genesis-cli 0.1.0__py3-none-any.whl

genesis_cli/README.md

@@ -0,0 +1,172 @@
+# genesis-cli — the Genesis Agent Workbench CLI
+
+Make any repository agent-ready, and keep AI-generated changes governed.
+
+## Install
+
+```bash
+pip install genesis-cli       # or: uv tool install genesis-cli
+genesis --version
+```
+
+Python 3.12+. `genesis-gates` (the engine) comes along as a dependency; there is
+nothing else to install and no API key to configure.
+
+> **Status:** PyPI publication happens at the first tagged release (`v0.1.0`),
+> driven by `.github/workflows/release.yml` in the
+> [genesis-framework](https://github.com/Inceptium-ai/genesis-framework)
+> repository. Until that tag lands, install from source:
+
+```bash
+# from a clone of the monorepo / framework repo
+uv sync && uv run genesis adopt .
+# or, without cloning:
+pip install "git+https://github.com/Inceptium-ai/genesis-framework#subdirectory=packages/genesis-cli"
+```
+
+## Commands
+
+```bash
+genesis --version             # installed version
+genesis adopt [path]          # audit a repo: score, gaps, AGENTS.md draft
+genesis adopt . --write       # also install AGENTS.md into the repo root
+genesis adopt . --review      # add the AI second-reader (see below)
+genesis adopt . --min-score 70   # CI mode: exit 1 below the threshold
+genesis adopt . --json        # machine-readable report on stdout
+genesis adopt . --baseline prev/report.json --fail-on-regression
+                              # CI mode: diff against a previous report,
+                              # exit 1 on regression (see below)
+genesis gates [path]          # run just the delivery gates, per-gate table
+genesis init [path]           # scaffold a new/bare repo agent-ready (see below)
+```
+
+## What `adopt` does
+
+Deterministic, zero API keys, zero infrastructure:
+
+1. **Delivery gates** — secret-scan, dependency-scan, unit-tests (in an isolated
+   venv with the app's own requirements), SAST, SBOM. Gates skip cleanly when a
+   scanner isn't installed.
+2. **System completeness** — detects systems (auth, payments, file uploads)
+   and checks their *mandatory flows* against the implementation surface
+   (routes, files), not prose. This catches the classic AI-agent failure:
+   an app that ships signup with no sign-in — or Stripe checkout with no
+   webhook signature verification, uploads with no size limit.
+3. **Env reconciliation** — the compose `${VAR}` contract and direct env reads,
+   diffed for unset/undocumented variables.
+4. **Structure** — tests, CI, lockfiles, `.env.example`, agent instructions.
+
+Output: a 0–100 **readiness score** with grade, `report.html` (shareable),
+`report.json` (machine-readable), `report.sarif` (SARIF 2.1.0 — feed it to
+GitHub code scanning or any SARIF viewer), and an `AGENTS.md` draft that turns
+the findings into instructions for AI coding agents.
+
+## Baseline comparison (`--baseline`, `--fail-on-regression`)
+
+Point `--baseline` at a previous run's `report.json` and `adopt` diffs the two
+reports: score delta, grade change, new/resolved gate findings (identity:
+gate + title + location) and new/resolved mandatory-flow gaps (identity:
+profile + flow). The diff prints as a **CHANGES SINCE BASELINE** section and is
+embedded in `report.json` as `baseline_comparison`.
+
+```
+CHANGES SINCE BASELINE
+  score ▲ +9.2   grade F→D
+  findings: 0 new, 0 resolved   ·   gaps: 0 new, 1 resolved
+  − closed gap: Implement returning-user sign-in (login)
+```
+
+`--fail-on-regression` (requires `--baseline`) exits 1 when the run
+**regressed**: the score dropped by more than 0.5 points, a new mandatory-flow
+gap appeared, or a new critical/high finding appeared. It composes with
