maintainability-agent 4.1.0__tar.gz → 4.3.0__tar.gz

{maintainability_agent-4.1.0/src/maintainability_agent.egg-info → maintainability_agent-4.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.1.0
+Version: 4.3.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.1.0**.
+Version **4.3.0**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -56,6 +56,11 @@ Version **4.1.0**.
 > taste, each pinned to the exact commit it was measured at, so anyone can
 > re-run the calibration and get the same numbers. The median of that corpus
 > scores a **B**. [How the corpus is chosen and measured](docs/standard.md#the-reference-corpus).
+>
+> So your grade places your code against those 201: a **B** means you are at
+> the median of mature, widely used open source. The corpus is re-measured
+> whenever the instrument changes — in 4.1.0 every file of even the largest
+> repositories was read, and the scale came back unchanged to four decimals.
 
 **Languages parsed:** Python, Java, Kotlin, C, C++, C#, Go, Rust, PHP, Ruby,
 Swift, Shell, COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -93,7 +98,10 @@ you what it could not measure.
 **Install secure-code-agent for the security pillar.** Every audit runs it; it is
 installed alongside rather than as a dependency, so the two tools release
 independently. Without it the report says the security pillar was not measured
-and gives this command. Its scanners decide what it can grade — see
+and gives this command. A full security run can take several minutes on a
+large repository; the audit waits up to 15 minutes for it, and
+`security.timeout_seconds` in `maintainability-agent.json` changes that. Its
+scanners decide what it can grade — see
 [machine setup](docs/machine-setup.md#3-toolchain) for which to install, and
 don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
 
@@ -356,6 +364,11 @@ signals on:
 - an ISO/IEC 25010-inspired 0–5 estimate per category, and a verified grade —
   or a disclosed withholding when the evidence is thin.
 
+**Large repositories are measured whole.** Every file is handed to the
+analyzers, split across as many runs as the command line needs, so a big
+codebase is read rather than sampled — FFmpeg's 4,687 files, not the first
+1,543 that fitted on one command line before 4.1.0.
+
 The analyzer is intentionally conservative and under-reports rather than
 over-reports: an unrecognized declaration costs one missed finding, never a
 cascade of false ones. Pair it with native tools (ESLint, Ruff, Radon, Semgrep,
@@ -496,7 +509,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.1.0
+- uses: marshallguillory86/maintainability-agent@v4.3.0
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.1.0**.
+Version **4.3.0**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -14,6 +14,11 @@ Version **4.1.0**.
 > taste, each pinned to the exact commit it was measured at, so anyone can
 > re-run the calibration and get the same numbers. The median of that corpus
 > scores a **B**. [How the corpus is chosen and measured](docs/standard.md#the-reference-corpus).
+>
+> So your grade places your code against those 201: a **B** means you are at
+> the median of mature, widely used open source. The corpus is re-measured
+> whenever the instrument changes — in 4.1.0 every file of even the largest
+> repositories was read, and the scale came back unchanged to four decimals.
 
 **Languages parsed:** Python, Java, Kotlin, C, C++, C#, Go, Rust, PHP, Ruby,
 Swift, Shell, COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -51,7 +56,10 @@ you what it could not measure.
 **Install secure-code-agent for the security pillar.** Every audit runs it; it is
 installed alongside rather than as a dependency, so the two tools release
 independently. Without it the report says the security pillar was not measured
-and gives this command. Its scanners decide what it can grade — see
+and gives this command. A full security run can take several minutes on a
+large repository; the audit waits up to 15 minutes for it, and
+`security.timeout_seconds` in `maintainability-agent.json` changes that. Its
+scanners decide what it can grade — see
 [machine setup](docs/machine-setup.md#3-toolchain) for which to install, and
 don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
 
@@ -314,6 +322,11 @@ signals on:
 - an ISO/IEC 25010-inspired 0–5 estimate per category, and a verified grade —
   or a disclosed withholding when the evidence is thin.
 
