housebroken-cli 0.4.0__tar.gz → 0.5.0__tar.gz

{housebroken_cli-0.4.0 → housebroken_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: housebroken-cli
-Version: 0.4.0
+Version: 0.5.0
 Summary: Agent-written pull requests that do not make a mess in someone else's house.
 Project-URL: Repository, https://github.com/lenamonj/housebroken
 License-Expression: MIT
@@ -57,6 +57,7 @@ one finding, one pull request
 body under 120 words, in their template, no footer
 prior art read and quoted before the branch existed
 their CI target green on a fresh clone of their main
+attacked by a second model before it left, evidence behind every finding
 the CLA known before filing, the SECURITY.md route taken when it applies
 ```
 
@@ -109,7 +110,11 @@ Every organization gets a card before the first filing: CLA, DCO, signed-commit
 A memory-safety or remote-abort finding in a library goes by the project's SECURITY.md route, privately, and never becomes a public pull request until the project answers.
 
 **9. File through the gate.**
-`branch-check.sh` reads the branch before anything leaves the machine: it refuses a dirty working tree, a file whose mode disagrees with its own siblings, a committed file the repository's own `.gitignore` excludes, a working artifact, and a branch that is not on top of its base, and it prints every absolute claim the added prose makes so each can be falsified against the code. Three of those came from one review round on a single pull request. `file-pr.sh` wraps the pull request creation and refuses when the prior-art printout for that repository is missing or older than a day, or when the body carries a footer, a trailer, or a typographic dash.
+`branch-check.sh` reads the branch before anything leaves the machine: it refuses a dirty working tree, a file whose mode disagrees with its own siblings, a file the branch adds that the repository's own `.gitignore` excludes, a working artifact, a commit carrying a tool trailer or a session link, a sign-off that names a username, and a branch that is not on top of its base, and it prints every absolute claim the added prose makes so each can be falsified against the code. Three of those came from one review round on a single pull request.
+
+Then a different model attacks the change. `review.sh brief` names the reviewer, never the model that wrote the change: one tier down, Fable to Opus and Opus to Sonnet, and never below Sonnet. The reviewer gets a fresh context, hard read-only limits and an attack list that starts with every claim the prose makes, and every finding it reports carries evidence it produced itself. Its report records the head and the text it read, so a fix it asks for is a new head and gets a new review. The defects reviews like this caught before anything was sent are in [the ledger](https://github.com/lenamonj/housebroken/blob/main/docs/lessons.md).
+
+`file-pr.sh` wraps the pull request creation and refuses when the prior-art printout for that repository is missing or older than a day, when the body carries a footer, a trailer, or a typographic dash, or when there is no POST AS IS review of the exact head and body being filed.
 
 **10. Watch it land.**
 `verify-filed-pr.sh` re-derives from GitHub that the head is the intended commit, the diff is exactly the intended files, and CI settled green. `pr-sweep.sh` lists every open pull request where the ball is in your court: a maintainer's comment unanswered, a review requesting changes, a red check, a conflict. Every maintainer comment gets a same-day answer. A ruling in a closed issue is never argued with. When the maintainer is right, concede and let them close it.
@@ -147,7 +152,8 @@ uv tool install git+https://github.com/lenamonj/housebroken
 | `scripts/comment-census.sh` | added code versus added comments, per branch |
 | `scripts/diff-defaults.sh` | default arguments and one-line wrappers added to keep call sites untouched |
 | `scripts/claim-check.sh` | every falsifiable claim in a body or a reply, listed to re-derive |
-| `scripts/branch-check.sh` | the branch's mechanical facts: clean tree, file modes, artifacts, absolute claims |
+| `scripts/branch-check.sh` | the branch's mechanical facts: clean tree, file modes, artifacts, trailers, sign-offs, absolute claims |
+| `scripts/review.sh` | the adversarial review: a different model attacks the change, and the filing is held to exactly what it read |
 | `scripts/file-pr.sh` | the only way a pull request gets filed |
 | `scripts/verify-filed-pr.sh` | the filed pull request is what was meant, and CI settled |
 | `scripts/pr-sweep.sh` | every open pull request where the ball is in your court |

{housebroken_cli-0.4.0 → housebroken_cli-0.5.0}/README.md

@@ -45,6 +45,7 @@ one finding, one pull request
 body under 120 words, in their template, no footer
 prior art read and quoted before the branch existed
 their CI target green on a fresh clone of their main
+attacked by a second model before it left, evidence behind every finding
 the CLA known before filing, the SECURITY.md route taken when it applies
 ```
 
@@ -97,7 +98,11 @@ Every organization gets a card before the first filing: CLA, DCO, signed-commit
 A memory-safety or remote-abort finding in a library goes by the project's SECURITY.md route, privately, and never becomes a public pull request until the project answers.
 