+`--min-score` — either condition fails the run; when both flags pass, the exit
+code is 0 regardless of grade.
+
+### Score history (`history.jsonl`)
+
+Every `adopt` run appends one line to `<out-dir>/history.jsonl` —
+`{generated_at, score, grade, findings_count, gaps_count}` — append-only, never
+rewritten. With two or more runs the terminal report ends with a trend line:
+
+```
+history: 44.8 → 49.0 → 75.5 (3 runs)
+```
+
+## `genesis gates` — just the delivery gates
+
+`genesis gates [path]` runs the same deterministic gate set as `adopt`
+(secret-scan, unit-tests, dependency-scan, sast, sbom) *without* the full
+analysis — a fast check for "did my fix turn secret-scan green?". It prints a
+per-gate table (name, status, summary) plus the top 5 findings — with location
+and remediation — for each failed gate. Exit code: `0` when every selected
+gate passed or skipped, `1` otherwise.
+
+- `--gate NAME` (repeatable) limits the run to specific gates; names are
+  validated against the gate registry, and a typo lists the valid names.
+- `--json` prints the full evidence package instead of the table.
+
+## `genesis init` — start agent-ready
+
+For a new or bare repository, `genesis init [path]` scaffolds the files agents
+need on day one: `AGENTS.md` (from a fresh audit of whatever exists — on an
+empty directory its first task is "establish a test command"), `.gitignore`
+(covers `.env*` and `.genesis-report/`), a `.env.example` stub, a
+`.github/workflows/genesis-audit.yml` self-audit workflow, and a commented
+`.genesis/config.yaml` gate config. It is idempotent and **never overwrites**
+— existing files are reported as "exists, skipped".
+
+## The AI second-reader (`--review`)
+
+Optional pass that runs through the local `claude` CLI using your existing
+Claude subscription login — still **no API key**. It is **additive-only**: it
+may add findings, annotate (including flagging likely false positives),
+prioritize, and write the executive summary. It can never remove or downgrade a
+deterministic finding, and it never changes the score. If the CLI is missing or
+the call fails, the audit completes without it.
+
+## CI usage
+
+```yaml
+# .github/workflows/genesis-audit.yml
+name: genesis-audit
+on:
+  pull_request:
+  push: {branches: [main]}   # keeps the baseline cache fresh
+permissions:
+  contents: read
+  security-events: write   # for the SARIF upload
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+      - run: uv sync
+      # Restore the last report so PRs are gated on regressions, not just the
+      # absolute score. The cache is (re)saved after every run on main.
+      - uses: actions/cache@v4
+        with:
+          path: .genesis-baseline/
+          key: genesis-baseline-${{ github.sha }}
+          restore-keys: genesis-baseline-
+      - run: |
+          if [ -f .genesis-baseline/report.json ]; then
+            uv run genesis adopt . --min-score 70 \
+              --baseline .genesis-baseline/report.json --fail-on-regression
+          else
+            uv run genesis adopt . --min-score 70
+          fi
+      - run: mkdir -p .genesis-baseline &&
+             cp .genesis-report/report.json .genesis-baseline/report.json
+        if: github.ref == 'refs/heads/main'
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with: {name: genesis-report, path: .genesis-report/}
+      # Findings land in the GitHub Security tab + inline PR annotations.
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with: {sarif_file: .genesis-report/report.sarif}
+```
+
+Exit codes: `0` pass, `1` below threshold / regressed (or grade D/F when
+neither `--min-score` nor `--fail-on-regression` is given), `2` usage error.

genesis_cli/adopt.py

@@ -0,0 +1,75 @@
+"""`genesis adopt` — audit any repo for agent-readiness. Deterministic, no LLM.
+
+Pipeline: gates (secrets/deps/tests/sast/sbom, skipping cleanly when tools are
+absent) + system-completeness + env reconciliation + structure facts → a scored
+readiness report and an AGENTS.md draft.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from datetime import UTC, datetime
+from pathlib import Path
+
+# Importing these registers gates/providers via side effects.
+import genesis_gates.gates  # noqa: F401
+import genesis_gates.providers  # noqa: F401
+from genesis_gates import GateContext, GateRunner, get_gate, load_gate_config
+from genesis_gates.analysis import (
+    analyze,
+    reconcile,
+    repo_input,
+    score_readiness,
+    structure_facts,
+)
+
+# Deterministic gate set. risk-classify is excluded on purpose: it consults an
+# LLM; `adopt` must run with zero keys and zero infrastructure.
+ADOPT_GATES = ("secret-scan", "unit-tests", "dependency-scan", "sast", "sbom")
+
+
+def run_gates(repo: Path, gate_names: Sequence[str] = ADOPT_GATES) -> dict:
+    """Run the named gates over ``repo`` and return the EvidencePackage dict.
+
+    Shared by ``genesis adopt`` (which folds ``gate_results`` into the full
+    readiness report) and ``genesis gates`` (which presents the package as-is).
+    """
+    gates = [get_gate(name)() for name in gate_names]
+    manifest = {
+        "apiVersion": "genesis.dev/v0",
+        "kind": "DeliveryManifest",
+        "change": {"id": "ADOPT-0001-001", "title": f"Agent-readiness audit of {repo.name}",
+                   "source": "adopted"},
+        "service": {"name": repo.name, "owner": "genesis-adopt",
+                    "criticality": "medium", "data_classification": "internal"},
+        "validation": {"required": [], "coverage_threshold": 0},
+        "release": {"risk_level": "medium", "strategy": "direct",
+                    "rollback_required": False},
+    }
+    ctx = GateContext(repo_path=str(repo), manifest=manifest,
+                      config=load_gate_config(repo))
+    return GateRunner(gates).run(ctx).to_dict()
+
+
+def run_audit(repo: Path) -> dict:
+    """Full audit. Returns the report dict (also consumed by the renderers)."""
+    repo = repo.resolve()
+    gate_results = run_gates(repo).get("gate_results", [])
+    completeness = analyze(repo_input(repo))
+    reconciliation = reconcile(repo, stored_deps={})
+    facts = structure_facts(repo)
+    readiness = score_readiness(
+        gate_results=gate_results, facts=facts,
+        completeness=completeness, reconciliation=reconciliation,
+    )
+    return {
+        "kind": "GenesisReadinessReport",
+        "version": 1,
+        "repo": str(repo),
+        "generated_at": datetime.now(UTC).isoformat(timespec="seconds"),
+        "readiness": readiness,
+        "gates": gate_results,
+        "completeness": completeness,
+        "env": reconciliation,
+        "structure": facts,
+    }

genesis_cli/agents_md.py

@@ -0,0 +1,76 @@
+"""AGENTS.md generator — agent instructions derived from the audit."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def render_agents_md(report: dict) -> str:
+    repo = Path(report["repo"])
+    facts = report["structure"]
+    cmds: dict[str, str] = facts.get("commands", {})
+    gaps = report["completeness"].get("gaps", [])
+    env_missing = [d["env_var"] for d in report["env"].get("missing_required", [])]
+
+    lines: list[str] = [
+        f"# AGENTS.md — {repo.name}",
+        "",
+        "_Generated by `genesis adopt`. Instructions for AI coding agents "
+        "(Claude Code, Cursor, etc.) working in this repository._",
+        "",
+        "## Commands",
+        "",
+    ]
+    if cmds:
+        lines += [f"- **{label}**: `{cmd}`" for label, cmd in sorted(cmds.items())]
+        lines += ["", "Run the test command after every change. Do not commit "
+                  "with failing tests."]
+    else:
+        lines += ["- No build/test commands were detected. FIRST TASK for any "
+                  "agent: establish a test command and record it here."]
+    lines += [
+        "",
+        "## Ground rules",
+        "",
+        "- Work in small, reviewable changes; one concern per branch/PR.",
+        "- Never hardcode secrets, API keys, ports, or model IDs — read them "
+        "from environment variables and document new ones in `.env.example`.",
+        "- Match the existing code style, structure, and naming of the "
+        "surrounding module.",
+        "- Fail closed: unknown states and validation errors must surface, "
+        "never be swallowed.",
+    ]
+    if env_missing:
+        lines += [
+            "",
+            "## Environment contract (currently incomplete)",
+            "",
+            "These variables are referenced with no default and no documented "
+            "value — supply them before deploying, and keep `.env.example` "
+            "current:",
+            "",
+        ]
+        lines += [f"- `{v}`" for v in env_missing]
+    if gaps:
+        lines += [
+            "",
+            "## Known completeness gaps (from the readiness audit)",
+            "",
+            "Mandatory system flows that appear to be missing. Treat these as "
+            "high-priority tasks:",
+            "",
+        ]
+        for g in gaps:
+            lines += [f"- **{g['title']}** ({g['profile']}:{g['flow']})"]
+    lines += [
+        "",
+        "## Validation",
+        "",
+        "Every change should pass the Genesis gates before merge:",
+        "",
+        "```bash",
+        "genesis adopt . --json  # re-run the audit; the readiness score must not regress",
+        "```",
+        "",
+    ]
+    return "\n".join(lines)

genesis_cli/baseline.py

@@ -0,0 +1,114 @@
+"""Baseline comparison + score history — the CI regression story.
+
+`compare` diffs two `genesis adopt` reports. Identity is deliberately simple
+and stable across runs: a gate finding is ``(gate, title, location)``, a
+completeness gap is ``(profile, flow)``. ``regressed`` is the CI signal: the
+score dropped by more than half a point, a mandatory-flow gap appeared, or a
+new critical/high finding appeared.
+
+`append_history` keeps one JSON line per audit in ``<out_dir>/history.jsonl``
+(append-only — never rewritten), so the readiness score becomes a trackable
+time series without any infrastructure.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+# A dip within this tolerance is jitter (e.g. a gate flipping skipped→passed),
+# not a regression.
+SCORE_TOLERANCE = 0.5
+
+_REGRESSION_SEVERITIES = frozenset({"critical", "high"})
+
+HISTORY_FILE = "history.jsonl"
+
+
+def _findings_by_identity(report: dict) -> dict[tuple, dict]:
+    """Gate findings keyed by (gate, title, location); first occurrence wins."""
+    out: dict[tuple, dict] = {}
+    for gate in report.get("gates", []):
+        for f in gate.get("findings", []):
+            key = (f.get("gate") or gate.get("gate"), f.get("title"),
+                   f.get("location"))
+            out.setdefault(key, f)
+    return out
+
+
+def _gaps_by_identity(report: dict) -> dict[tuple, dict]:
+    """Completeness gaps keyed by (profile, flow)."""
+    return {(g.get("profile"), g.get("flow")): g
+            for g in report.get("completeness", {}).get("gaps", [])}
+
+
+def compare(current: dict, baseline: dict) -> dict:
+    """Diff ``current`` against ``baseline`` (two adopt report dicts)."""
+    cur_f, base_f = _findings_by_identity(current), _findings_by_identity(baseline)
+    cur_g, base_g = _gaps_by_identity(current), _gaps_by_identity(baseline)
+
+    score_delta = round(
+        current["readiness"]["score"] - baseline["readiness"]["score"], 1)
+    cur_grade = current["readiness"]["grade"]
+    base_grade = baseline["readiness"]["grade"]
+    grade_change = f"{base_grade}→{cur_grade}" if cur_grade != base_grade else None
+
+    new_findings = [f for k, f in cur_f.items() if k not in base_f]
+    resolved_findings = [f for k, f in base_f.items() if k not in cur_f]
+    new_gaps = [g for k, g in cur_g.items() if k not in base_g]
+    resolved_gaps = [g for k, g in base_g.items() if k not in cur_g]
+
+    regressed = (
+        score_delta < -SCORE_TOLERANCE
+        or bool(new_gaps)
+        or any(f.get("severity") in _REGRESSION_SEVERITIES for f in new_findings)
+    )
+    return {
+        "score_delta": score_delta,
+        "grade_change": grade_change,
+        "new_findings": new_findings,
+        "resolved_findings": resolved_findings,
+        "new_gaps": new_gaps,
+        "resolved_gaps": resolved_gaps,
+        "regressed": regressed,
+    }
+
+
+def append_history(out_dir: Path, report: dict) -> list[dict]:
+    """Append this audit to ``<out_dir>/history.jsonl``; return all entries.
+
+    Append-only by design: the file is the artifact directory's score ledger.
+    Unparseable lines (e.g. from a truncated write) are skipped, not fatal.
+    """
+    entry = {
+        "generated_at": report["generated_at"],
+        "score": report["readiness"]["score"],
+        "grade": report["readiness"]["grade"],
+        "findings_count": sum(len(g.get("findings", []))
+                              for g in report.get("gates", [])),
+        "gaps_count": len(report.get("completeness", {}).get("gaps", [])),
+    }
+    path = out_dir / HISTORY_FILE
+    with path.open("a", encoding="utf-8") as fh:
+        fh.write(json.dumps(entry) + "\n")
+
+    entries = []
+    for line in path.read_text(encoding="utf-8").splitlines():
+        try:
+            entries.append(json.loads(line))
+        except json.JSONDecodeError:
+            continue
+    return entries
+
+
+def render_trend(entries: list[dict], max_shown: int = 8) -> str | None:
+    """One-line score trend ("history: 44.8 → 49.0 → 75.5 (3 runs)").
+
+    None when there is nothing to compare yet (fewer than two runs).
+    """
+    if len(entries) < 2:
+        return None
+    shown = entries[-max_shown:]
+    scores = " → ".join(str(e["score"]) for e in shown)
+    prefix = "… → " if len(entries) > len(shown) else ""
+    return f"history: {prefix}{scores} ({len(entries)} runs)"

