specsmith 0.16.1.dev605__tar.gz → 0.16.2__tar.gz

{specsmith-0.16.1.dev605/src/specsmith.egg-info → specsmith-0.16.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.16.1.dev605
+Version: 0.16.2
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -126,6 +126,8 @@ We ran a [multi-condition benchmark](https://specsmith.readthedocs.io/en/stable/
 
 See the [full benchmark report](https://specsmith.readthedocs.io/en/stable/efficiency-benchmark/) and [model comparison (gpt-4o-mini vs gpt-5.5)](https://specsmith.readthedocs.io/en/stable/model-comparison/).
 
+**v0.16.2** — bugfix release: resolved all 6 open CodeQL alerts (Protocol stub `py/ineffectual-statement`, dead-init `py/multiple-definition`; benchmark demo project excluded from scan); fixed `audit industrial_artifacts` false positive on Windows when `canopen_eds` entries are plain strings instead of dicts (closes #257).
+
 **v0.16.1** — governance efficiency benchmark suite (12 conditions, 3 tasks, gpt-4o-mini + gpt-5.5 comparison); cross-model comparison report; real OpenAI agent harness; CI matrix job. Also includes the v0.16.0 stabilisation milestone: 20+ CLI commands, ESDB SQLite backend, chronomemory 0.2.0, Python 3.10–3.13 × Ubuntu + Windows green, 1 607 tests passing.
 
 specsmith ships a full compliance and auditability layer aligned to the EU AI Act (2024/1689) and the NIST AI Risk Management Framework 1.0. Every agent action is cryptographically sealed, every AI-generated output is disclosed, context windows are GPU-aware, and compliance settings are configurable per-session and per-project.
@@ -475,7 +477,7 @@ Every preflight response includes a mandatory `ai_disclosure` block:
     "governance_gated": true,
     "provider": "ollama",
     "model": "qwen2.5:14b",
-    "spec_version": "0.16.1"
+    "spec_version": "0.16.2"
   }
 }
 ```

{specsmith-0.16.1.dev605 → specsmith-0.16.2}/README.md

@@ -48,6 +48,8 @@ We ran a [multi-condition benchmark](https://specsmith.readthedocs.io/en/stable/
 
 See the [full benchmark report](https://specsmith.readthedocs.io/en/stable/efficiency-benchmark/) and [model comparison (gpt-4o-mini vs gpt-5.5)](https://specsmith.readthedocs.io/en/stable/model-comparison/).
 
+**v0.16.2** — bugfix release: resolved all 6 open CodeQL alerts (Protocol stub `py/ineffectual-statement`, dead-init `py/multiple-definition`; benchmark demo project excluded from scan); fixed `audit industrial_artifacts` false positive on Windows when `canopen_eds` entries are plain strings instead of dicts (closes #257).
+
 **v0.16.1** — governance efficiency benchmark suite (12 conditions, 3 tasks, gpt-4o-mini + gpt-5.5 comparison); cross-model comparison report; real OpenAI agent harness; CI matrix job. Also includes the v0.16.0 stabilisation milestone: 20+ CLI commands, ESDB SQLite backend, chronomemory 0.2.0, Python 3.10–3.13 × Ubuntu + Windows green, 1 607 tests passing.
 
 specsmith ships a full compliance and auditability layer aligned to the EU AI Act (2024/1689) and the NIST AI Risk Management Framework 1.0. Every agent action is cryptographically sealed, every AI-generated output is disclosed, context windows are GPU-aware, and compliance settings are configurable per-session and per-project.
@@ -397,7 +399,7 @@ Every preflight response includes a mandatory `ai_disclosure` block:
     "governance_gated": true,
     "provider": "ollama",
     "model": "qwen2.5:14b",
-    "spec_version": "0.16.1"
+    "spec_version": "0.16.2"
   }
 }
 ```

{specsmith-0.16.1.dev605 → specsmith-0.16.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.16.1.dev605"
+version = "0.16.2"
 description = "AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider."
 readme = "README.md"
 license = "MIT"

{specsmith-0.16.1.dev605 → specsmith-0.16.2}/src/specsmith/__init__.py

@@ -8,4 +8,4 @@ from importlib.metadata import version as _pkg_version
 try:
     __version__: str = _pkg_version("specsmith")
 except PackageNotFoundError:  # running from source without install
-    __version__ = "0.16.1"  # fallback: keep in sync with pyproject.toml
+    __version__ = "0.16.2"  # fallback: keep in sync with pyproject.toml

{specsmith-0.16.1.dev605 → specsmith-0.16.2}/src/specsmith/auditor.py

@@ -1132,9 +1132,19 @@ def check_industrial_artifacts(root: Path) -> list[AuditResult]:
     declared_eds = declared.get("canopen_eds", []) or []
     # Normalise declared paths to forward slashes and lowercase so they match
     # on Windows where YAML uses '/' but Path.relative_to() returns '\\' (#251).
-    declared_paths = {
-        e.get("path", "").replace("\\", "/").lower() for e in declared_eds if isinstance(e, dict)
-    }
+    # canopen_eds entries may be plain strings ("path/to/file.eds") or dicts
+    # ({path: "path/to/file.eds", device: "..."}). Handle both to avoid false
+    # positives when users use the simpler string form (#257).
+    declared_paths: set[str] = set()
+    for e in declared_eds:
+        if isinstance(e, dict):
+            _p = e.get("path", "")
+        elif isinstance(e, str):
+            _p = e
+        else:
+            _p = str(e)
+        if _p:
+            declared_paths.add(_p.replace("\\", "/").lower())
 
     # Scan for .eds and .xdd files — respect scan_exclude_dirs and
     # scan_exclude_patterns from scaffold.yml (#175).

{specsmith-0.16.1.dev605 → specsmith-0.16.2}/src/specsmith/sync.py

@@ -602,8 +602,11 @@ def auto_migrate_if_needed(root: Path) -> dict[str, int]:
         return {}
 
     class _MigratableStore(Protocol):
-        def record_count(self) -> int: ...
-        def migrate_from_json(self, specsmith_dir: Path) -> dict[str, int] | Any: ...
+        def record_count(self) -> int:
+            pass  # noqa: E704
+
+        def migrate_from_json(self, specsmith_dir: Path) -> dict[str, int] | Any:
+            pass  # noqa: E704
 
     try:
         with open_default_store(root, warn=False) as store:

{specsmith-0.16.1.dev605 → specsmith-0.16.2/src/specsmith.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.16.1.dev605
+Version: 0.16.2
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -126,6 +126,8 @@ We ran a [multi-condition benchmark](https://specsmith.readthedocs.io/en/stable/
 
 See the [full benchmark report](https://specsmith.readthedocs.io/en/stable/efficiency-benchmark/) and [model comparison (gpt-4o-mini vs gpt-5.5)](https://specsmith.readthedocs.io/en/stable/model-comparison/).
 
+**v0.16.2** — bugfix release: resolved all 6 open CodeQL alerts (Protocol stub `py/ineffectual-statement`, dead-init `py/multiple-definition`; benchmark demo project excluded from scan); fixed `audit industrial_artifacts` false positive on Windows when `canopen_eds` entries are plain strings instead of dicts (closes #257).
+
 **v0.16.1** — governance efficiency benchmark suite (12 conditions, 3 tasks, gpt-4o-mini + gpt-5.5 comparison); cross-model comparison report; real OpenAI agent harness; CI matrix job. Also includes the v0.16.0 stabilisation milestone: 20+ CLI commands, ESDB SQLite backend, chronomemory 0.2.0, Python 3.10–3.13 × Ubuntu + Windows green, 1 607 tests passing.
 
 specsmith ships a full compliance and auditability layer aligned to the EU AI Act (2024/1689) and the NIST AI Risk Management Framework 1.0. Every agent action is cryptographically sealed, every AI-generated output is disclosed, context windows are GPU-aware, and compliance settings are configurable per-session and per-project.
@@ -475,7 +477,7 @@ Every preflight response includes a mandatory `ai_disclosure` block:
     "governance_gated": true,
     "provider": "ollama",
     "model": "qwen2.5:14b",
-    "spec_version": "0.16.1"
+    "spec_version": "0.16.2"
   }
 }
 ```

{specsmith-0.16.1.dev605 → specsmith-0.16.2}/tests/test_auditor.py

@@ -90,6 +90,10 @@ class TestAuditDetectsIssues:
 
 
 def test_industrial_artifacts_normalizes_windows_declared_paths(tmp_path: Path) -> None:
+    # Simulate a Windows user who put a single backslash path in scaffold.yml.
+    # YAML plain scalars treat backslash as literal, so the parsed value is
+    # "hardware\device.eds" (one backslash) which must normalise to the posix
+    # found path "hardware/device.eds".
     (tmp_path / "scaffold.yml").write_text(
         "name: test\n"
         "type: cli-python\n"
@@ -106,6 +110,51 @@ def test_industrial_artifacts_normalizes_windows_declared_paths(tmp_path: Path)
     assert any(r.name == "industrial-artifacts" and r.passed for r in results)
 
 
+def test_industrial_artifacts_plain_string_entries_no_false_positive(tmp_path: Path) -> None:
+    """Regression test for #257: plain string canopen_eds entries must not be
+    treated as undeclared even though they pass isinstance(e, dict) == False."""
+    (tmp_path / "scaffold.yml").write_text(
+        "name: test\n"
+        "type: cli-python\n"
+        "industrial_artifacts:\n"
+        "  canopen_eds:\n"
+        "    - application/canopen/device.eds\n"
+        "    - application/canopen/device.xdd\n",
+        encoding="utf-8",
+    )
+    can_dir = tmp_path / "application" / "canopen"
+    can_dir.mkdir(parents=True)
+    (can_dir / "device.eds").write_text("EDS", encoding="utf-8")
+    (can_dir / "device.xdd").write_text("XDD", encoding="utf-8")
+
+    results = check_industrial_artifacts(tmp_path)
+    assert results
+    assert any(r.name == "industrial-artifacts" and r.passed for r in results), (
+        f"Expected pass but got: {[r.message for r in results]}"
+    )
+
+
+def test_industrial_artifacts_mixed_string_and_dict_entries(tmp_path: Path) -> None:
+    """Mixed plain-string and dict entries should both be recognised (#257)."""
+    (tmp_path / "scaffold.yml").write_text(
+        "name: test\n"
+        "type: cli-python\n"
+        "industrial_artifacts:\n"
+        "  canopen_eds:\n"
+        "    - application/canopen/a.eds\n"
+        "    - path: application/canopen/b.eds\n"
+        "      device: MyDevice\n",
+        encoding="utf-8",
+    )
+    can_dir = tmp_path / "application" / "canopen"
+    can_dir.mkdir(parents=True)
+    (can_dir / "a.eds").write_text("EDS", encoding="utf-8")
+    (can_dir / "b.eds").write_text("EDS", encoding="utf-8")
+
+    results = check_industrial_artifacts(tmp_path)
+    assert any(r.name == "industrial-artifacts" and r.passed for r in results)
+
+
 # ---------------------------------------------------------------------------
 # Regression: issue #183 — letter-suffix TEST IDs in req trace
 # ---------------------------------------------------------------------------