pactkit 2.25.2__tar.gz → 2.26.0__tar.gz

pactkit-2.26.0/.github/workflows/publish.yml

@@ -0,0 +1,102 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[visualize,lint,test]"
+          pip install ruff
+
+      - name: Lint
+        run: ruff check src/ tests/
+
+      - name: Test
+        run: pytest tests/ -q
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: read
+      # 2026-09-11 review round 2, F4: the acceptance-wait step reads workflow
+      # runs via `gh run list`; without an explicit `actions: read` the job
+      # token is denied and the wait degrades into a 45-minute timeout.
+      actions: read
+    steps:
+      - uses: actions/checkout@v7
+
+      # STORY-slim-20260911b2bbd79889e0 C2/R8 (2026-09-11 review, finding 5):
+      # a tag may only publish after the Release Acceptance workflow has
+      # accepted the SAME commit — real wheels installed into a clean
+      # environment, adapter suites green with zero skips, journey verified.
+      # Fail-closed: no acceptance conclusion within the timeout, no publish.
+      # API/permission failures fail FAST with the stderr shown — only a
+      # legitimately still-running acceptance keeps waiting.
+      - name: Wait for Release Acceptance (same commit)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          SHA="${{ github.sha }}"
+          deadline=$(( $(date +%s) + 2700 ))
+          while :; do
+            if ! gh run list --workflow=release-acceptance.yml --commit "$SHA" \
+                 --json status,conclusion > /tmp/acceptance-runs.json 2>/tmp/gh-err; then
+              echo "::error::gh run list failed — permissions or API error, "
+              echo "NOT an acceptance-still-running state (review round 2, F4):"
+              cat /tmp/gh-err
+              exit 1
+            fi
+            row=$(jq -r '.[0] // empty' /tmp/acceptance-runs.json)
+            if [ -n "$row" ]; then
+              status=$(printf '%s' "$row" | jq -r '.status')
+              conclusion=$(printf '%s' "$row" | jq -r '.conclusion')
+              echo "release-acceptance: status=$status conclusion=$conclusion"
+              if [ "$status" = "completed" ]; then
+                if [ "$conclusion" = "success" ]; then
+                  echo "Release Acceptance passed for $SHA"
+                  exit 0
+                fi
+                echo "::error::Release Acceptance concluded: $conclusion — refusing to publish"
+                exit 1
+              fi
+            fi
+            if [ "$(date +%s)" -ge "$deadline" ]; then
+              echo "::error::timed out waiting for Release Acceptance on $SHA"
+              exit 1
+            fi
+            sleep 30
+          done
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Install build tools
+        run: python -m pip install --upgrade pip build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

pactkit-2.26.0/.github/workflows/release-acceptance.yml

@@ -0,0 +1,146 @@
+name: Release Acceptance
+
+# STORY-slim-20260911b2bbd79889e0 C2/R8 + 2026-09-11 reviews: install the
+# ACTUAL core wheel that is about to ship in a clean environment and prove
+# the package-level surface. The ordinary CI tests the editable checkout;
+# it cannot see packaging-level breaks (missing files in the wheel,
+# dependency misdeclaration). This job can. publish.yml waits for this
+# workflow's conclusion before publishing a tag.
+#
+# Zero-credential split (2026-09-11, first real runner run 34607922520):
+# GITHUB_TOKEN cannot read the private adapter repos, and the owner chose
+# no PAT/secrets. The core wheel + adapter COMBO acceptance therefore runs
+# in each adapter repo's own release-acceptance workflow — it checks out
+# ITSELF (its token suffices) and installs the RELEASED core from PyPI,
+# which the resolver pins for real. Each adapter repo covers classic + its
+# own host; the union covers all three. What remains here is the core-only
+# quality gate: wheel build/install/version, documented extras, wheel-mode
+# prompt snapshots (classic; the host assertion scales with installed
+# adapters), and the classic journey.
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  core-wheel:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      # R8: the accepted Python range must match what the package claims
+      # (pyproject requires-python >=3.10).
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Build the core wheel
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build --wheel --outdir dist/ .
+
+      - name: Install from the wheel into a clean environment (AC11)
+        run: |
+          python -m venv /tmp/accept
+          # Direct wheel path: the package under acceptance comes from the
+          # local dist/ (never PyPI, never editable); third-party deps
+          # (pyyaml) resolve from the index.
+          /tmp/accept/bin/pip install dist/pactkit-*.whl
+          ! /tmp/accept/bin/pip list | grep -q '\-e '
+          /tmp/accept/bin/pactkit version
+
+      - name: Base wheel + documented extras resolve (AC11)
+        run: |
+          python -m venv /tmp/extras
+          # The extras README documents must actually resolve from the built
+          # wheel. Adapter extras are deliberately excluded here: they pin
+          # the released core from the index, which during release prep is
+          # older than this build (core-first publish order).
+          WHEEL=$(ls dist/pactkit-*.whl)
+          /tmp/extras/bin/pip install "$WHEEL[lint,visualize]"
+          /tmp/extras/bin/pactkit version
+
+      - name: Prompt-body snapshots from the wheel (AC10/R7)
+        env:
+          PACTKIT_SNAPSHOT_FROM_WHEEL: "1"
+        run: |
+          # Wheel mode: the deploy subprocesses must import the WHEEL — no
+          # checkout PYTHONPATH, provenance asserted (site-packages origin),
+          # and every installed host participates in the comparison (this
+          # core-only environment compares classic; each adapter repo's
+          # acceptance adds its own host). A skip fails the step. The empty
+          # `-c` ini keeps the checkout's pyproject (pythonpath=src) from
+          # shadowing the installed wheel.
+          /tmp/accept/bin/pip install pytest
+          printf '[pytest]\n' > /tmp/acceptance-pytest.ini
+          cd /tmp
+          /tmp/accept/bin/pytest \
+            "$GITHUB_WORKSPACE/tests/unit/test_c1_body_snapshots.py" \
+            -c /tmp/acceptance-pytest.ini -p no:cacheprovider \
+            --junitxml=/tmp/snap-results.xml -q \
+            || { echo "::error::prompt-body snapshot comparison failed"; exit 1; }
+          /tmp/accept/bin/python - <<'EOF'
+          import sys
+          import xml.etree.ElementTree as ET
+
+          root = ET.parse("/tmp/snap-results.xml").getroot()
+          skipped = sum(int(s.get("skipped", 0)) for s in root.iter("testsuite"))
+          errors = sum(int(s.get("errors", 0)) for s in root.iter("testsuite"))
+          if skipped or errors:
+              print(f"::error::snapshot step: {skipped} skipped, {errors} errors — "
+                    "skip is failure under release acceptance")
+              sys.exit(1)
+          print("snapshots: 0 skipped, 0 errors")
+          EOF
+
+      - name: Classic journey from the wheel (AC12, CLI layer)
+        run: |
+          # The CLI is invoked by ABSOLUTE PATH from the acceptance venv
+          # (review round 2, F3): a bare `pactkit` would resolve against
+          # whatever the runner has preinstalled — or nothing at all.
+          # OpenCode/Codex journeys run in their own adapter repos'
+          # acceptance workflows (zero-credential split).
+          PACTKIT="/tmp/accept/bin/pactkit"
+          command -v "$PACTKIT" >/dev/null 2>&1 \
+            || { echo "::error::acceptance venv has no pactkit entry point"; exit 1; }
+          export HOME="/tmp/journey-home" XDG_CONFIG_HOME="/tmp/journey-home/.config"
+          rm -rf "$HOME" /tmp/journey-proj
+          mkdir -p "$HOME" /tmp/journey-proj
+          cd /tmp/journey-proj
+          git init -q .
+          git config user.email journey@example.invalid
+          git config user.name journey
+
+          fail() { echo "::error::journey: $1"; exit 1; }
+          root="$HOME/.claude"
+          "$PACTKIT" version
+          "$PACTKIT" init --format classic > init.log 2>&1 \
+            || { cat init.log; fail "classic init failed"; }
+          [ -f "$root/.pactkit-deployed.json" ] || fail "no deployment manifest"
+          entry="$root/skills/project-plan/SKILL.md"
+          [ -f "$entry" ] || fail "method entry point missing ($entry)"
+
+          mkdir -p "$root/rules"
+          printf '# My team conventions\n- ours, not PactKit\x27s\n' > "$root/rules/my-team.md"
+          "$PACTKIT" update --format classic > update.log 2>&1 \
+            || { cat update.log; fail "classic update failed"; }
+          [ -f "$root/rules/my-team.md" ] || fail "user rule file lost by update"
+
+          "$PACTKIT" uninstall --target "$root" > uninstall.log 2>&1 \
+            || { cat uninstall.log; fail "classic uninstall failed"; }
+          [ -f "$root/rules/my-team.md" ] || fail "user file deleted by uninstall"
+          [ ! -f "$root/skills/pactkit-board/scripts/board.py" ] \
+            || fail "manifest-owned file survived uninstall"
+          echo "classic journey OK (CLI layer)"
+          # Real-host runtime sessions are NOT exercised here — recorded as
+          # UNVERIFIED per R8: 自动化 CLI/产物检查与真实宿主运行记录 MUST
+          # 分开标注.

pactkit-2.26.0/.gitignore

@@ -0,0 +1,69 @@
+# Python
+*.pyc
+__pycache__/
+.coverage
+*.py[cod]
+*$py.class
+.pytest_cache/
+*.egg-info/
+dist/
+build/
+.eggs/
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+*.tmp
+*.log
+
+# PactKit - generated artifacts (auto-regenerated by user projects)
+docs/architecture/graphs/
+docs/architecture/snapshots/
+
+# PactKit - previously excluded for IP protection (repo is now private, all tracked)
+
+# Claude Code local config
+.claude/
+
+# Codex CLI local config
+.codex/
+
+# GitHub Copilot deployment artifacts (generated by pactkit update)
+.github/
+!.github/workflows/
+
+# Plugin deployment artifacts (generated by pactkit update)
+pactkit-plugin/
+
+# Office files
+~$*
+*.pptx
+
+# Secrets
+.pypirc
+
+# Playwright MCP
+.playwright-mcp/
+
+# Backup
+*.bak
+.mcp.json
+.pactkit/
+coder/
+docker/
+docs/slides/
+
+
+# Call graph SQLite output (STORY-slim-121)
+docs/architecture/graphs/*.db