rung-cli 0.1.2__py3-none-any.whl

rung/core/git.py

@@ -0,0 +1,236 @@
+"""Git plumbing: changed files, merge bases, temporary worktrees, and file globbing.
+
+All paths are POSIX paths relative to the project root (the directory holding `rung.toml`),
+which may be a subdirectory of the git repository. Git is always asked for NUL-delimited
+output, so names with non-ASCII characters, tabs or newlines are never mangled.
+
+Outside a git repository, file listing falls back to walking the tree, and diff-based
+features report that they need git.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import os
+import re
+import shutil
+import subprocess
+import tempfile
+from collections.abc import Iterator
+from functools import lru_cache
+from pathlib import Path
+
+from rung.core.errors import RungError
+
+GIT_TIMEOUT = 120
+
+# Directories that are build output or dependencies. Untracked files inside them never count as
+# project files; tracked files always do (a repository may track its own `build/` sources).
+SKIP_DIRS = frozenset({
+    ".git", "node_modules", ".venv", "venv", "__pycache__", ".lake", "dist", "build",
+    ".next", "target", ".mypy_cache", ".pytest_cache", ".ruff_cache", "vendor",
+})  # fmt: skip
+
+# Rung's own outputs. Writing a verdict or recording evidence must never stale another verdict.
+# Verification inputs under `.rung/` (drive scripts, baselines, waivers) are not listed here.
+RUNG_OUTPUTS = (".rung/verdicts/", ".rung/evidence/", ".rung/cache/", ".rung/runs/", ".rung/ledger.jsonl")
+# Files whose meaning reaches a verdict another way: each verdict hashes its check's declaration.
+RUNG_STATE_FILES = frozenset({"rung.toml", "LAWS.md"})
+
+
+class GitError(RungError):
+    """A git operation failed or the directory is not a repository."""
+
+
+def _git(root: Path, *args: str, check: bool = True, timeout: int = GIT_TIMEOUT) -> str:
+    try:
+        proc = subprocess.run(["git", *args], cwd=root, capture_output=True, text=True, check=False, timeout=timeout)
+    except FileNotFoundError as exc:
+        raise GitError("git is not installed") from exc
+    except subprocess.TimeoutExpired as exc:
+        raise GitError(f"git {' '.join(args)} timed out after {timeout}s") from exc
+    if check and proc.returncode != 0:
+        raise GitError(f"git {' '.join(args)}: {proc.stderr.strip() or proc.stdout.strip()}")
+    return proc.stdout
+
+
+def _paths(output: str) -> list[str]:
+    return [p for p in output.split("\0") if p]
+
+
+def is_repo(root: Path) -> bool:
+    try:
+        return _git(root, "rev-parse", "--is-inside-work-tree").strip() == "true"
+    except GitError:
+        return False
+
+
+def head(root: Path) -> str:
+    try:
+        return _git(root, "rev-parse", "HEAD").strip()
+    except GitError:
+        return ""
+
+
+def prefix(root: Path) -> str:
+    """Where `root` sits inside its repository, e.g. `backend/` (empty at the top)."""
+    return _git(root, "rev-parse", "--show-prefix").strip()
+
+
+def merge_base(root: Path, base: str) -> str:
+    """The commit where the current branch left `base`."""
+    return _git(root, "merge-base", base, "HEAD").strip()
+
+
+def changed_files(root: Path, base: str) -> set[str]:
+    """Files under `root` that differ from the merge base with `base`, including uncommitted and untracked ones."""
+    mb = merge_base(root, base)
+    changed = set(_paths(_git(root, "diff", "--name-only", "-z", "--relative", mb)))
+    changed |= set(_paths(_git(root, "ls-files", "-z", "--others", "--exclude-standard")))
+    return changed
+
+
+def show(root: Path, commit: str, path: str) -> str:
+    """The contents of `path` (relative to `root`) at `commit`; raises GitError if it did not exist there."""
+    return _git(root, "show", f"{commit}:./{path}")
+
+
+def show_many(root: Path, commit: str, paths: list[str]) -> dict[str, bytes]:
+    """The contents of many files at `commit` in one `git cat-file --batch` process (missing ones left out)."""
+    if not paths:
+        return {}
+    request = "".join(f"{commit}:./{p}\n" for p in paths).encode()
+    try:
+        proc = subprocess.run(["git", "cat-file", "--batch"], cwd=root, input=request, capture_output=True,
+                              check=False, timeout=600)  # fmt: skip
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise GitError(f"git cat-file failed: {exc}") from exc
+    if proc.returncode != 0:
+        raise GitError(f"git cat-file failed: {proc.stderr.decode(errors='replace').strip()}")
+    out, data, pos = {}, proc.stdout, 0
+    for path in paths:
+        end = data.index(b"\n", pos)
+        header = data[pos:end].split()
+        pos = end + 1
+        if len(header) == 3 and header[1] == b"blob":
+            size = int(header[2])
+            out[path] = data[pos : pos + size]
+            pos += size + 1
+        elif len(header) == 3:  # a tree or other object: skip its body
+            pos += int(header[2]) + 1
+    return out
+
+
+def files_at(root: Path, commit: str) -> list[str]:
+    """Files under `root` as they were at `commit`."""
+    return _paths(_git(root, "ls-tree", "-r", "-z", "--name-only", commit, "--", "."))
+
+
+def default_base(root: Path) -> str:
+    """The branch a pull request would merge into: origin's default, else main or master."""
+    try:
+        ref = _git(root, "symbolic-ref", "--quiet", "refs/remotes/origin/HEAD").strip()
+        return ref.removeprefix("refs/remotes/")
+    except GitError:
+        pass
+    for candidate in ("origin/main", "main", "origin/master", "master"):
+        if _git(root, "rev-parse", "--verify", "--quiet", candidate, check=False).strip():
+            return candidate
+    raise GitError("cannot find a base branch; pass --base")
+
+
+def list_files(root: Path) -> list[str]:
+    """Every project file git does not ignore: all tracked files, plus untracked ones outside build dirs."""
+    if is_repo(root):
+        tracked = _paths(_git(root, "ls-files", "-z", "--cached"))
+        untracked = [
+            p for p in _paths(_git(root, "ls-files", "-z", "--others", "--exclude-standard"))
+            if not SKIP_DIRS.intersection(p.split("/"))
+        ]  # fmt: skip
+        return sorted({p for p in tracked + untracked if (root / p).is_file()})
+    files = []
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS and d != ".git"]
+        rel = Path(dirpath).relative_to(root)
+        files += [(rel / f).as_posix() for f in filenames]
+    return sorted(files)
+
+
+@lru_cache(maxsize=512)
+def _glob_regex(pattern: str) -> re.Pattern[str]:
+    """Translate a glob into an anchored regex over POSIX paths.
+
+    Supports `*` (within one directory), `**` (across directories), `?` and `[...]` classes
+    (`[!...]` negates). Everything else matches literally.
+    """
+    out, i = [], 0
+    while i < len(pattern):
+        c = pattern[i]
+        if pattern.startswith("**/", i):
+            out.append("(?:.*/)?")
+            i += 3
+        elif pattern.startswith("**", i):
+            out.append(".*")
+            i += 2
+        elif c == "*":
+            out.append("[^/]*")
+            i += 1
+        elif c == "?":
+            out.append("[^/]")
+            i += 1
+        elif c == "[" and (end := pattern.find("]", i + 2)) != -1:
+            body = pattern[i + 1 : end]
+            negate = body.startswith("!")
+            body = re.escape(body[1:] if negate else body).replace("\\-", "-")
+            out.append(f"[^/{body}]" if negate else f"[{body}]")
+            i = end + 1
+        else:
+            out.append(re.escape(c))
+            i += 1
+    return re.compile("".join(out) + r"\Z")
+
+
+def glob_match(pattern: str, path: str) -> bool:
+    return bool(_glob_regex(pattern).match(path))
+
+
+def is_rung_output(path: str) -> bool:
+    return path in RUNG_STATE_FILES or any(path == o or path.startswith(o) for o in RUNG_OUTPUTS)
+
+
+def expand(root: Path, patterns: list[str]) -> list[str]:
+    """Resolve glob patterns against the project's files.
+
+    A pattern that matches nothing is kept literally, so a deleted file shows up
+    as missing instead of silently dropping out of a verdict's coverage.
+    """
+    if not patterns:
+        return []
+    files = [f for f in list_files(root) if not is_rung_output(f)]
+    out: set[str] = set()
+    for pattern in patterns:
+        matches = [f for f in files if glob_match(pattern, f)]
+        out.update(matches or [pattern])
+    return sorted(out)
+
+
+@contextlib.contextmanager
+def worktree(root: Path, ref: str) -> Iterator[Path]:
+    """Check out `ref` in a temporary worktree and yield the same project directory inside it."""
+    tmp = Path(tempfile.mkdtemp(prefix="rung-base-"))
+    target = tmp / "tree"
+    try:
+        sub = prefix(root)
+        _git(root, "worktree", "add", "--detach", str(target), ref, timeout=600)
+        yield target / sub if sub else target
+    finally:
+        if target.exists():
+            _git(root, "worktree", "remove", "--force", str(target), check=False)
+        shutil.rmtree(tmp, ignore_errors=True)
+
+
+def user_name(root: Path) -> str:
+    try:
+        return _git(root, "config", "user.name").strip()
+    except GitError:
+        return ""

rung/core/laws.py

@@ -0,0 +1,124 @@
+"""LAWS.md: the rules the software must never break, in plain language.
+
+Bend 2 introduced the idea of a LAWS file whose rules the compiler forces an AI
+to prove. Rung keeps that contract but works with any language and any checker:
+each law is a sentence a person can read and approve, mapped to the checks
+(TLA+ invariants, Lean theorems, differential tests, test suites) that enforce
+it. A law is only *held* when it is approved and every enforcing check has a
+fresh passing verdict.
+
+Format:
+
+    ## lease-result-from-holder
+    A job's result is always written by the worker that holds a valid lease.
+    - enforced by: lease-protocol, lease-model-proofs, impl-matches-model
+    - status: approved
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from rung.core.ledger import Status
+
+LAWS_FILE = "LAWS.md"
+_HEADING = re.compile(r"^##\s+(\S+)\s*$")
+_FIELD = re.compile(r"^-\s*(enforced by|status):\s*(.*)$", re.I)
+
+TEMPLATE = """# Laws
+
+Rules this software must never break. Each law names the Rung checks that
+enforce it; `rung laws` shows which laws currently hold. A law an agent proposes
+stays `proposed` until a person reads it and changes it to `approved`.
+"""
+
+
+@dataclass
+class Law:
+    id: str
+    text: str
+    enforced_by: list[str] = field(default_factory=list)
+    status: str = "proposed"
+
+
+def parse(source: str) -> list[Law]:
+    laws: list[Law] = []
+    current: Law | None = None
+    for line in source.splitlines():
+        if m := _HEADING.match(line):
+            current = Law(m.group(1), "")
+            laws.append(current)
+            continue
+        if current is None:
+            continue
+        if m := _FIELD.match(line.strip()):
+            key, value = m.group(1).lower(), m.group(2).strip()
+            if key == "enforced by":
+                current.enforced_by = [v.strip() for v in value.split(",") if v.strip()]
+            else:
+                current.status = value.lower() or "proposed"
+        elif line.strip() and not line.startswith("#"):
+            current.text = f"{current.text} {line.strip()}".strip()
+    return laws
+
+
+def load(root: Path) -> list[Law]:
+    path = root / LAWS_FILE
+    return parse(path.read_text()) if path.exists() else []
+
+
+def propose(root: Path, proposals: list[dict[str, str]], enforced_by: list[str]) -> list[str]:
+    """Append laws as `proposed`, skipping ids that already exist. Returns the ids added."""
+    path = root / LAWS_FILE
+    existing = {law.id for law in load(root)}
+    text = path.read_text() if path.exists() else TEMPLATE
+    added = []
+    for item in proposals:
+        law_id = re.sub(r"[^a-z0-9-]+", "-", item.get("id", "").lower()).strip("-")
+        sentence = " ".join(item.get("text", "").split())
+        if not law_id or not sentence or law_id in existing:
+            continue
+        text = (
+            text.rstrip()
+            + f"\n\n## {law_id}\n{sentence}\n- enforced by: {', '.join(enforced_by)}\n- status: proposed\n"
+        )
+        existing.add(law_id)
+        added.append(law_id)
+    if added:
+        path.write_text(text)
+    return added
+
+
+def set_status(root: Path, law_id: str, status: str) -> None:
+    path = root / LAWS_FILE
+    lines = path.read_text().splitlines()
+    inside = False
+    for i, line in enumerate(lines):
+        if m := _HEADING.match(line):
+            inside = m.group(1) == law_id
+            continue
+        if inside and _FIELD.match(line.strip()) and line.strip().lower().startswith("- status"):
+            lines[i] = f"- status: {status}"
+            path.write_text("\n".join(lines) + "\n")
+            return
+    raise KeyError(f"law {law_id!r} not found in {LAWS_FILE}")
+
+
+def state(law: Law, statuses: dict[str, Status]) -> tuple[str, str]:
+    """Return (state, explanation) for one law given the current check statuses."""
+    if law.status != "approved":
+        return "proposed", "awaiting a person's approval"
+    if not law.enforced_by:
+        return "unenforced", "no check enforces it"
+    unknown = [c for c in law.enforced_by if c not in statuses]
+    if unknown:
+        return "unenforced", f"unknown check(s): {', '.join(unknown)}"
+    failing = [c for c in law.enforced_by if statuses[c].state == "failing"]
+    if failing:
+        return "broken", f"failing: {', '.join(failing)}"
+    pending = [c for c in law.enforced_by if statuses[c].state != "fresh"]
+    if pending:
+        return "unproven", f"stale or never run: {', '.join(pending)}"
+    return "held", "every enforcing check is fresh and passing"

rung/core/ledger.py

@@ -0,0 +1,225 @@
+"""Verdicts: each check's latest result, bound to the exact inputs it checked.
+
+Each check has one small file, `.rung/verdicts/<check>.json`, holding its latest verdict: the
+outcome, a single digest over every covered and spec file (path and content), a hash of the check's
+own declaration, the comparison base, and when it stops being valid (a waiver that expires). A
+verdict is *fresh* only while all of that still matches and it is younger than the check's
+`max_age_days`.
+
+These files are meant to be committed, so teammates and CI see what was verified. One file per
+check means two branches conflict only when both ran the same check, and a conflicted, truncated or
+hand-edited file simply reads as "re-run this check". Each file carries a hash of its own contents,
+which detects corruption and careless edits. It is not a signature: anyone who can write the file
+can forge it, so CI should re-run the checks a change touches (`rung check --changed`) rather than
+trust committed verdicts for them.
+
+Per-file digests (to explain *which* file changed) and the full history of runs are kept in the
+git-ignored `.rung/cache/`, so the committed files stay a few hundred bytes each.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from dataclasses import dataclass
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+from typing import Any
+
+from rung.core import git
+from rung.core.config import write_atomic
+
+VERDICTS_DIR = Path(".rung") / "verdicts"
+CACHE_DIR = Path(".rung") / "cache"
+HISTORY_PATH = CACHE_DIR / "history.jsonl"
+CORRUPT = "(the verdict file is corrupt or was edited; re-run the check)"
+
+
+def file_digest(path: Path) -> str:
+    """sha256 of a file's bytes, or "missing" when it does not exist."""
+    try:
+        return hashlib.sha256(path.read_bytes()).hexdigest()
+    except (FileNotFoundError, IsADirectoryError, NotADirectoryError):
+        return "missing"
+
+
+def snapshot(root: Path, patterns: list[str]) -> dict[str, str]:
+    return {rel: file_digest(root / rel) for rel in git.expand(root, patterns)}
+
+
+def inputs_digest(files: dict[str, str]) -> str:
+    """One digest over every (path, content digest) pair, in sorted order."""
+    h = hashlib.sha256()
+    for path in sorted(files):
+        h.update(f"{path}\0{files[path]}\n".encode())
+    return h.hexdigest()
+
+
+def definition_hash(kind: str, covers: list[str], options: dict[str, Any]) -> str:
+    """A hash of how a check is declared; editing its options must stale its verdict."""
+    body = json.dumps({"kind": kind, "covers": covers, "options": options}, sort_keys=True, default=str)
+    return hashlib.sha256(body.encode()).hexdigest()[:16]
+
+
+def _self_hash(entry: dict[str, Any]) -> str:
+    body = {k: v for k, v in entry.items() if k != "hash"}
+    return hashlib.sha256(json.dumps(body, sort_keys=True).encode()).hexdigest()
+
+
+def _file_name(check_id: str) -> str:
+    # Proof ids look like `proof:<slug>`; ids are otherwise already filename-safe.
+    return check_id.replace(":", "--") + ".json"
+
+
+def verdict_path(root: Path, check_id: str) -> Path:
+    return root / VERDICTS_DIR / _file_name(check_id)
+
+
+def record(
+    root: Path,
+    *,
+    check_id: str,
+    kind: str,
+    verdict: str,
+    covers: dict[str, str],
+    specs: dict[str, str],
+    summary: str,
+    evidence: list[str] | None = None,
+    details: dict[str, Any] | None = None,
+    definition: str = "",
+    context: str = "",
+    valid_until: str = "",
+) -> dict[str, Any]:
+    """Write a check's latest verdict, cache its per-file inputs, and append it to the local history."""
+    if verdict not in ("pass", "fail", "error"):
+        raise ValueError(f"verdict must be pass, fail or error, not {verdict!r}")
+    files = covers | specs
+    entry: dict[str, Any] = {
+        "check": check_id,
+        "kind": kind,
+        "verdict": verdict,
+        "summary": summary,
+        "at": datetime.now(UTC).isoformat(timespec="seconds"),
+        "commit": git.head(root),
+        "inputs": {"digest": inputs_digest(files), "files": len(files)},
+        "definition": definition,
+        "context": context,
+        "valid_until": valid_until,
+        "evidence": evidence or [],
+        "details": details or {},
+    }
+    entry["hash"] = _self_hash(entry)
+    write_atomic(verdict_path(root, check_id), json.dumps(entry, indent=1, sort_keys=True) + "\n")
+    write_atomic(root / CACHE_DIR / "inputs" / _file_name(check_id), json.dumps(files, sort_keys=True))
+    history = root / HISTORY_PATH
+    history.parent.mkdir(parents=True, exist_ok=True)
+    with history.open("a") as fh:
+        fh.write(json.dumps(entry, sort_keys=True) + "\n")
+    return entry
+
+
+def _load(path: Path) -> dict[str, Any]:
+    """A verdict file, or `{"invalid": reason}` if it cannot be trusted."""
+    try:
+        entry = json.loads(path.read_text())
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+        return {"invalid": "not valid JSON (a merge conflict or a truncated write?)"}
+    if not isinstance(entry, dict) or not isinstance(entry.get("check"), str):
+        return {"invalid": "not a verdict"}
+    if _self_hash(entry) != entry.get("hash"):
+        return {"invalid": "contents do not match the file's own hash (edited by hand?)", "check": entry["check"]}
+    return entry
+
+
+def read_all(root: Path) -> dict[str, dict[str, Any]]:
+    """Every verdict file, keyed by check id (or by file name when the file is unreadable)."""
+    out: dict[str, dict[str, Any]] = {}
+    directory = root / VERDICTS_DIR
+    if not directory.is_dir():
+        return out
+    for path in sorted(directory.glob("*.json")):
+        entry = _load(path)
+        out[entry.get("check") or path.stem] = entry | {"_file": path.relative_to(root).as_posix()}
+    return out
+
+
+def problems(root: Path) -> list[str]:
+    return [f"{e['_file']}: {e['invalid']}" for e in read_all(root).values() if "invalid" in e]
+
+
+def history(root: Path) -> list[dict[str, Any]]:
+    path = root / HISTORY_PATH
+    if not path.exists():
+        return []
+    out = []
+    for line in path.read_text().splitlines():
+        try:
+            out.append(json.loads(line))
+        except json.JSONDecodeError:
+            continue
+    return out
+
+
+@dataclass
+class Status:
+    check_id: str
+    state: str  # fresh | stale | failing | never
+    entry: dict[str, Any] | None
+    changed: list[str]
+
+    @property
+    def trusted(self) -> bool:
+        return self.state == "fresh"
+
+
+class View:
+    """All verdicts read once, for every status decision in one command."""
+
+    def __init__(self, root: Path) -> None:
+        self.root = root
+        self.verdicts = read_all(root)
+
+    def _changed_files(self, check_id: str, now: dict[str, str]) -> list[str]:
+        cached = self.root / CACHE_DIR / "inputs" / _file_name(check_id)
+        try:
+            then = json.loads(cached.read_text())
+        except (OSError, json.JSONDecodeError):
+            return ["(covered files changed)"]
+        return sorted(p for p in set(now) | set(then) if now.get(p) != then.get(p)) or ["(covered files changed)"]
+
+    def status(
+        self,
+        check_id: str,
+        covers: list[str],
+        specs: list[str],
+        definition: str = "",
+        context: str | None = None,
+        max_age_days: int | None = None,
+    ) -> Status:
+        """Compare a check's verdict with its inputs, declaration, context and age as they are now."""
+        entry = self.verdicts.get(check_id)
+        if entry is None:
+            return Status(check_id, "never", None, [])
+        if "invalid" in entry:
+            return Status(check_id, "stale", entry, [CORRUPT])
+        if entry.get("verdict") != "pass":
+            return Status(check_id, "failing", entry, [])
+        changed: list[str] = []
+        now = snapshot(self.root, covers) | snapshot(self.root, specs)
+        if inputs_digest(now) != entry.get("inputs", {}).get("digest"):
+            changed += self._changed_files(check_id, now)
+        if definition and entry.get("definition", definition) != definition:
+            changed.append("(the check's definition in rung.toml)")
+        if context is not None and entry.get("context", "") != context:
+            changed.append(f"(verified against {entry.get('context') or 'no base'}, not {context or 'no base'})")
+        today = datetime.now(UTC)
+        if (until := entry.get("valid_until")) and today.date().isoformat() > until:
+            changed.append(f"(a waiver it relied on expired on {until})")
+        if max_age_days is not None:
+            try:
+                at = datetime.fromisoformat(entry["at"])
+            except (KeyError, ValueError):
+                at = today - timedelta(days=max_age_days + 1)
+            if today - at > timedelta(days=max_age_days):
+                changed.append(f"(older than {max_age_days} day(s); its data source changes over time)")
+        return Status(check_id, "stale" if changed else "fresh", entry, changed)

rung/core/proc.py

@@ -0,0 +1,58 @@
+"""Run external commands with a deadline that owns the whole process tree.
+
+`subprocess.run(timeout=...)` kills only the direct child; a test runner or dev server it started
+keeps running. Here every command starts in its own process group (session), and on timeout the
+whole group is killed. Output is captured in memory and truncated to a bounded tail.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import os
+import signal
+import subprocess
+from collections.abc import Mapping, Sequence
+from pathlib import Path
+
+MAX_OUTPUT = 2_000_000  # characters kept per stream
+
+
+def run(
+    argv: Sequence[str],
+    *,
+    cwd: Path,
+    timeout: float,
+    env: Mapping[str, str] | None = None,
+    stdin: str | None = None,
+) -> subprocess.CompletedProcess[str]:
+    """Run `argv` (no shell). Raises `subprocess.TimeoutExpired` after killing the whole process group."""
+    posix = os.name == "posix"
+    proc = subprocess.Popen(
+        list(argv),
+        cwd=cwd,
+        env=dict(env) if env is not None else None,
+        stdin=subprocess.PIPE if stdin is not None else subprocess.DEVNULL,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        start_new_session=posix,
+    )
+    try:
+        out, err = proc.communicate(input=stdin, timeout=timeout)
+    except subprocess.TimeoutExpired:
+        _kill_tree(proc, posix)
+        proc.communicate()
+        raise
+    finally:
+        # Anything the command left behind in its group (a server it backgrounded) goes too.
+        if proc.returncode is not None:
+            _kill_tree(proc, posix)
+    return subprocess.CompletedProcess(list(argv), proc.wait(), out[-MAX_OUTPUT:], err[-MAX_OUTPUT:])
+
+
+def _kill_tree(proc: subprocess.Popen[str], posix: bool) -> None:
+    if posix:
+        with contextlib.suppress(ProcessLookupError, PermissionError):
+            os.killpg(proc.pid, signal.SIGKILL)
+    elif proc.poll() is None:  # pragma: no cover - Windows
+        proc.kill()

rung/core/redact.py

@@ -0,0 +1,36 @@
+"""Mask secret-looking values before command output is stored in the committed ledger.
+
+Rung keeps the last lines of each check's output so a failure can be understood later. That
+output can contain a token a test printed or a URL with credentials in it. This is a best-effort
+filter for well-known shapes, not a guarantee: commands should not print secrets.
+"""
+
+from __future__ import annotations
+
+import re
+
+MASK = "[REDACTED]"
+
+# Each pattern has two groups: a prefix to keep, and the secret to mask.
+_PATTERNS = [
+    re.compile(r"(\b)(gh[pousr]_[A-Za-z0-9]{20,})"),  # GitHub tokens
+    re.compile(r"(\b)(github_pat_[A-Za-z0-9_]{20,})"),
+    re.compile(r"(\b)(xox[abprs]-[A-Za-z0-9-]{10,})"),  # Slack
+    re.compile(r"(\b)((?:AKIA|ASIA)[A-Z0-9]{16})\b"),  # AWS access key ids
+    re.compile(r"(\b)(sk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,})"),  # OpenAI / Anthropic style keys
+    re.compile(r"(\b)(AIza[0-9A-Za-z_-]{30,})"),  # Google API keys
+    re.compile(r"(\b)(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})"),  # JWTs
+    re.compile(r"(?i)(bearer\s+)([A-Za-z0-9._~+/=-]{16,})"),
+    re.compile(r"(://)([^/\s:@]+:[^/\s@]+)(?=@)"),  # user:password@ in URLs
+    re.compile(r"(?i)((?:password|passwd|secret|token|api[_-]?key)\s*[=:]\s*)([^\s,;]{6,})"),
+]
+
+
+def redact(text: str) -> str:
+    for pattern in _PATTERNS:
+        text = pattern.sub(lambda m: m.group(1) + MASK, text)
+    return text
+
+
+def redact_lines(lines: list[str]) -> list[str]:
+    return [redact(line) for line in lines]

rung/drafting/__init__.py

@@ -0,0 +1 @@
+"""Model-drafted artifacts (TLA+ specs, Lean models, runtime drive scripts) that a checker accepts or rejects."""