technical-debt-engine-runtime 1.0.0__tar.gz → 1.0.1__tar.gz

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: technical-debt-engine-runtime
-Version: 1.0.0
+Version: 1.0.1
 Summary: Technical Debt Engine runtime foundation API
 Requires-Python: >=3.11
 Requires-Dist: radon==6.0.1

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "technical-debt-engine-runtime"
-version = "1.0.0"
+version = "1.0.1"
 description = "Technical Debt Engine runtime foundation API"
 requires-python = ">=3.11"
 dependencies = ["radon==6.0.1"]

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/src/tde_cli/main.py

@@ -29,7 +29,7 @@ from tde_runtime.repository_qualification import (QualificationRegistry,
 from tde_runtime.differential import AssessmentBaselineRegistry, DifferentialEngine, DifferentialError
 
 
-CLI_VERSION = "1.0.0"
+CLI_VERSION = "1.0.1"
 GENERATION = "1"
 
 

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/src/tde_runtime/dependency_health.py

@@ -11,7 +11,7 @@ import re
 import shutil
 import subprocess
 import tomllib
-from typing import Any
+from typing import Any, Mapping
 import xml.etree.ElementTree as ET
 
 
@@ -21,13 +21,13 @@ CAPABILITY_ID = "dependency_health"
 CAPABILITY_VERSION = "1.0.0"
 
 
-def analyze(root: Path, timeout: int) -> dict[str, Any]:
+def analyze(root: Path, timeout: int, settings: Mapping[str, Any] | None = None) -> dict[str, Any]:
     """Normalize only package ecosystems actually present in a repository."""
     records = []
     if (root / "package.json").is_file(): records.append(_npm(root, timeout))
     python = _python(root, timeout)
     if python is not None: records.append(python)
-    nuget = _nuget(root, timeout)
+    nuget = _nuget(root, timeout, settings)
     if nuget is not None: records.append(nuget)
     if (root / "platformio.ini").is_file(): records.append(_platformio(root, timeout))
     if (root / "Package.swift").is_file(): records.append(_swift(root, timeout))
@@ -88,35 +88,69 @@ def _python(root: Path, timeout: int) -> dict[str, Any] | None:
     return _record("PyPI", "pip", sorted(direct), None, None, outdated, {"id": "pip", "version": version}, "".join(raw), limitations)
 
 
-def _nuget(root: Path, timeout: int) -> dict[str, Any] | None:
+def _nuget(root: Path, timeout: int, settings: Mapping[str, Any] | None = None) -> dict[str, Any] | None:
     projects = _manifest_files(root, "*.csproj")
     if not projects: return None
-    direct = []
     for project in projects:
-        try: direct.extend(item.attrib["Include"] for item in ET.parse(project).iter() if item.tag.endswith("PackageReference") and "Include" in item.attrib)
+        try: _project_frameworks(project)
         except (ET.ParseError, OSError) as error: return _blocked("NuGet", "dotnet", str(error))
+    direct = _nuget_direct_dependencies(projects)
     dotnet = shutil.which("dotnet")
     if not dotnet: return _record("NuGet", "dotnet", sorted(set(direct)), None, None, None, {"id": "dotnet", "version": "UNAVAILABLE"}, "", [_limitation("dependency_health.dotnet.unavailable", "dotnet was not found on PATH")])
+    try: selected_framework = _nuget_framework(settings)
+    except ValueError as error: return _configuration_failed("NuGet", "dotnet", str(error))
     raw, outdated, transitive, limitations = [], [], [], []
     for project in projects:
         try:
-            completed = subprocess.run([dotnet, "package", "list", "--project", str(project), "--outdated", "--include-transitive", "--format", "json"], cwd=root, capture_output=True, text=True, timeout=timeout, check=False)
-            raw.append(completed.stdout); payload = json.loads(completed.stdout or "{}")
-            problems = payload.get("problems", [])
-            errors = [item.get("text", "NuGet analysis failed") for item in problems if item.get("level") == "error"]
-            if completed.returncode != 0 or errors:
-                detail = "; ".join(errors) or completed.stderr.strip() or f"dotnet exited with status {completed.returncode}"
-                return _analysis_failed("NuGet", "dotnet", f"{project}: {detail}")
-            for project_data in payload.get("projects", []):
-                for framework in project_data.get("frameworks", []):
-                    outdated.extend(item["id"] for item in framework.get("topLevelPackages", []) if item.get("latestVersion"))
-                    outdated.extend(item["id"] for item in framework.get("transitivePackages", []) if item.get("latestVersion"))
-                    transitive.extend(item["id"] for item in framework.get("transitivePackages", []) if item.get("id"))
+            output, project_outdated, project_transitive = _nuget_project(dotnet, root, project, selected_framework, timeout)
+            raw.append(output); outdated.extend(project_outdated); transitive.extend(project_transitive)
+        except ValueError as error:
+            return _configuration_failed("NuGet", "dotnet", str(error))
+        except _NugetAnalysisError as error:
+            return _analysis_failed("NuGet", "dotnet", f"{project}: {error}")
         except (OSError, subprocess.SubprocessError, json.JSONDecodeError) as error:
             outdated = None; transitive = None; limitations.append(_limitation("dependency_health.nuget.outdated.unavailable", str(error)))
     return _record("NuGet", "dotnet", sorted(set(direct)), None if transitive is None else sorted(set(transitive) - set(direct)), None, None if outdated is None else sorted(set(outdated)), {"id": "dotnet", "version": _version(dotnet, root, timeout)}, "".join(raw), limitations)
 
