napkinstack 0.4.0__tar.gz → 0.5.0__tar.gz

{napkinstack-0.4.0 → napkinstack-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: napkinstack
-Version: 0.4.0
+Version: 0.5.0
 Summary: Engineering framework for several teams and their agents working in one repository: modules, contracts, guardrails in CI.
 License-Expression: MIT
 License-File: LICENSE
@@ -24,7 +24,11 @@ Positioning and vocabulary: [`PRODUCT.md`](PRODUCT.md) §1.
 > the framework announces refuses what it claims to — the boundaries read the contracts a
 > module uses, a contract version someone relies on changes only with a proof, the module
 > checks and stale approvals are enforced, a verifier is not an author, and every verdict names
-> the framework that gave it. A first pilot project, private, starts from it. Tracking: [engine roadmap](docs/governance/plans/2026-09-15-engine-v0.1.0.md),
+> the framework that gave it. Proved on the project that exposed the defects: eight probes
+> replayed, each refused or accepted as announced. A first pilot project, private, starts from
+> v0.5.0, which closes a way around the contract check found while proving it (D44) and says
+> what holds on a repository no plan lets the forge guard (PDR-0006).
+> Tracking: [engine roadmap](docs/governance/plans/2026-09-15-engine-v0.1.0.md),
 > [move to English](docs/governance/plans/2026-09-16-english-migration.md),
 > [frame, verify, approve](docs/governance/plans/2026-09-16-v0.3.0-frame-verify-approve.md),
 > [every barrier refuses](docs/governance/plans/2026-09-19-v0.4.0-every-barrier-refuses.md),
@@ -78,10 +82,25 @@ uv tool install napkinstack --with-executables-from pre-commit   # prerequisites
 nstack init my-project
 ```
 
-Each project then pins its version and changes it through `nstack update`. Every published
-version carries a provenance attestation, visible on PyPI, tying it to the workflow and
-the commit of this repository
-([ADR-0002](docs/adr/0002-distribute-napkinstack-on-pypi.md)).
+To try it without installing anything, or to install it from this repository instead of the
+registry — always pinned to a release tag:
+
+```bash
+uvx --from "git+https://github.com/NapkinStack/engineering-os@v0.4.0" nstack init my-project
+uv tool install "napkinstack @ git+https://github.com/NapkinStack/engineering-os@v0.4.0"
+```
+
+**Two channels, one published artefact.** The registry publishes: the PyPI artefact of a
+`vX.Y.Z` tag carries a provenance attestation tying it to the workflow and the commit of this
+repository. The forge distributes that same tag's source, which is a supported way in and
+never a published one — a tag can be moved, and carries no attestation — so a run installed
+that way says where its rules came from, on every line that judges
+([ADR-0002](docs/adr/0002-distribute-napkinstack-on-pypi.md),
+[PDR-0005](docs/pdr/0005-work-on-the-framework-while-using-it.md)). The project itself is
+unaffected: created from either channel at the same tag, it records the same version and its
+CI installs from the registry.
+
+Each project then pins its version and changes it through `nstack update`.
 
 ## The commands
 

{napkinstack-0.4.0 → napkinstack-0.5.0}/README.md

@@ -9,7 +9,11 @@ Positioning and vocabulary: [`PRODUCT.md`](PRODUCT.md) §1.
 > the framework announces refuses what it claims to — the boundaries read the contracts a
 > module uses, a contract version someone relies on changes only with a proof, the module
 > checks and stale approvals are enforced, a verifier is not an author, and every verdict names
-> the framework that gave it. A first pilot project, private, starts from it. Tracking: [engine roadmap](docs/governance/plans/2026-09-15-engine-v0.1.0.md),
+> the framework that gave it. Proved on the project that exposed the defects: eight probes
+> replayed, each refused or accepted as announced. A first pilot project, private, starts from
+> v0.5.0, which closes a way around the contract check found while proving it (D44) and says
+> what holds on a repository no plan lets the forge guard (PDR-0006).
+> Tracking: [engine roadmap](docs/governance/plans/2026-09-15-engine-v0.1.0.md),
 > [move to English](docs/governance/plans/2026-09-16-english-migration.md),
 > [frame, verify, approve](docs/governance/plans/2026-09-16-v0.3.0-frame-verify-approve.md),
 > [every barrier refuses](docs/governance/plans/2026-09-19-v0.4.0-every-barrier-refuses.md),
@@ -63,10 +67,25 @@ uv tool install napkinstack --with-executables-from pre-commit   # prerequisites
 nstack init my-project
 ```
 
