hardproof 0.3.0__tar.gz → 0.3.1__tar.gz

{hardproof-0.3.0/hardproof.egg-info → hardproof-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hardproof
-Version: 0.3.0
+Version: 0.3.1
 Summary: A persistent, risk-aware engineering protocol for Hermes Agent
 Author: Hardproof contributors
 License-Expression: Apache-2.0
@@ -36,8 +36,9 @@ Dynamic: license-file
 [![CI](https://github.com/asimons81/hardproof/actions/workflows/ci.yml/badge.svg)](https://github.com/asimons81/hardproof/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 [![PyPI](https://img.shields.io/pypi/v/hardproof)](https://pypi.org/project/hardproof/)
+[![X Follow](https://img.shields.io/twitter/follow/asimons81?style=social)](https://x.com/asimons81)
 
-> **Alpha software.** v0.2.0 Gatehouse is the current signed public alpha on PyPI. v0.3.0 Workcells development has not begun. Commands, schemas, and contracts may change before v1.0.0.
+> **Alpha software.** v0.3.0 Workcells is the current public alpha on PyPI. v0.3.1 Workcells Hardening has been prepared. v0.4.0 Challenge Chamber development has not begun. Commands, schemas, and contracts may change before v1.0.0.
 
 Hardproof gives coding agents a persistent, risk-aware engineering process that turns ambiguous software requests into reviewed, verified results while preserving the evidence behind every completion claim.
 
@@ -45,12 +46,12 @@ Hardproof gives coding agents a persistent, risk-aware engineering process that
 
 ## Current Release
 
-| Release | Version | Status |
-|---------|---------|--------|
-| Public alpha | v0.2.0 Gatehouse | Released on GitHub and PyPI |
+| Current | v0.3.0 Workcells | Released on GitHub and PyPI |
+| Hardening | v0.3.1 Workcells Hardening | Prepared, pending release |
+| Previous | v0.2.0 Gatehouse | Released on GitHub and PyPI |
 | Previous | v0.1.1 Core Heat | Released on GitHub and PyPI |
 | Previous | v0.1.0 Core Heat | Released on GitHub |
-| Future | v0.3.0 Workcells | Not started |
+| Future | v0.4.0 Challenge Chamber | Not started |
 
 ## Install
 

{hardproof-0.3.0 → hardproof-0.3.1}/README.md

@@ -5,8 +5,9 @@
 [![CI](https://github.com/asimons81/hardproof/actions/workflows/ci.yml/badge.svg)](https://github.com/asimons81/hardproof/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 [![PyPI](https://img.shields.io/pypi/v/hardproof)](https://pypi.org/project/hardproof/)
+[![X Follow](https://img.shields.io/twitter/follow/asimons81?style=social)](https://x.com/asimons81)
 
-> **Alpha software.** v0.2.0 Gatehouse is the current signed public alpha on PyPI. v0.3.0 Workcells development has not begun. Commands, schemas, and contracts may change before v1.0.0.
+> **Alpha software.** v0.3.0 Workcells is the current public alpha on PyPI. v0.3.1 Workcells Hardening has been prepared. v0.4.0 Challenge Chamber development has not begun. Commands, schemas, and contracts may change before v1.0.0.
 
 Hardproof gives coding agents a persistent, risk-aware engineering process that turns ambiguous software requests into reviewed, verified results while preserving the evidence behind every completion claim.
 
