simplicio-cli 0.18.11__tar.gz → 0.18.13__tar.gz

{simplicio_cli-0.18.11 → simplicio_cli-0.18.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simplicio-cli
-Version: 0.18.11
+Version: 0.18.13
 Summary: Deterministic task-to-code contract and verification CLI. It never executes or provisions an LLM.
 Author-email: Wesley Simplicio <wesleybob4@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: numpy>=2.1.0
-Requires-Dist: simplicio-mapper<0.27,>=0.26.20
+Requires-Dist: simplicio-mapper<0.27,>=0.26.31
 Requires-Dist: simplicio-prompt>=1.14.1
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: orjson>=3.11.9
@@ -40,7 +40,7 @@ Requires-Dist: sentence-transformers>=5.6.0; extra == "ml"
 Provides-Extra: bench
 Requires-Dist: fpdf2>=2.8.7; extra == "bench"
 Provides-Extra: fast
-Requires-Dist: simplicio-fast<3,>=2.0.28; python_version >= "3.11" and extra == "fast"
+Requires-Dist: simplicio-fast<3,>=2.0.33; python_version >= "3.11" and extra == "fast"
 Provides-Extra: performance
 Requires-Dist: uvloop>=0.21.0; sys_platform != "win32" and extra == "performance"
 Provides-Extra: all

{simplicio_cli-0.18.11 → simplicio_cli-0.18.13}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simplicio-cli"
-version = "0.18.11"
+version = "0.18.13"
 description = "Deterministic task-to-code contract and verification CLI. It never executes or provisions an LLM."
 readme = "README.md"
 license = { text = "MIT" }
@@ -45,7 +45,7 @@ classifiers = [
 # (generated, `--check`-able) for the full graph and #99 for the audit.
 dependencies = [
   "numpy>=2.1.0",
-  "simplicio-mapper>=0.26.20,<0.27",
+  "simplicio-mapper>=0.26.31,<0.27",
   "simplicio-prompt>=1.14.1",
   "httpx>=0.28.1",
   "orjson>=3.11.9",
@@ -62,7 +62,7 @@ ml = ["sentence-transformers>=5.6.0"]
 bench = ["fpdf2>=2.8.7"]
 # Optional canonical Fast adapter. It remains outside the base install until
 # its release train is formally promoted.
-fast = ["simplicio-fast>=2.0.28,<3; python_version >= '3.11'"]
+fast = ["simplicio-fast>=2.0.33,<3; python_version >= '3.11'"]
 # Opt-in faster asyncio event loop for the structured-concurrency runtime
 # (simplicio.runtime_async, issue #212). Never required: `install_uvloop()`
 # no-ops on Windows or when this extra is absent, falling back to stdlib

{simplicio_cli-0.18.11 → simplicio_cli-0.18.13}/simplicio/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "0.18.10"
+__version__ = "0.18.13"
 
 
 def mapper_module():
@@ -16,4 +16,3 @@ def mapper_version():
 
 
 __all__ = ["__version__", "mapper_module", "mapper_version"]
-

{simplicio_cli-0.18.11 → simplicio_cli-0.18.13}/simplicio/cli.py

@@ -413,6 +413,27 @@ def _build_parser() -> argparse.ArgumentParser:
         help="bypass the 24h PyPI cache when resolving mapper latest_known",
     )
 
+    p_release_train = sub.add_parser(
+        "release-train",
+        help="verify Mapper release events, immutable artifacts, and N/N-1 conformance",
+    )
+    release_train_sub = p_release_train.add_subparsers(dest="release_train_command", required=True)
+    release_verify = release_train_sub.add_parser(
+        "verify", help="fail-closed verification of one component-release-event/v1"
+    )
+    release_verify.add_argument("--event", required=True, help="Mapper release event JSON")
+    release_verify.add_argument("--conformance", help="installed N/N-1 conformance JSON")
+    release_verify.add_argument("--root", default=".", help="Dev CLI checkout containing pyproject.toml/uv.lock")
+    release_verify.add_argument("--declared-range")
+    release_verify.add_argument("--tested-against")
+    release_verify.add_argument("--state", default="", help="deduplication state JSON")
+    release_verify.add_argument("--record", action="store_true", help="record accepted event atomically")
+    release_verify.add_argument("--active-task", action="store_true", help="defer while a task is active")
+    release_verify.add_argument("--json", action="store_true", help="emit stable JSON")
+    release_doctor = release_train_sub.add_parser("doctor", help="report release-train evidence readiness")
+    release_doctor.add_argument("--root", default=".")
+    release_doctor.add_argument("--json", action="store_true", help="emit stable JSON")
+
     p_env_export = sub.add_parser(
         "env-export",
         help="print shell-safe exports from a dotenv file without sourcing it",
@@ -462,7 +483,7 @@ def _build_parser() -> argparse.ArgumentParser:
 
     p_edit = sub.add_parser(
         "edit",
-        help="apply a mechanical edit plan via simplicio-runtime when available",
+        help="apply a Dev CLI edit plan; legacy plans may delegate to Runtime",
     )
     p_edit.add_argument("--root", "--repo", dest="root", default=".")
     p_edit.add_argument("--plan", default="-", help="plan JSON path, or - for stdin")
@@ -788,6 +809,7 @@ _COMMAND_MODULES = {
     "doctor": "doctor",
     "fast": "fast",
     "versions": "versions",
+    "release-train": "release_train",
     "env-export": "env_export",
     "changeset": "changeset",
     "file": "file",

{simplicio_cli-0.18.11 → simplicio_cli-0.18.13}/simplicio/commands/edit.py

@@ -1,9 +1,10 @@
 """``simplicio-py mechanical-edit`` / ``simplicio-py edit``.
 
 Extracted from `cli.py`'s `_run_mechanical_edit_command`/`_run_edit_command`
-(issue #103); behavior unchanged. ``edit`` delegates to the native
-``simplicio`` Rust binary when available, falling back to
-``run_mechanical_edit`` (the pure-Python implementation) otherwise.
+(issue #103). Legacy plans retain their established Runtime delegation
+behavior. Versioned ``simplicio.dev-cli.edit-plan/v1`` plans always use the
+Dev CLI-owned deterministic kernel so the native Runtime adapter cannot
+silently select a second Mapper edit vocabulary.
 """
 
 from __future__ import annotations
@@ -32,6 +33,21 @@ CLI_PROG = "simplicio-py"
 RUNTIME_EDIT_TIMEOUT_S = 30.0
 
 
+def _decode_native_json(stdout: Any) -> Any:
+    """Decode Runtime's final JSON receipt after any human-readable output."""
+    if not isinstance(stdout, str):
+        return None
+    for line in reversed(stdout.splitlines()):
+        candidate = line.strip()
+        if not candidate.startswith("{"):
+            continue
+        try:
+            return json.loads(candidate)
+        except json.JSONDecodeError:
+            continue
+    return None
+
+
 def run_mechanical_edit(a: argparse.Namespace) -> int:
     from ..mechanical_edit import execute_plan_json
 
@@ -40,11 +56,21 @@ def run_mechanical_edit(a: argparse.Namespace) -> int:
     except OSError as exc:
         print(f"{CLI_PROG} mechanical-edit: {exc}", file=sys.stderr)
         return 2
+    try:
+        decoded_plan = json.loads(plan_text)
+        plan_schema = decoded_plan.get("schema") if isinstance(decoded_plan, dict) else None
+    except (TypeError, json.JSONDecodeError):
+        plan_schema = None
+    result_schema = (
+        "simplicio.dev-cli.edit-receipt/v1"
+        if plan_schema == "simplicio.dev-cli.edit-plan/v1"
+        else "simplicio.mechanical-edit-result/v1"
+    )
     policy = standalone_policy_for_root(a.root)
     result: dict[str, Any]
     if a.apply and not policy.write_allowed:
         result = {
-            "schema": "simplicio.mechanical-edit-result/v1",
+            "schema": result_schema,
             "status": "refused",
             "applied": False,
             "noop": False,
@@ -209,10 +235,7 @@ def _run_atomic_native_create_plans(
             ),
         }
 
