maintainability-agent 3.7.4__tar.gz → 3.7.6__tar.gz

{maintainability_agent-3.7.4/src/maintainability_agent.egg-info → maintainability_agent-3.7.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.4
+Version: 3.7.6
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -46,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.4**.
+Version **3.7.6**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -84,11 +84,11 @@ you what it could not measure.
 installed alongside rather than as a dependency, so the two tools release
 independently. Without it the report says the security pillar was not measured
 and gives this command. Its scanners decide what it can grade — see
-[machine setup](docs/machine-setup.md#4-toolchain) for which to install, and
+[machine setup](docs/machine-setup.md#3-toolchain) for which to install, and
 don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
 
 ```bash
-pip install 'secure-code-agent>=0.12.1'
+pip install 'secure-code-agent>=0.12.2'
 brew install gitleaks osv-scanner semgrep checkov   # its scanners; pip install bandit
 ```
 

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.4**.
+Version **3.7.6**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -43,11 +43,11 @@ you what it could not measure.
 installed alongside rather than as a dependency, so the two tools release
 independently. Without it the report says the security pillar was not measured
 and gives this command. Its scanners decide what it can grade — see
-[machine setup](docs/machine-setup.md#4-toolchain) for which to install, and
+[machine setup](docs/machine-setup.md#3-toolchain) for which to install, and
 don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
 
 ```bash
-pip install 'secure-code-agent>=0.12.1'
+pip install 'secure-code-agent>=0.12.2'
 brew install gitleaks osv-scanner semgrep checkov   # its scanners; pip install bandit
 ```
 

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "maintainability-agent"
-version = "3.7.4"
+version = "3.7.6"
 description = "Maintainability gate and AI remediation prompt generator for CI."
 readme = "README.md"
 # 3.11, not 3.10. `_discovery`, `_pillars` and `_runner` all import

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.4
+Version: 3.7.6
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -46,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.4**.
+Version **3.7.6**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -84,11 +84,11 @@ you what it could not measure.
 installed alongside rather than as a dependency, so the two tools release
 independently. Without it the report says the security pillar was not measured
 and gives this command. Its scanners decide what it can grade — see
-[machine setup](docs/machine-setup.md#4-toolchain) for which to install, and
+[machine setup](docs/machine-setup.md#3-toolchain) for which to install, and
 don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
 
 ```bash
-pip install 'secure-code-agent>=0.12.1'
+pip install 'secure-code-agent>=0.12.2'
 brew install gitleaks osv-scanner semgrep checkov   # its scanners; pip install bandit
 ```
 

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -224,7 +224,6 @@ tests/test_declaration_grading.py
 tests/test_declaration_ranges.py
 tests/test_declaration_source.py
 tests/test_declarative_parsers.py
-tests/test_declared_authorship.py
 tests/test_declared_imports.py
 tests/test_delegated_security_pillar.py
 tests/test_demo_tree.py
@@ -294,6 +293,7 @@ tests/test_mcp_history.py
 tests/test_mcp_server.py
 tests/test_mcp_start_failure_names_what_is_installed.py
 tests/test_migration_1_0.py
+tests/test_mutation_recorded.py
 tests/test_near_duplicates.py
 tests/test_network_disclosure.py
 tests/test_one_setup_across_surfaces_class.py
@@ -328,7 +328,6 @@ tests/test_release_needs_an_empty_ledger.py
 tests/test_release_plan.py
 tests/test_release_plan_status.py
 tests/test_report_remedy_copy.py
-tests/test_roles_recorded.py
 tests/test_root_grants.py
 tests/test_rubric_ignores_project_lint_config.py
 tests/test_ruby_declarations.py

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "3.7.4"
+__version__ = "3.7.6"

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_analysis.py

@@ -77,7 +77,7 @@ class ToolCoverage:
     # True when the language inventory (not a probe, not a spawn)
     # decided this tool had nothing to read — the selection-stage fact
     # D15 requires to be visible as selection, not only as a coverage
-    # outcome (Codex audit on 43c0d13, H1).
+    # outcome (audit of `43c0d13`, H1).
     inventory_filtered: bool = False
     # The catalog languages this tool reads, in the catalog's vocabulary.
     # Carried on the record because coverage is claimed per language: a

