simplicio-loop 3.23.0__tar.gz → 3.24.0__tar.gz

{simplicio_loop-3.23.0/simplicio_loop.egg-info → simplicio_loop-3.24.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simplicio-loop
-Version: 3.23.0
+Version: 3.24.0
 Summary: The Universal Looping AI Orchestrator — a runtime-agnostic super-plugin (7 skills) that drains any queue of work end-to-end on any LLM/runtime.
 Author-email: Wesley Simplicio <wesleybob4@gmail.com>
 License: MIT
@@ -19,8 +19,8 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: simplicio-mapper>=0.17.0
-Requires-Dist: simplicio-cli>=0.9.6
+Requires-Dist: simplicio-mapper>=0.19.0
+Requires-Dist: simplicio-cli>=0.11.0
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Provides-Extra: ml

{simplicio_loop-3.23.0 → simplicio_loop-3.24.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "simplicio-loop"
-version = "3.23.0"
+version = "3.24.0"
 description = "The Universal Looping AI Orchestrator — a runtime-agnostic super-plugin (7 skills) that drains any queue of work end-to-end on any LLM/runtime."
 readme = "PYPI.md"
 requires-python = ">=3.8"
@@ -25,8 +25,8 @@ classifiers = [
 #   simplicio-mapper -> the repo-survey step (binds `orient`)
 #   simplicio-cli    -> the operator that applies+verifies changes (binds `execute`/`deterministic_edit`)
 dependencies = [
-  "simplicio-mapper>=0.17.0",
-  "simplicio-cli>=0.9.6",
+  "simplicio-mapper>=0.19.0",
+  "simplicio-cli>=0.11.0",
 ]
 
 # Optional: the real embedding backend for `simplicio-cli semantic --ml` / `simplicio-cli rag --ml`.

{simplicio_loop-3.23.0 → simplicio_loop-3.24.0}/simplicio_loop/_bundle/hooks/action_gate.py

@@ -235,8 +235,46 @@ def gate_command(cmd, staged=False):
 
 
 # ---------------------------------------------------------------------------------------------
-def _emit_and_exit(verdict, pretooluse=False):
+def _hbp_append_gate_blocked(reason, cmd=""):
+    """Record a gate BLOCK into the runtime's HBP tamper-evident hash chain (#128) — fail-open,
+    `simplicio`-only, mirrors `hooks/loop_stop.py`'s `_call_simplicio_hbp_append*` family. A
+    blocked mutation is exactly the kind of decision that should be provable later (a later
+    `simplicio hbp verify` can show this exact command/reason was recorded in order), not just
+    printed to stderr and forgotten. Absent binary or any failure: silent no-op, never blocks
+    the gate's own allow/block decision (that decision already happened before this is called).
+    """
+    binary = shutil.which("simplicio")
+    if not binary:
+        return
+    try:
+        import hashlib
+        # minimal payload contract shared by the #128 topics: fingerprint + attempt id.
+        fp = hashlib.sha1((reason or "").encode("utf-8", "replace")).hexdigest()[:12]
+        attempt = None
+        try:  # attempt id = live loop iteration from the scratchpad frontmatter, when armed
+            with open(os.path.join(".orchestrator", "loop", "scratchpad.md"),
+                      encoding="utf-8") as f:
+                m = re.search(r"^iteration:\s*(\d+)", f.read(), re.M)
+            attempt = int(m.group(1)) if m else None
+        except Exception:
+            attempt = None
+        payload = json.dumps({"fingerprint": fp, "attempt": attempt,
+                              "reason": (reason or "")[:200], "command": (cmd or "")[:200]})
+        subprocess.run(
+            [binary, "hbp", "append",
+             "--topic", "loop-gate-blocked",
+             "--payload", payload,
+             "--provenance", "simplicio-loop",
+             "--json"],
+            capture_output=True, timeout=15,
+        )
+    except Exception:
+        pass
+
+
+def _emit_and_exit(verdict, pretooluse=False, cmd=""):
     if verdict["action"] == "block":
+        _hbp_append_gate_blocked(verdict.get("reason", ""), cmd)
         if pretooluse:
             # Claude PreToolUse: exit 2 blocks the call; reason on stderr is fed back to the model.
             sys.stderr.write("action_gate BLOCK — " + verdict["reason"] + "\n")
@@ -251,7 +289,7 @@ def _emit_and_exit(verdict, pretooluse=False):
 
 def cmd_check(opts):
     cmd = opts.get("command", "")
-    _emit_and_exit(gate_command(cmd, staged=bool(opts.get("staged"))))
+    _emit_and_exit(gate_command(cmd, staged=bool(opts.get("staged"))), cmd=cmd)
 
 
 def cmd_scan_diff(opts):
@@ -271,6 +309,8 @@ def cmd_scan_diff(opts):
         for label, n in hits:
             print("  secret: %s (line %d)" % (label, n))
         print("block")
+        _hbp_append_gate_blocked("secret in diff (%s)" % ", ".join(sorted({h[0] for h in hits})),
+                                  "scan-diff %s" % (src or "-"))
         sys.exit(2)
     print("allow")
     sys.exit(0)
@@ -292,7 +332,7 @@ def from_pretooluse():
     cmd = (data.get("tool_input", {}) or {}).get("command", "")
     if not cmd:
         sys.exit(0)
-    _emit_and_exit(gate_command(cmd), pretooluse=True)
+    _emit_and_exit(gate_command(cmd), pretooluse=True, cmd=cmd)
 
 
 def cmd_selftest(_opts):

{simplicio_loop-3.23.0 → simplicio_loop-3.24.0}/simplicio_loop/_bundle/hooks/loop_stop.py

@@ -326,9 +326,12 @@ def _changed_files():
     commit). A heuristic, not a precise "since loop start" diff — fail-open: {} on any error.
 