-    try:
-        payload = json.loads(completed.stdout)
-    except json.JSONDecodeError:
-        payload = None
+    payload = _decode_native_json(completed.stdout)
     result_files = payload.get("files") if isinstance(payload, dict) else None
     actual_files = (
         {str(item.get("file")) for item in result_files if isinstance(item, dict)}
@@ -347,9 +370,8 @@ def _run_native_edit_plans(
                 }
             )
             continue
-        try:
-            result = json.loads(getattr(completed, "stdout", ""))
-        except json.JSONDecodeError:
+        result = _decode_native_json(getattr(completed, "stdout", ""))
+        if result is None:
             errors.append(
                 {
                     "code": "native_delegation_malformed_output",
@@ -358,7 +380,9 @@ def _run_native_edit_plans(
                 }
             )
             continue
-        if not isinstance(result, dict) or result.get("status") != "ok":
+        native_status = result.get("status") if isinstance(result, dict) else None
+        final_status = result.get("final_status", native_status) if isinstance(result, dict) else None
+        if native_status not in {"ok", "success"} or final_status not in {"ok", "success"}:
             errors.append(
                 {
                     "code": "native_delegation_invalid_result",
@@ -416,6 +440,15 @@ def _invalid_delegated_plan(plan: Any) -> list[dict[str, Any]]:
         if not all(isinstance(item, dict) and isinstance(item.get("op"), str) for item in operations):
             return [{"code": "invalid_plan", "message": "Runtime plan operations must be objects with an op"}]
         return []
+    if plan.get("schema") == "simplicio.dev-cli.edit-plan/v1":
+        operations = plan.get("operations")
+        if not isinstance(operations, list) or not operations:
+            return [{"code": "invalid_plan", "message": "Dev CLI edit operations must be a non-empty list"}]
+        return (
+            []
+            if all(isinstance(item, dict) and isinstance(item.get("op"), str) for item in operations)
+            else [{"code": "invalid_plan", "message": "Dev CLI edit operations must be objects with an op"}]
+        )
     if plan.get("schema") != "simplicio.mechanical-edit/v1":
         return [{"code": "missing_schema", "message": "plan schema is unsupported"}]
     operations = plan.get("operations")
@@ -499,6 +532,15 @@ def run_edit(a: argparse.Namespace) -> int:
         )
         return _print_edit_result(result, a)
 
+    # The Dev CLI-owned plan is already in the canonical kernel vocabulary.
+    # Do not hand it to the legacy Runtime Mapper edit endpoint, whose older
+    # operation engine has different semantics. Runtime-backed callers can
+    # authorize the resulting effect at their boundary; the local kernel is
+    # the only implementation of this versioned plan.
+    if plan.get("schema") == "simplicio.dev-cli.edit-plan/v1":
+        record_delegation("edit", "python-forced", root=a.root, reason="canonical-dev-cli-plan")
+        return run_mechanical_edit(a)
+
     runtime = None if a.no_runtime else _runtime_edit_binary()
     if runtime:
         native_plans = None

simplicio_cli-0.18.13/simplicio/commands/release_train.py

@@ -0,0 +1,98 @@
+"""CLI adapter for the deterministic release-train contract."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from ..release_train import (
+    ReleaseTrainError,
+    evaluate_release_event,
+    release_train_doctor,
+)
+from ..component_manifest import (
+    declared_dependency_range,
+    tested_dependency_version,
+)
+
+
+def _read_json(path: Path) -> Any:
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as error:
+        raise ReleaseTrainError(f"cannot read JSON {path}: {error}") from error
+
+
+def _write_json_atomic(path: Path, value: dict[str, Any]) -> None:
+    path = path.resolve()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=str(path.parent))
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(value, handle, ensure_ascii=False, sort_keys=True, indent=2)
+            handle.write("\n")
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(temporary, path)
+    except Exception:
+        try:
+            os.unlink(temporary)
+        except OSError:
+            pass
+        raise
+
+
+def _load_state(path: Path | None) -> dict[str, Any]:
+    if path is None or not path.exists():
+        return {"processed_event_ids": [], "last_processed_version": None}
+    state = _read_json(path)
+    if not isinstance(state, dict):
+        raise ReleaseTrainError("release-train state must be an object")
+    ids = state.get("processed_event_ids", [])
+    last = state.get("last_processed_version")
+    if not isinstance(ids, list) or not all(isinstance(item, str) for item in ids):
+        raise ReleaseTrainError("state.processed_event_ids must be a list of strings")
+    if last is not None and not isinstance(last, str):
+        raise ReleaseTrainError("state.last_processed_version must be a string or null")
+    return {"processed_event_ids": sorted(set(ids)), "last_processed_version": last}
+
+
+def run(a: argparse.Namespace) -> int:
+    if a.release_train_command == "doctor":
+        print(json.dumps(release_train_doctor(a.root), ensure_ascii=False, indent=2, sort_keys=True))
+        return 0
+
+    try:
+        root = a.root
+        declared = a.declared_range or declared_dependency_range("simplicio-mapper", root)
+        tested = a.tested_against
+        if tested is None:
+            tested, _ = tested_dependency_version("simplicio-mapper", root)
+        state_path = Path(a.state) if a.state else None
+        state = _load_state(state_path)
+        evidence = _read_json(Path(a.conformance)) if a.conformance else None
+        decision = evaluate_release_event(
+            _read_json(Path(a.event)),
+            declared_range=declared,
+            tested_against=tested,
+            conformance=evidence,
+            active_task=a.active_task,
+            processed_event_ids=state["processed_event_ids"],
+            last_processed_version=state["last_processed_version"],
+        )
+        if a.record and decision.status == "accepted" and state_path is not None:
+            _write_json_atomic(state_path, decision.state)
+        print(json.dumps(decision.to_dict(), ensure_ascii=False, indent=2, sort_keys=True))
+        return 0 if decision.status in {"accepted", "duplicate"} else 2
+    except (OSError, ReleaseTrainError, TypeError, ValueError) as error:
+        print(json.dumps({
+            "schema": "simplicio.dev-cli.release-train/v1",
+            "status": "blocked",
+            "reason_code": "invalid_input",
+            "reason": str(error),
+        }, ensure_ascii=False, indent=2, sort_keys=True))
+        return 2

{simplicio_cli-0.18.11 → simplicio_cli-0.18.13}/simplicio/commands/versions.py

@@ -12,20 +12,21 @@ and reports drift — all read-only, all local.
 and the cache is empty the field is ``null`` with
 ``unavailable_reason: "registry_unreachable"`` — never a fabricated version.
 
-Explicitly NOT implemented here, and why:
-
-- **Receiving a Mapper release event over a real transport** — no event
-  bus/webhook receiver exists in this repo or session.
-  `component_manifest.parse_component_manifest` is ready to validate a
-  manifest the moment one arrives (see its docstring), but nothing
-  delivers one today.
-- **Auto-creating/merging a version-bump PR** — auto-merging a dependency
-  bump without human review contradicts this repo's AGENTS.md rules.
-  Declared out of scope, not a capability gap for this command.
+This read-only command deliberately does not mutate the checkout. The checked-
+in release-train workflows own authenticated event receipt, deduplicated PR
+updates, PyPI publication, and Loop propagation; this command reports their
+local version/drift state and remains safe to run during an active task.
+
+The workflow boundary is intentional:
+
+- **Receiving a Mapper release event** is handled by
+  `.github/workflows/release-train-reconcile.yml`.
+- **Creating or merging a version-bump PR** is handled by the fixed
+  `release-train/mapper-latest` branch and its gate/promote workflows.
+- **Dispatching `simplicio-loop`** is handled only after the signed PyPI
+  publication receipt in `.github/workflows/publish.yml`.
 - **SBOM/signing/provenance** — no signing identity available in this
   environment.
-- **Triggering `simplicio-loop`** — cross-repo propagation is a separate
-  release-train step, not part of the local versions report.
 """
 
 from __future__ import annotations
@@ -41,9 +42,11 @@ from ..component_manifest import (
     check_version_against_range,
     declared_dependency_range,
     detect_drift,
+    tested_dependency_artifacts,
     tested_dependency_version,
 )
 from ..ecosystem import _pypi_latest
+from ..release_train import release_train_doctor
 
 CLI_PROG = "simplicio-py"
 MAPPER_DIST_NAME = "simplicio-mapper"
@@ -99,6 +102,9 @@ def versions_report(
     installed = _installed_mapper_version()
     declared_range = declared_dependency_range(MAPPER_DIST_NAME, root)
     tested_against, tested_reason = tested_dependency_version(MAPPER_DIST_NAME, root)
+    tested_artifact_version, tested_artifacts, tested_artifact_reason = tested_dependency_artifacts(
+        MAPPER_DIST_NAME, root
+    )
     latest_known, unavailable_reason = _latest_mapper_version(refresh=refresh)
 
     compatibility = (
@@ -111,6 +117,16 @@ def versions_report(
         tested_against=tested_against,
     )
     own_manifest = build_own_manifest(root)
+    release_train = release_train_doctor(root)
+    latest_compatible = (
+        latest_known is not None
+        and declared_range is not None
+        and check_version_against_range(latest_known, declared_range, name=MAPPER_DIST_NAME).status
+        == "compatible"
+    )
+    upgrade_available = bool(
+        installed and latest_compatible and latest_known != installed and latest_known is not None
+    )
 
     return {
         "schema": "simplicio.dev-cli.versions/v1",
@@ -120,12 +136,23 @@ def versions_report(
             "required": declared_range,
             "tested_against": tested_against,
             "tested_against_reason": tested_reason,
+            "tested_artifact_version": tested_artifact_version,
+            "tested_artifacts": tested_artifacts,
+            "tested_artifacts_reason": tested_artifact_reason,
             "latest_known": latest_known,
             "unavailable_reason": unavailable_reason,
             "compatibility": compatibility.to_dict() if compatibility else None,
+            "upgrade": {
+                "available": upgrade_available,
+                "from": installed,
+                "to": latest_known if upgrade_available else None,
+                "action": "recreate environment from the updated lockfile" if upgrade_available else None,
+                "safe_while_task_active": True,
+            },
         },
         "drift": drift.to_dict(),
         "own_manifest": own_manifest.to_dict(),
+        "release_train": release_train,
     }
 
 
@@ -158,6 +185,11 @@ def _render_human(payload: dict[str, Any]) -> None:
     print(f"  version       {own['version']}")
     print(f"  commit        {own['commit'] or '(unknown)'}")
     print(f"  schema count  {len(own['schema_versions'])}")
+    train = payload["release_train"]
+    print()
+    print("release train readiness:")
+    print(f"  status        {train['status']}")
+    print(f"  reason        {train['reason_code']}")
 
 
 def run(a: argparse.Namespace) -> int:

{simplicio_cli-0.18.11 → simplicio_cli-0.18.13}/simplicio/component_manifest.py

@@ -3,11 +3,11 @@ manifests and check them against this repo's own declared compatibility
 range (issue #232).
 
 Context (verified in the issue): `simplicio-cli` declares
-`simplicio-mapper>=0.23.1` in `pyproject.toml`, while the Mapper already
-publishes 0.24.0/0.24.1. That range lets a *clean* install resolve to the
+`simplicio-mapper>=0.26.31,<0.27` in `pyproject.toml`, while the Mapper already
+publishes the 0.26.x train. That range lets a *clean* install resolve to the
 newer Mapper, but it never proves the combination was actually exercised,
 and it never updates an *existing* environment/lock (this repo's own
-`uv.lock` still pins `simplicio-mapper==0.23.1` — see
+`uv.lock` is now expected to pin the verified train candidate — see
 :func:`tested_mapper_version`). Issue #280 on the Mapper side (built by a
 parallel agent, not visible from here) is expected to add a
 ``simplicio.component-release/v1`` manifest and a `simplicio-mapper version
@@ -20,7 +20,7 @@ parallel agent, not visible from here) is expected to add a
 - :func:`check_component_compatibility` — real semver-range logic deciding
   whether a candidate manifest's version is COMPATIBLE, INCOMPATIBLE, or
   NEEDS_REVIEW against a declared range (e.g. this repo's own
-  ``simplicio-mapper>=0.23.1``), parsed for real out of `pyproject.toml`.
+  ``simplicio-mapper>=0.26.27,<0.27``), parsed for real out of `pyproject.toml`.
 - :func:`build_own_manifest` — the reverse direction: build *this* repo's
   own ``simplicio.component-release/v1`` manifest (name=`simplicio-cli`,
   version from `pyproject.toml`/`__version__`, commit from
@@ -375,6 +375,73 @@ def tested_dependency_version(
     return None, "not_present_in_lockfile"
 
 
+def tested_dependency_artifacts(
+    name: str, root: str | os.PathLike[str] | None = None
+) -> tuple[str | None, dict[str, Any], str]:
+    """Return the locked version and its immutable distribution digests.
+
+    The result is ``(version, artifacts, reason)`` where ``artifacts`` has a
+    ``sdist`` object and a ``wheels`` list when the lock records them. Hashes
+    are normalized to the ``sha256:...`` form used by component-release
+    events. Missing or malformed lock data is reported, never guessed.
+    """
+    if root is not None:
+        candidates = [Path(root).resolve() / "uv.lock"]
+    else:
+        candidates = [
+            Path.cwd() / "uv.lock",
+            Path(__file__).resolve().parent.parent / "uv.lock",
+        ]
+    lock_path = next((p for p in candidates if p.is_file()), None)
+    if lock_path is None:
+        return None, {}, "no_lockfile_found"
+    try:
+        text = lock_path.read_text(encoding="utf-8")
+        import tomllib  # type: ignore[import-not-found]
+
+        data = tomllib.loads(text)
+    except ModuleNotFoundError:
+        try:
+            import tomli as tomllib  # type: ignore[import-not-found,no-redef]
+
+            data = tomllib.loads(text)
+        except ModuleNotFoundError:
+            return None, {}, "tomllib_unavailable"
+    except (OSError, ValueError) as exc:
+        return None, {}, f"lockfile_unparseable: {exc}"
+    for package in data.get("package", []) or []:
+        if not isinstance(package, dict) or package.get("name") != name:
+            continue
+        version = package.get("version")
+        if not isinstance(version, str) or not version:
+            return None, {}, "lockfile_entry_missing_version"
+
+        def artifact(raw: Any) -> dict[str, Any] | None:
+            if not isinstance(raw, dict):
+                return None
+            digest = raw.get("hash")
+            if not isinstance(digest, str) or not digest.startswith("sha256:"):
+                return None
+            url = raw.get("url")
+            return {
+                "filename": Path(url).name if isinstance(url, str) else None,
+                "digest": digest,
+                "size": raw.get("size"),
+            }
+
+        artifacts: dict[str, Any] = {}
+        sdist = artifact(package.get("sdist"))
+        if sdist is not None:
+            artifacts["sdist"] = sdist
+        wheels = [item for item in (artifact(raw) for raw in package.get("wheels", []) or []) if item]
+        if wheels:
+            artifacts["wheels"] = wheels
+        if not artifacts:
+            return version, {}, "locked_entry_has_no_artifact_digests"
+        return version, artifacts, "locked_in_uv.lock"
+    return None, {}, "not_present_in_lockfile"
+
+
 # ---------------------------------------------------------------------------#
 # Compatibility check
 # ---------------------------------------------------------------------------#
@@ -659,6 +726,7 @@ __all__ = [
     "declared_dependency_range",
     "declared_own_version",
     "tested_dependency_version",
+    "tested_dependency_artifacts",
     "COMPATIBLE",
     "INCOMPATIBLE",
     "NEEDS_REVIEW",

{simplicio_cli-0.18.11 → simplicio_cli-0.18.13}/simplicio/dev_cli_contracts.py

@@ -6,10 +6,16 @@ import hashlib
 import json
 import os
 import time
+from collections.abc import Mapping
 from copy import deepcopy
 from pathlib import Path, PurePosixPath, PureWindowsPath
 from typing import Any
 
+from .mapper_binding import (
+    canonical_mapper_binding,
+    mapper_binding_digest,
+    validate_mapper_binding,
+)
 from .mechanical_edit import execute_plan
 from .standalone_migration import load_effect_unknown_lock
 from .utils.fs import write_text_atomic
@@ -109,7 +115,7 @@ def _diagnostics(result: dict[str, Any]) -> dict[str, Any]:
 def _preview(plan: dict[str, Any], root: Path) -> dict[str, Any]:
     try:
         return execute_plan(plan, root=root, apply=False, allow_native=False)
-    except Exception as exc:
+    except Exception as exc:  # noqa: BLE001 - convert any executor failure to a refusal
         return {
             "status": "refused",
             "planned_diff": "",
@@ -145,6 +151,11 @@ def _validated_preview(
         return empty, "plan_digest_mismatch", None
     if plan_envelope.get("effect_digest") != plan_envelope.get("plan_digest"):
         return empty, "effect_digest_mismatch", None
+    mapper_binding = plan.get("mapper_binding")
+    if mapper_binding is not None:
+        binding_errors = validate_mapper_binding(mapper_binding)
+        if binding_errors:
+            return empty, "mapper_binding_invalid", {"errors": binding_errors}
     result = _preview(plan, root)
     diagnostics = _diagnostics(result)
     if result.get("status") != "ok":
@@ -162,14 +173,32 @@ def _validated_preview(
     return diagnostics, None, None
 
 
-def compile_plan(plan: dict[str, Any], *, root: str | Path, idempotency_key: str) -> dict[str, Any]:
+def compile_plan(
+    plan: dict[str, Any],
+    *,
+    root: str | Path,
+    idempotency_key: str,
+    mapper_binding: Mapping[str, Any] | None = None,
+) -> dict[str, Any]:
     """Validate and bind a mechanical plan without writing or spawning."""
     root_path = Path(root).resolve()
     if not isinstance(plan, dict):
-        raise ValueError("plan must be an object")
+        raise ValueError("plan must be an object")  # noqa: TRY004 - public contract error
     if not idempotency_key:
         raise ValueError("idempotency_key is required")
     normalized = _normalized_plan(plan)
+    supplied_binding = mapper_binding if mapper_binding is not None else normalized.get("mapper_binding")
+    if supplied_binding is not None:
+        binding_errors = validate_mapper_binding(supplied_binding)
+        if binding_errors:
+            return {
+                "schema": PLAN_SCHEMA,
+                "status": "blocked",
+                "idempotency_key": idempotency_key,
+                "reason": "mapper_binding_invalid",
+                "errors": binding_errors,
+            }
+        normalized["mapper_binding"] = canonical_mapper_binding(supplied_binding)
     preview = _preview(normalized, root_path)
     digest = _digest(normalized)
     diagnostics = _diagnostics(preview)
@@ -182,6 +211,9 @@ def compile_plan(plan: dict[str, Any], *, root: str | Path, idempotency_key: str
         "diagnostics": diagnostics,
         "provenance": {"producer": "simplicio-dev-cli", "operator": "native-deterministic"},
     }
+    if "mapper_binding" in normalized:
+        base["mapper_binding"] = normalized["mapper_binding"]
+        base["provenance"]["mapper_binding_digest"] = mapper_binding_digest(normalized["mapper_binding"])
     if preview.get("status") != "ok":
         return base | {"status": "blocked", "errors": preview.get("errors", [])}
     try:
@@ -210,6 +242,8 @@ def dry_run(plan_envelope: dict[str, Any], *, root: str | Path) -> dict[str, Any
         "diagnostics": diagnostics,
         "provenance": plan_envelope.get("provenance", {}),
     }
+    if isinstance(plan_envelope.get("mapper_binding"), dict):
+        payload["mapper_binding"] = plan_envelope["mapper_binding"]
     if reason:
         payload["reason"] = reason
     if preconditions is not None:
@@ -333,6 +367,9 @@ def apply(plan_envelope: dict[str, Any], *, root: str | Path) -> dict[str, Any]:
             "provenance": plan_envelope.get("provenance", {}),
             "recovery_locator": str(receipt_path.relative_to(root_path)),
         }
+        if isinstance(plan_envelope.get("mapper_binding"), dict):
+            receipt["mapper_binding"] = plan_envelope["mapper_binding"]
+            receipt["mapper_binding_digest"] = mapper_binding_digest(plan_envelope["mapper_binding"])
         receipt["receipt_digest"] = _receipt_digest(receipt)
         write_text_atomic(receipt_path, _canonical(receipt) + "\n")
         return receipt | {"replayed": False}

{simplicio_cli-0.18.11 → simplicio_cli-0.18.13}/simplicio/doctor.py

@@ -136,6 +136,9 @@ def _render_mapper_versions(payload: dict) -> None:
         print(f"  drift            {drift['kind']}: {drift['reason']}")
     else:
         print("  drift            none")
+    train = payload.get("release_train")
+    if train:
+        print(f"  release train    {train['status']} — {train['reason_code']}")
 
 
 def _render_native_delegation(summary: dict) -> None: