forgexa-cli 1.78.2__tar.gz → 1.79.0__tar.gz

{forgexa_cli-1.78.2 → forgexa_cli-1.79.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.78.2
+Version: 1.79.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.78.2 → forgexa_cli-1.79.0}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.78.2"
+__version__ = "1.79.0"

{forgexa_cli-1.78.2 → forgexa_cli-1.79.0}/forgexa_cli/agent_core.py

@@ -67,6 +67,36 @@ except ImportError:
 logger = logging.getLogger("agent_core")
 
 
+def assess_approved_plan_conformance(baseline: dict, report: object) -> dict:
+    result = {
+        "status": "unverified", "baseline_fingerprint": baseline.get("fingerprint"),
+        "task_id": (baseline.get("task") or {}).get("id"), "evidence_refs": [],
+    }
+    expected = {key: value for key, value in baseline.items() if key != "fingerprint"}
+    fingerprint = hashlib.sha256(json.dumps(
+        expected, sort_keys=True, ensure_ascii=True, separators=(",", ":"),
+    ).encode()).hexdigest()
+    if baseline.get("version") != 1 or result["baseline_fingerprint"] != fingerprint:
+        result["reason"] = "approved_plan_baseline_invalid"
+        return result
+    if not isinstance(report, dict) or (
+        report.get("baseline_fingerprint") != fingerprint
+        or report.get("task_id") != result["task_id"]
+        or report.get("status") not in ("conformant", "deviation", "unverified")
+    ):
+        result["reason"] = "approved_plan_review_missing_or_mismatched"
+        return result
+    evidence = report.get("evidence")
+    if not isinstance(evidence, list) or not evidence or any(
+        not isinstance(item, str) or not item.strip() for item in evidence
+    ):
+        result["reason"] = "approved_plan_review_evidence_missing"
+        return result
+    result["status"] = report["status"]
+    result["evidence_refs"] = [hashlib.sha256(item.encode()).hexdigest() for item in evidence]
+    return result
+
+
 def is_implementation_testing_task(node_type: str, input_data: dict) -> bool:
     """Retain the testing responsibility of a phase-remediation wrapper."""
     fix_context = input_data.get("fix_context")

{forgexa_cli-1.78.2 → forgexa_cli-1.79.0}/forgexa_cli/daemon.py

@@ -1234,7 +1234,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.78.2"
+DAEMON_VERSION = "1.79.0"
 
 
 def _detect_client_type() -> str:
@@ -1732,6 +1732,36 @@ def _build_runtime_critic_prompt(
         "",
         f"Changed files ({len(changed_files)}):",
     ]
+    baseline = (task.input_data or {}).get("approved_plan_baseline")
+    if isinstance(baseline, dict):
+        parts.extend((
+            "", "## Frozen Approved Plan Baseline",
+            "Judge implementation against this approved baseline, not execution speculation. "
+            "Implementation details may refine it but cannot silently replace its responsibilities, "
+            "interfaces, required files or acceptance criteria. Report insufficient evidence honestly.",
+            json.dumps(baseline, ensure_ascii=True, sort_keys=True),
+            'Also return "plan_conformance":{"baseline_fingerprint":"<frozen fingerprint>",'
+            '"task_id":"<frozen task id>","status":"conformant|deviation|unverified",'
+            '"evidence":["concrete supplied source/test reference"]}. '
+            "Assess every assigned obligation, including behavior omitted from the diff. "
+            "Use deviation for an actual conflict or omission; use unverified when supplied evidence "
+            "cannot establish conformance. A high quality score never replaces this conclusion. "
+            "Do not infer missing changes or execution as passing, and do not approve a different plan.",
+            "Judge only this task's assigned contribution and required in-scope checks. Other tasks' "
+            "unfinished work and server-deferred live acceptance do not invalidate a complete implementation. "
+            "Missing assigned source or required test assets and actual failed checks remain blocking.",
+        ))
+        for key in ("deferred_acceptance_verification", "qa_test_level_policy_snapshot"):
+            if isinstance((task.input_data or {}).get(key), dict):
+                parts.extend((f"## Frozen {key}", json.dumps(task.input_data[key], ensure_ascii=True, sort_keys=True)))
+    else:
+        planned_context = {
+            key: (task.input_data or {}).get(key)
+            for key in ("task_instructions", "description", "items", "files", "acceptance_criteria")
+            if (task.input_data or {}).get(key)
+        }
+        if planned_context:
+            parts.extend(("", "## Planned Task Context", json.dumps(planned_context, ensure_ascii=True)))
     parts.extend(f"- {path}" for path in changed_files[:50])
     parts.extend(("", "## Code Diff", "```diff", diff, "```"))
     if test_summary:
@@ -9915,7 +9945,7 @@ class ServerConnection:
                 "acceptance_verification": {
                     "protocol_version": runtime_evidence.DEFERRED_ACCEPTANCE_VERIFICATION_PROTOCOL_VERSION,
                 },
-                "implementation_audit": {"protocol_version": 2},
+                "implementation_audit": {"protocol_version": 3},
                 "task_attachment_staging": {"protocol_version": 1, "runtime_proxy": True, "image_agents": ["claude"]},
             },
             "server_url": self.server_url,
@@ -10339,7 +10369,7 @@ class ServerConnection:
                     "acceptance_verification": {
                         "protocol_version": runtime_evidence.DEFERRED_ACCEPTANCE_VERIFICATION_PROTOCOL_VERSION,
                     },
-                    "implementation_audit": {"protocol_version": 2},
+                    "implementation_audit": {"protocol_version": 3},
                     "local_evidence": {"protocol_version": 1, "structured_summary": True},
                     "task_attachment_staging": {"protocol_version": 1, "runtime_proxy": True, "image_agents": ["claude"]},
                 },
@@ -13646,7 +13676,8 @@ class RuntimeDaemon:
             }
         metadata = {"agent_used": agent_id}
         is_local_bind = task.workspace_resolution == "local_bind"
-        if is_local_bind and not task.local_evidence_upload:
+        baseline = (task.input_data or {}).get("approved_plan_baseline")
+        if is_local_bind and not task.local_evidence_upload and not isinstance(baseline, dict):
             return {
                 "collection_status": "unavailable",
                 "failure_code": "runtime_critic_local_evidence_upload_disabled",
@@ -13658,16 +13689,49 @@ class RuntimeDaemon:
             for path in result.files_changed
             if isinstance(path, str) and path.strip()
         ]
-        if not changed_files:
+        if not changed_files and not isinstance(baseline, dict):
             return {"collection_status": "not_applicable"}
 
-        after_sha = str((result.git or {}).get("commit_sha") or "").strip()
+        after_sha = str((result.git or {}).get("commit_sha") or before_sha or "").strip()
         diff = await self._collect_runtime_critic_diff(
             workspace_path,
-            before_sha=before_sha,
+            before_sha=(baseline.get("source_base_sha") if isinstance(baseline, dict)
+                        and (baseline.get("task") or {}).get("type") == "review" else None) or before_sha,
             after_sha=after_sha,
             changed_files=changed_files,
         )
+        if isinstance(baseline, dict) and re.fullmatch(r"[0-9a-fA-F]{40}", after_sha):
+            planned = baseline.get("task") or {}
+            paths = agent_core.missing_planned_task_files({
+                "files": planned.get("files") or [], "items": planned.get("items") or [],
+            }, [])
+            for related in baseline.get("related_tasks") or []:
+                paths.extend(agent_core.missing_planned_task_files({
+                    "files": (related.get("input") or {}).get("files") or [],
+                    "items": related.get("items") or [],
+                }, []))
+            paths = list(dict.fromkeys(paths))
+            remaining = _RUNTIME_CRITIC_DIFF_MAX_CHARS - len(diff or "")
+            source_context = []
+            for path in paths[:20]:
+                normalized = Path(path)
+                if normalized.is_absolute() or ".." in normalized.parts or path.endswith("/") or remaining <= 0:
+                    continue
+                try:
+                    source = await self.workspace_manager._git(
+                        "show", f"{after_sha}:{path}", cwd=workspace_path, timeout=10,
+                    )
+                except Exception:
+                    continue
+                excerpt = source[:min(remaining, 16000)]
+                source_context.append(f"\n## Committed source {after_sha}:{path}\n{excerpt}")
+                if len(excerpt) < len(source):
+                    source_context.append("\nSource truncated; do not infer omitted obligations as conformant.")
+                remaining -= len(excerpt)
+                if path not in changed_files:
+                    changed_files.append(path)
+            if source_context:
+                diff = (diff or "No new changes; review committed delivery instead.") + "".join(source_context)
         if not diff:
             return {
                 "collection_status": "unavailable",
@@ -13748,6 +13812,20 @@ class RuntimeDaemon:
                     "agent_attempts": [attempt],
                     **metadata,
                 }
+            if not task.local_evidence_upload and isinstance(baseline, dict):
+                conformance = agent_core.assess_approved_plan_conformance(baseline, structured_result.get("plan_conformance"))
+                score = structured_result.get("score")
+                verdict = structured_result.get("verdict")
+                structured_result = {
+                    "score": score if type(score) in (int, float) and 0 <= score <= 1 else 0.5,
+                    "verdict": verdict if verdict in ("approve", "request_changes", "reject") else "request_changes",
+                    "summary": "Private local review; source and issue details remain local.", "issues": [],
+                    "plan_conformance": {
+                        "status": conformance["status"], "task_id": conformance["task_id"],
+                        "baseline_fingerprint": conformance["baseline_fingerprint"],
+                        "evidence": conformance["evidence_refs"],
+                    },
+                }
             encoded_result = json.dumps(
                 structured_result,
                 ensure_ascii=True,
@@ -13885,6 +13963,14 @@ class RuntimeDaemon:
             node_type = "testing"
         req_type = input_data.get("requirement_type", "feature")
         verification_work_item = bool(input_data.get("verification_work_item"))
+        if isinstance(input_data.get("approved_plan_baseline"), dict):
+            forbidden_paths = sorted(path for path in ProcessManager._normalize_repo_paths(result.files_changed)
+                                     if _is_requirement_analysis_path(path))
+            if forbidden_paths:
+                result.status = "failed"
+                result.failure_code = "approved_plan_baseline_modified"
+                result.error = "Implementation modified frozen analysis assets: " + ", ".join(forbidden_paths[:5])
+                issues.append(result.error)
 
         audit_contract = input_data.get("implementation_audit_contract")
         if isinstance(audit_contract, dict):
@@ -15873,7 +15959,7 @@ class RuntimeDaemon:
                 preserved_paths=preserved_paths,
             )
             issues = self._validate_outputs(workspace_path, task, result)
-            if result.failure_code == "implementation_plan_revision_required":
+            if result.failure_code in ("implementation_plan_revision_required", "approved_plan_baseline_modified"):
                 return result
             if require_source_inventory:
                 issues.extend(inventory_issues)
@@ -16002,7 +16088,7 @@ class RuntimeDaemon:
             preserved_paths=preserved_paths,
         )
         remaining = self._validate_outputs(workspace_path, task, result)
-        if result.failure_code == "implementation_plan_revision_required":
+        if result.failure_code in ("implementation_plan_revision_required", "approved_plan_baseline_modified"):
             return result
         if require_source_inventory:
             remaining.extend(inventory_issues)

{forgexa_cli-1.78.2 → forgexa_cli-1.79.0}/forgexa_cli/observability_evidence.py

@@ -6,6 +6,7 @@ from importlib import import_module
 
 EVIDENCE_PROTOCOL_VERSION = 1
 PAYLOAD_MAX_BYTES = 32 * 1024
+METADATA_MAX_BYTES = 128 * 1024
 TURN_MAX_BYTES = 64 * 1024
 ORIGIN_FIELDS = frozenset({"issuer", "workspace_id", "project_id", "user_id"})
 
@@ -72,7 +73,11 @@ def validate_payload(
         raise EvidenceError("observability_evidence_integrity_failed")
     _reference, metadata_model, payload_model, canonical, loads = _contract()
     try:
-        current = metadata_model.model_validate_json(canonical(metadata), strict=True)
+        metadata_bytes = (
+            metadata.encode("utf-8") if isinstance(metadata, str) else canonical(metadata)
+        )
+        metadata_value = loads(metadata_bytes, max_bytes=METADATA_MAX_BYTES)
+        current = metadata_model.model_validate_json(canonical(metadata_value), strict=True)
         parsed = loads(encoded)
         body = payload_model.model_validate_json(canonical(parsed), strict=True)
         if canonical(body.model_dump(mode="json")) != encoded:

{forgexa_cli-1.78.2 → forgexa_cli-1.79.0}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.78.2
+Version: 1.79.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.78.2 → forgexa_cli-1.79.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.78.2"
+version = "1.79.0"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"