specfuse-loop 0.28.0__tar.gz → 0.28.1__tar.gz

{specfuse_loop-0.28.0/specfuse_loop.egg-info → specfuse_loop-0.28.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfuse-loop
-Version: 0.28.0
+Version: 0.28.1
 Summary: Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology.
 Author: Specfuse contributors
 License: Apache-2.0

{specfuse_loop-0.28.0 → specfuse_loop-0.28.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specfuse-loop"
-version = "0.28.0"
+version = "0.28.1"
 description = "Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology."
 readme = "README.md"
 requires-python = ">=3.10"

{specfuse_loop-0.28.0 → specfuse_loop-0.28.1}/specfuse/agent/severity_backfill.py

@@ -46,9 +46,6 @@ from specfuse.loop.labels import (
 from specfuse.loop import agent_policy, triage
 from specfuse.loop.build_provenance import warn_if_out_of_tree
 
-#: Stands in for T10's classification session (gate 3, walking skeleton).
-_STUB_SEVERITY = "medium"
-
 
 def _default_runner(argv: list, check: bool = False):
     return subprocess.run(argv, check=check, capture_output=True, text=True)

specfuse_loop-0.28.1/specfuse/loop/data/VERSION

@@ -0,0 +1 @@
+0.28.1

{specfuse_loop-0.28.0 → specfuse_loop-0.28.1}/specfuse/loop/loop.py

@@ -127,7 +127,7 @@ SPECFUSE_DIR = Path(".specfuse")
 REPO_ROOT = SPECFUSE_DIR.parent
 FEATURES_DIR = SPECFUSE_DIR / "features"
 VERIFICATION_PATH = SPECFUSE_DIR / "verification.yml"
-DRIVER_VERSION = "0.28.0"
+DRIVER_VERSION = "0.28.1"
 # Oldest scaffold layout this driver can drive. init.sh stamps the scaffold's own
 # version into `.specfuse/VERSION`; check_scaffold_version() fails loud at startup if
 # the consumer's scaffold is older than this, pointing at `specfuse upgrade`. Bump

{specfuse_loop-0.28.0 → specfuse_loop-0.28.1}/specfuse/monitor/cli.py

@@ -241,7 +241,16 @@ def _default_transport_resolver(module, check_type: str, binding: Mapping[str, o
     )
 
 
-def _build_adapter(cls, *, component: str, environment: Mapping[str, object], check: Mapping[str, object], transport, now: datetime):
+def _build_adapter(
+    cls,
+    *,
+    component: str,
+    environment: Mapping[str, object],
+    check: Mapping[str, object],
+    transport,
+    now: datetime,
+    since: Optional[datetime] = None,
+):
     kwargs = dict(
         component=component,
         environment=environment,
@@ -255,6 +264,10 @@ def _build_adapter(cls, *, component: str, environment: Mapping[str, object], ch
         deploy_signal=check.get("deploy_signal"),
         window_after_deploy=check.get("window_after_deploy"),
         codes=check.get("codes"),
+        # The harvest window (#3480): adapters that read event history
+        # accept it; those that need older history by design do not.
+        since=since,
+        until=now if since is not None else None,
     )
     return _call_filtered(cls, **kwargs)
 
@@ -266,6 +279,7 @@ def _process_check(
     environment: Mapping[str, object],
     transport_resolver: Callable,
     now: datetime,
+    since: Optional[datetime] = None,
 ):
     check_type = check.get("type")
     if check_type not in CHECK_TYPES:
@@ -290,7 +304,13 @@ def _process_check(
     adapter_cls = _find_adapter_class(module, check_type)
     transport = transport_resolver(module, check_type, binding)
     adapter = _build_adapter(
-        adapter_cls, component=component_name, environment=environment, check=check, transport=transport, now=now
+        adapter_cls,
+        component=component_name,
+        environment=environment,
+        check=check,
+        transport=transport,
+        now=now,
+        since=since,
     )
     artifacts = list(adapter.fetch_failures())
     skipped = list(getattr(adapter, "skipped_targets", []))
@@ -454,8 +474,10 @@ def run_cycle(
 
     summary: list = []
     total_findings = 0
+    any_errored = False
 
     for env_name in sorted(selected_envs):
+        env_errored = False
         environment = selected_envs[env_name]
         watermark_path = watermark_dir / f"{env_name}.json"
         since, fallback_reason = _read_watermark(watermark_path, lookback=lookback, now=now)
@@ -487,13 +509,27 @@ def run_cycle(
             findings: list = []
             skipped: list = []
             for check in component.get("checks") or []:
-                artifacts, check_skipped = _process_check(
-                    check=check,
-                    component=component,
-                    environment=environment,
-                    transport_resolver=transport_resolver,
-                    now=now,
-                )
+                # #3478: one check's failure — a provider SDK error, a missing
+                # credential, a permission the running identity lacks — must
+                # not blind every other check in the run. Report it, keep the
+                # environment's watermark where it was so the window is
+                # retried, and exit non-zero once the summary is printed.
+                try:
+                    artifacts, check_skipped = _process_check(
+                        check=check,
+                        component=component,
+                        environment=environment,
+                        transport_resolver=transport_resolver,
+                        now=now,
+                        since=since,
+                    )
+                except Exception as exc:  # noqa: BLE001 — isolation is the point
+                    env_errored = True
+                    summary.append(
+                        f"{env_name}/{component_name}: check {check.get('type')} errored — "
+                        f"{type(exc).__name__}: {exc}"
+                    )
+                    continue
                 findings.extend(artifacts)
                 skipped.extend(check_skipped)
 
@@ -528,14 +564,20 @@ def run_cycle(
                     f"{getattr(skip, 'reason', 'unknown reason')}"
                 )
 
-        if not dry_run:
+        if env_errored:
+            any_errored = True
+            summary.append(
+                f"environment {env_name}: watermark not advanced — a check errored; "
+                "its window is retried next cycle"
+            )
+        elif not dry_run:
             _write_watermark(watermark_path, now=now)
 
     summary.append(f"total: {total_findings} finding(s) across {len(selected_components)} component(s)")
     for line in summary:
         print(line, file=out)
 
-    return 0
+    return 1 if any_errored else 0
 
 
 # ---------------------------------------------------------------------------

{specfuse_loop-0.28.0 → specfuse_loop-0.28.1}/specfuse/monitor/providers/azure_app_insights.py

@@ -69,7 +69,29 @@ class AppInsightsTransport(Protocol):
         ...
 
 
-def _error_logs_query(component: str) -> str:
+def _kql_datetime(moment: datetime) -> str:
+    """A KQL ``datetime()`` literal at full precision. ``moment`` comes from
+    the harvester's own clock or watermark file, never from a returned row."""
+    text = moment.astimezone(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.%fZ")
+    return f"datetime({text})"
+
+
+def _harvest_window(since: Optional[datetime], until: Optional[datetime]) -> str:
+    """The harvest-window predicate (#3480), or nothing when no window was
+    given. Bounded on ``ingestion_time()`` rather than ``TimeGenerated`` so a
+    row stamped before the previous run but ingested after it is read by the
+    next run instead of falling between two windows."""
+    if since is None or until is None:
+        return ""
+    return (
+        f"| where ingestion_time() >= {_kql_datetime(since)} "
+        f"and ingestion_time() < {_kql_datetime(until)} "
+    )
+
+
+def _error_logs_query(
+    component: str, since: Optional[datetime] = None, until: Optional[datetime] = None
+) -> str:
     """Built only from *component*, an operator-configured name — never from
     a telemetry query's returned rows.
 
@@ -81,16 +103,20 @@ def _error_logs_query(component: str) -> str:
     return (
         "AppExceptions "
         f"| where AppRoleName == '{component}' "
+        f"{_harvest_window(since, until)}"
         "| project timestamp = TimeGenerated, operation_Id = OperationId, "
         "operation_ParentId = ParentId, type = ExceptionType, "
         "outerMessage = OuterMessage"
     )
 
 
-def _http_5xx_query(component: str) -> str:
+def _http_5xx_query(
+    component: str, since: Optional[datetime] = None, until: Optional[datetime] = None
+) -> str:
     return (
         "AppRequests "
         f"| where AppRoleName == '{component}' and ResultCode startswith '5' "
+        f"{_harvest_window(since, until)}"
         "| project timestamp = TimeGenerated, operation_Id = OperationId, "
         "name = Name, resultCode = ResultCode"
     )
@@ -105,13 +131,17 @@ class ErrorLogsAdapter:
         component: str,
         environment: Mapping[str, object],
         transport: AppInsightsTransport,
+        since: Optional[datetime] = None,
+        until: Optional[datetime] = None,
     ) -> None:
         self._component = component
         self._telemetry = resolve_telemetry(component, environment)
         self._transport = transport
+        self._since = since
+        self._until = until
 
     def fetch_failures(self) -> Iterator[FailureArtifact]:
-        query = _error_logs_query(self._component)
+        query = _error_logs_query(self._component, self._since, self._until)
         rows = self._transport.run_query(query)
         for row in rows:
             yield self._build_artifact(row)
@@ -140,13 +170,17 @@ class Http5xxAdapter:
         component: str,
         environment: Mapping[str, object],
         transport: AppInsightsTransport,
+        since: Optional[datetime] = None,
+        until: Optional[datetime] = None,
     ) -> None:
         self._component = component
         self._telemetry = resolve_telemetry(component, environment)
         self._transport = transport
+        self._since = since
+        self._until = until
 
     def fetch_failures(self) -> Iterator[FailureArtifact]:
-        query = _http_5xx_query(self._component)
+        query = _http_5xx_query(self._component, self._since, self._until)
         rows = self._transport.run_query(query)
         for row in rows:
             yield self._build_artifact(row)

{specfuse_loop-0.28.0 → specfuse_loop-0.28.1/specfuse_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfuse-loop
-Version: 0.28.0
+Version: 0.28.1
 Summary: Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology.
 Author: Specfuse contributors
 License: Apache-2.0

{specfuse_loop-0.28.0 → specfuse_loop-0.28.1}/specfuse_loop.egg-info/SOURCES.txt

@@ -182,6 +182,7 @@ tests/test_agent_snapshot_refresh.py
 tests/test_agent_state.py
 tests/test_answer_escalation_skill.py
 tests/test_app_insights_adapters.py
+tests/test_app_insights_harvest_window.py
 tests/test_app_insights_query_schema_check.py
 tests/test_app_insights_workspace_schema.py
 tests/test_archive_ref_reconciliation.py
@@ -482,6 +483,7 @@ tests/test_max_open_prs.py
 tests/test_migrate_legacy.py
 tests/test_miniyaml_equivalence.py
 tests/test_miniyaml_negative.py
+tests/test_monitor_check_isolation.py
 tests/test_monitor_cli.py
 tests/test_monitor_durations.py
 tests/test_monitor_issue_lifecycle.py

specfuse_loop-0.28.1/tests/test_app_insights_harvest_window.py

@@ -0,0 +1,132 @@
+# Copyright 2026 Specfuse Contributors
+# Licensed under the Apache License, Version 2.0. See LICENSE.
+"""#3480: the App Insights `error-logs` and `http-5xx` checks must read only
+the harvest window `run_cycle` computes — from the environment's watermark,
+or `now - lookback` without one — not the workspace's whole retention.
+
+The window is bounded on `ingestion_time()`, not `TimeGenerated`: a row
+stamped just before the previous run but ingested after it is still picked
+up by the next run instead of being skipped forever. `heartbeat` and
+`http-status-regression` are deliberately not bounded by it: one needs the
+last heartbeat however old, the other compares windows around a deployment.
+"""
+
+from __future__ import annotations
+
+import io
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import specfuse.monitor.cli as cli
+
+_NOW = datetime(2026, 10, 16, 10, 0, 0, 123456, tzinfo=timezone.utc)
+_ENVIRONMENT = {
+    "telemetry": {"provider": "azure_app_insights", "credentials": {"api_key": "ACME_API_KEY"}},
+}
+
+
+def _config(checks):
+    return {
+        "environments": {"production": _ENVIRONMENT},
+        "components": [{
+            "name": "web-api",
+            "type": "api",
+            "runner": "local",
+            "diagnose": "manual",
+            "autofix": "off",
+            "checks": checks,
+        }],
+    }
+
+
+class _Recorder:
+    def __init__(self):
+        self.queries: dict[str, str] = {}
+
+    def resolver(self, module, check_type, binding):
+        recorder = self
+
+        class _Transport:
+            def run_query(self, query):
+                recorder.queries[check_type] = query
+                return []
+
+        return _Transport()
+
+
+_BOUNDED = [{"type": "error-logs"}, {"type": "http-5xx"}]
+
+
+class TestTelemetryQueriesAreBoundedToTheHarvestWindow(unittest.TestCase):
+    def setUp(self):
+        self._tmpdir = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmpdir.cleanup)
+        self.watermark_dir = Path(self._tmpdir.name)
+
+    def _run(self, checks):
+        recorder = _Recorder()
+        cli.run_cycle(
+            _config(checks),
+            dry_run=True,
+            transport_resolver=recorder.resolver,
+            now=_NOW,
+            watermark_dir=self.watermark_dir,
+            out=io.StringIO(),
+        )
+        return recorder.queries
+
+    def _window(self, since):
+        return (
+            f"| where ingestion_time() >= datetime({since}) "
+            f"and ingestion_time() < datetime(2026-10-16T10:00:00.123456Z)"
+        )
+
+    def test_no_watermark_bounds_to_the_lookback(self):
+        queries = self._run(_BOUNDED)
+        since = "2026-10-15T10:00:00.123456Z"  # _NOW - DEFAULT_LOOKBACK (24h)
+        for check_type in ("error-logs", "http-5xx"):
+            with self.subTest(check_type=check_type):
+                self.assertIn(self._window(since), queries[check_type])
+
+    def test_watermark_bounds_to_the_previous_run(self):
+        previous = _NOW - timedelta(minutes=15)
+        cli._write_watermark(self.watermark_dir / "production.json", now=previous)
+        queries = self._run(_BOUNDED)
+        for check_type in ("error-logs", "http-5xx"):
+            with self.subTest(check_type=check_type):
+                self.assertIn(self._window("2026-10-16T09:45:00.123456Z"), queries[check_type])
+
+    def test_window_filter_follows_the_table_scope(self):
+        # Bounded before projection, so the predicate reads the source table.
+        query = self._run([{"type": "error-logs"}])["error-logs"]
+        self.assertLess(query.index("ingestion_time()"), query.index("| project"))
+
+    def test_heartbeat_and_status_regression_are_not_window_bounded(self):
+        queries = self._run([
+            {"type": "heartbeat", "targets": [
+                {"name": "nightly", "cron": "0 2 * * *", "dialect": "standard-5", "timezone": "Etc/UTC"},
+            ]},
+            {"type": "http-status-regression", "deploy_signal": {"kind": "app-version"},
+             "window_after_deploy": "1h"},
+        ])
+        for check_type in ("heartbeat", "http-status-regression"):
+            with self.subTest(check_type=check_type):
+                self.assertNotIn("ingestion_time()", queries[check_type])
+
+
+class TestBoundedQueriesMatchWorkspaceSchema(unittest.TestCase):
+    def test_bounded_queries_use_only_workspace_names(self):
+        from specfuse.monitor.providers import azure_app_insights as aai
+        from tests.test_app_insights_query_schema_check import schema_violations
+
+        since, until = _NOW - timedelta(hours=1), _NOW
+        for build in (aai._error_logs_query, aai._http_5xx_query):
+            with self.subTest(build=build.__name__):
+                query = build("backend-api", since, until)
+                self.assertEqual(schema_violations(query), [], query)
+
+
+if __name__ == "__main__":
+    unittest.main()

specfuse_loop-0.28.1/tests/test_monitor_check_isolation.py

@@ -0,0 +1,178 @@
+# Copyright 2026 Specfuse Contributors
+# Licensed under the Apache License, Version 2.0. See LICENSE.
+"""#3478: one failing check must not abort the whole `specfuse monitor run`
+cycle. Each check is isolated: its error is reported in the summary, the
+other checks still run and file, the environment's watermark is not advanced
+(so the failed window is retried), and the run exits non-zero."""
+
+from __future__ import annotations
+
+import io
+import tempfile
+import unittest
+from datetime import datetime, timezone
+from pathlib import Path
+from types import SimpleNamespace
+
+import specfuse.monitor.cli as cli
+
+_NOW = datetime(2026, 10, 16, 10, 0, 0, tzinfo=timezone.utc)
+_REPO = "acme-widget/repo"
+_ENVIRONMENT = {
+    "telemetry": {"provider": "azure_app_insights", "credentials": {"api_key": "ACME_API_KEY"}},
+    "broker": {"provider": "azure_service_bus", "credentials": {"connection_string": "ACME_CONN"}},
+}
+
+
+class HttpResponseError(Exception):
+    """Stands in for `azure.core.exceptions.HttpResponseError`: any provider
+    SDK exception that is not a `MonitorCliError`."""
+
+
+def _component(name, checks):
+    return {
+        "name": name,
+        "type": "api",
+        "runner": "local",
+        "diagnose": "manual",
+        "autofix": "off",
+        "checks": checks,
+    }
+
+
+def _config():
+    # order-worker: error-logs succeeds, http-5xx fails; web-api is processed
+    # after the failing check and must still be checked.
+    return {
+        "environments": {"production": _ENVIRONMENT},
+        "components": [
+            _component("order-worker", [{"type": "http-5xx"}, {"type": "error-logs"}]),
+            _component("web-api", [{"type": "error-logs"}]),
+        ],
+    }
+
+
+class _Transport:
+    def __init__(self, rows=None, error=None):
+        self._rows = rows or []
+        self._error = error
+
+    def run_query(self, query):
+        if self._error is not None:
+            raise self._error
+        return list(self._rows)
+
+
+_ERROR_ROWS = [{"type": "NullReferenceException", "outerMessage": "boom at line 5"}]
+
+
+def _failing_resolver(module, check_type, binding):
+    if check_type == "http-5xx":
+        return _Transport(error=HttpResponseError(
+            "Failed to resolve table or column expression named 'requests'"
+        ))
+    return _Transport(rows=_ERROR_ROWS)
+
+
+def _clean_resolver(module, check_type, binding):
+    return _Transport(rows=_ERROR_ROWS if check_type == "error-logs" else [])
+
+
+class _GhRecorder:
+    def __init__(self):
+        self.created = 0
+
+    def __call__(self, args, check=True):
+        if args[:3] == ["gh", "issue", "list"]:
+            return SimpleNamespace(returncode=0, stdout="[]", stderr="")
+        if args[:3] == ["gh", "issue", "create"]:
+            self.created += 1
+            return SimpleNamespace(
+                returncode=0, stdout=f"https://github.com/{_REPO}/issues/{self.created}\n", stderr=""
+            )
+        raise AssertionError(f"unexpected gh call: {args}")
+
+
+class TestOneFailingCheckIsIsolated(unittest.TestCase):
+    def setUp(self):
+        self._tmpdir = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmpdir.cleanup)
+        self.watermark_dir = Path(self._tmpdir.name)
+
+    def _run(self, resolver, gh=None):
+        out = io.StringIO()
+        gh = gh or _GhRecorder()
+        code = cli.run_cycle(
+            _config(),
+            dry_run=False,
+            repo=_REPO,
+            transport_resolver=resolver,
+            gh_runner=gh,
+            now=_NOW,
+            watermark_dir=self.watermark_dir,
+            out=out,
+        )
+        return code, out.getvalue(), gh
+
+    def test_other_checks_still_run_and_file(self):
+        _, output, gh = self._run(_failing_resolver)
+        # error-logs on order-worker (same component, after the failure) and
+        # on web-api (the next component) both filed.
+        self.assertEqual(gh.created, 2)
+        self.assertIn("production/order-worker: 1 finding(s)", output)
+        self.assertIn("production/web-api: 1 finding(s)", output)
+        self.assertIn("total: 2 finding(s)", output)
+
+    def test_error_is_reported_in_the_summary(self):
+        _, output, _ = self._run(_failing_resolver)
+        self.assertIn(
+            "production/order-worker: check http-5xx errored — HttpResponseError: "
+            "Failed to resolve table or column expression named 'requests'",
+            output,
+        )
+
+    def test_run_exits_non_zero(self):
+        code, _, _ = self._run(_failing_resolver)
+        self.assertEqual(code, 1)
+
+    def test_watermark_is_not_advanced_for_the_environment(self):
+        self._run(_failing_resolver)
+        self.assertFalse((self.watermark_dir / "production.json").exists())
+
+    def test_setup_error_inside_one_check_is_isolated_too(self):
+        def resolver(module, check_type, binding):
+            if check_type == "http-5xx":
+                raise cli.MonitorCliError("credential env var 'ACME_API_KEY' is not set")
+            return _Transport(rows=_ERROR_ROWS)
+
+        code, output, gh = self._run(resolver)
+        self.assertEqual(code, 1)
+        self.assertEqual(gh.created, 2)
+        self.assertIn(
+            "production/order-worker: check http-5xx errored — MonitorCliError: "
+            "credential env var 'ACME_API_KEY' is not set",
+            output,
+        )
+
+    def test_clean_run_exits_zero_and_advances_the_watermark(self):
+        code, output, gh = self._run(_clean_resolver)
+        self.assertEqual(code, 0)
+        self.assertEqual(gh.created, 2)
+        self.assertNotIn("errored", output)
+        self.assertTrue((self.watermark_dir / "production.json").exists())
+
+    def test_run_level_errors_stay_fatal(self):
+        with self.assertRaises(cli.MonitorCliError):
+            cli.run_cycle(
+                _config(),
+                env_filter="staging",
+                dry_run=True,
+                transport_resolver=_clean_resolver,
+                now=_NOW,
+                watermark_dir=self.watermark_dir,
+                out=io.StringIO(),
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()

specfuse_loop-0.28.0/specfuse/loop/data/VERSION

@@ -1 +0,0 @@
-0.28.0