pactkit-codex 3.0.3__tar.gz → 3.0.5__tar.gz

{pactkit_codex-3.0.3/src/pactkit_codex.egg-info → pactkit_codex-3.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pactkit-codex
-Version: 3.0.3
+Version: 3.0.5
 Summary: PactKit adapter for OpenAI Codex CLI
 Author: Slim
 License: MIT

{pactkit_codex-3.0.3 → pactkit_codex-3.0.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pactkit-codex"
-version = "3.0.3"
+version = "3.0.5"
 description = "PactKit adapter for OpenAI Codex CLI"
 readme = "README.md"
 license = {text = "MIT"}

pactkit_codex-3.0.5/src/pactkit_codex/__init__.py

@@ -0,0 +1,10 @@
+"""PactKit Codex — thin adapter for OpenAI Codex CLI."""
+
+from pactkit import __version__  # noqa: F401
+
+# The second import is for its side effect: it registers Codex's enforcement
+# channel (SPEC-4.0-06 R3), and registration IS Core's availability signal —
+# an adapter that is not installed cannot register, so `format == "all"` never
+# installs a channel for a host that never deployed.
+from pactkit_codex.deployer import CodexDeployer  # noqa: F401
+from pactkit_codex.enforcement import codex_channel  # noqa: F401

pactkit_codex-3.0.5/src/pactkit_codex/declarations.py

@@ -0,0 +1,141 @@
+"""Codex's own declarations (SPEC-4.0-22 Step 6).
+
+These lived in Core's transitional seed (`_CORE_CAPABILITIES`, `_CORE_SECURITY`,
+`_CORE_PRETOOL_SURFACES`, `_CORE_DEPLOYMENT_CLAIMS`) until Step 6. While they
+did, this adapter could not answer for itself: `import pactkit_codex` read Core's table
+for its own identity, so removing the seed broke the import rather than the
+deployment.
+
+Core still owns the **vocabulary** (`capability.CAPABILITY_VOCABULARY`), the
+four levels, and the hole-filling rule in `resolve_capabilities`. What a given
+Host scores on them is the Host's own declaration — that is the split
+SPEC-4.0-22 R1 draws, and this module is the Codex side of it.
+
+Every value here was materialised from the seed Core was carrying, so this is a
+move, not a re-measurement. The `Capability.evidence` strings are preserved
+verbatim for the same reason: they are what the seed said, and re-wording them
+here would quietly change what the registry reports.
+"""
+
+from __future__ import annotations
+
+from pactkit.capability import Capability, CapabilityLevel
+from pactkit.profiles import (
+    CLIPolicy,
+    DeploymentClaim,
+    FormatProfile,
+    InputTranslation,
+    SecurityDeclaration,
+    SecurityFacts,
+)
+
+__all__ = [
+    "CAPABILITIES",
+    "DEPLOYMENT_CLAIM",
+    "INPUT_TRANSLATION",
+    "PRETOOL_SURFACE",
+    "PROFILE",
+    "SECURITY",
+]
+
+
+def _cap(name: str, level: CapabilityLevel, implemented: bool, evidence: str) -> Capability:
+    return Capability(name=name, level=level, implemented=implemented, evidence=evidence)
+
+
+#: The Host's profile. Core no longer owns it; this module is the source.
+PROFILE = FormatProfile(
+    name='codex',
+    display_name='Codex CLI',
+    global_config_dir='~/.codex',
+    project_config_dir='.codex',
+    skills_dir='~/.codex/skills',
+    agents_dir='~/.codex/agents',
+    commands_dir='~/.codex/prompts',
+    rules_dir='~/.codex/rules',
+    project_instructions_file='AGENTS.md',
+    global_instructions_file='AGENTS.md',
+    pactkit_yaml_path='.codex/pactkit.yaml',
+    agent_format='md',
+    rules_import_style='inline',
+    excluded_agent_fields=frozenset({'memory', 'permissionMode', 'skills', 'hooks'}),
+    excluded_commands=frozenset(),
+    supports_model_routing=False,
+    skills_path_var='~/.codex/skills',
+    command_deploy_form='skill',
+    agent_dialect=None,
+    command_dialect=None,
+    core_bundled=False,
+    cli_policy=CLIPolicy.PREFERRED,
+)
+
+#: What this Host scores on the capability vocabulary.
+CAPABILITIES: dict[str, Capability] = {
+    'completion_hook': _cap('completion_hook', CapabilityLevel.DEGRADED, False,
+        "unverified — not measured on this Host; absence of the capability is NOT established (SPEC-4.0-04 R2: "
+        "unverified is not unavailable)",
+    ),
+    'git_hook': _cap('git_hook', CapabilityLevel.NATIVE, True, 'shipped (commit_gate pre-commit chain)',
+    ),
+    'global_instruction': _cap('global_instruction', CapabilityLevel.EQUIVALENT, True, 'shipped (~/.codex/AGENTS.md)',
+    ),
+    'native_command': _cap('native_command', CapabilityLevel.DEGRADED, False,
+        "unverified — not measured on this Host; absence of the capability is NOT established (SPEC-4.0-04 R2: "
+        "unverified is not unavailable)",
+    ),
+    'native_skill': _cap('native_skill', CapabilityLevel.DEGRADED, False,
+        "unverified — not measured on this Host; absence of the capability is NOT established (SPEC-4.0-04 R2: "
+        "unverified is not unavailable)",
+    ),
+    'persistent_session': _cap('persistent_session', CapabilityLevel.DEGRADED, False,
+        "unverified — not measured on this Host; absence of the capability is NOT established (SPEC-4.0-04 R2: "
+        "unverified is not unavailable)",
+    ),
+    'post_tool_hook': _cap('post_tool_hook', CapabilityLevel.DEGRADED, False,
+        "unverified — not measured on this Host; absence of the capability is NOT established (SPEC-4.0-04 R2: "
+        "unverified is not unavailable)",
+    ),
+    'pre_tool_hook': _cap('pre_tool_hook', CapabilityLevel.NATIVE, True,
+        'shipped (doctor.check_codex_hook_capability; native hooks engine)',
+    ),
+    'project_instruction': _cap('project_instruction', CapabilityLevel.EQUIVALENT, True,
+        'shipped (AGENTS.md at project root)',
+    ),
+    'rule_import': _cap('rule_import', CapabilityLevel.EQUIVALENT, True, 'shipped as AGENTS.md (generators.deployer)',
+    ),
+    'session_resume': _cap('session_resume', CapabilityLevel.DEGRADED, False,
+        "unverified — not measured on this Host; absence of the capability is NOT established (SPEC-4.0-04 R2: "
+        "unverified is not unavailable)",
+    ),
+    'shell_execution': _cap('shell_execution', CapabilityLevel.NATIVE, True, 'shipped (native shell tool)',
+    ),
+    'structured_tool_result': _cap('structured_tool_result', CapabilityLevel.DEGRADED, False,
+        "unverified — not measured on this Host; absence of the capability is NOT established (SPEC-4.0-04 R2: "
+        "unverified is not unavailable)",
+    ),
+    'subagent': _cap('subagent', CapabilityLevel.DEGRADED, False,
+        "unverified — not measured on this Host; absence of the capability is NOT established (SPEC-4.0-04 R2: "
+        "unverified is not unavailable)",
+    ),
+}
+
+#: Files a gate must treat specially on this Host (SPEC-4.0-22 R8).
+SECURITY = SecurityDeclaration(
+    env_capable=SecurityFacts.declared(['.codex/config.toml']),
+    protected=SecurityFacts.declared(['.codex/hooks.json']),
+    conditional=SecurityFacts.empty(),
+)
+
+#: Which mechanism this Host offers for pre-tool interception, when one
+#: has been measured. `None` means unverified — not "cannot".
+PRETOOL_SURFACE = 'native hooks engine'
+
+#: How this Host executes and where its verification comes from.
+DEPLOYMENT_CLAIM = DeploymentClaim(
+    execution_mode='portable',
+    verification_source='native_codex_session',
+)
+
+#: Read-side wire-format data, when the Host has one. `None` means it
+#: declares none — the ladder then never asks it to recognise a payload.
+INPUT_TRANSLATION: InputTranslation | None = None

{pactkit_codex-3.0.3 → pactkit_codex-3.0.5}/src/pactkit_codex/deployer.py

@@ -36,13 +36,16 @@ from pactkit.generators.command_ownership import (
     write_command_manifest,
 )
 from pactkit.generators.deploy_base import DeployerBase, register_deployer
+
+# SPEC-4.0-06 R1: of this adapter's Core imports, only the two from
+# `pactkit.generators.spi` below have a frozen public equivalent; everything
+# else in this block is reached for directly.
 from pactkit.generators.deployer import (
     _cleanup_legacy,
     _cleanup_legacy_portable_methods,
     _enforce_deploy_integrity,
-    _render_prompt,
 )
-from pactkit.profiles import get_profile
+from pactkit.generators.spi import render_prompt, render_skill_md
 from pactkit.prompts.guides import GUIDES_FILES
 from pactkit.prompts.rules import (
     COMMAND_CONDITIONAL_RULES_MAP,
@@ -53,6 +56,8 @@ from pactkit.prompts.rules import (
 )
 from pactkit.utils import atomic_write
 
+from pactkit_codex import declarations
+
 # All canonical commands deploy. Sprint degrades to sequential execution when
 # Codex does not expose team orchestration primitives.
 CODEX_EXCLUDED_COMMANDS: frozenset[str] = frozenset()
@@ -107,7 +112,13 @@ class CodexDeployer(DeployerBase):
     - config.toml (not JSON/YAML)
     """
 
-    profile = get_profile("codex")
+    # SPEC-4.0-22 Step 6 — the Host's own declarations (see declarations.py).
+    profile = declarations.PROFILE
+    capabilities = declarations.CAPABILITIES
+    security = declarations.SECURITY
+    pretool_surface = declarations.PRETOOL_SURFACE
+    deployment_claim = declarations.DEPLOYMENT_CLAIM
+    input_translation = declarations.INPUT_TRANSLATION
 
     @staticmethod
     def continuation_capabilities(codex_root=None):
@@ -115,16 +126,17 @@ class CodexDeployer(DeployerBase):
 
