specsmith 0.11.3.dev427__tar.gz → 0.11.3.dev431__tar.gz

{specsmith-0.11.3.dev427/src/specsmith.egg-info → specsmith-0.11.3.dev431}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.11.3.dev427
+Version: 0.11.3.dev431
 Summary: Applied Epistemic Engineering toolkit — AEE agent sessions, execution profiles, FPGA/HDL governance, tool installer, 50+ CLI commands.
 Author: BitConcepts
 License-Expression: MIT

{specsmith-0.11.3.dev427 → specsmith-0.11.3.dev431}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.11.3.dev427"
+version = "0.11.3.dev431"
 description = "Applied Epistemic Engineering toolkit — AEE agent sessions, execution profiles, FPGA/HDL governance, tool installer, 50+ CLI commands."
 readme = "README.md"
 license = "MIT"
@@ -127,6 +127,8 @@ select = ["E", "F", "W", "I", "UP", "B", "SIM"]
 "src/specsmith/ci_manager.py" = ["E501"]
 # Context orchestrator: tier descriptions are intentionally descriptive
 "src/specsmith/context_orchestrator.py" = ["E501"]
+# Skills module: skill body strings contain markdown content with long lines
+"src/specsmith/skills/*.py" = ["E501"]
 # Migration files: rule description strings and template content
 "src/specsmith/migrations/m001_governance_yaml.py" = ["E501"]
 "src/specsmith/migrations/m004_ledger_esdb.py" = ["E501"]

{specsmith-0.11.3.dev427 → specsmith-0.11.3.dev431}/src/specsmith/agent/context_seed.py

@@ -186,12 +186,18 @@ def _load_ledger_snippet(root: Path, *, max_lines: int) -> str:
 
 
 def _load_esdb_snippet(root: Path, *, max_records: int) -> str:
-    """Return a compact summary of the most recent ESDB ChronoRecords."""
+    """Return a compact summary of the most recent ESDB ChronoRecords.
+
+    Uses query.what_is_known() (not store.query()) so infrastructure records
+    (edge, rollback_event, token_metric, skill_run) are excluded from the
+    LLM context seed — critical rule §23 / ESDB spec rule 3.
+    """
     try:
         from chronomemory import ChronoStore
+        from chronomemory import query as _cm_query
 
         with ChronoStore(root) as store:
-            all_records = store.query()  # active records in insertion order
+            all_records = _cm_query.what_is_known(store)  # active, conf>=0.6, no infra
         recent = all_records[-max_records:] if len(all_records) > max_records else all_records
         if not recent:
             return ""

{specsmith-0.11.3.dev427 → specsmith-0.11.3.dev431}/src/specsmith/cli.py

@@ -2471,8 +2471,14 @@ def push_cmd(project_dir: str, force: bool) -> None:
     default=False,
     help="Commit only; skip push.",
 )
+@click.option(
+    "--force",
+    is_flag=True,
+    default=False,
+    help="Override push safety checks (e.g. direct-to-main guard).",
+)
 @click.option("--json", "as_json", is_flag=True, default=False)
-def save_cmd(project_dir: str, message: str, no_push: bool, as_json: bool) -> None:
+def save_cmd(project_dir: str, message: str, no_push: bool, force: bool, as_json: bool) -> None:
     """Save governance state: ESDB backup, commit, and push.
 
     Combines ``specsmith esdb backup`` + ``specsmith commit`` + ``specsmith push``
@@ -2511,7 +2517,7 @@ def save_cmd(project_dir: str, message: str, no_push: bool, as_json: bool) -> No
 
     # 3. Push
     if not no_push:
-        push_result = run_push(root)
+        push_result = run_push(root, force=force)
         steps.append({"step": "push", "ok": push_result.success, "message": push_result.message})
 
     ok = all(s["ok"] for s in steps)
@@ -2688,11 +2694,28 @@ def pr_cmd(project_dir: str, title: str, draft: bool) -> None:
 
 @main.command(name="pull")
 @click.option("--project-dir", type=click.Path(exists=True), default=".")
-def pull_cmd(project_dir: str) -> None:
-    """Pull latest changes and check for governance conflicts."""
-    from specsmith.vcs_commands import run_sync
+@click.option(
+    "--discard",
+    is_flag=True,
+    default=False,
+    help="Hard-reset to remote and pull, discarding all local changes.",
+)
+@click.option(
+    "--clean",
+    is_flag=True,
+    default=False,
+    help="Like --discard but also removes untracked files (git clean -fd).",
+)
+def pull_cmd(project_dir: str, discard: bool, clean: bool) -> None:
+    """Pull latest changes and check for governance conflicts.
+
+    Use --discard to hard-reset to the remote branch, discarding local
+    changes.  Add --clean to also remove untracked files.
+    """
+    from specsmith.vcs_commands import run_discard, run_sync
 
-    result = run_sync(Path(project_dir).resolve())
+    root = Path(project_dir).resolve()
+    result = run_discard(root, clean=clean) if discard or clean else run_sync(root)
     if result.success:
         console.print(f"[green]\u2713[/green] {result.message}")
     else:

specsmith-0.11.3.dev431/src/specsmith/esdb/__init__.py

@@ -0,0 +1,62 @@
+# specsmith.esdb — ESDB integration package
+#
+# Re-exports the full chronomemory v0.1.1 public surface under the
+# specsmith.esdb namespace so internal modules can use a single import
+# path and never import chronomemory directly in more than one place.
+
+# Re-export query and metrics as module references so callers can do:
+#   from specsmith.esdb import query, metrics
+from chronomemory import (
+    RUST_BACKEND,
+    # Core store
+    ChronoRecord,
+    ChronoStore,
+    # Phase 2: context pack compiler
+    ContextPack,
+    ContextPackCompiler,
+    ContextPackEntry,
+    DependencyEdge,
+    # Phase 2: dependency graph
+    DepGraph,
+    # Bridge (backward-compat with .specsmith/*.json)
+    EsdbBridge,
+    EsdbRecord,
+    EsdbStatus,
+    # Phase 2: epistemic rollback
+    RollbackReport,
+    # Phase 3: optional Rust acceleration (None / False when not compiled)
+    RustChronoStore,
+    RustRecord,
+    WalEvent,
+    invalidate,
+    metrics,  # noqa: F401 — module re-export
+    open_store,
+    query,  # noqa: F401 — module re-export
+)
+
+__all__ = [
+    # Core
+    "ChronoStore",
+    "ChronoRecord",
+    "WalEvent",
+    "open_store",
+    # Bridge
+    "EsdbBridge",
+    "EsdbRecord",
+    "EsdbStatus",
+    # Phase 2
+    "DepGraph",
+    "DependencyEdge",
+    "RollbackReport",
+    "invalidate",
+    "ContextPack",
+    "ContextPackCompiler",
+    "ContextPackEntry",
+    # Phase 3
+    "RustChronoStore",
+    "RustRecord",
+    "RUST_BACKEND",
+    # Modules
+    "query",
+    "metrics",
+]

specsmith-0.11.3.dev431/src/specsmith/esdb/bridge.py

@@ -0,0 +1,28 @@
+"""specsmith.esdb.bridge — backward-compat bridge shim (chronomemory v0.1.1).
+
+For direct use prefer importing from specsmith.esdb (the package __init__)
+which re-exports the full chronomemory v0.1.1 surface.  This module is kept
+for any code that specifically imports from specsmith.esdb.bridge.
+"""
+
+from chronomemory import (
+    RUST_BACKEND,
+    ContextPackCompiler,
+    DepGraph,
+    EsdbBridge,
+    EsdbRecord,
+    EsdbStatus,
+    metrics,
+    query,
+)
+
+__all__ = [
+    "EsdbBridge",
+    "EsdbRecord",
+    "EsdbStatus",
+    "ContextPackCompiler",
+    "DepGraph",
+    "RUST_BACKEND",
+    "query",
+    "metrics",
+]

{specsmith-0.11.3.dev427 → specsmith-0.11.3.dev431}/src/specsmith/retrieval.py

@@ -40,14 +40,18 @@ def build_index(root: Path, *, include_ledger: bool = False, external: str = "")
     """
     entries: list[dict[str, str]] = []
 
-    # H18: inject high-confidence ESDB records as retrieval context
+    # H18: inject high-confidence ESDB records as retrieval context.
+    # Use query.what_is_known() (not store.query(rag_filter=True)) so that
+    # infrastructure records (edge, rollback_event, token_metric, skill_run)
+    # are excluded from the RAG index — critical rule §18.
     wal = root / ".chronomemory" / "events.wal"
     if wal.exists():
         try:
             from chronomemory import ChronoStore
+            from chronomemory import query as _cm_query
 
             with ChronoStore(root) as store:
-                for rec in store.query(rag_filter=True):  # confidence >= 0.6
+                for rec in _cm_query.what_is_known(store):
                     if rec.data:
                         content = (
                             f"[{rec.kind.upper()} {rec.id}] {rec.label}\n"

{specsmith-0.11.3.dev427 → specsmith-0.11.3.dev431}/src/specsmith/skills/devops.py

@@ -4,6 +4,176 @@
 from specsmith.skills import SkillDomain, SkillEntry
 
 SKILLS: list[SkillEntry] = [
+    SkillEntry(
+        slug="github-actions-ci",
+        name="GitHub Actions CI — Layer1Labs pattern (zero-trust, parallel, coverage-gated)",
+        description=(
+            "Standard Layer1Labs GitHub Actions CI pattern: permissions: {} at workflow level, "
+            "per-job contents: read grants, parallel jobs (no needs chain), full Python matrix "
+            "3.10–3.13, and --cov-fail-under=85 coverage gate."
+        ),
+        domain=SkillDomain.DEVOPS,
+        tags=[
+            "ci",
+            "github-actions",
+            "permissions",
+            "pytest",
+            "coverage",
+            "ruff",
+            "mypy",
+            "security",
+            "python",
+            "matrix",
+            "zero-trust",
+        ],
+        platforms=["linux", "windows", "macos"],
+        prerequisites=["gh"],
+        body=(
+            """\
+# GitHub Actions CI Skill (Layer1Labs pattern)
+
+Standard CI pattern used across all Layer1Labs / BitConcepts Python projects.
+Reference implementation: `chronomemory/.github/workflows/ci.yml`
+
+## Core principles
+- `permissions: {}` at workflow level — deny all by default.
+- `permissions: contents: read` on each individual job — grant minimum needed.
+- All jobs run **in parallel** — no `needs:` dependency chain unless truly required.
+- Full Python matrix: **3.10, 3.11, 3.12, 3.13** × ubuntu-latest, windows-latest.
+- Coverage gate: `--cov-fail-under=85`.
+- Named jobs (`name:` field) for readable GitHub UI.
+- `fail-fast: false` on the test matrix so all combinations are reported.
+
+## Canonical template
+```yaml
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  workflow_dispatch:
+
+# Default: deny all. Each job grants only what it needs.
+permissions: {}
+
+jobs:
+  lint:
+    name: Lint (ruff)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: pip install ruff
+      - name: ruff format --check
+        run: ruff format --check src/ tests/
+      - name: ruff check
+        run: ruff check src/ tests/
+
+  typecheck:
+    name: Type check (mypy)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: pip install -e ".[dev]"
+      - run: mypy src/<package>/
+
+  test:
+    name: Test (Python ${{ matrix.python-version }} / ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        os: [ubuntu-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: pip install -e ".[dev]"
+      - run: pytest --cov=<package> --cov-report=term-missing --cov-fail-under=85
+
+  security:
+    name: Security audit (pip-audit)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: pip install pip-audit
+      - run: pip install -e .
+      - run: pip-audit
+```
+
+## What NOT to do
+- Do NOT set `permissions: contents: read` at workflow level — use `permissions: {}` + per-job grants.
+- Do NOT use `needs: [lint, typecheck]` to gate the test job — run all in parallel.
+- Do NOT omit Python 3.11 from the matrix.
+- Do NOT skip `--cov-fail-under` — the 85% gate is non-negotiable.
+- Do NOT use `cancel-in-progress: true` (concurrency block) unless there is a
+  specific reason — chronomemory pattern omits it.
+- Do NOT use `macos-latest` in the matrix unless macOS-specific behavior must be
+  tested — it is ~10× slower and uses more CI minutes.
+
+## Rust projects (additional jobs)
+```yaml
+  rust-lint:
+    name: Rust lint (clippy + fmt)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - run: cargo fmt --check --all
+      - run: cargo clippy --workspace -- -D warnings
+
+  rust-test:
+    name: Rust tests
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo test --workspace
+
+  security:
+    name: Security audit (cargo-audit)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo install cargo-audit --locked
+      - run: cargo audit
+```
+"""
+        ),
+    ),
     SkillEntry(
         slug="docker-workflow",
         name="Docker — multi-stage builds, Compose, registries, security",