-Each project then pins its version and changes it through `nstack update`. Every published
-version carries a provenance attestation, visible on PyPI, tying it to the workflow and
-the commit of this repository
-([ADR-0002](docs/adr/0002-distribute-napkinstack-on-pypi.md)).
+To try it without installing anything, or to install it from this repository instead of the
+registry — always pinned to a release tag:
+
+```bash
+uvx --from "git+https://github.com/NapkinStack/engineering-os@v0.4.0" nstack init my-project
+uv tool install "napkinstack @ git+https://github.com/NapkinStack/engineering-os@v0.4.0"
+```
+
+**Two channels, one published artefact.** The registry publishes: the PyPI artefact of a
+`vX.Y.Z` tag carries a provenance attestation tying it to the workflow and the commit of this
+repository. The forge distributes that same tag's source, which is a supported way in and
+never a published one — a tag can be moved, and carries no attestation — so a run installed
+that way says where its rules came from, on every line that judges
+([ADR-0002](docs/adr/0002-distribute-napkinstack-on-pypi.md),
+[PDR-0005](docs/pdr/0005-work-on-the-framework-while-using-it.md)). The project itself is
+unaffected: created from either channel at the same tag, it records the same version and its
+CI installs from the registry.
+
+Each project then pins its version and changes it through `nstack update`.
 
 ## The commands
 

{napkinstack-0.4.0 → napkinstack-0.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "napkinstack"
-version = "0.4.0"
+version = "0.5.0"
 description = "Engineering framework for several teams and their agents working in one repository: modules, contracts, guardrails in CI."
 requires-python = ">=3.12"
 license = "MIT"

{napkinstack-0.4.0 → napkinstack-0.5.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "napkinstack"
-version = "0.4.0"
+version = "0.5.0"
 description = "Engineering framework for several teams and their agents working in one repository: modules, contracts, guardrails in CI."
 requires-python = ">=3.12"
 license = "MIT"

{napkinstack-0.4.0 → napkinstack-0.5.0}/src/napkinstack/cli.py

@@ -6,7 +6,8 @@ import argparse
 import json
 from pathlib import Path
 
-from napkinstack import __version__, compat, discovery, doctor, modules, provenance, pull_request, skills
+from napkinstack import (__version__, compat, discovery, doctor, landed, modules, provenance,
+                         pull_request, skills)
 from napkinstack.fitness import boundaries, hygiene, manifests, plan, pr_scope
 
 
@@ -105,6 +106,10 @@ def build_parser() -> argparse.ArgumentParser:
               lambda a: pull_request.run(a.root, a.base, a.body_file))
     pc.add_argument("--base", default="origin/main")
     pc.add_argument("--body-file", type=Path, help="the description, when PR_BODY is not set")
+    ld = _add(sub, "landed", "what reached this branch outside a pull request, recorded (W1)",
+              lambda a: landed.run(a.root, a.span, landed.from_environment(a.root)))
+    ld.add_argument("--span", default="HEAD~1..HEAD",
+                    help="the commits to read, BEFORE..AFTER (default: the last commit)")
     ds = _add(sub, "discover", "starts a discovery from an idea file, for the team's agent (PDR-0002)",
               lambda a: discovery.run(a.root, a.idea))
     ds.add_argument("idea", type=Path, help="the idea, a .md or .txt file")
@@ -124,7 +129,7 @@ def build_parser() -> argparse.ArgumentParser:
 
 
 JUDGES = {"manifests", "boundaries", "plan", "skills", "hygiene", "fitness", "doctor", "pr-scope",
-          "pr-check", "compat"}  # the commands whose verdict depends on the framework's rules
+          "pr-check", "compat", "landed"}  # the commands whose verdict depends on the framework's rules
 
 
 def main(argv: list[str] | None = None) -> int:

{napkinstack-0.4.0 → napkinstack-0.5.0}/src/napkinstack/compat.py

@@ -98,12 +98,15 @@ def _holder(root: Path, path: str) -> tuple[str, Path] | None:
     return None
 