         Codex PDCA commands run in the user's active session. PactKit no
         longer ships runners, workflow hooks, or background execution.
+
+        The `(execution_mode, verification_source)` pair is deliberately
+        **absent**: it is this Host's declaration in `_write_deployment_manifest`,
+        and Core derives the manifest from it (SPEC-4.0-06 R8).  A copy here would
+        not follow the declaration — R8's own test for "copy" not "derived" — and
+        the one this adapter carried had drifted from Core's `protocol_version`.
         """
         del codex_root
         return {
             "finish_guard_supported": False,
             "protocol_version": 0,
-            # ``portable`` is the Core protocol guarantee.  The separate
-            # session_execution field records the host UX without inventing
-            # a new doctor/workflow-engine enum value.
-            "execution_mode": "portable",
-            "verification_source": "native_codex_session",
             "completion_hook": False,
             "session_reentry": False,
             "auto_resume_available": False,
@@ -283,6 +295,38 @@ class CodexDeployer(DeployerBase):
             ))
         return tuple(paths)
 
+    @staticmethod
+    def _rule_paths(enabled_commands, enabled_rules) -> dict[str, list[str]]:
+        """Canonical rule id -> every relative path that rule is deployed to.
+
+        One definition, three readers: `deploy_codex_rules` retires stale
+        globals from it, the stale-reference sweep decides what to keep, and
+        the deployment manifest declares it to Core (SPEC-4.0-06 R2/AC2).
+        Codex keeps global rules in `rules/` and copies conditional ones into
+        each applicable command skill; Core derived that from the host name and
+        can no longer, and the host-agnostic fallback records none of the
+        command-local paths — under-recording the ledger that licenses deletion.
+        """
+        rules = sorted(DEFAULT_RULE_IDS) if enabled_rules is None else enabled_rules
+        enabled = {
+            r for rule_id in rules if (r := normalize_rule_id(rule_id)) is not None
+        }
+        commands = set(VALID_COMMANDS if enabled_commands is None else enabled_commands)
+        declared = {
+            rule_id: [f"rules/{RULE_DEFINITIONS[rule_id].filename}"]
+            for rule_id in sorted(enabled & RULE_DEFINITIONS.keys())
+            if RULE_DEFINITIONS[rule_id].load_policy == "global"
+        }
+        for command in sorted(COMMAND_CONDITIONAL_RULES_MAP):
+            if command not in commands:
+                continue
+            for rule_id in COMMAND_CONDITIONAL_RULES_MAP[command]:
+                if rule_id in enabled:
+                    declared.setdefault(rule_id, []).append(
+                        f"skills/{command}/references/rules/{rule_id}.md"
+                    )
+        return declared
+
     @staticmethod
     def _cleanup_stale_command_references(
         codex_root: Path, enabled_commands, enabled_rules,
@@ -312,19 +356,9 @@ class CodexDeployer(DeployerBase):
             return
 
         commands = set(VALID_COMMANDS if enabled_commands is None else enabled_commands)
-        configured = sorted(DEFAULT_RULE_IDS) if enabled_rules is None else enabled_rules
-        rule_ids = {
-            normalized
-            for rule_id in configured
-            if (normalized := normalize_rule_id(rule_id)) is not None
-        }
-        desired = {
-            f"skills/{command}/references/rules/{rule_id}.md"
-            for command, candidates in COMMAND_CONDITIONAL_RULES_MAP.items()
-            if command in commands
-            for rule_id in candidates
-            if rule_id in rule_ids
-        }
+        desired = set().union(
+            *CodexDeployer._rule_paths(enabled_commands, enabled_rules).values()
+        )
         if "project-act" in commands:
             desired.update(
                 f"skills/project-act/references/guides/{filename}"
@@ -365,34 +399,45 @@ class CodexDeployer(DeployerBase):
                     parent = parent.parent
 
     def _write_deployment_manifest(self, codex_root, cfg):
-        """Write the Core manifest and Codex-native capability projection."""
-        from pactkit.deploy_manifest import write_deploy_manifest
-
-        manifest_path = write_deploy_manifest(codex_root, "codex", cfg)
+        """Write the Core manifest, declaring what only this Host knows."""
+        from pactkit.deploy_manifest import HostDeclaration, write_deploy_manifest
+
+        # Codex's rule layout is not derivable from the host name any more
+        # (SPEC-4.0-06 R2). Core used to branch on `format_name == "codex"` to
+        # find command-local rule references; the host-agnostic fallback records
+        # only `rules/pactkit-runtime.md`, under-recording the ledger that is
+        # what licenses `_cleanup_stale_command_references` to delete.
+        # R8: the `(execution_mode, verification_source)` pair is the Host's
+        # **declaration** — Core records it and derives both sections from it,
+        # including `tool_execution`, `manual_resume` and `guarantee_level`,
+        # which are functions of `execution_mode` and not separate facts.  This
+        # adapter used to write both sections itself, restating the same two
+        # values; they happened to agree, and nothing kept them agreeing.
+        manifest_path = write_deploy_manifest(
+            codex_root, "codex", cfg,
+            declaration=HostDeclaration(
+                rule_paths=CodexDeployer._rule_paths(
+                    cfg.get("commands"), cfg.get("rules", sorted(DEFAULT_RULE_IDS)),
+                ),
+                execution_mode="portable",
+                verification_source="native_codex_session",
+            ),
+        )
         manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
         capability = self.continuation_capabilities(codex_root)
         if not capability["hook_installed"]:
             capability["hook_observed"] = False
             capability["hook_trusted"] = False
-        manifest["workflow_continuation"] = capability
-        manifest["host_capabilities"] = {
-            "protocol_version": 0,
-            "verification_source": "native_codex_session",
-            "instructions_discovery": True,
-            "skills_discovery": True,
-            "structured_results": False,
-            "tool_execution": False,
-            "approval": False,
-            "lifecycle_events": False,
-            "thread_resume": False,
-            "turn_steer": False,
-            "background_execution": False,
-            "cancellation": False,
-            "e2e_validated": False,
-            "execution_mode": "portable",
-            "manual_resume": False,
-            "session_execution": "native_current_session",
-        }
+        # Add only what Core cannot know; restating the pair here would
+        # re-create the second definition point R8 removes.  The sections take
+        # different extras — hook state, and the session model's name.
+        derived = ("execution_mode", "verification_source", "guarantee_level")
+        manifest["workflow_continuation"].update({
+            key: value
+            for key, value in capability.items()
+            if key not in derived and key not in manifest["workflow_continuation"]
+        })
+        manifest["host_capabilities"]["session_execution"] = capability["session_execution"]
         atomic_write(
             manifest_path,
             json.dumps(manifest, indent=2, ensure_ascii=False) + "\n",
@@ -550,10 +595,13 @@ class CodexDeployer(DeployerBase):
 
         # Selective deploys describe the desired projection. Remove a disabled
         # rule only when the prior manifest proves ownership of unchanged bytes.
+        # Only `rules/` is this method's business; both readers take the layout
+        # from `_rule_paths`.
         enabled_paths = {
-            (Path("rules") / RULE_DEFINITIONS[rule_id].filename).as_posix()
-            for rule_id in enabled_ids
-            if RULE_DEFINITIONS[rule_id].load_policy == "global"
+            path
+            for paths in CodexDeployer._rule_paths(None, enabled_rules).values()
+            for path in paths
+            if path.startswith("rules/")
         }
         for definition in RULE_DEFINITIONS.values():
             destination = rules_dir / definition.filename
@@ -597,7 +645,7 @@ class CodexDeployer(DeployerBase):
             if not content:
                 continue
             content = content.strip()
-            content = _render_prompt(content, profile)
+            content = render_prompt(content, profile)
             content = CodexDeployer.strip_model_selection_table(content)
             for pattern in CLAUDE_PATH_PATTERNS:
                 content = content.replace(pattern, "~/.codex/")
@@ -647,7 +695,7 @@ class CodexDeployer(DeployerBase):
         lines = [f"# PactKit Runtime Contract (v{__version__})", ""]
         if "runtime" in enabled_rule_ids:
             lines.extend((
-                _render_prompt(RULE_DEFINITIONS["runtime"].content.strip(), profile),
+                render_prompt(RULE_DEFINITIONS["runtime"].content.strip(), profile),
                 "",
             ))
         lines.extend((
@@ -656,7 +704,7 @@ class CodexDeployer(DeployerBase):
             "",
         ))
 
-        raw_content = _render_prompt("\n".join(lines), profile)
+        raw_content = render_prompt("\n".join(lines), profile)
 
         for pattern in CLAUDE_PATH_PATTERNS:
             raw_content = raw_content.replace(pattern, "~/.codex/")
@@ -730,7 +778,7 @@ class CodexDeployer(DeployerBase):
                             description = line.split(":", 1)[1].strip().strip('"')
                     content = parts[2].lstrip("\n")
 
-            content = _render_prompt(content, profile)
+            content = render_prompt(content, profile)
             if cmd_name == "project-sprint":
                 description = "Sequential PDCA in the current Codex session"
                 content = _codex_single_session_sprint()
@@ -774,7 +822,7 @@ class CodexDeployer(DeployerBase):
                     continue
                 elif key in RULE_DEFINITIONS:
                     inline_rules.append(
-                        _render_prompt(RULE_DEFINITIONS[key].content.strip(), profile)
+                        render_prompt(RULE_DEFINITIONS[key].content.strip(), profile)
                     )
 
             conditional = {
@@ -807,7 +855,7 @@ class CodexDeployer(DeployerBase):
             rendered[cmd_name] = skill_content
             command_references = {}
             for rule_id, definition in conditional.items():
-                reference_content = _render_prompt(
+                reference_content = render_prompt(
                     definition.content.strip(), profile,
                 ).replace(
                     "~/.codex/skills/_rules/guides/", "../guides/",
@@ -999,7 +1047,6 @@ class CodexDeployer(DeployerBase):
         # STORY-slim-139 R4: consume the core SKILL_MANIFEST — no local
         # hardcoded skill list (the old 10-item snapshot silently dropped
         # garden/audit/report when core added them).
-        from pactkit.generators.deployer import _render_skill_md
         from pactkit.prompts.skills import get_skill_manifest
 
         enabled_set = set(enabled_skills)
@@ -1011,7 +1058,7 @@ class CodexDeployer(DeployerBase):
             skill_dir = skills_dir / sd["name"]
             skill_dir.mkdir(parents=True, exist_ok=True)
 