 **9. File through the gate.**
-`branch-check.sh` reads the branch before anything leaves the machine: it refuses a dirty working tree, a file whose mode disagrees with its own siblings, a committed file the repository's own `.gitignore` excludes, a working artifact, and a branch that is not on top of its base, and it prints every absolute claim the added prose makes so each can be falsified against the code. Three of those came from one review round on a single pull request. `file-pr.sh` wraps the pull request creation and refuses when the prior-art printout for that repository is missing or older than a day, or when the body carries a footer, a trailer, or a typographic dash.
+`branch-check.sh` reads the branch before anything leaves the machine: it refuses a dirty working tree, a file whose mode disagrees with its own siblings, a file the branch adds that the repository's own `.gitignore` excludes, a working artifact, a commit carrying a tool trailer or a session link, a sign-off that names a username, and a branch that is not on top of its base, and it prints every absolute claim the added prose makes so each can be falsified against the code. Three of those came from one review round on a single pull request.
+
+Then a different model attacks the change. `review.sh brief` names the reviewer, never the model that wrote the change: one tier down, Fable to Opus and Opus to Sonnet, and never below Sonnet. The reviewer gets a fresh context, hard read-only limits and an attack list that starts with every claim the prose makes, and every finding it reports carries evidence it produced itself. Its report records the head and the text it read, so a fix it asks for is a new head and gets a new review. The defects reviews like this caught before anything was sent are in [the ledger](docs/lessons.md).
+
+`file-pr.sh` wraps the pull request creation and refuses when the prior-art printout for that repository is missing or older than a day, when the body carries a footer, a trailer, or a typographic dash, or when there is no POST AS IS review of the exact head and body being filed.
 
 **10. Watch it land.**
 `verify-filed-pr.sh` re-derives from GitHub that the head is the intended commit, the diff is exactly the intended files, and CI settled green. `pr-sweep.sh` lists every open pull request where the ball is in your court: a maintainer's comment unanswered, a review requesting changes, a red check, a conflict. Every maintainer comment gets a same-day answer. A ruling in a closed issue is never argued with. When the maintainer is right, concede and let them close it.
@@ -135,7 +140,8 @@ uv tool install git+https://github.com/lenamonj/housebroken
 | `scripts/comment-census.sh` | added code versus added comments, per branch |
 | `scripts/diff-defaults.sh` | default arguments and one-line wrappers added to keep call sites untouched |
 | `scripts/claim-check.sh` | every falsifiable claim in a body or a reply, listed to re-derive |
-| `scripts/branch-check.sh` | the branch's mechanical facts: clean tree, file modes, artifacts, absolute claims |
+| `scripts/branch-check.sh` | the branch's mechanical facts: clean tree, file modes, artifacts, trailers, sign-offs, absolute claims |
+| `scripts/review.sh` | the adversarial review: a different model attacks the change, and the filing is held to exactly what it read |
 | `scripts/file-pr.sh` | the only way a pull request gets filed |
 | `scripts/verify-filed-pr.sh` | the filed pull request is what was meant, and CI settled |
 | `scripts/pr-sweep.sh` | every open pull request where the ball is in your court |

{housebroken_cli-0.4.0 → housebroken_cli-0.5.0}/bin/housebroken

@@ -50,6 +50,7 @@ usage: housebroken <subcommand> [args...]
   6  census      added code lines against added comment lines, per branch
   6  claims      every falsifiable claim in outbound text, listed to re-derive
   9  branch      the mechanical facts about the branch: tree, modes, artifacts, claims
+  9  review      a different model attacks the change before it is filed
   9  file        the only way a pull request gets filed
  10  verify      the filed pull request is what was meant, and CI settled
  10  sweep       every open pull request where the ball is in your court
@@ -93,6 +94,7 @@ case "$cmd" in
   census)    script=comment-census.sh ;;
   claims)    script=claim-check.sh ;;
   branch)    script=branch-check.sh ;;
+  review)    script=review.sh ;;
   file)      script=file-pr.sh ;;
   verify)    script=verify-filed-pr.sh ;;
   sweep)     script=pr-sweep.sh ;;

