maintainability-agent 3.7.0__tar.gz → 3.7.3__tar.gz

{maintainability_agent-3.7.0/src/maintainability_agent.egg-info → maintainability_agent-3.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.0
+Version: 3.7.3
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -19,7 +19,6 @@ Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: secure-code-agent<0.11,>=0.10
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Requires-Dist: pytest-cov>=5; extra == "test"
@@ -47,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.0**.
+Version **3.7.3**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -81,6 +80,18 @@ and `test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
 disagree. Nothing here is required — the audit runs without any of it and tells
 you what it could not measure.
 
+**Install secure-code-agent for the security pillar.** Every audit runs it; it is
+installed alongside rather than as a dependency, so the two tools release
+independently. Without it the report says the security pillar was not measured
+and gives this command. Its scanners decide what it can grade — see
+[machine setup](docs/machine-setup.md#4-toolchain) for which to install, and
+don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
+
+```bash
+pip install 'secure-code-agent>=0.12.1'
+brew install gitleaks osv-scanner semgrep checkov   # its scanners; pip install bandit
+```
+
 **One command to a work order.** A config file is the whole setup — with one
 present, nothing is asked and nothing is written into your tree:
 

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.0**.
+Version **3.7.3**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -39,6 +39,18 @@ and `test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
 disagree. Nothing here is required — the audit runs without any of it and tells
 you what it could not measure.
 
+**Install secure-code-agent for the security pillar.** Every audit runs it; it is
+installed alongside rather than as a dependency, so the two tools release
+independently. Without it the report says the security pillar was not measured
+and gives this command. Its scanners decide what it can grade — see
+[machine setup](docs/machine-setup.md#4-toolchain) for which to install, and
+don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
+
+```bash
+pip install 'secure-code-agent>=0.12.1'
+brew install gitleaks osv-scanner semgrep checkov   # its scanners; pip install bandit
+```
+
 **One command to a work order.** A config file is the whole setup — with one
 present, nothing is asked and nothing is written into your tree:
 

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "maintainability-agent"
-version = "3.7.0"
+version = "3.7.3"
 description = "Maintainability gate and AI remediation prompt generator for CI."
 readme = "README.md"
 # 3.11, not 3.10. `_discovery`, `_pillars` and `_runner` all import
@@ -13,14 +13,6 @@ readme = "README.md"
 # metadata said a user could stand: the suite runs 3.12 and the
 # composite action pins 3.11 (D42).
 requires-python = ">=3.11"
-# The security pillar is complete (D177): every audit runs secure-code-agent,
-# so it installs with this package rather than being left to the operator.
-# Its own dependency is PyYAML; this package still imports no YAML
-# (`test_the_shipped_package_does_not_import_yaml`) — it runs the tool as a
-# child and reads the JSON document it writes.
-dependencies = [
-  "secure-code-agent>=0.10,<0.11",
-]
 license = { text = "MIT" }
 authors = [
   { name = "Marshall Guillory" }

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.0
+Version: 3.7.3
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -19,7 +19,6 @@ Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: secure-code-agent<0.11,>=0.10
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Requires-Dist: pytest-cov>=5; extra == "test"
@@ -47,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.0**.
+Version **3.7.3**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -81,6 +80,18 @@ and `test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
 disagree. Nothing here is required — the audit runs without any of it and tells
 you what it could not measure.
 
+**Install secure-code-agent for the security pillar.** Every audit runs it; it is
+installed alongside rather than as a dependency, so the two tools release
+independently. Without it the report says the security pillar was not measured
+and gives this command. Its scanners decide what it can grade — see
+[machine setup](docs/machine-setup.md#4-toolchain) for which to install, and
+don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
+
+```bash
+pip install 'secure-code-agent>=0.12.1'
+brew install gitleaks osv-scanner semgrep checkov   # its scanners; pip install bandit
+```
+
 **One command to a work order.** A config file is the whole setup — with one
 present, nothing is asked and nothing is written into your tree:
 

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -291,6 +291,7 @@ tests/test_mcp_baseline_payload.py
 tests/test_mcp_format_contract.py
 tests/test_mcp_history.py
 tests/test_mcp_server.py
+tests/test_mcp_start_failure_names_what_is_installed.py
 tests/test_migration_1_0.py
 tests/test_near_duplicates.py
 tests/test_network_disclosure.py
@@ -341,6 +342,7 @@ tests/test_scanning.py
 tests/test_schema_fidelity.py
 tests/test_scope_conformance.py
 tests/test_scoring_calibration.py
+tests/test_security_delegate_versions_agree.py
 tests/test_security_pillar_runs_and_shows.py
 tests/test_semantic_policy.py
 tests/test_setup_gate_completeness.py

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3}/src/maintainability_agent.egg-info/requires.txt

@@ -1,4 +1,3 @@
-secure-code-agent<0.11,>=0.10
 
 [dev]
 pytest>=8

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "3.7.0"
+__version__ = "3.7.3"

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3}/src/maintainability_audit/_security_delegate.py

@@ -44,8 +44,19 @@ from typing import Any
 from ._delegated_pillar import read_produced
 from ._runner import Invocation, Outcome, run
 
-#: The distribution the pillar requires, and the range this tool reads.
-REQUIREMENT = "secure-code-agent>=0.10,<0.11"
+#: The releases this audit runs, and the install command's requirement.
+#:
+#: **Not a package dependency.** 3.7.0 made it one, and within the day it
+#: capped the tool below its current release — installing this package
+#: downgraded a machine's secure-code-agent — and put the two tools' opposed
+#: `mcp` pins into one environment. secure-code-agent's D3 and this project's
+#: ADR 008 both hold the tools independently releasable. So the audit runs
+#: whichever release is installed, when it falls in this range, and says so
+#: when it does not. The ceiling is the next major: within 0.x the pillar
+#: document is versioned by its own `schema_version`, which the reader checks.
+SUPPORTED_FLOOR = (0, 12, 1)
+SUPPORTED_CEILING = (1,)
+REQUIREMENT = "secure-code-agent>=0.12.1,<1"
 
 #: How long the child may run before the pillar is reported as unmeasured.
 DEFAULT_TIMEOUT_SECONDS = 300
@@ -82,6 +93,12 @@ def run_security_delegate(
     if importlib.util.find_spec("secure_code_audit") is None:
         reason = "secure-code-agent is not installed for the interpreter running this audit"
         return DelegateRun(None, reason, [_install_remedy(reason)])
+    installed = _installed_version()
+    if installed is None or not (SUPPORTED_FLOOR <= installed < SUPPORTED_CEILING):
+        shown = ".".join(map(str, installed)) if installed else "an unreadable version"
+        reason = (f"secure-code-agent {shown} is installed; this audit runs "
+                  f"{REQUIREMENT.removeprefix('secure-code-agent')}")
+        return DelegateRun(None, reason, [_install_remedy(reason)])
     with tempfile.TemporaryDirectory(prefix="ma-security-") as scratch:
         out = Path(scratch)
         pillar = out / "security-pillar.json"
@@ -116,6 +133,31 @@ def run_security_delegate(
         return DelegateRun(None, reason)
 
 
+def _installed_version() -> tuple[int, ...] | None:
+    """The installed release as integers, or `None` when it cannot be read.
+
+    No `packaging` import: this package has no runtime dependencies. A
+    pre-release or local suffix is cut at the first non-numeric part, which
+    compares a `0.13.0rc1` as `0.13.0` — conservative at the ceiling.
+    """
+    import importlib.metadata as metadata
+    import re
+
+    try:
+        text = metadata.version("secure-code-agent")
+    except metadata.PackageNotFoundError:
+        return None
+    parts = []
+    for piece in text.split("."):
+        match = re.match(r"\d+", piece)
+        if not match:
+            break
+        parts.append(int(match.group()))
+        if match.group() != piece:
+            break
+    return tuple(parts) or None
+
+
 def _last_line(text: str | None) -> str:
     lines = [line.strip() for line in (text or "").splitlines() if line.strip()]
     return lines[-1][:200] if lines else ""

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3}/src/maintainability_audit/config.py

@@ -20,7 +20,7 @@ from ._operator_reads import (
 # still the door every caller comes through.
 __all__ = ["DEFAULT_CONFIG", "DEFAULT_IDIOM_GROUPS", "PROJECT_URL", "VERSION"]
 
-VERSION = "3.7.0"
+VERSION = "3.7.3"
 
 PROJECT_URL = "https://github.com/marshallguillory86/maintainability-agent"
 

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3}/src/maintainability_audit/mcp_server.py

@@ -368,6 +368,46 @@ def _bind_prompts(server: Any) -> None:
         )
 
 
+#: The `mcp` releases this server is written against, as the `mcp` extra pins.
+MCP_REQUIREMENT = ">=2,<3"
+
+
+def mcp_unavailable_message(error: BaseException | None = None) -> str:
+    """Why the server cannot start, naming what is actually installed (D178).
+
+    The message said "MCP support is not installed" whenever the import
+    failed. On the machine this was found on, `mcp` *was* installed — at
+    1.23.3, because installing secure-code-agent's scanner extras pulled in
+    semgrep, which pins `mcp<2`, and pip replaced this package's 2.0.0 to
+    satisfy it. The chat door then failed to start, and the remedy it printed
+    was the install that had just been undone. A reader needs the version
+    that is there and the package that put it there.
+    """
+    import importlib.metadata as metadata
+    import re
+
+    try:
+        installed = metadata.version("mcp")
+    except metadata.PackageNotFoundError:
+        return ('MCP support is not installed. Install with: '
+                'pip install "maintainability-agent[mcp]"')
+    major = installed.split(".", 1)[0]
+    if major.isdigit() and int(major) == 2:
+        return (f"MCP support cannot start: mcp {installed} is installed and satisfies "
+                f"mcp{MCP_REQUIREMENT}, but importing it failed: {error}")
+    names_mcp = re.compile(r"^mcp(?=$|[\s<>=!~\[;(])", re.IGNORECASE)
+    dependents = sorted({
+        dist.metadata["Name"] for dist in metadata.distributions()
+        if dist.metadata["Name"] and dist.metadata["Name"].lower() not in ("maintainability-agent", "mcp")
+        and any(names_mcp.match(requirement.strip()) for requirement in (dist.requires or ()))
+    })
+    pinned = (f" It is required here by {', '.join(dependents)}, which may be what "
+              "installed this version; give that tool its own environment, or the next "
+              "install will replace mcp again.") if dependents else ""
+    return (f"MCP support cannot start: mcp {installed} is installed, and this server needs "
+            f"mcp{MCP_REQUIREMENT}.{pinned} Restore it with: pip install \"mcp{MCP_REQUIREMENT}\"")
+
+
 def create_server(*, roots: tuple[Path, ...] | None = None):
     """Create the SDK server; importing the base package does not require MCP."""
     try:
@@ -376,10 +416,8 @@ def create_server(*, roots: tuple[Path, ...] | None = None):
         from mcp.server.mcpserver.resources import FunctionResource
         from mcp.server.mcpserver.resources.templates import ResourceSecurity
         from mcp.types import ToolAnnotations
-    except ImportError as error:  # pragma: no cover - exercised by the console entry point
-        raise RuntimeError(
-            'MCP support is not installed. Install with: pip install "maintainability-agent[mcp]"'
-        ) from error
+    except ImportError as error:
+        raise RuntimeError(mcp_unavailable_message(error)) from error
 
     ledger = _RootLedger(roots if roots is not None else allowed_roots())
     server = MCPServer(

maintainability_agent-3.7.3/tests/test_mcp_start_failure_names_what_is_installed.py

@@ -0,0 +1,94 @@
+"""When the chat door cannot start, it says what is installed and what put it there (D178).
+
+Found setting up a second machine for a demo. Installing secure-code-agent's
+scanner extras into this package's environment pulled in semgrep, which pins
+`mcp<2`; pip replaced `mcp` 2.0.0 with 1.23.3, and `maintainability-agent-mcp`
+failed to start with "MCP support is not installed" and the remedy
+`pip install "maintainability-agent[mcp]"` — describing a package that was
+installed, and prescribing the install that had just been undone.
+
+The claim: **for every way the import can fail, the message states the
+installed version and, where one exists, the package that requires `mcp`.**
+The states are the three the version metadata can be in: absent, outside
+this server's range, and inside it but unimportable.
+"""
+from __future__ import annotations
+
+import importlib.metadata as metadata
+
+import pytest
+
+
+class _Dist:
+    def __init__(self, name: str, requires: list[str]) -> None:
+        self.metadata = {"Name": name}
+        self.requires = requires
+
+
+def _patch(monkeypatch, version: str | None, dists: list[_Dist]) -> None:
+    def fake_version(name: str) -> str:
+        if name == "mcp" and version is not None:
+            return version
+        raise metadata.PackageNotFoundError(name)
+
+    monkeypatch.setattr(metadata, "version", fake_version)
+    monkeypatch.setattr(metadata, "distributions", lambda: iter(dists))
+
+
+def test_a_version_outside_the_range_names_it_and_who_required_it(monkeypatch) -> None:
+    from maintainability_audit.mcp_server import MCP_REQUIREMENT, mcp_unavailable_message
+
+    _patch(monkeypatch, "1.23.3", [
+        _Dist("semgrep", ["mcp==1.23.3", "click>=8"]),
+        _Dist("mcp-helper", ["mcpx>=1"]),  # a name that merely starts with mcp is not mcp
+        _Dist("maintainability-agent", ['mcp<3,>=2; extra == "mcp"']),
+    ])
+    message = mcp_unavailable_message(ImportError("cannot import name 'MCPServer'"))
+
+    assert "1.23.3" in message and MCP_REQUIREMENT in message, message
+    assert "semgrep" in message, f"the package that pinned mcp is not named: {message}"
+    assert "mcp-helper" not in message, f"a package that does not require mcp was blamed: {message}"
+    assert "not installed" not in message, f"an installed mcp was described as missing: {message}"
+
+
+def test_an_absent_mcp_still_says_how_to_install_the_extra(monkeypatch) -> None:
+    """Covers existing behaviour: the absent case was already worded correctly.
+
+    Guards that naming versions did not change what a fresh environment is told.
+    """
+    from maintainability_audit.mcp_server import mcp_unavailable_message
+
+    _patch(monkeypatch, None, [])
+    message = mcp_unavailable_message(ImportError("No module named 'mcp'"))
+    assert "not installed" in message and "maintainability-agent[mcp]" in message, message
+
+
+def test_a_version_inside_the_range_reports_the_import_error_itself(monkeypatch) -> None:
+    """An in-range mcp that will not import is not a version problem; do not say it is."""
+    from maintainability_audit.mcp_server import mcp_unavailable_message
+
+    _patch(monkeypatch, "2.0.0", [])
+    message = mcp_unavailable_message(ImportError("broken wheel: missing pydantic_core"))
+    assert "2.0.0" in message and "broken wheel" in message, message
+    assert "not installed" not in message, message
+
+
+@pytest.mark.parametrize("version", ["1.23.3", "3.0.0"])
+def test_the_console_entry_raises_the_named_message(monkeypatch, version) -> None:
+    """D178 at the seam the operator sees: `create_server` raises the named message."""
+    import builtins
+
+    from maintainability_audit import mcp_server
+
+    _patch(monkeypatch, version, [_Dist("semgrep", [f"mcp=={version}"])])
+    real_import = builtins.__import__
+
+    def failing_import(name, *args, **kwargs):
+        if name == "mcp.server" or name.startswith("mcp.server."):
+            raise ImportError(f"cannot import name 'MCPServer' from 'mcp.server' ({version})")
+        return real_import(name, *args, **kwargs)
+
+    monkeypatch.setattr(builtins, "__import__", failing_import)
+    with pytest.raises(RuntimeError) as raised:
+        mcp_server.create_server(roots=())
+    assert version in str(raised.value) and "semgrep" in str(raised.value), str(raised.value)

maintainability_agent-3.7.3/tests/test_security_delegate_versions_agree.py

@@ -0,0 +1,86 @@
+"""The secure-code-agent this project gates on is one this audit will run.
+
+3.7.0 made secure-code-agent a package dependency pinned `>=0.10,<0.11`, repeated in
+`_security_delegate.REQUIREMENT`, with CI on `==0.10.0` — all taken from the pin CI
+already had, while the published tool was at 0.12.1. It is no longer a dependency
+(secure-code-agent D3, ADR 008: independently releasable), so the audit's own supported
+range is the one declaration, and every CI pin has to fall inside it.
+
+Covers existing behaviour: CI's pin sat inside the declared range before this change
+too — on the wrong version. Knowing the current release needs the index, which an
+offline suite cannot read; this guard keeps the declarations together from here.
+"""
+from __future__ import annotations
+
+import re
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _version_tuple(text: str) -> tuple[int, ...]:
+    return tuple(int(part) for part in text.split("."))
+
+
+def test_the_supported_range_and_the_install_remedy_are_one_declaration() -> None:
+    from maintainability_audit._security_delegate import (
+        REQUIREMENT,
+        SUPPORTED_CEILING,
+        SUPPORTED_FLOOR,
+    )
+
+    bounds = dict(re.findall(r"(>=|<)([0-9][0-9.]*)", REQUIREMENT))
+    assert _version_tuple(bounds[">="]) == SUPPORTED_FLOOR, (REQUIREMENT, SUPPORTED_FLOOR)
+    assert _version_tuple(bounds["<"]) == SUPPORTED_CEILING, (REQUIREMENT, SUPPORTED_CEILING)
+
+
+def test_secure_code_agent_is_not_a_package_dependency() -> None:
+    project = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))["project"]
+    coupled = [dep for dep in project.get("dependencies", []) if dep.startswith("secure-code-agent")]
+    assert not coupled, (
+        f"secure-code-agent is a package dependency again ({coupled}); the tools are "
+        "independently releasable (secure-code-agent D3, ADR 008)"
+    )
+
+
+def test_every_ci_pin_is_a_release_the_audit_runs() -> None:
+    from maintainability_audit._security_delegate import SUPPORTED_CEILING, SUPPORTED_FLOOR
+
+    workflows = sorted((ROOT / ".github" / "workflows").glob("*.yml"))
+    assert workflows, "no workflows found"
+    pins = [(path.name, pin) for path in workflows
+            for pin in re.findall(r"secure-code-agent==([0-9][0-9.]*)", path.read_text(encoding="utf-8"))]
+    assert pins, "no workflow pins secure-code-agent; the gate would run whatever pip picks"
+    outside = [(name, pin) for name, pin in pins
+               if not (SUPPORTED_FLOOR <= _version_tuple(pin) < SUPPORTED_CEILING)]
+    assert not outside, f"CI pins a secure-code-agent this audit refuses to run: {outside}"
+
+
+def _jobs(text: str) -> dict[str, str]:
+    """Each job's text in a workflow, split on the two-space job keys under `jobs:`.
+
+    Read as text, as `test_ci_installs_the_analyzer_pool` does: the suite does
+    not import a YAML parser.
+    """
+    body = text.split("\njobs:\n", 1)[1] if "\njobs:\n" in text else ""
+    parts = re.split(r"^  ([A-Za-z0-9_-]+):\s*$", body, flags=re.MULTILINE)
+    return {parts[index]: parts[index + 1] for index in range(1, len(parts) - 1, 2)}
+
+
+def test_every_job_that_runs_the_suite_installs_secure_code_agent() -> None:
+    """The 3.7.2 tag failed in `release.yml`: it ran the suite without the tool.
+
+    `test_every_ci_pin_is_a_release_the_audit_runs` checked the pins that
+    existed, and the release job had none. The population here is every job,
+    in every workflow, whose steps run pytest.
+    """
+    running = [
+        (path.name, job, body)
+        for path in sorted((ROOT / ".github" / "workflows").glob("*.yml"))
+        for job, body in _jobs(path.read_text(encoding="utf-8")).items()
+        if re.search(r"-m pytest\b", body)
+    ]
+    assert running, "no workflow job runs pytest; the sweep would pass vacuously"
+    missing = [(name, job) for name, job, body in running if "secure-code-agent==" not in body]
+    assert not missing, f"jobs that run the suite without installing secure-code-agent: {missing}"

{maintainability_agent-3.7.0 → maintainability_agent-3.7.3}/tests/test_security_pillar_runs_and_shows.py

@@ -151,6 +151,44 @@ def test_a_missing_delegate_is_stated_with_its_remedy(tmp_path, monkeypatch) ->
     assert remedies and "pip install" in remedies[0]["install"], report["environment_work_order"]
 
 
+@pytest.mark.parametrize("installed", ["0.10.0", "0.12.0", "1.0.0"])
+def test_an_unsupported_release_is_stated_not_run(tmp_path, monkeypatch, installed) -> None:
+    """D177: installed but outside the supported range is a reason and a remedy, never a run.
+
+    secure-code-agent is no longer a package dependency, so the version a machine has is
+    whatever it has. Running a release outside the range would read a contract this
+    audit has not been checked against.
+    """
+    import importlib.machinery
+    import importlib.metadata as metadata
+
+    from maintainability_audit import _security_delegate
+    from maintainability_audit import report as report_module
+    from maintainability_audit.config import load_config
+    from maintainability_audit.report import build_report
+
+    real_version = metadata.version
+    monkeypatch.setattr(metadata, "version",
+                        lambda name: installed if name == "secure-code-agent" else real_version(name))
+    # Installed, as far as the audit can tell, whatever this environment holds:
+    # the release build ran this without secure-code-agent and read "not installed".
+    real_find = _security_delegate.importlib.util.find_spec
+    monkeypatch.setattr(_security_delegate.importlib.util, "find_spec",
+                        lambda name, *a: importlib.machinery.ModuleSpec(name, None)
+                        if name == "secure_code_audit" else real_find(name, *a))
+    monkeypatch.setattr(_security_delegate, "run",
+                        lambda *a, **k: (_ for _ in ()).throw(AssertionError("an unsupported release ran")),
+                        raising=False)
+    monkeypatch.setattr(report_module, "run_security_delegate",
+                        _security_delegate.run_security_delegate, raising=False)
+
+    report = build_report(_repo(tmp_path), load_config(None), run_analyzers=False)
+    entry = _security(report)
+    assert installed in entry["reason"] and "is installed" in entry["reason"], entry["reason"]
+    remedies = [item for item in report["environment_work_order"] if item["tool"] == "secure-code-agent"]
+    assert remedies and "secure-code-agent>=" in remedies[0]["install"], report["environment_work_order"]
+
+
 def _states() -> dict[str, dict[str, Any]]:
     """Every state the security pillar can be in, as `pillar_report` builds it."""
     from maintainability_audit._pillars import pillar_report