rung-cli 0.1.2__tar.gz → 0.1.4__tar.gz

{rung_cli-0.1.2 → rung_cli-0.1.4}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "rung",
   "description": "Set up Rung in a repository: record tests and security scans as checks, gate pull requests in CI, and teach coding agents the verification rules.",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "author": { "name": "CalQuity" },
   "homepage": "https://github.com/CalQuity/rung",
   "repository": "https://github.com/CalQuity/rung",

{rung_cli-0.1.2 → rung_cli-0.1.4}/CHANGELOG.md

@@ -3,7 +3,54 @@
 All notable changes to Rung. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and versions follow the policy in [CONTRIBUTING.md](CONTRIBUTING.md#versioning).
 
-## 0.1.2 (unreleased)
+## 0.1.4 (2026-11-01)
+
+### Changed
+- The `osv-scanner` preset runs `osv-scanner scan source --no-resolve`. Without it, a manifest naming
+  a package the registry does not have (`stripe-checkout-retry-pro` in `requirements.txt`) failed
+  transitive resolution, and the whole vulnerable-dependencies check was an ERROR. Manifests and
+  lockfiles are now scanned as written; the `deps` check reports the missing package. A check that
+  sets its own `run` is unaffected.
+- `rung prove` with a pytest command judges each test the branch adds or changes, from a JUnit XML
+  report of both runs. A new test that passes (or skips) on the merge base fails the proof, by name,
+  even when another test in the same file fails there. `--json` and the proof's ledger entry gain
+  `cases` (each test with its outcome on the merge base and the branch). Other runners keep the
+  file-level rule.
+- `rung draft tla` and `rung draft lean` cover the SQL files they added to the prompt (see below), so
+  a changed definition stales the verdict. `--json` gains `context` and `warnings`.
+
+### Added
+- `rung draft tla` and `rung draft lean` find the database functions the sources call (`.rpc("name"`,
+  `self._rpc("name"`, and `select name(` / `call name(` in SQL strings), search the repository's
+  `*.sql` files for their `create [or replace] function` statements, and add every defining file to
+  the prompt, oldest commit first, telling the model the newest definition is the one that runs. The
+  command prints which files it added. A call whose definition cannot be found is a warning, on the
+  terminal and in the result, because the model then has to assume the call is atomic.
+- `rung draft runtime` shows the model the routes the app serves, with `file:line`: FastAPI,
+  Starlette and Flask decorators (with an `APIRouter(prefix=...)` or `Blueprint(url_prefix=...)` in
+  the same file), Express, Hono and Koa handlers, router mounts, and the Next.js app and pages
+  routers. The model is told to drive only listed routes and to say in its notes when the intent
+  names a feature that does not exist.
+
+### Fixed
+- A drafted spec, Lean adapter, drive script or property test that hard-codes a home or temporary
+  directory path (`/Users/<name>/`, `/home/<name>/`, `C:\Users\`, `/tmp`, `/var/folders/`) is sent
+  back to the model as a repair error, before Rung runs it. Before, a Lean adapter could fall back to
+  the drafting developer's own checkout and fail on everyone else's machine.
+
+## 0.1.3 (2026-11-01)
+
+### Fixed
+- `rung draft property`: a plain `assert` the model wrote that fails on the real code is now a
+  finding for a person, not a broken test. Before, a failure without Hypothesis's "Falsifying
+  example" marker was sent back to the model to rewrite, up to four times, which could hide the bug
+  the tests had found. A mutant that stops the module compiling is still not counted as caught.
+
+### Documentation
+- The README describes the runtime verification kit: the drive script, the `FEATURES.md` feature
+  map, the project verification skill for coding agents, and the recordings each run leaves.
+
+## 0.1.2 (2026-11-01)
 
 The first release on PyPI, as `rung-cli`.
 

{rung_cli-0.1.2 → rung_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: rung-cli
-Version: 0.1.2
+Version: 0.1.4
 Summary: An opinionated verification ladder for software written with coding agents: architecture rules, runtime evidence, properties, TLA+ and Lean, and an evidence ledger that expires when code changes.
 Project-URL: Homepage, https://github.com/CalQuity/rung
 Project-URL: Documentation, https://github.com/CalQuity/rung/tree/main/docs
@@ -122,6 +122,33 @@ A refund never exceeds the original charge, even under concurrent retries.
 `rung laws` shows whether each law currently **holds**: approved, enforced, and every enforcing
 verdict fresh. Agents may propose laws; only people approve them.
 
+## A verification kit for your running app
+
+`rung draft runtime --intent "apply a coupon at checkout and see the total update"` gives your
+project a verification kit, written by the model and registered as a check only once it has worked
+against the real app:
+
+- **`.rung/verify/drive.py`**, a script that starts the app on a free port, drives a feature the way
+  a user does (Playwright for web UIs, HTTP or CLI calls otherwise) and asserts on what a user would
+  see. It never calls internal functions or test-only endpoints. The model is shown the routes the
+  app really serves, found in its code (FastAPI, Starlette and Flask decorators, Express, Hono and
+  Koa handlers, Next.js app and pages routers), and drives only those; when the intent names a
+  feature the app does not have, it says so in its notes instead of guessing URLs.
+- **`.rung/verify/FEATURES.md`**, a feature map: for each user-facing feature, how a user reaches it,
+  how the script drives it, what observable state proves it works, and the gotchas (seed data,
+  logins, flaky spots).
+- **A project verification skill** (`.claude/skills/verify-<project>/`) that tells the project's
+  coding agents to drive the app after any user-facing change, extend the script and feature map
+  when they add a feature, and treat a failure as a product bug rather than weaken the script.
+- **Recordings.** Every run writes its evidence to a fresh directory: a video of the browser session
+  (`--require .webm` demands one), screenshots, request and response logs, a transcript and a
+  structured `result.json`. Their hashes go into the verdict, which stays valid only while the code
+  it covers is unchanged.
+
+Where a script cannot reach a feature (a login flow, a native app), an agent can drive it with its
+own browser or computer-use tool and record it with `rung attest <check> <files> --by <tool>`. Such
+evidence is recorded with who captured it and is never re-run, so it is weaker than a script.
+
 ## Property tests that are tested themselves
 
 `rung draft property pricing.py --intent "a total is never negative and equals the discounted sum"`
@@ -147,11 +174,19 @@ needs them, and the model drafts the first version.
 
 - **`rung draft tla queue.py`** writes a TLA+ model whose actions copy the code's real guards,
   then runs TLC. A counterexample stops the draft and goes to you. The model never gets to
-  edit the spec until the checker is quiet.
+  edit the spec until the checker is quiet. When the code calls database functions
+  (`supabase.rpc("claim_job")`, `select claim_job(...)` in SQL strings), Rung adds the `*.sql`
+  files that define them to the prompt, oldest definition first, and covers them with the check;
+  a call whose definition it cannot find is a warning, because the model then has to assume the
+  call is atomic.
 - **`rung draft lean pricing.py`** writes a small Lean model of the intended behaviour, proves
   its laws, and sets up a differential test that holds the real code to it on random inputs.
   Lean checks pass only when `#print axioms` shows no `sorry`, no `native_decide` and no
-  invented axioms.
+  invented axioms. It is shown the same SQL definitions.
+
+Every drafted file (spec, adapter, drive script, property test) is sent back to the model if it
+hard-codes a home or temporary directory path (`/Users/<name>/`, `/home/<name>/`, `C:\Users\`,
+`/tmp`), because it would run on one machine only.
 
 [`examples/lease-queue`](https://github.com/CalQuity/rung/tree/main/examples/lease-queue) shows both catching a real bug, plus a
 three-step case only the differential test finds.
@@ -171,7 +206,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: CalQuity/rung@v0.1.2
+      - uses: CalQuity/rung@v0.1.4
 ```
 
 The action runs the checks a pull request touches against its merge base. It keeps a single
@@ -186,7 +221,7 @@ To run the same check before every push, add Rung to `.pre-commit-config.yaml`:
 
 ```yaml
 - repo: https://github.com/CalQuity/rung
-  rev: v0.1.2
+  rev: v0.1.4
   hooks:
     - id: rung-check
 ```
@@ -213,7 +248,7 @@ any OpenAI-compatible endpoint, including local models. Rung never stores creden
 | `rung check [ids] [--changed] [--base REF]` | Run checks and record verdicts |
 | `rung status [--ci]` | Fresh, stale, failing; `--ci` exits 1 unless all fresh |
 | `rung report [--format md\|json]` | Checks, laws, new findings and fix proofs |
-| `rung prove 'pytest tests/test_x.py'` | Show a new test fails without the fix and passes with it |
+| `rung prove 'pytest tests/test_x.py'` | Show a new test fails without the fix and passes with it; under pytest, each new or changed test on its own |
 | `rung laws [--approve ID]` | Which laws hold |
 | `rung add <kind> <id> ...` | Declare a `command`, `evidence`, `scan` or `deps` check |
 | `rung attest <check> <files> --by <tool>` | Record evidence an agent or person captured (Claude in Chrome, Codex, computer use) |

{rung_cli-0.1.2 → rung_cli-0.1.4}/README.md

@@ -104,6 +104,33 @@ A refund never exceeds the original charge, even under concurrent retries.
 `rung laws` shows whether each law currently **holds**: approved, enforced, and every enforcing
 verdict fresh. Agents may propose laws; only people approve them.
 
+## A verification kit for your running app
+
+`rung draft runtime --intent "apply a coupon at checkout and see the total update"` gives your
+project a verification kit, written by the model and registered as a check only once it has worked
+against the real app:
+
+- **`.rung/verify/drive.py`**, a script that starts the app on a free port, drives a feature the way
+  a user does (Playwright for web UIs, HTTP or CLI calls otherwise) and asserts on what a user would
+  see. It never calls internal functions or test-only endpoints. The model is shown the routes the
+  app really serves, found in its code (FastAPI, Starlette and Flask decorators, Express, Hono and
+  Koa handlers, Next.js app and pages routers), and drives only those; when the intent names a
+  feature the app does not have, it says so in its notes instead of guessing URLs.
+- **`.rung/verify/FEATURES.md`**, a feature map: for each user-facing feature, how a user reaches it,
+  how the script drives it, what observable state proves it works, and the gotchas (seed data,
+  logins, flaky spots).
+- **A project verification skill** (`.claude/skills/verify-<project>/`) that tells the project's
+  coding agents to drive the app after any user-facing change, extend the script and feature map
+  when they add a feature, and treat a failure as a product bug rather than weaken the script.
+- **Recordings.** Every run writes its evidence to a fresh directory: a video of the browser session
+  (`--require .webm` demands one), screenshots, request and response logs, a transcript and a
+  structured `result.json`. Their hashes go into the verdict, which stays valid only while the code
+  it covers is unchanged.
+
+Where a script cannot reach a feature (a login flow, a native app), an agent can drive it with its
+own browser or computer-use tool and record it with `rung attest <check> <files> --by <tool>`. Such
+evidence is recorded with who captured it and is never re-run, so it is weaker than a script.
+
 ## Property tests that are tested themselves
 
 `rung draft property pricing.py --intent "a total is never negative and equals the discounted sum"`
@@ -129,11 +156,19 @@ needs them, and the model drafts the first version.
 
 - **`rung draft tla queue.py`** writes a TLA+ model whose actions copy the code's real guards,
   then runs TLC. A counterexample stops the draft and goes to you. The model never gets to
-  edit the spec until the checker is quiet.
+  edit the spec until the checker is quiet. When the code calls database functions
+  (`supabase.rpc("claim_job")`, `select claim_job(...)` in SQL strings), Rung adds the `*.sql`
+  files that define them to the prompt, oldest definition first, and covers them with the check;
+  a call whose definition it cannot find is a warning, because the model then has to assume the
+  call is atomic.
 - **`rung draft lean pricing.py`** writes a small Lean model of the intended behaviour, proves
   its laws, and sets up a differential test that holds the real code to it on random inputs.
   Lean checks pass only when `#print axioms` shows no `sorry`, no `native_decide` and no
-  invented axioms.
+  invented axioms. It is shown the same SQL definitions.
+
+Every drafted file (spec, adapter, drive script, property test) is sent back to the model if it
+hard-codes a home or temporary directory path (`/Users/<name>/`, `/home/<name>/`, `C:\Users\`,
+`/tmp`), because it would run on one machine only.
 
 [`examples/lease-queue`](https://github.com/CalQuity/rung/tree/main/examples/lease-queue) shows both catching a real bug, plus a
 three-step case only the differential test finds.
@@ -153,7 +188,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: CalQuity/rung@v0.1.2
+      - uses: CalQuity/rung@v0.1.4
 ```
 
 The action runs the checks a pull request touches against its merge base. It keeps a single
@@ -168,7 +203,7 @@ To run the same check before every push, add Rung to `.pre-commit-config.yaml`:
 
 ```yaml
 - repo: https://github.com/CalQuity/rung
-  rev: v0.1.2
+  rev: v0.1.4
   hooks:
     - id: rung-check
 ```
@@ -195,7 +230,7 @@ any OpenAI-compatible endpoint, including local models. Rung never stores creden
 | `rung check [ids] [--changed] [--base REF]` | Run checks and record verdicts |
 | `rung status [--ci]` | Fresh, stale, failing; `--ci` exits 1 unless all fresh |
 | `rung report [--format md\|json]` | Checks, laws, new findings and fix proofs |
-| `rung prove 'pytest tests/test_x.py'` | Show a new test fails without the fix and passes with it |
+| `rung prove 'pytest tests/test_x.py'` | Show a new test fails without the fix and passes with it; under pytest, each new or changed test on its own |
 | `rung laws [--approve ID]` | Which laws hold |
 | `rung add <kind> <id> ...` | Declare a `command`, `evidence`, `scan` or `deps` check |
 | `rung attest <check> <files> --by <tool>` | Record evidence an agent or person captured (Claude in Chrome, Codex, computer use) |

{rung_cli-0.1.2 → rung_cli-0.1.4}/docs/CONFIG.md

@@ -90,6 +90,12 @@ can reach the feature.
 | `default_level` | preset's | Level for results the tool reports without one |
 | `covers` | preset's | gitleaks/semgrep: everything; osv-scanner: manifests and lockfiles; zizmor: workflows |
 
+The `osv-scanner` preset runs `osv-scanner scan source --no-resolve`: manifests and lockfiles are
+scanned as written, without resolving transitive dependencies, because one package the registry does
+not have (an invented or private name in `requirements.txt`) makes resolution fail the whole scan.
+The `deps` check is what reports such a package. A project that wants transitive resolution can set
+`run` to the command without `--no-resolve`.
+
 On `--changed` or `--base`, the scanner also runs on the merge base, in a temporary worktree,
 and only new findings count. Otherwise findings are compared with `.rung/baselines/<id>.json`
 if present. Without either, every finding counts as new.

{rung_cli-0.1.2 → rung_cli-0.1.4}/docs/DESIGN.md

@@ -74,6 +74,12 @@ A regression test that passes before the fix proves nothing, and agents write su
 they must fail, then runs them on the branch where they must pass. `--expect` names text the
 failure must contain, so an import error does not count as the bug being caught.
 
+One failing test can hide a weak one in the same file, so when the command runs pytest, both runs
+also write a JUnit XML report and each test the branch adds or changes (found by comparing the test
+functions' code with the merge base) is judged on its own. Any of them that passes or skips on the
+merge base fails the proof, by name. `--json` lists each one as `cases`, with its outcome on both
+sides. Other runners are judged by the whole run.
+
 ### Runtime evidence that proves itself
 
 `rung draft runtime` has the model write a drive script and a feature map. Rung runs the script

{rung_cli-0.1.2 → rung_cli-0.1.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rung-cli"
-version = "0.1.2"
+version = "0.1.4"
 description = "An opinionated verification ladder for software written with coding agents: architecture rules, runtime evidence, properties, TLA+ and Lean, and an evidence ledger that expires when code changes."
 readme = "README.md"
 license = "Apache-2.0"

{rung_cli-0.1.2 → rung_cli-0.1.4}/skills/setup/SKILL.md

@@ -75,7 +75,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: CalQuity/rung@v0.1.2
+      - uses: CalQuity/rung@v0.1.4
 ```
 
 Install whatever the checks need (language runtimes, scanners) in steps before `CalQuity/rung`.

{rung_cli-0.1.2 → rung_cli-0.1.4}/src/rung/__init__.py

@@ -1,3 +1,3 @@
 """Rung: an opinionated verification ladder for software written with coding agents."""
 
-__version__ = "0.1.2"
+__version__ = "0.1.4"

{rung_cli-0.1.2 → rung_cli-0.1.4}/src/rung/checks/presets.py

@@ -43,7 +43,9 @@ PRESETS: dict[str, Preset] = {
         Preset(
             "osv-scanner",
             "dependencies with known vulnerabilities",
-            "osv-scanner scan source -r . -f sarif --output-file {out}",
+            # --no-resolve scans manifests as written. Transitive resolution fails the whole scan when a
+            # manifest names a package the registry does not have; the `deps` check reports that package.
+            "osv-scanner scan source --no-resolve -r . -f sarif --output-file {out}",
             "brew install osv-scanner  |  https://github.com/google/osv-scanner",
             max_age_days=1,
             covers=[

rung_cli-0.1.4/src/rung/checks/prove.py

@@ -0,0 +1,271 @@
+"""`rung prove`: show that a new test actually catches the bug it claims to.
+
+A regression test that passes before the fix proves nothing; agents write such
+tests all the time. The proof is mechanical: take the test files changed on this
+branch, put them on top of the merge base (the code *without* the fix), and run
+the test command there. It must fail. Then run it on the branch. It must pass.
+Both runs are recorded in the ledger.
+
+When the base fails for the wrong reason, typically an import error because the
+fix added a new function, `--expect` names text the base failure must contain,
+such as the assertion or the test name.
+
+A file can hold several new tests, and one failing on the base says nothing about the
+others. When the command runs pytest, both runs also write a JUnit XML report, and each
+test the branch adds or changes is judged on its own: it must fail on the merge base and
+pass on the branch. A new test that passes on the base proves nothing about the fix, so
+the proof fails and names it. Other runners are judged by the whole run, as before.
+"""
+
+from __future__ import annotations
+
+import ast
+import itertools
+import re
+import shlex
+import shutil
+import tempfile
+import xml.etree.ElementTree as ET
+from dataclasses import dataclass, field
+from pathlib import Path, PurePosixPath
+
+from rung.core import git, ledger
+from rung.core.errors import RungError
+from rung.core.proc import run as run_process
+from rung.core.redact import redact_lines
+
+TEST_PATTERNS = [
+    "**/test_*.py", "**/*_test.py", "**/tests/**", "**/__tests__/**", "**/*.test.*",
+    "**/*.spec.*", "**/*_test.go", "**/spec/**", "**/*Test.java", "**/*Tests.cs",
+]  # fmt: skip
+
+
+@dataclass
+class Run:
+    returncode: int
+    tail: list[str]
+
+
+@dataclass
+class Case:
+    """One test the branch adds or changes, and its outcome on each side."""
+
+    test: str  # `tests/test_money.py::test_refund` or `...::TestRefund::test_cap`
+    base: str  # passed | failed | skipped | missing (did not run)
+    head: str
+
+    @property
+    def proven(self) -> bool:
+        return self.base == "failed" and self.head == "passed"
+
+
+@dataclass
+class Proof:
+    verdict: str  # pass | fail | error
+    summary: str
+    tests: list[str] = field(default_factory=list)
+    base: Run | None = None
+    head: Run | None = None
+    cases: list[Case] = field(default_factory=list)  # per test, when the runner reports them (pytest)
+
+
+def is_test_file(path: str) -> bool:
+    return any(git.glob_match(p, path) for p in TEST_PATTERNS)
+
+
+def _run(argv: list[str], cwd: Path, timeout: int) -> Run:
+    result = run_process(argv, cwd=cwd, timeout=timeout)
+    return Run(result.returncode, (result.stdout + result.stderr).strip().splitlines()[-25:])
+
+
+def runs_pytest(argv: list[str]) -> bool:
+    """Whether a command runs pytest: `pytest ...`, `uv run pytest ...`, `python -m pytest ...`."""
+    if any(PurePosixPath(a.replace("\\", "/")).name in ("pytest", "py.test", "pytest.exe") for a in argv):
+        return True
+    return any(a == "-m" and b == "pytest" for a, b in itertools.pairwise(argv))
+
+
+def python_tests(source: str) -> dict[str, str]:
+    """Each pytest test in `source` (`test_x`, `TestY.test_z`) -> a dump of its code, decorators included."""
+    try:
+        tree = ast.parse(source)
+    except SyntaxError:
+        return {}
+    tests = {}
+    for node in tree.body:
+        if isinstance(node, ast.FunctionDef | ast.AsyncFunctionDef) and node.name.startswith("test"):
+            tests[node.name] = ast.dump(node)
+        elif isinstance(node, ast.ClassDef) and node.name.startswith("Test"):
+            for item in node.body:
+                if isinstance(item, ast.FunctionDef | ast.AsyncFunctionDef) and item.name.startswith("test"):
+                    tests[f"{node.name}.{item.name}"] = ast.dump(item)
+    return tests
+
+
+def new_or_changed_tests(root: Path, base: str, files: list[str]) -> dict[str, list[str]]:
+    """file -> the tests in it that the branch adds or whose code it changes (Python test files only)."""
+    found = {}
+    for rel in files:
+        if not rel.endswith(".py"):
+            continue
+        try:
+            before = python_tests(git.show(root, base, rel))
+        except git.GitError:
+            before = {}
+        after = python_tests((root / rel).read_text(errors="ignore"))
+        if changed := [name for name, code in after.items() if before.get(name) != code]:
+            found[rel] = changed
+    return found
+
+
+def junit_outcomes(path: Path) -> dict[tuple[str, str], str]:
+    """(classname, test name without parameters) -> passed | failed | skipped, from a JUnit XML report.
+
+    A parametrized test failed if any case failed; it passed if none failed and one passed.
+    """
+    try:
+        tree = ET.parse(path)
+    except (OSError, ET.ParseError):
+        return {}
+    outcomes: dict[tuple[str, str], str] = {}
+    rank = {"skipped": 0, "passed": 1, "failed": 2}
+    for case in tree.iter("testcase"):
+        key = (case.get("classname", ""), case.get("name", "").split("[", 1)[0])
+        tags = {child.tag for child in case}
+        outcome = "failed" if tags & {"failure", "error"} else "skipped" if "skipped" in tags else "passed"
+        if rank[outcome] >= rank.get(outcomes.get(key, "skipped"), 0):
+            outcomes[key] = outcome
+    return outcomes
+
+
+def _qualname(classname: str, name: str, module: list[str]) -> str | None:
+    """The test's name inside its module, if the JUnit classname belongs to the module at path `module`."""
+    for start in range(len(module)):
+        dotted = ".".join(module[start:])
+        if classname == dotted:
+            return name
+        if classname.startswith(dotted + "."):
+            return f"{classname[len(dotted) + 1 :]}.{name}"
+    return None
+
+
+def per_test(
+    wanted: dict[str, list[str]], base: dict[tuple[str, str], str], head: dict[tuple[str, str], str]
+) -> list[Case]:
+    """Match the new or changed tests to the outcomes of both runs."""
+
+    def outcome(results: dict[tuple[str, str], str], rel: str, test: str) -> str:
+        module = list(PurePosixPath(rel).with_suffix("").parts)
+        hits = [o for (cls, name), o in results.items() if _qualname(cls, name, module) == test]
+        return max(hits, key=["skipped", "passed", "failed"].index) if hits else "missing"
+
+    return [
+        Case(f"{rel}::{test.replace('.', '::')}", outcome(base, rel, test), outcome(head, rel, test))
+        for rel, tests in sorted(wanted.items())
+        for test in tests
+    ]
+
+
+def _names(cases: list[Case]) -> str:
+    return ", ".join(c.test for c in cases)
+
+
+# Output that means the tests never reached an assertion on the base: they could not even load.
+SETUP_FAILURE = re.compile(
+    r"ModuleNotFoundError|ImportError|SyntaxError|NameError: name .* is not defined|error collecting|"
+    r"ERROR collecting|errors? during collection|no tests ran|collected 0 items|Cannot find module|"
+    r"is not exported|has no exported member|TS2307|TS2305|undefined: |cannot find package",
+)
+
+
+def prove(
+    root: Path, command: str, base_ref: str, *, tests: list[str] | None = None,
+    expect: str | None = None, timeout: int = 1800, cwd: str = ".",
+) -> Proof:  # fmt: skip
+    mb = git.merge_base(root, base_ref)
+    changed = git.changed_files(root, base_ref)
+    chosen = sorted(tests) if tests else sorted(f for f in changed if is_test_file(f))
+    if not chosen:
+        return Proof("error", "no changed test files on this branch; name them with --tests")
+    missing = [t for t in chosen if not (root / t).is_file()]
+    if missing:
+        raise RungError(f"test file(s) not found: {', '.join(missing)}")
+    sources = sorted(f for f in changed if not is_test_file(f) and (root / f).is_file())
+    before = ledger.snapshot(root, sources + chosen)
+
+    argv = shlex.split(command)
+    wanted = new_or_changed_tests(root, mb, chosen) if runs_pytest(argv) else {}
+    with tempfile.TemporaryDirectory(prefix="rung-prove-") as tmp:
+        report = {side: Path(tmp) / f"{side}.xml" for side in ("base", "head")}
+        extra = {side: [f"--junitxml={path}"] if wanted else [] for side, path in report.items()}
+        with git.worktree(root, mb) as tree:
+            for rel in chosen:
+                dest = tree / rel
+                dest.parent.mkdir(parents=True, exist_ok=True)
+                shutil.copy2(root / rel, dest)
+            base_run = _run(argv + extra["base"], tree / cwd, timeout)
+        head_run = _run(argv + extra["head"], root / cwd, timeout)
+        cases = per_test(wanted, junit_outcomes(report["base"]), junit_outcomes(report["head"])) if wanted else []
+    if cases and all(c.head == "missing" for c in cases):
+        cases = []  # the report did not name them (an unusual rootdir or plugin): judge the whole run
+
+    proof = Proof("pass", "", chosen, base_run, head_run, cases)
+    base_text = "\n".join(base_run.tail)
+    weak = [c for c in cases if c.base in ("passed", "skipped")]
+    not_run = [c for c in cases if c.base == "missing"]
+    not_passing = [c for c in cases if c.head != "passed"]
+    if base_run.returncode == 0:
+        proof.verdict, proof.summary = "fail", "the tests pass without the fix, so they do not catch the bug"
+    elif weak:
+        proof.verdict = "fail"
+        proof.summary = (
+            f"{len(weak)} new or changed test(s) also pass (or skip) on the merge base, so they prove nothing "
+            f"about the fix: {_names(weak)}"
+        )
+    elif expect and expect not in base_text:
+        proof.verdict = "fail"
+        proof.summary = f"the base run failed, but not with {expect!r}; it may be failing for another reason"
+    elif not expect and SETUP_FAILURE.search(base_text):
+        proof.verdict = "fail"
+        proof.summary = (
+            "on the merge base the tests failed while loading (an import or collection error), not on an "
+            "assertion. If that failure is the bug, re-run with --expect '<text of the failing assertion>'"
+        )
+    elif not expect and not_run:
+        proof.verdict = "fail"
+        proof.summary = f"{len(not_run)} new or changed test(s) did not run on the merge base: {_names(not_run)}"
+    elif head_run.returncode != 0:
+        proof.verdict = "fail"
+        proof.summary = "the tests fail on this branch too" + (f": {_names(not_passing)}" if not_passing else "")
+    elif not_passing:
+        proof.verdict = "fail"
+        proof.summary = f"{len(not_passing)} new or changed test(s) did not pass on this branch: {_names(not_passing)}"
+    elif cases:
+        proof.summary = (
+            f"{len(cases)} new or changed test(s) fail on merge base {mb[:10]} and pass on this branch: "
+            + _names(cases)
+        )
+    else:
+        proof.summary = f"fails on merge base {mb[:10]}, passes on this branch"
+    if ledger.snapshot(root, sources + chosen) != before:
+        proof.verdict, proof.summary = "error", "files changed while the proof ran; re-run it"
+
+    slug = re.sub(r"[^a-z0-9]+", "-", command.lower()).strip("-")[:40] or "tests"
+    ledger.record(
+        root,
+        check_id=f"proof:{slug}",
+        kind="proof",
+        verdict=proof.verdict,
+        covers=before,
+        specs={},
+        summary=proof.summary,
+        context=mb,
+        details={
+            "command": command, "cwd": cwd, "base": mb, "tests": chosen, "expect": expect or "",
+            "files": sorted(before),
+            "base_returncode": base_run.returncode, "head_returncode": head_run.returncode,
+            "base_tail": redact_lines(base_run.tail), "head_tail": redact_lines(head_run.tail),
+            "cases": [c.__dict__ for c in cases],
+        },
+    )  # fmt: skip
+    return proof

{rung_cli-0.1.2 → rung_cli-0.1.4}/src/rung/cli/commands/draft.py

@@ -15,7 +15,7 @@ from rung.core import laws
 from rung.core.config import Check, Config, ConfigError
 from rung.drafting import lean as lean_draft
 from rung.drafting import property as property_draft
-from rung.drafting import providers, runtime
+from rung.drafting import providers, runtime, sql_context
 from rung.drafting import tla as tla_draft
 
 
@@ -160,12 +160,20 @@ def cmd_draft(args, out: Output) -> int:
     check_id = args.id or f"{_slug(rel)}-{args.kind}"
     target = root / (args.out or f"spec/{args.kind}/{_slug(rel)}")
     target.mkdir(parents=True, exist_ok=True)
+    sql = sql_context.gather(root, sources)
+    if sql.files:
+        out.line(f"Added the SQL that defines {', '.join(sql.defined)} to the drafting context:")
+        for f in sql.files:
+            out.detail(f"added {f}", indent=2)
+    for w in sql.warnings:
+        out.line(out.style(f"WARNING {w}", "yellow"))
     out.line(f"Drafting {args.kind} for {', '.join(rel)} with {drafted_by(cfg, provider)} ...")
 
     drafter = tla_draft.draft if args.kind == "tla" else lean_draft.draft
-    result = drafter(provider, root, sources, target, intent=args.intent or "")
+    result = drafter(provider, root, sources, target, intent=args.intent or "", sql=sql)
     out.emit({"ok": result.ok, "message": result.message, "rounds": result.rounds, "trace": result.trace,
-              "files": [str(f.relative_to(root)) for f in result.files]})  # fmt: skip
+              "files": [str(f.relative_to(root)) for f in result.files], "context": result.context,
+              "warnings": result.warnings})  # fmt: skip
     out.line(f"{'OK' if result.ok else 'FAILED'} after {result.rounds} round(s): {result.message}")
     out.detail(f"drafted by {drafted_by(cfg, provider)}", indent=2)
     if result.notes:
@@ -173,6 +181,11 @@ def cmd_draft(args, out: Output) -> int:
         out.detail(result.notes, indent=2)
     for f in result.files:
         out.detail(f"wrote {f.relative_to(root)}", indent=2)
+    for w in result.warnings:
+        if w not in sql.warnings:  # those were shown before drafting
+            out.detail(w, indent=2)
+    if sql.missing and result.ok:
+        out.detail(f"this result assumes each call to {', '.join(sql.missing)} is atomic", indent=2)
     if result.trace:
         out.line("\nCounterexample:")
         out.detail(result.trace, indent=2)
@@ -180,12 +193,13 @@ def cmd_draft(args, out: Output) -> int:
     if not result.ok:
         return GATE_FAILED
 
+    covered = rel + [f for f in result.context if f not in rel]  # a changed SQL definition stales the verdict too
     if args.kind == "tla":
         spec = next(f for f in result.files if f.suffix == ".tla")
         cfg_file = next(f for f in result.files if f.suffix == ".cfg")
         options = {"spec": spec.relative_to(root).as_posix(), "config": cfg_file.relative_to(root).as_posix(),
                    "drafted_by": drafted_by(cfg, provider)}  # fmt: skip
-        add_check(cfg, Check(check_id, "tla", rel, options), out)
+        add_check(cfg, Check(check_id, "tla", covered, options), out)
     else:
         project = target.relative_to(root).as_posix()
         add_check(
@@ -205,7 +219,7 @@ def cmd_draft(args, out: Output) -> int:
                 "impl": f"python3 {project}/drt_adapter.py", "alphabet": result.alphabet,
                 "cases": 2000, "max_len": 8, "specs": [f"{project}/**/*.lean", f"{project}/drt_adapter.py"],
             }  # fmt: skip
-            add_check(cfg, Check(f"{check_id}-drt", "drt", rel, options), out)
+            add_check(cfg, Check(f"{check_id}-drt", "drt", covered, options), out)
     enforcing = [check_id] if args.kind == "tla" else [check_id, f"{check_id}-drt"]
     added = laws.propose(root, result.laws, enforcing)
     if added: