specsmith 0.22.0__tar.gz → 0.22.2__tar.gz

{specsmith-0.22.0/src/specsmith.egg-info → specsmith-0.22.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.22.0
+Version: 0.22.2
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -27,6 +27,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click>=8.1
+Requires-Dist: cryptography>=42.0
 Requires-Dist: jinja2>=3.1
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: pydantic>=2.0
@@ -38,10 +39,8 @@ Requires-Dist: ruff>=0.4; extra == "dev"
 Requires-Dist: mypy>=1.10; extra == "dev"
 Requires-Dist: pre-commit>=3.0; extra == "dev"
 Requires-Dist: types-pyyaml>=6.0; extra == "dev"
-Requires-Dist: cryptography>=42.0; extra == "dev"
 Provides-Extra: esdb
 Requires-Dist: chronomemory>=0.2.7; extra == "esdb"
-Requires-Dist: cryptography>=42.0; extra == "esdb"
 Provides-Extra: docs
 Requires-Dist: mkdocs>=1.6; extra == "docs"
 Requires-Dist: mkdocs-material>=9.5; extra == "docs"
@@ -73,7 +72,6 @@ Requires-Dist: pytest-cov>=4.0; extra == "all"
 Requires-Dist: ruff>=0.4; extra == "all"
 Requires-Dist: mypy>=1.10; extra == "all"
 Provides-Extra: license-verify
-Requires-Dist: cryptography>=42.0; extra == "license-verify"
 Dynamic: license-file
 
 # specsmith
@@ -317,6 +315,7 @@ If you hold a chronomemory ESDB license, activate the commercial backend:
 pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
 # or if using pipx:
 pipx inject specsmith "chronomemory>=0.2.0"  # inject into the specsmith pipx venv
+# The license verifier is included in base specsmith; no cryptography injection is needed.
 
 # Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key
@@ -340,6 +339,10 @@ pipx upgrade specsmith   # preferred — upgrades the pipx-isolated CLI
 specsmith self-update    # alternative: self-update from within specsmith
 ```
 
+An intent limited to maintaining the local pipx CLI is returned as the non-blocking
+`environment_only` preflight decision. It exits successfully and creates no project
+work item, ledger entry, or ESDB record. All `--help` invocations are read-only.
+
 ---
 
 ## Quick Start

{specsmith-0.22.0 → specsmith-0.22.2}/README.md

@@ -239,6 +239,7 @@ If you hold a chronomemory ESDB license, activate the commercial backend:
 pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
 # or if using pipx:
 pipx inject specsmith "chronomemory>=0.2.0"  # inject into the specsmith pipx venv
+# The license verifier is included in base specsmith; no cryptography injection is needed.
 
 # Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key
@@ -262,6 +263,10 @@ pipx upgrade specsmith   # preferred — upgrades the pipx-isolated CLI
 specsmith self-update    # alternative: self-update from within specsmith
 ```
 
+An intent limited to maintaining the local pipx CLI is returned as the non-blocking
+`environment_only` preflight decision. It exits successfully and creates no project
+work item, ledger entry, or ESDB record. All `--help` invocations are read-only.
+
 ---
 
 ## Quick Start

{specsmith-0.22.0 → specsmith-0.22.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.22.0"
+version = "0.22.2"
 description = "AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider."
 readme = "README.md"
 license = "MIT"
@@ -37,6 +37,8 @@ classifiers = [
 
 dependencies = [
     "click>=8.1",
+    # `specsmith esdb enable` verifies Ed25519 license signatures in every install.
+    "cryptography>=42.0",
     "jinja2>=3.1",
     "pyyaml>=6.0",
     "pydantic>=2.0",
@@ -54,7 +56,6 @@ dev = [
     "mypy>=1.10",
     "pre-commit>=3.0",
     "types-pyyaml>=6.0",
-    "cryptography>=42.0",   # needed for test_esdb_license.py signing helpers
 ]
 # ESDB commercial backend — requires a valid license from licensing@layer1labs.ai
 # Install: pip install specsmith[esdb]
@@ -62,7 +63,6 @@ dev = [
 # Terms: https://github.com/layer1labs/specsmith/blob/develop/COMMERCIAL-LICENSE.md
 esdb = [
     "chronomemory>=0.2.7",   # proprietary commercial — ChronoMemory terms only (not SQLite free tier)
-    "cryptography>=42.0",
 ]
 docs = [
     "mkdocs>=1.6",
@@ -95,8 +95,8 @@ all = [
     "ruff>=0.4",
     "mypy>=1.10",
 ]
-# cryptography for license verification (usable without full esdb extra)
-license-verify = ["cryptography>=42.0"]
+# Compatibility extra: cryptography is now part of every supported installation.
+license-verify = []
 
 [project.scripts]
 specsmith = "specsmith.cli:main"

{specsmith-0.22.0 → specsmith-0.22.2}/src/specsmith/__init__.py

@@ -8,4 +8,4 @@ from importlib.metadata import version as _pkg_version
 try:
     __version__: str = _pkg_version("specsmith")
 except PackageNotFoundError:  # running from source without install
-    __version__ = "0.22.0"  # fallback: keep in sync with pyproject.toml
+    __version__ = "0.22.2"  # fallback: keep in sync with pyproject.toml

{specsmith-0.22.0 → specsmith-0.22.2}/src/specsmith/agent/broker.py

@@ -416,7 +416,12 @@ class PreflightDecision:
 
     @property
     def accepted(self) -> bool:
-        return self.decision.lower() == "accepted"
+        return self.decision.lower() in {"accepted", "environment_only"}
+
+    @property
+    def environment_only(self) -> bool:
+        """Whether this decision permits local tool maintenance only."""
+        return self.decision.lower() == "environment_only"
 
 
 def _resolve_specsmith_executable() -> str:
@@ -523,7 +528,11 @@ def narrate_plan(
     else:
         lines.append("No matching governance scope found; will ask before drafting anything new.")
 
-    if decision.accepted:
+    if decision.environment_only:
+        lines.append(
+            "Environment-only SpecSmith CLI maintenance may proceed; no project work is governed."
+        )
+    elif decision.accepted:
         lines.append("Specsmith approved this work.")
     elif decision.decision == "needs_clarification":
         # Surface only one clarifying question (REQ-063 stop-and-align).

{specsmith-0.22.0 → specsmith-0.22.2}/src/specsmith/cli.py

@@ -130,9 +130,11 @@ class _AutoUpdateGroup(click.Group):
             warnings.simplefilter("ignore", DeprecationWarning)
             protected = list(ctx.protected_args)  # [subcommand] in 8.x, [] in 9.0
         subcommand = protected[0] if protected else (ctx.args[0] if ctx.args else "")
+        help_requested = any(arg in {"--help", "-h"} for arg in (*protected, *ctx.args))
         skip = (
             os.environ.get("SPECSMITH_NO_AUTO_UPDATE", "").strip() in ("1", "true", "yes")
             or subcommand in self._SKIP_COMMANDS
+            or help_requested
         )
 
         if not skip:
@@ -939,7 +941,7 @@ def preflight_cmd(
 
     # REQ-092: decision-specific exit codes so CI / shell wrappers can branch
     # on intent without parsing the JSON payload.
-    if decision_str == "accepted":
+    if decision_str in {"accepted", "environment_only"}:
         return  # exit 0
     if decision_str == "needs_clarification":
         raise SystemExit(2)
@@ -3853,7 +3855,7 @@ def channel_set_cmd(channel: str) -> None:
     if channel == "stable" and is_prerelease_version(__version__):
         raise click.UsageError(
             "Cannot select stable while a prerelease is installed. "
-            f"Install a stable build first: {version_mismatch_remediation('0.22.0')}"
+            f"Install a stable build first: {version_mismatch_remediation('0.22.2')}"
         )
 
     set_persisted_channel(channel)
@@ -4100,7 +4102,7 @@ def checkpoint_cmd(project_dir: str, as_json: bool) -> None:
         pass
 
     # ── Phase ─────────────────────────────────────────────────────────────────
-    phase_key, phase_label, phase_emoji, phase_pct = "unknown", "Unknown", "", 0
+    phase_key, phase_label, phase_pct = "unknown", "Unknown", 0
     try:
         from specsmith.phase import PHASE_MAP, phase_progress_pct, read_phase
 
@@ -4108,7 +4110,6 @@ def checkpoint_cmd(project_dir: str, as_json: bool) -> None:
         phase = PHASE_MAP.get(phase_key)
         if phase:
             phase_label = phase.label
-            phase_emoji = phase.emoji
             phase_pct = phase_progress_pct(phase, root)
     except Exception:  # noqa: BLE001
         pass
@@ -4203,7 +4204,7 @@ def checkpoint_cmd(project_dir: str, as_json: bool) -> None:
         "ts": ts,
         "project": project_name,
         "phase": phase_key,
-        "phase_label": f"{phase_emoji} {phase_label}",
+        "phase_label": phase_label,
         "phase_pct": phase_pct,
         "health": "clean" if health_ok else f"{audit_failed} issues",
         "audit_failed": audit_failed,
@@ -4223,69 +4224,37 @@ def checkpoint_cmd(project_dir: str, as_json: bool) -> None:
 
     # ── Human-readable anchor block ───────────────────────────────────────────
     # Designed to be compact and survive context summarization.
-    _w = 57  # interior width — must match len(hbar)
-    hbar = "\u2550" * _w  # ═══…
-    vbar = "\u2551"  # ║
-    health_icon = "\u2713" if health_ok else "\u2717"
-    esdb_icon = "\u2713" if esdb_ok else "\u2717"
+    _w = 72
+    health_status = "OK" if health_ok else "FAIL"
+    esdb_status = "OK" if esdb_ok else "FAIL"
     if esdb_backend == "chronomemory":
-        esdb_field = f"ESDB: {esdb_records} records ({esdb_icon} chain)"
+        esdb_field = f"ESDB: chronomemory {esdb_records} records chain={esdb_status}"
     elif esdb_backend == "sqlite":
-        # Compact format keeps the row within the 57-char box interior.
-        # " REQs    : NNN   TESTs: NNN   " = 30 chars, leaving 27 for esdb_field.
-        esdb_field = f"ESDB: SQLite {esdb_records} recs {esdb_icon}"
+        esdb_field = f"ESDB: sqlite {esdb_records} records chain={esdb_status}"
     else:
         esdb_field = "ESDB: N/A"
     wi_str = ", ".join(recent_wis) if recent_wis else "none seen"
 
-    def _arow(rich: str, plain: str, wide: int = 0) -> str:
-        """Format one anchor box row: ║ <content padded to _w terminal cols> ║.
+    def _arow(content: str) -> str:
+        """Return an ASCII-only row with a stable terminal-column width."""
+        ascii_content = content.encode("ascii", "backslashreplace").decode("ascii")
+        return f"|{ascii_content[:_w].ljust(_w)}|"
 
-        ``plain`` is the markup-free string used for width calculation.
-        ``wide`` is the count of 2-wide (full-width/emoji) characters in ``plain``
-        that add an extra terminal column beyond their Python ``len()``.
-        """
-        pad = " " * max(0, _w - len(plain) - wide)
-        return f"[bold cyan]{vbar}[/bold cyan]{rich}{pad}[bold cyan]{vbar}[/bold cyan]"
-
-    console.print(f"[bold cyan]\u2554{hbar}\u2557[/bold cyan]")
-
-    r1 = f" GOVERNANCE ANCHOR  {ts}"
-    console.print(_arow(r1, r1))
-
-    r2_plain = f" Project : {project_name}"
-    console.print(_arow(f" Project : [bold]{project_name}[/bold]", r2_plain))
-
-    # Emoji omitted from the anchor box: full-width glyphs vary by terminal
-    # and break the fixed-width box alignment unpredictably (GH #align).
-    r3_plain = f" Phase   : {phase_label} ({phase_pct}%)"
-    console.print(_arow(r3_plain, r3_plain))
-
-    r4_plain = (
-        f" Health  : {health_icon} clean"
-        if health_ok
-        else f" Health  : {health_icon} {audit_failed} issues"
-    )
-    r4_rich = (
-        f" Health  : [green]{health_icon} clean[/green]"
-        if health_ok
-        else f" Health  : [red]{health_icon} {audit_failed} issues[/red]"
-    )
-    console.print(_arow(r4_rich, r4_plain))
-
-    r5 = f" REQs    : {req_count}   TESTs: {test_count}   {esdb_field}"
-    console.print(_arow(r5, r5))
-
-    r6 = f" WIs     : {wi_str}"
-    console.print(_arow(r6, r6))
+    click.echo("+" + "-" * _w + "+")
+    click.echo(_arow(f" GOVERNANCE ANCHOR  {ts}"))
+    click.echo(_arow(f" Project : {project_name}"))
+    click.echo(_arow(f" Phase   : {phase_label} ({phase_pct}%)"))
+    health_field = "clean" if health_ok else f"{audit_failed} issues"
+    click.echo(_arow(f" Health  : {health_status} {health_field}"))
+    click.echo(_arow(f" REQs    : {req_count}   TESTs: {test_count}   {esdb_field}"))
+    click.echo(_arow(f" WIs     : {wi_str}"))
 
     if last_preflight:
-        _pf_max = _w - len(" Preflight: ")  # 45 — was incorrectly 55
+        _pf_max = _w - len(" Preflight: ")
         pf_short = last_preflight[:_pf_max]
-        r7 = f" Preflight: {pf_short}"
-        console.print(_arow(r7, r7))
+        click.echo(_arow(f" Preflight: {pf_short}"))
 
-    console.print(f"[bold cyan]\u255a{hbar}\u255d[/bold cyan]")
+    click.echo("+" + "-" * _w + "+")
     console.print(
         "[dim]Include this block verbatim in any context summary "
         r"(\`specsmith checkpoint\` re-generates it).[/dim]",
@@ -11975,18 +11944,50 @@ def esdb_migrate_cmd(project_dir: str, as_json: bool) -> None:
     }
 
     manifest_path = root / ".specsmith" / "esdb_migration_manifest.json"
-    manifest_path.parent.mkdir(parents=True, exist_ok=True)
-    manifest_path.write_text(_json.dumps(manifest, indent=2, ensure_ascii=False), encoding="utf-8")
 
     # --- Phase 2: migrate into active ESDB backend (if validation passed) ---
     migrate_counts: dict[str, int] = {}
+    wal_repair: dict[str, Any] = {"attempted": False}
     if ok:
         try:
             from specsmith.esdb import open_default_store
 
             with open_default_store(root, warn=False) as store:  # type: ignore[attr-defined]
+                from specsmith.esdb import ESDB_BACKEND
+
+                chain_valid = getattr(store, "chain_valid", None)
+                is_invalid_chrono_wal = (
+                    ESDB_BACKEND == "chronomemory"
+                    and callable(chain_valid)
+                    and chain_valid() is False
+                )
+                if is_invalid_chrono_wal:
+                    # ChronoMemory < 0.1.3 can retain readable records in a
+                    # WAL whose historical hash chain no longer validates.
+                    # Back up first, then compact to rebuild the chain safely.
+                    wal_repair = {
+                        "attempted": True,
+                        "detected_invalid": True,
+                        "method": "backup_then_compact",
+                    }
+                    backup = getattr(store, "backup", None)
+                    compact = getattr(store, "compact", None)
+                    if not callable(backup) or not callable(compact):
+                        raise RuntimeError(
+                            "ChronoStore cannot repair a legacy WAL because backup() or "
+                            "compact() is unavailable",
+                        )
+                    backup_path = backup()
+                    wal_repair["backup_path"] = str(backup_path)
+                    compact()
+                    wal_repair["chain_valid_after"] = chain_valid() is not False
+                    if not wal_repair["chain_valid_after"]:
+                        raise RuntimeError(
+                            "ChronoStore compact() did not restore WAL chain validity"
+                        )
+                    wal_repair["ok"] = True
+
                 migrate_counts = store.migrate_from_json(root / ".specsmith")
-            from specsmith.esdb import ESDB_BACKEND
 
             manifest["migrated"] = migrate_counts
             if ESDB_BACKEND == "chronomemory":
@@ -11994,7 +11995,27 @@ def esdb_migrate_cmd(project_dir: str, as_json: bool) -> None:
             else:
                 manifest["backend"] = "SQLite (.specsmith/esdb.sqlite3)"
         except Exception as _me:  # noqa: BLE001
+            issue_kind = "legacy-wal-chain-repair" if wal_repair["attempted"] else "esdb-migration"
+            migration_issue = {"kind": issue_kind, "detail": str(_me)}
+            issues.append(migration_issue)
+            errors.append(migration_issue)
+            ok = False
             manifest["chrono_error"] = str(_me)
+            if wal_repair["attempted"]:
+                wal_repair["ok"] = False
+
+    manifest["ok"] = ok
+    manifest["issues"] = issues
+    manifest["error_count"] = len(errors)
+    manifest["warning_count"] = len(issues) - len(errors)
+    manifest["wal_repair"] = wal_repair
+    manifest["next_step"] = (
+        "Ready for ChronoMemory native ingestion."
+        if ok
+        else "Fix errors above, then re-run to update the manifest."
+    )
+    manifest_path.parent.mkdir(parents=True, exist_ok=True)
+    manifest_path.write_text(_json.dumps(manifest, indent=2, ensure_ascii=False), encoding="utf-8")
 
     if as_json:
         click.echo(_json.dumps(manifest, indent=2))

{specsmith-0.22.0 → specsmith-0.22.2}/src/specsmith/config.py

@@ -140,7 +140,7 @@ class ProjectConfig(BaseModel):
         ),
     )
     language: str = Field(default="python", description="Primary language/runtime")
-    spec_version: str = Field(default="0.22.0", description="Spec version to scaffold from")
+    spec_version: str = Field(default="0.22.2", description="Spec version to scaffold from")
     description: str = Field(default="", description="Short project description")
 
     # Options

{specsmith-0.22.0 → specsmith-0.22.2}/src/specsmith/governance_logic.py

@@ -19,6 +19,16 @@ from pathlib import Path
 from typing import Any, cast
 
 
+def _is_environment_only_specsmith_upgrade(utterance: str) -> bool:
+    """Return whether an utterance only maintains the local pipx CLI."""
+    text = utterance.casefold()
+    return (
+        "specsmith" in text
+        and "pipx" in text
+        and any(action in text for action in ("install", "update", "upgrade"))
+    )
+
+
 def _safe_resolve(path: str | Path) -> Path:
     """Resolve a project directory path and reject traversal sequences.
 
@@ -88,6 +98,32 @@ def run_preflight(
     _safe_root = os.path.realpath(_raw)
     _root_str = _safe_root  # alias used by helpers later in this function
     intent = classify_intent(utterance)
+
+    # Local pipx maintenance is not a repository change.  Return before scope
+    # inference and persistence so the command cannot dirty a governed project.
+    if _is_environment_only_specsmith_upgrade(utterance):
+        return {
+            "decision": "environment_only",
+            "scope": "environment_only",
+            "work_item_id": "",
+            "requirement_ids": [],
+            "test_case_ids": [],
+            "confidence_target": 1.0,
+            "instruction": (
+                "Pipx-managed local SpecSmith CLI maintenance is outside project governance. "
+                "Proceed with `pipx upgrade specsmith`; no project work item or "
+                "records were created."
+            ),
+            "intent": intent.value,
+            "ai_disclosure": {
+                "governed_by": "specsmith",
+                "governance_gated": True,
+                "provider": os.environ.get("SPECSMITH_PROVIDER", "local/heuristic"),
+                "model": os.environ.get("SPECSMITH_MODEL", "deterministic-broker"),
+                "spec_version": __version__,
+            },
+        }
+
     # Requirements scope source for keyword matching in infer_scope().
     # Requirements are sourced from .specsmith/requirements.json (YAML-first mode);
     # the REQUIREMENTS.md markdown is only a token-overlap fallback.  The canonical

{specsmith-0.22.0 → specsmith-0.22.2}/src/specsmith/vcs_commands.py

@@ -39,9 +39,16 @@ def _run_git(root: Path, args: list[str], *, timeout: int = 30) -> GitResult:
 
 
 def get_current_branch(root: Path) -> str:
-    """Get the current git branch name."""
+    """Get the current git branch name for the supplied worktree."""
     result = _run_git(root, ["branch", "--show-current"])
-    return result.output if result.success else ""
+    branch = result.output.strip() if result.success else ""
+    if branch:
+        return branch
+
+    # ``branch --show-current`` is empty in some shell/worktree combinations
+    # despite HEAD being attached. ``symbolic-ref`` is the authoritative fallback.
+    result = _run_git(root, ["symbolic-ref", "--quiet", "--short", "HEAD"])
+    return result.output.strip() if result.success else ""
 
 
 def has_uncommitted_changes(root: Path) -> bool:
@@ -166,7 +173,12 @@ def run_push(root: Path, *, force: bool = False) -> GitResult:
 
     branch = get_current_branch(root)
     if not branch:
-        return GitResult(success=False, message="Not on any branch")
+        worktree = _run_git(root, ["rev-parse", "--show-toplevel"])
+        inspected = worktree.output.strip() if worktree.success else str(root.resolve())
+        return GitResult(
+            success=False,
+            message=f"Not on any branch in git worktree: {inspected}",
+        )
 
     # Safety: check branching strategy
     from specsmith.paths import find_scaffold

{specsmith-0.22.0 → specsmith-0.22.2/src/specsmith.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.22.0
+Version: 0.22.2
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -27,6 +27,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click>=8.1
+Requires-Dist: cryptography>=42.0
 Requires-Dist: jinja2>=3.1
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: pydantic>=2.0
@@ -38,10 +39,8 @@ Requires-Dist: ruff>=0.4; extra == "dev"
 Requires-Dist: mypy>=1.10; extra == "dev"
 Requires-Dist: pre-commit>=3.0; extra == "dev"
 Requires-Dist: types-pyyaml>=6.0; extra == "dev"
-Requires-Dist: cryptography>=42.0; extra == "dev"
 Provides-Extra: esdb
 Requires-Dist: chronomemory>=0.2.7; extra == "esdb"
-Requires-Dist: cryptography>=42.0; extra == "esdb"
 Provides-Extra: docs
 Requires-Dist: mkdocs>=1.6; extra == "docs"
 Requires-Dist: mkdocs-material>=9.5; extra == "docs"
@@ -73,7 +72,6 @@ Requires-Dist: pytest-cov>=4.0; extra == "all"
 Requires-Dist: ruff>=0.4; extra == "all"
 Requires-Dist: mypy>=1.10; extra == "all"
 Provides-Extra: license-verify
-Requires-Dist: cryptography>=42.0; extra == "license-verify"
 Dynamic: license-file
 
 # specsmith
@@ -317,6 +315,7 @@ If you hold a chronomemory ESDB license, activate the commercial backend:
 pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
 # or if using pipx:
 pipx inject specsmith "chronomemory>=0.2.0"  # inject into the specsmith pipx venv
+# The license verifier is included in base specsmith; no cryptography injection is needed.
 
 # Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key
@@ -340,6 +339,10 @@ pipx upgrade specsmith   # preferred — upgrades the pipx-isolated CLI
 specsmith self-update    # alternative: self-update from within specsmith
 ```
 
+An intent limited to maintaining the local pipx CLI is returned as the non-blocking
+`environment_only` preflight decision. It exits successfully and creates no project
+work item, ledger entry, or ESDB record. All `--help` invocations are read-only.
+
 ---
 
 ## Quick Start

{specsmith-0.22.0 → specsmith-0.22.2}/src/specsmith.egg-info/SOURCES.txt

@@ -321,6 +321,7 @@ tests/test_esdb_backend_switch.py
 tests/test_esdb_enforcement.py
 tests/test_esdb_integration.py
 tests/test_esdb_license.py
+tests/test_esdb_migrate_wal_repair.py
 tests/test_esdb_sqlite.py
 tests/test_esdb_status_integrity.py
 tests/test_esdb_status_output.py
@@ -358,6 +359,7 @@ tests/test_project_metrics.py
 tests/test_quality_report.py
 tests/test_rate_limits.py
 tests/test_release_guard.py
+tests/test_release_version_contract.py
 tests/test_releaser.py
 tests/test_repl.py
 tests/test_repl_extended.py
@@ -365,6 +367,7 @@ tests/test_reporting_commands.py
 tests/test_req_248_262.py
 tests/test_req_358_359.py
 tests/test_resume_command.py
+tests/test_rtd_deploy_workflow.py
 tests/test_scaffolder.py
 tests/test_schema_migrations.py
 tests/test_session_events.py
@@ -382,6 +385,7 @@ tests/test_typing_guardrails.py
 tests/test_updater.py
 tests/test_validator.py
 tests/test_vcs.py
+tests/test_vcs_commands.py
 tests/test_warp_parity.py
 tests/test_warp_parity_followup.py
 tests/test_wi_lifecycle.py

{specsmith-0.22.0 → specsmith-0.22.2}/src/specsmith.egg-info/requires.txt

@@ -1,4 +1,5 @@
 click>=8.1
+cryptography>=42.0
 jinja2>=3.1
 pyyaml>=6.0
 pydantic>=2.0
@@ -29,7 +30,6 @@ ruff>=0.4
 mypy>=1.10
 pre-commit>=3.0
 types-pyyaml>=6.0
-cryptography>=42.0
 
 [docs]
 mkdocs>=1.6
@@ -37,7 +37,6 @@ mkdocs-material>=9.5
 
 [esdb]
 chronomemory>=0.2.7
-cryptography>=42.0
 
 [gemini]
 google-genai>=1.0
@@ -50,7 +49,6 @@ sentence-transformers>=2.2
 numpy>=1.24
 
 [license-verify]
-cryptography>=42.0
 
 [mistral]
 openai>=1.0

{specsmith-0.22.0 → specsmith-0.22.2}/tests/test_cli.py

@@ -70,6 +70,68 @@ class TestCLIVersion:
         assert __version__ in result.output
 
 
+class TestCLIHelp:
+    def test_preflight_help_does_not_migrate_or_write_project_files(
+        self, tmp_path, monkeypatch
+    ) -> None:
+        """TEST-475: help must not mutate a project that needs migration."""
+        docs = tmp_path / "docs"
+        docs.mkdir()
+        (docs / "SPECSMITH.yml").write_text(
+            "name: temp-specsmith-repro\ntype: cli-python\nspec_version: 0.22.0\n",
+            encoding="utf-8",
+        )
+        (tmp_path / "LEDGER.md").write_text("# Ledger\n", encoding="utf-8")
+        before = {
+            path.relative_to(tmp_path): path.read_bytes()
+            for path in tmp_path.rglob("*")
+            if path.is_file()
+        }
+
+        monkeypatch.chdir(tmp_path)
+        result = CliRunner().invoke(
+            main,
+            ["preflight", "--help"],
+            env={"SPECSMITH_NO_UPDATE_CHECK": "1"},
+            catch_exceptions=False,
+        )
+
+        assert result.exit_code == 0, result.output
+        assert "Usage: " in result.output
+        assert "Auto-migrating" not in result.output
+        after = {
+            path.relative_to(tmp_path): path.read_bytes()
+            for path in tmp_path.rglob("*")
+            if path.is_file()
+        }
+        assert after == before
+
+
+class TestCheckpointAnchor:
+    def test_checkpoint_anchor_is_ascii_and_fixed_width(self, tmp_path: Path) -> None:
+        """TEST-479: anchor rows must render safely in proportional-font clients."""
+        result = CliRunner().invoke(
+            main,
+            ["checkpoint", "--project-dir", str(tmp_path)],
+            env={"SPECSMITH_NO_AUTO_UPDATE": "1"},
+            catch_exceptions=False,
+        )
+
+        assert result.exit_code == 0, result.output
+        lines = result.output.splitlines()
+        top = next(index for index, line in enumerate(lines) if line.startswith("+---"))
+        bottom = next(
+            index for index, line in enumerate(lines[top + 1 :], top + 1) if line.startswith("+---")
+        )
+        anchor = lines[top : bottom + 1]
+
+        assert all(line.isascii() for line in anchor)
+        assert all(len(line) == len(anchor[0]) for line in anchor)
+        assert anchor[0] == anchor[-1]
+        assert all(line.startswith("|") and line.endswith("|") for line in anchor[1:-1])
+        assert "Health  : " in "\n".join(anchor)
+
+
 class TestCLIInit:
     def test_init_from_config(self, tmp_path: Path) -> None:
         config = {