qaas-python 1.0.0__py3-none-any.whl → 2.0.0__py3-none-any.whl

qaas/adapters/tracker.py

@@ -207,12 +207,12 @@ class LocalTracker(TrackerAdapter):
         return self.dir / f"{key}.json"
 
     def _write(self, issue: Issue) -> Issue:
-        self._path(issue.key).write_text(issue.model_dump_json(indent=2))
+        self._path(issue.key).write_text(issue.model_dump_json(indent=2), encoding="utf-8")
         return issue
 
     def get(self, key: str) -> Issue | None:
         path = self._path(key)
-        return Issue.model_validate_json(path.read_text()) if path.exists() else None
+        return Issue.model_validate_json(path.read_text(encoding="utf-8")) if path.exists() else None
 
     def _require(self, key: str) -> Issue:
         issue = self.get(key)
@@ -224,7 +224,7 @@ class LocalTracker(TrackerAdapter):
         found = []
         for path in self.dir.glob("*.json"):
             if _KEY_RE.match(path.stem):
-                found.append(Issue.model_validate_json(path.read_text()))
+                found.append(Issue.model_validate_json(path.read_text(encoding="utf-8")))
         return sorted(found, key=lambda i: i.number)
 
     def _next_key(self, project: str) -> str:
@@ -568,6 +568,43 @@ def _label_slug(value: str | None) -> str | None:
     return slug or None
 
 
+class _StripAuthOnRedirect(urllib.request.HTTPRedirectHandler):
+    """Drop `Authorization` when a redirect leaves the site it was minted for.
+
+    urllib strips credentials across hosts only for the auth *handlers*. A
+    header set by hand on the `Request` — which is how every call here sends
+    `Basic <email:api_token>` — is copied onto the redirected request verbatim:
+    `HTTPRedirectHandler.redirect_request` filters out `content-length` and
+    `content-type` and nothing else.
+
+    That matters because `_resolve_url` deliberately follows Jira's redirects to
+    learn where a board actually lives, and it runs at the top of every
+    Jira-backed run via `cli._ensure_board`. On an SSO-enforced site
+    `/secure/RapidBoard.jspa?rapidView=<id>` answers 302 to the identity
+    provider — a different host — and the bot's API token went with it. The same
+    exposure sits on `_request`, which follows redirects too; both share this
+    one opener, so both are fixed here rather than at either call site.
+
+    Scheme counts as well as host: an https -> http redirect would put the token
+    on the wire in clear.
+    """
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):  # type: ignore[no-untyped-def]
+        new = super().redirect_request(req, fp, code, msg, headers, newurl)
+        if new is None:
+            return None
+        before = urllib.parse.urlsplit(req.full_url)
+        after = urllib.parse.urlsplit(new.full_url)
+        if (before.hostname, before.scheme) != (after.hostname, after.scheme):
+            # `Request.headers` is capitalised; `unredirected_hdrs` holds the
+            # ones urllib adds itself. Clear from both so nothing puts it back.
+            new.headers = {k: v for k, v in new.headers.items() if k.lower() != "authorization"}
+            new.unredirected_hdrs = {
+                k: v for k, v in new.unredirected_hdrs.items() if k.lower() != "authorization"
+            }
+        return new
+
+
 @dataclass(frozen=True)
 class BoardInfo:
     """What a per-repository board provisioning attempt produced.
@@ -664,7 +701,8 @@ class JiraTracker(TrackerAdapter):
         self.timeout = timeout
         # Built once, at construction, so proxy settings are read from the
         # environment the tracker was configured in rather than per call.
-        self._opener = urllib.request.build_opener()
+        # `_StripAuthOnRedirect` is not optional: see its docstring.
+        self._opener = urllib.request.build_opener(_StripAuthOnRedirect)
         self._link_type_cache: list[dict[str, Any]] | None = None
         self._account_id_cache: str | None = None
 
