sembl-stack 0.1.0__tar.gz → 0.1.1__tar.gz

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/.github/workflows/release.yml

@@ -34,6 +34,11 @@ jobs:
             exit 1
           fi
 
+      - name: Run test suite (a release never ships untested)
+        run: |
+          python -m pip install -e ".[all]" pytest
+          python -m pytest -q
+
       - name: Build sdist and wheel
         run: |
           python -m pip install --upgrade build

sembl_stack-0.1.1/.github/workflows/tests.yml

@@ -0,0 +1,29 @@
+name: Tests
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test:
+    name: pytest (py${{ matrix.python }} / ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python: ["3.10", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install package with all extras
+        run: python -m pip install -e ".[all]" pytest
+
+      - name: Run test suite
+        # From the repo root: eval-corpus paths are cwd-relative.
+        run: python -m pytest -q

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/.gitignore

@@ -12,3 +12,5 @@ __pycache__/
 build/
 dist/
 .venv/
+eval/.checkpoint-*.json
+eval/.result-*

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sembl-stack
-Version: 0.1.0
+Version: 0.1.1
 Summary: A swappable, spec-driven software factory: task to bounds, an agent writes in a sandbox, the Sembl gate judges the diff, PASS merges, deploys, and a post-deploy gate confirms or rolls back. Every stage an adapter behind one typed contract.
 License-Expression: Apache-2.0
 License-File: LICENSE

sembl_stack-0.1.1/SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report suspected vulnerabilities privately via
+[GitHub Security Advisories](https://github.com/speedvibecode/sembl-stack/security/advisories/new)
+(preferred) or by email to totlasiddharth@gmail.com. Do not open a public issue for
+security reports.
+
+You can expect an acknowledgement within a few days. Please include a reproduction
+if you can.
+
+## Scope notes
+
+sembl-stack is a **local-first CLI**: it runs on the operator's machine, with the
+operator's own credentials, against repositories the operator already controls. There
+is no hosted service and no server-side data. The security surfaces we care most
+about:
+
+- **Credential handling** — profiles store only pointers (`env:VAR` / `keyring`),
+  never key material; executor output is secret-scrubbed; third-party process output
+  is persisted as fingerprints (byte count + SHA-256), never content.
+- **Untrusted diff/content handling** — reviewer prompts treat the diff as data, not
+  instructions; run artifacts are local and gitignored.
+- **Release integrity** — PyPI publishing uses Trusted Publishing (OIDC, no stored
+  tokens) with a version-lockstep guard.
+
+Reports in any of these areas are especially appreciated.

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/docs/PROCESS-ACTION-PLAN.md

@@ -279,7 +279,12 @@ decoupled (confirmed third-party backend bug). History below (spec `SPEC-coderab
    diff's own hunks (before this, 12/14 corpus cases silently degraded to UNKNOWN). Live smoke:
    planted case 14 → real FINDINGS (SQL injection flagged critical + N+1 major). Back-to-back
    corpus runs hit CodeRabbit's **rate limit** (correctly UNKNOWN) — `eval/two_axis.py` gained
-   `--patient` (waits out the window); full real CodeRabbit 2×2 = run when the window resets.
+   `--patient` (waits out the window); full real CodeRabbit 2×2 ✅ **DONE 2026-07-04** after six
+   failed monolithic attempts — root cause was the eval losing all progress on any mid-run death;
+   fixed with `--checkpoint` (per-case review outcomes persisted as they land, reruns resume).
+   Result, 14/14 real reviews, 0 UNKNOWN: **gate_only=4, quality_only=3** (planted case 14, runtime
+   -break case 13, AND 01-greenfield-snake), **both=2, neither=5** — complementarity thesis now
+   proven on BOTH real reviewers (llm + CodeRabbit), nearly identical grids.
    Status unchanged: optional second reviewer, never load-bearing.
 