     Excludes `.orchestrator/` (the loop's own state files — never source, and would otherwise
-    make the receipt's own write, or a sibling state write, look like a "later" source change)
-    and build/cache noise (`__pycache__`, `.pyc`) that this very check's own module import can
-    create — that self-inflicted false-positive is exactly why both are filtered here.
+    make the receipt's own write, or a sibling state write, look like a "later" source change),
+    `.simplicio/` (the simplicio runtime/dev-cli's own state — checkpoints, events.jsonl, survey
+    artifacts — written by this very hook's fire-and-forget CLI callouts mid-turn, the same
+    self-inflicted false-positive class), and build/cache noise (`__pycache__`, `.pyc`) that this
+    very check's own module import can create — those false-positives are exactly why all three
+    are filtered here.
     """
     out = set()
     for args in (
@@ -344,7 +347,8 @@ def _changed_files():
             continue
     return {
         f for f in out
-        if not f.startswith(".orchestrator/") and "__pycache__" not in f and not f.endswith((".pyc", ".pyo"))
+        if not f.startswith((".orchestrator/", ".simplicio/"))
+        and "__pycache__" not in f and not f.endswith((".pyc", ".pyo"))
     }
 
 
@@ -518,6 +522,31 @@ def _call_simplicio_checkpoint(iteration):
         pass
 
 
+def _call_simplicio_hbp_append_topic(topic, payload_dict):
+    """Generic fail-open append into the runtime's HBP tamper-evident hash chain
+    (`simplicio hbp append`), when the native `simplicio` binary is on PATH (#128).
+
+    Same contract as the promise-verified append below: `simplicio`-only, best-effort — absent
+    binary or any failure is a silent no-op that never blocks the caller's own decision. Every
+    new HBP point in this hook family (stall detected, gate blocked, run blocked) goes through
+    here so the topics all carry the same provenance and failure discipline.
+    """
+    binary = shutil.which("simplicio")
+    if not binary:
+        return
+    try:
+        subprocess.run(
+            [binary, "hbp", "append",
+             "--topic", topic,
+             "--payload", json.dumps(payload_dict),
+             "--provenance", "simplicio-loop",
+             "--json"],
+            capture_output=True, timeout=15,
+        )
+    except Exception:
+        pass
+
+
 def _call_simplicio_hbp_append(iteration, promise, watcher_tag):
     """Record the promise-verification decision into the runtime's HBP
     tamper-evident hash chain (`simplicio hbp append`), when the native
@@ -531,29 +560,44 @@ def _call_simplicio_hbp_append(iteration, promise, watcher_tag):
     recorded in order, without trusting this process's own say-so after the
     fact. Absent binary or any failure: silent no-op, never blocks the stop.
     """
-    binary = shutil.which("simplicio")
-    if not binary:
-        return
     try:
         anchor = read_anchor() or {}
-        payload = json.dumps({
+        _call_simplicio_hbp_append_topic("loop-promise-verified", {
             "iteration": iteration,
             "promise": promise,
             "watcher_tag": watcher_tag,
             "goal_fp": anchor.get("goal_fp", ""),
         })
-        subprocess.run(
-            [binary, "hbp", "append",
-             "--topic", "loop-promise-verified",
-             "--payload", payload,
-             "--provenance", "simplicio-loop",
-             "--json"],
-            capture_output=True, timeout=15,
-        )
     except Exception:
         pass
 
 
+def _journal_stall(k=3):
+    """Trailing same-fingerprint failure streak from the journal — (fingerprint, streak).
+
+    Mirrors `scripts/loop_journal.py`'s `analyze()` trailing-streak math over the tail of the
+    journal, locally and fail-open (("", 0) on any error) — the hook must never import the
+    worker to decide whether to emit the `loop-stall-detected` HBP record (#128).
+    """
+    try:
+        rows = tail_journal(n=max(k * 3, 12))
+        if not rows:
+            return "", 0
+        last = rows[-1]
+        fp = last.get("fingerprint", "")
+        if last.get("gate") == "pass" or not fp:
+            return "", 0
+        streak = 0
+        for r in reversed(rows):
+            if r.get("gate") != "pass" and r.get("fingerprint") == fp:
+                streak += 1
+            else:
+                break
+        return fp, streak
+    except Exception:
+        return "", 0
+
+
 def read_watcher_challenge():
     """Return the current per-iteration watcher challenge dict, or None. Fail-open."""
     try:
@@ -781,7 +825,11 @@ def main():
         # hand-survey/hand-edit.
         missing_ops = missing_bound_operators()
         if missing_ops:
-            write_handoff("bound operator missing: %s" % ", ".join(missing_ops), meta, body)
+            reason = "bound operator missing: %s" % ", ".join(missing_ops)
+            _call_simplicio_hbp_append_topic("loop-run-blocked", {
+                "fingerprint": _journal_stall()[0], "attempt": iteration, "reason": reason,
+            })
+            write_handoff(reason, meta, body)
             cleanup_and_stop()
 
         stdin = read_stdin_json()
@@ -792,6 +840,15 @@ def main():
         # this turn even if the agent forgot the manual `loop_journal.py record` call.
         auto_record_journal(iteration, has_evidence)
 
