specfuse-loop 0.28.0__tar.gz → 0.28.2__tar.gz

{specfuse_loop-0.28.0/specfuse_loop.egg-info → specfuse_loop-0.28.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfuse-loop
-Version: 0.28.0
+Version: 0.28.2
 Summary: Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology.
 Author: Specfuse contributors
 License: Apache-2.0

{specfuse_loop-0.28.0 → specfuse_loop-0.28.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specfuse-loop"
-version = "0.28.0"
+version = "0.28.2"
 description = "Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology."
 readme = "README.md"
 requires-python = ">=3.10"

{specfuse_loop-0.28.0 → specfuse_loop-0.28.2}/specfuse/agent/severity_backfill.py

@@ -46,9 +46,6 @@ from specfuse.loop.labels import (
 from specfuse.loop import agent_policy, triage
 from specfuse.loop.build_provenance import warn_if_out_of_tree
 
-#: Stands in for T10's classification session (gate 3, walking skeleton).
-_STUB_SEVERITY = "medium"
-
 
 def _default_runner(argv: list, check: bool = False):
     return subprocess.run(argv, check=check, capture_output=True, text=True)

specfuse_loop-0.28.2/specfuse/loop/data/VERSION

@@ -0,0 +1 @@
+0.28.2

{specfuse_loop-0.28.0 → specfuse_loop-0.28.2}/specfuse/loop/loop.py

@@ -127,7 +127,7 @@ SPECFUSE_DIR = Path(".specfuse")
 REPO_ROOT = SPECFUSE_DIR.parent
 FEATURES_DIR = SPECFUSE_DIR / "features"
 VERIFICATION_PATH = SPECFUSE_DIR / "verification.yml"
-DRIVER_VERSION = "0.28.0"
+DRIVER_VERSION = "0.28.2"
 # Oldest scaffold layout this driver can drive. init.sh stamps the scaffold's own
 # version into `.specfuse/VERSION`; check_scaffold_version() fails loud at startup if
 # the consumer's scaffold is older than this, pointing at `specfuse upgrade`. Bump

{specfuse_loop-0.28.0 → specfuse_loop-0.28.2}/specfuse/monitor/cli.py

@@ -241,7 +241,16 @@ def _default_transport_resolver(module, check_type: str, binding: Mapping[str, o
     )
 
 
-def _build_adapter(cls, *, component: str, environment: Mapping[str, object], check: Mapping[str, object], transport, now: datetime):
+def _build_adapter(
+    cls,
+    *,
+    component: str,
+    environment: Mapping[str, object],
+    check: Mapping[str, object],
+    transport,
+    now: datetime,
+    since: Optional[datetime] = None,
+):
     kwargs = dict(
         component=component,
         environment=environment,
@@ -255,6 +264,10 @@ def _build_adapter(cls, *, component: str, environment: Mapping[str, object], ch
         deploy_signal=check.get("deploy_signal"),
         window_after_deploy=check.get("window_after_deploy"),
         codes=check.get("codes"),
+        # The harvest window (#3480): adapters that read event history
+        # accept it; those that need older history by design do not.
+        since=since,
+        until=now if since is not None else None,
     )
     return _call_filtered(cls, **kwargs)
 
@@ -266,6 +279,7 @@ def _process_check(
     environment: Mapping[str, object],
     transport_resolver: Callable,
     now: datetime,
+    since: Optional[datetime] = None,
 ):
     check_type = check.get("type")
     if check_type not in CHECK_TYPES:
@@ -290,7 +304,13 @@ def _process_check(
     adapter_cls = _find_adapter_class(module, check_type)
     transport = transport_resolver(module, check_type, binding)
     adapter = _build_adapter(
-        adapter_cls, component=component_name, environment=environment, check=check, transport=transport, now=now
+        adapter_cls,
+        component=component_name,
+        environment=environment,
+        check=check,
+        transport=transport,
+        now=now,
+        since=since,
     )
     artifacts = list(adapter.fetch_failures())
     skipped = list(getattr(adapter, "skipped_targets", []))
@@ -437,6 +457,10 @@ def run_cycle(
     out = out if out is not None else sys.stdout
     now = now if now is not None else datetime.now(timezone.utc)
     gh_runner = gh_runner if gh_runner is not None else _default_runner
+    # Fingerprints already handed to `record_finding` this cycle (#3486): the
+    # `gh issue list` lookup can lag an issue created moments earlier, so a
+    # repeated fingerprint must not reach it twice.
+    filed_fingerprints: set = set()
 
     environments = config.get("environments") or {}
     components = config.get("components") or []
@@ -454,8 +478,10 @@ def run_cycle(
 
     summary: list = []
     total_findings = 0
+    any_errored = False
 
     for env_name in sorted(selected_envs):
+        env_errored = False
         environment = selected_envs[env_name]
         watermark_path = watermark_dir / f"{env_name}.json"
         since, fallback_reason = _read_watermark(watermark_path, lookback=lookback, now=now)
@@ -487,13 +513,27 @@ def run_cycle(
             findings: list = []
             skipped: list = []
             for check in component.get("checks") or []:
-                artifacts, check_skipped = _process_check(
-                    check=check,
-                    component=component,
-                    environment=environment,
-                    transport_resolver=transport_resolver,
-                    now=now,
-                )
+                # #3478: one check's failure — a provider SDK error, a missing
+                # credential, a permission the running identity lacks — must
+                # not blind every other check in the run. Report it, keep the
+                # environment's watermark where it was so the window is
+                # retried, and exit non-zero once the summary is printed.
+                try:
+                    artifacts, check_skipped = _process_check(
+                        check=check,
+                        component=component,
+                        environment=environment,
+                        transport_resolver=transport_resolver,
+                        now=now,
+                        since=since,
+                    )
+                except Exception as exc:  # noqa: BLE001 — isolation is the point
+                    env_errored = True
+                    summary.append(
+                        f"{env_name}/{component_name}: check {check.get('type')} errored — "
+                        f"{type(exc).__name__}: {exc}"
+                    )
+                    continue
                 findings.extend(artifacts)
                 skipped.extend(check_skipped)
 
@@ -504,9 +544,13 @@ def run_cycle(
                 for artifact in findings:
                     summary.append(f"  would file: {_describe(artifact)}")
             else:
-                created = updated = throttled = 0
+                created = updated = throttled = repeats = 0
                 for artifact in findings:
                     fingerprint = fingerprint_artifact(artifact)
+                    if fingerprint in filed_fingerprints:
+                        repeats += 1
+                        continue
+                    filed_fingerprints.add(fingerprint)
                     recorder = _CallRecorder(gh_runner)
                     record_finding(fingerprint, artifact, repo, runner=recorder, now=now.timestamp())
                     outcome = _classify(recorder)
@@ -516,10 +560,13 @@ def run_cycle(
                         updated += 1
                     else:
                         throttled += 1
-                summary.append(
+                line = (
                     f"{env_name}/{component_name}: {len(findings)} finding(s) — "
                     f"created {created}, updated {updated}, throttled {throttled}"
                 )
+                if repeats:
+                    line += f", {repeats} repeat(s) of an already-filed fingerprint"
+                summary.append(line)
 
             for skip in skipped:
                 summary.append(
@@ -528,14 +575,20 @@ def run_cycle(
                     f"{getattr(skip, 'reason', 'unknown reason')}"
                 )
 
-        if not dry_run:
+        if env_errored:
+            any_errored = True
+            summary.append(
+                f"environment {env_name}: watermark not advanced — a check errored; "
+                "its window is retried next cycle"
+            )
+        elif not dry_run:
             _write_watermark(watermark_path, now=now)
 
     summary.append(f"total: {total_findings} finding(s) across {len(selected_components)} component(s)")
     for line in summary:
         print(line, file=out)
 
-    return 0
+    return 1 if any_errored else 0
 
 
 # ---------------------------------------------------------------------------

{specfuse_loop-0.28.0 → specfuse_loop-0.28.2}/specfuse/monitor/diagnose_cli.py

@@ -19,6 +19,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import re
 import sys
 from typing import Any
 
@@ -37,6 +38,19 @@ class AnalysisParseError(ValueError):
     """
 
 
+#: One markdown code fence around the whole result, optionally tagged `json`.
+#: Headless sessions asked for "exactly one JSON object" still fence it often
+#: (#3489); anything outside the fence stays a parse error.
+_FENCE_RE = re.compile(r"\A\s*```(?:json)?[ \t]*\n(?P<body>.*?)\n```\s*\Z", re.DOTALL)
+
+
+def _strip_fence(raw: str) -> str:
+    match = _FENCE_RE.match(raw)
+    if match is None or "```" in match.group("body"):
+        return raw
+    return match.group("body")
+
+
 def parse_analysis(raw: str) -> Diagnosis:
     """Parse an analysis-step result (JSON text) into a `Diagnosis`.
 
@@ -45,7 +59,7 @@ def parse_analysis(raw: str) -> Diagnosis:
     required field, or a `fix_scope` outside `FIX_SCOPES`.
     """
     try:
-        data: Any = json.loads(raw)
+        data: Any = json.loads(_strip_fence(raw))
     except json.JSONDecodeError as exc:
         raise AnalysisParseError(f"analysis result is not valid JSON: {exc}") from exc
 

{specfuse_loop-0.28.0 → specfuse_loop-0.28.2}/specfuse/monitor/providers/azure_app_insights.py

@@ -69,7 +69,29 @@ class AppInsightsTransport(Protocol):
         ...
 
 
-def _error_logs_query(component: str) -> str:
+def _kql_datetime(moment: datetime) -> str:
+    """A KQL ``datetime()`` literal at full precision. ``moment`` comes from
+    the harvester's own clock or watermark file, never from a returned row."""
+    text = moment.astimezone(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.%fZ")
+    return f"datetime({text})"
+
+
+def _harvest_window(since: Optional[datetime], until: Optional[datetime]) -> str:
+    """The harvest-window predicate (#3480), or nothing when no window was
+    given. Bounded on ``ingestion_time()`` rather than ``TimeGenerated`` so a
+    row stamped before the previous run but ingested after it is read by the
+    next run instead of falling between two windows."""
+    if since is None or until is None:
+        return ""
+    return (
+        f"| where ingestion_time() >= {_kql_datetime(since)} "
+        f"and ingestion_time() < {_kql_datetime(until)} "
+    )
+
+
+def _error_logs_query(
+    component: str, since: Optional[datetime] = None, until: Optional[datetime] = None
+) -> str:
     """Built only from *component*, an operator-configured name — never from
     a telemetry query's returned rows.
 
@@ -81,16 +103,20 @@ def _error_logs_query(component: str) -> str:
     return (
         "AppExceptions "
         f"| where AppRoleName == '{component}' "
+        f"{_harvest_window(since, until)}"
         "| project timestamp = TimeGenerated, operation_Id = OperationId, "
         "operation_ParentId = ParentId, type = ExceptionType, "
         "outerMessage = OuterMessage"
     )
 
 
-def _http_5xx_query(component: str) -> str:
+def _http_5xx_query(
+    component: str, since: Optional[datetime] = None, until: Optional[datetime] = None
+) -> str:
     return (
         "AppRequests "
         f"| where AppRoleName == '{component}' and ResultCode startswith '5' "
+        f"{_harvest_window(since, until)}"
         "| project timestamp = TimeGenerated, operation_Id = OperationId, "
         "name = Name, resultCode = ResultCode"
     )
@@ -105,13 +131,17 @@ class ErrorLogsAdapter:
         component: str,
         environment: Mapping[str, object],
         transport: AppInsightsTransport,
+        since: Optional[datetime] = None,
+        until: Optional[datetime] = None,
     ) -> None:
         self._component = component
         self._telemetry = resolve_telemetry(component, environment)
         self._transport = transport
+        self._since = since
+        self._until = until
 
     def fetch_failures(self) -> Iterator[FailureArtifact]:
-        query = _error_logs_query(self._component)
+        query = _error_logs_query(self._component, self._since, self._until)
         rows = self._transport.run_query(query)
         for row in rows:
             yield self._build_artifact(row)
@@ -140,13 +170,17 @@ class Http5xxAdapter:
         component: str,
         environment: Mapping[str, object],
         transport: AppInsightsTransport,
+        since: Optional[datetime] = None,
+        until: Optional[datetime] = None,
     ) -> None:
         self._component = component
         self._telemetry = resolve_telemetry(component, environment)
         self._transport = transport
+        self._since = since
+        self._until = until
 
     def fetch_failures(self) -> Iterator[FailureArtifact]:
-        query = _http_5xx_query(self._component)
+        query = _http_5xx_query(self._component, self._since, self._until)
         rows = self._transport.run_query(query)
         for row in rows:
             yield self._build_artifact(row)

{specfuse_loop-0.28.0 → specfuse_loop-0.28.2/specfuse_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfuse-loop
-Version: 0.28.0
+Version: 0.28.2
 Summary: Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology.
 Author: Specfuse contributors
 License: Apache-2.0

{specfuse_loop-0.28.0 → specfuse_loop-0.28.2}/specfuse_loop.egg-info/SOURCES.txt

@@ -182,6 +182,7 @@ tests/test_agent_snapshot_refresh.py
 tests/test_agent_state.py
 tests/test_answer_escalation_skill.py
 tests/test_app_insights_adapters.py
+tests/test_app_insights_harvest_window.py
 tests/test_app_insights_query_schema_check.py
 tests/test_app_insights_workspace_schema.py
 tests/test_archive_ref_reconciliation.py
@@ -294,6 +295,7 @@ tests/test_derive_monitoring_discovery.py
 tests/test_derive_monitoring_skill_registration.py
 tests/test_design_for_diagnosis_rule.py
 tests/test_deterministic_refusal_repeat.py
+tests/test_diagnose_fenced_analysis.py
 tests/test_diagnose_headless.py
 tests/test_diagnose_issue_skill.py
 tests/test_diagnosis.py
@@ -482,9 +484,11 @@ tests/test_max_open_prs.py
 tests/test_migrate_legacy.py
 tests/test_miniyaml_equivalence.py
 tests/test_miniyaml_negative.py
+tests/test_monitor_check_isolation.py
 tests/test_monitor_cli.py
 tests/test_monitor_durations.py
 tests/test_monitor_issue_lifecycle.py
+tests/test_monitor_one_issue_per_fingerprint.py
 tests/test_monitor_runner_surfaces.py
 tests/test_monitoring_bootstrap_artifacts.py
 tests/test_monitoring_cron_dialect.py

specfuse_loop-0.28.2/tests/test_app_insights_harvest_window.py

@@ -0,0 +1,132 @@
+# Copyright 2026 Specfuse Contributors
+# Licensed under the Apache License, Version 2.0. See LICENSE.
+"""#3480: the App Insights `error-logs` and `http-5xx` checks must read only
+the harvest window `run_cycle` computes — from the environment's watermark,
+or `now - lookback` without one — not the workspace's whole retention.
+
+The window is bounded on `ingestion_time()`, not `TimeGenerated`: a row
+stamped just before the previous run but ingested after it is still picked
+up by the next run instead of being skipped forever. `heartbeat` and
+`http-status-regression` are deliberately not bounded by it: one needs the
+last heartbeat however old, the other compares windows around a deployment.
+"""
+
+from __future__ import annotations
+
+import io
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import specfuse.monitor.cli as cli
+
+_NOW = datetime(2026, 10, 16, 10, 0, 0, 123456, tzinfo=timezone.utc)
+_ENVIRONMENT = {
+    "telemetry": {"provider": "azure_app_insights", "credentials": {"api_key": "ACME_API_KEY"}},
+}
+
+
+def _config(checks):
+    return {
+        "environments": {"production": _ENVIRONMENT},
+        "components": [{
+            "name": "web-api",
+            "type": "api",
+            "runner": "local",
+            "diagnose": "manual",
+            "autofix": "off",
+            "checks": checks,
+        }],
+    }
+
+
+class _Recorder:
+    def __init__(self):
+        self.queries: dict[str, str] = {}
+
+    def resolver(self, module, check_type, binding):
+        recorder = self
+
+        class _Transport:
+            def run_query(self, query):
+                recorder.queries[check_type] = query
+                return []
+
+        return _Transport()
+
+
+_BOUNDED = [{"type": "error-logs"}, {"type": "http-5xx"}]
+
+
+class TestTelemetryQueriesAreBoundedToTheHarvestWindow(unittest.TestCase):
+    def setUp(self):
+        self._tmpdir = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmpdir.cleanup)
+        self.watermark_dir = Path(self._tmpdir.name)
+
+    def _run(self, checks):
+        recorder = _Recorder()
+        cli.run_cycle(
+            _config(checks),
+            dry_run=True,
+            transport_resolver=recorder.resolver,
+            now=_NOW,
+            watermark_dir=self.watermark_dir,
+            out=io.StringIO(),
+        )
+        return recorder.queries
+
+    def _window(self, since):
+        return (
+            f"| where ingestion_time() >= datetime({since}) "
+            f"and ingestion_time() < datetime(2026-10-16T10:00:00.123456Z)"
+        )
+
+    def test_no_watermark_bounds_to_the_lookback(self):
+        queries = self._run(_BOUNDED)
+        since = "2026-10-15T10:00:00.123456Z"  # _NOW - DEFAULT_LOOKBACK (24h)
+        for check_type in ("error-logs", "http-5xx"):
+            with self.subTest(check_type=check_type):
+                self.assertIn(self._window(since), queries[check_type])
+
+    def test_watermark_bounds_to_the_previous_run(self):
+        previous = _NOW - timedelta(minutes=15)
+        cli._write_watermark(self.watermark_dir / "production.json", now=previous)
+        queries = self._run(_BOUNDED)
+        for check_type in ("error-logs", "http-5xx"):
+            with self.subTest(check_type=check_type):
+                self.assertIn(self._window("2026-10-16T09:45:00.123456Z"), queries[check_type])
+
+    def test_window_filter_follows_the_table_scope(self):
+        # Bounded before projection, so the predicate reads the source table.
+        query = self._run([{"type": "error-logs"}])["error-logs"]
+        self.assertLess(query.index("ingestion_time()"), query.index("| project"))
+
+    def test_heartbeat_and_status_regression_are_not_window_bounded(self):
+        queries = self._run([
+            {"type": "heartbeat", "targets": [
+                {"name": "nightly", "cron": "0 2 * * *", "dialect": "standard-5", "timezone": "Etc/UTC"},
+            ]},
+            {"type": "http-status-regression", "deploy_signal": {"kind": "app-version"},
+             "window_after_deploy": "1h"},
+        ])
+        for check_type in ("heartbeat", "http-status-regression"):
+            with self.subTest(check_type=check_type):
+                self.assertNotIn("ingestion_time()", queries[check_type])
+
+
+class TestBoundedQueriesMatchWorkspaceSchema(unittest.TestCase):
+    def test_bounded_queries_use_only_workspace_names(self):
+        from specfuse.monitor.providers import azure_app_insights as aai
+        from tests.test_app_insights_query_schema_check import schema_violations
+
+        since, until = _NOW - timedelta(hours=1), _NOW
+        for build in (aai._error_logs_query, aai._http_5xx_query):
+            with self.subTest(build=build.__name__):
+                query = build("backend-api", since, until)
+                self.assertEqual(schema_violations(query), [], query)
+
+
+if __name__ == "__main__":
+    unittest.main()

specfuse_loop-0.28.2/tests/test_diagnose_fenced_analysis.py

@@ -0,0 +1,69 @@
+# Copyright 2026 Specfuse Contributors
+# Licensed under the Apache License, Version 2.0. See LICENSE.
+"""#3489: a headless analysis session often wraps its one JSON object in a
+markdown code fence. `parse_analysis` must read a single surrounding fence as
+the object it holds, and stay strict about everything else.
+"""
+
+from __future__ import annotations
+
+import json
+import unittest
+
+from specfuse.monitor.diagnose_cli import AnalysisParseError, parse_analysis
+
+_PAYLOAD = {
+    "root_cause": "The weekly job last ran before heartbeat emission shipped.",
+    "evidence": "AppRequests show successful runs; no ScheduleHeartbeat before 2026-10-14.",
+    "candidate_fix": "None in the component; wait for the next firing.",
+    "confidence": 0.7,
+    "fix_scope": "external",
+}
+_JSON = json.dumps(_PAYLOAD, indent=2)
+
+
+class TestFencedAnalysisParses(unittest.TestCase):
+    def _assert_parses(self, raw):
+        diagnosis = parse_analysis(raw)
+        self.assertEqual(diagnosis.fix_scope, "external")
+        self.assertEqual(diagnosis.confidence, 0.7)
+        self.assertEqual(diagnosis.root_cause, _PAYLOAD["root_cause"])
+
+    def test_json_fence_parses(self):
+        self._assert_parses(f"```json\n{_JSON}\n```")
+
+    def test_bare_fence_parses(self):
+        self._assert_parses(f"```\n{_JSON}\n```")
+
+    def test_fence_with_surrounding_whitespace_parses(self):
+        self._assert_parses(f"\n\n```json\n{_JSON}\n```\n")
+
+    def test_unfenced_still_parses(self):
+        self._assert_parses(_JSON)
+
+
+class TestStillStrict(unittest.TestCase):
+    def test_prose_before_fence_is_rejected(self):
+        with self.assertRaises(AnalysisParseError):
+            parse_analysis(f"Here is the diagnosis:\n```json\n{_JSON}\n```")
+
+    def test_prose_after_fence_is_rejected(self):
+        with self.assertRaises(AnalysisParseError):
+            parse_analysis(f"```json\n{_JSON}\n```\nLet me know if you need more.")
+
+    def test_two_fenced_objects_are_rejected(self):
+        with self.assertRaises(AnalysisParseError):
+            parse_analysis(f"```json\n{_JSON}\n```\n```json\n{_JSON}\n```")
+
+    def test_unterminated_fence_is_rejected(self):
+        with self.assertRaises(AnalysisParseError):
+            parse_analysis(f"```json\n{_JSON}\n")
+
+    def test_fenced_payload_missing_field_is_rejected(self):
+        partial = {k: v for k, v in _PAYLOAD.items() if k != "fix_scope"}
+        with self.assertRaises(AnalysisParseError):
+            parse_analysis(f"```json\n{json.dumps(partial)}\n```")
+
+
+if __name__ == "__main__":
+    unittest.main()