specsmith 0.13.1.dev522__tar.gz → 0.13.1.dev534__tar.gz

{specsmith-0.13.1.dev522/src/specsmith.egg-info → specsmith-0.13.1.dev534}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.13.1.dev522
+Version: 0.13.1.dev534
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -40,7 +40,7 @@ Requires-Dist: pre-commit>=3.0; extra == "dev"
 Requires-Dist: types-pyyaml>=6.0; extra == "dev"
 Requires-Dist: cryptography>=42.0; extra == "dev"
 Provides-Extra: esdb
-Requires-Dist: chronomemory>=0.1.3; extra == "esdb"
+Requires-Dist: chronomemory>=0.1.4; extra == "esdb"
 Requires-Dist: cryptography>=42.0; extra == "esdb"
 Provides-Extra: docs
 Requires-Dist: mkdocs>=1.6; extra == "docs"
@@ -204,18 +204,43 @@ immediately importable.  The pipx isolation guard only applies to the `specsmith
 command — not to library imports.  Use this when you want the AEE belief-state machinery
 in your own application without managing a pipx environment.
 
-**ESDB ChronoStore (commercial, requires license):**
+**ESDB — Epistemic State Database**
+
+| Tier | Package | License | What you get |
+|------|---------|---------|-------------|
+| **Default** | `specsmith` (built-in) | MIT, free | SQLite backend — requirements, test cases, confidence filtering |
+| **Commercial** | `chronomemory` via `specsmith[esdb]` | Proprietary — license required | ChronoStore: tamper-evident SHA-256 WAL, OEA anti-hallucination fields, Rust acceleration, epistemic rollback |
+
+`pip install specsmith` always installs the **free SQLite backend** automatically.
+No additional packages, no license key, no configuration — it works out of the box.
 
 ```bash
-pip install "specsmith[esdb]"             # + chronomemory from PyPI (commercial — requires license key)
+specsmith esdb status   # shows: SQLite (free, MIT) — active by default
+```
+
+**Upgrading to chronomemory ChronoStore (commercial):**
+
+If you hold a chronomemory ESDB license, activate the commercial backend:
+
+```bash
+# Step 1 — install the chronomemory package
+pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
+# or if using pipx:
+pipx inject specsmith "chronomemory>=0.1.4"  # inject into the specsmith pipx venv
+
+# Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key
-specsmith esdb status                     # confirms ChronoStore is active
+# The key is copied to ~/.specsmith/esdb.key and used automatically from now on.
+
+# Step 3 — verify ChronoStore is active
+specsmith esdb status
+# ● ESDB — ChronoStore WAL (chronomemory commercial)
+#   ✔ License: your-org (expires YYYY-MM-DD)
 ```
 
-The default ESDB backend is SQLite (free, MIT, no license needed).  ChronoStore
-(tamper-evident WAL, OEA fields, Rust acceleration) is a commercial add-on.
-Contact [licensing@layer1labs.com](mailto:licensing@layer1labs.com) to obtain a license.
-See [ESDB docs](https://specsmith.readthedocs.io/esdb) for a full feature comparison.
+To obtain a chronomemory ESDB license:
+[licensing@layer1labs.com](mailto:licensing@layer1labs.com) · [layer1labs.com/esdb-licensing](https://layer1labs.com/esdb-licensing)
+See the [full ESDB docs](https://specsmith.readthedocs.io/esdb) for a feature comparison and Python API reference.
 
 **Update:**
 

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/README.md

@@ -126,18 +126,43 @@ immediately importable.  The pipx isolation guard only applies to the `specsmith
 command — not to library imports.  Use this when you want the AEE belief-state machinery
 in your own application without managing a pipx environment.
 
-**ESDB ChronoStore (commercial, requires license):**
+**ESDB — Epistemic State Database**
+
+| Tier | Package | License | What you get |
+|------|---------|---------|-------------|
+| **Default** | `specsmith` (built-in) | MIT, free | SQLite backend — requirements, test cases, confidence filtering |
+| **Commercial** | `chronomemory` via `specsmith[esdb]` | Proprietary — license required | ChronoStore: tamper-evident SHA-256 WAL, OEA anti-hallucination fields, Rust acceleration, epistemic rollback |
+
+`pip install specsmith` always installs the **free SQLite backend** automatically.
+No additional packages, no license key, no configuration — it works out of the box.
 
 ```bash
-pip install "specsmith[esdb]"             # + chronomemory from PyPI (commercial — requires license key)
+specsmith esdb status   # shows: SQLite (free, MIT) — active by default
+```
+
+**Upgrading to chronomemory ChronoStore (commercial):**
+
+If you hold a chronomemory ESDB license, activate the commercial backend:
+
+```bash
+# Step 1 — install the chronomemory package
+pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
+# or if using pipx:
+pipx inject specsmith "chronomemory>=0.1.4"  # inject into the specsmith pipx venv
+
+# Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key
-specsmith esdb status                     # confirms ChronoStore is active
+# The key is copied to ~/.specsmith/esdb.key and used automatically from now on.
+
+# Step 3 — verify ChronoStore is active
+specsmith esdb status
+# ● ESDB — ChronoStore WAL (chronomemory commercial)
+#   ✔ License: your-org (expires YYYY-MM-DD)
 ```
 
-The default ESDB backend is SQLite (free, MIT, no license needed).  ChronoStore
-(tamper-evident WAL, OEA fields, Rust acceleration) is a commercial add-on.
-Contact [licensing@layer1labs.com](mailto:licensing@layer1labs.com) to obtain a license.
-See [ESDB docs](https://specsmith.readthedocs.io/esdb) for a full feature comparison.
+To obtain a chronomemory ESDB license:
+[licensing@layer1labs.com](mailto:licensing@layer1labs.com) · [layer1labs.com/esdb-licensing](https://layer1labs.com/esdb-licensing)
+See the [full ESDB docs](https://specsmith.readthedocs.io/esdb) for a feature comparison and Python API reference.
 
 **Update:**
 

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.13.1.dev522"
+version = "0.13.1.dev534"
 description = "AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider."
 readme = "README.md"
 license = "MIT"
@@ -60,7 +60,7 @@ dev = [
 # Install: pip install specsmith[esdb]
 # Activate: specsmith esdb enable --key-file /path/to/your.esdb.key
 esdb = [
-    "chronomemory>=0.1.3",   # proprietary commercial — see chronomemory LICENSE
+    "chronomemory>=0.1.4",   # proprietary commercial — see chronomemory LICENSE
     "cryptography>=42.0",
 ]
 docs = [

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/src/specsmith/cli.py

@@ -4234,15 +4234,16 @@ def agent_ask_cmd(prompt: str, project_dir: str, as_json: bool) -> None:
         )
         action = "skills_hint"
     elif any(k in lower for k in ("esdb", "database", "backup", "export", "records")):
-        import specsmith.esdb as _esdb
+        from specsmith.esdb import ESDB_BACKEND as _ESDB_BACKEND  # noqa: PLC0415
+        from specsmith.esdb import open_default_store as _open_default_store  # noqa: PLC0415
 
         action = "esdb_status"
         try:
-            store = _esdb.open_default_store(project_dir, warn=False)
+            store = _open_default_store(project_dir, warn=False)
             with store:
                 count = store.record_count()
                 chain_ok = store.chain_valid()
-            reply = f"ESDB: {_esdb.ESDB_BACKEND} | {count} records | chain_valid={chain_ok}"
+            reply = f"ESDB: {_ESDB_BACKEND} | {count} records | chain_valid={chain_ok}"
         except Exception as exc:  # noqa: BLE001
             reply = f"ESDB unavailable: {exc}"
     elif any(k in lower for k in ("mcp", "server", "tool server")):

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/src/specsmith/esdb/__init__.py

@@ -98,7 +98,9 @@ except ImportError:
         """Stub module reference so 'from specsmith.esdb import query, metrics' works."""
 
         def __getattr__(self, name: str) -> "_Stub":
-            raise ImportError(_INSTALL_HINT)
+            raise AttributeError(  # noqa: TRY301
+                f"'{name}' is unavailable: {_INSTALL_HINT}"
+            )
 
     query = _StubModule()  # type: ignore[assignment]
     metrics = _StubModule()  # type: ignore[assignment]

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/src/specsmith/esdb/bridge.py

@@ -44,7 +44,9 @@ except ImportError:  # pragma: no cover
 
     class _StubModule:  # noqa: F811
         def __getattr__(self, name: str) -> "_Stub":
-            raise ImportError(_INSTALL_HINT)
+            raise AttributeError(  # noqa: TRY301
+                f"'{name}' is unavailable: {_INSTALL_HINT}"
+            )
 
     EsdbBridge = EsdbRecord = EsdbStatus = ContextPackCompiler = DepGraph = _Stub  # noqa: F811
     query = _StubModule()  # noqa: F811

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/src/specsmith/esdb/sqlite_store.py

@@ -330,7 +330,7 @@ class SqliteStore:
                     )
                     counts["requirements"] += 1
             except (OSError, ValueError):
-                pass
+                counts["skipped"] += 1  # file unreadable or invalid JSON
 
         test_path = state_dir / "testcases.json"
         if test_path.exists():
@@ -351,7 +351,7 @@ class SqliteStore:
                     )
                     counts["testcases"] += 1
             except (OSError, ValueError):
-                pass
+                counts["skipped"] += 1  # file unreadable or invalid JSON
 
         return counts
 

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/src/specsmith/governance_logic.py

@@ -71,7 +71,8 @@ def run_preflight(
     from specsmith import __version__
     from specsmith.agent.broker import Intent, classify_intent, infer_scope
 
-    root = _safe_resolve(project_dir)
+    _safe_resolve(project_dir)  # validate: reject null bytes and traversal sequences
+    root = Path(os.path.realpath(str(project_dir)))  # CodeQL-visible sanitiser (py/path-injection)
     intent = classify_intent(utterance)
     # Requirements live at docs/REQUIREMENTS.md, not at the project root.
     # Falling back to root/REQUIREMENTS.md would always yield an empty list

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534/src/specsmith.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.13.1.dev522
+Version: 0.13.1.dev534
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -40,7 +40,7 @@ Requires-Dist: pre-commit>=3.0; extra == "dev"
 Requires-Dist: types-pyyaml>=6.0; extra == "dev"
 Requires-Dist: cryptography>=42.0; extra == "dev"
 Provides-Extra: esdb
-Requires-Dist: chronomemory>=0.1.3; extra == "esdb"
+Requires-Dist: chronomemory>=0.1.4; extra == "esdb"
 Requires-Dist: cryptography>=42.0; extra == "esdb"
 Provides-Extra: docs
 Requires-Dist: mkdocs>=1.6; extra == "docs"
@@ -204,18 +204,43 @@ immediately importable.  The pipx isolation guard only applies to the `specsmith
 command — not to library imports.  Use this when you want the AEE belief-state machinery
 in your own application without managing a pipx environment.
 
-**ESDB ChronoStore (commercial, requires license):**
+**ESDB — Epistemic State Database**
+
+| Tier | Package | License | What you get |
+|------|---------|---------|-------------|
+| **Default** | `specsmith` (built-in) | MIT, free | SQLite backend — requirements, test cases, confidence filtering |
+| **Commercial** | `chronomemory` via `specsmith[esdb]` | Proprietary — license required | ChronoStore: tamper-evident SHA-256 WAL, OEA anti-hallucination fields, Rust acceleration, epistemic rollback |
+
+`pip install specsmith` always installs the **free SQLite backend** automatically.
+No additional packages, no license key, no configuration — it works out of the box.
 
 ```bash
-pip install "specsmith[esdb]"             # + chronomemory from PyPI (commercial — requires license key)
+specsmith esdb status   # shows: SQLite (free, MIT) — active by default
+```
+
+**Upgrading to chronomemory ChronoStore (commercial):**
+
+If you hold a chronomemory ESDB license, activate the commercial backend:
+
+```bash
+# Step 1 — install the chronomemory package
+pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
+# or if using pipx:
+pipx inject specsmith "chronomemory>=0.1.4"  # inject into the specsmith pipx venv
+
+# Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key
-specsmith esdb status                     # confirms ChronoStore is active
+# The key is copied to ~/.specsmith/esdb.key and used automatically from now on.
+
+# Step 3 — verify ChronoStore is active
+specsmith esdb status
+# ● ESDB — ChronoStore WAL (chronomemory commercial)
+#   ✔ License: your-org (expires YYYY-MM-DD)
 ```
 
-The default ESDB backend is SQLite (free, MIT, no license needed).  ChronoStore
-(tamper-evident WAL, OEA fields, Rust acceleration) is a commercial add-on.
-Contact [licensing@layer1labs.com](mailto:licensing@layer1labs.com) to obtain a license.
-See [ESDB docs](https://specsmith.readthedocs.io/esdb) for a full feature comparison.
+To obtain a chronomemory ESDB license:
+[licensing@layer1labs.com](mailto:licensing@layer1labs.com) · [layer1labs.com/esdb-licensing](https://layer1labs.com/esdb-licensing)
+See the [full ESDB docs](https://specsmith.readthedocs.io/esdb) for a feature comparison and Python API reference.
 
 **Update:**
 

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/src/specsmith.egg-info/requires.txt

@@ -36,7 +36,7 @@ mkdocs>=1.6
 mkdocs-material>=9.5
 
 [esdb]
-chronomemory>=0.1.3
+chronomemory>=0.1.4
 cryptography>=42.0
 
 [gemini]

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/tests/test_esdb_license.py

@@ -159,7 +159,7 @@ def test_resolve_license_path_default(tmp_path: Path) -> None:
     specsmith_dir = tmp_path / ".specsmith"
     specsmith_dir.mkdir()
     _make_license_file(specsmith_dir, filename="esdb.key")
-    import specsmith.esdb._license as lic_mod
+    from specsmith.esdb import _license as lic_mod  # noqa: PLC0415
 
     def fake_home() -> Path:
         return tmp_path

{specsmith-0.13.1.dev522 → specsmith-0.13.1.dev534}/tests/test_mcp_server.py

@@ -634,8 +634,6 @@ class TestGovernanceReqListYamlMode:
 
     def test_yaml_mode_returns_new_req_despite_stale_cache(self, yaml_mode_project: Path) -> None:
         """REQ-364: governance_req_list in yaml_mode reads YAML, not JSON cache."""
-        import specsmith.mcp_server as mcp_mod
-
         result = mcp_mod._handle_governance_req_list({"project_dir": str(yaml_mode_project)})
         req_ids = {r["id"] for r in result["reqs"]}
         assert "REQ-NEW" in req_ids, (
@@ -646,8 +644,6 @@ class TestGovernanceReqListYamlMode:
 
     def test_yaml_mode_coverage_from_yaml_tests(self, yaml_mode_project: Path) -> None:
         """Coverage is computed from YAML tests, not stale JSON cache."""
-        import specsmith.mcp_server as mcp_mod
-
         result = mcp_mod._handle_governance_req_list({"project_dir": str(yaml_mode_project)})
         reqs_by_id = {r["id"]: r for r in result["reqs"]}
         # REQ-001 has a test in YAML → covered
@@ -657,8 +653,6 @@ class TestGovernanceReqListYamlMode:
 
     def test_legacy_mode_still_uses_json_cache(self, tmp_path: Path) -> None:
         """Non-yaml-mode projects still use the JSON cache (backward compat)."""
-        import specsmith.mcp_server as mcp_mod
-
         state = tmp_path / ".specsmith"
         state.mkdir()
         # No governance-mode file → legacy mode