housebroken-cli 0.7.0__tar.gz → 0.8.0__tar.gz

{housebroken_cli-0.7.0 → housebroken_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: housebroken-cli
-Version: 0.7.0
+Version: 0.8.0
 Summary: Agent-written pull requests that do not make a mess in someone else's house.
 Project-URL: Repository, https://github.com/lenamonj/housebroken
 License-Expression: MIT
@@ -61,7 +61,7 @@ A pull request passes through the door in order, and stops at the first rule it
 A change that rejects an input the project tolerated, changes a default, or narrows what the project publishes is the maintainer's call. It is sent with the call stated in the body: what breaks for existing users, and an offer to narrow or close it. A finding whose only evidence is a measurement is a hold, not a pull request.
 
 **4. Prove it red first, and prove the proof.**
-On a fresh clone of the upstream default branch, the new test fails; with the patch, it passes. Every arm of the experiment prints evidence that its precondition held, files are swapped by content and checked by hash, and two arms that agree exactly have not tested the variable.
+On a fresh clone of the upstream default branch, the new test fails; with the patch, it passes. Every arm of the experiment prints evidence that its precondition held, files are swapped by content and checked by hash, and two arms that agree exactly have not tested the variable. `proof.sh` runs the experiment itself: the test on the head, then on the head with every changed non-test file swapped back to its content at the merge base, then the head restored and checked by hash, and it stamps the head only when the base arm fails and the head arm passes. A change with nothing to show red says so, with the reason, and the filing prints it.
 
 **5. Run their CI, not yours.**
 The project's own test target on the fresh clone, and every gate its pull request workflow runs: lint, format, mutation, API check. A gate not run is a red check the maintainer sees first.
@@ -77,8 +77,8 @@ A memory-safety, remote-abort, injection or path-escape finding goes by the proj
 
 **9. File through the gate.**
 `branch-check.sh` refuses a dirty working tree, a file whose mode disagrees with its siblings, a file the repository's own `.gitignore` excludes, a working artifact, a commit carrying a tool trailer, a session link or a tool identity, a sign-off naming a username, a branch not on top of its base, any comment added to code, a warning suppression that does not name what it hides or that no build log shows firing, reflection added to a .NET project that declares AOT or trim support without an AOT publish log of it, a credential or a path under your own home, a lockfile, generated file or binary nobody named, an agent's working file, and a file rewritten for its line endings; it notes a base the upstream has moved past, a user path that may be a fixture and every absolute claim in added prose, and stamps the head it passed.
-`review.sh` names the adversarial reviewer: a different model from the one that wrote the change, one tier down, never below Sonnet. The reviewer gets a fresh context, hard read-only limits, and before it reads the diff it writes its own fix from the bug alone, so it is not anchored on ours; the report names that fix as a diff and the gate refuses one that does not, a POST AS IS over an open BLOCKING or SHOULD FIX finding, and a POST AS IS over items the reviewer skipped. Its attack list starts with every claim the prose makes and includes the form of the code: the reviewer writes the changed block the way the strongest engineer in that language would, in the repository's own idioms, and a smaller or clearer version is a finding; every finding carries evidence it produced itself, and its report is bound to the head and the text it read. A fix is a new head and gets a new review.
-`file-pr.sh` is the only way a pull request is opened. It refuses without a prior-art printout under a day old that searched every file the branch changes, a policy printout under a day old that reads neither BAN nor UNREAD, a body that discloses when the policy asks and runs under 120 words of its own beside the project's template, a branch stamp for the exact head whose base the upstream has not since changed under the branch's files, a POST AS IS review of that head and that body, fewer than three open pull requests of yours on the repository, and ten minutes since the last.
+`review.sh` names the adversarial reviewer: a different model from the one that wrote the change, one tier down, never below Sonnet. Before it runs, the author writes a declaration (`declare.sh`): what the change was not tested against, and every assumption with what breaks if it is wrong and how it was checked. "Nothing" is refused as an answer. The review reads the declaration as one of its texts and attacks each line. The reviewer gets a fresh context, hard read-only limits, and before it reads the diff it writes its own fix from the bug alone, so it is not anchored on ours; the report names that fix as a diff and the gate refuses one that does not, a POST AS IS over an open BLOCKING or SHOULD FIX finding, and a POST AS IS over items the reviewer skipped. Its attack list starts with every claim the prose makes and includes the form of the code: the reviewer writes the changed block the way the strongest engineer in that language would, in the repository's own idioms, and a smaller or clearer version is a finding; every finding carries evidence it produced itself, and its report is bound to the head and the text it read. A fix is a new head and gets a new review.
+`file-pr.sh` is the only way a pull request is opened. It refuses without a prior-art printout under a day old that searched every file the branch changes, a policy printout under a day old that reads neither BAN nor UNREAD, a body that discloses when the policy asks and runs under 120 words of its own beside the project's template, a branch stamp for the exact head whose base the upstream has not since changed under the branch's files, a proof stamp for that head, a declaration that passes, a POST AS IS review of that head, that body and that declaration, fewer than three open pull requests of yours on the repository, and ten minutes since the last.
 `file-issue.sh` is the only way an issue is opened. It refuses without the same prior-art and policy printouts, refuses the same prose, and refuses a body that mentions a fix, a patch or a pull request without a GitHub link to the branch or commit, so work that exists is attributable to whoever did it.
 