genesis_cli/gates.py

@@ -0,0 +1,50 @@
+"""`genesis gates` — run just the deterministic delivery gates, no full audit.
+
+Same gate set and configuration as `genesis adopt` (via `adopt.run_gates`),
+but without the completeness/env/structure analysis: a fast per-gate table for
+local iteration ("did my fix turn secret-scan green?") and scripting.
+"""
+
+from __future__ import annotations
+
+_STATUS_MARKS = {"passed": "✓", "failed": "✗", "skipped": "–", "error": "!"}
+
+
+def render_gates_terminal(package: dict) -> str:
+    """Per-gate table (name, status, summary) + findings for failed gates."""
+    results = package.get("gate_results", [])
+    if not results:
+        return "no gates were run"
+    name_w = max(len("GATE"), *(len(str(r.get("gate", ""))) for r in results))
+
+    lines = ["", f"  {'GATE':<{name_w}}  {'STATUS':<8}  SUMMARY"]
+    for r in results:
+        mark = _STATUS_MARKS.get(r.get("status"), "?")
+        summary = r.get("summary") or r.get("error") or ""
+        lines.append(f"{mark} {r.get('gate', ''):<{name_w}}  "
+                     f"{r.get('status', ''):<8}  {summary[:80]}")
+
+    for r in results:
+        findings = r.get("findings", [])
+        if r.get("status") != "failed" or not findings:
+            continue
+        lines += ["", f"── {r['gate']}: top findings " +
+                  "─" * max(0, 50 - len(str(r["gate"])))]
+        for f in findings[:5]:
+            lines.append(f"   [{f.get('severity')}] {f.get('title')}")
+            if f.get("location"):
+                lines.append(f"     at {f['location']}")
+            if f.get("remediation"):
+                lines.append(f"     fix: {f['remediation']}")
+        if len(findings) > 5:
+            lines.append(f"   … {len(findings) - 5} more (use --json for all)")
+
+    lines.append("")
+    return "\n".join(lines)
+
+
+def gates_exit_code(package: dict) -> int:
+    """0 when every selected gate passed or skipped, 1 otherwise."""
+    ok = all(r.get("status") in ("passed", "skipped")
+             for r in package.get("gate_results", []))
+    return 0 if ok else 1

genesis_cli/init.py

@@ -0,0 +1,158 @@
+"""`genesis init` — scaffold a new (or bare) repo so agents start agent-ready.
+
+Idempotent: every file is created only if absent; existing files are reported
+as skipped and never modified. AGENTS.md comes from a fresh audit of whatever
+already exists, so on an empty directory it carries the "establish a test
+command" first task, and on a partial repo it reflects real commands and gaps.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from .adopt import run_audit
+from .agents_md import render_agents_md
+
+GITIGNORE = """\
+# Environment — never commit secrets (.env.example is the documented template).
+.env
+.env.*
+!.env.example
+
+# Genesis audit artifacts
+.genesis-report/
+
+# Dependencies & build output
+node_modules/
+dist/
+build/
+coverage/
+
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+
+# OS / editor noise
+.DS_Store
+"""
+
+ENV_EXAMPLE = """\
+# Environment contract — every variable the app reads, with safe example
+# values. Copy to .env and fill in real values (never commit .env).
+#
+# EXAMPLE_API_KEY=changeme
+"""
+
+AUDIT_WORKFLOW = """\
+# Agent-readiness audit: every PR runs `genesis adopt` and fails when the
+# readiness score drops below the bar. Raise --min-score as remediation lands.
+name: genesis-audit
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write  # for the SARIF upload
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      # TODO: genesis-cli is not on PyPI yet. Until it is published, replace
+      # this with an install from your checkout of the Genesis repo
+      # (e.g. `pip install path/to/genesis/packages/genesis-cli`).
+      - run: pip install genesis-cli
+      - name: Agent-readiness audit
+        run: genesis adopt . --min-score 40
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: genesis-readiness-report
+          path: .genesis-report/
+      # Surface findings in the GitHub Security tab / PR annotations.
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: .genesis-report/report.sarif
+"""
+
+GATE_CONFIG = """\
+# Genesis gate config — the "how" of validation (provider selection,
+# thresholds, BYO tooling). All optional: with everything commented out, each
+# gate auto-picks its default provider and skips cleanly when the scanner is
+# not installed. Schema: genesis-gates contracts/gateconfig.schema.json.
+apiVersion: genesis.dev/v0
+kind: GateConfig
+
+# defaults:                    # applied to every gate, overridable per gate
+#   fail_on_severity: high     # findings at/above this severity fail the gate
+#   timeout: 300
+
+# gates:
+#   secret-scan:
+#     provider: gitleaks
+#   dependency-scan:
+#     provider: trivy
+#     fail_on_severity: critical
+#   unit-tests:
+#     provider: command
+#     command: "npm test"
+#     fail_on_nonzero: true
+#   sast:
+#     provider: report         # import a report your CI already produced
+#     report: semgrep.sarif
+#     parser: sarif
+"""
+
+
+def run_init(repo: Path) -> tuple[list[str], list[str]]:
+    """Scaffold `repo`. Returns (created, skipped) as repo-relative paths."""
+    repo.mkdir(parents=True, exist_ok=True)
+
+    # Audit what exists BEFORE writing anything, so AGENTS.md reflects the
+    # repo as found (empty dir -> "establish a test command" first task).
+    agents_md = render_agents_md(run_audit(repo))
+
+    created: list[str] = []
+    skipped: list[str] = []
+    for rel, content in (
+        ("AGENTS.md", agents_md),
+        (".gitignore", GITIGNORE),
+        (".env.example", ENV_EXAMPLE),
+        (".github/workflows/genesis-audit.yml", AUDIT_WORKFLOW),
+        (".genesis/config.yaml", GATE_CONFIG),
+    ):
+        path = repo / rel
+        if path.exists():
+            skipped.append(rel)
+        else:
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(content)
+            created.append(rel)
+    return created, skipped
+
+
+def render_summary(repo: Path, created: list[str], skipped: list[str]) -> str:
+    lines = [f"genesis init — {repo}", ""]
+    lines += [f"  created  {rel}" for rel in created]
+    lines += [f"  exists, skipped  {rel}" for rel in skipped]
+    lines += [
+        "",
+        "Next steps:",
+        "  1. Fill in .env.example as you introduce configuration (never commit .env).",
+        "  2. Establish a test command and record it in AGENTS.md — agents run it "
+        "after every change.",
+        "  3. Run `genesis adopt .` after your first commits to get a readiness "
+        "score and gap list.",
+    ]
+    return "\n".join(lines)