maintainability-agent 3.7.6__tar.gz → 3.7.7__tar.gz

{maintainability_agent-3.7.6/src/maintainability_agent.egg-info → maintainability_agent-3.7.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.6
+Version: 3.7.7
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -46,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.6**.
+Version **3.7.7**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -424,13 +424,13 @@ it was generated against — a provenance record, not a claim about HEAD.
 
 | Metric | Value |
 |---|---:|
-| Maintainability estimate | 4.5 / 5 |
+| Maintainability estimate | 4.4 / 5 |
 | Verified grade | B |
-| Files scanned | 511 |
+| Files scanned | 498 |
 | Hard gate failures | 0 |
 
 A **B**, and the report says why: the grade is verified against the evidence
-*floor* of 4.2 rather than the 4.5 point estimate, because an unmeasured aspect
+*floor* of 4.1 rather than the 4.4 point estimate, because an unmeasured aspect
 prices at 0 when a grade has to be defended. Every threshold gate is opted
 **on** for this repository's own CI, so drifting below the bar fails the build
 rather than the README.
@@ -473,7 +473,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v1.0.0
+- uses: marshallguillory86/maintainability-agent@v3.7.7
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-3.7.6 → maintainability_agent-3.7.7}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.6**.
+Version **3.7.7**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -383,13 +383,13 @@ it was generated against — a provenance record, not a claim about HEAD.
 
 | Metric | Value |
 |---|---:|
-| Maintainability estimate | 4.5 / 5 |
+| Maintainability estimate | 4.4 / 5 |
 | Verified grade | B |
-| Files scanned | 511 |
+| Files scanned | 498 |
 | Hard gate failures | 0 |
 
 A **B**, and the report says why: the grade is verified against the evidence
-*floor* of 4.2 rather than the 4.5 point estimate, because an unmeasured aspect
+*floor* of 4.1 rather than the 4.4 point estimate, because an unmeasured aspect
 prices at 0 when a grade has to be defended. Every threshold gate is opted
 **on** for this repository's own CI, so drifting below the bar fails the build
 rather than the README.
@@ -432,7 +432,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v1.0.0
+- uses: marshallguillory86/maintainability-agent@v3.7.7
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-3.7.6 → maintainability_agent-3.7.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "maintainability-agent"
-version = "3.7.6"
+version = "3.7.7"
 description = "Maintainability gate and AI remediation prompt generator for CI."
 readme = "README.md"
 # 3.11, not 3.10. `_discovery`, `_pillars` and `_runner` all import

{maintainability_agent-3.7.6 → maintainability_agent-3.7.7/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.6
+Version: 3.7.7
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -46,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.6**.
+Version **3.7.7**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -424,13 +424,13 @@ it was generated against — a provenance record, not a claim about HEAD.
 
 | Metric | Value |
 |---|---:|
-| Maintainability estimate | 4.5 / 5 |
+| Maintainability estimate | 4.4 / 5 |
 | Verified grade | B |
-| Files scanned | 511 |
+| Files scanned | 498 |
 | Hard gate failures | 0 |
 
 A **B**, and the report says why: the grade is verified against the evidence
-*floor* of 4.2 rather than the 4.5 point estimate, because an unmeasured aspect
+*floor* of 4.1 rather than the 4.4 point estimate, because an unmeasured aspect
 prices at 0 when a grade has to be defended. Every threshold gate is opted
 **on** for this repository's own CI, so drifting below the bar fails the build
 rather than the README.
@@ -473,7 +473,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v1.0.0
+- uses: marshallguillory86/maintainability-agent@v3.7.7
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-3.7.6 → maintainability_agent-3.7.7}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "3.7.6"
+__version__ = "3.7.7"

{maintainability_agent-3.7.6 → maintainability_agent-3.7.7}/src/maintainability_audit/_delegated_pillar.py

@@ -23,10 +23,12 @@ number: a delegated pillar's numbers belong to the tool that measured
 them, and a consumer that recomputed anything would be a second opinion
 nobody asked for.
 
-**Absence is the normal case and stays the documented one.** No file
-means the pillar reports exactly what it reported before — delegated,
-`NotApplicable`, naming the other tool. That path is not a failure and
-does not warn: most repositories run one tool.
+**Absence is stated, never silent.** Since D177 every audit runs
+secure-code-agent itself; this reader serves `--security-pillar PATH`,
+where a pipeline hands over a document the delegate already wrote. A
+document that is missing or cannot be trusted yields `None`, and the
+caller records why in the pillar entry rather than reporting an empty
+pillar as a clean one.
 