 **10. Watch it land.**
@@ -121,6 +121,8 @@ uv tool install git+https://github.com/lenamonj/housebroken
 | `scripts/comment-census.sh` | added code versus added comments, per branch |
 | `scripts/diff-defaults.sh` | default arguments and one-line wrappers added to keep call sites untouched |
 | `scripts/claim-check.sh` | every falsifiable claim in a body or a reply, listed to re-derive |
+| `scripts/proof.sh` | the red-first experiment, run and stamped: red on the base, green on the head |
+| `scripts/declare.sh` | what was not tested and what was assumed, for the review to attack |
 | `scripts/ref-check.sh` | every issue, link, test, file and commit a body names, looked up |
 | `scripts/branch-check.sh` | the branch's mechanical facts: clean tree, live base, modes, artifacts, secrets, generated files, trailers, sign-offs, comments, suppressions, absolute claims |
 | `scripts/review.sh` | the adversarial review: a different model attacks the change, and the filing is held to exactly what it read |

{housebroken_cli-0.7.0 → housebroken_cli-0.8.0}/README.md

@@ -49,7 +49,7 @@ A pull request passes through the door in order, and stops at the first rule it
 A change that rejects an input the project tolerated, changes a default, or narrows what the project publishes is the maintainer's call. It is sent with the call stated in the body: what breaks for existing users, and an offer to narrow or close it. A finding whose only evidence is a measurement is a hold, not a pull request.
 
 **4. Prove it red first, and prove the proof.**
-On a fresh clone of the upstream default branch, the new test fails; with the patch, it passes. Every arm of the experiment prints evidence that its precondition held, files are swapped by content and checked by hash, and two arms that agree exactly have not tested the variable.
+On a fresh clone of the upstream default branch, the new test fails; with the patch, it passes. Every arm of the experiment prints evidence that its precondition held, files are swapped by content and checked by hash, and two arms that agree exactly have not tested the variable. `proof.sh` runs the experiment itself: the test on the head, then on the head with every changed non-test file swapped back to its content at the merge base, then the head restored and checked by hash, and it stamps the head only when the base arm fails and the head arm passes. A change with nothing to show red says so, with the reason, and the filing prints it.
 
 **5. Run their CI, not yours.**
 The project's own test target on the fresh clone, and every gate its pull request workflow runs: lint, format, mutation, API check. A gate not run is a red check the maintainer sees first.
@@ -65,8 +65,8 @@ A memory-safety, remote-abort, injection or path-escape finding goes by the proj
 
 **9. File through the gate.**
 `branch-check.sh` refuses a dirty working tree, a file whose mode disagrees with its siblings, a file the repository's own `.gitignore` excludes, a working artifact, a commit carrying a tool trailer, a session link or a tool identity, a sign-off naming a username, a branch not on top of its base, any comment added to code, a warning suppression that does not name what it hides or that no build log shows firing, reflection added to a .NET project that declares AOT or trim support without an AOT publish log of it, a credential or a path under your own home, a lockfile, generated file or binary nobody named, an agent's working file, and a file rewritten for its line endings; it notes a base the upstream has moved past, a user path that may be a fixture and every absolute claim in added prose, and stamps the head it passed.
-`review.sh` names the adversarial reviewer: a different model from the one that wrote the change, one tier down, never below Sonnet. The reviewer gets a fresh context, hard read-only limits, and before it reads the diff it writes its own fix from the bug alone, so it is not anchored on ours; the report names that fix as a diff and the gate refuses one that does not, a POST AS IS over an open BLOCKING or SHOULD FIX finding, and a POST AS IS over items the reviewer skipped. Its attack list starts with every claim the prose makes and includes the form of the code: the reviewer writes the changed block the way the strongest engineer in that language would, in the repository's own idioms, and a smaller or clearer version is a finding; every finding carries evidence it produced itself, and its report is bound to the head and the text it read. A fix is a new head and gets a new review.
-`file-pr.sh` is the only way a pull request is opened. It refuses without a prior-art printout under a day old that searched every file the branch changes, a policy printout under a day old that reads neither BAN nor UNREAD, a body that discloses when the policy asks and runs under 120 words of its own beside the project's template, a branch stamp for the exact head whose base the upstream has not since changed under the branch's files, a POST AS IS review of that head and that body, fewer than three open pull requests of yours on the repository, and ten minutes since the last.
+`review.sh` names the adversarial reviewer: a different model from the one that wrote the change, one tier down, never below Sonnet. Before it runs, the author writes a declaration (`declare.sh`): what the change was not tested against, and every assumption with what breaks if it is wrong and how it was checked. "Nothing" is refused as an answer. The review reads the declaration as one of its texts and attacks each line. The reviewer gets a fresh context, hard read-only limits, and before it reads the diff it writes its own fix from the bug alone, so it is not anchored on ours; the report names that fix as a diff and the gate refuses one that does not, a POST AS IS over an open BLOCKING or SHOULD FIX finding, and a POST AS IS over items the reviewer skipped. Its attack list starts with every claim the prose makes and includes the form of the code: the reviewer writes the changed block the way the strongest engineer in that language would, in the repository's own idioms, and a smaller or clearer version is a finding; every finding carries evidence it produced itself, and its report is bound to the head and the text it read. A fix is a new head and gets a new review.
+`file-pr.sh` is the only way a pull request is opened. It refuses without a prior-art printout under a day old that searched every file the branch changes, a policy printout under a day old that reads neither BAN nor UNREAD, a body that discloses when the policy asks and runs under 120 words of its own beside the project's template, a branch stamp for the exact head whose base the upstream has not since changed under the branch's files, a proof stamp for that head, a declaration that passes, a POST AS IS review of that head, that body and that declaration, fewer than three open pull requests of yours on the repository, and ten minutes since the last.
 `file-issue.sh` is the only way an issue is opened. It refuses without the same prior-art and policy printouts, refuses the same prose, and refuses a body that mentions a fix, a patch or a pull request without a GitHub link to the branch or commit, so work that exists is attributable to whoever did it.
 
 **10. Watch it land.**
@@ -109,6 +109,8 @@ uv tool install git+https://github.com/lenamonj/housebroken
 | `scripts/comment-census.sh` | added code versus added comments, per branch |
 | `scripts/diff-defaults.sh` | default arguments and one-line wrappers added to keep call sites untouched |
 | `scripts/claim-check.sh` | every falsifiable claim in a body or a reply, listed to re-derive |
+| `scripts/proof.sh` | the red-first experiment, run and stamped: red on the base, green on the head |
+| `scripts/declare.sh` | what was not tested and what was assumed, for the review to attack |
 | `scripts/ref-check.sh` | every issue, link, test, file and commit a body names, looked up |
 | `scripts/branch-check.sh` | the branch's mechanical facts: clean tree, live base, modes, artifacts, secrets, generated files, trailers, sign-offs, comments, suppressions, absolute claims |
 | `scripts/review.sh` | the adversarial review: a different model attacks the change, and the filing is held to exactly what it read |

{housebroken_cli-0.7.0 → housebroken_cli-0.8.0}/bin/housebroken

@@ -47,11 +47,13 @@ usage: housebroken <subcommand> [args...]
   1  policy      read the repository's AI-contribution policy where it lives
   1  outside     count outside contributors merged in the last 120 days
   2  prior-art   issues and pull requests on the touched files, rulings quoted
+  4  proof       run the test on the base and the head, and stamp red then green
   6  census      added code lines against added comment lines, per branch
   6  comments    refuse a comment added to code nobody asked for
   6  claims      every falsifiable claim in outbound text, listed to re-derive
   6  refs        every issue, link, test, file and commit the text names, looked up
   9  branch      the mechanical facts about the branch: tree, modes, artifacts, claims
+  9  declare     what was not tested and what was assumed, for the review to attack
   9  review      a different model attacks the change before it is filed
   9  file        the only way a pull request gets filed
   9  issue       the only way an issue gets filed
@@ -98,6 +100,8 @@ case "$cmd" in
   comments)  script=comment-check.sh ;;
   claims)    script=claim-check.sh ;;
   refs)      script=ref-check.sh ;;
+  proof)     script=proof.sh ;;
+  declare)   script=declare.sh ;;
   branch)    script=branch-check.sh ;;
   review)    script=review.sh ;;
   file)      script=file-pr.sh ;;

{housebroken_cli-0.7.0 → housebroken_cli-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "housebroken-cli"
-version = "0.7.0"
+version = "0.8.0"
 description = "Agent-written pull requests that do not make a mess in someone else's house."
 dynamic = ["readme"]
 license = "MIT"

housebroken_cli-0.8.0/scripts/declare.sh

@@ -0,0 +1,90 @@
+#!/bin/bash
+# declare.sh - the author says what was not tested and what was assumed.
+#
+# A review attacks what it is shown. The gaps an author knows about and does
+# not mention are the ones a maintainer finds: the mode that was never run,
+# the comparer that was assumed to be the default, the caller that was
+# assumed not to exist. The declaration names them before the review, so
+# the reviewer can attack each one and a gap left out becomes a statement
+# that was false, not an oversight.
+#
+# The first run writes a declaration for the clone's head and prints its
+# path; fill it in. Later runs check it:
+#   not-tested:   what this change was not run against, at least one line;
+#                 "none" is refused, because something always was not
+#   assumptions:  one line each, "- <assumption> | if wrong: <what breaks,
+#                 for whom> | checked by: <the command and its result, or
+#                 unchecked>"
+#
+# Pass the declaration to the review as a --text, so the reviewer attacks it
+# and the review is bound to it. file-pr.sh requires a passing declaration
+# for the head, and that the review read it.
+#
+# Usage:
+#   bash declare.sh [CLONE]
+#   bash declare.sh --help
+#
+# Writes or reads $HOUSEBROKEN_HOME/declarations/<head>.md. Exits 0 when the
+# declaration passes, 1 when it was just written or does not pass, 2 on a
+# usage error.
+set -u
+
+usage() { awk 'NR>1 && /^#/ {sub(/^# ?/, ""); print; next} NR>1 {exit}' "$0"; }
+
+case "${1:-}" in
+  --help|-h) usage; exit 0 ;;
+  -*) echo "REFUSED: unknown option $1" >&2; exit 2 ;;
+esac
+clone="${1:-.}"
+head=$(git -C "$clone" rev-parse HEAD 2>/dev/null) || { echo "REFUSED: $clone is not a git clone" >&2; exit 2; }
+home="${HOUSEBROKEN_HOME:-$HOME/.housebroken}"
+decl="$home/declarations/$head.md"
+
+if [ ! -f "$decl" ]; then
+  mkdir -p "$home/declarations"
+  cat > "$decl" <<EOF
+head: $head
+
+not-tested:
+-
+
+assumptions:
+- <assumption> | if wrong: <what breaks, for whom> | checked by: <command and result, or unchecked>
+EOF
+  echo "declare: fill in $decl, then run this again"
+  exit 1
+fi
+
+bad=""
+tr -d '\r' < "$decl" | grep -q "^head: $head\$" || bad="$bad
+    the head line is not $head"
+section() { tr -d '\r' < "$decl" | awk -v s="$1:" '$0 == s {on = 1; next} /^[a-z-]+:/ {on = 0} on && /^- */ {sub(/^- */, ""); print}' | sed 's/[[:space:]]*$//' | grep -v '^$'; }
+nt=$(section not-tested)
+if [ -z "$nt" ]; then
+  bad="$bad
+    not-tested: names nothing; one line per item, each starting with '- '"
+elif printf '%s\n' "$nt" | grep -qixE 'none\.?|n/a|nothing\.?'; then
+  bad="$bad
+    not-tested: says none; something always was not tested"
+fi
+as=$(section assumptions)
+[ -n "$as" ] || bad="$bad
+    assumptions: lists none"
+while IFS= read -r a; do
+  [ -n "$a" ] || continue
+  case "$a" in
+    *"<assumption>"*|*"<what breaks"*|*"<command and result"*) bad="$bad
+    an assumption is still the template line" ;;
+    *"| if wrong: "*"| checked by: "*) ;;
+    *) bad="$bad
+    an assumption lacks '| if wrong: ... | checked by: ...': $a" ;;
+  esac
+done <<EOF
+$as
+EOF
+
+if [ -n "$bad" ]; then
+  echo "REFUSED: $decl does not pass:$bad"
+  exit 1
+fi
+echo "declare: $decl passes ($(printf '%s\n' "$nt" | grep -c .) not tested, $(printf '%s\n' "$as" | grep -c .) assumptions)"

{housebroken_cli-0.7.0 → housebroken_cli-0.8.0}/scripts/file-pr.sh

@@ -263,12 +263,41 @@ if [ "$since" -lt 600 ]; then
   echo "REFUSED: your last pull request on $repo was filed ${since}s ago - wait until ten minutes have passed" >&2
   exit 2
 fi
+# The experiment the body describes was run by proof.sh, not recounted, and
+# against the base branch-check measured; the author's declaration of what
+# was not tested passes and names a proof that was waived; and the review
+# read the declaration. Proof and declaration come before the review because
+# the review is bound to the declaration.
+proof="$home/proofs/$head"
+if [ ! -f "$proof" ]; then
+  echo "REFUSED: no proof for head ${head:0:12} - run proof.sh --test 'COMMAND', or --none 'REASON' when nothing can fail first" >&2
+  exit 2
+fi
+decl="$home/declarations/$head.md"
+if ! declared=$(bash "$(dirname "$0")/declare.sh" . 2>&1); then
+  echo "$declared" >&2
+  exit 2
+fi
+if grep -q '^proof: none' "$proof"; then
+  reason=$(sed -n 's/^reason: //p' "$proof" | tr -d '\r')
+  if ! grep -qF -- "$reason" "$decl"; then
+    echo "REFUSED: the proof for ${head:0:12} is none ($reason) and the declaration does not say so - add it under not-tested, so the reviewer attacks it" >&2
+    exit 2
+  fi
+  echo "note: no red-green proof for ${head:0:12}: $reason" >&2
+else
+  proved=$(sed -n 's/^base: //p' "$proof" | tr -d '\r')
+  if [ "$proved" != "$stamped" ]; then
+    echo "REFUSED: the proof for ${head:0:12} ran against base ${proved:0:12}, branch-check measured ${stamped:0:12} - rerun proof.sh --base $checked" >&2
+    exit 2
+  fi
+fi
 review="$home/reviews/review-${repo%%/*}-${repo##*/}-${head:0:12}.md"
 if [ ! -f "$review" ]; then
-  echo "REFUSED: no adversarial review at $review - run review.sh brief and have a different model attack this head" >&2
+  echo "REFUSED: no adversarial review at $review - run review.sh brief with --text $decl and have a different model attack this head" >&2
   exit 2
 fi
-bash "$(dirname "$0")/review.sh" check "$review" --clone . --text "$bodyfile" >/dev/null || exit 2
+bash "$(dirname "$0")/review.sh" check "$review" --clone . --text "$bodyfile" --text "$decl" >/dev/null || exit 2
 
 if [ "${FILE_PR_DRY:-0}" = "1" ]; then
   printf 'DRY RUN, not filed:\ngh pr create -R %s' "$repo"

housebroken_cli-0.8.0/scripts/proof.sh

@@ -0,0 +1,204 @@
+#!/bin/bash
+# proof.sh - run the red-first experiment and stamp what it showed.
+#
+# "The new test fails on main and passes with the patch" is the claim every
+# pull request rests on, and the ledger has five runs that reported it while
+# seeing nothing: a worktree whose checkout did nothing, a refused checkout
+# that left the patch in place, a soft reset, a filtered count, a test that
+# never compiled. This runs the experiment itself. On the clone's head it
+# runs the test command; then it swaps every changed file that is not a test
+# back to its content at the merge base, by content and checked by hash, so
+# the tests stay and the fix goes; runs the command again; and restores the
+# head from the commit, checked by hash. The stamp is written only when the
+# base arm fails, the head arm passes, and the two arms ran different code.
+#
+# A change with nothing to prove red, a documentation fix or a refactor
+# whose behaviour the existing suite already pins, says so with --none and a
+# reason; the stamp records the reason and the filing prints it.
+#
+# Usage:
+#   bash proof.sh [CLONE] --test 'COMMAND' [--base REF] [--keep PATH]...
+#                 [--fix PATH]... [--base-file PATH=FILE]...
+#   bash proof.sh [CLONE] --none 'REASON'
+#   bash proof.sh --help
+#
+# CLONE defaults to the current directory. REF defaults to the base the
+# branch-check stamp for the head names, then to the first of upstream/main,
+# upstream/master, origin/main and origin/master that resolves. COMMAND runs
+# with bash -c from the clone's top; name the new test in it so the run is
+# that test, not the whole suite. A changed file is taken for a test when its
+# path says test or spec; --keep PATH keeps another changed file at the head
+# in the base arm, such as a fixture the test reads; --fix PATH takes a file
+# away although its path says test, such as src/testing/util.go. When one
+# file carries both the test and the fix, a Rust module with its #[cfg(test)]
+# block, --base-file PATH=FILE puts FILE's content, the base plus the test,
+# at PATH in the base arm.
+#
+# Writes $HOUSEBROKEN_HOME/proofs/<head>, which file-pr.sh requires.
+# Exits 0 when the stamp is written, 1 when the experiment does not show the
+# fix, 2 on a usage error or when the clone cannot be swapped safely.
+set -u
+
+usage() { awk 'NR>1 && /^#/ {sub(/^# ?/, ""); print; next} NR>1 {exit}' "$0"; }
+
+home="${HOUSEBROKEN_HOME:-$HOME/.housebroken}"
+clone="."; cmd=""; none=""; base=""
+keeps=(); forces=(); basefiles=()
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --help|-h) usage; exit 0 ;;
+    --test) cmd="${2:-}"; [ -n "$cmd" ] || { echo "REFUSED: --test needs the command" >&2; exit 2; }; shift ;;
+    --none) none="${2:-}"; [ -n "$none" ] || { echo "REFUSED: --none needs the reason" >&2; exit 2; }; shift ;;
+    --base) base="${2:-}"; [ -n "$base" ] || { echo "REFUSED: --base needs a ref" >&2; exit 2; }; shift ;;
+    --keep) [ -n "${2:-}" ] || { echo "REFUSED: --keep needs a path" >&2; exit 2; }; keeps+=("$2"); shift ;;
+    --fix) [ -n "${2:-}" ] || { echo "REFUSED: --fix needs a path" >&2; exit 2; }; forces+=("$2"); shift ;;
+    --base-file)
+      case "${2:-}" in ?*=?*) ;; *) echo "REFUSED: --base-file needs PATH=FILE" >&2; exit 2 ;; esac
+      [ -f "${2#*=}" ] || { echo "REFUSED: --base-file: ${2#*=} does not exist" >&2; exit 2; }
+      basefiles+=("$2"); shift ;;
+    -*) echo "REFUSED: unknown option $1" >&2; exit 2 ;;
+    *) clone="$1" ;;
+  esac
+  shift
+done
+[ -n "$cmd" ] || [ -n "$none" ] || { echo "REFUSED: pass --test 'COMMAND', or --none 'REASON'" >&2; exit 2; }
+[ -z "$cmd" ] || [ -z "$none" ] || { echo "REFUSED: --test and --none are exclusive" >&2; exit 2; }
+if ! top=$(git -C "$clone" rev-parse --show-toplevel 2>/dev/null) || ! cd "$top"; then
+  echo "REFUSED: $clone is not a git clone" >&2
+  exit 2
+fi
+head=$(git rev-parse HEAD)
+mkdir -p "$home/proofs"
+stamp="$home/proofs/$head"
+when=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+if [ -n "$none" ]; then
+  printf 'head: %s\nproof: none\nreason: %s\nchecked: %s\n' "$head" "$none" "$when" > "$stamp"
+  echo "proof: none recorded for ${head:0:12}: $none"
+  exit 0
+fi
+
+[ -z "$(git status --porcelain)" ] || { echo "REFUSED: the working tree is dirty, so the arms would not be the commits; after a proof run that was killed, git checkout -- . puts the head back" >&2; exit 2; }
+[ -n "$base" ] || base=$(sed -n 's/^base-ref: //p' "$home/branch-checks/$head" 2>/dev/null | tr -d '\r')
+if [ -z "$base" ]; then
+  for candidate in upstream/main upstream/master origin/main origin/master; do
+    if git rev-parse --verify -q "$candidate" >/dev/null 2>&1; then base="$candidate"; break; fi
+  done
+fi
+[ -n "$base" ] || { echo "REFUSED: no --base, no branch-check stamp for ${head:0:12} to read it from, and no upstream or origin main or master" >&2; exit 2; }
+mb=$(git merge-base "$base" HEAD 2>/dev/null) || { echo "REFUSED: $base and HEAD share no history" >&2; exit 2; }
+
+listed() { local n="$1" k; shift; for k in "$@"; do [ "$n" = "$k" ] && return 0; done; return 1; }
+base_file_for() { local e; for e in ${basefiles[@]+"${basefiles[@]}"}; do case "$e" in "$1="*) printf '%s' "${e#*=}"; return 0 ;; esac; done; return 1; }
+mode_in() { git ls-tree "$1" -- "$2" | cut -c1-6; }
+# Renames are read as the delete and the add they are, so the base arm gets
+# the old path back; quotePath off, so a non-ASCII path is the path.
+changed=$(git -c core.quotePath=false diff --name-only --no-renames "$mb" HEAD)
+for p in ${keeps[@]+"${keeps[@]}"} ${forces[@]+"${forces[@]}"} ${basefiles[@]+"${basefiles[@]%%=*}"}; do
+  printf '%s\n' "$changed" | grep -qxF -- "$p" || { echo "REFUSED: $p is not a file this branch changes (paths are as git diff --name-only prints them)" >&2; exit 2; }
+done
+fixes=(); kept=()
+while IFS= read -r f; do
+  [ -n "$f" ] || continue
+  if listed "$f" ${keeps[@]+"${keeps[@]}"}; then kept+=("$f"); continue; fi
+  if ! listed "$f" ${forces[@]+"${forces[@]}"}; then
+    case "$f" in *test*|*Test*|*spec*) kept+=("$f"); continue ;; esac
+  fi
+  for t in HEAD "$mb"; do
+    case "$(mode_in "$t" "$f")" in
+      100644|100755|"") ;;
+      *) echo "REFUSED: $f is not a regular file in $t (a symlink, a submodule or a directory); the experiment swaps regular files only" >&2; exit 2 ;;
+    esac
+  done
+  fixes+=("$f")
+done <<EOF
+$changed
+EOF
+if [ "${#fixes[@]}" -eq 0 ]; then
+  echo "REFUSED: every changed file is a test or kept (${kept[*]}); there is no fix to take away - --fix PATH takes one away although its path says test" >&2
+  exit 2
+fi
+echo "proof: taking away ${#fixes[@]} file(s): ${fixes[*]}${kept[0]:+; keeping ${#kept[@]} at the head: ${kept[*]}}"
+
+hash_of() { if [ -f "$1" ]; then git hash-object -- "$1"; else echo absent; fi; }
+hashes() { local f; for f in "${fixes[@]}"; do printf '%s %s\n' "$(hash_of "$f")" "$f"; done; }
+run_arm() { # label -> rc in arm_rc, output tail in arm_out
+  arm_out=$(bash -c "$cmd" 2>&1); arm_rc=$?
+  arm_out=$(printf '%s\n' "$arm_out" | tail -15)
+  echo "== $1 arm: exit $arm_rc"
+  printf '%s\n' "$arm_out" | sed 's/^/    /'
+}
+
+head_hashes=$(hashes)
+run_arm head
+head_rc=$arm_rc; head_out=$arm_out
+
+# The base arm: each fix file by its content at the merge base, through the
+# clone's own filters so line endings are what a checkout gives, or gone
+# when the branch added it. The restore below runs whatever happens in
+# between. It restores from the commit, not the index: the tree was clean,
+# so the two agree, and the commit brings the mode and the line endings back
+# with the content, which a plain write does not.
+restore() {
+  local f
+  for f in "${fixes[@]}"; do
+    if git cat-file -e "HEAD:./$f" 2>/dev/null; then
+      git checkout -q HEAD -- "$f"
+    else
+      rm -f -- "$f"
+    fi
+  done
+}
+trap restore EXIT
+for f in "${fixes[@]}"; do
+  if bf=$(base_file_for "$f"); then
+    cat "$bf" > "$f"
+  elif git cat-file -e "$mb:./$f" 2>/dev/null; then
+    mkdir -p "$(dirname "$f")" && git cat-file --filters "$mb:./$f" > "$f"
+    [ "$(mode_in "$mb" "$f")" != 100755 ] || chmod +x "$f"
+  else
+    rm -f -- "$f"
+  fi
+done
+base_hashes=$(hashes)
+run_arm base
+base_rc=$arm_rc; base_out=$arm_out
+restore
+trap - EXIT
+
+if [ "$(hashes)" != "$head_hashes" ]; then
+  echo "REFUSED: the head did not come back byte for byte; check the clone before anything else:" >&2
+  diff <(printf '%s\n' "$head_hashes") <(hashes) | sed 's/^/    /' >&2
+  exit 2
+fi
+dirt=$(git status --porcelain --untracked-files=no)
+if [ -n "$dirt" ]; then
+  echo "REFUSED: the test command changed tracked files; restore them with git checkout -- <path>, then make the command leave the tree alone or commit what it generates:" >&2
+  printf '%s\n' "$dirt" | sed 's/^/    /' >&2
+  exit 2
+fi
+left=$(git status --porcelain | sed -n 's/^?? //p')
+[ -z "$left" ] || echo "note: the test command left untracked files, which branch-check refuses: $(printf '%s' "$left" | tr '\n' ' ')"
+
+failed=""
+[ "$base_hashes" != "$head_hashes" ] || failed="the two arms ran the same files, so they did not test the fix"
+case "$base_rc" in
+  126|127) failed="${failed:+$failed; }the base arm's command did not run (exit $base_rc: $(printf '%s' "$base_out" | head -1)); a test named in the command has to exist in both arms" ;;
+  0) failed="${failed:+$failed; }the test passes without the fix, so it does not show the bug${kept[0]:+ (or the fix is in a kept file: ${kept[*]})}" ;;
+esac
+[ "$head_rc" -eq 0 ] || failed="${failed:+$failed; }the test fails with the fix"
+if [ -n "$failed" ]; then
+  echo "proof: not shown - $failed"
+  exit 1
+fi
+
+{
+  printf 'head: %s\nbase: %s\nproof: red-green\ncommand: %s\nchecked: %s\n' "$head" "$mb" "$cmd" "$when"
+  printf 'base-exit: %s\nhead-exit: %s\n' "$base_rc" "$head_rc"
+  printf '%s\n' "$head_hashes" | sed 's/^/head-file: /'
+  printf '%s\n' "$base_hashes" | sed 's/^/base-file: /'
+  for f in ${kept[@]+"${kept[@]}"}; do printf 'kept-file: %s\n' "$f"; done
+  for e in ${basefiles[@]+"${basefiles[@]}"}; do printf 'base-from: %s\n' "$e"; done
+  printf 'base-output:\n%s\nhead-output:\n%s\n' "$(printf '%s\n' "$base_out" | sed 's/^/    /')" "$(printf '%s\n' "$head_out" | sed 's/^/    /')"
+} > "$stamp"
+echo "proof: red on the base, green on the head, for ${head:0:12}; stamped at $stamp"

{housebroken_cli-0.7.0 → housebroken_cli-0.8.0}/scripts/review.sh

@@ -193,12 +193,22 @@ EOF
   done
   cat <<'EOF'
 2. The proof: the new test fails on the base and passes with the change. Swap file content with git show <base>:<path> rather than switching branches, compare hashes, and make sure the two arms differ. Ask what each step would print if it did nothing.
+EOF
+  if [ -n "$clone" ]; then
+    if [ -f "$home/proofs/$head" ]; then
+      printf '   The author'"'"'s run, stamped by proof.sh; rerun it. A base arm that never ran the test (nothing collected, a file missing, a build that did not happen), or a swapped file the test needed for a reason other than the fix, is a finding:\n'
+      sed 's/^/     /' "$home/proofs/$head"
+    else
+      printf '   No proof stamp exists for this head: the author has not run proof.sh. Say so.\n'
+    fi
+  fi
+  cat <<'EOF'
 3. The project's own CI, read from its workflow files: tests, lint, format, API and mutation checks, run on the change.
 4. The form: write the changed block the way the best engineer in this language would, in this repository's own idioms and at the language version its manifest names, then measure the diff against it. Fewer moving parts, no state the loop already carries, no extra pass, no extra allocation, no counter beside a cursor that could be bounded itself. When yours is smaller or clearer, the finding is SHOULD FIX with your version in full; when the diff is already that form, say which alternatives you tried and why each is worse. A maintainer who asks for a rework is a review round you could have spent on the merge.
 5. Scope: every changed line is needed for what was asked, nothing is unrequested, no comment appears where the surrounding code has none, and documentation, README and CHANGELOG that describe the changed behaviour change with it.
 6. Prior art: nothing duplicates an open pull request or argues with a ruling in a closed issue.
 7. The text: it leads with the fact; no verdict on the reviewer, no thanks, apology or offer of help; a reply runs one to three sentences and a body stays under 120 words; no footer, trailer or typographic dash; every sentence is true as literally worded.
-8. Anything else that would embarrass the author in front of this maintainer.
+8. Anything else that would embarrass the author in front of this maintainer. When a text is the author's declaration (not-tested and assumptions), rerun every "checked by", and test the assumptions marked unchecked yourself: a false assumption is a finding, and so is one the change rests on that the declaration leaves out. A "checked by" that cannot be rerun as written, because it names no command or no result, is a finding too.
 EOF
   if [ -n "$clone" ]; then
     cat <<'EOF'

{housebroken_cli-0.7.0 → housebroken_cli-0.8.0}/skills/housebroken/SKILL.md

@@ -110,6 +110,17 @@ report it in one line and do not proceed to the next step.
    invariant instead of resetting it, and its grid has a row for every
    order the two are called in, the same value twice and null included. A
    reviewer lists the empty cells otherwise.
+   Then run it through the gate: `housebroken proof <clone> --test '<the
+   command that runs the new test>'` runs the test on the head and again with
+   every changed file that is not a test swapped back to the base, restores
+   the head by hash, and stamps it only when the base arm fails and the head
+   arm passes. `--keep <path>` keeps a fixture the test reads; `--fix <path>`
+   takes a file away although its path says test; `--base-file
+   <path>=<file>` gives the base arm a file that carries both the test and
+   the fix, a Rust module with its `#[cfg(test)]` block, as the base plus
+   the test. A change with
+   nothing that can fail first, documentation or a pinned refactor, records
+   `--none '<reason>'`. The filing requires the stamp.
 
 5. **Run their CI, not yours.**
    Run the project's own test target on the fresh clone, and every gate its
@@ -182,7 +193,12 @@ report it in one line and do not proceed to the next step.
    makes so you can falsify each one against the code, and it stamps the
    head it passed, which the filing requires. Then the adversarial review:
    `housebroken review brief --author <your model> --repo owner/repo --clone <clone> --text <body file>`
-   names the reviewer and prints its brief. The reviewer is never the model
+   names the reviewer and prints its brief; first run `housebroken declare
+   <clone>`, fill in what the change was not tested against and every
+   assumption it rests on ("- <assumption> | if wrong: <what breaks> |
+   checked by: <command and result, or unchecked>"), and pass that file to
+   the brief as a second `--text`, so the reviewer attacks it and the review
+   is bound to it. The reviewer is never the model
    that wrote the change: one tier down, Fable to Opus and Opus to Sonnet,
    and never below Sonnet, so Sonnet's work goes to Opus. Hand the brief to a
    fresh agent running that model; anything of yours it reads is for it to
@@ -216,8 +232,9 @@ report it in one line and do not proceed to the next step.
    has not stamped the exact head against the branch it is filed into
    (`--base` to both when the project takes pull requests on a branch other
    than its default), when the upstream has since changed a file the branch
-   changes, when there is no POST AS IS review of the exact head and body
-   being filed, when you already have three open pull requests on the
+   changes, when there is no proof stamp for the head, when the declaration
+   does not pass, when there is no POST AS IS review of the exact head, body
+   and declaration being filed, when you already have three open pull requests on the
    repository, and when your last one there is under ten minutes old.
    A refusal is a result; fix the cause.
 

housebroken_cli-0.8.0/src/housebroken/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.0"

housebroken_cli-0.7.0/src/housebroken/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.7.0"