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_anchor.py

@@ -16,7 +16,7 @@ obsolete again at the next one.
 What is *not* policy is silence about it where the grade is read. The
 report carried `score.reference` and the note said the corpus spanned
 "every language this scanner parses" — which was true when it was written
-and false from 2.4.0 onward, for three releases. A Grok audit on
+and false from 2.4.0 onward, for three releases. An audit on
 2026-09-04 named it as the second instance of a shape this project had
 already shipped once: a limit disclosed only in JSON is disclosed nowhere
 that matters.

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_backfill.py

@@ -62,7 +62,7 @@ def _git(root: Path, *args: str) -> str:
             # tree instead -- and backfill's `worktree add` re-hashes
             # content, which is exactly what runs a `clean` filter. `run_git`
             # got this; this spawner, living outside `git_tools`, did not
-            # (Grok e88b429 audit; the D92 sweep only read `git_tools.py`).
+            # (audit of `e88b429`; the D92 sweep only read `git_tools.py`).
             ["git", *READ_ONLY_GIT_CONFIG, *_attr_tree_config(root),
              "-C", str(root), *args],
             capture_output=True, text=True, check=False,

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_cognitive.py

@@ -216,7 +216,7 @@ def cobol_cognitive(lines: list[str]) -> int:
     no `PROCEDURE DIVISION` — so re-masking blanked the whole thing and
     every COBOL paragraph in production scored exactly 0, including deeply
     nested ones. The souvenir test passed throughout because it called this
-    with a whole file. Found by a Grok audit on 2026-09-04.
+    with a whole file. Found by an audit on 2026-09-04.
     """
     masked = lines
     score = 0

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_economics.py

@@ -172,7 +172,7 @@ def _affected_changes_per_year(report: dict[str, Any]) -> tuple[float, str]:
         # Once per file, not once per row. A file with several work-order
         # items -- a long function and dead code in the same module --
         # has one churn history, and summing it per row multiplied that
-        # file's yearly changes by its finding count (Grok e88b429 audit).
+        # file's yearly changes by its finding count (audit of `e88b429`).
         touched = sum(churn.get(path, 0) for path in {item.get("path") or "" for item in items})
         if touched:
             return float(touched), (

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_first_run.py

@@ -44,7 +44,7 @@ def maybe_prompt_first_run(root: Path, explicit_config: str | None) -> None:
     "chat-path twin"). The CLI had drifted to a depth/license-only subset
     that never answered pool execution, so the mere existence of the file
     it wrote defaulted the pool on and marked setup complete for a
-    decision nobody made (Grok 63ab820 audit). Asking `run_pool` and
+    decision nobody made (audit of `63ab820`). Asking `run_pool` and
     `record_scan_history` here, and persisting through `apply_answers`,
     makes a repository configured at a terminal identical to one
     configured in chat.

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_html_view.py

@@ -143,7 +143,7 @@ def _comparable_tail(records: list[Any]) -> list[Any]:
     The HTML skin walked every stored record instead, so a first-vs-last
     estimate straddling a break read as "Improving across N scans" when
     the two numbers were produced by different instruments and cannot be
-    compared at all (Grok e88b429 audit). Restricting to the last segment
+    compared at all (audit of `e88b429`). Restricting to the last segment
     puts the HTML skin on the same comparability rule as the others.
     """
     from ._scan_history import segments

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_in_loop.py

@@ -174,7 +174,7 @@ def _breaches_for(metric: Any, thresholds: dict[str, int]) -> list[dict[str, Any
     version subtracted `max_function_lines` from the line count whatever
     had failed. A short, complex function then rendered as "-71 over" —
     a negative overage of a budget it was comfortably inside, printed for
-    a breach that was real (Grok's audit). A figure has to be about the
+    a breach that was real (found by audit). A figure has to be about the
     thing that failed or it is worse than no figure.
     """
     lines_limit, _ = _budget_for(metric.kind, thresholds)