 **A file that cannot be trusted is refused rather than partly believed.**
 Wrong schema, unreadable JSON, a shape that is not an object — each
@@ -108,7 +110,8 @@ def read_delegated(root: Path, relative: str = DEFAULT_PILLAR_PATH) -> dict[str,
     the file is absent, it is not a regular file, it does not parse, it
     is not an object, or it announces a schema this tool does not know.
     All five collapse to one answer because the caller does the same
-    thing with each — keep the placeholder that names the other tool.
+    thing with each — it states that the handed-over document was absent
+    or could not be trusted.
 
     Read through the regular-file primitive like every other path the
     audited tree chooses (D145): a FIFO here would hang the audit rather

{maintainability_agent-3.7.6 → maintainability_agent-3.7.7}/src/maintainability_audit/config.py

@@ -20,7 +20,7 @@ from ._operator_reads import (
 # still the door every caller comes through.
 __all__ = ["DEFAULT_CONFIG", "DEFAULT_IDIOM_GROUPS", "PROJECT_URL", "VERSION"]
 
-VERSION = "3.7.6"
+VERSION = "3.7.7"
 
 PROJECT_URL = "https://github.com/marshallguillory86/maintainability-agent"
 

{maintainability_agent-3.7.6 → maintainability_agent-3.7.7}/tests/test_authorship_gates.py

@@ -77,19 +77,32 @@ def _step_scripts() -> dict[str, str]:
     assert scripts.keys() == {
         "Each commit carries the repository's commit identity",
         "Each commit is signed",
+        "Commit messages name only the commit identity",
+        "No forbidden term in the change",
     }
     return scripts
 
 
 SCRIPTS = _step_scripts()
 
+#: Stands in for the FORBIDDEN_TERMS secret. A made-up term, deliberately:
+#: the real terms live only in the secret and must never be written here.
+EXAMPLE_TERM = "example-forbidden-term"
 
-def _run_gate(repo: Path, name: str) -> subprocess.CompletedProcess[str]:
-    """Substitute the only Actions expression used by the checked script."""
+
+def _run_gate(
+    repo: Path, name: str, *, terms: str = EXAMPLE_TERM,
+) -> subprocess.CompletedProcess[str]:
+    """Substitute the only Actions expression used by the checked script.
+
+    ``terms`` is what the secret would hold; an empty string is the secret
+    being unset.
+    """
     script = SCRIPTS[name].replace("${{ github.base_ref }}", "main")
     return subprocess.run(
         ["bash", "-c", script],
         cwd=repo,
+        env={**os.environ, "FORBIDDEN_TERMS": terms},
         text=True,
         capture_output=True,
         check=False,
@@ -131,10 +144,13 @@ def signed_repo(tmp_path: Path) -> tuple[Path, Callable[..., str]]:
         signed: bool = True,
         author: str = COMMIT_IDENTITY,
         committer: str = COMMIT_IDENTITY,
+        message: str | None = None,
+        content: str | None = None,
     ) -> str:
         nonlocal counter
         counter += 1
-        (repo / f"change-{counter}").write_text(f"{counter}\n", encoding="utf-8")
+        (repo / f"change-{counter}").write_text(
+            content if content is not None else f"{counter}\n", encoding="utf-8")
         _require_git(repo, "add", ".")
         result = _git(
             repo,
@@ -147,7 +163,7 @@ def signed_repo(tmp_path: Path) -> tuple[Path, Callable[..., str]]:
             "--author",
             f"Marshall Guillory <{author}>",
             "-m",
-            f"change {counter}",
+            message if message is not None else f"change {counter}",
             env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"}
             if committer != COMMIT_IDENTITY
             else None,
@@ -325,3 +341,86 @@ def test_the_signature_gate_still_checks_merge_commits() -> None:
         "the conflict resolution its author wrote; rebase a stale branch "
         "rather than weakening this to make 'Update branch' pass (D105)."
     )
+
+
+def test_a_trailer_naming_another_address_fails(
+    signed_repo: tuple[Path, Callable[..., str]],
+) -> None:
+    """A co-author trailer is where an outside address reached history before.
+
+    The identity step reads author and committer only, so a trailer in the
+    message passed every check and landed on the protected branch.
+    """
+    repo, commit = signed_repo
+    commit(message="change\n\nCo-authored-by: Someone Else <someone@example.com>")
+
+    result = _run_gate(repo, "Commit messages name only the commit identity")
+
+    assert result.returncode == 1, result.stdout
+    assert "names an address other than the commit identity" in result.stdout
+
+
+def test_a_message_naming_only_the_commit_identity_passes(
+    signed_repo: tuple[Path, Callable[..., str]],
+) -> None:
+    """The allowlist is the identity itself, so naming it is not a failure."""
+    repo, commit = signed_repo
+    commit(message=f"change\n\nCo-authored-by: Marshall Guillory <{COMMIT_IDENTITY}>")
+
+    result = _run_gate(repo, "Commit messages name only the commit identity")
+
+    assert result.returncode == 0, result.stdout
+
+
+def test_a_forbidden_term_in_a_message_fails_in_any_case(
+    signed_repo: tuple[Path, Callable[..., str]],
+) -> None:
+    repo, commit = signed_repo
+    commit(message=f"change mentioning {EXAMPLE_TERM.upper()}")
+
+    result = _run_gate(repo, "No forbidden term in the change")
+
+    assert result.returncode == 1, result.stdout
+    assert "identity or message contains a forbidden term" in result.stdout
+
+
+def test_a_forbidden_term_added_to_a_file_fails_without_printing_it(
+    signed_repo: tuple[Path, Callable[..., str]],
+) -> None:
+    """The failure names the file, never the matched text.
+
+    A check that echoed the term into a public CI log would publish the
+    thing it exists to keep out.
+    """
+    repo, commit = signed_repo
+    commit(content=f"a line carrying {EXAMPLE_TERM}\n")
+
+    result = _run_gate(repo, "No forbidden term in the change")
+
+    assert result.returncode == 1, result.stdout
+    assert "adds a forbidden term" in result.stdout
+    assert EXAMPLE_TERM not in (result.stdout + result.stderr).lower()
+
+
+def test_a_clean_change_passes_the_forbidden_term_check(
+    signed_repo: tuple[Path, Callable[..., str]],
+) -> None:
+    repo, commit = signed_repo
+    commit()
+
+    result = _run_gate(repo, "No forbidden term in the change")
+
+    assert result.returncode == 0, result.stdout
+
+
+def test_the_forbidden_term_check_fails_closed_without_the_secret(
+    signed_repo: tuple[Path, Callable[..., str]],
+) -> None:
+    """An unset secret must not read as a clean change."""
+    repo, commit = signed_repo
+    commit()
+
+    result = _run_gate(repo, "No forbidden term in the change", terms="")
+
+    assert result.returncode == 1
+    assert "this check proved nothing" in result.stdout

{maintainability_agent-3.7.6 → maintainability_agent-3.7.7}/tests/test_installed_wheel_runtime.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import json
 import os
+import shutil
 import subprocess
 import sys
 import venv
@@ -105,8 +106,26 @@ def _run(command: list[str], *, cwd: Path, env: dict[str, str]) -> subprocess.Co
 
 @pytest.fixture(scope="module")
 def built_wheel(tmp_path_factory: pytest.TempPathFactory) -> Path:
-    """Build the actual PEP 517 wheel; backend failure is a test failure."""
+    """Build the actual PEP 517 wheel; backend failure is a test failure.
+
+    Built from a private copy of what the build reads, never from the
+    checkout itself. setuptools writes `build/` and `*.egg-info` into the
+    source it is given, and this fixture is module-scoped, so under
+    `pytest -n auto` each worker that draws a test from this file builds
+    its own wheel. Two of them building from the checkout at once raced in
+    those shared directories and one failed with "wheel build failed",
+    intermittently, on a tree with nothing wrong in it.
+    """
     work = tmp_path_factory.mktemp("installed-wheel-build")
+    source = work / "source"
+    source.mkdir()
+    for name in ("pyproject.toml", "README.md", "LICENSE"):
+        if (ROOT / name).exists():
+            shutil.copy2(ROOT / name, source / name)
+    shutil.copytree(
+        ROOT / "src", source / "src",
+        ignore=shutil.ignore_patterns("__pycache__", "*.egg-info"),
+    )
     result = _run(
         [
             sys.executable,
@@ -116,7 +135,7 @@ def built_wheel(tmp_path_factory: pytest.TempPathFactory) -> Path:
             "--no-deps",
             "--wheel-dir",
             str(work),
-            str(ROOT),
+            str(source),
         ],
         cwd=work,
         env=_clean_env(work),

{maintainability_agent-3.7.6 → maintainability_agent-3.7.7}/tests/test_readme_claims.py

@@ -45,6 +45,23 @@ def test_the_readme_names_the_shipped_version() -> None:
     )
 
 
+
+def test_the_readme_action_example_pins_the_shipped_version() -> None:
+    """The copy-paste Action example installs whatever tag it names.
+
+    `action.yml` runs `pip install -e "$GITHUB_ACTION_PATH"`, so the pin is
+    the version a reader actually gets. It named `v1.0.0` through every
+    release from 1.0.1 to 3.7.5 while the version line above it was kept
+    current, because only that line had a guard.
+    """
+    from maintainability_audit.config import VERSION
+
+    readme = _read(ROOT / "README.md")
+    assert f"maintainability-agent@v{VERSION}" in readme, (
+        f"the README's GitHub Action example does not pin v{VERSION}; a "
+        "reader copying it installs an older release"
+    )
+
 def test_the_report_names_the_corpus_its_anchor_is_drawn_from() -> None:
     """Every multiple is against a corpus; the report must say which one.