 **Track 4 — RSI-L1 readout (cheap, high-narrative):** per-executor iters-to-green + cost over the

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/eval/two_axis.py

@@ -9,7 +9,12 @@ Reviewers: mock (default, deterministic, no account), a REAL one via
 `--reviewer llm [--model m]` — the BYO agent-CLI reviewer (review_llm.py) — or
 `--reviewer coderabbit` (real authenticated CodeRabbit CLI, review_coderabbit.py).
 Add `--patient` for real reviewers: waits out rate-limit windows instead of counting a
-throttled review as UNKNOWN."""
+throttled review as UNKNOWN.
+
+Add `--checkpoint <file>` for real reviewers: each case's review outcome is saved as it
+lands, and a rerun skips cases already reviewed (UNKNOWNs are always retried) — so a
+killed run resumes instead of starting over. The gate axis is deterministic and cheap;
+only review outcomes are cached."""
 import json
 import sys
 import time
@@ -61,16 +66,34 @@ def _patient_review(review, diff, tries: int = 14, wait: int = 300):
     return rep
 
 
+def _load_checkpoint(path: Path, reviewer: str) -> dict:
+    if path.is_file():
+        data = json.loads(path.read_text(encoding="utf-8"))
+        if data.get("reviewer") == reviewer:
+            return data.get("cases", {})
+    return {}
+
+
 def main() -> int:
     name, review = _reviewer()
     patient = "--patient" in sys.argv
+    ckpt_path = (Path(sys.argv[sys.argv.index("--checkpoint") + 1])
+                 if "--checkpoint" in sys.argv else None)
+    done = _load_checkpoint(ckpt_path, name) if ckpt_path else {}
     gate_only = quality_only = both = neither = unknown = 0
     rows = []
     quality_only_cases = []
     for c in _cases():
         gate_bad = _gate(c) == "BLOCK"
-        rep = _patient_review(review, c["diff"]) if patient else review.review(c["diff"])
-        status = rep.status
+        if c["name"] in done:                  # cached (never UNKNOWN — those aren't saved)
+            status = done[c["name"]]
+        else:
+            rep = _patient_review(review, c["diff"]) if patient else review.review(c["diff"])
+            status = rep.status
+            if ckpt_path and status != "UNKNOWN":
+                done[c["name"]] = status
+                ckpt_path.write_text(json.dumps({"reviewer": name, "cases": done}, indent=2),
+                                     encoding="utf-8")
         if status == "UNKNOWN":                # a real reviewer can fail; never count as clean
             unknown += 1
         quality_bad = status == "FINDINGS"

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sembl-stack"
-version = "0.1.0"
+version = "0.1.1"
 description = "A swappable, spec-driven software factory: task to bounds, an agent writes in a sandbox, the Sembl gate judges the diff, PASS merges, deploys, and a post-deploy gate confirms or rolls back. Every stage an adapter behind one typed contract."
 readme = "README.md"
 requires-python = ">=3.10"

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/sembl_stack/__init__.py

@@ -1,3 +1,3 @@
 """sembl-stack — an open, swappable spec-driven coding factory."""
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/sembl_stack/cli.py

@@ -157,7 +157,18 @@ def _loop_cmd(task_file: str, config_path: str):
     click.echo(f"layers: {cfg.raw['layers']}")
     click.echo(f"task: {task.text!r}\nrepo: {task.repo}\n")
 
-    result = run_loop(cfg, task)
+    try:
+        result = run_loop(cfg, task)
+    except RuntimeError as exc:
+        # Stage adapters raise RuntimeError with an "L<n>: ..." prefix. A stranger's
+        # first failure should be a diagnosis, not a stack trace.
+        click.secho(f"error: {exc}", fg="red")
+        click.echo("hint: `sembl-stack doctor` checks your environment. The loop needs\n"
+                   "  - the task's repo to be a git repository with at least one commit\n"
+                   "    (the sandbox clones it), and\n"
+                   "  - a bounds source: a task spec_path, or a bounds.json next to the\n"
+                   "    task file (`sembl-stack init` scaffolds a working starter).")
+        raise SystemExit(1)
 
     click.echo(f"engine: {result.engine}")
     for attempt, status in result.history:
@@ -510,10 +521,47 @@ def init(preset, config_path, with_task, force):
         else:
             tp.write_text(presets.starter_task(), encoding="utf-8")
             click.secho("wrote task.yaml", fg="green")
+        # The starter task has no spec_path, so the L2 spec adapter needs a
+        # bounds.json beside it — without one, `loop` cannot derive a contract.
+        bp = Path("bounds.json")
+        if bp.exists() and not force:
+            click.echo("  bounds.json exists — left as-is")
+        else:
+            bp.write_text(presets.starter_bounds(), encoding="utf-8")
+            click.secho("wrote bounds.json  (the starter task's contract)", fg="green")
+        for msg in _ensure_demo_repo():
+            click.secho(msg, fg="green")
     click.echo("\nnext:\n  sembl-stack doctor          # check your environment\n"
                "  sembl-stack loop task.yaml  # run the loop")
 
 
+def _ensure_demo_repo() -> list[str]:
+    """Make the cwd loop-runnable: the sandbox clones the repo, so a fresh demo
+    directory needs a git repo with at least one commit. Existing repos are left
+    entirely alone."""
+    if Path(".git").exists():
+        return []
+    msgs = []
+    app = Path("app")
+    if not app.exists():
+        app.mkdir()
+        (app / "__init__.py").write_text(
+            '"""Demo app module — the starter task adds a constant here."""\n',
+            encoding="utf-8")
+        msgs.append("wrote app/__init__.py  (demo module the starter task edits)")
+    subprocess.run(["git", "init", "-q"], check=True)
+    subprocess.run(["git", "add", "-A"], check=True)
+    committed = subprocess.run(
+        ["git", "commit", "-q", "-m", "sembl-stack demo scaffold"],
+        capture_output=True, text=True)
+    if committed.returncode != 0:       # machine has no git identity configured
+        subprocess.run(
+            ["git", "-c", "user.name=sembl-stack", "-c", "user.email=demo@sembl.local",
+             "commit", "-q", "-m", "sembl-stack demo scaffold"], check=True)
+    msgs.append("initialized a git repo + first commit  (the sandbox clones it)")
+    return msgs
+
+
 @main.command()
 @click.option("--config", "config_path", default="sembl.stack.yaml")
 def doctor(config_path):

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/sembl_stack/doctor.py

@@ -38,8 +38,10 @@ _EXECUTOR_BINARY = {
 }
 
 
-def run_checks(cfg=None) -> list[Check]:
-    """Structured preflight. `cfg` is an optional loaded StackConfig (config-aware checks)."""
+def run_checks(cfg=None, repo: str = ".") -> list[Check]:
+    """Structured preflight. `cfg` is an optional loaded StackConfig (config-aware checks);
+    `repo` is where a `loop` run would happen (git + bounds-source checks)."""
+    from pathlib import Path
     layers = (getattr(cfg, "raw", {}) or {}).get("layers", {}) if cfg else {}
     transport = (getattr(cfg, "raw", {}) or {}).get("transport", {}) if cfg else {}
     checks: list[Check] = []
@@ -93,6 +95,37 @@ def run_checks(cfg=None) -> list[Check]:
     elif execute == "mock":
         checks.append(Check("executor: mock", True, "no binary needed", required=False))
 
+    # --- loop-runnability: the sandbox clones the repo; L2 needs a bounds source ---
+    # Both were stranger-blockers found live 2026-07-04: `init` used to scaffold a
+    # task with no bounds source in a non-git directory, and `loop` crashed twice.
+    sandbox = layers.get("sandbox", "clone")
+    if sandbox in ("clone", "worktree"):
+        is_repo = (Path(repo) / ".git").exists()
+        checks.append(Check(
+            "repo (git)", is_repo,
+            "git repository" if is_repo else f"{Path(repo).resolve()} is not a git repo",
+            "" if is_repo else
+            "the sandbox clones the repo — `git init` + a first commit "
+            "(`sembl-stack init` scaffolds this for a fresh directory)"))
+    task_file = Path(repo) / "task.yaml"
+    if task_file.is_file():
+        has_spec = False
+        try:
+            import yaml
+            spec = (yaml.safe_load(task_file.read_text(encoding="utf-8")) or {}).get(
+                "spec_path")
+            has_spec = bool(spec)
+        except Exception:
+            pass
+        has_bounds = has_spec or (Path(repo) / "bounds.json").is_file()
+        checks.append(Check(
+            "bounds source", has_bounds,
+            "spec_path set" if has_spec else
+            ("bounds.json" if has_bounds else "no spec_path and no bounds.json"),
+            "" if has_bounds else
+            "L2 needs a contract: set spec_path in task.yaml, or add a bounds.json "
+            "next to it (`sembl-stack init` scaffolds one)"))
+
     # --- context graph (only when context: symgraph) ---
     if layers.get("context") == "symgraph":
         sg_ok = shutil.which("symgraph") is not None

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/sembl_stack/presets.py

@@ -93,8 +93,26 @@ _STARTER_TASK = """\
 text: "Add a VALUE constant to the app module, in scope, without touching infra."
 repo: "."
 # spec_path: "./specs/001-feature"   # optional: a Spec Kit feature dir / tasks.md
+# Without a spec_path, bounds come from bounds.json next to this file (scaffolded
+# by `sembl-stack init`).
 """
 
+# The bounds contract for the starter task: the mock executor edits inside
+# editable_paths[0] and (on its deliberate first-attempt misbehaviour) strays into
+# forbidden_areas[0] — these two entries are what make the BLOCK -> retry -> PASS
+# demo work.
+_STARTER_BOUNDS = """\
+{
+  "editable_paths": ["app/"],
+  "forbidden_areas": ["infra/"],
+  "churn_budget": {"max_files": 5, "max_lines": 200}
+}
+"""
+
+
+def starter_bounds() -> str:
+    return _STARTER_BOUNDS
+
 
 def names() -> list[str]:
     return list(PRESETS)

{sembl_stack-0.1.0 → sembl_stack-0.1.1}/tests/test_deploy_postdeploy.py

@@ -103,6 +103,10 @@ def test_vercel_deploy_adapter_records_failure(monkeypatch, tmp_path):
     def fake_run(cmd, **kwargs):
         return SimpleNamespace(returncode=1, stdout="", stderr="not linked")
 
+    # The adapter resolves the CLI via shutil.which first — without this the test
+    # only passes on machines that happen to have vercel installed (CI does not).
+    monkeypatch.setattr("sembl_stack.adapters.deploy_vercel.shutil.which",
+                        lambda name: "vercel")
     monkeypatch.setattr("sembl_stack.adapters.deploy_vercel.subprocess.run", fake_run)
 
     delivery = VercelDeployAdapter(timeout=5).deploy(str(tmp_path))

sembl_stack-0.1.1/tests/test_init_stranger.py

@@ -0,0 +1,101 @@
+"""The stranger quickstart: `init` in a fresh directory must yield a runnable loop.
+
+Regression suite for the two live stranger-blockers found 2026-07-04: `init` scaffolded a
+task with no bounds source, in a non-git directory — so `loop task.yaml` crashed at L2
+("could not derive bounds") and, once bounds existed, at L4 ("git clone failed"). Now
+`init` scaffolds bounds.json + a committed git repo, `doctor` diagnoses both gaps, and
+`loop` reports stage failures as clean errors instead of tracebacks.
+"""
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+
+from click.testing import CliRunner
+
+from sembl_stack import doctor
+from sembl_stack.cli import main
+from sembl_stack.config import load
+
+
+def _init_in(tmp: Path, runner: CliRunner):
+    return runner.invoke(main, ["init", "--preset", "gate+sandbox"], catch_exceptions=False)
+
+
+class TestInitScaffoldsRunnableDemo:
+    def test_fresh_dir_gets_bounds_and_git_repo(self, tmp_path, monkeypatch):
+        monkeypatch.chdir(tmp_path)
+        res = _init_in(tmp_path, CliRunner())
+        assert res.exit_code == 0
+        bounds = json.loads((tmp_path / "bounds.json").read_text(encoding="utf-8"))
+        assert bounds["editable_paths"] and bounds["forbidden_areas"]
+        assert (tmp_path / ".git").exists()
+        assert (tmp_path / "app" / "__init__.py").is_file()
+        head = subprocess.run(["git", "rev-parse", "HEAD"], cwd=tmp_path,
+                              capture_output=True, text=True)
+        assert head.returncode == 0, "init must leave a first commit for the clone sandbox"
+
+    def test_existing_git_repo_left_alone(self, tmp_path, monkeypatch):
+        monkeypatch.chdir(tmp_path)
+        subprocess.run(["git", "init", "-q"], cwd=tmp_path, check=True)
+        res = _init_in(tmp_path, CliRunner())
+        assert res.exit_code == 0
+        assert not (tmp_path / "app").exists(), "must not write demo files into a real repo"
+        # bounds.json is still scaffolded — the starter task needs a contract anywhere.
+        assert (tmp_path / "bounds.json").is_file()
+
+    def test_existing_bounds_not_overwritten(self, tmp_path, monkeypatch):
+        monkeypatch.chdir(tmp_path)
+        (tmp_path / "bounds.json").write_text('{"editable_paths": ["mine/"]}',
+                                              encoding="utf-8")
+        res = _init_in(tmp_path, CliRunner())
+        assert res.exit_code == 0
+        kept = json.loads((tmp_path / "bounds.json").read_text(encoding="utf-8"))
+        assert kept["editable_paths"] == ["mine/"]
+
+    def test_scaffold_loop_runs_end_to_end(self, tmp_path, monkeypatch):
+        """The actual stranger journey: init then loop, PASS after the mock's BLOCK."""
+        monkeypatch.chdir(tmp_path)
+        runner = CliRunner()
+        assert _init_in(tmp_path, runner).exit_code == 0
+        res = runner.invoke(main, ["loop", "task.yaml"])
+        assert "FINAL: PASS" in res.output, res.output
+        assert res.exit_code == 0
+
+
+class TestDoctorDiagnosesStrangerGaps:
+    def test_flags_non_git_dir_and_missing_bounds(self, tmp_path):
+        (tmp_path / "task.yaml").write_text('text: "t"\nrepo: "."\n', encoding="utf-8")
+        checks = {c.name: c for c in doctor.run_checks(None, repo=str(tmp_path))}
+        assert not checks["repo (git)"].ok
+        assert not checks["bounds source"].ok
+
+    def test_green_on_scaffolded_dir(self, tmp_path, monkeypatch):
+        monkeypatch.chdir(tmp_path)
+        assert _init_in(tmp_path, CliRunner()).exit_code == 0
+        cfg = load(tmp_path / "sembl.stack.yaml")
+        checks = {c.name: c for c in doctor.run_checks(cfg, repo=str(tmp_path))}
+        assert checks["repo (git)"].ok
+        assert checks["bounds source"].ok
+
+    def test_spec_path_counts_as_bounds_source(self, tmp_path):
+        subprocess.run(["git", "init", "-q"], cwd=tmp_path, check=True)
+        (tmp_path / "task.yaml").write_text(
+            'text: "t"\nrepo: "."\nspec_path: "./specs/001"\n', encoding="utf-8")
+        checks = {c.name: c for c in doctor.run_checks(None, repo=str(tmp_path))}
+        assert checks["bounds source"].ok
+
+
+class TestLoopFailsClean:
+    def test_stage_runtimeerror_is_a_diagnosis_not_a_traceback(self, tmp_path, monkeypatch):
+        """A missing bounds source must produce the hint, not a LangGraph traceback."""
+        monkeypatch.chdir(tmp_path)
+        runner = CliRunner()
+        assert _init_in(tmp_path, runner).exit_code == 0
+        (tmp_path / "bounds.json").unlink()          # recreate the original stranger state
+        res = runner.invoke(main, ["loop", "task.yaml"])
+        assert res.exit_code == 1
+        assert "error: L2" in res.output
+        assert "sembl-stack doctor" in res.output
+        assert "Traceback" not in res.output