+**Large repositories are measured whole.** Every file is handed to the
+analyzers, split across as many runs as the command line needs, so a big
+codebase is read rather than sampled — FFmpeg's 4,687 files, not the first
+1,543 that fitted on one command line before 4.1.0.
+
 The analyzer is intentionally conservative and under-reports rather than
 over-reports: an unrecognized declaration costs one missed finding, never a
 cascade of false ones. Pair it with native tools (ESLint, Ruff, Radon, Semgrep,
@@ -454,7 +467,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.1.0
+- uses: marshallguillory86/maintainability-agent@v4.3.0
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.1.0
+Version: 4.3.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.1.0**.
+Version **4.3.0**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -56,6 +56,11 @@ Version **4.1.0**.
 > taste, each pinned to the exact commit it was measured at, so anyone can
 > re-run the calibration and get the same numbers. The median of that corpus
 > scores a **B**. [How the corpus is chosen and measured](docs/standard.md#the-reference-corpus).
+>
+> So your grade places your code against those 201: a **B** means you are at
+> the median of mature, widely used open source. The corpus is re-measured
+> whenever the instrument changes — in 4.1.0 every file of even the largest
+> repositories was read, and the scale came back unchanged to four decimals.
 
 **Languages parsed:** Python, Java, Kotlin, C, C++, C#, Go, Rust, PHP, Ruby,
 Swift, Shell, COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -93,7 +98,10 @@ you what it could not measure.
 **Install secure-code-agent for the security pillar.** Every audit runs it; it is
 installed alongside rather than as a dependency, so the two tools release
 independently. Without it the report says the security pillar was not measured
-and gives this command. Its scanners decide what it can grade — see
+and gives this command. A full security run can take several minutes on a
+large repository; the audit waits up to 15 minutes for it, and
+`security.timeout_seconds` in `maintainability-agent.json` changes that. Its
+scanners decide what it can grade — see
 [machine setup](docs/machine-setup.md#3-toolchain) for which to install, and
 don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
 
@@ -356,6 +364,11 @@ signals on:
 - an ISO/IEC 25010-inspired 0–5 estimate per category, and a verified grade —
   or a disclosed withholding when the evidence is thin.
 
+**Large repositories are measured whole.** Every file is handed to the
+analyzers, split across as many runs as the command line needs, so a big
+codebase is read rather than sampled — FFmpeg's 4,687 files, not the first
+1,543 that fitted on one command line before 4.1.0.
+
 The analyzer is intentionally conservative and under-reports rather than
 over-reports: an unrecognized declaration costs one missed finding, never a
 cascade of false ones. Pair it with native tools (ESLint, Ruff, Radon, Semgrep,
@@ -496,7 +509,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.1.0
+- uses: marshallguillory86/maintainability-agent@v4.3.0
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -22,6 +22,7 @@ src/maintainability_audit/_banner.py
 src/maintainability_audit/_built_ins.py
 src/maintainability_audit/_calibration.py
 src/maintainability_audit/_catalog.py
+src/maintainability_audit/_changed_code_policy.py
 src/maintainability_audit/_charts.py
 src/maintainability_audit/_cognitive.py
 src/maintainability_audit/_config_defaults.py
@@ -157,6 +158,7 @@ tests/test_a_dangling_source_link_is_named_not_fatal.py
 tests/test_a_format_override_is_disclosed.py
 tests/test_a_matching_format_stays_silent.py
 tests/test_a_published_question_offers_what_it_accepts.py
+tests/test_a_rendered_docs_site_is_not_scored_as_source.py
 tests/test_a_setup_question_keeps_its_contract.py
 tests/test_acquisition_trust.py
 tests/test_adapter_docs.py
@@ -178,6 +180,8 @@ tests/test_analyzer_provenance_exclusions.py
 tests/test_analyzer_scoring_path.py
 tests/test_analyzer_spread_range.py
 tests/test_analyzer_xml_bounds.py
+tests/test_analyzers_against_the_real_tools.py
+tests/test_analyzers_report_what_actually_failed.py
 tests/test_anchor_and_mode.py
 tests/test_anchor_caveat_and_counts_follow_the_run.py
 tests/test_anchor_disclosure.py
@@ -207,6 +211,7 @@ tests/test_calibration_drift.py
 tests/test_calibration_tooling.py
 tests/test_catalog_selection.py
 tests/test_catalog_tier_promise.py
+tests/test_changed_code_policy.py
 tests/test_chat_leads_with_the_work_order.py
 tests/test_chat_primary_docs.py
 tests/test_check_refuses_plus_only_fragments.py
@@ -276,6 +281,7 @@ tests/test_evidence_invariants.py
 tests/test_evidence_normalization.py
 tests/test_evidence_properties.py
 tests/test_example_config_opens_claimed_languages.py
+tests/test_exclude_additional_keeps_the_defaults.py
 tests/test_exclusion_dialects.py
 tests/test_exposure_never_outranks_band.py
 tests/test_falsifier_standard.py
@@ -367,6 +373,7 @@ tests/test_python_declarations.py
 tests/test_read_boundary.py
 tests/test_readme_claims.py
 tests/test_recurrence.py
+tests/test_regular_file_reads_work_without_o_nonblock.py
 tests/test_release_needs_an_empty_ledger.py
 tests/test_release_plan.py
 tests/test_release_plan_status.py

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "4.1.0"
+__version__ = "4.3.0"

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/_adapters.py

@@ -118,6 +118,36 @@ def _format_default(_base: Path, tree: str) -> tuple[str, ...]:
     return (tree, f"{tree}/**")
 
 
+_REGEX_DIALECTS = frozenset({"regex", "rel_regex"})
+
+
+def _name_as_regex(pattern: str) -> str:
+    """A shell-style name as a regex that finds it as a path component anywhere.
+
+    `*` and `?` stay inside one component, as they do for the built-in
+    scan's own matcher; the name matches at the start of the path or after
+    a `/`, and ends at a `/` or the end, so `.venv/` is not `venv_tools.py`.
+    Works for `re.match` on an absolute path (pylint) and `re.search` on a
+    relative one (mypy) alike.
+    """
+    body = "".join("[^/]*" if ch == "*" else "[^/]" if ch == "?" else re.escape(ch)
+                   for ch in pattern.strip("/"))
+    return f"(?:^|.*/){body}(?:/|$)"
+
+
+def _names_as_paths(excludes: Sequence[str], root: Path) -> tuple[str, ...]:
+    """Plain path names as absolute paths under the root; wildcards dropped.
+
+    A path dialect (interrogate's `--exclude`) names locations, so
+    `calibration/.corpus/` becomes `<root>/calibration/.corpus`. A wildcard
+    such as `*.min.js` names no location and cannot be spelled here; it is
+    left out, which can only under-exclude — the scan's own filter still
+    applies it to what the tool reports.
+    """
+    return tuple(str(root / pattern.strip("/")) for pattern in excludes
+                 if not any(ch in pattern for ch in "*?["))
+
+
 _TREE_FORMATTERS = {
     "fnmatch": _format_fnmatch,
     "regex": _format_regex,
@@ -267,7 +297,7 @@ class BaseAdapter:
         """
         if not self.exclude_flag:
             return ()
-        entries = tuple(excludes) + self.tree_patterns(
+        entries = self.operator_patterns(excludes, root) + self.tree_patterns(
             getattr(excludes, "trees", ()), root
         )
         if not entries:
@@ -279,6 +309,21 @@ class BaseAdapter:
             return tuple(repeated)
         return (self.exclude_flag, self.exclude_separator.join(entries))
 
+    def operator_patterns(self, excludes: Sequence[str], root: Path | None = None) -> tuple[str, ...]:
+        """The operator's exclude names, spelled for this tool's matcher.
+
+        They are shell-style names — `.venv/`, `*.egg-info/` — and for most
+        dialects they pass through as written. A regex dialect compiles
+        them: pylint's `--ignore-paths` refused `*.egg-info` ("nothing to
+        repeat"), exited with an argument error, and analysed nothing, on
+        every repository whose config carried a glob (the default does).
+        """
+        if self.exclude_dialect == "abspath":
+            return _names_as_paths(excludes, Path(root) if root is not None else Path("."))
+        if self.exclude_dialect not in _REGEX_DIALECTS:
+            return tuple(excludes)
+        return tuple(_name_as_regex(pattern) for pattern in excludes)
+
     def tree_patterns(
         self, trees: Sequence[str], root: Path | None = None
     ) -> tuple[str, ...]:

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/_analysis.py

@@ -447,6 +447,7 @@ def _attempt(root: Path, adapter: Any, probe: Probe, timeout: int,
         )
 
     result, parsed = _run_batches(adapter, root, excludes, timeout)
+    result = _silent_failure(adapter.slug, result, parsed)
     # Filtered before the counts are taken, not after. Recording 48
     # measurements and reporting 6 describes an activity rather than a
     # result, which is the defect this project keeps finding.
@@ -500,6 +501,24 @@ def _run_batches(adapter: Any, root: Path, excludes: Sequence[str],
     return _merged_result(results, len(invocations)), _merged_extraction(parsed)
 
 
+def _silent_failure(slug: str, result: ToolResult, parsed: Extraction) -> ToolResult:
+    """A tool that wrote nothing failed, whatever its exit code says.
+
+    pylint's argument error exits 2, which is also its "error messages
+    issued" bit, so a run that analysed nothing counted as one that worked
+    and its empty output was reported as unreadable JSON while stderr held
+    the reason. secure-code-agent recorded the same class as its D30: let
+    the output decide, and let the failure carry what the tool said.
+    """
+    if not (parsed.parse_error and result.usable and not (result.stdout or "").strip()):
+        return result
+    said = " ".join((result.stderr or "").split())[:400]
+    if not said:
+        return result
+    return replace(result, outcome=Outcome.FAILED,
+                   detail=f"{slug} exited {result.exit_code} and wrote no output; it said: {said}")
+
+
 def _merged_result(results: list[ToolResult], planned: int) -> ToolResult:
     failed = next((r for r in results if not r.usable), None)
     basis = failed or results[0]

maintainability_agent-4.3.0/src/maintainability_audit/_changed_code_policy.py

@@ -0,0 +1,98 @@
+"""Code a change touches is held to a stricter bar (Decision 15).
+
+A repository adopting a quality gate cannot fix every old long function
+first, and a gate that fails on all of them is a gate nobody turns on.
+`policy.changed_code` sets stricter function limits, and on a run against a
+change only the functions that change touched are held to them; untouched
+code is judged by the standard as before.
+
+A function is *touched* when the change added or altered a line inside it —
+`git diff --unified=0` lines, so context does not count and a pure deletion
+touches nothing. Classes are not held to it: their budget is a container's,
+and their methods are functions in their own right.
+
+Two rules from the decision, enforced here rather than trusted:
+
+- **A policy only tightens.** A limit looser than the standard threshold is
+  refused when the configuration loads, by name, as `PolicyError` — the
+  refusal both doors already turn into a message.
+- **It never moves the grade.** Its result is `report["policy"]`, beside the
+  score rather than inside `hard_gate_failures`, which the scorer reads.
+  `--fail-on-gate` reads both.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ._catalog import PolicyError
+
+#: Each policy key: the standard threshold it may only tighten, the
+#: function-metric field it reads, and the name a failure reports.
+LIMITS: dict[str, tuple[str, str, str]] = {
+    "max_function_lines": ("max_function_lines", "lines", "function_lines"),
+    "max_complexity": ("max_complexity", "complexity", "complexity"),
+    "max_cognitive_complexity": ("max_cognitive_complexity", "cognitive", "cognitive_complexity"),
+}
+
+
+def changed_code_limits(config: dict[str, Any]) -> dict[str, int]:
+    """The configured limits, or empty when the repository sets none."""
+    return dict((config.get("policy") or {}).get("changed_code") or {})
+
+
+def validate(config: dict[str, Any]) -> None:
+    """Refuse a limit that is unknown, not a positive integer, or looser than the standard."""
+    thresholds = config.get("thresholds") or {}
+    for key, value in changed_code_limits(config).items():
+        if key not in LIMITS:
+            raise PolicyError(
+                f"unknown policy.changed_code key {key!r}; expected one of {sorted(LIMITS)}")
+        if isinstance(value, bool) or not isinstance(value, int) or value < 1:
+            raise PolicyError(f"policy.changed_code.{key} must be a positive integer, not {value!r}")
+        standard = thresholds.get(LIMITS[key][0])
+        if isinstance(standard, int) and value > standard:
+            raise PolicyError(
+                f"policy.changed_code.{key} is {value}, looser than the standard "
+                f"thresholds.{LIMITS[key][0]} of {standard}; a policy may only tighten")
+
+
+def evaluate(function_metrics: list[Any], touched_lines: dict[str, set[int]],
+             config: dict[str, Any], revspec: str) -> dict[str, Any] | None:
+    """Every touched function's breaches of the policy, or None without a policy."""
+    limits = changed_code_limits(config)
+    if not limits:
+        return None
+    touched = [metric for metric in function_metrics if _touched(metric, touched_lines)]
+    return {
+        "revspec": revspec,
+        "limits": limits,
+        "touched_functions": len(touched),
+        "failures": [failure for metric in touched for failure in _breaches(metric, limits)],
+    }
+
+
+def failures(report: dict[str, Any]) -> list[dict[str, Any]]:
+    """The policy's failures in a finished report; empty when no policy ran."""
+    return list((report.get("policy") or {}).get("failures") or [])
+
+
+def _touched(metric: Any, touched_lines: dict[str, set[int]]) -> bool:
+    if getattr(metric, "kind", "function") == "class":
+        return False
+    lines = touched_lines.get(metric.path)
+    if not lines:
+        return False
+    end = metric.start_line + metric.lines
+    return any(metric.start_line <= line < end for line in lines)
+
+
+def _breaches(metric: Any, limits: dict[str, int]) -> list[dict[str, Any]]:
+    found = []
+    for key, limit in limits.items():
+        _standard, field, measure = LIMITS[key]
+        value = getattr(metric, field, None)
+        if isinstance(value, int) and value > limit:
+            found.append({"path": metric.path, "name": metric.name, "start_line": metric.start_line,
+                          "measure": measure, "value": value, "limit": limit})
+    return found

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/_gates.py

@@ -18,6 +18,7 @@ import argparse
 import sys
 from pathlib import Path
 
+from ._changed_code_policy import failures as policy_failures
 from .baseline import findings_not_in_baseline
 from .git_tools import added_lines, changed_paths, removed_lines
 
@@ -147,7 +148,7 @@ def audit_exit_code(args: argparse.Namespace, report: dict) -> int:
         root = Path(report["root"])
         if findings_not_in_baseline(report, args.baseline, root):
             return 1
-    if args.fail_on_gate and report["hard_gate_failures"]:
+    if args.fail_on_gate and (report["hard_gate_failures"] or policy_failures(report)):
         return 1
     conformance = _conformance_exit(args, report)
     if conformance:

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/_html_view.py

@@ -318,15 +318,36 @@ def _work_order_section(report: dict[str, Any]) -> list[str]:
 
 def _hard_gate_section(report: dict[str, Any]) -> list[str]:
     failures = report.get("hard_gate_failures") or []
+    rows: list[str] = []
+    if failures:
+        rows = [
+            "<h2>Hard gates</h2>",
+            "<table><tr><th>Severity</th><th>Gate</th></tr>",
+        ]
+        rows.extend(
+            f"<tr><td class='sev-Severe'>Severe</td><td>{escape(str(gate))}</td></tr>"
+            for gate in failures
+        )
+        rows.append("</table>")
+    return rows + _policy_section(report)
+
+
+def _policy_section(report: dict[str, Any]) -> list[str]:
+    """The changed-code policy beside the gates, as the markdown prints it (Decision 15)."""
+    policy = report.get("policy")
+    failures = (policy or {}).get("failures") or []
     if not failures:
         return []
     rows = [
-        "<h2>Hard gates</h2>",
-        "<table><tr><th>Severity</th><th>Gate</th></tr>",
+        "<h2>Changed-code policy</h2>",
+        f"<p class='muted'>Functions touched by {escape(str(policy.get('revspec')))} are held to "
+        "this repository's stricter limits. The grade is unaffected.</p>",
+        "<table><tr><th>Location</th><th>Function</th><th>Measure</th><th>Value</th><th>Limit</th></tr>",
     ]
     rows.extend(
-        f"<tr><td class='sev-Severe'>Severe</td><td>{escape(str(gate))}</td></tr>"
-        for gate in failures
+        f"<tr><td>{escape(str(f['path']))}:{f['start_line']}</td><td>{escape(str(f['name']))}</td>"
+        f"<td>{escape(str(f['measure']))}</td><td>{f['value']}</td><td>{f['limit']}</td></tr>"
+        for f in failures
     )
     rows.append("</table>")
     return rows

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/_mcp_audit.py

@@ -21,6 +21,7 @@ from typing import Any
 
 from ._calibration import CALIBRATION_C
 from ._catalog import PRESENTATIONS
+from ._changed_code_policy import failures as policy_failures
 from ._grant_ledger import (
     ALLOWED_ROOTS_ENV as ALLOWED_ROOTS_ENV,  # noqa: PLC0414 - re-export
 )
@@ -396,7 +397,8 @@ def _top_level_result(report: dict[str, Any], root: Path, status: str,
         "audit_ran": True,
         "source_commit": probe_git(["rev-parse", "HEAD"], root) or None,
         "worktree_dirty": bool(status),
-        "gate_passed": not report["hard_gate_failures"],
+        # The changed-code policy is a gate too (Decision 15); the CLI reads both.
+        "gate_passed": not (report["hard_gate_failures"] or policy_failures(report)),
         # Stated at the top level so a caller cannot mistake an audit that
         # ran six built-in detectors for one that ran ten tools. Two
         # reports with different coverage are not comparable (P8).

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/_metric_adapters.py

@@ -321,10 +321,12 @@ class CohesionAdapter(BaseAdapter):
         super().__init__(
             slug="cohesion", emits="metric", executable="cohesion",
             concepts=("cohesion",), exclude_dialect="files",
-            # Its CLI takes files or a directory and has no version flag,
-            # so availability is answered from package metadata, the same
-            # arrangement multimetric already uses.
-            distribution="cohesion",
+            # Its CLI takes files or a directory and has no version flag, so
+            # the version comes from package metadata — and availability
+            # from `--help`, the arrangement multimetric uses. The probe was
+            # `--version`, which argparse rejects with exit 2, so cohesion
+            # was recorded as failed without ever being asked to run.
+            version_flag="--help", distribution="cohesion",
         )
 
     def has_targets(self, root: Path, excludes: Sequence[str] = ()) -> bool:

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/_operator_reads.py

@@ -55,7 +55,9 @@ def open_regular_file(path: Path, why: str) -> int:
     """
     import stat as stat_module
 
-    handle = os.open(path, os.O_RDONLY | os.O_NONBLOCK)
+    # Windows has no `O_NONBLOCK` and no POSIX FIFO in the tree to guard
+    # against; using the flag unconditionally killed every read there.
+    handle = os.open(path, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0))
     if not stat_module.S_ISREG(os.fstat(handle).st_mode):
         os.close(handle)
         raise PathNotAllowed(f"{path} is not a regular file. {why}")

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/_ratio_adapters.py

@@ -134,7 +134,10 @@ class InterrogateAdapter(BaseAdapter):
         super().__init__(
             slug="interrogate", emits="metric", executable="interrogate",
             concepts=("documentation",), findings_exit_codes=(0, 1),
-            exclude_flag="--exclude", exclude_separator=" ",
+            # One `--exclude` per path: interrogate names one location per
+            # flag, and a space-joined list named none, so excluded trees
+            # were analysed and one unparseable file in them crashed it.
+            exclude_flag="--exclude", exclude_repeat=True,
             exclude_dialect="abspath",
         )
 

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/config.py

@@ -7,6 +7,7 @@ from typing import Any
 # Re-exported: the defaults live in `_config_defaults`, this module is
 # still the door every caller comes through.
 from . import __version__ as _package_version
+from ._changed_code_policy import validate as validate_changed_code_policy
 from ._config_defaults import DEFAULT_CONFIG, DEFAULT_IDIOM_GROUPS
 from ._operator_reads import (
     MAX_OPERATOR_FILE_BYTES as MAX_OPERATOR_FILE_BYTES,
@@ -161,12 +162,30 @@ def load_config(path: str | None) -> dict[str, Any]:
         return config
     config["analyzers"]["run"] = True
     if user_tier is not None:
-        deep_update(config, user_tier)
+        _merge_tier(config, user_tier)
     if path:
-        deep_update(config, _host_authority_stripped(_configured(Path(path))))
+        _merge_tier(config, _host_authority_stripped(_configured(Path(path))))
+    validate_changed_code_policy(config)
     return config
 
 
+def _merge_tier(config: dict[str, Any], tier: dict[str, Any]) -> None:
+    """One tier over the ones before it, with `exclude_additional` appended.
+
+    `deep_update` replaces lists, so setting `paths.exclude_patterns` to add
+    one directory discarded every default exclusion and froze a copy that
+    drifts on the next release (#292). `exclude_additional` adds to whatever
+    the earlier tiers produced instead, so a repository can add without
+    restating.
+    """
+    added = list((tier.get("paths") or {}).get("exclude_additional") or [])
+    deep_update(config, tier)
+    paths = config["paths"]
+    paths.pop("exclude_additional", None)
+    paths["exclude_patterns"] = [*paths["exclude_patterns"],
+                                 *(p for p in added if p not in paths["exclude_patterns"])]
+
+
 #: The one key a repository may state and this tool will not act on,
 #: because acting on it runs a program of the tree's choosing on the host.
 #: The whole leaf is dropped, not merged.

{maintainability_agent-4.1.0 → maintainability_agent-4.3.0}/src/maintainability_audit/renderers.py

@@ -178,11 +178,32 @@ def render_markdown(report: dict[str, Any], *, complete: bool = True) -> str:
 
 
 def _hard_gate_lines(report: dict[str, Any]) -> list[str]:
-    """The hard-gate list, printed the same way wherever it appears."""
-    if not report["hard_gate_failures"]:
+    """The hard-gate list, printed the same way wherever it appears.
+
+    The changed-code policy follows it: also a gate, never a grade
+    (Decision 15), so it is printed wherever the gates are.
+    """
+    lines: list[str] = []
+    if report["hard_gate_failures"]:
+        lines += ["## Hard Gate Failures", "",
+                  *(f"- {gate}" for gate in report["hard_gate_failures"]), ""]
+    return lines + _policy_lines(report)
+
+
+def _policy_lines(report: dict[str, Any]) -> list[str]:
+    policy = report.get("policy")
+    if not policy:
         return []
-    return ["## Hard Gate Failures", "",
-            *(f"- {gate}" for gate in report["hard_gate_failures"]), ""]
+    failures = policy.get("failures") or []
+    head = (f"{policy.get('touched_functions', 0)} function(s) touched by "
+            f"`{policy.get('revspec')}` are held to this repository's stricter limits; "
+            "the grade is unaffected.")
+    if not failures:
+        return ["## Changed-code policy", "", head + " All of them meet it.", ""]
+    rows = [f"| `{f['path']}:{f['start_line']}` | `{f['name']}` | {f['measure']} | {f['value']} | {f['limit']} |"
+            for f in failures]
+    return ["## Changed-code policy", "", head, "",
+            "| Location | Function | Measure | Value | Limit |", "|---|---|---|---|---|", *rows, ""]
 
 
 def _no_work_order_lines() -> list[str]: