phase-loop-runtime 0.2.1__tar.gz → 0.3.0__tar.gz

{phase_loop_runtime-0.2.1 → phase_loop_runtime-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.2.1
+Version: 0.3.0
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author: ViperJuice
 License-Expression: Apache-2.0
@@ -18,7 +18,7 @@ Description-Content-Type: text/markdown
 Requires-Dist: baml-py<0.223,>=0.222
 Requires-Dist: pydantic<3,>=2
 Requires-Dist: PyYAML<7,>=6
-Requires-Dist: consiliency-contract<0.5.0,>=0.3.0
+Requires-Dist: consiliency-contract<0.7,>=0.6.3
 Requires-Dist: jsonschema<5,>=4
 Requires-Dist: tomli<3,>=2; python_version < "3.11"
 

{phase_loop_runtime-0.2.1 → phase_loop_runtime-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.2.1"
+version = "0.3.0"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -22,12 +22,17 @@ dependencies = [
     "baml-py>=0.222,<0.223",
     "pydantic>=2,<3",
     "PyYAML>=6,<7",
-    # Widened ceiling (Slice G): the git-discipline guardrail CONSUMES the
-    # contract's `pipeline_ref_classes` registry + `git_discipline_protocol`
-    # schema, first published in 0.4.x. Floor stays at 0.3.0 so CI still resolves
-    # against the currently-published 0.3.0 (the guardrail then degrades to a
-    # neutral no-op); it auto-adopts the git-discipline contract once 0.4.x ships.
-    "consiliency-contract>=0.3.0,<0.5.0",
+    # PIN (spec-integration v0.3.0): floor at 0.6.3 -- ships the `gate_posture_registry`
+    # AND the manifest-schema `gate_posture_overrides` key (0.6.3) that makes the dial
+    # OPERABLE (a repo can declare per-repo posture overrides without failing layout_validity),
+    # alongside `pipeline_ref_classes` + `git_discipline_protocol`. This
+    # ACTIVATES the git-discipline guardrail AND the posture dial (per-finding-class
+    # enforcement with non-retractable floors). The dial degrades gracefully on an older
+    # contract (gate_posture.available() False -> legacy per-gate behavior preserved), so
+    # < 0.6.2 stays safe; the floor guarantees the teeth are present. Warn-default remains;
+    # human_required is never set. (0.6.0 shipped self-inconsistent version refs -> fixed in
+    # 0.6.1, contract PR #18.)
+    "consiliency-contract>=0.6.3,<0.7",
     "jsonschema>=4,<5",
     # Advisor Board config loader (ABDREG) parses advisor-boards.toml. tomllib is
     # stdlib on 3.11+; on the 3.10 requires-python floor it is absent, so pull in

{phase_loop_runtime-0.2.1 → phase_loop_runtime-0.3.0}/src/phase_loop_runtime/__init__.py

@@ -17,4 +17,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.2.1"
+__version__ = "0.3.0"

{phase_loop_runtime-0.2.1 → phase_loop_runtime-0.3.0}/src/phase_loop_runtime/consiliency_gates.py

@@ -62,7 +62,28 @@ CONSILIENCY_GATES_ENV = "PHASE_LOOP_CONSILIENCY_GATES"
 CONSILIENCY_GATES_MODES: tuple[str, ...] = ("off", "warn", "hard")
 DEFAULT_CONSILIENCY_GATES_MODE = "warn"
 
-_GATE_NAMES = ("presence", "local_integrity", "layout_validity", "version_skew", "git_discipline")
+_GATE_NAMES = ("presence", "local_integrity", "layout_validity", "version_skew", "git_discipline", "spec_conformance")
+
+# spec_conformance (HGATE) — the generic conformance ladder + default bar. Advisory
+# panel (Fable + Codex 5.5 + Gemini 3.1 Pro, unanimous) set the default PASS bar at
+# `hash-checked`+ ("bar B"): it's the lowest rung where the claim is checkable by the
+# existing local_integrity digest machinery, so a self-asserted `hash-checked` obligates
+# a recorded digest rather than being a free claim. `presence-only` is an INFO-grade
+# soft warn (declared but not digest-anchored); `present-nonconforming`/`foreign`/
+# `unmanaged` are loud. The per-archetype/per-doc conformance floor as CONTRACT REGISTRY
+# DATA is the deferred ratchet (do NOT hardcode org policy here). These labels mirror the
+# contract `maturity-labels` registry; `certified` is a deprecated alias of `parity-certified`.
+_SPEC_PROJECTION_CLASSES = ("proj-S", "proj-code")
+_CONFORMANCE_LADDER = {  # conforming rungs, low -> high
+    "presence-only": 0,
+    "hash-checked": 1,
+    "realized-edge-observed": 2,
+    "parity-certified": 3,
+    "authority-certified": 4,
+}
+_CONFORMANCE_ALIASES = {"certified": "parity-certified"}  # deprecated alias, ranked as parity-certified
+_NONCONFORMING_LABELS = frozenset({"present-nonconforming", "foreign", "unmanaged"})
+_CONFORMANCE_FLOOR = "hash-checked"  # bar B: the generic default PASS floor
 
 
 def resolve_consiliency_gates_mode(env: Mapping[str, str] | None = None) -> str:
@@ -117,7 +138,8 @@ def scan_consiliency_gates(
         "local_integrity": _gate_local_integrity(repo_path, manifest, mode=mode),
         "layout_validity": _gate_layout_validity(repo_path, manifest, mode=mode),
         "version_skew": _gate_version_skew(manifest, mode=mode),
-        "git_discipline": _gate_git_discipline(repo_path, mode=mode),
+        "git_discipline": _gate_git_discipline(repo_path, manifest, mode=mode),
+        "spec_conformance": _gate_spec_conformance(manifest, mode=mode),
     }
     if any(g["status"] == "blocked" for g in gates.values()):
         overall = "blocked"
@@ -142,6 +164,50 @@ def _gate_status(findings: list[dict[str, Any]], *, mode: str, capped_warn: bool
     return "warn"
 
 
+_SEVERITY = {"note": 0, "warn": 1, "blocked": 2}
+_SEVERITY_STATUS = {0: "passed", 1: "warn", 2: "blocked"}
+
+
+def _apply_posture(
+    findings: list[dict[str, Any]], *, manifest: Mapping[str, Any] | None, mode: str,
+    legacy_capped_all: bool = False, legacy_capped_codes: frozenset[str] = frozenset(),
+) -> dict[str, Any]:
+    """Retractable teeth -- resolve each finding's posture from the contract registry and
+    derive the gate status. `observe` findings are RECORDED (as notes) but never escalate
+    past `passed`; `warn` -> warn; `enforce` -> warn unless the operator opted into `hard`
+    -> blocked. Any per-repo override that LOWERS a class below its default adds the
+    non-retractable `posture_retracted` finding -- fired from the manifest overrides, so
+    de-fanging is visible even on an otherwise-clean scan.
+
+    Contract < 0.6.2 fallback preserves each gate's PRIOR severity: `legacy_capped_all`
+    caps every finding at warn (version_skew's normative phase0 const), `legacy_capped_codes`
+    caps just those codes (spec_conformance's info tier); everything else follows mode."""
+    from . import gate_posture as gp
+
+    if not gp.available():
+        if not findings:
+            return {"status": "passed", "findings": findings}
+        worst = 0
+        for f in findings:
+            capped = legacy_capped_all or str(f.get("code") or "") in legacy_capped_codes
+            worst = max(worst, _SEVERITY["warn" if (capped or mode != "hard") else "blocked"])
+        return {"status": _SEVERITY_STATUS[worst], "findings": findings}
+
+    out: list[dict[str, Any]] = []
+    worst = 0
+    for f in findings:
+        res = gp.resolve_posture(str(f.get("code") or ""), manifest=manifest)
+        worst = max(worst, _SEVERITY.get(gp.posture_status(res["posture"], mode=mode), 1))
+        out.append({**f, "posture": res["posture"]})
+    retracted = gp.retracting_overrides(manifest)
+    if retracted:
+        r = gp.resolve_posture("posture_retracted", manifest=manifest)
+        worst = max(worst, _SEVERITY.get(gp.posture_status(r["posture"], mode=mode), 1))
+        out.append({"code": "posture_retracted", "posture": r["posture"], "retracted_classes": retracted,
+                    "message": "per-repo posture override lowered: " + ", ".join(retracted)})
+    return {"status": _SEVERITY_STATUS[worst], "findings": out}
+
+
 def _declared_archetypes_modifiers(manifest: Mapping[str, Any]) -> tuple[str, tuple[str, ...], tuple[str, ...]]:
     declaration = dict(manifest.get("declaration") or {})
     decl_mode = str(declaration.get("mode") or "baseline-only")
@@ -178,6 +244,84 @@ def _gate_presence(repo: Path, manifest: Mapping[str, Any], *, mode: str) -> dic
     return {"status": _gate_status(findings, mode=mode), "maturity": "presence-only", "findings": findings}
 
 
+def _gate_spec_conformance(manifest: Mapping[str, Any], *, mode: str) -> dict[str, Any]:
+    """HGATE: warn when a DECLARED spec-projection (proj-S/proj-code) sits below the
+    conformance bar. Structural — reads declared maturity, no byte/digest verification
+    (that is local_integrity's job for hash-checked, and a future canon-backed verifier's
+    for higher rungs). Full no-op when the repo declares no spec-projections (OPA-style
+    optional layer). Two-tier: `present-nonconforming`/`foreign`/`unmanaged` are loud
+    (may block under hard mode); a below-bar non-sanctioned `presence-only` is an
+    info-grade soft warn that NEVER blocks (so honest early adopters are nudged, not
+    punished).
+
+    HONESTY -- this gate is FORWARD INFRASTRUCTURE, dormant on schema-valid manifests
+    with today's contract data: (a) every proj-S/proj-code required-doc row is
+    `l0_stub_allowed` at a `presence-only` floor, so the info + below-floor branches
+    are dead until the per-archetype conformance ratchet raises floors (deferred to
+    contract-registry data); (b) the manifest schema's maturity enum is only
+    {presence-only, hash-checked, realized-edge-observed}, so the non-conforming labels
+    that drive the loud branches are schema-INVALID and already caught by
+    layout_validity. So today it fires nothing layout_validity does not; it activates
+    without code change when the schema enum + the ratchet expand. Known ceiling:
+    `hash-checked` is the only rung the harness can locally verify (via local_integrity,
+    and only for `path`-backed docs -- `ref`-backed hash-checked is not yet digest-
+    checked); `realized-edge-observed`+ pass as accepted claims, verified downstream by
+    a canon-backed verifier, not here."""
+    decl_mode, archetypes, modifiers = _declared_archetypes_modifiers(manifest)
+    try:
+        rows = compose_required_documents(mode=decl_mode, archetypes=archetypes, modifiers=modifiers)
+    except ValueError:
+        # A malformed declaration is presence/layout's finding, not conformance's.
+        return {"status": "passed", "maturity": "presence-only", "findings": [],
+                "note": "declaration invalid; deferred to presence/layout gates"}
+    proj_rows = {r.id: r for r in rows if r.doc_class in _SPEC_PROJECTION_CLASSES}
+    docs_by_id = {d.get("id"): d for d in manifest.get("documents", []) if isinstance(d, Mapping)}
+    declared = [(pid, proj_rows[pid], docs_by_id[pid]) for pid in sorted(proj_rows) if pid in docs_by_id]
+    if not declared:
+        return {"status": "passed", "maturity": "presence-only", "findings": [],
+                "note": "no spec-projection documents declared; conformance gate is a no-op"}
+
+    bar_rank = _CONFORMANCE_LADDER[_CONFORMANCE_FLOOR]
+    loud: list[dict[str, Any]] = []
+    info: list[dict[str, Any]] = []
+    for pid, row, entry in declared:
+        raw = str(entry.get("maturity") or "").strip()
+        label = _CONFORMANCE_ALIASES.get(raw, raw)
+        floor_rank = _CONFORMANCE_LADDER.get(_CONFORMANCE_ALIASES.get(row.maturity_floor, row.maturity_floor), 0)
+        if not raw:
+            loud.append({"code": "spec_maturity_missing", "doc_id": pid,
+                         "message": f"spec-projection '{pid}' declares no maturity"})
+        elif label == "present-nonconforming":
+            loud.append({"code": "spec_nonconforming", "doc_id": pid, "maturity": raw,
+                         "message": f"spec-projection '{pid}' is 'present-nonconforming' -- the projection asserts the code does NOT match spec"})
+        elif label in _NONCONFORMING_LABELS:  # foreign / unmanaged -- governance-status, NOT a non-conformance assertion
+            loud.append({"code": "spec_ungoverned", "doc_id": pid, "maturity": raw,
+                         "message": f"spec-projection '{pid}' declares governance status '{raw}' (not this repo's, or ungoverned) -- outside the conformance ladder"})
+        elif label not in _CONFORMANCE_LADDER:
+            loud.append({"code": "spec_maturity_unknown", "doc_id": pid, "maturity": raw,
+                         "message": f"spec-projection '{pid}' declares an unrecognized maturity '{raw}'"})
+        elif _CONFORMANCE_LADDER[label] < floor_rank:
+            # Below the doc's OWN contract-declared maturity_floor -- a real regression.
+            loud.append({"code": "spec_below_declared_floor", "doc_id": pid, "maturity": raw, "floor": row.maturity_floor,
+                         "message": f"spec-projection '{pid}' is '{raw}' but the contract floor for it is '{row.maturity_floor}'"})
+        elif _CONFORMANCE_LADDER[label] < bar_rank and not row.l0_stub_allowed:
+            # Below the generic conformance bar AND not a contract-sanctioned L0 stub -> info nudge.
+            info.append({"code": "spec_below_conformance_bar", "doc_id": pid, "maturity": raw,
+                         "message": f"spec-projection '{pid}' is '{raw}'; the conformance bar is '{_CONFORMANCE_FLOOR}'+ (declared but not digest-anchored). Informational -- pass requires {_CONFORMANCE_FLOOR}+ unless it is a sanctioned L0 stub or local policy overrides."})
+        # else: at/above its contract floor and (hash-checked+ OR a sanctioned L0 stub) -> conforming
+
+    # Retractable teeth: the contract's posture registry (not a hardcoded loud/info split)
+    # now drives severity per finding-class -- spec_nonconforming/etc default to `warn`
+    # (advisory, may be raised to enforce per-repo), spec_below_conformance_bar to `observe`
+    # (a recorded note). This gate does NO digest work itself, so it reports its own
+    # maturity as presence-only (honest); hash-checked is the bar, not a verified claim.
+    # legacy_capped_codes: preserve the pre-registry info tier -- spec_below_conformance_bar
+    # never blocked even under hard, so cap it in the < 0.6.2 fallback.
+    result = _apply_posture(loud + info, manifest=manifest, mode=mode,
+                            legacy_capped_codes=frozenset({"spec_below_conformance_bar"}))
+    return {"status": result["status"], "maturity": "presence-only", "findings": result["findings"]}
+
+
 def _git_show(repo: Path, path: str) -> bytes | None:
     try:
         return subprocess.check_output(
@@ -222,10 +366,14 @@ def _gate_local_integrity(repo: Path, manifest: Mapping[str, Any], *, mode: str)
         checked_any = True
         if recorded != digest:
             findings.append({"code": "hash_drift", "doc_id": doc_id, "path": path, "expected": recorded, "actual": digest})
+    # Retractable teeth: hash_drift is an audit-chain invariant floored at `warn` in the
+    # registry (warns, does not hard-block by default; can be raised to enforce). Migrated
+    # onto the dial so the contract data matches live behavior (CR: Codex/Gemini/Fable).
+    posture = _apply_posture(findings, manifest=manifest, mode=mode)
     return {
-        "status": _gate_status(findings, mode=mode),
+        "status": posture["status"],
         "maturity": "hash-checked" if checked_any else "presence-only",
-        "findings": findings,
+        "findings": posture["findings"],
     }
 
 
@@ -264,7 +412,7 @@ def _gate_layout_validity(repo: Path, manifest: Mapping[str, Any], *, mode: str)
     return {"status": _gate_status(findings, mode=mode), "maturity": "presence-only", "findings": findings}
 
 
-def _gate_git_discipline(repo: Path, *, mode: str) -> dict[str, Any]:
+def _gate_git_discipline(repo: Path, manifest: Mapping[str, Any] | None, *, mode: str) -> dict[str, Any]:
     """Slice-G git-discipline guardrail: classify the repo's refs against the
     neutral contract's ``pipeline_ref_classes`` registry and check the
     write-footprint / branch-naming invariants. Consumes the contract, does not
@@ -296,7 +444,13 @@ def _gate_git_discipline(repo: Path, *, mode: str) -> dict[str, Any]:
         registry=registry,
         protocol=protocol,
     )
-    return {"status": _gate_status(findings, mode=mode), "maturity": "presence-only", "findings": findings}
+    # Retractable teeth: per-finding-class posture from the contract registry replaces the
+    # uniform _gate_status -- pipeline_branch_naming_drift softens to `observe` (a note),
+    # write_footprint_violation holds at its `warn` floor, and never_delete_human_refs is
+    # `enforce` and NON-RETRACTABLE. Legacy uniform behavior survives when the contract
+    # predates the posture registry (< 0.6.2).
+    result = _apply_posture(findings, manifest=manifest, mode=mode)
+    return {"status": result["status"], "maturity": "presence-only", "findings": result["findings"]}
 
 
 _RANGE_RE = re.compile(r"^>=\s*([0-9.]+)\s*<\s*([0-9.]+)$")
@@ -361,14 +515,19 @@ def _gate_version_skew(manifest: Mapping[str, Any], *, mode: str) -> dict[str, A
             )
         else:
             compatibility = "compatible"
-    # Normative: version-skew stays warn-only at Phase 0 regardless of the
-    # gate mode opt-in (version-skew-protocol.schema `default_behavior.
-    # phase0_severity` is a fixed const, not a per-consumer policy knob).
+    # Normative: version-skew stays warn-only at Phase 0. The `version_skew` finding class
+    # carries max_posture=warn in the contract posture registry, so the cap is now contract
+    # DATA (retractable teeth) rather than the hardcoded capped_warn flag -- the legacy
+    # cap survives (fallback) when the contract predates the registry.
+    # legacy_capped_all: the version-skew phase0 severity is a normative const `warn`, so
+    # the < 0.6.2 fallback must cap at warn (never block under hard) -- preserving the old
+    # capped_warn=True behavior.
+    posture = _apply_posture(findings, manifest=manifest, mode=mode, legacy_capped_all=True)
     return {
-        "status": _gate_status(findings, mode=mode, capped_warn=True),
+        "status": posture["status"],
         "maturity": "realized-edge-observed",
         "compatibility": compatibility,
         "installed_contract_version": installed_version,
         "repo_contract_version": repo_version or None,
-        "findings": findings,
+        "findings": posture["findings"],
     }

phase_loop_runtime-0.3.0/src/phase_loop_runtime/gate_posture.py

@@ -0,0 +1,135 @@
+"""Retractable teeth -- gate enforcement posture resolution.
+
+Reads the merge-gated ``gate_posture_registry`` (consiliency-contract >= 0.6.2) and
+resolves the *effective* posture for a finding class from three layers -- the contract
+``default_posture``, then a per-repo ``.consiliency/manifest.json`` override -- clamped
+to the class's non-retractable ``min_posture`` FLOOR and optional ``max_posture`` cap.
+
+Posture rungs: ``observe`` < ``warn`` < ``enforce``. A per-repo override may RAISE any
+class freely but may LOWER it only to (never below) its floor -- ``invariant`` classes
+(never-delete-human-refs, write-footprint, hash-drift) carry a real floor; ``advisory``
+classes retract freely to ``observe``. The operator's ``PHASE_LOOP_CONSILIENCY_GATES``
+= off | warn | hard remains the MASTER switch: ``enforce`` blocks ONLY under ``hard``;
+``human_required`` is NEVER set at any posture. A per-repo *downward* move is surfaced
+via the non-retractable ``posture_retracted`` note so de-fanging is always fleet-visible.
+
+Contract-absent degrade: if the installed contract predates the registry (< 0.6.2),
+:func:`available` is False and callers keep their legacy status logic unchanged.
+
+Design ratified by advisory panel (Fable + Codex 5.5 + Gemini 3.1 Pro, unanimous).
+"""
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+_RUNG = {"observe": 0, "warn": 1, "enforce": 2}
+# Optional per-repo overrides live under this manifest key: {finding_code: posture}.
+MANIFEST_OVERRIDE_KEY = "gate_posture_overrides"
+_DEFAULT_UNLISTED = {"category": "advisory", "default_posture": "warn", "min_posture": "observe"}
+
+
+def _rank(posture: str) -> int:
+    return _RUNG.get(posture, _RUNG["warn"])
+
+
+_REGISTRY_CACHE: dict[str, Any] | None = None
+_REGISTRY_LOADED = False
+
+
+def _registry() -> dict[str, Any] | None:
+    global _REGISTRY_CACHE, _REGISTRY_LOADED
+    if _REGISTRY_LOADED:
+        return _REGISTRY_CACHE
+    try:
+        from consiliency_contract import load_registry
+
+        reg = load_registry("gate_posture_registry")
+        _REGISTRY_CACHE = reg if isinstance(reg, Mapping) else None
+    except Exception:
+        _REGISTRY_CACHE = None  # contract predates the registry (< 0.6.2)
+    _REGISTRY_LOADED = True
+    return _REGISTRY_CACHE
+
+
+def available() -> bool:
+    """True when the installed contract ships the posture registry (>= 0.6.2)."""
+    return _registry() is not None
+
+
+def _class_entry(reg: Mapping[str, Any], code: str) -> Mapping[str, Any]:
+    for fc in reg.get("finding_classes", []):
+        if isinstance(fc, Mapping) and fc.get("code") == code:
+            return fc
+    unlisted = reg.get("default_unlisted")
+    return unlisted if isinstance(unlisted, Mapping) else _DEFAULT_UNLISTED
+
+
+def _overrides(manifest: Mapping[str, Any] | None) -> dict[str, str]:
+    if isinstance(manifest, Mapping):
+        raw = manifest.get(MANIFEST_OVERRIDE_KEY)
+        if isinstance(raw, Mapping):
+            return {str(k): str(v) for k, v in raw.items()}
+    return {}
+
+
+def resolve_posture(code: str, *, manifest: Mapping[str, Any] | None = None) -> dict[str, Any]:
+    """Resolve the effective posture for a finding ``code``.
+
+    Returns a dict with the effective ``posture`` plus provenance (``default``, ``floor``,
+    ``cap``, ``requested`` per-repo value, ``retracted`` = a real downward move below the
+    default, ``clamped_to_floor`` = an override that tried to go below the floor and was
+    denied, ``category``). ``available`` is False when the contract lacks the registry.
+    """
+    reg = _registry()
+    if reg is None:
+        return {"posture": "warn", "default": "warn", "floor": "observe", "cap": None,
+                "requested": None, "retracted": False, "clamped_to_floor": False,
+                "category": "advisory", "available": False}
+    entry = _class_entry(reg, code)
+    default = str(entry.get("default_posture", "warn"))
+    floor = str(entry.get("min_posture", "observe"))
+    cap = entry.get("max_posture")
+    cap = str(cap) if cap in _RUNG else None
+
+    requested = _overrides(manifest).get(code)
+    chosen = requested if requested in _RUNG else default
+
+    effective = chosen
+    clamped_to_floor = requested in _RUNG and _rank(requested) < _rank(floor)
+    if cap and _rank(effective) > _rank(cap):
+        effective = cap
+    if _rank(effective) < _rank(floor):
+        # NON-RETRACTABLE floor: a repo can never weaken below it -- and the floor wins
+        # even over a mis-configured max_posture < min_posture registry entry.
+        effective = floor
+
+    # `retracted` reflects an ACTUAL downward move of the effective posture below the
+    # default -- a floor-clamped attempt (effective unchanged) is NOT a retraction; it is
+    # surfaced via `clamped_to_floor` instead.
+    retracted = requested in _RUNG and _rank(effective) < _rank(default)
+    return {"posture": effective, "default": default, "floor": floor, "cap": cap,
+            "requested": requested, "retracted": bool(retracted),
+            "clamped_to_floor": bool(clamped_to_floor),
+            "category": str(entry.get("category", "advisory")), "available": True}
+
+
+def retracting_overrides(manifest: Mapping[str, Any] | None) -> list[str]:
+    """The finding codes whose per-repo override LOWERS the effective posture below its
+    default -- de-fanging that must be surfaced even when that class fired no finding this
+    scan. A floor-clamped attempt (effective unchanged) is not counted (see resolve_posture)."""
+    if _registry() is None:
+        return []
+    out = [code for code in _overrides(manifest) if resolve_posture(code, manifest=manifest)["retracted"]]
+    return sorted(set(out))
+
+
+def posture_status(posture: str, *, mode: str) -> str:
+    """Map a resolved posture + operator mode to a gate-status contribution:
+    ``observe`` -> ``note`` (recorded, never warns/blocks); ``warn`` -> ``warn``;
+    ``enforce`` -> ``warn`` unless the operator opted into ``hard`` -> ``blocked``.
+    ``human_required`` is never implied at any rung."""
+    if posture == "observe":
+        return "note"
+    if posture == "enforce" and mode == "hard":
+        return "blocked"
+    return "warn"

{phase_loop_runtime-0.2.1 → phase_loop_runtime-0.3.0}/src/phase_loop_runtime.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.2.1
+Version: 0.3.0
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author: ViperJuice
 License-Expression: Apache-2.0
@@ -18,7 +18,7 @@ Description-Content-Type: text/markdown
 Requires-Dist: baml-py<0.223,>=0.222
 Requires-Dist: pydantic<3,>=2
 Requires-Dist: PyYAML<7,>=6
-Requires-Dist: consiliency-contract<0.5.0,>=0.3.0
+Requires-Dist: consiliency-contract<0.7,>=0.6.3
 Requires-Dist: jsonschema<5,>=4
 Requires-Dist: tomli<3,>=2; python_version < "3.11"
 

{phase_loop_runtime-0.2.1 → phase_loop_runtime-0.3.0}/src/phase_loop_runtime.egg-info/SOURCES.txt

@@ -37,6 +37,7 @@ src/phase_loop_runtime/evidence_audit_config.py
 src/phase_loop_runtime/fleet_map.py
 src/phase_loop_runtime/fleet_metrics.py
 src/phase_loop_runtime/fleet_metrics_export.py
+src/phase_loop_runtime/gate_posture.py
 src/phase_loop_runtime/git_discipline.py
 src/phase_loop_runtime/git_ops.py
 src/phase_loop_runtime/git_topology.py
@@ -417,6 +418,7 @@ tests/test_fleet_map.py
 tests/test_fleet_metrics.py
 tests/test_fleet_metrics_export.py
 tests/test_gate_a_wheel_isolation.py
+tests/test_gate_posture.py
 tests/test_git_discipline.py
 tests/test_governed_disjointness_model_first.py
 tests/test_governed_e2e.py
@@ -614,6 +616,7 @@ tests/test_skill_sources_seam.py
 tests/test_skills_bundle_drift.py
 tests/test_skills_canon_parity.py
 tests/test_skills_src_claude_literal_lint.py
+tests/test_spec_conformance_gate.py
 tests/test_sync_skills_apply_failloud.py
 tests/test_train_e2e.py
 tests/test_train_invariants.py

{phase_loop_runtime-0.2.1 → phase_loop_runtime-0.3.0}/src/phase_loop_runtime.egg-info/requires.txt

@@ -1,7 +1,7 @@
 baml-py<0.223,>=0.222
 pydantic<3,>=2
 PyYAML<7,>=6
-consiliency-contract<0.5.0,>=0.3.0
+consiliency-contract<0.7,>=0.6.3
 jsonschema<5,>=4
 
 [:python_version < "3.11"]

phase_loop_runtime-0.3.0/tests/test_gate_posture.py

@@ -0,0 +1,113 @@
+"""Retractable teeth -- posture resolution (floors, clamps, caps, retraction visibility)."""
+from __future__ import annotations
+
+import unittest
+
+from phase_loop_runtime import gate_posture as gp
+
+
+class GatePostureResolveTest(unittest.TestCase):
+    def test_registry_available_on_0_6_2(self):
+        self.assertTrue(gp.available())
+
+    def test_invariant_default_is_its_floor_and_cannot_be_retracted(self):
+        # never_delete_human_refs: default enforce, floor enforce -> non-retractable.
+        base = gp.resolve_posture("never_delete_human_refs")
+        self.assertEqual(base["posture"], "enforce")
+        self.assertEqual(base["floor"], "enforce")
+        # a repo tries to silence it -> denied, clamped back to the floor
+        m = {gp.MANIFEST_OVERRIDE_KEY: {"never_delete_human_refs": "observe"}}
+        r = gp.resolve_posture("never_delete_human_refs", manifest=m)
+        self.assertEqual(r["posture"], "enforce")
+        self.assertTrue(r["clamped_to_floor"])
+
+    def test_write_footprint_floored_at_warn(self):
+        m = {gp.MANIFEST_OVERRIDE_KEY: {"write_footprint_violation": "observe"}}
+        r = gp.resolve_posture("write_footprint_violation", manifest=m)
+        self.assertEqual(r["posture"], "warn")  # cannot drop below the warn floor
+        self.assertTrue(r["clamped_to_floor"])
+
+    def test_advisory_retracts_freely_and_is_flagged_retracted(self):
+        # spec_nonconforming: advisory, default warn, floor observe.
+        m = {gp.MANIFEST_OVERRIDE_KEY: {"spec_nonconforming": "observe"}}
+        r = gp.resolve_posture("spec_nonconforming", manifest=m)
+        self.assertEqual(r["posture"], "observe")   # retract honored
+        self.assertTrue(r["retracted"])             # ...but recorded as a downward move
+        self.assertFalse(r["clamped_to_floor"])
+
+    def test_repo_may_raise_freely(self):
+        m = {gp.MANIFEST_OVERRIDE_KEY: {"pipeline_branch_naming_drift": "enforce"}}
+        r = gp.resolve_posture("pipeline_branch_naming_drift", manifest=m)
+        self.assertEqual(r["posture"], "enforce")
+        self.assertFalse(r["retracted"])
+
+    def test_version_skew_capped_at_warn(self):
+        # even an explicit raise to enforce is capped by max_posture.
+        m = {gp.MANIFEST_OVERRIDE_KEY: {"version_skew": "enforce"}}
+        r = gp.resolve_posture("version_skew", manifest=m)
+        self.assertEqual(r["posture"], "warn")
+        self.assertEqual(r["cap"], "warn")
+
+    def test_unlisted_code_uses_advisory_default(self):
+        r = gp.resolve_posture("some_brand_new_finding")
+        self.assertEqual(r["posture"], "warn")
+        self.assertEqual(r["category"], "advisory")
+
+    def test_clamped_invariant_is_not_flagged_retracted(self):
+        # CR fix: a floor-clamped attempt (effective unchanged) is clamped_to_floor, NOT retracted.
+        m = {gp.MANIFEST_OVERRIDE_KEY: {"never_delete_human_refs": "observe"}}
+        r = gp.resolve_posture("never_delete_human_refs", manifest=m)
+        self.assertEqual(r["posture"], "enforce")
+        self.assertFalse(r["retracted"])
+        self.assertTrue(r["clamped_to_floor"])
+
+    def test_retracting_overrides_lists_only_real_downward_moves(self):
+        # CR fix: de-fanging visible on clean scans -- retracting_overrides scans the manifest,
+        # counting only overrides that ACTUALLY lower a class (clamped invariants excluded).
+        m = {gp.MANIFEST_OVERRIDE_KEY: {
+            "spec_nonconforming": "observe",          # real down-move (advisory)
+            "never_delete_human_refs": "observe",     # clamped -> not counted
+            "pipeline_branch_naming_drift": "enforce"}}  # a raise -> not counted
+        self.assertEqual(gp.retracting_overrides(m), ["spec_nonconforming"])
+
+    def test_max_posture_never_undercuts_the_floor(self):
+        # CR fix: floor wins even over a (hypothetical) mis-set max<min; version_skew has
+        # floor observe + cap warn, so a raise-to-enforce lands at the warn cap, not below.
+        m = {gp.MANIFEST_OVERRIDE_KEY: {"version_skew": "enforce"}}
+        self.assertEqual(gp.resolve_posture("version_skew", manifest=m)["posture"], "warn")
+
+    def test_posture_status_mapping(self):
+        self.assertEqual(gp.posture_status("observe", mode="warn"), "note")
+        self.assertEqual(gp.posture_status("observe", mode="hard"), "note")
+        self.assertEqual(gp.posture_status("warn", mode="warn"), "warn")
+        self.assertEqual(gp.posture_status("warn", mode="hard"), "warn")
+        self.assertEqual(gp.posture_status("enforce", mode="warn"), "warn")   # master switch not thrown
+        self.assertEqual(gp.posture_status("enforce", mode="hard"), "blocked")  # opted into hard
+
+
+class ApplyPostureFallbackTest(unittest.TestCase):
+    """CR regression guard: on a contract < 0.6.2 (registry absent) the fallback must
+    preserve each gate's PRIOR severity, not uniformly block under hard."""
+
+    def _apply(self, findings, *, mode, **kw):
+        from unittest import mock
+        from phase_loop_runtime import consiliency_gates as cg
+        with mock.patch.object(gp, "available", return_value=False):
+            return cg._apply_posture(findings, manifest=None, mode=mode, **kw)
+
+    def test_version_skew_fallback_stays_warn_under_hard(self):
+        r = self._apply([{"code": "version_skew"}], mode="hard", legacy_capped_all=True)
+        self.assertEqual(r["status"], "warn")  # NOT blocked -- normative phase0 const
+
+    def test_spec_info_fallback_stays_warn_under_hard(self):
+        r = self._apply([{"code": "spec_below_conformance_bar"}], mode="hard",
+                        legacy_capped_codes=frozenset({"spec_below_conformance_bar"}))
+        self.assertEqual(r["status"], "warn")  # info tier never blocks, even in fallback
+
+    def test_uncapped_finding_still_blocks_under_hard_in_fallback(self):
+        r = self._apply([{"code": "some_finding"}], mode="hard")
+        self.assertEqual(r["status"], "blocked")  # legacy uniform behavior preserved
+
+
+if __name__ == "__main__":
+    unittest.main()

{phase_loop_runtime-0.2.1 → phase_loop_runtime-0.3.0}/tests/test_git_discipline.py

@@ -186,12 +186,20 @@ class GateSeverityTest(unittest.TestCase):
             gd.load_protocol = self._orig_proto
             gd.gather_repo_ref_facts = self._orig_facts
 
-    def test_warns_by_default_blocks_on_opt_in(self):
+    def test_write_footprint_warns_by_default_and_blocks_on_enforce_opt_in(self):
+        # Retractable teeth: write_footprint_violation is an invariant FLOORED at warn --
+        # it warns by default (even under hard, forgiving), can't be silenced below warn,
+        # and blocks under hard only when a repo/fleet raises it to `enforce`.
         self._patch("consiliency/pipeline/v0.4", ["src/app.py"])
-        warn = _gate_git_discipline(Path("/nonexistent"), mode="warn")
-        hard = _gate_git_discipline(Path("/nonexistent"), mode="hard")
+        warn = _gate_git_discipline(Path("/nonexistent"), None, mode="warn")
+        hard = _gate_git_discipline(Path("/nonexistent"), None, mode="hard")
         self.assertEqual(warn["status"], "warn")
-        self.assertEqual(hard["status"], "blocked")
+        self.assertEqual(hard["status"], "warn")  # forgiving default: warns, does not block
+        enforce = {"gate_posture_overrides": {"write_footprint_violation": "enforce"}}
+        self.assertEqual(_gate_git_discipline(Path("/nonexistent"), enforce, mode="hard")["status"], "blocked")
+        # ...but it can never be silenced below its warn floor:
+        silence = {"gate_posture_overrides": {"write_footprint_violation": "observe"}}
+        self.assertEqual(_gate_git_discipline(Path("/nonexistent"), silence, mode="warn")["status"], "warn")
         self.assertTrue(warn["findings"])
         # The gate never emits a human_required signal.
         self.assertNotIn("human_required", warn)
@@ -200,7 +208,7 @@ class GateSeverityTest(unittest.TestCase):
 
     def test_clean_pipeline_branch_passes(self):
         self._patch("consiliency/pipeline/v0.4", [".consiliency/manifest.json"])
-        result = _gate_git_discipline(Path("/nonexistent"), mode="hard")
+        result = _gate_git_discipline(Path("/nonexistent"), None, mode="hard")
         self.assertEqual(result["status"], "passed")
 
 
@@ -214,7 +222,7 @@ class ContractAbsentDegradeTest(unittest.TestCase):
 
     def test_gate_degrades_to_passed_not_warn(self):
         # Neutral no-op even in hard mode -- must NOT flip governed scans to warn.
-        result = _gate_git_discipline(Path("/nonexistent"), mode="hard")
+        result = _gate_git_discipline(Path("/nonexistent"), None, mode="hard")
         self.assertEqual(result["status"], "passed")
         self.assertIn("latent", result["note"])