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_in_loop_view.py

@@ -102,7 +102,7 @@ def check_json(result: dict[str, Any]) -> str:
             # Read from the result, never written as a constant. A
             # literal `False` here says "not scored" whatever the check
             # actually did, so the field would keep reassuring a caller
-            # through the exact bug it exists to disclose (Grok's audit).
+            # through the exact bug it exists to disclose (found by audit).
             "scored": result["scored"],
             "scored_reason": result["scored_reason"],
         },

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_markdown_sections.py

@@ -93,7 +93,7 @@ def render_history_markdown(report: dict[str, Any]) -> list[str]:
         # complete" with nothing about the window at all, while the
         # scoring layer had already marked every history rate
         # not-applicable. P8: the report states what examined each value
-        # (D56, reopened by Codex).
+        # (D56, reopened).
         return [
             "### History",
             "",

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_mcp_audit.py

@@ -136,7 +136,7 @@ def authorize_config(config_path: str | None, root: Path) -> str | None:
     So the two doors onto one rule disagreed: `repository_path` refused
     `link/…` and this returned the target. The baseline seam below
     already carries a comment recording this same escape being found and
-    closed *there*; this door was never revisited (Grok, 673e667).
+    closed *there*; this door was never revisited (audit of `673e667`).
     """
     if config_path is None:
         return None
@@ -375,7 +375,7 @@ def _baseline_workflow(report: dict[str, Any], root: Path,
     # resolves and this then bounded the resolved path, so an inward
     # `.maintainability -> src` symlink kept the target inside the root and
     # the write landed in source -- the D34 escape history refused and
-    # baseline did not (Grok e88b429 audit). `repository_path` refuses a
+    # baseline did not (audit of `e88b429`). `repository_path` refuses a
     # symlink anywhere on the route and keeps the same boundary check.
     target = repository_path(root, baseline_path, str(DEFAULT_BASELINE_PATH))
     if write:

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_mcp_setup.py

@@ -341,9 +341,8 @@ def setup_schema(root: Path | None = None):
     """The elicitation model for whichever stage this repository is in.
 
     Two stages, because the three labor rates are only wanted by
-    someone who said yes to the gate. Asking them of everyone is what
-    Marshall called basic logic broken, and he was right: the default
-    answer to the gate is "skip".
+    someone who said yes to the gate. Asking them of everyone was broken
+    logic: the default answer to the gate is "skip".
     """
     if root is not None and economics_bounds_pending(root):
         return _schema_for(economics_bound_questions())

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_pressures.py

@@ -99,7 +99,7 @@ def _banded(banded_state: object, population: float | None,
         # refinement that can only *add* pressure over the count rate (a
         # warn at complexity 12 is worse than a plain warn), so falling
         # back to the count rate when the band is withheld only improved
-        # the score -- the P3 hole Grok's e88b429 audit named. Dropping the
+        # the score -- the P3 hole the `e88b429` audit named. Dropping the
         # dimension is no better: averaging over the rest can still improve
         # the estimate when the withheld dimension was worse than its
         # peers. `SEVERE` is the only value that cannot improve any

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_prompt_sections.py

@@ -437,7 +437,7 @@ def prompt_focus_sections(report: dict[str, Any]) -> list[str]:
     # Risk findings honour the same escalation as the hotspots and large
     # files above: a design-review candidate is announced as withheld in
     # the escalation note, so listing it here too presented it twice and
-    # contradicted that note (P5, Grok e88b429 audit). The rule was
+    # contradicted that note (P5, audit of `e88b429`). The rule was
     # enforced on every focus category except this one.
     risk_ids = risk_identities(report)
     risks = [