@@ -14,12 +15,12 @@ Hardproof gives coding agents a persistent, risk-aware engineering process that
 
 ## Current Release
 
-| Release | Version | Status |
-|---------|---------|--------|
-| Public alpha | v0.2.0 Gatehouse | Released on GitHub and PyPI |
+| Current | v0.3.0 Workcells | Released on GitHub and PyPI |
+| Hardening | v0.3.1 Workcells Hardening | Prepared, pending release |
+| Previous | v0.2.0 Gatehouse | Released on GitHub and PyPI |
 | Previous | v0.1.1 Core Heat | Released on GitHub and PyPI |
 | Previous | v0.1.0 Core Heat | Released on GitHub |
-| Future | v0.3.0 Workcells | Not started |
+| Future | v0.4.0 Challenge Chamber | Not started |
 
 ## Install
 

{hardproof-0.3.0 → hardproof-0.3.1}/hardproof/__init__.py

@@ -1,3 +1,3 @@
 """Hardproof public package."""
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"

{hardproof-0.3.0 → hardproof-0.3.1}/hardproof/commands/shared.py

@@ -17,7 +17,7 @@ from uuid import uuid4
 import yaml
 
 from hardproof.compat import inspect_context
-from hardproof.config import DEFAULTS, ConfigError, config_fingerprint, load_config
+from hardproof.config import DEFAULTS, ConfigError, config_fingerprint, load_config, _MODEL_TIERS
 from hardproof.domain.enums import ApprovalGate, RiskLevel, RunProfile, RunStage
 from hardproof.domain.models import Run, SessionBinding, VerificationCheck, new_id, utc_now
 from hardproof.paths import ProjectPaths
@@ -142,6 +142,7 @@ class CommandService:
             approved_review=any(event.event_type == "review_approved" for event in events),
             recorded_change=any(event.event_type == "change_recorded" for event in events),
             learning_skipped=any(event.event_type == "learning_skipped" for event in events),
+            workcell_required_unresolved=self.repository.count_unresolved_required_workcells(run_id),
         )
 
     def transition_facts(self, run_id: str) -> TransitionFacts:
@@ -370,27 +371,76 @@ class CommandService:
                 required = {"key", "title", "objective", "acceptance"}
                 if not required <= set(value):
                     raise ValueError("every Workcell task requires key, title, objective, and acceptance")
+                unknown = sorted(set(value) - required - {
+                    "dependencies", "read_scope", "write_scope", "required", "priority", "model_tier",
+                })
+                if unknown:
+                    raise ValueError(f"unknown Workcell task keys: {', '.join(unknown)}")
+                key = str(value["key"])
+                if not key or len(key) > 128 or not key.replace("-", "").replace("_", "").isalnum():
+                    raise ValueError("Workcell task key must be 1-128 filename-safe characters")
+                title = str(value["title"])
+                if not title.strip() or len(title) > 256:
+                    raise ValueError("Workcell task title must be 1-256 characters")
+                objective = str(value["objective"])
+                if not objective.strip() or len(objective) > 4096:
+                    raise ValueError("Workcell task objective must be 1-4096 characters")
                 acceptance = value["acceptance"]
+                if not isinstance(acceptance, list) or not acceptance or len(acceptance) > 32:
+                    raise ValueError("Workcell task acceptance must be a non-empty list of at most 32 strings")
+                for item in acceptance:
+                    if not isinstance(item, str) or not item.strip() or len(item) > 512:
+                        raise ValueError("Workcell task acceptance items must be 1-512 character strings")
                 dependencies = value.get("dependencies", [])
+                if not isinstance(dependencies, list) or len(dependencies) > 32:
+                    raise ValueError("Workcell task dependencies must be a list of at most 32 strings")
+                for item in dependencies:
+                    if not isinstance(item, str) or not item.strip():
+                        raise ValueError("Workcell task dependencies must be non-empty strings")
                 read_scope = value.get("read_scope", [])
                 write_scope = value.get("write_scope", [])
-                for name, sequence in {
-                    "acceptance": acceptance, "dependencies": dependencies,
-                    "read_scope": read_scope, "write_scope": write_scope,
-                }.items():
-                    if not isinstance(sequence, list) or any(not isinstance(item, str) for item in sequence):
-                        raise ValueError(f"Workcell task {name} must be a list of strings")
+                for name, scope in [("read_scope", read_scope), ("write_scope", write_scope)]:
+                    if not isinstance(scope, list) or len(scope) > 32:
+                        raise ValueError(f"Workcell task {name} must be a list of at most 32 strings")
+                    for item in scope:
+                        if not isinstance(item, str) or not item.strip():
+                            raise ValueError(f"Workcell task {name} items must be non-empty strings")
+                        if item.startswith("/") or ".." in item.split("/"):
+                            raise ValueError(f"Workcell task {name} path must be project-relative without traversal: {item}")
+                req_bool = value.get("required", True)
+                if not isinstance(req_bool, bool):
+                    raise ValueError("Workcell task required must be boolean")
+                priority = value.get("priority", 0)
+                if not isinstance(priority, int) or isinstance(priority, bool) or not -128 <= priority <= 127:
+                    raise ValueError("Workcell task priority must be an integer between -128 and 127")
+                model_tier = value.get("model_tier")
+                if model_tier is not None:
+                    if not isinstance(model_tier, str) or model_tier not in _MODEL_TIERS:
+                        raise ValueError(f"Workcell task model_tier must be one of {sorted(_MODEL_TIERS)}")
                 specs.append(WorkcellTaskSpec(
                     str(value["key"]), str(value["title"]), str(value["objective"]), tuple(acceptance),
-                    tuple(dependencies), bool(value.get("required", True)), tuple(read_scope), tuple(write_scope),
-                    int(value.get("priority", 0)), str(value["model_tier"]) if "model_tier" in value else None,
+                    tuple(dependencies), req_bool, tuple(read_scope), tuple(write_scope),
+                    priority, model_tier,
                 ))
             config = load_config(self.paths.config).workcells
             if not config.enabled:
                 raise PermissionError("Workcells are disabled by project configuration")
+            run_id = self.active_run_id()
+            active_run = self.repository.get_run(run_id)
+            if active_run.profile is RunProfile.QUICK and len(specs) > 3:
+                raise ValueError("Quick profile Workcell graphs are limited to at most 3 tasks")
+            # Validate profile minimum tier for every task
+            minimum = config.profile_minimum_tiers.get(active_run.profile, config.default_model_tier)
+            for spec in specs:
+                tier = spec.model_tier or config.default_model_tier
+                tier_index = {t: i for i, t in enumerate(sorted(_MODEL_TIERS))}
+                if tier_index.get(tier, -1) < tier_index.get(minimum, 0):
+                    raise ValueError(f"Workcell task {spec.key} model tier {tier} is below profile minimum {minimum}")
             created = WorkcellService(
                 self.repository, maximum_attempts=config.maximum_attempts,
                 default_model_tier=config.default_model_tier,
+                claim_timeout_seconds=config.claim_timeout_seconds,
+                maximum_active_children=config.maximum_active_children,
             ).create_graph(self.active_run_id(), tuple(specs))
             return CommandResult(
                 True,
@@ -410,6 +460,8 @@ class CommandService:
                 default_model_tier=config.default_model_tier, brief_size_limit=config.brief_size_limit,
                 context_manifest_size_limit=config.context_manifest_size_limit,
                 result_size_limit=config.result_size_limit,
+                claim_timeout_seconds=config.claim_timeout_seconds,
+                maximum_active_children=config.maximum_active_children,
             ).launch_next(
                 self.active_run_id(), project_root=self.context.project_root,
                 adapter=HermesChildAdapter(self.context.hermes_context), claimant=self.context.actor,
@@ -428,12 +480,43 @@ class CommandService:
                 default_model_tier=config.default_model_tier, brief_size_limit=config.brief_size_limit,
                 context_manifest_size_limit=config.context_manifest_size_limit,
                 result_size_limit=config.result_size_limit,
+                claim_timeout_seconds=config.claim_timeout_seconds,
+                maximum_active_children=config.maximum_active_children,
             ).process_result(rest[1], project_root=self.context.project_root, actor=self.context.actor)
             return CommandResult(True, f"Workcell result accepted: {outcome}.", self.active_run_id())
         if rest[0] == "reconcile" and len(rest) == 2:
             attempt = self.repository.reconcile_workcell_attempt(rest[1], actor=self.context.actor)
             return CommandResult(True, f"Workcell attempt {attempt.attempt_id}: {attempt.state.value}.", self.active_run_id())
-        raise ValueError("usage: workcells <status|plan --tasks-json JSON|run-next|result ATTEMPT|reconcile> [attempt-id]")
+        if rest[0] == "retry" and len(rest) >= 3:
+            task_id_or_key = rest[1]
+            reason = " ".join(rest[2:])
+            run_id = self.active_run_id()
+            run = self.repository.get_run(run_id)
+            if run.stage not in (RunStage.IMPLEMENT, RunStage.REVIEW):
+                raise PermissionError("Workcell retry requires IMPLEMENT or REVIEW stage")
+            rows = self.repository.list_workcell_task_rows(run_id)
+            task = next(
+                (row for row in rows if row["id"] == task_id_or_key or row["task_key"] == task_id_or_key),
+                None,
+            )
+            if task is None:
+                raise LookupError("Workcell task not found")
+            prior_attempts = self.repository.list_workcell_attempts(str(task["id"]))
+            if not prior_attempts:
+                raise ValueError("Workcell task has no attempts to retry")
+            latest = prior_attempts[-1]
+            if latest.state.value not in {"blocked", "failed", "interrupted", "cancelled"}:
+                raise ValueError("Workcell task's latest attempt cannot be retried")
+            decision_id = self.repository.authorize_workcell_retry(
+                str(task["id"]), latest.attempt_id, actor=self.context.actor,
+                reason=reason, material_change="human-authorized retry",
+                new_context_sha256=latest.context_sha256, new_model_tier=str(task["model_tier"]),
+            )
+            return CommandResult(True, f"Workcell retry authorized: {decision_id}.", run_id)
+        raise ValueError(
+            "usage: workcells <status|plan --tasks-json JSON|run-next|result ATTEMPT|"
+            "reconcile ATTEMPT|retry TASK REASON...>"
+        )
 
     def _approve(self, rest: list[str]) -> CommandResult:
         if not rest:

{hardproof-0.3.0 → hardproof-0.3.1}/hardproof/policy/stage_rules.py

@@ -26,6 +26,7 @@ class TransitionFacts:
     approved_review: bool = False
     recorded_change: bool = False
     learning_skipped: bool = False
+    workcell_required_unresolved: int = 0
 
     def has_artifact(self, kind: ArtifactKind) -> bool:
         return any(item.kind is kind for item in self.artifacts)
@@ -60,6 +61,8 @@ def _gate_for_forward(run: Run, target: RunStage, facts: TransitionFacts) -> lis
     elif run.stage is RunStage.IMPLEMENT and target is RunStage.REVIEW:
         if not facts.recorded_change and not any(task.status is TaskStatus.COMPLETED for task in facts.tasks):
             blockers.append("completed task or recorded change missing")
+        if facts.workcell_required_unresolved > 0:
+            blockers.append(f"required Workcells are unresolved: {facts.workcell_required_unresolved} task(s) not completed")
     elif run.stage is RunStage.REVIEW and target is RunStage.VERIFY:
         if run.profile is not RunProfile.QUICK and not (
             facts.approved_review or facts.has_human_approval(ApprovalGate.WAIVER)

{hardproof-0.3.0 → hardproof-0.3.1}/hardproof/services/workcells.py

@@ -42,7 +42,8 @@ class WorkcellService:
     def __init__(
         self, repository: RunRepository, *, maximum_attempts: int, default_model_tier: str,
         brief_size_limit: int = 65_536, context_manifest_size_limit: int = 32_768,
-        result_size_limit: int = 65_536,
+        result_size_limit: int = 65_536, claim_timeout_seconds: int = 900,
+        maximum_active_children: int = 1,
     ) -> None:
         self.repository = repository
         self.maximum_attempts = maximum_attempts
@@ -50,6 +51,8 @@ class WorkcellService:
         self.brief_size_limit = brief_size_limit
         self.context_manifest_size_limit = context_manifest_size_limit
         self.result_size_limit = result_size_limit
+        self.claim_timeout_seconds = claim_timeout_seconds
+        self.maximum_active_children = maximum_active_children
 
     def create_graph(self, run_id: str, specs: tuple[WorkcellTaskSpec, ...]) -> CreatedWorkcellGraph:
         run = self.repository.get_run(run_id)
@@ -107,19 +110,33 @@ class WorkcellService:
     def launch_next(
         self, run_id: str, *, project_root: str | Path, adapter: ChildSessionAdapter, claimant: str = "scheduler"
     ) -> ChildLaunch | None:
-        """Claim, materialize, and launch one deterministic ready Workcell task."""
+        """Claim, materialize, and launch one deterministic ready Workcell task.
+
+        The attempt is claimed BEFORE the child context is finalized so the child
+        receives its complete identity contract (including attempt_id) and can
+        produce a valid result.json without post-launch repository introspection.
+        """
         self.refresh_readiness(run_id)
         ready = [item for item in self.repository.list_workcell_task_rows(run_id) if item["status"] == "ready"]
         if not ready:
             return None
         selected = ready[0]
+        # Scope check: run must be in IMPLEMENT and not paused/aborted
+        run = self.repository.get_run(run_id)
+        if run.stage is not RunStage.IMPLEMENT or run.status.value in ("paused", "aborted"):
+            raise PermissionError("Workcell launch requires active IMPLEMENT stage")
         detail = self.repository.get_workcell_task_detail(str(selected["id"]))
         root = Path(project_root).resolve()
+
+        # Pre-generate the attempt identity so the child receives it in its contract
+        attempt_id = new_id("workcell-attempt")
         attempt_number = int(cast(int, detail["attempt_count"])) + 1
         store = WorkcellArtifactStore(
             root, run_id, str(detail["task_key"]), attempt_number,
             maximum_bytes=max(self.brief_size_limit, self.context_manifest_size_limit, self.result_size_limit),
         )
+        relative_base = store.attempt_directory.relative_to(root).as_posix()
+
         brief = "\n".join((
             f"# Workcell task: {detail['task_key']}", "", f"## Objective\n{detail['objective']}",
             "", "## Acceptance criteria", *(f"- {item}" for item in cast(tuple[str, ...], detail["acceptance"])),
@@ -127,18 +144,37 @@ class WorkcellService:
             "", "## Allowed write scope", *(f"- {item}" for item in cast(tuple[str, ...], detail["write_scope"]) or ("- none declared",)),
             "", "## Constraints\nDo not create approvals or waivers. Return only the versioned result contract.", "",
         ))
+
+        # The child contract includes every identity the child must echo in result.json
+        result_path = f"{relative_base}/result.json"
         context = {
-            "version": 1, "run_id": run_id, "task_id": detail["id"], "task_key": detail["task_key"],
-            "graph_revision_id": detail["graph_revision_id"], "model_tier": detail["model_tier"],
-            "brief_path": "brief.md", "result_path": "result.json",
+            "version": 1,
+            "run_id": run_id,
+            "task_id": str(detail["id"]),
+            "task_key": str(detail["task_key"]),
+            "attempt_id": attempt_id,
+            "attempt_number": attempt_number,
+            "graph_revision_id": str(detail["graph_revision_id"]),
+            "model_tier": str(detail["model_tier"]),
+            "brief_path": "brief.md",
+            "result_path": "result.json",
         }
         serialized_context = json.dumps(context, sort_keys=True, separators=(",", ":"))
         context_sha256 = hashlib.sha256(serialized_context.encode("utf-8")).hexdigest()
-        relative_base = store.attempt_directory.relative_to(root).as_posix()
+
+        # Enforce configured active-child bounds before attempting to claim
+        active_count = len(self.repository.list_active_workcell_attempts(run_id))
+        if active_count >= self.maximum_active_children:
+            return None
+
+        # Claim the attempt with pre-generated identity so the SHA-256 matches
         attempt = self.repository.claim_workcell_task(
             str(detail["id"]), claimant=claimant, model_tier=str(detail["model_tier"]),
             context_sha256=context_sha256, brief_path=f"{relative_base}/brief.md",
-            context_manifest_path=f"{relative_base}/context.json", result_path=f"{relative_base}/result.json",
+            context_manifest_path=f"{relative_base}/context.json",
+            result_path=result_path,
+            attempt_id=attempt_id, attempt_number=attempt_number,
+            claim_timeout_seconds=self.claim_timeout_seconds,
         )
         try:
             if len(brief.encode("utf-8")) > self.brief_size_limit:
@@ -151,6 +187,10 @@ class WorkcellService:
             self.repository.mark_workcell_attempt_running(
                 attempt.attempt_id, child_session_id=launch.child_session_id, child_handle=launch.raw,
             )
+            # Verify the child received the correct attempt_id by writing result.json
+            result = store.attempt_directory / "result.json"
+            if result.exists():
+                raise RuntimeError("Workcell result path was pre-populated before child action")
         except Exception as exc:
             self.repository.close_workcell_attempt(
                 attempt.attempt_id, outcome="failed", actor=claimant, reason=f"launch failed: {type(exc).__name__}",
@@ -164,6 +204,10 @@ class WorkcellService:
         child_session_id = detail["child_session_id"]
         if not isinstance(child_session_id, str) or not child_session_id:
             raise ValueError("Workcell attempt has no reported child session identity")
+        # Scope check: verify the attempt belongs to a run in IMPLEMENT stage
+        run = self.repository.get_run(str(detail["run_id"]))
+        if run.stage is not RunStage.IMPLEMENT:
+            raise PermissionError("Workcell result processing requires run in IMPLEMENT stage")
         root = Path(project_root).resolve()
         result_path = root / safe_project_relative(str(detail["result_path"]))
         if not result_path.is_file() or result_path.is_symlink():
@@ -182,6 +226,15 @@ class WorkcellService:
         for value in (*result.changed_paths, *result.artifacts_produced):
             if not (root / safe_project_relative(value)).exists():
                 raise ValueError("Workcell result claims a missing path")
+        # Enforce write scope: every changed path and artifact must match declared write scope
+        write_scope = cast(tuple[str, ...], detail.get("write_scope") or ())
+        if write_scope:
+            import fnmatch
+            for path in (*result.changed_paths, *result.artifacts_produced):
+                if not any(fnmatch.fnmatch(path.replace("\\", "/"), pattern) for pattern in write_scope):
+                    raise ValueError(
+                        f"Workcell result path '{path}' is outside declared write scope {sorted(write_scope)}"
+                    )
         if result.reported_status == "succeeded":
             expected = set(cast(tuple[str, ...], detail["acceptance"]))
             if not expected.issubset(set(result.acceptance_completed)):

{hardproof-0.3.0 → hardproof-0.3.1}/hardproof/storage/repository.py

@@ -360,12 +360,22 @@ class RunRepository:
         brief_path: str,
         context_manifest_path: str,
         result_path: str,
+        attempt_id: str | None = None,
+        attempt_number: int | None = None,
+        claim_timeout_seconds: int = 900,
     ) -> WorkcellAttempt:
-        """Atomically create the sole active attempt for a ready Workcell task."""
+        """Atomically create the sole active attempt for a ready Workcell task.
+
+        When attempt_id and attempt_number are provided, use them directly
+        (pre-generated by the caller for the child handoff contract).
+        Otherwise generate fresh values (backward compatible).
+
+        claim_timeout_seconds controls the claim expiry window (default 900s/15m).
+        """
         if not claimant.strip() or not model_tier.strip() or len(context_sha256) != 64:
             raise ValueError("invalid Workcell claim")
         timestamp = utc_now()
-        expires_at = (datetime.now(timezone.utc) + timedelta(minutes=15)).isoformat(
+        expires_at = (datetime.now(timezone.utc) + timedelta(seconds=claim_timeout_seconds)).isoformat(
             timespec="milliseconds"
         ).replace("+00:00", "Z")
         with self.database.connect() as connection:
@@ -380,9 +390,9 @@ class RunRepository:
                     raise ValueError("Workcell task is not ready to claim")
                 if int(row["attempt_count"]) >= int(row["maximum_attempts"]):
                     raise ValueError("Workcell task has exhausted its attempts")
-                attempt_id = new_id("workcell-attempt")
+                actual_attempt_id = attempt_id if attempt_id is not None else new_id("workcell-attempt")
                 launch_token = new_id("workcell-launch")
-                attempt_number = int(row["attempt_count"]) + 1
+                actual_attempt_number = attempt_number if attempt_number is not None else int(row["attempt_count"]) + 1
                 connection.execute(
                     """INSERT INTO workcell_attempts(
                         id, run_id, task_id, attempt_number, state, launch_token, model_tier,
@@ -391,7 +401,7 @@ class RunRepository:
                         updated_at, terminal_reason
                     ) VALUES (?, ?, ?, ?, 'starting', ?, ?, ?, ?, ?, ?, NULL, NULL, NULL, NULL, ?, ?, NULL)""",
                     (
-                        attempt_id, row["run_id"], task_id, attempt_number, launch_token,
+                        actual_attempt_id, row["run_id"], task_id, actual_attempt_number, launch_token,
                         model_tier, context_sha256, brief_path, context_manifest_path, result_path,
                         timestamp, timestamp,
                     ),
@@ -399,12 +409,12 @@ class RunRepository:
                 connection.execute(
                     """INSERT INTO workcell_claims(task_id, attempt_id, claim_token, claimant, acquired_at, expires_at)
                     VALUES (?, ?, ?, ?, ?, ?)""",
-                    (task_id, attempt_id, launch_token, claimant, timestamp, expires_at),
+                    (task_id, actual_attempt_id, launch_token, claimant, timestamp, expires_at),
                 )
                 cursor = connection.execute(
                     """UPDATE workcell_tasks SET status='starting', attempt_count=?, updated_at=?
                     WHERE id=? AND status='ready'""",
-                    (attempt_number, timestamp, task_id),
+                    (actual_attempt_number, timestamp, task_id),
                 )
                 if cursor.rowcount != 1:
                     raise RuntimeError("Workcell task changed concurrently")
@@ -413,7 +423,7 @@ class RunRepository:
                         run_id, task_id, attempt_id, event_type, actor, child_session_id,
                         previous_state, new_state, details_json, correlation_id, created_at
                     ) VALUES (?, ?, ?, 'claim_acquired', ?, NULL, 'ready', 'starting', '{}', ?, ?)""",
-                    (row["run_id"], task_id, attempt_id, claimant, launch_token, timestamp),
+                    (row["run_id"], task_id, actual_attempt_id, claimant, launch_token, timestamp),
                 )
             except Exception:
                 connection.rollback()
@@ -421,7 +431,7 @@ class RunRepository:
             else:
                 connection.commit()
         return WorkcellAttempt.create(
-            attempt_id, str(row["run_id"]), task_id, attempt_number, launch_token, model_tier, context_sha256
+            actual_attempt_id, str(row["run_id"]), task_id, actual_attempt_number, launch_token, model_tier, context_sha256
         )
 
     def list_workcell_attempts(self, task_id: str) -> tuple[WorkcellAttempt, ...]:
@@ -779,6 +789,40 @@ class RunRepository:
                 connection.commit()
         return tuple(ready)
 
+    def count_unresolved_required_workcells(self, run_id: str) -> int:
+        """Return the count of required Workcell tasks not in a terminal successful state.
+
+        Used by transition gates to prevent advancing past IMPLEMENT while
+        required Workcells are pending, starting, running, blocked, failed,
+        interrupted, cancelled, or escalated.
+        """
+        with self.database.connect() as connection:
+            row = connection.execute(
+                """SELECT COUNT(*) FROM workcell_tasks
+                WHERE run_id=? AND required=1 AND status != 'succeeded'""",
+                (run_id,),
+            ).fetchone()
+        return int(row[0]) if row else 0
+
+    def list_active_workcell_attempts(self, run_id: str) -> tuple[WorkcellAttempt, ...]:
+        """Return all Workcell attempts currently in starting or running state for a run."""
+        with self.database.connect() as connection:
+            rows = connection.execute(
+                """SELECT attempt.* FROM workcell_attempts AS attempt
+                JOIN workcell_tasks AS task ON task.id=attempt.task_id
+                WHERE task.run_id=? AND attempt.state IN ('starting', 'running')
+                ORDER BY attempt.created_at""",
+                (run_id,),
+            ).fetchall()
+        return tuple(
+            WorkcellAttempt(
+                str(row["id"]), str(row["run_id"]), str(row["task_id"]), int(row["attempt_number"]),
+                str(row["launch_token"]), str(row["model_tier"]), str(row["context_sha256"]),
+                AttemptState(str(row["state"])), row["child_session_id"], row["terminal_reason"],
+            )
+            for row in rows
+        )
+
     def add_verification_check(self, check: VerificationCheck) -> None:
         with self.database.connect() as connection:
             connection.execute(

{hardproof-0.3.0 → hardproof-0.3.1/hardproof.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hardproof
-Version: 0.3.0
+Version: 0.3.1
 Summary: A persistent, risk-aware engineering protocol for Hermes Agent
 Author: Hardproof contributors
 License-Expression: Apache-2.0
@@ -36,8 +36,9 @@ Dynamic: license-file
 [![CI](https://github.com/asimons81/hardproof/actions/workflows/ci.yml/badge.svg)](https://github.com/asimons81/hardproof/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 [![PyPI](https://img.shields.io/pypi/v/hardproof)](https://pypi.org/project/hardproof/)
+[![X Follow](https://img.shields.io/twitter/follow/asimons81?style=social)](https://x.com/asimons81)
 
-> **Alpha software.** v0.2.0 Gatehouse is the current signed public alpha on PyPI. v0.3.0 Workcells development has not begun. Commands, schemas, and contracts may change before v1.0.0.
+> **Alpha software.** v0.3.0 Workcells is the current public alpha on PyPI. v0.3.1 Workcells Hardening has been prepared. v0.4.0 Challenge Chamber development has not begun. Commands, schemas, and contracts may change before v1.0.0.
 
 Hardproof gives coding agents a persistent, risk-aware engineering process that turns ambiguous software requests into reviewed, verified results while preserving the evidence behind every completion claim.
 
@@ -45,12 +46,12 @@ Hardproof gives coding agents a persistent, risk-aware engineering process that
 
 ## Current Release
 
-| Release | Version | Status |
-|---------|---------|--------|
-| Public alpha | v0.2.0 Gatehouse | Released on GitHub and PyPI |
+| Current | v0.3.0 Workcells | Released on GitHub and PyPI |
+| Hardening | v0.3.1 Workcells Hardening | Prepared, pending release |
+| Previous | v0.2.0 Gatehouse | Released on GitHub and PyPI |
 | Previous | v0.1.1 Core Heat | Released on GitHub and PyPI |
 | Previous | v0.1.0 Core Heat | Released on GitHub |
-| Future | v0.3.0 Workcells | Not started |
+| Future | v0.4.0 Challenge Chamber | Not started |
 
 ## Install
 

{hardproof-0.3.0 → hardproof-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hardproof"
-version = "0.3.0"
+version = "0.3.1"
 description = "A persistent, risk-aware engineering protocol for Hermes Agent"
 readme = "README.md"
 requires-python = ">=3.11"