 
-def _extract(root: Path, base: str, path: str, into: Path) -> Path:
-    archive = subprocess.run(["git", "archive", "--format=tar", base, "--", path], cwd=root,
+def _base_tree(root: Path, base: str, into: Path) -> Path:
+    """The whole repository as it is at the base. The proof runs here, so the change it judges
+    cannot rewrite what judges it — a script, a fixture, anything it reads (D44). Measured on
+    2026-09-20: 7 ms for 1.6 MB."""
+    archive = subprocess.run(["git", "archive", "--format=tar", base], cwd=root,
                              capture_output=True, check=True).stdout
     with tarfile.open(fileobj=io.BytesIO(archive)) as tar:
         tar.extractall(into, filter="data")
-    return into / path
+    return into
 
 
 def run(root: Path, module: str | None, base: str) -> int:
@@ -152,15 +155,26 @@ def run(root: Path, module: str | None, base: str) -> int:
                             "a new version beside it (docs/os/03-contracts.md §4).")
             continue
         with tempfile.TemporaryDirectory() as temporary:
+            tree = _base_tree(root, fork, Path(temporary))
+            where_it_runs = tree / folder.relative_to(root)
+            if not where_it_runs.is_dir():
+                failures.append(f"[V1] {label}: module '{name}' has no folder at the base, so its "
+                                f"compatibility command cannot be run as merged.\n      Action: "
+                                "declare the command where the module now lives, in a pull request "
+                                "of its own (docs/os/03-contracts.md §4).")
+                continue
             env = {**os.environ, "NSTACK_CONTRACT": contract, "NSTACK_VERSION": version,
-                   "NSTACK_BASE_PATH": str(_extract(root, fork, path, Path(temporary))),
-                   "NSTACK_HEAD_PATH": str(root / target)}
+                   "NSTACK_BASE_PATH": str(tree / path), "NSTACK_HEAD_PATH": str(root / target)}
             print(f"-> {name}: {command}", flush=True)
-            code = subprocess.run(command, shell=True, cwd=folder, env=env).returncode
+            code = subprocess.run(command, shell=True, cwd=where_it_runs, env=env).returncode
         if code:
-            failures.append(f"[V1] {label}: `{command}` exited with {code}, a breaking change.\n"
-                            "      Action: publish it as a new version beside it, then migrate its "
-                            "consumers (expand/contract, docs/os/03-contracts.md §4).")
+            failures.append(f"[V1] {label}: the compatibility command of module '{name}' ({where}) "
+                            f"did not prove the change compatible (exit {code}).\n"
+                            "      Action: read the comparator's output above. If the change is "
+                            "breaking, publish it as a new version beside this one and migrate its "
+                            "consumers (expand/contract, docs/os/03-contracts.md §4). If the command "
+                            "could not run — a missing tool, no network — fix the command: V1 cannot "
+                            "pass without a proof.")
         else:
             checked.append(f"{label}: proven compatible")
     for line in checked:

{napkinstack-0.4.0 → napkinstack-0.5.0}/src/napkinstack/doctor.py

@@ -44,6 +44,10 @@ from napkinstack import __version__, provenance
 from napkinstack.project import ANSWERS
 
 OK, GAP, UNKNOWN, NOT_APPLICABLE = "OK", "FAIL", "NOT VERIFIED", "NOT APPLICABLE"
+OUT_OF_REACH = "OUT OF REACH"      # the plan forbids it: a state, not a fault (PDR-0006)
+# The settings that make the forge refuse a merge. A repository is guarded when they are
+# all in force; the others matter and none of them stops a merge.
+BLOCKING = ("G1", "G2", "G3", "G4", "G12", "G13")
 API_VERSION = "2026-03-10"
 PLACEHOLDER = "<One sentence: what this project does.>"
 JOBS = ("Fitness functions", "PR scope and review budget", "Hooks and secrets", "Test sheet and cycle",
@@ -287,6 +291,35 @@ def _display(rule: str, setting: str, status: str, detail: str) -> None:
         print(f"                 {line}")
 