+        # HBP point: stall detected (#128) — when the trailing journal streak crosses the same
+        # K=3 threshold the stall detector/planner use, record it into the tamper-evident chain
+        # so a later `simplicio hbp verify` can prove WHEN the loop knew it was stuck. Fail-open.
+        stall_fp, stall_streak = _journal_stall()
+        if stall_streak >= 3:
+            _call_simplicio_hbp_append_topic("loop-stall-detected", {
+                "fingerprint": stall_fp, "attempt": iteration, "streak": stall_streak,
+            })
+
         # HRM-style hierarchical planner: re-assess phase on stall or every N iterations.
         # Runs BEFORE the promise gate so the phase context is available.
         _call_hierarchical_planner()
@@ -824,6 +881,10 @@ def main():
             cleanup_and_stop()
         # (4) Iteration cap — incomplete stop, hand off.
         if max_iter > 0 and iteration >= max_iter:
+            _call_simplicio_hbp_append_topic("loop-run-blocked", {
+                "fingerprint": _journal_stall()[0], "attempt": iteration,
+                "reason": "max_iterations cap reached",
+            })
             write_handoff("max_iterations cap reached", meta, body)
             cleanup_and_stop()
         # (5) Spindle handoff — latched handoff overrides re-feed.

{simplicio_loop-3.23.0 → simplicio_loop-3.24.0}/simplicio_loop/_bundle/hooks/simplicio_dashboard.py

@@ -27,6 +27,15 @@ from pathlib import Path
 
 HOME = os.path.expanduser("~")
 REPO_ROOT = Path(__file__).resolve().parents[1]
+_SCRIPTS_DIR = str(REPO_ROOT / "scripts")
+if _SCRIPTS_DIR not in sys.path:
+    sys.path.insert(0, _SCRIPTS_DIR)
+try:
+    # tolerant JSONL reader (#127) — see hooks/simplicio_watch.py for the same rationale: the
+    # savings ledger is written by the external `simplicio` runtime, never by this repo.
+    from _locked_append import count_jsonl_lines
+except Exception:
+    count_jsonl_lines = None
 # Structured savings file written by the capture engine — the primary data source.
 SAVINGS_JSON_CANDIDATES = [
     Path(HOME) / ".simplicio" / "proxy_savings.json",
@@ -706,8 +715,16 @@ def get_status():
             except (IndexError, ValueError):
                 pass
 
+    # Tolerant count (#127): a truncated/illegible line is counted separately, not folded into
+    # the event total as if it were real data.
     ledger = REPO_ROOT / ".simplicio" / "ledger" / "savings-events.jsonl"
-    lc = sum(1 for _ in ledger.open(errors="replace")) if ledger.exists() else 0
+    if ledger.exists() and count_jsonl_lines is not None:
+        lc, ledger_corrupt = count_jsonl_lines(str(ledger))
+    elif ledger.exists():
+        lc = sum(1 for _ in ledger.open(errors="replace"))
+        ledger_corrupt = 0
+    else:
+        lc = ledger_corrupt = 0
 
     savings_pct = round((tok_saved / max(tok_before, 1)) * 100, 1)
 
@@ -751,6 +768,7 @@ def get_status():
         "cache_hit_pct": cache_hit,
         "memories": mem,
         "ledger_events": lc,
+        "ledger_corrupt_lines": ledger_corrupt,
         "series": series,
         "models_seen": models_seen[:8],
         "active_model": active_model,

{simplicio_loop-3.23.0 → simplicio_loop-3.24.0}/simplicio_loop/_bundle/hooks/simplicio_watch.py

@@ -18,6 +18,17 @@ from pathlib import Path
 HOME = os.path.expanduser("~")
 LOGS = os.path.join(HOME, ".simplicio", "logs")
 REPO_ROOT = Path(__file__).resolve().parents[1]
+_SCRIPTS_DIR = str(REPO_ROOT / "scripts")
+if _SCRIPTS_DIR not in sys.path:
+    sys.path.insert(0, _SCRIPTS_DIR)
+try:
+    # tolerant JSONL reader (#127) — the savings ledger is written by the external `simplicio`
+    # runtime, never by this repo; we only ever READ it, so hardening here means counting valid
+    # vs. corrupt/truncated lines instead of a naive `sum(1 for _ in file)` that treats a torn
+    # line the same as a real event. Fail-open: missing helper -> fall back to the raw count.
+    from _locked_append import count_jsonl_lines
+except Exception:
+    count_jsonl_lines = None
 # Native engine: invoked cross-platform via this interpreter (no external binary).
 ENGINE_CMD = [sys.executable or "python3", str(REPO_ROOT / "engine" / "simplicio_engine.py")]
 PROXY_PORT = os.environ.get("SIMPLICIO_PROXY_PORT", "8788")
@@ -50,11 +61,17 @@ def status():
     for line in out2.split("\n"):
         if "Total" in line or "Database" in line:
             log(f"  {line.strip()}")
-    # Savings ledger
+    # Savings ledger — tolerant count (#127): a truncated/illegible line is counted, not silently
+    # folded into the total as if it were a real event.
     ledger = REPO_ROOT / ".simplicio" / "ledger" / "savings-events.jsonl"
     if ledger.is_file():
-        total = sum(1 for _ in ledger.open(errors="replace"))
-        log(f"  💰 Savings ledger: {total} events")
+        if count_jsonl_lines is not None:
+            valid, corrupt = count_jsonl_lines(str(ledger))
+            suffix = f" ({corrupt} corrupt line(s) skipped)" if corrupt else ""
+            log(f"  💰 Savings ledger: {valid} events{suffix}")
+        else:
+            total = sum(1 for _ in ledger.open(errors="replace"))
+            log(f"  💰 Savings ledger: {total} events")
     log(f"  🪵 Logs: {LOGS}/proxy.log")
     return 0 if running else 1
 

{simplicio_loop-3.23.0 → simplicio_loop-3.24.0/simplicio_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simplicio-loop
-Version: 3.23.0
+Version: 3.24.0
 Summary: The Universal Looping AI Orchestrator — a runtime-agnostic super-plugin (7 skills) that drains any queue of work end-to-end on any LLM/runtime.
 Author-email: Wesley Simplicio <wesleybob4@gmail.com>
 License: MIT
@@ -19,8 +19,8 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: simplicio-mapper>=0.17.0
-Requires-Dist: simplicio-cli>=0.9.6
+Requires-Dist: simplicio-mapper>=0.19.0
+Requires-Dist: simplicio-cli>=0.11.0
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Provides-Extra: ml

{simplicio_loop-3.23.0 → simplicio_loop-3.24.0}/simplicio_loop.egg-info/SOURCES.txt

@@ -79,11 +79,13 @@ tests/test_evidence_chain.py
 tests/test_fan_out_flow.py
 tests/test_fan_out_unit.py
 tests/test_flow_audit.py
+tests/test_hbp_topics.py
 tests/test_hierarchical_planner.py
 tests/test_hooks_coverage.py
 tests/test_impact_audit.py
 tests/test_install_lib.py
 tests/test_learn_pipeline_removed.py
+tests/test_locked_append.py
 tests/test_loop_e2e.py
 tests/test_precommit_bundle_sync.py
 tests/test_repo_conventions_architecture.py

{simplicio_loop-3.23.0 → simplicio_loop-3.24.0}/simplicio_loop.egg-info/requires.txt

@@ -1,5 +1,5 @@
-simplicio-mapper>=0.17.0
-simplicio-cli>=0.9.6
+simplicio-mapper>=0.19.0
+simplicio-cli>=0.11.0
 
 [dev]
 pytest>=7

simplicio_loop-3.24.0/tests/test_hbp_topics.py

@@ -0,0 +1,299 @@
+"""#128: journal consumes dev-cli events + the new HBP evidence-chain points.
+
+Two halves, both deterministic:
+
+1. `scripts/loop_journal.py` optionally folds the dev-cli's OWN event log
+   (`<repo>/.simplicio/events.jsonl`, schema `simplicio.dev-cli-event/v1` — the documented
+   contract from simplicio-dev-cli's `observability.emit_event`, read by shape, never imported)
+   into the attempt fingerprint + stall detector: a repeated `validation_fail` on the same
+   target streaks to STALLED exactly like a repeated journal failure; `edit_applied`/
+   `task_complete` reset the streak; a missing/corrupt file changes nothing (fail-open).
+
+2. The three new HBP producers append to the runtime's tamper-evident chain via
+   `simplicio hbp append` and are FAIL-OPEN like the pre-existing promise-verified append
+   (`hooks/loop_stop.py::_call_simplicio_hbp_append`): with a FAKE `simplicio` binary on PATH the
+   exact topic + payload go through; with the binary ABSENT the caller degrades silently — never
+   a crash, never a changed decision. (Producer discipline per tests/test_evidence_chain.py:
+   prove the positive chain with fixtures shaped like the real producer's output, and prove the
+   absent-toolchain path degrades rather than fakes.)
+"""
+import json
+import os
+import shutil
+import subprocess
+import sys
+
+REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, os.path.join(REPO, "scripts"))
+import loop_journal as lj  # noqa: E402
+
+HOOK = os.path.join(REPO, "hooks", "loop_stop.py")
+GATE = os.path.join(REPO, "hooks", "action_gate.py")
+
+SCHEMA = "simplicio.dev-cli-event/v1"
+
+
+def _event(event, target="src/app.py", ts="2026-07-09T00:00:00Z", warnings=None, attempt=1):
+    """A record shaped exactly like observability.emit_event()'s documented on-disk contract."""
+    return {"schema": SCHEMA, "ts": ts, "event": event, "level": "info",
+            "payload": {"target": target, "attempt": attempt, "warnings": warnings or []}}
+
+
+def _write_events(root, records, extra_lines=()):
+    d = os.path.join(root, ".simplicio")
+    os.makedirs(d, exist_ok=True)
+    with open(os.path.join(d, "events.jsonl"), "w", encoding="utf-8") as f:
+        for rec in records:
+            f.write(json.dumps(rec) + "\n")
+        for ln in extra_lines:
+            f.write(ln + "\n")
+
+
+# ── half 1: dev-cli events -> stall detector ────────────────────────────────────────────────
+
+
+def test_missing_events_file_changes_nothing(tmp_path):
+    events, corrupt = lj.load_dev_cli_events(str(tmp_path))
+    assert events == [] and corrupt == 0
+    rows = [{"gate": "fail", "fingerprint": "aaa", "ts": "t", "action": "x"}]
+    assert lj.merge_dev_cli(rows, events) == rows  # identical behavior to today
+
+
+def test_repeated_validation_fail_same_target_streaks_to_stalled(tmp_path):
+    root = str(tmp_path)
+    _write_events(root, [
+        _event("validation_fail", ts="2026-07-09T00:00:0%dZ" % i, warnings=["pytest failed"])
+        for i in (1, 2, 3)
+    ])
+    events, corrupt = lj.load_dev_cli_events(root)
+    assert len(events) == 3 and corrupt == 0
+    verdict = lj.analyze(lj.merge_dev_cli([], events), 3)
+    assert verdict["verdict"] == "STALLED", verdict
+    assert verdict["stall_count"] == 3
+
+
+def test_different_targets_do_not_streak(tmp_path):
+    root = str(tmp_path)
+    _write_events(root, [
+        _event("validation_fail", target="a.py", ts="2026-07-09T00:00:01Z", warnings=["boom"]),
+        _event("validation_fail", target="b.py", ts="2026-07-09T00:00:02Z", warnings=["boom"]),
+        _event("validation_fail", target="c.py", ts="2026-07-09T00:00:03Z", warnings=["boom"]),
+    ])
+    events, _ = lj.load_dev_cli_events(root)
+    assert lj.analyze(lj.merge_dev_cli([], events), 3)["verdict"] == "PROGRESS"
+
+
+def test_task_complete_resets_the_streak(tmp_path):
+    root = str(tmp_path)
+    _write_events(root, [
+        _event("validation_fail", ts="2026-07-09T00:00:01Z", warnings=["boom"]),
+        _event("validation_fail", ts="2026-07-09T00:00:02Z", warnings=["boom"]),
+        _event("validation_fail", ts="2026-07-09T00:00:03Z", warnings=["boom"]),
+        _event("task_complete", ts="2026-07-09T00:00:04Z"),
+    ])
+    events, _ = lj.load_dev_cli_events(root)
+    assert lj.analyze(lj.merge_dev_cli([], events), 3)["verdict"] == "PROGRESS"
+
+
+def test_events_merge_chronologically_with_journal_rows(tmp_path):
+    # A journal fail + two dev-cli fails on the same signature must form ONE trailing streak.
+    root = str(tmp_path)
+    ev = [_event("validation_fail", ts="2026-07-09T00:00:0%dZ" % i, warnings=["boom"])
+          for i in (2, 3)]
+    _write_events(root, ev)
+    events, _ = lj.load_dev_cli_events(root)
+    fp = lj._dev_cli_fingerprint(ev[0])
+    rows = [{"gate": "fail", "fingerprint": fp, "ts": "2026-07-09T00:00:01Z", "action": "manual"}]
+    verdict = lj.analyze(lj.merge_dev_cli(rows, events), 3)
+    assert verdict["verdict"] == "STALLED", verdict
+    assert verdict["stall_count"] == 3
+
+
+def test_corrupt_and_foreign_lines_are_tolerated(tmp_path):
+    root = str(tmp_path)
+    _write_events(root, [_event("validation_fail", warnings=["boom"])],
+                  extra_lines=['{"torn json', json.dumps({"schema": "other/v9", "event": "x"}),
+                               json.dumps(["not", "a", "dict"])])
+    events, corrupt = lj.load_dev_cli_events(root)
+    assert len(events) == 1     # only the real dev-cli event
+    assert corrupt == 1         # only the torn line counts as corrupt; foreign schema is skipped
+
+
+def test_stall_cli_consumes_events_via_events_root(tmp_path):
+    # End-to-end through the real CLI: copy the worker (+ its sibling imports) into an isolated
+    # repo dir, journal EMPTY, only dev-cli events present -> `stall --format json` = STALLED.
+    root = str(tmp_path)
+    scripts = os.path.join(root, "scripts")
+    os.makedirs(scripts)
+    for mod in ("loop_journal.py", "toon_codec.py", "_locked_append.py"):
+        shutil.copy2(os.path.join(REPO, "scripts", mod), os.path.join(scripts, mod))
+    _write_events(root, [
+        _event("validation_fail", ts="2026-07-09T00:00:0%dZ" % i, warnings=["pytest failed"])
+        for i in (1, 2, 3)
+    ])
+    r = subprocess.run([sys.executable, os.path.join(scripts, "loop_journal.py"),
+                        "stall", "--format", "json"],
+                       capture_output=True, text=True, cwd=root)
+    assert r.returncode == 0, r.stdout + r.stderr
+    verdict = json.loads(r.stdout)
+    assert verdict["verdict"] == "STALLED", verdict
+    # and --events-root pointing somewhere empty restores today's behavior
+    empty = os.path.join(root, "elsewhere")
+    os.makedirs(empty)
+    r2 = subprocess.run([sys.executable, os.path.join(scripts, "loop_journal.py"),
+                         "stall", "--format", "json", "--events-root", empty],
+                        capture_output=True, text=True, cwd=root)
+    assert json.loads(r2.stdout)["verdict"] == "PROGRESS", r2.stdout
+
+
+# ── half 2: HBP producers (fake / absent binary) ────────────────────────────────────────────
+
+
+def _fake_simplicio(bin_dir, log_path):
+    """A fake `simplicio` binary that appends its argv (one call per line) to log_path."""
+    os.makedirs(bin_dir, exist_ok=True)
+    if os.name == "nt":  # pragma: no cover — POSIX CI
+        path = os.path.join(bin_dir, "simplicio.bat")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('@echo off\r\necho %* >> "%s"\r\n' % log_path)
+    else:
+        path = os.path.join(bin_dir, "simplicio")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('#!/bin/sh\nprintf \'%s\\n\' "$*" >> "{}"\n'.format(log_path))
+        os.chmod(path, 0o755)
+    return path
+
+
+def _calls(log_path):
+    if not os.path.exists(log_path):
+        return []
+    with open(log_path, encoding="utf-8") as f:
+        return [ln.rstrip("\n") for ln in f if ln.strip()]
+
+
+SCRATCHPAD = """---
+iteration: {iteration}
+max_iterations: {max_iter}
+completion_promise: "SIMPLICIO_DONE"
+evidence_required: true
+started_at: "2026-06-24T00:00:00Z"
+---
+Implement the thing and prove it works.
+"""
+
+
+def _arm(root, iteration=1, max_iter=5):
+    loop = os.path.join(root, ".orchestrator", "loop")
+    os.makedirs(loop, exist_ok=True)
+    with open(os.path.join(loop, "scratchpad.md"), "w", encoding="utf-8") as f:
+        f.write(SCRATCHPAD.format(iteration=iteration, max_iter=max_iter))
+    return loop
+
+
+def _write_stalled_journal(root, fp="deadbeef0001", n=3):
+    loop = os.path.join(root, ".orchestrator", "loop")
+    os.makedirs(loop, exist_ok=True)
+    with open(os.path.join(loop, "journal.jsonl"), "w", encoding="utf-8") as f:
+        for i in range(1, n + 1):
+            f.write(json.dumps({"iteration": i, "action": "retry fetch", "gate": "fail",
+                                "fingerprint": fp, "ts": "2026-07-09T00:00:0%dZ" % i}) + "\n")
+
+
+def _tick(root, text, env):
+    return subprocess.run([sys.executable, HOOK], input=json.dumps({"text": text}),
+                          capture_output=True, text=True, cwd=root, env=env)
+
+
+def test_stall_detected_appends_hbp_topic(tmp_path):
+    root = str(tmp_path)
+    _arm(root, iteration=3, max_iter=10)
+    _write_stalled_journal(root)
+    log = os.path.join(root, "hbp_calls.log")
+    bin_dir = os.path.join(root, "bin")
+    _fake_simplicio(bin_dir, log)
+    env = dict(os.environ, PATH=bin_dir + os.pathsep + os.environ.get("PATH", ""))
+    _tick(root, "still failing, no promise", env)
+    calls = _calls(log)
+    stall = [c for c in calls if "loop-stall-detected" in c]
+    assert stall, "a 3-deep same-fingerprint streak must append loop-stall-detected: %s" % calls
+    assert "deadbeef0001" in stall[0], stall[0]
+    assert "hbp append" in stall[0]
+
+
+def test_run_blocked_on_cap_appends_hbp_topic(tmp_path):
+    root = str(tmp_path)
+    _arm(root, iteration=5, max_iter=5)  # at the cap -> run blocked
+    log = os.path.join(root, "hbp_calls.log")
+    bin_dir = os.path.join(root, "bin")
+    _fake_simplicio(bin_dir, log)
+    env = dict(os.environ, PATH=bin_dir + os.pathsep + os.environ.get("PATH", ""))
+    r = _tick(root, "still working", env)
+    assert r.stdout.strip() == "", "cap must stop the loop:\n%s" % r.stdout
+    blocked = [c for c in _calls(log) if "loop-run-blocked" in c]
+    assert blocked, "cap-reached stop must append loop-run-blocked: %s" % _calls(log)
+    assert "max_iterations cap reached" in blocked[0]
+
+
+def test_run_blocked_on_missing_operator_appends_hbp_topic(tmp_path):
+    root = str(tmp_path)
+    _arm(root, iteration=1, max_iter=9)
+    skill_dir = os.path.join(root, ".claude", "skills", "simplicio-loop")
+    os.makedirs(skill_dir, exist_ok=True)
+    open(os.path.join(skill_dir, "SKILL.md"), "w").close()
+    log = os.path.join(root, "hbp_calls.log")
+    bin_dir = os.path.join(root, "bin")
+    _fake_simplicio(bin_dir, log)  # simplicio IS on PATH; mapper/dev-cli are NOT
+    env = dict(os.environ, PATH=bin_dir)
+    r = _tick(root, "no promise yet", env)
+    assert r.stdout.strip() == "", r.stdout
+    blocked = [c for c in _calls(log) if "loop-run-blocked" in c]
+    assert blocked, "operator-missing block must append loop-run-blocked: %s" % _calls(log)
+    assert "bound operator missing" in blocked[0]
+
+
+def test_gate_blocked_appends_hbp_topic(tmp_path):
+    root = str(tmp_path)
+    os.makedirs(os.path.join(root, ".orchestrator"), exist_ok=True)  # project-relevance marker
+    log = os.path.join(root, "hbp_calls.log")
+    bin_dir = os.path.join(root, "bin")
+    _fake_simplicio(bin_dir, log)
+    env = dict(os.environ, PATH=bin_dir + os.pathsep + os.environ.get("PATH", ""))
+    r = subprocess.run([sys.executable, GATE, "check", "--command",
+                        "git push --force origin main"],
+                       capture_output=True, text=True, cwd=root, env=env)
+    assert r.returncode == 2, "force-push must still be blocked (exit 2)"
+    blocked = [c for c in _calls(log) if "loop-gate-blocked" in c]
+    assert blocked, "a gate BLOCK must append loop-gate-blocked: %s" % _calls(log)
+    assert "fingerprint" in blocked[0]
+
+
+def test_all_producers_degrade_silently_without_binary(tmp_path):
+    # Absent `simplicio`: every path still reaches its own decision — never a crash, no append.
+    root = str(tmp_path)
+    empty = os.path.join(root, "empty-bin")
+    os.makedirs(empty)
+    env = dict(os.environ, PATH=empty)
+
+    # stall path (journal stalled, no binary): hook still re-feeds normally
+    _arm(root, iteration=3, max_iter=10)
+    _write_stalled_journal(root)
+    r = _tick(root, "still failing, no promise", env)
+    assert r.returncode == 0
+    assert "followup_message" in r.stdout, "stall append absent-binary must not break the re-feed"
+
+    # cap path: still a clean stop
+    _arm(root, iteration=10, max_iter=10)
+    r = _tick(root, "still working", env)
+    assert r.returncode == 0 and r.stdout.strip() == ""
+
+    # gate path: still blocks with exit 2 (PATH needs git for the classify-only path — none used)
+    r = subprocess.run([sys.executable, GATE, "check", "--command",
+                        "git push --force origin main"],
+                       capture_output=True, text=True, cwd=root, env=env)
+    assert r.returncode == 2, "gate must still block without the runtime binary"
+
+
+if __name__ == "__main__":
+    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+    from _selfrun import run_module
+    run_module(globals(), "test_hbp_topics")

simplicio_loop-3.24.0/tests/test_locked_append.py

@@ -0,0 +1,168 @@
+"""scripts/_locked_append.py — locked JSONL append + tolerant-count helpers (issue #127).
+
+Two layers of proof:
+  1. Unit-level: the helper appends valid JSON, creates parent dirs, and — critically — FAILS
+     OPEN (skips the write, never writes unlocked/partial) when the lock can't be acquired within
+     its timeout.
+  2. Concurrency: K REAL OS processes (`multiprocessing.Process`, not threads — threads never
+     exercise actual cross-process file locking) each append M lines to the SAME journal-shaped
+     file at once. Post-condition: exactly K*M lines, every single one valid JSON. This is the
+     regression guard for the exact bug class #127 fixes: two writers racing an unlocked
+     `open(path, "a").write()` interleaving into a torn/unparseable line.
+"""
+import json
+import multiprocessing
+import os
+import sys
+import time
+
+REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, os.path.join(REPO, "scripts"))
+import _locked_append as la  # noqa: E402
+
+K_WORKERS = 8
+M_LINES = 40
+
+
+def test_appends_valid_json_line(tmp_path):
+    path = str(tmp_path / "journal.jsonl")
+    assert la.locked_append_line(path, json.dumps({"a": 1})) is True
+    assert la.locked_append_line(path, json.dumps({"a": 2})) is True
+    with open(path, encoding="utf-8") as f:
+        lines = [ln for ln in f if ln.strip()]
+    assert len(lines) == 2
+    assert json.loads(lines[0]) == {"a": 1}
+    assert json.loads(lines[1]) == {"a": 2}
+
+
+def test_adds_trailing_newline_when_missing(tmp_path):
+    path = str(tmp_path / "j.jsonl")
+    la.locked_append_line(path, '{"x":1}')  # no trailing \n supplied
+    la.locked_append_line(path, '{"x":2}')
+    with open(path, encoding="utf-8") as f:
+        text = f.read()
+    assert text == '{"x":1}\n{"x":2}\n'
+
+
+def test_creates_parent_dirs(tmp_path):
+    path = str(tmp_path / "nested" / "deep" / "journal.jsonl")
+    assert la.locked_append_line(path, json.dumps({"ok": True})) is True
+    assert os.path.exists(path)
+
+
+def test_flush_and_fsync_survive_before_lock_release(tmp_path):
+    # Not directly observable from the outside, but a write that returns True must be durably on
+    # disk (readable) immediately after the call returns — this is the contract fsync buys us.
+    path = str(tmp_path / "durable.jsonl")
+    la.locked_append_line(path, json.dumps({"durable": True}))
+    with open(path, encoding="utf-8") as f:
+        assert json.loads(f.read().strip()) == {"durable": True}
+
+
+def test_timeout_skips_write_never_writes_unlocked(tmp_path):
+    """Fail-open contract: if the lock is already held (by THIS process, a different fd — POSIX
+    flock is per-open-file-description, so a second fd contends genuinely), a short-timeout call
+    must return False and must NOT append anything — never a partial/unlocked write."""
+    if la.fcntl is None:
+        return  # POSIX-only path exercised here; Windows CI (if any) skips this specific check
+    path = str(tmp_path / "contended.jsonl")
+    lock_path = la._lock_path(path)
+    la._ensure_lock_file(lock_path)
+    held_fh = open(lock_path, "a+b")
+    la.fcntl.flock(held_fh.fileno(), la.fcntl.LOCK_EX)
+    try:
+        ok = la.locked_append_line(path, json.dumps({"should": "not-write"}), timeout_ms=80)
+        assert ok is False
+        assert not os.path.exists(path), "a timed-out lock must never write, not even partially"
+    finally:
+        la.fcntl.flock(held_fh.fileno(), la.fcntl.LOCK_UN)
+        held_fh.close()
+    # once the lock is free again, a normal call succeeds
+    assert la.locked_append_line(path, json.dumps({"now": "ok"})) is True
+
+
+def test_count_jsonl_lines_valid_only(tmp_path):
+    path = tmp_path / "clean.jsonl"
+    path.write_text('{"a":1}\n{"a":2}\n{"a":3}\n', encoding="utf-8")
+    valid, corrupt = la.count_jsonl_lines(str(path))
+    assert (valid, corrupt) == (3, 0)
+
+
+def test_count_jsonl_lines_counts_corrupt_without_raising(tmp_path):
+    path = tmp_path / "dirty.jsonl"
+    path.write_text('{"a":1}\n{"a":2\nnot json at all\n{"a":3}\n', encoding="utf-8")
+    valid, corrupt = la.count_jsonl_lines(str(path))
+    assert valid == 2
+    assert corrupt == 2
+
+
+def test_count_jsonl_lines_missing_file_is_zero_zero(tmp_path):
+    assert la.count_jsonl_lines(str(tmp_path / "nope.jsonl")) == (0, 0)
+
+
+def test_count_jsonl_lines_ignores_blank_lines(tmp_path):
+    path = tmp_path / "blanks.jsonl"
+    path.write_text('{"a":1}\n\n\n{"a":2}\n', encoding="utf-8")
+    assert la.count_jsonl_lines(str(path)) == (2, 0)
+
+
+# ── concurrency (K real processes) ──────────────────────────────────────────────────────────
+
+
+def _worker(path, worker_id, m):
+    """Top-level, picklable worker body — runs in its OWN OS process."""
+    scripts_dir = os.path.join(REPO, "scripts")
+    if scripts_dir not in sys.path:
+        sys.path.insert(0, scripts_dir)
+    from _locked_append import locked_append_line
+
+    for i in range(m):
+        rec = {
+            "worker": worker_id,
+            "seq": i,
+            "iteration": worker_id * 1000 + i,
+            "action": "concurrent-write",
+            "gate": "pass",
+            "ts": time.time(),
+        }
+        ok = locked_append_line(path, json.dumps(rec))
+        if not ok:
+            raise RuntimeError("worker %d: lock acquisition failed on write %d" % (worker_id, i))
+
+
+def test_k_processes_m_lines_all_valid_json_no_loss(tmp_path):
+    journal = str(tmp_path / "journal.jsonl")
+    procs = []
+    for w in range(K_WORKERS):
+        p = multiprocessing.Process(target=_worker, args=(journal, w, M_LINES))
+        p.start()
+        procs.append(p)
+    for p in procs:
+        p.join(timeout=90)
+        assert p.exitcode == 0, (
+            "worker process %s failed or timed out (exitcode=%s)" % (p.pid, p.exitcode)
+        )
+
+    with open(journal, encoding="utf-8") as f:
+        lines = [ln for ln in f if ln.strip()]
+
+    expected = K_WORKERS * M_LINES
+    assert len(lines) == expected, (
+        "expected %d lines, got %d — a write was lost under concurrency" % (expected, len(lines))
+    )
+
+    seen = set()
+    for ln in lines:
+        rec = json.loads(ln)  # raises ValueError if this line is torn/interleaved — that IS the
+        # regression this test guards against (#127): an unlocked writer can corrupt a line.
+        seen.add((rec["worker"], rec["seq"]))
+    assert len(seen) == expected, "duplicate or garbled records survived under concurrency"
+
+    valid, corrupt = la.count_jsonl_lines(journal)
+    assert (valid, corrupt) == (expected, 0)
+
+
+if __name__ == "__main__":
+    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+    from _selfrun import run_module
+    run_module(globals(), "test_locked_append")