polyglot-code-guard 0.3.0__tar.gz → 0.4.0__tar.gz

polyglot_code_guard-0.4.0/PKG-INFO

@@ -0,0 +1,182 @@
+Metadata-Version: 2.4
+Name: polyglot-code-guard
+Version: 0.4.0
+Summary: Fail-closed, multi-language test verification for AI-generated code.
+Author: Furox-Art
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Furox-Art/polyglot-code-guard
+Project-URL: Repository, https://github.com/Furox-Art/polyglot-code-guard
+Project-URL: Issues, https://github.com/Furox-Art/polyglot-code-guard/issues
+Keywords: testing,code-verification,polyglot,ai-generated-code,quality-gate
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: tomli>=2; python_version < "3.11"
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == "test"
+Requires-Dist: pytest-cov>=6.0; extra == "test"
+Dynamic: license-file
+
+# Polyguard
+
+**Fail-closed verification for AI-generated code across multiple programming languages.**
+
+Polyguard discovers supported project types, checks for a test suite, runs the relevant build/test commands, and returns a one-word verdict by default. A passing command exit code is not enough: Polyguard also requires a positive test-success summary from a recognized runner output format.
+
+## Install
+
+\`\`\`bash
+python -m pip install --upgrade polyglot-code-guard
+\`\`\`
+
+## Run
+
+From the target repository:
+
+\`\`\`bash
+polyguard verify
+\`\`\`
+
+Default output:
+
+\`\`\`text
+PASS
+\`\`\`
+
+or:
+
+\`\`\`text
+FAIL
+\`\`\`
+
+Diagnostics and automation:
+
+\`\`\`bash
+polyguard verify --details
+polyguard verify --json
+polyguard verify --path ./my-project --timeout 180
+polyguard verify --config ./ci/polyguard.toml
+polyguard --version
+\`\`\`
+
+Exit code is **0** for PASS and **1** for FAIL. Missing tests, missing toolchains, invalid configuration, a build/test failure, timeout, or missing positive test-execution evidence returns FAIL. On timeout, Polyguard terminates the command's process group/tree to avoid leaving test-runner descendants behind. Captured output is streamed and limited to the final 256 KiB per command.
+
+## Built-in language support
+
+| Language | Default build/test plan | Positive execution evidence |
+| --- | --- | --- |
+| Python | \`compileall\`, then \`pytest -q\` | Pytest passed-test summary |
+| Rust | \`cargo test --all-targets\` | Cargo test-result summary |
+| Go | \`go test -json ./...\` | Passing test events in JSON stream |
+| JavaScript / TypeScript | Direct Vitest/Jest/Mocha/TAP CLI when declared, otherwise `node --test`; TypeScript also runs `tsc --noEmit` when configured | Recognized runner pass summary (including Vitest default/minimal, Jest, Mocha, and Node TAP formats) |
+| Java | Maven `clean test` or Gradle `clean test` | Parsed Surefire/Gradle JUnit XML; at least one pass, zero failures |
+| C# | dotnet test with a Polyguard TRX prefix | Parsed TRX counters; at least one pass, zero failures |
+| PHP | PHPUnit with --log-junit | Parsed JUnit XML; at least one pass, zero failures |
+| Ruby | RSpec, or Ruby's Minitest runner | RSpec/Minitest success summary |
+| Swift | `swift test --parallel` | Recognized Swift Testing/XCTest runner summary with a positive passed-test count |
+| C | CMake build and CTest | CTest positive test count |
+| C++ | CMake build and CTest | CTest positive test count |
+
+C and C++ are separate language identifiers in configuration. JavaScript and TypeScript share the same project plan; TypeScript type checking does not replace running tests. Project-defined npm `test` scripts are never treated as test-execution evidence.
+
+### Monorepos and workspaces
+
+Polyguard recursively discovers independent package roots and runs each package in its own working directory. It also recognizes common aggregator manifests and delegates execution to the native workspace command once, avoiding duplicate child-package runs:
+
+- Maven `<modules>` and Gradle `settings.gradle(.kts)`
+- Cargo `[workspace].members`
+- npm `workspaces`
+- .NET solution (`.sln`) files
+
+Only projects explicitly declared as Maven modules, Gradle includes, Cargo members, npm workspace packages, or .NET solution projects are coalesced under the aggregator root. Unlisted nested projects remain independent units. Each independently discovered project is reported separately. A failure or incomplete test report in any required project makes the overall result FAIL. For workspace aggregators, native package managers remain responsible for workspace dependency resolution and execution.
+
+## Configure custom test commands
+
+For non-standard project layouts or test runners, create \`.polyguard.toml\` in the project root or pass one with \`--config\`.
+
+\`\`\`toml
+[project]
+languages = ["python"]
+
+[checks.python]
+commands = [
+  ["python3", "-m", "compileall", "-q", "src"],
+  ["python3", "-m", "pytest", "-q"],
+]
+test_patterns = ["tests/test_*.py", "tests/**/*.py"]
+\`\`\`
+
+Configuration fields:
+- \`commands\`: non-empty argument arrays. Commands are launched without a shell.
+- \`test_patterns\`: at least one matching file must exist inside the project root.
+
+**Evidence boundary:** custom \`success_patterns\` are rejected. An arbitrary output regex can be satisfied by a dummy command and cannot establish that tests executed. Custom commands may execute for diagnostics, but they cannot establish PASS: their stdout and generated reports are not trusted execution evidence. PASS requires the exact built-in command plan for the detected language project. A custom command adapter is not currently supported.
+
+## Test evidence and verdict rules
+
+A language check returns PASS only when:
+1. The project and required test suite are detected.
+2. Every required command completes successfully.
+3. The exact built-in command plan for the detected project ran; custom commands cannot establish PASS.
+4. A built-in runner summary or a freshly generated native structured test report proves that at least one test passed.
+5. No command failure or timeout occurs.
+
+A zero-test run, an all-skipped suite, an output with no recognized success summary, inconsistent report counters, a malformed or stale native report, or a non-zero exit code returns FAIL. Java and PHP require freshly generated JUnit XML; C# requires a fresh TRX report. Swift uses a positive test count from the SwiftPM runner summary because Swift Testing does not produce a usable xUnit report in this workflow. A successful command exit alone is insufficient. C# currently targets the VSTest TRX logger contract; Microsoft.Testing.Platform projects that do not emit this TRX report fail closed until an MTP-specific adapter is configured. JSON and detailed output include passed, failed, skipped, and total counts when the runner report exposes them.
+
+## Integration tests
+
+The repository includes disposable real-project fixtures for all eleven supported language identifiers, including real Java/JUnit, C#/.NET, PHP/PHPUnit, and SwiftPM/Swift Testing projects. The suite also covers mixed-language and native-workspace monorepos. Run:
+
+\`\`\`bash
+python -m pip install -e ".[test]"
+python -m pytest -q
+\`\`\`
+
+Integration fixtures are created in temporary directories and run through Polyguard's actual project discovery and command execution path. Missing local toolchains are skipped by local integration tests; required CI jobs install their toolchains explicitly. The CI workflow also runs runner unit tests on Linux, Windows, and macOS, plus a native SwiftPM fixture on macOS.
+
+## AI coding-agent skill
+
+The repository includes \`SKILL.md\`, also shipped in the installed package. Agents should run:
+
+\`\`\`bash
+polyguard verify --path . --details
+\`\`\`
+
+Agents must not report successful verification unless the command exits 0 and returns PASS. They must not delete, skip, or weaken tests to manufacture a passing result.
+
+## Important limitations and security
+
+Polyguard is a test-execution gate, **not a formal proof of program correctness**. PASS means that the built-in command plan succeeded and positive test-pass evidence was recognized. It does not guarantee adequate test coverage, correct requirements, or absence of defects.
+
+The verifier executes project build scripts, package managers, and tests. Treat repositories and dependencies as untrusted. Run them in a disposable container or VM without secrets, privileged access, or sensitive host mounts. Polyguard does not itself provide operating-system isolation.
+
+Automatic language discovery is conservative. Custom frameworks can be configured for diagnostic execution, but custom commands cannot establish PASS. Only the built-in command plan currently produces trusted execution evidence. Polyguard discovers supported package manifests recursively and executes each discovered language package from its own project root. Multiple packages using the same language are reported separately; the overall result is FAIL if any package fails. A root-level .polyguard.toml applies its language configuration to each matching package, with test patterns evaluated relative to that package root. Workspace-specific dependency orchestration remains the responsibility of the native package manager.
+
+## Development
+
+The CI unit-test gate requires **100% line and branch coverage** of Polyguard's own Python implementation. This measures Polyguard's code, not the test coverage of projects it verifies.
+
+\`\`\`bash
+python -m pip install -e ".[test]"
+python -m pytest -q
+python -m pytest -q --cov=polyguard --cov-branch --cov-report=term-missing --cov-fail-under=100
+python -m build
+python -m twine check dist/*
+\`\`\`
+
+## Publishing
+
+GitHub Actions builds the distributions and publishes with PyPI Trusted Publishing. Configure the PyPI publisher for:
+- Owner: \`Furox-Art\`
+- Repository: \`polyglot-code-guard\`
+- Workflow: \`publish.yml\`
+- Environment: \`pypi\`
+
+## License
+
+MIT

polyglot_code_guard-0.4.0/README.md

@@ -0,0 +1,158 @@
+# Polyguard
+
+**Fail-closed verification for AI-generated code across multiple programming languages.**
+
+Polyguard discovers supported project types, checks for a test suite, runs the relevant build/test commands, and returns a one-word verdict by default. A passing command exit code is not enough: Polyguard also requires a positive test-success summary from a recognized runner output format.
+
+## Install
+
+\`\`\`bash
+python -m pip install --upgrade polyglot-code-guard
+\`\`\`
+
+## Run
+
+From the target repository:
+
+\`\`\`bash
+polyguard verify
+\`\`\`
+
+Default output:
+
+\`\`\`text
+PASS
+\`\`\`
+
+or:
+
+\`\`\`text
+FAIL
+\`\`\`
+
+Diagnostics and automation:
+
+\`\`\`bash
+polyguard verify --details
+polyguard verify --json
+polyguard verify --path ./my-project --timeout 180
+polyguard verify --config ./ci/polyguard.toml
+polyguard --version
+\`\`\`
+
+Exit code is **0** for PASS and **1** for FAIL. Missing tests, missing toolchains, invalid configuration, a build/test failure, timeout, or missing positive test-execution evidence returns FAIL. On timeout, Polyguard terminates the command's process group/tree to avoid leaving test-runner descendants behind. Captured output is streamed and limited to the final 256 KiB per command.
+
+## Built-in language support
+
+| Language | Default build/test plan | Positive execution evidence |
+| --- | --- | --- |
+| Python | \`compileall\`, then \`pytest -q\` | Pytest passed-test summary |
+| Rust | \`cargo test --all-targets\` | Cargo test-result summary |
+| Go | \`go test -json ./...\` | Passing test events in JSON stream |
+| JavaScript / TypeScript | Direct Vitest/Jest/Mocha/TAP CLI when declared, otherwise `node --test`; TypeScript also runs `tsc --noEmit` when configured | Recognized runner pass summary (including Vitest default/minimal, Jest, Mocha, and Node TAP formats) |
+| Java | Maven `clean test` or Gradle `clean test` | Parsed Surefire/Gradle JUnit XML; at least one pass, zero failures |
+| C# | dotnet test with a Polyguard TRX prefix | Parsed TRX counters; at least one pass, zero failures |
+| PHP | PHPUnit with --log-junit | Parsed JUnit XML; at least one pass, zero failures |
+| Ruby | RSpec, or Ruby's Minitest runner | RSpec/Minitest success summary |
+| Swift | `swift test --parallel` | Recognized Swift Testing/XCTest runner summary with a positive passed-test count |
+| C | CMake build and CTest | CTest positive test count |
+| C++ | CMake build and CTest | CTest positive test count |
+
+C and C++ are separate language identifiers in configuration. JavaScript and TypeScript share the same project plan; TypeScript type checking does not replace running tests. Project-defined npm `test` scripts are never treated as test-execution evidence.
+
+### Monorepos and workspaces
+
+Polyguard recursively discovers independent package roots and runs each package in its own working directory. It also recognizes common aggregator manifests and delegates execution to the native workspace command once, avoiding duplicate child-package runs:
+
+- Maven `<modules>` and Gradle `settings.gradle(.kts)`
+- Cargo `[workspace].members`
+- npm `workspaces`
+- .NET solution (`.sln`) files
+
+Only projects explicitly declared as Maven modules, Gradle includes, Cargo members, npm workspace packages, or .NET solution projects are coalesced under the aggregator root. Unlisted nested projects remain independent units. Each independently discovered project is reported separately. A failure or incomplete test report in any required project makes the overall result FAIL. For workspace aggregators, native package managers remain responsible for workspace dependency resolution and execution.
+
+## Configure custom test commands
+
+For non-standard project layouts or test runners, create \`.polyguard.toml\` in the project root or pass one with \`--config\`.
+
+\`\`\`toml
+[project]
+languages = ["python"]
+
+[checks.python]
+commands = [
+  ["python3", "-m", "compileall", "-q", "src"],
+  ["python3", "-m", "pytest", "-q"],
+]
+test_patterns = ["tests/test_*.py", "tests/**/*.py"]
+\`\`\`
+
+Configuration fields:
+- \`commands\`: non-empty argument arrays. Commands are launched without a shell.
+- \`test_patterns\`: at least one matching file must exist inside the project root.
+
+**Evidence boundary:** custom \`success_patterns\` are rejected. An arbitrary output regex can be satisfied by a dummy command and cannot establish that tests executed. Custom commands may execute for diagnostics, but they cannot establish PASS: their stdout and generated reports are not trusted execution evidence. PASS requires the exact built-in command plan for the detected language project. A custom command adapter is not currently supported.
+
+## Test evidence and verdict rules
+
+A language check returns PASS only when:
+1. The project and required test suite are detected.
+2. Every required command completes successfully.
+3. The exact built-in command plan for the detected project ran; custom commands cannot establish PASS.
+4. A built-in runner summary or a freshly generated native structured test report proves that at least one test passed.
+5. No command failure or timeout occurs.
+
+A zero-test run, an all-skipped suite, an output with no recognized success summary, inconsistent report counters, a malformed or stale native report, or a non-zero exit code returns FAIL. Java and PHP require freshly generated JUnit XML; C# requires a fresh TRX report. Swift uses a positive test count from the SwiftPM runner summary because Swift Testing does not produce a usable xUnit report in this workflow. A successful command exit alone is insufficient. C# currently targets the VSTest TRX logger contract; Microsoft.Testing.Platform projects that do not emit this TRX report fail closed until an MTP-specific adapter is configured. JSON and detailed output include passed, failed, skipped, and total counts when the runner report exposes them.
+
+## Integration tests
+
+The repository includes disposable real-project fixtures for all eleven supported language identifiers, including real Java/JUnit, C#/.NET, PHP/PHPUnit, and SwiftPM/Swift Testing projects. The suite also covers mixed-language and native-workspace monorepos. Run:
+
+\`\`\`bash
+python -m pip install -e ".[test]"
+python -m pytest -q
+\`\`\`
+
+Integration fixtures are created in temporary directories and run through Polyguard's actual project discovery and command execution path. Missing local toolchains are skipped by local integration tests; required CI jobs install their toolchains explicitly. The CI workflow also runs runner unit tests on Linux, Windows, and macOS, plus a native SwiftPM fixture on macOS.
+
+## AI coding-agent skill
+
+The repository includes \`SKILL.md\`, also shipped in the installed package. Agents should run:
+
+\`\`\`bash
+polyguard verify --path . --details
+\`\`\`
+
+Agents must not report successful verification unless the command exits 0 and returns PASS. They must not delete, skip, or weaken tests to manufacture a passing result.
+
+## Important limitations and security
+
+Polyguard is a test-execution gate, **not a formal proof of program correctness**. PASS means that the built-in command plan succeeded and positive test-pass evidence was recognized. It does not guarantee adequate test coverage, correct requirements, or absence of defects.
+
+The verifier executes project build scripts, package managers, and tests. Treat repositories and dependencies as untrusted. Run them in a disposable container or VM without secrets, privileged access, or sensitive host mounts. Polyguard does not itself provide operating-system isolation.
+
+Automatic language discovery is conservative. Custom frameworks can be configured for diagnostic execution, but custom commands cannot establish PASS. Only the built-in command plan currently produces trusted execution evidence. Polyguard discovers supported package manifests recursively and executes each discovered language package from its own project root. Multiple packages using the same language are reported separately; the overall result is FAIL if any package fails. A root-level .polyguard.toml applies its language configuration to each matching package, with test patterns evaluated relative to that package root. Workspace-specific dependency orchestration remains the responsibility of the native package manager.
+
+## Development
+
+The CI unit-test gate requires **100% line and branch coverage** of Polyguard's own Python implementation. This measures Polyguard's code, not the test coverage of projects it verifies.
+
+\`\`\`bash
+python -m pip install -e ".[test]"
+python -m pytest -q
+python -m pytest -q --cov=polyguard --cov-branch --cov-report=term-missing --cov-fail-under=100
+python -m build
+python -m twine check dist/*
+\`\`\`
+
+## Publishing
+
+GitHub Actions builds the distributions and publishes with PyPI Trusted Publishing. Configure the PyPI publisher for:
+- Owner: \`Furox-Art\`
+- Repository: \`polyglot-code-guard\`
+- Workflow: \`publish.yml\`
+- Environment: \`pypi\`
+
+## License
+
+MIT

{polyglot_code_guard-0.3.0 → polyglot_code_guard-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "polyglot-code-guard"
-version = "0.3.0"
+version = "0.4.0"
 description = "Fail-closed, multi-language test verification for AI-generated code."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -21,7 +21,7 @@ classifiers = [
 dependencies = ["tomli>=2; python_version < '3.11'"]
 
 [project.optional-dependencies]
-test = ["pytest>=8.0"]
+test = ["pytest>=8.0", "pytest-cov>=6.0"]
 
 [project.scripts]
 polyguard = "polyguard.cli:main"
@@ -44,3 +44,11 @@ polyguard = ["SKILL.md"]
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 addopts = "-ra"
+
+[tool.coverage.run]
+branch = true
+source = ["polyguard"]
+
+[tool.coverage.report]
+fail_under = 100
+show_missing = true

polyglot_code_guard-0.4.0/src/polyglot_code_guard.egg-info/PKG-INFO

@@ -0,0 +1,182 @@
+Metadata-Version: 2.4
+Name: polyglot-code-guard
+Version: 0.4.0
+Summary: Fail-closed, multi-language test verification for AI-generated code.
+Author: Furox-Art
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Furox-Art/polyglot-code-guard
+Project-URL: Repository, https://github.com/Furox-Art/polyglot-code-guard
+Project-URL: Issues, https://github.com/Furox-Art/polyglot-code-guard/issues
+Keywords: testing,code-verification,polyglot,ai-generated-code,quality-gate
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: tomli>=2; python_version < "3.11"
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == "test"
+Requires-Dist: pytest-cov>=6.0; extra == "test"
+Dynamic: license-file
+
+# Polyguard
+
+**Fail-closed verification for AI-generated code across multiple programming languages.**
+
+Polyguard discovers supported project types, checks for a test suite, runs the relevant build/test commands, and returns a one-word verdict by default. A passing command exit code is not enough: Polyguard also requires a positive test-success summary from a recognized runner output format.
+
+## Install
+
+\`\`\`bash
+python -m pip install --upgrade polyglot-code-guard
+\`\`\`
+
+## Run
+
+From the target repository:
+
+\`\`\`bash
+polyguard verify
+\`\`\`
+
+Default output:
+
+\`\`\`text
+PASS
+\`\`\`
+
+or:
+
+\`\`\`text
+FAIL
+\`\`\`
+
+Diagnostics and automation:
+
+\`\`\`bash
+polyguard verify --details
+polyguard verify --json
+polyguard verify --path ./my-project --timeout 180
+polyguard verify --config ./ci/polyguard.toml
+polyguard --version
+\`\`\`
+
+Exit code is **0** for PASS and **1** for FAIL. Missing tests, missing toolchains, invalid configuration, a build/test failure, timeout, or missing positive test-execution evidence returns FAIL. On timeout, Polyguard terminates the command's process group/tree to avoid leaving test-runner descendants behind. Captured output is streamed and limited to the final 256 KiB per command.
+
+## Built-in language support
+
+| Language | Default build/test plan | Positive execution evidence |
+| --- | --- | --- |
+| Python | \`compileall\`, then \`pytest -q\` | Pytest passed-test summary |
+| Rust | \`cargo test --all-targets\` | Cargo test-result summary |
+| Go | \`go test -json ./...\` | Passing test events in JSON stream |
+| JavaScript / TypeScript | Direct Vitest/Jest/Mocha/TAP CLI when declared, otherwise `node --test`; TypeScript also runs `tsc --noEmit` when configured | Recognized runner pass summary (including Vitest default/minimal, Jest, Mocha, and Node TAP formats) |
+| Java | Maven `clean test` or Gradle `clean test` | Parsed Surefire/Gradle JUnit XML; at least one pass, zero failures |
+| C# | dotnet test with a Polyguard TRX prefix | Parsed TRX counters; at least one pass, zero failures |
+| PHP | PHPUnit with --log-junit | Parsed JUnit XML; at least one pass, zero failures |
+| Ruby | RSpec, or Ruby's Minitest runner | RSpec/Minitest success summary |
+| Swift | `swift test --parallel` | Recognized Swift Testing/XCTest runner summary with a positive passed-test count |
+| C | CMake build and CTest | CTest positive test count |
+| C++ | CMake build and CTest | CTest positive test count |
+
+C and C++ are separate language identifiers in configuration. JavaScript and TypeScript share the same project plan; TypeScript type checking does not replace running tests. Project-defined npm `test` scripts are never treated as test-execution evidence.
+
+### Monorepos and workspaces
+
+Polyguard recursively discovers independent package roots and runs each package in its own working directory. It also recognizes common aggregator manifests and delegates execution to the native workspace command once, avoiding duplicate child-package runs:
+
+- Maven `<modules>` and Gradle `settings.gradle(.kts)`
+- Cargo `[workspace].members`
+- npm `workspaces`
+- .NET solution (`.sln`) files
+
+Only projects explicitly declared as Maven modules, Gradle includes, Cargo members, npm workspace packages, or .NET solution projects are coalesced under the aggregator root. Unlisted nested projects remain independent units. Each independently discovered project is reported separately. A failure or incomplete test report in any required project makes the overall result FAIL. For workspace aggregators, native package managers remain responsible for workspace dependency resolution and execution.
+
+## Configure custom test commands
+
+For non-standard project layouts or test runners, create \`.polyguard.toml\` in the project root or pass one with \`--config\`.
+
+\`\`\`toml
+[project]
+languages = ["python"]
+
+[checks.python]
+commands = [
+  ["python3", "-m", "compileall", "-q", "src"],
+  ["python3", "-m", "pytest", "-q"],
+]
+test_patterns = ["tests/test_*.py", "tests/**/*.py"]
+\`\`\`
+
+Configuration fields:
+- \`commands\`: non-empty argument arrays. Commands are launched without a shell.
+- \`test_patterns\`: at least one matching file must exist inside the project root.
+
+**Evidence boundary:** custom \`success_patterns\` are rejected. An arbitrary output regex can be satisfied by a dummy command and cannot establish that tests executed. Custom commands may execute for diagnostics, but they cannot establish PASS: their stdout and generated reports are not trusted execution evidence. PASS requires the exact built-in command plan for the detected language project. A custom command adapter is not currently supported.
+
+## Test evidence and verdict rules
+
+A language check returns PASS only when:
+1. The project and required test suite are detected.
+2. Every required command completes successfully.
+3. The exact built-in command plan for the detected project ran; custom commands cannot establish PASS.
+4. A built-in runner summary or a freshly generated native structured test report proves that at least one test passed.
+5. No command failure or timeout occurs.
+
+A zero-test run, an all-skipped suite, an output with no recognized success summary, inconsistent report counters, a malformed or stale native report, or a non-zero exit code returns FAIL. Java and PHP require freshly generated JUnit XML; C# requires a fresh TRX report. Swift uses a positive test count from the SwiftPM runner summary because Swift Testing does not produce a usable xUnit report in this workflow. A successful command exit alone is insufficient. C# currently targets the VSTest TRX logger contract; Microsoft.Testing.Platform projects that do not emit this TRX report fail closed until an MTP-specific adapter is configured. JSON and detailed output include passed, failed, skipped, and total counts when the runner report exposes them.
+
+## Integration tests
+
+The repository includes disposable real-project fixtures for all eleven supported language identifiers, including real Java/JUnit, C#/.NET, PHP/PHPUnit, and SwiftPM/Swift Testing projects. The suite also covers mixed-language and native-workspace monorepos. Run:
+
+\`\`\`bash
+python -m pip install -e ".[test]"
+python -m pytest -q
+\`\`\`
+
+Integration fixtures are created in temporary directories and run through Polyguard's actual project discovery and command execution path. Missing local toolchains are skipped by local integration tests; required CI jobs install their toolchains explicitly. The CI workflow also runs runner unit tests on Linux, Windows, and macOS, plus a native SwiftPM fixture on macOS.
+
+## AI coding-agent skill
+
+The repository includes \`SKILL.md\`, also shipped in the installed package. Agents should run:
+
+\`\`\`bash
+polyguard verify --path . --details
+\`\`\`
+
+Agents must not report successful verification unless the command exits 0 and returns PASS. They must not delete, skip, or weaken tests to manufacture a passing result.
+
+## Important limitations and security
+
+Polyguard is a test-execution gate, **not a formal proof of program correctness**. PASS means that the built-in command plan succeeded and positive test-pass evidence was recognized. It does not guarantee adequate test coverage, correct requirements, or absence of defects.
+
+The verifier executes project build scripts, package managers, and tests. Treat repositories and dependencies as untrusted. Run them in a disposable container or VM without secrets, privileged access, or sensitive host mounts. Polyguard does not itself provide operating-system isolation.
+
+Automatic language discovery is conservative. Custom frameworks can be configured for diagnostic execution, but custom commands cannot establish PASS. Only the built-in command plan currently produces trusted execution evidence. Polyguard discovers supported package manifests recursively and executes each discovered language package from its own project root. Multiple packages using the same language are reported separately; the overall result is FAIL if any package fails. A root-level .polyguard.toml applies its language configuration to each matching package, with test patterns evaluated relative to that package root. Workspace-specific dependency orchestration remains the responsibility of the native package manager.
+
+## Development
+
+The CI unit-test gate requires **100% line and branch coverage** of Polyguard's own Python implementation. This measures Polyguard's code, not the test coverage of projects it verifies.
+
+\`\`\`bash
+python -m pip install -e ".[test]"
+python -m pytest -q
+python -m pytest -q --cov=polyguard --cov-branch --cov-report=term-missing --cov-fail-under=100
+python -m build
+python -m twine check dist/*
+\`\`\`
+
+## Publishing
+
+GitHub Actions builds the distributions and publishes with PyPI Trusted Publishing. Configure the PyPI publisher for:
+- Owner: \`Furox-Art\`
+- Repository: \`polyglot-code-guard\`
+- Workflow: \`publish.yml\`
+- Environment: \`pypi\`
+
+## License
+
+MIT

{polyglot_code_guard-0.3.0 → polyglot_code_guard-0.4.0}/src/polyglot_code_guard.egg-info/SOURCES.txt

@@ -11,4 +11,5 @@ src/polyguard/SKILL.md
 src/polyguard/__init__.py
 src/polyguard/cli.py
 src/polyguard/runner.py
+tests/test_coverage_paths.py
 tests/test_runner.py

{polyglot_code_guard-0.3.0 → polyglot_code_guard-0.4.0}/src/polyglot_code_guard.egg-info/requires.txt

@@ -4,3 +4,4 @@ tomli>=2
 
 [test]
 pytest>=8.0
+pytest-cov>=6.0

{polyglot_code_guard-0.3.0 → polyglot_code_guard-0.4.0}/src/polyguard/SKILL.md

@@ -12,10 +12,10 @@ Use this skill whenever code is generated, changed, refactored, or described as
 1. Identify every language, build system, package root, and test framework touched by the change.
 2. Add requirement-based tests for normal behavior, edge cases, invalid inputs, error paths, and regressions.
 3. Run \`polyguard verify --path . --details\`.
-4. For a non-standard test runner, configure explicit commands, file patterns, and a success-summary parser in \`.polyguard.toml\`.
+4. For a non-standard test runner, explicit commands and file patterns can be configured for diagnostics; custom commands cannot establish PASS until a trusted runner adapter is implemented.
 5. Run the complete configured test suite. Do not omit a detected or required language.
-6. Require a positive passed-test count in recognized runner output. A successful command exit code or a test-looking filename alone is not sufficient.
-7. If a command fails, a toolchain is missing, tests cannot be found, the runner reports no passing tests, execution times out, or output evidence is missing, the verdict is FAIL.
+6. Require a positive passed-test count from the exact built-in command plan. Java and PHP default checks must produce fresh JUnit XML; C# must produce a fresh TRX report. Swift must emit a positive native test-runner summary. A successful command exit code alone is not sufficient.
+7. If a command fails, a toolchain is missing, tests cannot be found, the runner reports no passing tests, execution times out (the command process tree is terminated), or output evidence is missing, the verdict is FAIL.
 8. Fix the implementation or tests and rerun all checks. Never delete, skip, weaken, or rewrite a valid test merely to obtain PASS.
 9. Retain command output and the JSON report when inspectable evidence is requested.
 
@@ -28,11 +28,11 @@ The CLI exits 0 only for PASS and 1 for FAIL. Default output is exactly one word
 
 ## Custom command trust
 
-A custom \`success_patterns\` entry is a trusted assertion by the repository owner about command output. It is not independent proof that the command executed real tests. Do not use a dummy command that prints a success-looking summary. Prefer built-in adapters and native test reports.
+Custom \`success_patterns\` are rejected. Custom commands may execute for diagnostics, but their output and generated reports cannot establish PASS because a command can forge them. Only the exact built-in command plan for the detected project is accepted as execution evidence. Java, C#, and PHP additionally require fresh native reports; Swift uses its runner summary.
 
 ## Scope
 
-Built-in support: Python, Rust, Go, JavaScript/TypeScript, Java, C#, PHP, Ruby, Swift, C, and C++ with CMake/CTest. Use explicit configuration for unconventional project layouts and custom runners. Full monorepo orchestration is not implemented; run Polyguard separately from each package root.
+Built-in support: Python, Rust, Go, JavaScript/TypeScript, Java, C#, PHP, Ruby, Swift, C, and C++ with CMake/CTest. Use explicit configuration for unconventional project layouts and custom runners. Polyguard discovers supported package manifests recursively, executes each language package from its own root, and reports multiple packages of the same language separately. A root-level configuration is applied to each matching package with test patterns evaluated relative to that package root. Maven modules, Gradle settings builds, Cargo workspaces, npm workspaces, and .NET solutions are delegated to their native root command once to avoid duplicate child-package execution.
 
 ## Security
 

{polyglot_code_guard-0.3.0 → polyglot_code_guard-0.4.0}/src/polyguard/__init__.py

@@ -1,3 +1,3 @@
 """Polyguard: fail-closed verification for multi-language projects."""
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"