status=a.status, redact=a.redact)
+        print(f"KSD package: {r['controls']} controls, {r['files_collected']} evidence file(s)"
+              + (f", {r['redactions']} file(s) redacted" if r["redactions"] else "")
+              + f" → {r['package']}/  (+ {Path(r['zip']).name})")
+        if r["missing_evidence"]:
+            print(f"⚠ no evidence file collected for: {', '.join(r['missing_evidence'])}")
+        return 0
     if a.cmd == "new":
         eng = new_engagement(a.name, a.cycle, wave=a.wave); eng.save(a.path)
         print(f"created {a.path}: {eng.name} / {eng.cycle} (Wave {eng.wave}) "

{drydock_cli-3.1.5 → drydock_cli-3.1.7}/drydock/providers.py

@@ -584,6 +584,17 @@ def stream(
     if config.get("temperature") is not None:
         kwargs["temperature"] = config["temperature"]
 
+    # vLLM-Gemma quirk: a turn truncated at max_tokens (esp. tool-call / reasoning
+    # turns, whose tail is special tokens) comes back with EMPTY content unless we
+    # send skip_special_tokens=false — and a checker-scored harness reads an empty
+    # turn as a FAILURE. Always send it for vLLM (harmless / ignored on llama.cpp),
+    # and floor an already-configured-but-tiny budget so reasoning turns don't
+    # truncate to nothing. We never impose a cap where none was set.
+    if provider == "vllm":
+        kwargs.setdefault("extra_body", {})["skip_special_tokens"] = False
+        if kwargs.get("max_tokens") and kwargs["max_tokens"] < 2000:
+            kwargs["max_tokens"] = 2000
+
     # Adaptive reasoning budget (harmony/gpt-oss style models accept this;
     # endpoints without the knob ignore the extra field). Set per turn by the
     # agent loop: high for planning, low for routine continuation.