swarph-cli 0.41.2__tar.gz → 0.41.4__tar.gz

{swarph_cli-0.41.2/src/swarph_cli.egg-info → swarph_cli-0.41.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.41.2
+Version: 0.41.4
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.41.2"
+version = "0.41.4"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.41.2"
+__version__ = "0.41.4"
 
 __all__ = ["__version__"]

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/src/swarph_cli/commands/board.py

@@ -50,20 +50,43 @@ def _patch_json(url: str, body: dict, token: str, *, timeout: float = 10.0) -> t
 
 # ── pure builders (unit-tested) ───────────────────────────────────────────────
 
-def _cards_list_url(gateway: str, *, project=None, stage=None, assignee=None) -> str:
-    q = {k: v for k, v in (("project", project), ("stage", stage), ("assignee", assignee)) if v}
+def _cards_list_url(gateway: str, *, project=None, stage=None, assignee=None,
+                    label=None) -> str:
+    q = {k: v for k, v in (("project", project), ("stage", stage),
+                           ("assignee", assignee), ("label", label)) if v}
     base = f"{gateway.rstrip('/')}/board/cards"
     return f"{base}?{urllib.parse.urlencode(q)}" if q else base
 
 
-def _card_add_payload(actor, project_id, title, *, body=None, ai2=False, priority=0) -> dict:
+def _card_add_payload(actor, project_id, title, *, body=None, ai2=False, priority=0,
+                      labels=None) -> dict:
     p = {"actor": actor, "project_id": int(project_id), "title": title,
          "ai2": bool(ai2), "priority": int(priority)}
     if body:
         p["body"] = body
+    if labels:
+        p["labels"] = list(labels)
     return p
 
 
+def _apply_label(current: list, action: str, label: str) -> list:
+    """Compute the NEW label set. Pure, so the read-modify-write is testable
+    without a gateway.
+
+    The server takes a FULL REPLACEMENT (labels are a set — a merge-only field
+    could never REMOVE one), so `label rm` is unavoidably read-modify-write. That
+    is last-writer-wins between two simultaneous editors of the SAME card, which
+    the board already has for `stage` and `assignee` — stated rather than hidden,
+    because the alternative (server-side add/rm ops) is a bigger surface than
+    this card justifies.
+    """
+    cur = [str(x).strip().lower() for x in (current or [])]
+    lab = label.strip().lower()
+    if action == "add":
+        return cur if lab in cur else cur + [lab]
+    return [x for x in cur if x != lab]
+
+
 def _project_add_payload(actor, slug, title, *, goal=None) -> dict:
     p = {"actor": actor, "slug": slug, "title": title}
     if goal:
@@ -153,13 +176,17 @@ def _build_parser() -> argparse.ArgumentParser:
     cards = top.add_parser("cards", help="board cards").add_subparsers(dest="command", required=True)
     cl = cards.add_parser("list", help="list cards")
     cl.add_argument("--project"); cl.add_argument("--stage"); cl.add_argument("--assignee")
+    cl.add_argument("--label", help="only cards carrying this label (exact match)")
     cl.add_argument("--json", action="store_true"); _add_common(cl)
     cs = cards.add_parser("show", help="show one card"); cs.add_argument("id", type=int)
     cs.add_argument("--json", action="store_true"); _add_common(cs)
     ca = cards.add_parser("add", help="create a card")
     ca.add_argument("--project", required=True, help="project id or slug"); ca.add_argument("--title", required=True)
     ca.add_argument("--body"); ca.add_argument("--ai2", action="store_true")
-    ca.add_argument("--priority", type=int, default=0); ca.add_argument("--json", action="store_true"); _add_common(ca)
+    ca.add_argument("--priority", type=int, default=0)
+    ca.add_argument("--label", action="append", dest="labels", metavar="LABEL",
+                    help="attach a label (repeatable)")
+    ca.add_argument("--json", action="store_true"); _add_common(ca)
     cm = cards.add_parser("move", help="move a card to a stage")
     cm.add_argument("id", type=int); cm.add_argument("stage"); cm.add_argument("--json", action="store_true"); _add_common(cm)
     ck = cards.add_parser("link", help="add/update a link on a card (merges)")
@@ -167,6 +194,10 @@ def _build_parser() -> argparse.ArgumentParser:
     ck.add_argument("--json", action="store_true"); _add_common(ck)
     cn = cards.add_parser("assign", help="set a card's assignee")
     cn.add_argument("id", type=int); cn.add_argument("assignee"); cn.add_argument("--json", action="store_true"); _add_common(cn)
+    cb = cards.add_parser("label", help="add/remove a label on a card")
+    cb.add_argument("action", choices=["add", "rm"])
+    cb.add_argument("id", type=int); cb.add_argument("label")
+    cb.add_argument("--json", action="store_true"); _add_common(cb)
     cr = cards.add_parser("ready", help="flag a card ready-to-advance (move_ready) for the orchestrator")
     cr.add_argument("id", type=int); cr.add_argument("--clear", action="store_true", help="unset move_ready")
     cr.add_argument("--json", action="store_true"); _add_common(cr)
@@ -224,7 +255,9 @@ def run_board(argv: list[str]) -> int:
             if err:
                 print(f"swarph board: {err}", file=sys.stderr)
                 return 1
-            st, d = _http_get_json(_cards_list_url(gw, project=pid, stage=args.stage, assignee=args.assignee), token)
+            st, d = _http_get_json(_cards_list_url(gw, project=pid, stage=args.stage,
+                                                   assignee=args.assignee,
+                                                   label=getattr(args, "label", None)), token)
             return _out(st, d, _format_cards, aj)
         if args.command == "show":
             st, d = _http_get_json(f"{gw}/board/cards/{args.id}", token)
@@ -234,8 +267,26 @@ def run_board(argv: list[str]) -> int:
             if err or pid is None:
                 print(f"swarph board: {err or 'project required'}", file=sys.stderr)
                 return 1
-            st, d = _post_json(f"{gw}/board/cards", _card_add_payload(self_name, pid, args.title, body=args.body, ai2=args.ai2, priority=args.priority), token)
+            st, d = _post_json(f"{gw}/board/cards", _card_add_payload(
+                self_name, pid, args.title, body=args.body, ai2=args.ai2,
+                priority=args.priority, labels=getattr(args, "labels", None)), token)
             return _out(st, d, lambda x: f"created card #{x.get('id')} [{x.get('stage')}] (stage defaults to proposed — use `cards move` to advance)", aj)
+        if args.command == "label":
+            # READ the current set before replacing it. If the GET fails we must
+            # NOT write — a PATCH built on a failed read would silently CLOBBER
+            # every other label on the card. Refuse loudly instead.
+            st, cur = _http_get_json(f"{gw}/board/cards/{args.id}", token)
+            if st != 200 or not isinstance(cur, dict):
+                print(f"swarph board: cannot read card #{args.id} to modify its "
+                      f"labels (HTTP {st}) — refusing to write, a replacement built "
+                      f"on a failed read would drop the card's other labels",
+                      file=sys.stderr)
+                return 1
+            new = _apply_label(cur.get("labels") or [], args.action, args.label)
+            st, d = _patch_json(f"{gw}/board/cards/{args.id}",
+                                {"actor": self_name, "labels": new}, token)
+            return _out(st, d, lambda x: f"card #{x.get('id')} labels -> "
+                                         f"{', '.join(x.get('labels') or []) or '(none)'}", aj)
         if args.command == "move":
             st, d = _patch_json(f"{gw}/board/cards/{args.id}", {"actor": self_name, "stage": args.stage}, token)
             return _out(st, d, lambda x: f"card #{x.get('id')} -> {x.get('stage')}", aj)

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/src/swarph_cli/commands/board_merge_check.py

@@ -161,15 +161,41 @@ def decide(card: dict, pr_state: dict) -> Decision:
         # vacuous for exactly the backlog it must cover. ok=None => COULD NOT
         # EVALUATE => REFUSE, which is this file's existing doctrine for the
         # unreachable-GitHub case and the reason it has a tri-state at all.
+        # >>> A STAMP THAT EXISTS AND LACKS THE KEY IS AS BLIND AS NO STAMP AT ALL,
+        # AND IT IS 92% OF PRODUCTION. <<< (droplet, running decide() on the
+        # INSTALLED 0.41.2 rather than reading it.)
+        #
+        # The first version tested `_vstamp is None` — ABSENCE OF THE STAMP. The
+        # backlog's actual shape is a stamp that EXISTS (written before
+        # self_authored shipped) and lacks the KEY. That fell through to the
+        # comparison, where `.get("self_authored")` returns None, `not None` is
+        # True, and the leg reported ok=True. A textbook self-review PASSED.
+        #
+        # MEASURED: 53 link_stamps in production, 4 carrying the flag — 49 (92%)
+        # are the middle shape. So the leg was VACUOUS FOR EXACTLY THE BACKLOG IT
+        # WAS BUILT FOR: the outcome the design explicitly targets, and which I
+        # reported to the date-holder as avoided. He authorised near-total
+        # ABSTENTION on the backlog; what shipped was near-total PASS — the
+        # opposite, and MORE PERMISSIVE THAN THE PHASE-1 STATE IT REPLACES.
+        #
+        # The two blind causes are kept DISTINCT in the detail because they decay
+        # differently: a missing stamp is a producer that dropped it (an outage
+        # shape); a missing key is a verdict older than the flag (a shape that
+        # drains to zero as verdicts are rewritten). A single message would make
+        # them indistinguishable, which is the naming rule one level down.
         _vstamp = (card.get("link_stamps") or {}).get("peer_verdict")
-        if _vstamp is None:
+        if _vstamp is None or "self_authored" not in _vstamp:
+            _why = ("no link_stamp for peer_verdict at all — a producer dropped it, "
+                    "or the verdict predates #199"
+                    if _vstamp is None else
+                    f"link_stamp exists (by={_vstamp.get('by')!r}) but carries NO "
+                    f"self_authored key — the verdict predates the flag")
             add("verdict is not self-authored", None,
-                "no link_stamp for peer_verdict — cannot tell who wrote it "
-                "(pre-#199 verdict, or a producer that dropped link_stamps); "
-                "COULD NOT EVALUATE, never a pass")
+                f"{_why}; cannot tell whether the reviewee wrote it. "
+                f"COULD NOT EVALUATE, never a pass")
         else:
-            add("verdict is not self-authored", not _vstamp.get("self_authored"),
-                f"self_authored={_vstamp.get('self_authored')!r} by={_vstamp.get('by')!r} "
+            add("verdict is not self-authored", not _vstamp["self_authored"],
+                f"self_authored={_vstamp['self_authored']!r} by={_vstamp.get('by')!r} "
                 f"— the person being reviewed cannot supply the review")
         add("verdict is APPROVED", verdict["verdict"] == "APPROVED",
             f"verdict={verdict['verdict']}")

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/src/swarph_cli/commands/daemon.py

@@ -138,7 +138,21 @@ def _resolve_state_dir(arg: Optional[str], self_name_arg: Optional[str]) -> Path
 
 
 def _resolve_token(token_file_arg: Optional[str]) -> str:
-    """Mirror onboard's resolution. env → secrets.toml mode 0600 → prompt."""
+    """DELEGATES to onboard's resolver (#243) — and this docstring used to lie.
+
+    It read "Mirror onboard's resolution. env -> secrets.toml mode 0600 ->
+    prompt", which describes a COPY. The body has always been a delegation, so
+    the fix for #243 reached this verb for free — but a reader auditing which
+    verbs inherited the retired-credential bug would have read this line and
+    concluded daemon had its own broken copy. I did exactly that, and carded it.
+
+    >>> A DOCSTRING THAT DESCRIBES A COPY OVER A BODY THAT DELEGATES IS A STALE
+    RECORD, AND IT COSTS THE NEXT READER THE SAME WRONG CONCLUSION. <<< The
+    resolution order it names is also now wrong: onboard gained
+    ~/.config/swarph/<SWARPH_SELF>.peer_token and REFUSES rather than prompting.
+    Naming the delegation instead of restating the order means this cannot go
+    stale again.
+    """
     from swarph_cli.commands.onboard import _resolve_token as _onboard_resolve
 
     return _onboard_resolve(token_file_arg)

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/src/swarph_cli/commands/onboard.py

@@ -167,14 +167,51 @@ def _resolve_token(token_file_arg: Optional[str]) -> str:
                 f"swarph onboard: failed to read {secrets_path}: {exc}", file=sys.stderr
             )
 
-    print_safe(
-        f"swarph onboard: MESH_GATEWAY_TOKEN not in env, not found in {secrets_path}.\n"
-        f"  Canonical secrets.toml shape (mode 0600):\n"
-        f"    MESH_GATEWAY_TOKEN=<your-token>\n"
-        f"  Falling back to interactive prompt.",
-        file=sys.stderr,
+    # ── #243: THE PER-PEER TOKEN — THE CREDENTIAL THAT ACTUALLY EXISTS ──────
+    # >>> THIS VERB WAS LOOKING ONLY FOR THE CREDENTIAL THE R1 MIGRATION
+    # RETIRED. <<< Measured on lab-ovh 2026-08-03: $MESH_GATEWAY_TOKEN UNSET,
+    # ~/.swarph/secrets.toml ABSENT, and 10+ files present at
+    # ~/.config/swarph/<peer>.peer_token. Every other verb resolves the per-peer
+    # file; onboard (and ratify, which re-exports this function, and daemon,
+    # which copied it) were left on the old path — classic mint-vs-cutover, the
+    # credential moved and three consumers did not.
+    #
+    # AND THE GATEWAY NEVER REQUIRED THE SHARED TOKEN: measured, POST
+    # /peers/register with a PER-PEER token returns 200 and mints. So this was
+    # never a permissions problem — only a lookup that never learned.
+    #
+    # Placed AFTER the existing two so a working operator-token setup is
+    # unchanged; this only fills the hole where the verb used to prompt.
+    self_name = os.environ.get("SWARPH_SELF", "").strip()
+    if self_name:
+        peer_tok = Path.home() / ".config" / "swarph" / f"{self_name}.peer_token"
+        if peer_tok.exists():
+            try:
+                val = peer_tok.read_text(encoding="utf-8").strip()
+                if val:
+                    return val
+            except Exception as exc:
+                print_safe(f"swarph onboard: failed to read {peer_tok}: {exc}",
+                           file=sys.stderr)
+
+    # >>> REFUSE. DO NOT PROMPT. <<< getpass on a non-tty is a guaranteed
+    # EOFError, and this verb runs from scripts, cron and spawned cells — the
+    # traceback it produced was reported as a BROKEN VERB, not as a missing
+    # credential, because the prompt hid which of the two it was.
+    #
+    # NOTE the deliberate absence of a default for SWARPH_SELF: guessing a name
+    # makes a cell hunt ANOTHER CELL'S token, find nothing, and blame the
+    # credential — measured on 6 of 6 cells 2026-07-29. Unset is named as unset.
+    raise RuntimeError(
+        "no gateway credential found. Tried, in order:\n"
+        f"  1. --token-file            {'(not given)' if not token_file_arg else token_file_arg}\n"
+        "  2. $MESH_GATEWAY_TOKEN     (unset)\n"
+        f"  3. {secrets_path}\n"
+        f"  4. ~/.config/swarph/<self>.peer_token  "
+        + (f"(SWARPH_SELF={self_name!r} -> not found)" if self_name
+           else "(SWARPH_SELF IS UNSET — set it; this verb will not guess a peer name)")
+        + "\n  The per-peer token is sufficient: POST /peers/register accepts it."
     )
-    return getpass("MESH_GATEWAY_TOKEN: ").strip()
 
 
 def _post_json(

{swarph_cli-0.41.2 → swarph_cli-0.41.4/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.41.2
+Version: 0.41.4
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/src/swarph_cli.egg-info/SOURCES.txt

@@ -94,6 +94,8 @@ src/swarph_cli/service/providers.py
 src/swarph_cli/systemd/swarph-watchdog.default
 src/swarph_cli/systemd/swarph-watchdog.service
 src/swarph_cli/systemd/swarph-watchdog.timer
+tests/test_243_onboard_per_peer_token.py
+tests/test_84_cli_labels.py
 tests/test_add_security_gate.py
 tests/test_artifact_add.py
 tests/test_artifact_hash.py

swarph_cli-0.41.4/tests/test_243_onboard_per_peer_token.py

@@ -0,0 +1,86 @@
+"""#243 — `swarph onboard` resolved ONLY the credential the R1 migration retired.
+
+Measured on lab-ovh 2026-08-03: $MESH_GATEWAY_TOKEN UNSET, ~/.swarph/secrets.toml
+ABSENT, and 10+ files present at ~/.config/swarph/<peer>.peer_token. Every other
+verb resolves the per-peer file; onboard (and ratify, which re-exports it, and
+daemon, which COPIED it) were left on the old path.
+
+The gateway never required the shared token — POST /peers/register accepts a
+per-peer token and mints (measured). So this was never permissions, only a lookup
+that never learned.
+"""
+import pytest
+
+from swarph_cli.commands import onboard
+
+
+@pytest.fixture(autouse=True)
+def _no_ambient_credentials(monkeypatch, tmp_path):
+    """The bug is invisible on a box that still has the old credential, so the
+    fixture removes BOTH retired sources — which is the state of every cell
+    since the migration."""
+    monkeypatch.delenv("MESH_GATEWAY_TOKEN", raising=False)
+    monkeypatch.delenv("SWARPH_SELF", raising=False)
+    monkeypatch.setattr(onboard.Path, "home", staticmethod(lambda: tmp_path))
+    return tmp_path
+
+
+def _write_peer_token(home, peer, value="tok-per-peer"):
+    d = home / ".config" / "swarph"
+    d.mkdir(parents=True, exist_ok=True)
+    (d / f"{peer}.peer_token").write_text(value, encoding="utf-8")
+
+
+def test_it_resolves_the_PER_PEER_token(_no_ambient_credentials, monkeypatch):
+    """>>> THE BUG. <<< With no shared token anywhere — the state of every cell
+    since R1 — onboard must find the per-peer file rather than prompting."""
+    _write_peer_token(_no_ambient_credentials, "lab-ovh")
+    monkeypatch.setenv("SWARPH_SELF", "lab-ovh")
+    assert onboard._resolve_token(None) == "tok-per-peer"
+
+
+def test_it_REFUSES_instead_of_prompting_when_nothing_is_found(_no_ambient_credentials):
+    """getpass on a non-tty is a guaranteed EOFError, and this verb runs from
+    scripts, cron and spawned cells. The refusal must NAME the places it looked —
+    the prompt is what made a missing credential look like a broken verb."""
+    with pytest.raises(RuntimeError) as e:
+        onboard._resolve_token(None)
+    msg = str(e.value)
+    assert "MESH_GATEWAY_TOKEN" in msg
+    assert "peer_token" in msg
+    assert "SWARPH_SELF IS UNSET" in msg, (
+        "an unset SWARPH_SELF must be named as unset — guessing a peer name makes "
+        "a cell hunt ANOTHER CELL'S token and blame the credential")
+
+
+def test_it_does_NOT_guess_a_peer_name(_no_ambient_credentials):
+    """MEASURED 2026-07-29 on 6 of 6 cells: a default self-name makes a cell look
+    for lab-ovh's token, find nothing, and report a TOKEN fault. Harmless on
+    lab-ovh, silently wrong everywhere else."""
+    _write_peer_token(_no_ambient_credentials, "lab-ovh")   # present but not ours
+    with pytest.raises(RuntimeError):
+        onboard._resolve_token(None)                        # SWARPH_SELF unset
+
+
+def test_the_SHARED_token_still_wins_when_present(_no_ambient_credentials, monkeypatch):
+    """NON-VACUITY. The per-peer path is ADDITIVE — an operator with a working
+    shared-token setup must be unaffected, or the fix trades one broken
+    population for another."""
+    _write_peer_token(_no_ambient_credentials, "lab-ovh", "tok-per-peer")
+    monkeypatch.setenv("SWARPH_SELF", "lab-ovh")
+    monkeypatch.setenv("MESH_GATEWAY_TOKEN", "tok-shared")
+    assert onboard._resolve_token(None) == "tok-shared"
+
+
+def test_ratify_and_daemon_resolve_through_THE_SAME_function():
+    """>>> ratify RE-EXPORTED and was fixed for free; daemon COPIED and was not.
+    <<< A copy made to keep two things identical keeps them identical only until
+    one is fixed. Both now delegate, so the next credential migration cannot
+    break one and not the others."""
+    from swarph_cli.commands import ratify, daemon
+    import inspect
+    for mod in (ratify, daemon):
+        src = inspect.getsource(mod._resolve_token)
+        assert "from swarph_cli.commands.onboard import _resolve_token" in src, (
+            f"{mod.__name__} does not delegate — it has its own copy and will "
+            "diverge at the next migration")

swarph_cli-0.41.4/tests/test_84_cli_labels.py

@@ -0,0 +1,81 @@
+"""#84 CLI half — `--label` filter, `--label` on add, `cards label add/rm`.
+
+The gateway takes a FULL REPLACEMENT for labels (they are a set — a merge-only
+field could never REMOVE one), so `label rm` is unavoidably read-modify-write.
+The risk that creates is the one these tests pin: a replacement built on a FAILED
+read would silently drop every other label on the card.
+"""
+import pytest
+
+from swarph_cli.commands import board as b
+
+
+# ── the pure transform, so the RMW is testable without a gateway ────────────
+
+@pytest.mark.parametrize("cur,action,lab,want", [
+    ([], "add", "obligation-ledger", ["obligation-ledger"]),
+    (["a"], "add", "b", ["a", "b"]),
+    (["a", "b"], "rm", "a", ["b"]),
+    (["a"], "rm", "nope", ["a"]),                      # removing an absent label is a no-op
+    (["a"], "add", "a", ["a"]),                        # idempotent add
+    (["a"], "add", "A", ["a"]),                        # case is a WRITING variation, not a new label
+    (["A", "B"], "rm", "a", ["b"]),                    # ...on both sides
+    (None, "add", "x", ["x"]),                         # a card with no labels column yet
+])
+def test_apply_label(cur, action, lab, want):
+    assert b._apply_label(cur, action, lab) == want
+
+
+def test_add_is_idempotent_and_order_preserving():
+    """Labels are a SET but the ORDER is what a human reads. Re-adding must not
+    reorder — a card whose labels shuffle on every touch is noise in the diff."""
+    out = ["one", "two", "three"]
+    for lab in ("one", "two", "three"):
+        out = b._apply_label(out, "add", lab)
+    assert out == ["one", "two", "three"]
+
+
+# ── the URL + payload builders ─────────────────────────────────────────────
+
+def test_list_url_carries_the_label_filter():
+    url = b._cards_list_url("http://gw", project=8, label="obligation-ledger")
+    assert "label=obligation-ledger" in url
+    assert "project=8" in url
+
+
+def test_list_url_omits_the_filter_when_absent():
+    """NON-VACUITY: an empty filter must not become `?label=`, which the gateway
+    would read as a request for cards labelled with the empty string."""
+    assert "label" not in b._cards_list_url("http://gw", project=8)
+    assert "label" not in b._cards_list_url("http://gw", project=8, label=None)
+    assert "label" not in b._cards_list_url("http://gw", project=8, label="")
+
+
+def test_add_payload_carries_labels_only_when_given():
+    assert "labels" not in b._card_add_payload("me", 8, "t")
+    p = b._card_add_payload("me", 8, "t", labels=["a", "b"])
+    assert p["labels"] == ["a", "b"]
+
+
+# ── >>> THE CLOBBER GUARD — the reason the RMW is safe <<< ──────────────────
+
+def test_label_REFUSES_to_write_when_the_read_FAILS(monkeypatch, capsys):
+    """>>> A REPLACEMENT BUILT ON A FAILED READ WOULD DROP EVERY OTHER LABEL. <<<
+
+    `label add` must GET the card, compute the new set, then PATCH the whole
+    array. If the GET fails and the code proceeds with `[]` as "current", the
+    PATCH silently erases the card's other labels — a data-loss bug that looks
+    like a successful write.
+
+    Pinned by making the GET fail and asserting NOTHING is patched.
+    """
+    patched = []
+    monkeypatch.setattr(b, "_http_get_json", lambda *a, **k: (503, {"detail": "down"}))
+    monkeypatch.setattr(b, "_patch_json", lambda *a, **k: patched.append(a) or (200, {}))
+    monkeypatch.setattr(b, "_resolve_self_name", lambda *_: "lab-ovh")
+    monkeypatch.setattr(b, "_resolve_token", lambda *_: "tok")
+
+    rc = b.run_board(["cards", "label", "add", "1", "x", "--gateway", "http://gw"])
+    assert rc == 1, "a failed read must refuse, not fall through to a write"
+    assert patched == [], "PATCHED after a failed GET — the other labels were clobbered"
+    assert "refusing to write" in capsys.readouterr().err

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/tests/test_board_merge_check.py

@@ -347,3 +347,50 @@ def test_a_READY_card_with_NO_peer_verdict_REFUSES():
     d = mc.decide(_card(links={"pr": "https://github.com/o/r/pull/152"}), _pr())
     assert _fail(d, "peer verdict recorded on the card")
     assert d.verdict != "WOULD_MERGE"
+
+
+def test_a_stamp_WITHOUT_the_self_authored_KEY_abstains_like_no_stamp():
+    """>>> THE BUG THAT SHIPPED IN 0.41.2, AND IT WAS 92% OF PRODUCTION. <<<
+
+    Found by droplet RUNNING decide() on the installed package instead of reading
+    it. The first version tested `_vstamp is None` — absence of the STAMP. The
+    backlog's real shape is a stamp that EXISTS (written before self_authored
+    shipped) and lacks the KEY: it fell through to the comparison, where
+    `.get("self_authored")` returns None, `not None` is True, and A TEXTBOOK
+    SELF-REVIEW PASSED.
+
+    Measured at the time: 53 link_stamps in production, 4 carrying the flag — 49
+    (92%) were this shape. The leg was VACUOUS FOR EXACTLY THE BACKLOG IT WAS
+    BUILT FOR, which is the outcome the design explicitly targets and which I had
+    reported to the date-holder as avoided. He authorised near-total ABSTENTION;
+    what shipped was near-total PASS.
+
+    WHY THE VERIFICATION MISSED IT: the wheel audit and the end-to-end check
+    covered self_authored=True (refuses) and no-stamp (abstains). Both correct,
+    NEITHER IS THE PRODUCTION SHAPE. The untested case was the only one that
+    exists in the data.
+    """
+    stamp_no_key = {"peer_verdict": {"by": "droplet", "caller_bound": True,
+                                     "at": "2026-08-01T00:00:00Z"}}
+    d = mc.decide(_card(created_by="lab-ovh", assignee="droplet",
+                        link_stamps=stamp_no_key), _pr())
+    check = [c for c in d.checks if c.name == "verdict is not self-authored"][0]
+    assert check.ok is None, (
+        "a stamp lacking the self_authored KEY passed the self-review leg — "
+        "vacuous for 92% of production")
+    assert d.verdict != "WOULD_MERGE"
+
+
+def test_the_two_BLIND_causes_are_named_distinctly():
+    """They decay differently and must not print the same: a MISSING STAMP is a
+    producer that dropped it (outage shape); a MISSING KEY is a verdict older than
+    the flag (drains to zero as verdicts are rewritten). One message for both
+    would make a permanent outage indistinguishable from a shrinking backlog."""
+    no_stamp = mc.decide(_card(created_by="lab-ovh", link_stamps={}), _pr())
+    no_key = mc.decide(_card(created_by="lab-ovh",
+                             link_stamps={"peer_verdict": {"by": "droplet"}}), _pr())
+    d1 = [c for c in no_stamp.checks if c.name == "verdict is not self-authored"][0].detail
+    d2 = [c for c in no_key.checks if c.name == "verdict is not self-authored"][0].detail
+    assert d1 != d2, "both blind causes printed the same detail"
+    assert "at all" in d1
+    assert "predates the flag" in d2

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/tests/test_brain_ask_command.py

@@ -17,7 +17,7 @@ from swarph_cli.commands import brain_ask as ba
 
 def test_version_is_0_33_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.41.2"
+    assert swarph_cli.__version__ == "0.41.4"
 
 
 # --- request / response plumbing -------------------------------------------

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/tests/test_onboard_command.py

@@ -48,14 +48,30 @@ def test_resolve_token_warns_on_loose_mode(monkeypatch, tmp_path, capsys):
     assert "0o644" in err
 
 
-def test_resolve_token_falls_back_to_prompt(monkeypatch, tmp_path, capsys):
+def test_resolve_token_REFUSES_rather_than_prompting(monkeypatch, tmp_path):
+    """>>> THIS TEST USED TO ASSERT THE PROMPT, AND THE PROMPT WAS THE BUG (#243).
+    <<<
+
+    It pinned `falls_back_to_prompt` — correct when a shared MESH_GATEWAY_TOKEN
+    was the only credential. After the R1 per-peer migration neither
+    $MESH_GATEWAY_TOKEN nor ~/.swarph/secrets.toml exists on any cell, so the
+    prompt became the DEFAULT path — and getpass on a non-tty is a guaranteed
+    EOFError. `swarph onboard` was reported as a broken verb; it was a missing
+    credential wearing a traceback.
+
+    The expectation is flipped DELIBERATELY: refuse, naming every place it
+    looked, so the operator learns which credential is absent instead of meeting
+    a prompt that cannot be answered.
+    """
     monkeypatch.delenv("MESH_GATEWAY_TOKEN", raising=False)
-    monkeypatch.setattr(onboard, "getpass", lambda _: "prompted-tok")
-    fake = tmp_path / "no-such-file.toml"
-    out = onboard._resolve_token(str(fake))
-    assert out == "prompted-tok"
-    err = capsys.readouterr().err
-    assert "secrets.toml shape" in err  # operator learns the pattern
+    monkeypatch.delenv("SWARPH_SELF", raising=False)
+    monkeypatch.setattr(onboard.Path, "home", staticmethod(lambda: tmp_path))
+    with pytest.raises(RuntimeError) as e:
+        onboard._resolve_token(str(tmp_path / "no-such-file.toml"))
+    msg = str(e.value)
+    assert "MESH_GATEWAY_TOKEN" in msg and "peer_token" in msg, (
+        "the refusal must name every place it looked — a bare failure leaves the "
+        "operator guessing which of four credentials is missing")
 
 
 # ---------------------------------------------------------------------------

{swarph_cli-0.41.2 → swarph_cli-0.41.4}/tests/test_watchdog.py

@@ -1043,4 +1043,4 @@ def test_parser_defaults_process_name_claude_liveness_cmd_none():
 
 def test_version_is_0_33_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.41.2"
+    assert swarph_cli.__version__ == "0.41.4"