-            skill_md = _render_skill_md(sd, profile, _prefix)
+            skill_md = render_skill_md(sd, profile, _prefix)
             skill_md = _replace_cli_with_scripts(skill_md)
             skill_md = CodexDeployer.strip_model_references(skill_md)
             _enforce_deploy_integrity(skill_md, profile, f"skill:{sd['name']}")
@@ -1200,7 +1247,8 @@ normal verification evidence.
 # CLI subcommands that map to skill scripts (STORY-slim-145 R3: lossy CLI
 # prefix replacements for regression/lint/context/clean/visualize/guard/
 # doctor/update REMOVED — Codex is CLIPolicy.PREFERRED, so canonical `pactkit`
-# CLI commands are preserved by Core _render_prompt rather than rewritten here.
+# CLI commands are preserved by Core's render_prompt (via the adapter SPI)
+# rather than rewritten here.
 # Only genuine path normalization (board/scaffold) remains in this table.
 _CLI_TO_SCRIPT = [
     # board (path normalization)

pactkit_codex-3.0.5/src/pactkit_codex/enforcement.py

@@ -0,0 +1,77 @@
+"""Codex's enforcement channel, stated by its owner (SPEC-4.0-06 R3).
+
+Core used to install this channel from a ``format_name == "codex"`` branch:
+the config file, the matchers, the trust notice and the transport key were
+Core constants.  R3 moved all four onto the host, and Core now traverses a
+registry instead of branching.  The transport key has since been deleted
+outright rather than moved — see ``codex_channel``.  This module is what makes "the codex adapter
+is installed" and "Codex's channel can be installed" the same fact — the
+registry's own docstring names import-time registration as the availability
+signal, so nothing here asks Core whether this host is present.
+
+Registering nothing is a valid state and means the channel is not installed:
+that is the honest answer for a host whose adapter is absent, and it is why
+``gate_matrix.channels_for`` must not be read as an install guarantee on its
+own.
+
+The merge, the config lock, the atomic replace and the "unrecognized
+structure → leave byte-identical" protections are Core's ``install_channel``.
+Nothing here re-implements them; this module supplies host facts and nothing
+else.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from pactkit.commit_gate import HookChannel, register_enforcement_channel
+
+# MUST equal the string `gate_matrix.channels_for("codex")` advertises, or the
+# coverage notice names a channel that is not the one installed — the
+# divergence SPEC-4.0-06 R4 records as this dataclass's standing tension.
+# `test_codex_enforcement_channel.py` asserts the agreement; nothing can
+# enforce it structurally, which is exactly why it is asserted.
+IDENTITY = "codex PreToolUse hook"
+
+# The wire contract is Codex's, and it matches Claude Code's (tool_name
+# "Bash", exit 2 + stderr block), so the handler is `pactkit commit-gate
+# --hook` unchanged.  Bash feeds the commit/push/tamper pipeline; Edit|Write
+# feeds the tamper guard.  Stated here rather than imported from Core: which
+# tools a host gates is host knowledge, and importing Core's tuple would put
+# it back.
+MATCHERS = ("Bash", "Edit|Write")
+
+# Deployment never activates the hook silently — Codex requires a one-time
+# content-hash trust confirmation, and the report has to say so.
+TRUST_NOTICE = (
+    " — needs one-time trust confirmation inside Codex "
+    "(content-hash prompt) before it takes effect"
+)
+
+
+def codex_channel(root: Path) -> HookChannel:
+    """Codex's channel as of this deploy root.
+
+    No ``transport`` is declared: the retired MCP transport is gone, so this
+    host's transport is the shell hook, which is ``HookChannel``'s default.
+
+    The config key that used to select it (``enforcement.codex_hook_transport``)
+    was the last Policy-layer remnant of the MCP retirement and was deleted on
+    2026-09-22 — Core never owned it (§4 P1.1 Policy #2: which key selects a
+    host's load policy is host knowledge) and this adapter only read it to
+    RECOGNIZE a pending migration.  That recognition was not load-bearing: the
+    installer already decides from the hooks file itself, and the key's only
+    remaining effect was to report a migration on projects that had nothing to
+    migrate.
+    """
+    del root
+    return HookChannel(
+        relative_path=".codex/hooks.json",
+        identity=IDENTITY,
+        matchers=MATCHERS,
+        label="codex hook",
+        notice=TRUST_NOTICE,
+    )
+
+
+register_enforcement_channel("codex", codex_channel)

{pactkit_codex-3.0.3 → pactkit_codex-3.0.5/src/pactkit_codex.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pactkit-codex
-Version: 3.0.3
+Version: 3.0.5
 Summary: PactKit adapter for OpenAI Codex CLI
 Author: Slim
 License: MIT

{pactkit_codex-3.0.3 → pactkit_codex-3.0.5}/src/pactkit_codex.egg-info/SOURCES.txt

@@ -2,7 +2,9 @@ LICENSE
 README.md
 pyproject.toml
 src/pactkit_codex/__init__.py
+src/pactkit_codex/declarations.py
 src/pactkit_codex/deployer.py
+src/pactkit_codex/enforcement.py
 src/pactkit_codex.egg-info/PKG-INFO
 src/pactkit_codex.egg-info/SOURCES.txt
 src/pactkit_codex.egg-info/dependency_links.txt

pactkit_codex-3.0.5/tests/test_host_body_snapshot.py

@@ -0,0 +1,239 @@
+"""This host's deployed prompt bodies, pinned against a golden (R7/AC10).
+
+2026-09-12 review (83/100, gap 2): the zero-credential acceptance split
+left adapter-host body comparison out of CI — the core workflow compares
+classic only. This suite pins the CODEX deployment's prompt bodies:
+
+- digest drift (a rule edited or deleted inside a prompt body) fails,
+  naming the file;
+- a core version mismatch fails with an explicit action — regenerate the
+  golden against the new core, or publish the matching core release
+  (PENDING-COMPATIBLE-CORE, see the spec R8 release-window semantics);
+- a drift at a MATCHING version is diagnosed as such rather than as a
+  version skew (`_drift_diagnosis`) — the version guard compares strings and
+  so cannot see a core prompt edit made inside one version;
+- a probe test deploys, edits one body in place, and proves the SAME
+  comparison logic flags it (删改必被检出, not vacuous).
+
+Regenerate with: tests/scripts/refresh_host_body_golden.py — and record the
+cause when you do; an unexplained regeneration turns the golden into a copy
+of today's output and its guard value goes to zero.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+HOST = "codex"
+GOLDEN = Path(__file__).parent / "fixtures" / "host_body_golden.json"
+DEPLOY_SUFFIXES = (".md", ".json", ".toml")
+
+
+def _core_version() -> str:
+    import importlib.metadata as m
+
+    return m.version("pactkit")
+
+
+def _normalize(content: str, deploy_root: str) -> str:
+    """Strip only the deterministic environment difference: the deploy root
+    path baked into rendered prompts. Rule text stays — normalizing it would
+    swallow the drift this suite exists to catch."""
+    return content.replace(deploy_root, "<DEPLOY_ROOT>")
+
+
+def _deployed_digests(tmp_path: Path) -> tuple[dict[str, str] | None, subprocess.CompletedProcess]:
+    home = tmp_path / "home"
+    target = tmp_path / "deploy"
+    home.mkdir()
+    proc = subprocess.run(
+        [sys.executable, "-m", "pactkit", "init", "--format", HOST, "--target", str(target)],
+        capture_output=True, text=True, timeout=180,
+        env={"PATH": "/usr/bin:/bin", "HOME": str(home), "COLUMNS": "200"},
+    )
+    if proc.returncode != 0:
+        return None, proc
+    digests: dict[str, str] = {}
+    for path in sorted(target.rglob("*")):
+        if not path.is_file() or path.suffix not in DEPLOY_SUFFIXES:
+            continue
+        body = _normalize(path.read_text(encoding="utf-8"), str(target))
+        digests[path.relative_to(target).as_posix()] = hashlib.sha256(
+            body.encode("utf-8")
+        ).hexdigest()
+    return digests, proc
+
+
+def _drift_diagnosis(golden: dict, core_version: str) -> str:
+    """Which of the two red lights is this? R7's answer to the version guard's
+    structural blindness.
+
+    The guard compares version STRINGS, so "core edited a prompt without
+    bumping the version" and "the adapter broke" produce the same diff — and
+    the old message resolved that ambiguity by hedging, offering "publish the
+    matching core release" as an alternative to regenerating. In a path only
+    reachable once the versions already match, that advice cannot apply: it
+    was describing the other red light. So the diagnosis is derived from the
+    version facts instead of guessed, and names the one thing the evidence
+    establishes — that a version skew is ruled out.
+
+    What it does NOT claim: that the adapter is innocent. Matching versions
+    plus differing bodies means the difference is content, and content can
+    have moved on either side. Both diffs are named, because guessing between
+    them is what made this message useless.
+
+    Measured instance (2026-09-21, Batch 4) — three bodies drifted with the
+    versions matching. Attributed by deploying the SAME adapter against core
+    v3.0.3 and against the working tree:
+
+    - `skills/project-act/SKILL.md` — core `49ef848` added `--outcome green`
+      and the unavailable/red branches to the Act playbook's "Verification
+      Record" line (`prompts/commands.py:282`), after this golden was
+      regenerated and without a version bump. That commit's own message
+      predicted this drift and deferred it to Batch 5.
+    - `skills/.pactkit-command-manifest.json` — the sha256 of the body above,
+      so a consequence of the same edit rather than an independent drift.
+    - `.pactkit-deployed.json` — core `04b1689` deleted the `rule_loading.
+      layout` host-policy string, and the rule records changed under
+      SPEC-4.0-06 R2. No prompt body is involved.
+
+    Not a cause, though it looks like one: `04b1689` also edited
+    `prompts/rules.py`, but that line sits in the legacy `architecture`
+    module, which this host does not deploy — every deployed body is
+    byte-identical across the two cores, so it drifted nothing. A plausible
+    cause that the evidence rules out is worth as much as one it confirms.
+
+    Measured instance (2026-09-22, SPEC-4.0-06 R8) — one body drifted with the
+    versions matching, and this time **the adapter moved, not Core**:
+
+    - `.pactkit-deployed.json` — `_write_deployment_manifest` now declares the
+      `(execution_mode, verification_source)` pair to Core instead of writing
+      both manifest sections itself. Three consequences, all inside that one
+      artifact: `protocol_version` 0 -> 1 in both sections (Core's
+      `CORE_PROTOCOL_VERSION` — the adapter's hardcoded 0 had drifted from it
+      with nothing keeping the two equal, which is the defect R8 removes),
+      `workflow_continuation.verification_source` is no longer restated, and
+      `workflow_continuation.e2e_validated` is now Core's.
+
+    The other 67 bodies are byte-identical, and that is the evidence the move
+    is adapter-side: a Core prompt edit would have moved prompt bodies, and
+    none moved.
+    """
+    if golden["core_version"] == core_version:
+        return (
+            f"core_version matches but content differs — the golden and this "
+            f"environment are both core {core_version}, so a version skew is "
+            f"ruled out and the difference is content: either Core's prompts "
+            f"changed inside this version (no bump, so the check above cannot "
+            f"see it — measured instance: core 49ef848 edited the Act playbook "
+            f"after this golden was regenerated) or this adapter's rendering "
+            f"changed. Diff the core prompts and this adapter since the golden "
+            f"was generated; regenerate only once the cause is known — see "
+            f"this function's docstring for the 2026-09-21 attribution"
+        )
+    return (
+        f"core_version differs — the golden was generated against core "
+        f"{golden['core_version']} and this environment has {core_version}. "
+        f"Regenerate the golden after the core change, or publish the matching "
+        f"core release first (PENDING-COMPATIBLE-CORE, spec R8 release-window "
+        f"semantics)"
+    )
+
+
+def _assert_no_drift(golden: dict, live: dict[str, str]) -> None:
+    """The one comparison both the golden test and the tamper probe use —
+    including the diagnosis, so the probe exercises the message a real drift
+    would produce rather than a similar one."""
+    golden_digests = golden["body_digests"]
+    changed = sorted(
+        k for k in set(golden_digests) & set(live) if golden_digests[k] != live[k]
+    )
+    removed = sorted(set(golden_digests) - set(live))
+    added = sorted(set(live) - set(golden_digests))
+    assert not (changed or removed or added), (
+        f"prompt body drift: changed={changed} removed={removed} added={added} "
+        f"— {_drift_diagnosis(golden, _core_version())}"
+    )
+
+
+class TestHostBodySnapshot:
+    def test_bodies_match_the_golden(self, tmp_path):
+        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
+        core_v = _core_version()
+        if golden["core_version"] != core_v:
+            # Fail here rather than at the comparison: under a version skew
+            # every body reads as "changed", which is noise, not signal. The
+            # wording comes from the same diagnosis function the comparison
+            # uses, so the two red lights cannot drift apart.
+            pytest.fail(_drift_diagnosis(golden, core_v))
+        live, proc = _deployed_digests(tmp_path)
+        assert live is not None, (
+            f"{HOST} deploy failed: {proc.stdout[-300:]}{proc.stderr[-300:]}"
+        )
+        _assert_no_drift(golden, live)
+
+    def test_a_body_edit_is_caught_by_the_same_comparison(self, tmp_path):
+        """Non-vacuity, end to end: deploy, edit one prompt body in place,
+        and the SAME comparison that guards the golden must flag it."""
+        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
+        live, proc = _deployed_digests(tmp_path)
+        assert live is not None, f"{HOST} deploy failed: {proc.stderr[-300:]}"
+        target = tmp_path / "deploy"
+        # Pick a real deployed prompt body and delete one rule line from it.
+        victims = sorted(
+            p for p in target.rglob("*.md") if p.relative_to(target).as_posix() in golden["body_digests"]
+        )
+        assert victims, "no deployed .md body found to tamper with"
+        victim = victims[0]
+        rel = victim.relative_to(target).as_posix()
+        body = victim.read_text(encoding="utf-8")
+        victim.write_text(body + "\n- deleted in a review\n", encoding="utf-8")
+
+        tampered = {
+            p.relative_to(target).as_posix(): hashlib.sha256(
+                _normalize(p.read_text(encoding="utf-8"), str(target)).encode("utf-8")
+            ).hexdigest()
+            for p in sorted(target.rglob("*"))
+            if p.is_file() and p.suffix in DEPLOY_SUFFIXES
+        }
+        with pytest.raises(AssertionError, match=rel):
+            _assert_no_drift(golden, tampered)
+
+    def test_a_drift_at_a_matching_version_is_diagnosed_as_content(self, tmp_path):
+        """R7(b): on drift the guard must say the versions matched. The old
+        message offered "publish the matching core release" as an alternative
+        to regenerating — advice that cannot apply here, because this path is
+        only reachable once the versions already match."""
+        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
+        assert golden["core_version"] == _core_version(), (
+            "this test is about a drift at a MATCHING version"
+        )
+        live, proc = _deployed_digests(tmp_path)
+        assert live is not None, f"{HOST} deploy failed: {proc.stderr[-300:]}"
+        victim = sorted(golden["body_digests"])[0]
+        drifted = dict(live)
+        drifted[victim] = hashlib.sha256(b"not the deployed body").hexdigest()
+
+        with pytest.raises(AssertionError) as caught:
+            _assert_no_drift(golden, drifted)
+
+        message = str(caught.value)
+        assert victim in message, "the drifting body is not named"
+        assert "core_version matches but content differs" in message, (
+            f"the guard did not diagnose the matching version: {message}"
+        )
+
+    def test_a_version_skew_is_diagnosed_as_a_skew(self):
+        """The other red light, from the same function: a golden pinned against
+        a different core must be told to regenerate or publish — not told its
+        content changed inside a version it does not share."""
+        golden = {"core_version": "0.0.0-not-this-core", "body_digests": {}}
+        message = _drift_diagnosis(golden, _core_version())
+        assert "PENDING-COMPATIBLE-CORE" in message
+        assert "core_version matches but content differs" not in message

pactkit_codex-3.0.3/src/pactkit_codex/__init__.py

@@ -1,5 +0,0 @@
-"""PactKit Codex — thin adapter for OpenAI Codex CLI."""
-
-from pactkit import __version__  # noqa: F401
-
-from pactkit_codex.deployer import CodexDeployer  # noqa: F401

pactkit_codex-3.0.3/tests/test_host_body_snapshot.py

@@ -1,126 +0,0 @@
-"""This host's deployed prompt bodies, pinned against a golden (R7/AC10).
-
-2026-09-12 review (83/100, gap 2): the zero-credential acceptance split
-left adapter-host body comparison out of CI — the core workflow compares
-classic only. This suite pins the CODEX deployment's prompt bodies:
-
-- digest drift (a rule edited or deleted inside a prompt body) fails,
-  naming the file;
-- a core version mismatch fails with an explicit action — regenerate the
-  golden against the new core, or publish the matching core release
-  (PENDING-COMPATIBLE-CORE, see the spec R8 release-window semantics);
-- a probe test deploys, edits one body in place, and proves the SAME
-  comparison logic flags it (删改必被检出, not vacuous).
-
-Regenerate with: tests/scripts/refresh_host_body_golden.py
-"""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-HOST = "codex"
-GOLDEN = Path(__file__).parent / "fixtures" / "host_body_golden.json"
-DEPLOY_SUFFIXES = (".md", ".json", ".toml")
-
-
-def _core_version() -> str:
-    import importlib.metadata as m
-
-    return m.version("pactkit")
-
-
-def _normalize(content: str, deploy_root: str) -> str:
-    """Strip only the deterministic environment difference: the deploy root
-    path baked into rendered prompts. Rule text stays — normalizing it would
-    swallow the drift this suite exists to catch."""
-    return content.replace(deploy_root, "<DEPLOY_ROOT>")
-
-
-def _deployed_digests(tmp_path: Path) -> tuple[dict[str, str] | None, subprocess.CompletedProcess]:
-    home = tmp_path / "home"
-    target = tmp_path / "deploy"
-    home.mkdir()
-    proc = subprocess.run(
-        [sys.executable, "-m", "pactkit", "init", "--format", HOST, "--target", str(target)],
-        capture_output=True, text=True, timeout=180,
-        env={"PATH": "/usr/bin:/bin", "HOME": str(home), "COLUMNS": "200"},
-    )
-    if proc.returncode != 0:
-        return None, proc
-    digests: dict[str, str] = {}
-    for path in sorted(target.rglob("*")):
-        if not path.is_file() or path.suffix not in DEPLOY_SUFFIXES:
-            continue
-        body = _normalize(path.read_text(encoding="utf-8"), str(target))
-        digests[path.relative_to(target).as_posix()] = hashlib.sha256(
-            body.encode("utf-8")
-        ).hexdigest()
-    return digests, proc
-
-
-def _assert_no_drift(golden_digests: dict[str, str], live: dict[str, str]) -> None:
-    """The one comparison both the golden test and the tamper probe use."""
-    changed = sorted(
-        k for k in set(golden_digests) & set(live) if golden_digests[k] != live[k]
-    )
-    removed = sorted(set(golden_digests) - set(live))
-    added = sorted(set(live) - set(golden_digests))
-    assert not (changed or removed or added), (
-        f"prompt body drift: changed={changed} removed={removed} added={added} "
-        f"— if the core prompts changed, regenerate the golden "
-        f"(tests/scripts/refresh_host_body_golden.py) or publish the matching "
-        f"core release first (PENDING-COMPATIBLE-CORE)"
-    )
-
-
-class TestHostBodySnapshot:
-    def test_bodies_match_the_golden(self, tmp_path):
-        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
-        core_v = _core_version()
-        if golden["core_version"] != core_v:
-            pytest.fail(
-                f"PENDING-COMPATIBLE-CORE: the {HOST} golden was generated "
-                f"against core {golden['core_version']}, this environment has "
-                f"{core_v}. Either regenerate it after the core change "
-                f"(tests/scripts/refresh_host_body_golden.py) or publish the "
-                f"matching core release first (spec R8 release-window semantics)."
-            )
-        live, proc = _deployed_digests(tmp_path)
-        assert live is not None, (
-            f"{HOST} deploy failed: {proc.stdout[-300:]}{proc.stderr[-300:]}"
-        )
-        _assert_no_drift(golden["body_digests"], live)
-
-    def test_a_body_edit_is_caught_by_the_same_comparison(self, tmp_path):
-        """Non-vacuity, end to end: deploy, edit one prompt body in place,
-        and the SAME comparison that guards the golden must flag it."""
-        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
-        live, proc = _deployed_digests(tmp_path)
-        assert live is not None, f"{HOST} deploy failed: {proc.stderr[-300:]}"
-        target = tmp_path / "deploy"
-        # Pick a real deployed prompt body and delete one rule line from it.
-        victims = sorted(
-            p for p in target.rglob("*.md") if p.relative_to(target).as_posix() in golden["body_digests"]
-        )
-        assert victims, "no deployed .md body found to tamper with"
-        victim = victims[0]
-        rel = victim.relative_to(target).as_posix()
-        body = victim.read_text(encoding="utf-8")
-        victim.write_text(body + "\n- deleted in a review\n", encoding="utf-8")
-
-        tampered = {
-            p.relative_to(target).as_posix(): hashlib.sha256(
-                _normalize(p.read_text(encoding="utf-8"), str(target)).encode("utf-8")
-            ).hexdigest()
-            for p in sorted(target.rglob("*"))
-            if p.is_file() and p.suffix in DEPLOY_SUFFIXES
-        }
-        with pytest.raises(AssertionError, match=rel):
-            _assert_no_drift(golden["body_digests"], tampered)