 
+def _state(results: list[tuple[str, str, str, str]]) -> None:
+    """Guarded when every setting that refuses a merge is in force; unguarded otherwise, with
+    what a plan forbids kept apart from what is not yet done; never guarded on what could not
+    be read (PDR-0006)."""
+    status_of = {rule: status for rule, _, status, _ in results}
+    blocking = [status_of.get(rule, UNKNOWN) for rule in BLOCKING]
+    if any(status == UNKNOWN for status in blocking):
+        print("\nThis repository: not verified — what cannot be read is never reported as guarded.")
+        return
+    if all(status == OK for status in blocking):
+        print("\nThis repository: guarded — the forge refuses what the checklist asks it to refuse.")
+        return
+    groups = {name: [rule for rule, _, status, _ in results
+                     if status == name and rule.startswith("G")]
+              for name in (OK, GAP, OUT_OF_REACH)}
+    print("\nThis repository: unguarded — nothing here refuses a merge.")
+    for label, name in (("In force", OK), ("Not yet in place", GAP),
+                        ("Out of reach on this plan", OUT_OF_REACH)):
+        if groups[name]:
+            print(f"  {label:<26}: {', '.join(groups[name])}")
+    if groups[OUT_OF_REACH]:
+        print("  What it would take        : make the repository public, where these work at no "
+              "cost on any plan;\n                              or move the private repository to a "
+              "plan that enforces rules;\n                              or keep working here, "
+              "knowing that nothing refuses.")
+    if groups[GAP]:
+        print("  Each setting not yet in place carries its action above.")
+
+
 def run(root: Path) -> int:
     if not (root / ANSWERS).is_file():
         print(f"FAIL [doctor] {ANSWERS} not found in {root}: this folder is not a project "
@@ -324,16 +357,19 @@ def run(root: Path) -> int:
             except Gap as action:
                 status, detail = GAP, f"Action: {action}"
             if private and status != OK and rule in PRIVATE_PLAN:
-                detail += f"\n{PRIVATE_PLAN[rule]}"
+                status, detail = OUT_OF_REACH, f"Reason: {PRIVATE_PLAN[rule]}"
         results.append((rule, setting, status, detail))
         _display(rule, setting, status, detail)
 
     gaps = sum(status == GAP for _, _, status, _ in results)
     unknown = sum(status == UNKNOWN for _, _, status, _ in results)
     skipped = sum(status == NOT_APPLICABLE for _, _, status, _ in results)
+    out_of_reach = sum(status == OUT_OF_REACH for _, _, status, _ in results)
+    _state(results)
     suffix = f", {skipped} not applicable" if skipped else ""
     if not gaps and not unknown:
-        print(f"\nnstack doctor: compliant{suffix}.")
+        reach = f"; {out_of_reach} setting(s) out of reach on this plan" if out_of_reach else ""
+        print(f"\nnstack doctor: compliant{suffix}{reach}.")
         return 0
     print(f"\nnstack doctor: {gaps} gap(s), {unknown} not verified{suffix}.\nWorkflows inform; "
           "it is the GitHub settings that block, and they are not copied with the project.")

napkinstack-0.5.0/src/napkinstack/landed.py

@@ -0,0 +1,122 @@
+"""
+What reached the default branch (PDR-0006).
+
+Rule:
+  W1  a commit on the default branch arrived through a pull request
+
+This is a record, not a barrier. Where the forge can refuse — a ruleset requiring a pull
+request — nothing reaches the default branch any other way, and this says so. Where it
+cannot, because the repository's plan does not allow it, a commit pushed straight to the
+branch is the one thing nobody would otherwise be told about. A record that fires late is
+worth more than a silence.
+
+It says nothing about what predates it: the commit that created the repository, and
+everything the repository already held when the record arrived, are not reported. A record
+that greets a project by failing on its own arrival teaches people to ignore it.
+
+The forge is read with a token supplied by the run (GH_TOKEN, otherwise GITHUB_TOKEN), which
+needs no write access of any kind: the project's automation token stays read-only (G10).
+Without a token, or when the span cannot be read, nothing is claimed.
+
+Usage :  nstack landed [--root ROOT] [--span BEFORE..AFTER]
+Output:  0 when every commit of the span arrived through a pull request, or when nothing
+         could be verified; 1 when one did not.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+from pathlib import Path
+
+import yaml
+
+from napkinstack.doctor import GitHub, NotVerified
+from napkinstack.project import ANSWERS
+
+# The workflow that runs this record in a generated project. Its own arrival is what the
+# record treats as its beginning; platform/tests/run.sh checks the two names match.
+RECORD = ".github/workflows/commits-on-main.yml"
+EMPTY = "0" * 40
+
+
+def _git(root: Path, *args: str) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(["git", *args], cwd=root, capture_output=True, text=True)
+
+
+def _commits(root: Path, span: str) -> list[str] | None:
+    """The commits of the span, newest first; None when the span cannot be read."""
+    before, _, after = span.partition("..")
+    if not after or before in ("", EMPTY):
+        after, before = (after or before), ""          # a branch's first push has no before
+    read = (_git(root, "rev-list", f"{before}..{after}") if before
+            else _git(root, "rev-list", "-1", after))
+    return None if read.returncode else read.stdout.split()
+
+
+def _beginning(root: Path) -> str | None:
+    """The commit that brought the record into the repository, if it is there."""
+    read = _git(root, "log", "--diff-filter=A", "--format=%H", "--", RECORD)
+    return read.stdout.split()[-1] if read.returncode == 0 and read.stdout.split() else None
+
+
+def _exempt(root: Path, commit: str, beginning: str | None) -> str | None:
+    """Why this commit is not recorded, or None when it is to be checked."""
+    if _git(root, "rev-parse", "--verify", "--quiet", f"{commit}^").returncode:
+        return "the first commit of the repository"
+    if beginning and _git(root, "merge-base", "--is-ancestor", commit, beginning).returncode == 0:
+        return "older than the record itself"
+    return None
+
+
+def _described(root: Path, commit: str) -> str:
+    return _git(root, "show", "-s", "--format=%h (%an, %ad)", "--date=short", commit).stdout.strip()
+
+
+def run(root: Path, span: str, forge: GitHub | None) -> int:
+    commits = _commits(root, span)
+    if commits is None:
+        print(f"[W1] the commits of '{span}' cannot be read: not verified.\n"
+              "      Action: fetch the history (fetch-depth: 0), or pass an existing range.")
+        return 0
+    if forge is None:
+        print("[W1] no token (GH_TOKEN or GITHUB_TOKEN): how each commit arrived is not verified.\n"
+              "      Action: supply a token with read access to the repository's pull requests.")
+        return 0
+    beginning = _beginning(root)
+    outside, checked = [], 0
+    for commit in commits:
+        why = _exempt(root, commit, beginning)
+        if why:
+            print(f"Commit {_described(root, commit)}: not recorded, {why}.")
+            continue
+        try:
+            pulls = forge.get(f"/commits/{commit}/pulls")
+        except NotVerified as reason:
+            print(f"[W1] commit {commit[:12]}: not verified. Reason: {reason}")
+            continue
+        checked += 1
+        if pulls:
+            print(f"Commit {_described(root, commit)}: arrived through a pull request.")
+        else:
+            outside.append(commit)
+    for commit in outside:
+        print(f"FAIL [W1] commit {_described(root, commit)} reached this branch outside a pull "
+              "request.\n      This run records it; it does not refuse it — on this repository "
+              "nothing could.\n      Action: read the commit. If it was not meant to land this "
+              "way, revert it through a pull request.")
+    if outside:
+        return 1
+    if checked:
+        print(f"Every commit of this push arrived through a pull request ({checked} checked).")
+    return 0
+
+
+def from_environment(root: Path) -> GitHub | None:
+    """The forge, read-only, from the project's own answers and the run's token."""
+    token = os.environ.get("GH_TOKEN") or os.environ.get("GITHUB_TOKEN")
+    if not token:
+        return None
+    answers = yaml.safe_load((root / ANSWERS).read_text(encoding="utf-8")) or {}
+    return GitHub(str(answers.get("github_repo")), token,
+                  os.environ.get("GITHUB_API_URL") or "https://api.github.com")

{napkinstack-0.4.0 → napkinstack-0.5.0}/src/napkinstack/modules.py

@@ -118,10 +118,15 @@ def next_steps(root: Path, name: str, criticality: str, user_facing: bool) -> li
         why = "user-facing" if user_facing else f"criticality {criticality}"
         steps.append(f"Every pull request that changes its behaviour carries a test sheet ({why}), "
                      "run by a verifier who is not its author (T1–T5, docs/os/05-workflow.md §7)")
-    cycle = plan.accepted_cycle(root) if plan.charter_accepted(root) else None
-    if cycle is None:
-        steps.append("The project is not framed: delivery work needs an accepted charter and cycle (K1), "
+    framed = plan.charter_accepted(root)
+    cycle = plan.accepted_cycle(root) if framed else None
+    if not framed:
+        steps.append("The project is not framed: delivery work needs an accepted charter (K1), "
                      "or the out-of-cycle label with its justification (K4)")
+    elif cycle is None:
+        # The charter is accepted: only the next cycle is missing (D47).
+        steps.append("No accepted cycle: delivery work needs one (K1), or the out-of-cycle label "
+                     "with its justification (K4)")
     else:
         steps.append(f"Delivery work names a ready deliverable of {cycle[0].name} (K3), "
                      "or carries the out-of-cycle label with its justification (K4)")

{napkinstack-0.4.0 → napkinstack-0.5.0}/src/napkinstack/provenance.py

@@ -3,7 +3,9 @@ Which framework judges a project (PDR-0005): a published version, or something n
 published — said out loud on every run that judges, never only in a file.
 
 The engine's origin is what its installer recorded (PEP 610, direct_url.json): nothing for a
-version from the registry; a repository and a commit, or a local checkout, otherwise.
+version from the registry; a repository with the ref it was asked for and the commit that ref
+resolved to, or a local checkout, otherwise. A repository is a supported channel and never a
+published one: a tag can be moved, and carries no attestation (ADR-0002).
 """
 
 from __future__ import annotations
@@ -30,7 +32,13 @@ def engine() -> tuple[str, str | None]:
         return distribution.version, None
     data = json.loads(record)
     if "vcs_info" in data:
-        return distribution.version, f"{data['url']}@{str(data['vcs_info'].get('commit_id', ''))[:12]}"
+        # The installer records the ref it was asked for beside the commit (PEP 610). Naming it
+        # says more than a bare sha — and no less: a tag can be moved, so this is still not the
+        # published artefact (ADR-0002, clarified 2026-09-20).
+        commit = str(data["vcs_info"].get("commit_id", ""))[:12]
+        wanted = str(data["vcs_info"].get("requested_revision") or "")
+        return distribution.version, (f"{data['url']} at {wanted} (commit {commit})" if wanted
+                                      else f"{data['url']}@{commit}")
     if "archive_info" in data:
         return distribution.version, "an archive, not the registry"
     path = Path(url2pathname(urlparse(data.get("url", "")).path))

{napkinstack-0.4.0 → napkinstack-0.5.0}/src/napkinstack/pull_request.py

@@ -11,7 +11,8 @@ Rules:
   T3  no scenario passed without its evidence and the commit it was verified on
   T4  evidence produced on the pull request's head commit: the others are to run again
   T5  no scenario failed; none left not verified, unless it is human only
-  K1  delivery work needs an accepted charter and an accepted cycle
+  K1  delivery work needs an accepted charter and an accepted cycle, and says which of
+      the two is missing
   K2  delivery work stops once the cycle is past its end date: the circuit breaker
   K3  delivery work names a ready or in-progress deliverable of the cycle
   K4  the out-of-cycle label carries its justification
@@ -257,11 +258,18 @@ def check_cycle(root: Path, body: str, labels: set[str], today: datetime.date, f
                        "\"Out of cycle: <reason>\" to the description — an incident, a production defect.")
         return
     cycle = plan.accepted_cycle(root)
-    if not plan.charter_accepted(root) or cycle is None:
-        fail("K1", "the project is not framed: no accepted charter and cycle in docs/project/.\n"
+    if not plan.charter_accepted(root):
+        fail("K1", "the project is not framed: no accepted charter in docs/project/.\n"
                    "      Action: frame it with your agent (playbooks/framing.md), or add the "
                    f"{LABEL} label with a justification.")
         return
+    if cycle is None:
+        # The charter is accepted: sending the reader back to framing would be false (D47).
+        fail("K1", "no accepted cycle: the charter is accepted, and no cycle is open.\n"
+                   "      Action: open the next cycle with your agent "
+                   "(docs/project/cycles/_TEMPLATE.md), or add the "
+                   f"{LABEL} label with a justification.")
+        return
     path, data = cycle
     end = plan.as_date(data.get("end"))
     if end is not None and today > end: