swarph-cli 0.41.1__tar.gz → 0.41.2__tar.gz

{swarph_cli-0.41.1/src/swarph_cli.egg-info → swarph_cli-0.41.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.41.1
+Version: 0.41.2
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.41.1 → swarph_cli-0.41.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.41.1"
+version = "0.41.2"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.41.1 → swarph_cli-0.41.2}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.41.1"
+__version__ = "0.41.2"
 
 __all__ = ["__version__"]

{swarph_cli-0.41.1 → swarph_cli-0.41.2}/src/swarph_cli/commands/board_merge_check.py

@@ -126,11 +126,51 @@ def decide(card: dict, pr_state: dict) -> Decision:
         "" if verdict else "missing or unparseable — expected '<cell> APPROVED <sha>'")
 
     author = card.get("created_by")
+    assignee = card.get("assignee")
     if verdict:
         # Author identity comes from the CARD. Git says the same account for every
         # cell, so it cannot answer "was this reviewed by someone else".
         add("reviewer is not the author", verdict["cell"] != author,
             f"reviewer={verdict['cell']} author={author}")
+        # >>> LEG 2 (#144): READ THE FROZEN, BOUND self_authored FLAG — NOT A
+        # GATE-TIME COMPARISON OF AN ASSERTED NAME. <<<
+        #
+        # The first version of this leg compared verdict["cell"] against
+        # card["assignee"]. drop-on-meta-edge showed it was DOUBLY WEAK, verified
+        # against the merged commit:
+        #
+        #  (i) ASSERTED — verdict["cell"] is parsed out of the peer_verdict VALUE,
+        #      which the writer controls. The assignee simply writes
+        #      "not-me APPROVED <sha>": cell(not-me) != assignee(me) PASSES, and the
+        #      created_by leg passes too. The self-review leg was defeated by
+        #      asserting a non-self name, so it meant nothing until the value's cell
+        #      was forced to equal the bound writer.
+        #
+        # (ii) GATE-TIME — it read card["assignee"] AT MERGE. Self-verdict, then the
+        #      work reassigns (the normal flow: 9% of live cards already have
+        #      created_by != assignee), and the gate sees cell != assignee(new) so a
+        #      STALE SELF-APPROVAL PASSES. Frozen-vs-mutable, on the fix itself.
+        #
+        # `self_authored` closes both in one read. The gateway computes it
+        # SERVER-SIDE from row["assignee"] == the BOUND writer and FREEZES it in
+        # link_stamps at write time: BOUND (so no asserted name can dodge it — no
+        # dependency on leg (a)) and FROZEN (so reassignment cannot launder it).
+        #
+        # ABSENCE IS NOT INNOCENCE. A verdict written before the flag existed has no
+        # stamp, and treating that as "not self-authored" would make this leg
+        # vacuous for exactly the backlog it must cover. ok=None => COULD NOT
+        # EVALUATE => REFUSE, which is this file's existing doctrine for the
+        # unreachable-GitHub case and the reason it has a tri-state at all.
+        _vstamp = (card.get("link_stamps") or {}).get("peer_verdict")
+        if _vstamp is None:
+            add("verdict is not self-authored", None,
+                "no link_stamp for peer_verdict — cannot tell who wrote it "
+                "(pre-#199 verdict, or a producer that dropped link_stamps); "
+                "COULD NOT EVALUATE, never a pass")
+        else:
+            add("verdict is not self-authored", not _vstamp.get("self_authored"),
+                f"self_authored={_vstamp.get('self_authored')!r} by={_vstamp.get('by')!r} "
+                f"— the person being reviewed cannot supply the review")
         add("verdict is APPROVED", verdict["verdict"] == "APPROVED",
             f"verdict={verdict['verdict']}")
         head = pr_state.get("head_sha") or ""
@@ -220,7 +260,41 @@ def fetch_pr_state(repo: str, number: str) -> dict:
 
 
 def format_decision(d: Decision) -> str:
-    lines = [f"card #{d.card_id}: {d.verdict}"]
+    """Render a decision, and >>> DISTINGUISH *FAILED* FROM *COULD NOT EVALUATE* IN
+    THE SUMMARY, NOT ONLY PER-LINE. <<<
+
+    Condition 1 of the date-holder's ruling on #144 (droplet, 2026-08-01):
+
+        "A gate that graduates and then refuses everything is INDISTINGUISHABLE
+         from a gate that never graduated — from the outside, and from the board.
+         The abstention rate must be REPORTED, not silent."
+
+    The register exists because "a recording phase that never graduates is a
+    control that does not exist, and it LOOKS LIKE PROGRESS ON A BOARD."
+    Abstention is that same failure wearing the opposite mask: near-total
+    abstention is acceptable as a TRANSIENT and is a dead control as a steady
+    state, and the only thing that tells them apart is whether anyone can SEE it
+    without going to look.
+
+    SCOPE, stated so it is not mistaken for more: this tool evaluates ONE card per
+    run (--card-json). It cannot compute a RATE. What it can do — and now does — is
+    make every run self-describing, naming which checks abstained and why, so the
+    caller that iterates cards can aggregate without parsing prose.
+    """
+    ok = sum(1 for c in d.checks if c.ok is True)
+    failed = [c for c in d.checks if c.ok is False]
+    blind = [c for c in d.checks if c.ok is None]
+    head = f"card #{d.card_id}: {d.verdict}"
+    if failed or blind:
+        head += (f"  —  {ok} ok · {len(failed)} FAILED · "
+                 f"{len(blind)} COULD-NOT-EVALUATE")
+        if blind:
+            # Name them. A count alone cannot tell "abstained on self-authorship
+            # because the stamp predates the flag" from "abstained because GitHub
+            # was unreachable", and those decay differently: one shrinks to zero as
+            # verdicts are rewritten, the other is an outage.
+            head += f"  [blind: {', '.join(c.name for c in blind)}]"
+    lines = [head]
     for c in d.checks:
         mark = "ok  " if c.ok is True else ("FAIL" if c.ok is False else "????")
         lines.append(f"  [{mark}] {c.name}" + (f" — {c.detail}" if c.detail else ""))

{swarph_cli-0.41.1 → swarph_cli-0.41.2/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.41.1
+Version: 0.41.2
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.41.1 → swarph_cli-0.41.2}/tests/test_board_merge_check.py

@@ -28,7 +28,15 @@ SHA = "abc1234def5678"
 def _card(**over):
     card = {"id": 152, "stage": "build", "move_ready": True, "created_by": "lab-ovh",
             "links": {"pr": "https://github.com/o/r/pull/152",
-                      "peer_verdict": f"droplet APPROVED {SHA}"}}
+                      "peer_verdict": f"droplet APPROVED {SHA}"},
+            # #144 leg 2: the DEFAULT fixture is a NORMAL card — a bound
+            # third-party verdict. Without a stamp the self-authorship leg reports
+            # COULD-NOT-EVALUATE (never a pass), which is correct behaviour and
+            # would otherwise make every unrelated test refuse for the wrong
+            # reason. Tests that care about the flag override it explicitly.
+            "link_stamps": {"peer_verdict": {"by": "droplet", "self_authored": False,
+                                             "caller_bound": True,
+                                             "at": "2026-08-01T00:00:00Z"}}}
     card.update(over)
     return card
 
@@ -219,3 +227,123 @@ def test_cli_reports_dry_run(tmp_path, capsys):
     out = capsys.readouterr().out
     assert "DRY RUN" in out
     assert rc == 2, "offline means COULD NOT EVALUATE (2), never a measured refusal (1)"
+
+
+# ── #144 leg 2: read the FROZEN, BOUND self_authored flag ────────────────────
+# The first version compared verdict["cell"] against card["assignee"].
+# drop-on-meta-edge showed it was doubly weak: (i) ASSERTED — the writer controls
+# the cell string, so an assignee writing "not-me APPROVED <sha>" passed it; and
+# (ii) GATE-TIME — it read the assignee at merge, so a self-verdict laundered by a
+# later reassignment passed. Both close by reading the server-computed flag.
+
+def _stamped(self_authored, by="droplet", **over):
+    """A card whose peer_verdict carries a link_stamp."""
+    return _card(link_stamps={"peer_verdict": {"by": by, "self_authored": self_authored,
+                                               "caller_bound": True, "at": "2026-08-01T00:00:00Z"}},
+                 **over)
+
+
+def test_a_SELF_AUTHORED_verdict_is_refused():
+    """>>> THE HOLE. <<< `is_exec_assignee` permits the assignee to write
+    peer_verdict on their own card, so the person being reviewed supplies the
+    review — no forgery, no privilege escalation. 20 of 213 live cards (9%) have
+    created_by != assignee, so the created_by leg passes on the normal split."""
+    d = mc.decide(_stamped(True, created_by="lab-ovh"), _pr())
+    assert not _fail(d, "reviewer is not the author"), (
+        "the created_by leg fired — this would pass for the wrong reason")
+    assert _fail(d, "verdict is not self-authored")
+    assert d.verdict != "WOULD_MERGE"
+
+
+def test_an_ASSERTED_non_self_name_CANNOT_dodge_it():
+    """WEAKNESS (i) OF THE FIRST VERSION, pinned. The assignee writes a verdict
+    naming someone else. The old leg compared that ASSERTED string and passed;
+    the flag is computed server-side from the BOUND writer, so the string is
+    irrelevant."""
+    card = _stamped(True, created_by="lab-ovh",
+                    links={"pr": "https://github.com/o/r/pull/152",
+                           "peer_verdict": f"not-me APPROVED {SHA}"})
+    d = mc.decide(card, _pr())
+    assert _fail(d, "verdict is not self-authored"), (
+        "an asserted non-self name defeated the self-review leg")
+
+
+def test_a_LATER_REASSIGNMENT_cannot_launder_a_self_verdict():
+    """WEAKNESS (ii), pinned. droplet self-verdicts, then the work is reassigned.
+    A gate-time comparison sees cell != assignee(new) and passes; the FROZEN flag
+    still says the verdict was self-authored when written."""
+    card = _stamped(True, created_by="lab-ovh", assignee="gridiron")  # reassigned away
+    d = mc.decide(card, _pr())
+    assert _fail(d, "verdict is not self-authored")
+
+
+def test_a_genuine_third_party_review_still_passes():
+    """NON-VACUITY. If the leg fired on real reviews it would be a blocker, not a
+    gate — and third-party review is the entire feature."""
+    card = _stamped(False, by="grok-researcher", created_by="lab-ovh",
+                    links={"pr": "https://github.com/o/r/pull/152",
+                           "peer_verdict": f"grok-researcher APPROVED {SHA}"})
+    d = mc.decide(card, _pr())
+    assert not _fail(d, "verdict is not self-authored")
+    assert d.verdict == "WOULD_MERGE", [(c.name, c.detail) for c in d.blockers]
+
+
+def test_a_MISSING_stamp_is_COULD_NOT_EVALUATE_never_a_pass():
+    """>>> ABSENCE IS NOT INNOCENCE. <<< A verdict written before the flag existed
+    has no stamp. Treating that as "not self-authored" would make this leg vacuous
+    for exactly the backlog it must cover — the empty-subject defect, in the fix
+    for a self-review defect. ok=None is this file's existing doctrine."""
+    for absent in ({}, None, {"some_other_key": {"by": "x"}}):
+        d = mc.decide(_card(created_by="lab-ovh", link_stamps=absent), _pr())
+        assert _fail(d, "verdict is not self-authored"), (
+            f"a verdict with NO peer_verdict stamp passed (link_stamps={absent!r}) "
+            "— absence read as innocence")
+        check = [c for c in d.blockers if c.name == "verdict is not self-authored"][0]
+        assert check.ok is None, "must be COULD-NOT-EVALUATE, not a hard False"
+
+
+def test_the_summary_DISTINGUISHES_failed_from_could_not_evaluate():
+    """>>> CONDITION 1 OF THE DATE-HOLDER'S RULING. <<< (droplet, #144.)
+
+    "A gate that graduates and then refuses everything is INDISTINGUISHABLE from a
+    gate that never graduated — from the outside, and from the board."
+
+    A REFUSE that fails a check and a REFUSE that could not see its subject are
+    different facts with different decay: the first is the gate working, the
+    second shrinks to zero as verdicts are rewritten — or doesn't, which is the
+    dead-control signal. They must not print the same.
+    """
+    d = mc.decide(_card(created_by="lab-ovh", link_stamps={}), _pr())
+    out = mc.format_decision(d)
+    assert "COULD-NOT-EVALUATE" in out
+    assert "blind:" in out
+    assert "verdict is not self-authored" in out.split("\n")[0], (
+        "the abstaining check must be NAMED on the summary line, not only "
+        "buried in the per-check list — a count cannot tell a stamp-less backlog "
+        "from a GitHub outage")
+
+
+def test_a_clean_pass_does_not_print_an_abstention_summary():
+    """NON-VACUITY. If the summary always printed the tri-state it would be noise
+    on every healthy run, and noise is how a gate stops being read."""
+    out = mc.format_decision(mc.decide(_card(), _pr()))
+    assert "COULD-NOT-EVALUATE" not in out
+    assert out.split("\n")[0] == "card #152: WOULD_MERGE"
+
+
+def test_a_READY_card_with_NO_peer_verdict_REFUSES():
+    """>>> drop-on-meta-edge's pin, and it guards a live emptiness. <<< MEASURED
+    2026-08-01: 13 cards are in build/test and ZERO carry a peer_verdict link. So
+    at arming EVERY ready card hits "peer verdict recorded on the card" = False →
+    REFUSE → human gate. The gate is safe-BY-EMPTINESS today.
+
+    That is the same empty-subject shape found all night (group_grants, the verdict
+    store) except here it fails SAFE — refuse, not pass — which is the one
+    direction that makes an empty subject acceptable rather than a defect.
+
+    Pinned so the day someone "helpfully" defaults a missing verdict to pass, it
+    fails loudly instead of silently auto-merging an unreviewed card.
+    """
+    d = mc.decide(_card(links={"pr": "https://github.com/o/r/pull/152"}), _pr())
+    assert _fail(d, "peer verdict recorded on the card")
+    assert d.verdict != "WOULD_MERGE"

{swarph_cli-0.41.1 → swarph_cli-0.41.2}/tests/test_brain_ask_command.py

@@ -17,7 +17,7 @@ from swarph_cli.commands import brain_ask as ba
 
 def test_version_is_0_33_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.41.1"
+    assert swarph_cli.__version__ == "0.41.2"
 
 
 # --- request / response plumbing -------------------------------------------

{swarph_cli-0.41.1 → swarph_cli-0.41.2}/tests/test_watchdog.py

@@ -1043,4 +1043,4 @@ def test_parser_defaults_process_name_claude_liveness_cmd_none():
 
 def test_version_is_0_33_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.41.1"
+    assert swarph_cli.__version__ == "0.41.2"