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_ranges_core.py

@@ -141,7 +141,7 @@ def _is_bare_signature(masked: list[str], start: int, end: int) -> bool:
     """A declaration that terminates without opening a body or an arrow
     value: `declare function f(): void;`, a TS overload signature, an
     abstract method. No body to measure, so counting one mints a member
-    with no code behind it (Grok 63ab820 audit). A real function/method
+    with no code behind it (audit of `63ab820`). A real function/method
     opens a block `{`; an expression member carries `=>`; neither, closed
     on `;`, is signature only. `f() {}` and `g = () => x;` still count.
     """

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_ranges_js.py

@@ -75,8 +75,8 @@ _PROPERTY_RE = re.compile(
 # field of type T; a value would need `name = ...`, so `name: (...) => X`
 # can only be a function-type annotation, with X a return type and no
 # body. D93 skipped these inside `interface`/`type` blocks but not inside
-# a class, so class fields still minted a declaration population (Grok
-# e88b429 audit). The `;` terminator and the absence of a block `{` after
+# a class, so class fields still minted a declaration population (audit
+# of `e88b429`). The `;` terminator and the absence of a block `{` after
 # the arrow are what tell an annotation from a real arrow-valued property
 # (`onSave: (a) => { ... }`), which keeps its body and stays counted.
 _FUNCTION_TYPE_ANNOTATION_RE = re.compile(
@@ -142,7 +142,7 @@ def _is_method(tail: str, match: re.Match[str]) -> bool:
 
     When the paren closes on the line, a real method opens a body brace
     after it -- run-on (`f(x) {`) or single-line (`f(x) { return x }`). A
-    trailing-`{` test missed the single-line one (Grok 63ab820 audit); a
+    trailing-`{` test missed the single-line one (audit of `63ab820`); a
     call (`foo(x);`) or a signature (`foo(): T;`) has no brace and stays out.
     """
     trimmed = tail.rstrip()

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_runner.py

@@ -218,9 +218,9 @@ def analyzer_env() -> dict[str, str]:
         # `registry=https://evil/` silently redirects that fetch. Forcing
         # the registry through the environment -- which npm ranks above a
         # project `.npmrc` -- pins it to the value the user configured for
-        # themselves, read below where the tree cannot vote. Marshall's
-        # call, 2026-08-29: let the user pull tools, do not let the tree
-        # pick the source.
+        # themselves, read below where the tree cannot vote. Decided
+        # 2026-08-29: let the user pull tools, do not let the tree pick the
+        # source.
         env["npm_config_registry"] = registry
     return env
 
@@ -301,7 +301,7 @@ def _probe(slug: str, argv: tuple[str, ...]) -> ToolResult:
 #: a pin that changes with a tool's colour choices, not its version. The
 #: determinism suite stripped these before comparing, which hid that the
 #: stored value carried them; stripping at capture makes the recorded pin
-#: the version and nothing else (Grok e88b429 audit).
+#: the version and nothing else (audit of `e88b429`).
 _ANSI_ESCAPE = re.compile(r"\x1b\[[0-?]*[ -/]*[@-~]")
 
 

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_safe_write.py

@@ -102,7 +102,7 @@ def write_artifact(
       tree. So when the named path falls within the grant the write goes
       through ``write_bounded`` and inherits the lexical route refusal --
       ``.maintainability -> src`` on both ``/var`` and ``/private/var``
-      spellings of the same macOS path (Grok 63ab820 audit; the earlier
+      spellings of the same macOS path (audit of `63ab820`; the earlier
       ``write_bounded(target.parent, target)`` bound the check to the
       symlink itself and checked nothing). A path outside the grant is on
       ground the audited tree does not control; only the final component
@@ -117,7 +117,7 @@ def write_artifact(
     grant_real = os.path.realpath(grant_root)
     # Membership is decided on the *real* path so a ``/var`` spelling of
     # the target and a ``/private/var`` spelling of the grant name the
-    # same tree (Grok 63ab820 audit). In-tree, the write is bound to the
+    # same tree (audit of `63ab820`). In-tree, the write is bound to the
     # grant and inherits its lexical route refusal (the ``.maintainability
     # -> src`` link the real path erased); out-of-tree, it is bound to the
     # operator's own directory -- ground the audited tree cannot plant a
@@ -213,7 +213,7 @@ def _stage_and_replace(target: Path, body: str) -> Path:
     The staging name is unique per call. A fixed `.{name}.incoming` was
     guessable, and the audited tree could plant that exact file: `O_EXCL`
     then raised `FileExistsError` and took the write primitive down with a
-    crash the tree chose the timing of (Grok e88b429 audit). `mkstemp`
+    crash the tree chose the timing of (audit of `e88b429`). `mkstemp`
     creates an exclusive file under a random name in the same directory,
     so nothing the tree pre-places can collide with it, and it still lands
     on the same filesystem for an atomic `os.replace`.

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_security_delegate.py

@@ -5,8 +5,8 @@
 tool wrote `security-pillar.json` and this one read it if it happened to be
 there. Nothing ran it, so every audit that did not follow a manual or CI run
 of the other tool reported the pillar as unmeasured — including every audit
-through the chat door, which cannot run it at all. Decided 2026-09-13 with
-Marshall: the pillar is complete, so the audit runs it.
+through the chat door, which cannot run it at all. Decided 2026-09-13: the
+pillar is complete, so the audit runs it.
 
 **What the child writes.** Every report `secure-code-agent` can produce is
 redirected into a temporary directory this process owns: the Markdown and
@@ -55,9 +55,15 @@ from ._runner import Invocation, Outcome, run
 #: whichever release is installed, when it falls in this range, and says so
 #: when it does not. The ceiling is the next major: within 0.x the pillar
 #: document is versioned by its own `schema_version`, which the reader checks.
-SUPPORTED_FLOOR = (0, 12, 1)
+#:
+#: **The floor is 0.12.2, not the first release with this contract (D182).**
+#: 0.12.1 writes the same schema v2 document, and matches `.scignore.yaml`
+#: `paths:` globs against absolute finding paths. This audit always hands it an
+#: absolute root, so under 0.12.1 every reviewed `paths:` suppression is ignored
+#: and its finding counts as live in the pillar every skin shows (D179).
+SUPPORTED_FLOOR = (0, 12, 2)
 SUPPORTED_CEILING = (1,)
-REQUIREMENT = "secure-code-agent>=0.12.1,<1"
+REQUIREMENT = "secure-code-agent>=0.12.2,<1"
 
 #: How long the child may run before the pillar is reported as unmeasured.
 DEFAULT_TIMEOUT_SECONDS = 300

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_semantic_ts.py

@@ -86,7 +86,7 @@ def local_tsc_analysis(root: Path) -> dict[str, Any] | None:
     *unknown*, not clean: a config error (FAILED, exit 3+) or a findings
     exit with an empty body (NOT_WORKING) both leave `stdout` empty, and
     reading that as a violation-free type check is the absence-as-a-pass
-    the class ADR 001 forbids (Grok 63ab820 audit). Only a usable run
+    the class ADR 001 forbids (audit of `63ab820`). Only a usable run
     counts; a RAN with no output is the real "compiled, no type errors".
     CLI output carries no boundary facts, so `typed_boundaries` is empty.
     """

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_verification.py

@@ -91,7 +91,7 @@ DEFAULT_V1_REQUIRED: frozenset[str] = frozenset({
     # The 3.2 band pressures. Score-bearing: the band matrix prices a
     # complexity-12 warn above a plain warn, so it can only add pressure
     # over the count rate. Withholding one therefore only improves the
-    # score -- the P3 hole Grok's e88b429 audit named -- so an absent band
+    # score -- the P3 hole the `e88b429` audit named -- so an absent band
     # withholds the grade rather than quietly falling back to the coarser
     # count rate. `_pressures._banded` no longer prices an Unknown band at
     # the count rate for the same reason.
@@ -107,7 +107,7 @@ DEFAULT_V1_REQUIRED: frozenset[str] = frozenset({
 #
 # The four 3.2 band pressures used to live here, on the reasoning that a
 # missing band predated the wiring and the count-rate fallback was a
-# coarser-but-verifiable number. Grok's e88b429 audit showed that was a
+# coarser-but-verifiable number. The `e88b429` audit showed that was a
 # P3 hole: the band can only add pressure over the count rate, so
 # withholding it only ever improved the score, and this list kept the
 # concealment sweep from ever noticing. They are now required (above).

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/_work_order.py

@@ -251,7 +251,7 @@ def _items_from_idioms(report: dict[str, Any]) -> list[dict[str, Any]]:
 
 
 def _locate(finding: dict[str, Any]) -> tuple[str | None, int | None]:
-    """Path/line; a duplicate block carries only `locations`, which the old path/line read dropped (Grok e88b429)."""
+    """Path/line; a duplicate block carries only `locations`, which the old path/line read dropped (audit of `e88b429`)."""
     path = finding.get("path") or finding.get("first_path")
     line = finding.get("line") or finding.get("first_line") or finding.get("start_line")
     if path is None and (locs := finding.get("locations")):

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/baseline.py

@@ -133,7 +133,7 @@ def write_baseline(path: str, report: dict[str, Any]) -> None:
     # baseline's own parent directory: `write_bounded(target.parent, ...)`
     # bound the symlink check to the symlink itself and so checked
     # nothing, which is how `.maintainability -> src` still redirected the
-    # baseline into source (Grok 63ab820 audit). `write_artifact` keeps
+    # baseline into source (audit of `63ab820`). `write_artifact` keeps
     # the predating contract that a baseline may live outside the tree —
     # a path outside the grant is written on the operator's own ground —
     # while a path inside the grant inherits the lexical route refusal,

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/cli.py

@@ -112,7 +112,7 @@ def write_outputs(args: argparse.Namespace, report: dict, rendered: str) -> None
     # Every rendered output the operator asks for is a product-artifact
     # write: a raw `Path(name).write_text` followed the tree's symlink
     # into source, so each goes through `write_artifact`, bound to the
-    # repository the report was taken in (Grok 63ab820 audit).
+    # repository the report was taken in (audit of `63ab820`).
     root = Path(report["root"])
     if args.output:
         _emit(root, args.output, rendered + "\n")

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/config.py

@@ -20,7 +20,7 @@ from ._operator_reads import (
 # still the door every caller comes through.
 __all__ = ["DEFAULT_CONFIG", "DEFAULT_IDIOM_GROUPS", "PROJECT_URL", "VERSION"]
 
-VERSION = "3.7.4"
+VERSION = "3.7.6"
 
 PROJECT_URL = "https://github.com/marshallguillory86/maintainability-agent"
 

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/duplication.py

@@ -58,7 +58,7 @@ def duplicate_blocks(
         # The index into this filtered list is not a source line: reporting
         # `idx + 1` pointed a reader at the Nth non-comment line, not line N
         # of the file, so every duplicate location was off by however many
-        # comments and blanks preceded it (Grok e88b429 audit).
+        # comments and blanks preceded it (audit of `e88b429`).
         useful = [
             (number, line)
             for number, line in enumerate(lines, start=1)

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/src/maintainability_audit/instructions.py

@@ -142,7 +142,7 @@ def write_instruction_pack(
     # Each instruction file is a product-artifact write: `output_dir`
     # comes from a person (`--instructions-output-dir`), so the write is
     # bound to that directory and refuses a symlinked route the audited
-    # tree could plant beneath it (Grok 63ab820 audit).
+    # tree could plant beneath it (audit of `63ab820`).
     from ._safe_write import write_artifact
 
     written: list[str] = []

{maintainability_agent-3.7.4 → maintainability_agent-3.7.6}/tests/test_artifact_write_route_class.py

@@ -1,4 +1,4 @@
-"""Class A (Grok 63ab820): every product-artifact write refuses a route the
+"""Class A (audit of `63ab820`): every product-artifact write refuses a route the
 audited tree could redirect, on both ``/var`` and ``/private/var`` spellings,
 and refuses to truncate a file that is not one of ours.