@@ -950,6 +988,33 @@ class JiraTracker(TrackerAdapter):
             for name in self.PROJECT_PERMISSIONS
         }
 
+    def _jira_status_name(self, status: str, project: str | None = None) -> str:
+        """A house status translated into this project's own vocabulary.
+
+        The `search` tool advertises `{"enum": list(STATUSES)}` — the house names
+        — and forwarded them to Jira verbatim, which validates status names and
+        answers 400. So TRIAGE following its own schema to dedupe
+        (`search(status="open", fingerprint=...)`) errored on every call, dedupe
+        degraded silently, and the duplicate ticket this system exists to prevent
+        got filed. `transition` goes to real trouble to translate via
+        `JIRA_STATUS_ALIASES`; this did not, and `_issue_from_jira` deliberately
+        stores Jira's own status name, so the house vocabulary could never match.
+
+        A name that is already this project's own is passed through untouched:
+        the one existing test for this path searches `status="Done"`, which is
+        Jira vocabulary rather than anything in `STATUSES`.
+        """
+        if status not in STATUSES:
+            return status
+        key = project or self._project
+        try:
+            names = sorted({n for group in self.project_statuses(key).values() for n in group})
+        except TrackerError:
+            # The workflow is unreadable; the caller's word is the best we have,
+            # and a 400 from a search is not worth failing a run over.
+            return status
+        return self.map_house_statuses(names).get(status) or status
+
     def project_statuses(self, key: str) -> dict[str, list[str]]:
         """Issue type name -> the status names its workflow contains.
 
@@ -976,7 +1041,7 @@ class JiraTracker(TrackerAdapter):
 
         Mirrors `_match_transition`'s candidate order, so what this predicts is
         what a transition will actually do. A None is a silent failure waiting
-        to happen: PROOF asks for 'closed', nothing matches, and the ticket sits
+        to happen: VERIFIER asks for 'closed', nothing matches, and the ticket sits
         open while the run reports success.
         """
         available = {name.strip().lower(): name for name in status_names if name.strip()}
@@ -1005,7 +1070,7 @@ class JiraTracker(TrackerAdapter):
         `filter/search` returns other people's filters too, and adopting a
         stranger's filter as the run's board would silently repoint it.
         """
-        params = {"filterName": name, "expand": "jql", "maxResults": "50"}
+        params = {"filterName": name, "expand": "jql,owner", "maxResults": "50"}
         account = self._account_id()
         if account:
             # Omitted rather than sent empty: Jira answers an empty accountId
@@ -1013,8 +1078,20 @@ class JiraTracker(TrackerAdapter):
             params["accountId"] = account
         data = self._request("GET", "/filter/search", params=params, retry_on_429=True)
         for entry in data.get("values") or []:
-            if str(entry.get("name") or "").strip() == name:
-                return entry
+            if str(entry.get("name") or "").strip() != name:
+                continue
+            # With no account id the scoping parameter was omitted, so the search
+            # returned everyone's filters and the first name match was adopted --
+            # a stranger's filter, which `ensure_repo_board` now PUTs new JQL
+            # onto. Failing open was survivable while this only read; since the
+            # repair landed it rewrites someone else's saved filter. When the
+            # owner cannot be established, decline to reuse and make our own.
+            owner = (entry.get("owner") or {}).get("accountId")
+            if account and owner and owner != account:
+                continue
+            if not account and owner:
+                continue
+            return entry
         return None
 
     def update_filter_jql(self, filter_id: int, *, name: str, jql: str) -> dict[str, Any]:
@@ -1027,7 +1104,16 @@ class JiraTracker(TrackerAdapter):
         told to watch. That is the same "files fine, invisible" failure the
         `repo-` label exists to prevent, arriving by a different road.
         """
-        return self._request("PUT", f"/filter/{filter_id}", body={"name": name, "jql": jql})
+        # `sharePermissions` is sent again on purpose. A PUT replaces the
+        # filter, so omitting it un-shares the filter this call just repaired --
+        # and Jira refuses to render a board over a private filter, which is the
+        # same "files fine, invisible" outcome two calls later. `create_filter`
+        # below records why the share matters.
+        return self._request(
+            "PUT",
+            f"/filter/{filter_id}",
+            body={"name": name, "jql": jql, "sharePermissions": [{"type": "authenticated"}]},
+        )
 
     def create_filter(self, *, name: str, jql: str, description: str = "") -> dict[str, Any]:
         """A saved filter, shared with authenticated users.
@@ -1568,7 +1654,7 @@ class JiraTracker(TrackerAdapter):
                 "project in (" + ", ".join(self._jql_value(p) for p in scope) + ")"
             )
         if status:
-            clauses.append(f"status = {self._jql_value(status)}")
+            clauses.append(f"status = {self._jql_value(self._jira_status_name(status, project))}")
         for value, prefix in (
             (label, ""),
             (envelope_id, ENVELOPE_LABEL_PREFIX),

qaas/adapters/vcs.py

@@ -6,7 +6,7 @@ one layer up, in `qaas.mcp.vcs`, because that is where the run context lives and
 where a refusal can be logged to the ledger.
 
 The split also keeps the §8.1 matrix honest when the backend changes. Swapping
-`vcs: local` for `vcs: github` must not quietly widen what FORGE may do, and it
+`vcs: local` for `vcs: github` must not quietly widen what REPRODUCER may do, and it
 cannot, because the enforcement is not in here.
 
 Two capabilities are absent on purpose rather than by oversight: there is no
@@ -129,16 +129,21 @@ class LocalGit(VcsAdapter):
         return name or "HEAD"
 
     def create_branch(self, name: str, from_ref: str | None = None) -> str:
-        args = ["checkout", "-b", name]
+        # `from_ref` had no validator of any kind while `name` had two. git
+        # accepts options after positionals, so a start point like
+        # `--upload-pack=...` was a flag in a value's clothing -- the exact
+        # shape `_reject_flaglike` exists to stop, on the one argument nothing
+        # was checking.
+        args = ["checkout", "-b", _reject_refspec("branch", name)]
         if from_ref:
-            args.append(from_ref)
+            args.append(_reject_ref("from_ref", from_ref))
         self._git(*args)
         return self.current_branch()
 
     def checkout(self, ref: str) -> str:
         """Switch to an existing ref. Not part of the abstract surface: only the
         local backend has a working tree to switch."""
-        self._git("checkout", ref)
+        self._git("checkout", _reject_ref("ref", ref))
         return self.current_branch()
 
     def write_files(self, files: Mapping[str, str]) -> list[str]:
@@ -146,7 +151,7 @@ class LocalGit(VcsAdapter):
         for rel, content in files.items():
             path = self.repo / rel
             path.parent.mkdir(parents=True, exist_ok=True)
-            path.write_text(content)
+            path.write_text(content, encoding="utf-8")
             written.append(rel)
         return written
 
@@ -162,9 +167,14 @@ class LocalGit(VcsAdapter):
         return self._git("rev-parse", "HEAD").strip()
 
     def diff(self, ref: str | None = None, paths: Sequence[str] | None = None) -> str:
+        # `ref` reached argv raw while `pr_diff` and `list_changed_files` both
+        # called `_reject_flaglike` on theirs. `git diff --output=<path>` exits 0
+        # and writes the diff to that path, so the one tool documented
+        # "read-only" could create or truncate any file the process can reach --
+        # and REVIEWER, whose policy grants no write access at all, holds it.
         args = ["diff"]
         if ref:
-            args.append(ref)
+            args.append(_reject_flaglike("ref", ref))
         if paths:
             args.extend(["--", *paths])
         return self._git(*args)
@@ -221,6 +231,52 @@ def _reject_flaglike(kind: str, value: str) -> str:
     return text
 
 
+#: git's own refname rules, narrowed to what this system ever needs. Notably it
+#: excludes `?`, `#`, `%` and `..` — which matter because `list_changed_files`
+#: interpolates a ref into a `gh api` *path*, where those characters restructure
+#: the request rather than name a commit.
+_REF_CHARS = re.compile(r"^[A-Za-z0-9._/-]+$")
+
+
+def _reject_ref(kind: str, value: str) -> str:
+    """A ref is letters, digits and a little punctuation. Anything else is not one."""
+    text = _reject_flaglike(kind, value)
+    if ".." in text or not _REF_CHARS.match(text):
+        raise VcsError(
+            f"refusing {kind} '{text}': a git ref is letters, digits, '.', '_', '-' "
+            "and '/', and may not contain '..'."
+        )
+    return text
+
+
+def _reject_refspec(kind: str, value: str) -> str:
+    """Refuse a branch name that git would read as a *refspec* rather than a name.
+
+    `git push origin <x>` parses `<x>` as a refspec, so `qa/repro/x:main` pushes
+    the local branch `qa/repro/x` onto the remote's `main` — while every gate on
+    the way sees a string that is neither `main` nor outside the agent's
+    patterns: `fnmatch("qa/repro/x:main", "qa/repro/*")` is True, and
+    `is_protected_head` tests the whole string. Verified against a real bare
+    remote: exit 0, `qa/repro/x -> main`. A leading `+` is a forced update in the
+    same grammar, which is the other thing this file promises can never happen.
+
+    Git itself forbids `:` in a branch name, so nothing legitimate is lost: the
+    only way one gets here is a caller passing a refspec where a name belongs.
+    """
+    text = _reject_flaglike(kind, value)
+    if ":" in text:
+        raise VcsError(
+            f"refusing {kind} '{text}': a branch name may not contain ':'. "
+            "git would read that as a refspec and push to whatever follows it."
+        )
+    if text.startswith("+"):
+        raise VcsError(
+            f"refusing {kind} '{text}': a leading '+' is a forced update, "
+            "and force-pushing is never permitted (§8.1)."
+        )
+    return _reject_ref(kind, text)
+
+
 def is_protected_head(branch: str) -> bool:
     """Whether `branch` is one no agent may push or open a PR from (§8.1)."""
     name = branch.strip().lower().removeprefix("refs/heads/")
@@ -299,7 +355,7 @@ class GitHubVcs(LocalGit):
 
     @staticmethod
     def _guard_head(branch: str) -> str:
-        name = _reject_flaglike("branch", branch)
+        name = _reject_refspec("branch", branch)
         if is_protected_head(name):
             raise VcsError(
                 f"refusing to publish '{name}': it is a protected branch (§8.1). "
@@ -317,8 +373,12 @@ class GitHubVcs(LocalGit):
         follow-up `gh pr create` can resolve the head without the agent having
         to know about tracking refs.
         """
-        name = self._guard_head(branch or self.current_branch())
-        self._git("push", "--set-upstream", self.remote, name)
+        name = self._guard_head(branch or self.current_branch()).removeprefix("refs/heads/")
+        # Fully qualified on both sides, so the destination is stated rather than
+        # inferred from a string git is free to re-parse. `_guard_head` already
+        # refuses a `:`; this makes the refspec explicit even if that ever
+        # changes, because the cost of being wrong here is a push to main.
+        self._git("push", "--set-upstream", self.remote, f"refs/heads/{name}:refs/heads/{name}")
         return name
 
     def open_pr(
@@ -350,18 +410,19 @@ class GitHubVcs(LocalGit):
                 "must say on its face what finding it answers."
             )
 
+        # `--flag=value`, not `--flag value`: `title` and `body` are the two
+        # arguments an agent writes freely here, and they were the two with no
+        # shape check at all. The joined form removes the question rather than
+        # answering it — there is no position left for a value to be read as a
+        # flag, and a title may still legitimately begin with a dash.
         args = [
             "pr",
             "create",
             *self._repo_args(),
-            "--head",
-            head,
-            "--base",
-            base_ref,
-            "--title",
-            subject,
-            "--body",
-            self.pr_body(body, key),
+            f"--head={head}",
+            f"--base={base_ref}",
+            f"--title={subject}",
+            f"--body={self.pr_body(body, key)}",
         ]
         if draft:
             args.append("--draft")
@@ -398,8 +459,8 @@ class GitHubVcs(LocalGit):
         Asking GitHub rather than the local tree means this answers for a PR
         whose head was never fetched into this checkout.
         """
-        base_ref = _reject_flaglike("base", base)
-        head_ref = _reject_flaglike("head", head)
+        base_ref = _reject_ref("base", base)
+        head_ref = _reject_ref("head", head)
         out = self._gh(
             "api",
             f"repos/{self._api_repo_path()}/compare/{base_ref}...{head_ref}",

qaas/cli.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import json
 import re
+import shutil
 import subprocess
 import sys
 from pathlib import Path
@@ -175,11 +176,21 @@ def _materialise_repo(repo: str, clone_to: Path | str | None) -> tuple[Path, str
 
     root.parent.mkdir(parents=True, exist_ok=True)
     console.print(f"cloning {repo} -> {root}")
-    result = subprocess.run(
-        ["git", "clone", "--depth", "50", repo, str(root)],
-        capture_output=True, text=True, timeout=600,
-    )
+    try:
+        result = subprocess.run(
+            ["git", "clone", "--depth", "50", repo, str(root)],
+            capture_output=True, text=True, timeout=600,
+        )
+    except subprocess.TimeoutExpired:
+        # git leaves the partial tree behind, and `root.exists()` above then
+        # reports "using existing clone" on the next run -- so a clone that timed
+        # out was silently reused as a complete checkout, and every finding after
+        # it described a repository that was never fully there.
+        shutil.rmtree(root, ignore_errors=True)
+        console.print(f"[red]clone timed out[/red] after 600s; removed the partial checkout at {root}")
+        raise typer.Exit(1) from None
     if result.returncode != 0:
+        shutil.rmtree(root, ignore_errors=True)
         console.print(f"[red]clone failed:[/red] {result.stderr.strip()[:400]}")
         raise typer.Exit(1)
     return root, repo
@@ -224,7 +235,7 @@ def _write_profile(profile, out: Path) -> None:
         "# Target profile. Everything here was guessed by inspection — review it.\n"
         "# Credentials never belong in this file: reference environment variables.\n\n"
         + _yaml.safe_dump(payload, sort_keys=False, width=88)
-    )
+    , encoding="utf-8")
 
 
 def _provision_target(
@@ -338,15 +349,15 @@ def init(
     system_yaml = project_config / "system.yaml"
     if not system_yaml.exists():
         shipped = Workspace.resolve().config_file("system.yaml")
-        base = shipped.read_text() if shipped else "project: qaas\n"
+        base = shipped.read_text(encoding="utf-8") if shipped else "project: qaas\n"
         system_yaml.write_text(
             _activate_target(base, target_name)
             if shipped
             else f"project: qaas\ntarget: {target_name}\n"
-        )
+        , encoding="utf-8")
         wrote_system = True
     else:
-        system_yaml.write_text(_activate_target(system_yaml.read_text(), target_name))
+        system_yaml.write_text(_activate_target(system_yaml.read_text(encoding="utf-8"), target_name))
         wrote_system = False
 
     # `.qaas/` now holds a user's committed config next to their disposable run
@@ -358,7 +369,7 @@ def init(
             "# Run state: regenerated every run, never worth committing.\n"
             "runs/\ntickets/\ngenerated/\nsystem-map/\nmemory.db\nartifacts/\n"
             "\n# config/ is NOT ignored -- it is yours, and it is the point.\n"
-        )
+        , encoding="utf-8")
 
     console.print(f"\n[green]wrote {out}[/green]")
     console.print(
@@ -465,7 +476,7 @@ def doctor(
 
 
 def _agent_usable(spec, caps: dict[str, bool]) -> bool:
-    """Delegates to `target.agent_usable`, which the conductor also uses.
+    """Delegates to `target.agent_usable`, which the router also uses.
 
     Two copies of this rule meant `qaas doctor` could report an agent unusable
     while a run dispatched it anyway.
@@ -512,7 +523,7 @@ def validate(config_dir: Path | None = ConfigDir) -> None:
     # A mode whose agents cannot fit inside its cap is a mode that stops
     # partway through, every time, and looks like it worked: agents run,
     # findings reach the ledger, nothing errors. `pr-check` shipped that way --
-    # $6 cap against a $15 roster, so discovery spent $6.09 and FORGE and CLERK
+    # $6 cap against a $15 roster, so discovery spent $6.09 and REPRODUCER and TRIAGE
     # never dispatched. The mode meant for every pull request could not file a
     # ticket. It took a live run to notice; this check makes it free.
     for mode_name, mode in sorted(cfg.run_modes.items()):
@@ -720,7 +731,7 @@ def prompts_list(config_dir: Path | None = ConfigDir) -> None:
         SHARED_PROMPT,
         _prompt_origin(shared, ws) if shared else "[red]missing[/red]",
         "-",
-        str(len(shared.read_text())) if shared else "-",
+        str(len(shared.read_text(encoding="utf-8"))) if shared else "-",
     )
     console.print(table)
 
@@ -767,7 +778,7 @@ def prompts_eject(
             skipped.append(dest)
             continue
         dest.parent.mkdir(parents=True, exist_ok=True)
-        dest.write_text(src.read_text())
+        dest.write_text(src.read_text(encoding="utf-8"))
         written.append(dest)
 
     for path in written:
@@ -815,8 +826,8 @@ def prompts_diff(
         if in_force is not None and packaged.is_file() and in_force != packaged.resolve():
             diff = list(
                 difflib.unified_diff(
-                    packaged.read_text().splitlines(),
-                    in_force.read_text().splitlines(),
+                    packaged.read_text(encoding="utf-8").splitlines(),
+                    in_force.read_text(encoding="utf-8").splitlines(),
                     fromfile=f"packaged/{filename}",
                     tofile=str(in_force),
                     lineterm="",
@@ -839,7 +850,7 @@ def prompts_diff(
             changed += 1
             console.print(f"\n[bold]{label}[/bold] [dim]+ {append_name(filename)}[/dim]")
             console.print(f"--- {path}", markup=False, highlight=False)
-            for line in path.read_text().splitlines():
+            for line in path.read_text(encoding="utf-8").splitlines():
                 console.print(f"+{line}", style="green", markup=False, highlight=False)
 
     if not changed:
@@ -857,7 +868,7 @@ def runs(root: Path = Root, limit: int = 10) -> None:
     for col in ("run", "envelopes", "agents"):
         table.add_column(col)
     for run_id in ids:
-        store = RunStore(run_id, root)
+        store = RunStore(run_id, root, create=False)
         results = store.results()
         table.add_row(
             run_id,
@@ -878,7 +889,7 @@ VERDICT_STYLE = {
 @app.command()
 def show(run_id: str, root: Path = Root) -> None:
     """Show one run's findings and ledger: cost, duration, tickets, escalations."""
-    store = RunStore(run_id, root)
+    store = RunStore(run_id, root, create=False)
     # One pass over the ledger, shared by the header and the denial list -- each
     # `store.ledger(kind)` call is a full-file scan of a file that reaches tens
     # of thousands of lines on a real run.
@@ -992,7 +1003,7 @@ def trace(
     quiet: bool = typer.Option(False, "--quiet", "-q", help="Drop tool_call lines and show only what an agent decided."),
 ) -> None:
     """Print one run's ledger as a timeline: dispatches, tools, denials, verdicts, cost."""
-    store = RunStore(run_id, root)
+    store = RunStore(run_id, root, create=False)
     if not store.ledger_path.exists() and not follow:
         console.print(f"[red]no ledger for run {run_id}[/red] — try `qaas runs`")
         raise typer.Exit(1)
@@ -1039,11 +1050,11 @@ def trace(
 
 @app.command()
 def map(root: Path = Root, version: str | None = None) -> None:
-    """Show the system map Cartographer produced."""
+    """Show the system map Mapper produced."""
     maps = SystemMapStore(root)
     payload = maps.get(version)
     if payload is None:
-        console.print("[dim]no system map yet — run CARTOGRAPHER[/dim]")
+        console.print("[dim]no system map yet — run MAPPER[/dim]")
         raise typer.Exit(1)
     console.print(f"[bold]version[/bold] {version or maps.latest_version()}")
     console.print_json(data=payload)
@@ -1066,7 +1077,7 @@ def run(
     """Execute a run. Costs real money unless --dry-run."""
     import asyncio
 
-    from qaas.conductor import Conductor
+    from qaas.router import Router
     from qaas.registry import describe
 
     if repo and target:
@@ -1177,8 +1188,8 @@ def run(
         elif kind == "stopped":
             console.print(f"[yellow]stopped: {detail.get('reason')}[/yellow]")
 
-    conductor = Conductor(cfg, root=root, on_event=on_event, tickets=list(ticket) if ticket else None)
-    report = asyncio.run(conductor.run(mode, run_id=run_id))
+    router = Router(cfg, root=root, on_event=on_event, tickets=list(ticket) if ticket else None)
+    report = asyncio.run(router.run(mode, run_id=run_id))
 
     console.print()
     console.print_json(data=report.summary())
@@ -1198,11 +1209,21 @@ def score(
     domains: list[str] = typer.Option(
         None, "--domain", help="Restrict scoring to these domains. Use it when a run covered only part of the surface."
     ),
+    target: str = typer.Option(
+        None, "--target", "-t", help="Score against this profile's ledger rather than the active one's."
+    ),
 ) -> None:
     """Score a run against the golden ledger. This is the honest number."""
     from qaas.scorecard import GoldenLedger, score as score_run
 
     cfg = load_config(config_dir)
+    # Every other command that reads a run takes `--target`; this one did not,
+    # so a `--repo` run was scored against whatever profile `system.yaml`
+    # happened to name -- in practice the bundled demo's ledger, which describes
+    # a different application entirely. Recall and precision against the wrong
+    # oracle are worse than no number, because they look like a number.
+    if target:
+        cfg = cfg.model_copy(update={"target": target, "profile": _load_target(target, config_dir)})
     ledger_path = _ledger_path(cfg)
     if ledger_path is None or not ledger_path.exists():
         console.print(
@@ -1222,7 +1243,7 @@ def score(
             raise typer.Exit(1)
         run_id = ids[0]
 
-    store = RunStore(run_id, root)
+    store = RunStore(run_id, root, create=False)
     card = score_run(
         store.envelopes(),
         GoldenLedger.load(ledger_path),
@@ -1274,12 +1295,12 @@ def sweep(
     """
     import asyncio
 
-    from qaas.conductor import Conductor
+    from qaas.router import Router
     from qaas.scorecard import GoldenLedger, score as score_run
 
     cfg = load_config(config_dir)
-    conductor = Conductor(cfg, root=root)
-    report = asyncio.run(conductor.run(mode))
+    router = Router(cfg, root=root)
+    report = asyncio.run(router.run(mode))
     console.print_json(data=report.summary())
 
     ledger_path = _ledger_path(cfg)
@@ -1323,12 +1344,12 @@ _JIRA_ENV_HELP: dict[str, str] = {
 _JIRA_SECRET_ENV = frozenset({"JIRA_API_TOKEN"})
 
 #: House statuses this system actually drives. An unmapped one here is a real
-#: failure: PROOF asks for 'closed', nothing in the workflow matches, and the
+#: failure: VERIFIER asks for 'closed', nothing in the workflow matches, and the
 #: ticket stays open while the run reports a clean close. The rest of `STATUSES`
 #: are human dispositions — worth reporting, not worth failing on.
 _DRIVEN_STATUSES = ("open", "in_progress", "resolved", "closed")
 
-#: What `--dry-run-ticket` renders. A realistic CLERK ticket rather than a
+#: What `--dry-run-ticket` renders. A realistic TRIAGE ticket rather than a
 #: placeholder, because the point is to see the ADF, the labels and the
 #: fingerprint an engineer will actually receive.
 _SAMPLE_TICKET: dict[str, object] = {
@@ -1357,7 +1378,7 @@ _SAMPLE_TICKET: dict[str, object] = {
     "severity": "critical",
     "envelope_id": "env-sample-0001",
     "fingerprint": "sha256:" + "ab12cd34" * 8,
-    "reporter": "CLERK",
+    "reporter": "TRIAGE",
 }
 
 

qaas/config.py

@@ -1,7 +1,7 @@
 """Configuration: agents are data, not code.
 
 An agent is a prompt file plus an entry in `config/agents/`. Adding one of the
-remaining agents from the roster should never require touching the conductor,
+remaining agents from the roster should never require touching the router,
 the runner, or the guardrails — that is the property this module exists to keep.
 """
 
@@ -87,7 +87,7 @@ class AgentSpec(BaseModel):
 
     # Tools this agent must have called before it is allowed to finish. The Stop
     # hook enforces it. Without this an agent can produce a confident summary and
-    # no artifact, and the failure only surfaces afterwards in the conductor —
+    # no artifact, and the failure only surfaces afterwards in the router —
     # too late for the agent to fix it.
     must_call: list[str] = Field(default_factory=list)
 
@@ -310,7 +310,7 @@ def load_config(
         looked = ", ".join(str(d) for d in dirs) or "(nowhere -- no search path)"
         raise FileNotFoundError(f"no system config at {dirs[0] / 'system.yaml'} (looked in: {looked})")
 
-    raw: dict[str, Any] = yaml.safe_load(system_path.read_text()) or {}
+    raw: dict[str, Any] = yaml.safe_load(system_path.read_text(encoding="utf-8")) or {}
 
     # `target_app:` used to name the application's directory relative to the
     # process cwd. The target profile's `root` says the same thing and says it
@@ -321,7 +321,7 @@ def load_config(
     raw.pop("target_app", None)
 
     # Backend overrides from the environment, so pointing a run at a real
-    # tracker or forge is not a committed file change.
+    # tracker or reproducer is not a committed file change.
     #
     # `tracker: local` is the committed default and must stay that way. When
     # `jira` was committed instead, 18 tests failed and 14 errored: the agent
@@ -348,7 +348,7 @@ def load_config(
 
     agents: dict[str, Any] = {}
     for path in by_stem.values():
-        spec = yaml.safe_load(path.read_text()) or {}
+        spec = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
         name = spec.get("name") or path.stem.upper()
         spec["name"] = name
         if name in agents:

qaas/defaults/config/agents/{conduit.yaml → api.yaml}

@@ -1,10 +1,10 @@
-name: CONDUIT
+name: API
 layer: discovery
 role: >
   Backend, API and contract analyst. Finds spec drift, breaking changes, missing
   authorization, error-taxonomy inconsistency, unbounded results, validation gaps.
   Ships a failing contract test as evidence, never a bare opinion.
-prompt: CONDUIT.md
+prompt: API.md
 model: claude-opus-5
 effort: high
 max_turns: 60