{housebroken_cli-0.4.0 → housebroken_cli-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "housebroken-cli"
-version = "0.4.0"
+version = "0.5.0"
 description = "Agent-written pull requests that do not make a mess in someone else's house."
 dynamic = ["readme"]
 license = "MIT"

{housebroken_cli-0.4.0 → housebroken_cli-0.5.0}/scripts/branch-check.sh

@@ -103,9 +103,16 @@ while IFS= read -r f; do
     fi
   fi
 
-  # The repository's own .gitignore is the authority on what is build output.
-  if git check-ignore -q --no-index -- "$f" 2>/dev/null; then
-    block "$f is committed but the repository's .gitignore excludes it"
+  # The repository's own .gitignore is the authority on what is build output,
+  # but only for a file this branch adds. Ignore rules never apply to a file the
+  # project already tracks, which is why check-ignore skips tracked files unless
+  # forced. NVIDIA/go-nvml ignores "dl" for a built binary, and that pattern also
+  # matches the directory pkg/dl, so forcing the check called two upstream source
+  # files build output.
+  if ! git cat-file -e "$base:$f" 2>/dev/null; then
+    if git check-ignore -q --no-index -- "$f" 2>/dev/null; then
+      block "$f is added by this branch and the repository's .gitignore excludes it"
+    fi
   fi
 
   case "$f" in
@@ -116,6 +123,28 @@ done <<EOF
 $files
 EOF
 
+# A tool trailer is the one thing in a commit that cannot be argued as style.
+# Thirteen open pull requests across ten organisations were found carrying
+# "Co-Authored-By: Claude ..." and four of them a live claude.ai session URL,
+# on NVIDIA, Microsoft, Apple, Uber, Tesla, Apache and IBM repositories. No
+# project asked for it; a harness adds it by default and nobody read the commit
+# before pushing. The body is checked for this at step 9; the commits were not.
+trailers=$(git log --format='%H %s%n%b' "$base..HEAD" 2>/dev/null \
+  | grep -inE 'Co-Authored-By: *Claude|Claude-Session:|https://claude\.ai/code|Generated with .*Claude')
+if [ -n "$trailers" ]; then
+  block "a commit carries a tool trailer or a session link, which no project asked for"
+  printf '%s\n' "$trailers" | sed 's/^/    /'
+fi
+
+# DCO wants a human being, and several projects say so in as many words.
+if git log --format='%b' "$base..HEAD" 2>/dev/null | grep -qE '^Signed-off-by:'; then
+  usernames=$(git log --format='%b' "$base..HEAD" 2>/dev/null | grep -E '^Signed-off-by: [a-z0-9_-]+ <')
+  if [ -n "$usernames" ]; then
+    block "a Signed-off-by names a username; the DCO asks for a real name"
+    printf '%s\n' "$usernames" | sed 's/^/    /'
+  fi
+fi
+
 # Absolutes in added prose are the claims a maintainer can falsify in one grep.
 claims=$(git diff -U0 "$base..HEAD" -- '*.md' '*.mdx' '*.rst' '*.txt' 2>/dev/null \
   | grep '^+' | grep -v '^+++' | sed 's/^+//' \
@@ -128,8 +157,8 @@ fi
 echo
 echo "commits:"
 git log --oneline "$base..HEAD" | sed 's/^/    /'
-echo "diff:"
-git diff --stat "$base..HEAD" | sed 's/^/    /'
+echo "diff (against the merge base, which is what the maintainer sees):"
+git diff --stat "$(git merge-base "$base" HEAD)..HEAD" | sed 's/^/    /'
 
 if [ "$blocked" -ne 0 ]; then
   echo

{housebroken_cli-0.4.0 → housebroken_cli-0.5.0}/scripts/file-pr.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# file-pr.sh - the only way a PR gets filed: gh pr create behind two gates.
+# file-pr.sh - the only way a PR gets filed: gh pr create behind three gates.
 #
 # Gate one is prior art. typer #1946 (closed 2026-08-31) duplicated an open PR
 # and swift-http-types #153 (closed 2026-09-04) reargued a closed issue, both
@@ -9,6 +9,10 @@
 # Gate two is the prose. Tool footers, session trailers and em or en dashes have
 # no place in somebody else's repository, so a body carrying one is refused.
 # Written 2026-09-07.
+# Gate three is the adversarial review (review.sh). A different model attacked
+# this exact head and this exact body file and said POST AS IS. An inline
+# --body is refused, because a review cannot be bound to text that was never a
+# file. Added 2026-09-12.
 #
 # Usage:
 #   bash file-pr.sh owner/repo <gh pr create args...>
@@ -39,6 +43,10 @@ gates:
               exist and be under 24 hours old
   prose       no tool footer, session trailer, co-author trailer, em dash or
               en dash in --body or --body-file
+  review      run from the clone being filed; the report at
+              $HOUSEBROKEN_HOME/reviews/review-<owner>-<repo>-<head12>.md must
+              pass review.sh check for this head and the --body-file, and an
+              inline --body is refused
 
 environment:
   HOUSEBROKEN_HOME  work directory, default $HOME/.housebroken
@@ -88,14 +96,18 @@ check_text() {
 }
 
 prev=""
+bodyfile=""
+inline_body=0
 for arg in "$@"; do
   case "$prev" in
     --body-file|-F)
       [ -f "$arg" ] || { echo "REFUSED: body file $arg does not exist" >&2; exit 2; }
       check_text "body file $arg" "$(cat "$arg")"
+      bodyfile="$arg"
       ;;
     --body|-b)
       check_text "--body" "$arg"
+      inline_body=1
       ;;
   esac
   case "$arg" in
@@ -103,12 +115,27 @@ for arg in "$@"; do
       f="${arg#--body-file=}"
       [ -f "$f" ] || { echo "REFUSED: body file $f does not exist" >&2; exit 2; }
       check_text "body file $f" "$(cat "$f")"
+      bodyfile="$f"
       ;;
-    --body=*) check_text "--body" "${arg#--body=}" ;;
+    --body=*) check_text "--body" "${arg#--body=}"; inline_body=1 ;;
   esac
   prev="$arg"
 done
 
+head=$(git rev-parse HEAD 2>/dev/null) || { echo "REFUSED: run file-pr.sh from inside the clone being filed" >&2; exit 2; }
+if [ "$inline_body" -eq 1 ]; then
+  echo "REFUSED: pass the body as --body-file so the review can be bound to it" >&2
+  exit 2
+fi
+review="$home/reviews/review-${repo%%/*}-${repo##*/}-${head:0:12}.md"
+if [ ! -f "$review" ]; then
+  echo "REFUSED: no adversarial review at $review - run review.sh brief and have a different model attack this head" >&2
+  exit 2
+fi
+review_args=(check "$review" --clone .)
+[ -n "$bodyfile" ] && review_args+=(--text "$bodyfile")
+bash "$(dirname "$0")/review.sh" "${review_args[@]}" >/dev/null || exit 2
+
 if [ "${FILE_PR_DRY:-0}" = "1" ]; then
   printf 'DRY RUN, not filed:\ngh pr create -R %s' "$repo"
   for arg in "$@"; do printf ' %q' "$arg"; done

housebroken_cli-0.5.0/scripts/review.sh

@@ -0,0 +1,263 @@
+#!/bin/bash
+# review.sh - the adversarial review: a different model attacks the change
+# before it leaves the machine, and the filing is held to exactly what it read.
+#
+# The gates before this one read code and count prose. None of them asks
+# whether the idea of the patch was complete, or whether a sentence is true,
+# and those are the defects that got furthest: a reply saying five new
+# static_asserts fail on main when four did, a new test file committed 100755
+# among 100644 siblings, a patch that removed behaviour the repository
+# documents. A second session's review caught each of them (docs/lessons.md,
+# 2026-09-10). Asked how a smaller model could catch what a larger one missed,
+# the ledger answered that it was the seat, not the model: the author had
+# decided the patch was good before writing the sentence. So the reviewer is
+# never the model that wrote the change. It is one tier down by default, which
+# costs less and still brings different blind spots, and never below Sonnet,
+# because a review has to be able to check a standard citation or a CI matrix:
+# Fable's work goes to Opus, Opus's to Sonnet, Sonnet's to Opus.
+#
+# A review that passed is not a proof. On 2026-09-12 a review passed a reply
+# packet whose author then found, re-reading, that the two functions it cited
+# as precedent compile only under MSVC. The author still re-reads every claim
+# the reviewer did not re-derive.
+#
+# The report is bound to what it read. Its header records the head it attacked
+# and the sha256 of every text, and check refuses when the branch or the text
+# has moved since, or when the verdict is anything but POST AS IS: a fix the
+# reviewer asked for is a new head, and a new head is reviewed again.
+#
+# Usage:
+#   bash review.sh reviewer MODEL
+#   bash review.sh brief --author MODEL --repo owner/repo [--reviewer MODEL]
+#                        [--clone DIR [--base REF]] [--text FILE]...
+#                        [--context FILE]...
+#   bash review.sh check REPORT [--clone DIR] [--text FILE]...
+#   bash review.sh --help
+#
+# reviewer  prints the model that reviews work written by MODEL.
+# brief     prints on stdout the brief to hand a fresh session running the
+#           reviewer model, and on stderr who that is and where its report
+#           goes: $HOUSEBROKEN_HOME/reviews/review-<owner>-<repo>-<key>.md,
+#           keyed by the clone's head, or by the first text's sha256 when there
+#           is no clone.
+# check     exits 0 when REPORT may gate a filing or a reply, 1 when it may
+#           not, with the reason on stderr, and 2 on a usage error.
+#
+# Environment:
+#   HOUSEBROKEN_HOME  work directory, default $HOME/.housebroken.
+#
+# Assumes git, and sha256sum or shasum.
+set -u
+
+usage() { awk 'NR>1 && /^#/ {sub(/^# ?/, ""); print; next} NR>1 {exit}' "$0"; }
+refuse() { echo "REFUSED: $1" >&2; exit 1; }
+bad_usage() { echo "review.sh: $1" >&2; exit 2; }
+
+home="${HOUSEBROKEN_HOME:-$HOME/.housebroken}"
+here=$(cd "$(dirname "$0")" && pwd)
+
+family() {
+  local m
+  m=$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')
+  case "$m" in
+    *fable*) echo fable ;;
+    *opus*) echo opus ;;
+    *sonnet*) echo sonnet ;;
+    *haiku*) echo haiku ;;
+    *) printf '%s\n' "$m" ;;
+  esac
+}
+
+# One tier down, never below sonnet. A family not listed has no default.
+default_reviewer() {
+  case "$1" in
+    fable) echo opus ;;
+    opus) echo sonnet ;;
+    sonnet) echo opus ;;
+    haiku) echo sonnet ;;
+  esac
+}
+
+# Prints why REVIEWER may not review AUTHOR's work, or nothing when it may.
+objection() {
+  if [ -z "$2" ]; then
+    echo "no reviewer model named"
+  elif [ "$2" = "$1" ]; then
+    echo "the reviewer is the model that wrote the change ($1)"
+  elif [ "$2" = haiku ]; then
+    echo "haiku is below the floor: a reviewer has to be able to check a standard citation or a CI matrix"
+  fi
+}
+
+sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  else
+    shasum -a 256 "$1" | awk '{print $1}'
+  fi
+}
+
+cmd_reviewer() {
+  [ "$#" -eq 1 ] || bad_usage "reviewer takes one model name"
