maintainability-agent 3.7.1__tar.gz → 3.7.3__tar.gz

{maintainability_agent-3.7.1/src/maintainability_agent.egg-info → maintainability_agent-3.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.1
+Version: 3.7.3
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -19,7 +19,6 @@ Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: secure-code-agent<0.11,>=0.10
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Requires-Dist: pytest-cov>=5; extra == "test"
@@ -47,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.1**.
+Version **3.7.3**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -81,6 +80,18 @@ and `test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
 disagree. Nothing here is required — the audit runs without any of it and tells
 you what it could not measure.
 
+**Install secure-code-agent for the security pillar.** Every audit runs it; it is
+installed alongside rather than as a dependency, so the two tools release
+independently. Without it the report says the security pillar was not measured
+and gives this command. Its scanners decide what it can grade — see
+[machine setup](docs/machine-setup.md#4-toolchain) for which to install, and
+don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
+
+```bash
+pip install 'secure-code-agent>=0.12.1'
+brew install gitleaks osv-scanner semgrep checkov   # its scanners; pip install bandit
+```
+
 **One command to a work order.** A config file is the whole setup — with one
 present, nothing is asked and nothing is written into your tree:
 

{maintainability_agent-3.7.1 → maintainability_agent-3.7.3}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.1**.
+Version **3.7.3**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -39,6 +39,18 @@ and `test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
 disagree. Nothing here is required — the audit runs without any of it and tells
 you what it could not measure.
 
+**Install secure-code-agent for the security pillar.** Every audit runs it; it is
+installed alongside rather than as a dependency, so the two tools release
+independently. Without it the report says the security pillar was not measured
+and gives this command. Its scanners decide what it can grade — see
+[machine setup](docs/machine-setup.md#4-toolchain) for which to install, and
+don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
+
+```bash
+pip install 'secure-code-agent>=0.12.1'
+brew install gitleaks osv-scanner semgrep checkov   # its scanners; pip install bandit
+```
+
 **One command to a work order.** A config file is the whole setup — with one
 present, nothing is asked and nothing is written into your tree:
 

{maintainability_agent-3.7.1 → maintainability_agent-3.7.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "maintainability-agent"
-version = "3.7.1"
+version = "3.7.3"
 description = "Maintainability gate and AI remediation prompt generator for CI."
 readme = "README.md"
 # 3.11, not 3.10. `_discovery`, `_pillars` and `_runner` all import
@@ -13,14 +13,6 @@ readme = "README.md"
 # metadata said a user could stand: the suite runs 3.12 and the
 # composite action pins 3.11 (D42).
 requires-python = ">=3.11"
-# The security pillar is complete (D177): every audit runs secure-code-agent,
-# so it installs with this package rather than being left to the operator.
-# Its own dependency is PyYAML; this package still imports no YAML
-# (`test_the_shipped_package_does_not_import_yaml`) — it runs the tool as a
-# child and reads the JSON document it writes.
-dependencies = [
-  "secure-code-agent>=0.10,<0.11",
-]
 license = { text = "MIT" }
 authors = [
   { name = "Marshall Guillory" }

{maintainability_agent-3.7.1 → maintainability_agent-3.7.3/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.1
+Version: 3.7.3
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -19,7 +19,6 @@ Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: secure-code-agent<0.11,>=0.10
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Requires-Dist: pytest-cov>=5; extra == "test"
@@ -47,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.1**.
+Version **3.7.3**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -81,6 +80,18 @@ and `test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
 disagree. Nothing here is required — the audit runs without any of it and tells
 you what it could not measure.
 
+**Install secure-code-agent for the security pillar.** Every audit runs it; it is
+installed alongside rather than as a dependency, so the two tools release
+independently. Without it the report says the security pillar was not measured
+and gives this command. Its scanners decide what it can grade — see
+[machine setup](docs/machine-setup.md#4-toolchain) for which to install, and
+don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
+
+```bash
+pip install 'secure-code-agent>=0.12.1'
+brew install gitleaks osv-scanner semgrep checkov   # its scanners; pip install bandit
+```
+
 **One command to a work order.** A config file is the whole setup — with one
 present, nothing is asked and nothing is written into your tree:
 

{maintainability_agent-3.7.1 → maintainability_agent-3.7.3}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -342,6 +342,7 @@ tests/test_scanning.py
 tests/test_schema_fidelity.py
 tests/test_scope_conformance.py
 tests/test_scoring_calibration.py
+tests/test_security_delegate_versions_agree.py
 tests/test_security_pillar_runs_and_shows.py
 tests/test_semantic_policy.py
 tests/test_setup_gate_completeness.py

{maintainability_agent-3.7.1 → maintainability_agent-3.7.3}/src/maintainability_agent.egg-info/requires.txt

@@ -1,4 +1,3 @@
-secure-code-agent<0.11,>=0.10
 
 [dev]
 pytest>=8

{maintainability_agent-3.7.1 → maintainability_agent-3.7.3}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "3.7.1"
+__version__ = "3.7.3"

{maintainability_agent-3.7.1 → maintainability_agent-3.7.3}/src/maintainability_audit/_security_delegate.py

@@ -44,8 +44,19 @@ from typing import Any
 from ._delegated_pillar import read_produced
 from ._runner import Invocation, Outcome, run
 
-#: The distribution the pillar requires, and the range this tool reads.
-REQUIREMENT = "secure-code-agent>=0.10,<0.11"
+#: The releases this audit runs, and the install command's requirement.
+#:
+#: **Not a package dependency.** 3.7.0 made it one, and within the day it
+#: capped the tool below its current release — installing this package
+#: downgraded a machine's secure-code-agent — and put the two tools' opposed
+#: `mcp` pins into one environment. secure-code-agent's D3 and this project's
+#: ADR 008 both hold the tools independently releasable. So the audit runs
+#: whichever release is installed, when it falls in this range, and says so
+#: when it does not. The ceiling is the next major: within 0.x the pillar
+#: document is versioned by its own `schema_version`, which the reader checks.
+SUPPORTED_FLOOR = (0, 12, 1)
+SUPPORTED_CEILING = (1,)
+REQUIREMENT = "secure-code-agent>=0.12.1,<1"
 
 #: How long the child may run before the pillar is reported as unmeasured.
 DEFAULT_TIMEOUT_SECONDS = 300
@@ -82,6 +93,12 @@ def run_security_delegate(
     if importlib.util.find_spec("secure_code_audit") is None:
         reason = "secure-code-agent is not installed for the interpreter running this audit"
         return DelegateRun(None, reason, [_install_remedy(reason)])
+    installed = _installed_version()
+    if installed is None or not (SUPPORTED_FLOOR <= installed < SUPPORTED_CEILING):
+        shown = ".".join(map(str, installed)) if installed else "an unreadable version"
+        reason = (f"secure-code-agent {shown} is installed; this audit runs "
+                  f"{REQUIREMENT.removeprefix('secure-code-agent')}")
+        return DelegateRun(None, reason, [_install_remedy(reason)])
     with tempfile.TemporaryDirectory(prefix="ma-security-") as scratch:
         out = Path(scratch)
         pillar = out / "security-pillar.json"
@@ -116,6 +133,31 @@ def run_security_delegate(
         return DelegateRun(None, reason)
 
 
+def _installed_version() -> tuple[int, ...] | None:
+    """The installed release as integers, or `None` when it cannot be read.
+
+    No `packaging` import: this package has no runtime dependencies. A
+    pre-release or local suffix is cut at the first non-numeric part, which
+    compares a `0.13.0rc1` as `0.13.0` — conservative at the ceiling.
+    """
+    import importlib.metadata as metadata
+    import re
+
+    try:
+        text = metadata.version("secure-code-agent")
+    except metadata.PackageNotFoundError:
+        return None
+    parts = []
+    for piece in text.split("."):
+        match = re.match(r"\d+", piece)
+        if not match:
+            break
+        parts.append(int(match.group()))
+        if match.group() != piece:
+            break
+    return tuple(parts) or None
+
+
 def _last_line(text: str | None) -> str:
     lines = [line.strip() for line in (text or "").splitlines() if line.strip()]
     return lines[-1][:200] if lines else ""

{maintainability_agent-3.7.1 → maintainability_agent-3.7.3}/src/maintainability_audit/config.py

@@ -20,7 +20,7 @@ from ._operator_reads import (
 # still the door every caller comes through.
 __all__ = ["DEFAULT_CONFIG", "DEFAULT_IDIOM_GROUPS", "PROJECT_URL", "VERSION"]
 
-VERSION = "3.7.1"
+VERSION = "3.7.3"
 
 PROJECT_URL = "https://github.com/marshallguillory86/maintainability-agent"
 

maintainability_agent-3.7.3/tests/test_security_delegate_versions_agree.py

@@ -0,0 +1,86 @@
+"""The secure-code-agent this project gates on is one this audit will run.
+
+3.7.0 made secure-code-agent a package dependency pinned `>=0.10,<0.11`, repeated in
+`_security_delegate.REQUIREMENT`, with CI on `==0.10.0` — all taken from the pin CI
+already had, while the published tool was at 0.12.1. It is no longer a dependency
+(secure-code-agent D3, ADR 008: independently releasable), so the audit's own supported
+range is the one declaration, and every CI pin has to fall inside it.
+
+Covers existing behaviour: CI's pin sat inside the declared range before this change
+too — on the wrong version. Knowing the current release needs the index, which an
+offline suite cannot read; this guard keeps the declarations together from here.
+"""
+from __future__ import annotations
+
+import re
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _version_tuple(text: str) -> tuple[int, ...]:
+    return tuple(int(part) for part in text.split("."))
+
+
+def test_the_supported_range_and_the_install_remedy_are_one_declaration() -> None:
+    from maintainability_audit._security_delegate import (
+        REQUIREMENT,
+        SUPPORTED_CEILING,
+        SUPPORTED_FLOOR,
+    )
+
+    bounds = dict(re.findall(r"(>=|<)([0-9][0-9.]*)", REQUIREMENT))
+    assert _version_tuple(bounds[">="]) == SUPPORTED_FLOOR, (REQUIREMENT, SUPPORTED_FLOOR)
+    assert _version_tuple(bounds["<"]) == SUPPORTED_CEILING, (REQUIREMENT, SUPPORTED_CEILING)
+
+
+def test_secure_code_agent_is_not_a_package_dependency() -> None:
+    project = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))["project"]
+    coupled = [dep for dep in project.get("dependencies", []) if dep.startswith("secure-code-agent")]
+    assert not coupled, (
+        f"secure-code-agent is a package dependency again ({coupled}); the tools are "
+        "independently releasable (secure-code-agent D3, ADR 008)"
+    )
+
+
+def test_every_ci_pin_is_a_release_the_audit_runs() -> None:
+    from maintainability_audit._security_delegate import SUPPORTED_CEILING, SUPPORTED_FLOOR
+
+    workflows = sorted((ROOT / ".github" / "workflows").glob("*.yml"))
+    assert workflows, "no workflows found"
+    pins = [(path.name, pin) for path in workflows
+            for pin in re.findall(r"secure-code-agent==([0-9][0-9.]*)", path.read_text(encoding="utf-8"))]
+    assert pins, "no workflow pins secure-code-agent; the gate would run whatever pip picks"
+    outside = [(name, pin) for name, pin in pins
+               if not (SUPPORTED_FLOOR <= _version_tuple(pin) < SUPPORTED_CEILING)]
+    assert not outside, f"CI pins a secure-code-agent this audit refuses to run: {outside}"
+
+
+def _jobs(text: str) -> dict[str, str]:
+    """Each job's text in a workflow, split on the two-space job keys under `jobs:`.
+
+    Read as text, as `test_ci_installs_the_analyzer_pool` does: the suite does
+    not import a YAML parser.
+    """
+    body = text.split("\njobs:\n", 1)[1] if "\njobs:\n" in text else ""
+    parts = re.split(r"^  ([A-Za-z0-9_-]+):\s*$", body, flags=re.MULTILINE)
+    return {parts[index]: parts[index + 1] for index in range(1, len(parts) - 1, 2)}
+
+
+def test_every_job_that_runs_the_suite_installs_secure_code_agent() -> None:
+    """The 3.7.2 tag failed in `release.yml`: it ran the suite without the tool.
+
+    `test_every_ci_pin_is_a_release_the_audit_runs` checked the pins that
+    existed, and the release job had none. The population here is every job,
+    in every workflow, whose steps run pytest.
+    """
+    running = [
+        (path.name, job, body)
+        for path in sorted((ROOT / ".github" / "workflows").glob("*.yml"))
+        for job, body in _jobs(path.read_text(encoding="utf-8")).items()
+        if re.search(r"-m pytest\b", body)
+    ]
+    assert running, "no workflow job runs pytest; the sweep would pass vacuously"
+    missing = [(name, job) for name, job, body in running if "secure-code-agent==" not in body]
+    assert not missing, f"jobs that run the suite without installing secure-code-agent: {missing}"

{maintainability_agent-3.7.1 → maintainability_agent-3.7.3}/tests/test_security_pillar_runs_and_shows.py

@@ -151,6 +151,44 @@ def test_a_missing_delegate_is_stated_with_its_remedy(tmp_path, monkeypatch) ->
     assert remedies and "pip install" in remedies[0]["install"], report["environment_work_order"]
 
 
+@pytest.mark.parametrize("installed", ["0.10.0", "0.12.0", "1.0.0"])
+def test_an_unsupported_release_is_stated_not_run(tmp_path, monkeypatch, installed) -> None:
+    """D177: installed but outside the supported range is a reason and a remedy, never a run.
+
+    secure-code-agent is no longer a package dependency, so the version a machine has is
+    whatever it has. Running a release outside the range would read a contract this
+    audit has not been checked against.
+    """
+    import importlib.machinery
+    import importlib.metadata as metadata
+
+    from maintainability_audit import _security_delegate
+    from maintainability_audit import report as report_module
+    from maintainability_audit.config import load_config
+    from maintainability_audit.report import build_report
+
+    real_version = metadata.version
+    monkeypatch.setattr(metadata, "version",
+                        lambda name: installed if name == "secure-code-agent" else real_version(name))
+    # Installed, as far as the audit can tell, whatever this environment holds:
+    # the release build ran this without secure-code-agent and read "not installed".
+    real_find = _security_delegate.importlib.util.find_spec
+    monkeypatch.setattr(_security_delegate.importlib.util, "find_spec",
+                        lambda name, *a: importlib.machinery.ModuleSpec(name, None)
+                        if name == "secure_code_audit" else real_find(name, *a))
+    monkeypatch.setattr(_security_delegate, "run",
+                        lambda *a, **k: (_ for _ in ()).throw(AssertionError("an unsupported release ran")),
+                        raising=False)
+    monkeypatch.setattr(report_module, "run_security_delegate",
+                        _security_delegate.run_security_delegate, raising=False)
+
+    report = build_report(_repo(tmp_path), load_config(None), run_analyzers=False)
+    entry = _security(report)
+    assert installed in entry["reason"] and "is installed" in entry["reason"], entry["reason"]
+    remedies = [item for item in report["environment_work_order"] if item["tool"] == "secure-code-agent"]
+    assert remedies and "secure-code-agent>=" in remedies[0]["install"], report["environment_work_order"]
+
+
 def _states() -> dict[str, dict[str, Any]]:
     """Every state the security pillar can be in, as `pillar_report` builds it."""
     from maintainability_audit._pillars import pillar_report