+  local r
+  r=$(default_reviewer "$(family "$1")")
+  [ -n "$r" ] || bad_usage "no default reviewer for '$1'; name one with brief --reviewer: any model other than the author's, not below sonnet"
+  echo "$r"
+}
+
+cmd_brief() {
+  local author="" repo="" reviewer="" clone="" base="" head="" key="" mb="" t
+  local texts=() contexts=()
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --author) author="${2:-}"; shift ;;
+      --repo) repo="${2:-}"; shift ;;
+      --reviewer) reviewer="${2:-}"; shift ;;
+      --clone) clone="${2:-}"; shift ;;
+      --base) base="${2:-}"; shift ;;
+      --text) texts+=("${2:-}"); shift ;;
+      --context) contexts+=("${2:-}"); shift ;;
+      *) bad_usage "unknown argument: $1" ;;
+    esac
+    shift
+  done
+  [ -n "$author" ] || bad_usage "brief needs --author, the model that wrote the change"
+  case "$repo" in */*) : ;; *) bad_usage "brief needs --repo owner/repo" ;; esac
+  local ntext=${#texts[@]}
+  [ -n "$clone" ] || [ "$ntext" -gt 0 ] || bad_usage "brief needs --clone, --text, or both"
+  for t in ${texts[@]+"${texts[@]}"} ${contexts[@]+"${contexts[@]}"}; do
+    [ -f "$t" ] || bad_usage "$t does not exist"
+  done
+
+  local fa fr why
+  fa=$(family "$author")
+  if [ -n "$reviewer" ]; then fr=$(family "$reviewer"); else fr=$(default_reviewer "$fa"); fi
+  [ -n "$fr" ] || refuse "no default reviewer for '$author'; name one with --reviewer"
+  why=$(objection "$fa" "$fr")
+  [ -z "$why" ] || refuse "$why"
+  reviewer="${reviewer:-$fr}"
+
+  if [ -n "$clone" ]; then
+    head=$(git -C "$clone" rev-parse HEAD 2>/dev/null) || bad_usage "$clone is not a git clone"
+    if [ -z "$base" ]; then
+      for t in upstream/main upstream/master origin/main origin/master; do
+        if git -C "$clone" rev-parse --verify --quiet "$t" >/dev/null; then base="$t"; break; fi
+      done
+    fi
+    [ -n "$base" ] && mb=$(git -C "$clone" merge-base "$base" HEAD 2>/dev/null)
+    key="${head:0:12}"
+  else
+    key=$(sha256 "${texts[0]}" | cut -c1-12)
+  fi
+  local report="$home/reviews/review-${repo%%/*}-${repo##*/}-$key.md"
+  mkdir -p "$home/reviews"
+  echo "housebroken review: hand the brief below to a fresh session running $reviewer; its report goes to $report" >&2
+
+  printf 'ADVERSARIAL REVIEW BRIEF\n\n'
+  printf 'You are the reviewer. The change below was written by %s. You are %s, chosen because you did not write it. ' "$author" "$reviewer"
+  cat <<'EOF'
+Find what is wrong with it before a maintainer does. Assume there is at least one defect and hunt for it. A finding needs evidence you produced yourself: a command and its output, a quoted line of code, a quoted document. An impression is not a finding.
+
+Hard limits
+- Nothing leaves this machine: no git push; no gh pr create, comment, review or merge; no gh api call with -X POST, PATCH, PUT or DELETE, or with -f or -F fields. Read-only gh calls are fine.
+- Do not edit, commit in, or check out branches in the clone. To experiment, copy it and work in the copy. A copied build directory still points at the tree it was configured in, so reconfigure the build in the copy and make every arm's build log name the file that arm changed.
+- Do not edit the text under review. Write only your report.
+
+Under review
+EOF
+  printf -- '- repository: %s\n' "$repo"
+  if [ -n "$clone" ]; then
+    printf -- '- clone: %s at %s, the branch exactly as it will be filed\n' "$clone" "$head"
+    if [ -n "$mb" ]; then
+      printf -- '- what the maintainer sees: git -C %s diff %s..%s\n' "$clone" "$mb" "$head"
+      git -C "$clone" diff --stat "$mb..HEAD" | sed 's/^/    /'
+    else
+      printf -- '- no upstream base found in the clone: ask which ref the branch is filed against\n'
+    fi
+  fi
+  for t in ${texts[@]+"${texts[@]}"}; do
+    printf -- '- text: %s (sha256 %s)\n' "$t" "$(sha256 "$t")"
+  done
+  for t in ${contexts[@]+"${contexts[@]}"}; do
+    printf -- '- context from the author, to attack rather than trust: %s\n' "$t"
+  done
+
+  printf '\nAttack at least\n'
+  printf '1. Every claim the text makes, re-derived now against the exact revision it names.\n'
+  for t in ${texts[@]+"${texts[@]}"}; do
+    printf '   %s:\n' "$t"
+    bash "$here/claim-check.sh" "$t" | awk 'NF == 0 {exit} {print "   " $0}'
+  done
+  cat <<'EOF'
+2. The proof: the new test fails on the base and passes with the change. Swap file content with git show <base>:<path> rather than switching branches, compare hashes, and make sure the two arms differ. Ask what each step would print if it did nothing.
+3. The project's own CI, read from its workflow files: tests, lint, format, API and mutation checks, run on the change.
+4. Scope: every changed line is needed for what was asked, nothing is unrequested, no comment appears where the surrounding code has none, and documentation, README and CHANGELOG that describe the changed behaviour change with it.
+5. Prior art: nothing duplicates an open pull request or argues with a ruling in a closed issue.
+6. The text: it leads with the fact; no verdict on the reviewer, no thanks, apology or offer of help; a reply runs one to three sentences and a body stays under 120 words; no footer, trailer or typographic dash; every sentence is true as literally worded.
+7. Anything else that would embarrass the author in front of this maintainer.
+
+Report
+EOF
+  printf 'Write it to %s. It must start with exactly these lines, with the verdict filled in:\n\n' "$report"
+  printf 'review-of: %s\n' "$repo"
+  [ -n "$head" ] && printf 'head: %s\n' "$head"
+  for t in ${texts[@]+"${texts[@]}"}; do
+    printf 'text: sha256:%s %s\n' "$(sha256 "$t")" "$(basename "$t")"
+  done
+  printf 'author-model: %s\nreviewer-model: %s\n' "$author" "$reviewer"
+  printf 'verdict: POST AS IS | POST WITH CHANGES | DO NOT POST\n\n'
+  cat <<'EOF'
+POST AS IS means nothing BLOCKING or SHOULD FIX remains. POST WITH CHANGES means the author fixes what you found and the fixed version comes back for another review. DO NOT POST means it should not go at all. After the header, number your findings, each with a severity (BLOCKING, SHOULD FIX or NIT), the evidence, and the exact fix, with replacement text in full for any wording. A report with no findings says what was checked and how.
+EOF
+}
+
+cmd_check() {
+  local report="${1:-}" clone="" t
+  local texts=()
+  [ -n "$report" ] || bad_usage "check needs the report path"
+  shift
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --clone) clone="${2:-}"; shift ;;
+      --text) texts+=("${2:-}"); shift ;;
+      *) bad_usage "unknown argument: $1" ;;
+    esac
+    shift
+  done
+  [ -f "$report" ] || refuse "no review report at $report"
+
+  field() { sed -n "s/^$1: *//p" "$report" | head -1 | tr -d '\r' | sed 's/ *$//'; }
+  local author reviewer verdict head why now
+  author=$(field author-model)
+  reviewer=$(field reviewer-model)
+  verdict=$(field verdict | tr '[:lower:]' '[:upper:]')
+  head=$(field head)
+  [ -n "$author" ] || refuse "$report names no author-model"
+  why=$(objection "$(family "$author")" "$(family "$reviewer")")
+  [ -z "$why" ] || refuse "$why"
+  [ "$verdict" = "POST AS IS" ] ||
+    refuse "the verdict is '${verdict:-missing}' and only POST AS IS clears the gate: fix what the review found and review the new version"
+
+  if [ -n "$clone" ]; then
+    now=$(git -C "$clone" rev-parse HEAD 2>/dev/null) || bad_usage "$clone is not a git clone"
+    [ -n "$head" ] || refuse "$report records no head, so it cannot clear a branch"
+    if [ "${#head}" -lt 12 ] || [ "${now#"$head"}" = "$now" ]; then
+      refuse "the branch moved after the review: it attacked ${head:0:12}, the clone is at ${now:0:12}"
+    fi
+  fi
+  for t in ${texts[@]+"${texts[@]}"}; do
+    [ -f "$t" ] || bad_usage "$t does not exist"
+    grep -q "^text: sha256:$(sha256 "$t")" "$report" ||
+      refuse "$t is not the text that was reviewed: its sha256 is not in $report"
+  done
+  echo "review: POST AS IS by $reviewer on work by $author${head:+ at ${head:0:12}}"
+}
+
+case "${1:-}" in
+  --help|-h) usage; exit 0 ;;
+  reviewer) shift; cmd_reviewer "$@" ;;
+  brief) shift; cmd_brief "$@" ;;
+  check) shift; cmd_check "$@" ;;
+  "") usage >&2; exit 2 ;;
+  *) bad_usage "unknown subcommand: $1 (reviewer, brief or check)" ;;
+esac

{housebroken_cli-0.4.0 → housebroken_cli-0.5.0}/skills/housebroken/SKILL.md

@@ -140,15 +140,26 @@ report it in one line and do not proceed to the next step.
 
 9. **File through the gate.**
    `housebroken branch <clone>` first. It refuses a dirty working tree, a file
-   whose mode disagrees with its own siblings, a committed file the repository
-   ignores, and a branch that is not on top of its base, and it prints every
-   absolute claim your added prose makes so you can falsify each one against
-   the code. Then
+   whose mode disagrees with its own siblings, a file the branch adds that the
+   repository ignores, a commit carrying a tool trailer or a session link, a
+   sign-off that names a username, and a branch that is not on top of its
+   base, and it prints every absolute claim your added prose makes so you can
+   falsify each one against the code. Then the adversarial review:
+   `housebroken review brief --author <your model> --repo owner/repo --clone <clone> --text <body file>`
+   names the reviewer and prints its brief. The reviewer is never the model
+   that wrote the change: one tier down, Fable to Opus and Opus to Sonnet,
+   and never below Sonnet, so Sonnet's work goes to Opus. Hand the brief to a
+   fresh agent running that model; anything of yours it reads is for it to
+   attack, not to trust. It writes its report where the brief says, with its
+   own evidence behind every finding. Every fix it asks for is a new head,
+   and a new head is reviewed again. When it passes, re-read every claim it
+   did not re-derive itself: a passed review is not a proof. Then
    `housebroken file owner/repo --title ... --body-file ...`, the only way a
    pull request is opened. Never run the pull request creation command
    directly. The gate refuses when the prior-art printout for that repository
-   is missing or older than a day, or when the body carries a footer, a
-   trailer or a dash character. A refusal is a result; fix the cause.
+   is missing or older than a day, when the body carries a footer, a trailer
+   or a dash character, or when there is no POST AS IS review of the exact
+   head and body being filed. A refusal is a result; fix the cause.
 
 10. **Watch it land.**
     `housebroken verify owner/repo PR` re-derives from GitHub that the head is
@@ -163,7 +174,10 @@ report it in one line and do not proceed to the next step.
     `housebroken inbox --ack`. Answer every maintainer comment the same day,
     in the user's voice, and run `housebroken claims` over the reply before
     it is posted: the only claim that has gone out wrong here was in a
-    reply, not a body. Rework what is asked for as a second commit so the reviewer sees
+    reply, not a body. A reply that concedes a point, disagrees, or rides on
+    a code change goes through the adversarial review of step 9 first, with
+    the reply as its `--text`, and `housebroken review check <report> --text
+    <reply file>` must pass before it is posted. Rework what is asked for as a second commit so the reviewer sees
     the change. When the maintainer is
     right, concede in one sentence and let them close it. Never nudge a
     silent maintainer without the user's explicit word. After answering a
@@ -213,8 +227,9 @@ report it in one line and do not proceed to the next step.
 ## What you say to the user
 
 Before filing: the repository, the finding in one sentence, the prior-art
-result in one sentence, the red-then-green result, the agreement the
-organization wants, and the exact command you are about to run. After
+result in one sentence, the red-then-green result, the review's verdict and
+the model that gave it, the agreement the organization wants, and the exact
+command you are about to run. After
 filing: the pull request URL and the verify result. At the end of the run:
 what went into the ledger, or that nothing did. On a refusal at any
 step: which step, and the one sentence that explains it.
@@ -225,4 +240,5 @@ Never open a pull request without the prior-art printout. Never argue with a
 ruling in a closed issue. Never file where the policy asks you not to. Never
 put a footer, a session link or a co-author trailer on anything that leaves
 the user's repositories. Never post a comment upstream that the user has not
-seen. Never claim a test ran that you did not run.
+seen. Never file a change a different model has not attacked. Never claim a
+test ran that you did not run.

housebroken_cli-0.5.0/src/housebroken/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.0"

housebroken_cli-0.4.0/src/housebroken/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.2.1"