 
+class _NugetAnalysisError(Exception):
+    """Native package-manager output cannot provide canonical evidence."""
+
+
+def _nuget_direct_dependencies(projects: list[Path]) -> list[str]:
+    return [item.attrib["Include"] for project in projects for item in ET.parse(project).iter()
+            if item.tag.endswith("PackageReference") and "Include" in item.attrib]
+
+
+def _nuget_framework(settings: Mapping[str, Any] | None) -> str | None:
+    value = (settings or {}).get("nugetFramework")
+    if value is None: return None
+    if not isinstance(value, str) or not value.strip():
+        raise ValueError("dependency_health.nugetFramework must be a non-empty string")
+    return value.strip()
+
+
+def _nuget_project(dotnet: str, root: Path, project: Path, framework: str | None, timeout: int) -> tuple[str, list[str], list[str]]:
+    if framework and (declared := _project_frameworks(project)) and framework not in declared:
+        raise ValueError(f"{project}: configured nugetFramework '{framework}' is not declared by the project")
+    command = [dotnet, "package", "list", "--project", str(project), "--outdated", "--include-transitive", "--format", "json"]
+    if framework: command.extend(["--framework", framework])
+    completed = subprocess.run(command, cwd=root, capture_output=True, text=True, timeout=timeout, check=False)
+    payload = json.loads(completed.stdout or "{}")
+    errors = [item.get("text", "NuGet analysis failed") for item in payload.get("problems", []) if item.get("level") == "error"]
+    if completed.returncode != 0 or errors:
+        raise _NugetAnalysisError("; ".join(errors) or completed.stderr.strip() or f"dotnet exited with status {completed.returncode}")
+    return completed.stdout, *_nuget_packages(payload)
+
+
+def _nuget_packages(payload: Mapping[str, Any]) -> tuple[list[str], list[str]]:
+    frameworks = [framework for project in payload.get("projects", []) for framework in project.get("frameworks", [])]
+    outdated = [item["id"] for framework in frameworks for key in ("topLevelPackages", "transitivePackages")
+                for item in framework.get(key, []) if item.get("latestVersion")]
+    transitive = [item["id"] for framework in frameworks for item in framework.get("transitivePackages", []) if item.get("id")]
+    return outdated, transitive
+
+
 def _platformio(root: Path, timeout: int) -> dict[str, Any]:
     direct = []
     lines = (root / "platformio.ini").read_text(encoding="utf-8").splitlines(); in_deps = False
@@ -148,6 +182,7 @@ def _record(ecosystem: str, manager: str, direct: list[str], transitive: list[st
 
 def _blocked(ecosystem: str, manager: str, reason: str) -> dict[str, Any]: return _record(ecosystem, manager, [], None, None, None, {"id": manager, "version": "UNAVAILABLE"}, "", [_limitation("dependency_health.manifest.invalid", reason, True)])
 def _analysis_failed(ecosystem: str, manager: str, reason: str) -> dict[str, Any]: return _record(ecosystem, manager, [], None, None, None, {"id": manager, "version": "UNAVAILABLE"}, "", [_limitation(f"dependency_health.{manager}.analysis.failed", reason, True)])
+def _configuration_failed(ecosystem: str, manager: str, reason: str) -> dict[str, Any]: return _record(ecosystem, manager, [], None, None, None, {"id": manager, "version": "UNAVAILABLE"}, "", [_limitation("dependency_health.nuget.configuration.invalid", reason, True)])
 def _unavailable(reason: str) -> dict[str, Any]: return {"status": "VALID", "ecosystems": [], "rawOutput": "", "rawOutputHash": "sha256:" + sha256(b"").hexdigest(), "limitations": [_limitation("dependency_health.ecosystem.unavailable", reason)] , "available": False}
 def _limitation(identifier: str, description: str, blocking: bool = False) -> dict[str, Any]: return {"id": identifier, "description": description, "cause": "dependency health", "blocking": blocking}
 def _version(executable: str, root: Path, timeout: int) -> str:
@@ -169,5 +204,15 @@ def _manifest_files(root: Path, pattern: str) -> list[Path]:
     return sorted(manifests)
 
 
+def _project_frameworks(project: Path) -> set[str]:
+    """Return target frameworks declared by a project without evaluating it."""
+    document = ET.parse(project)
+    values = []
+    for element in document.iter():
+        if element.tag.endswith(("TargetFramework", "TargetFrameworks")) and element.text:
+            values.extend(item.strip() for item in element.text.split(";") if item.strip())
+    return set(values)
+
+
 def _ignored_directory(name: str) -> bool:
     return name in {".git", "node_modules", "dist", "build", ".venv", "venv", ".build", ".swiftpm", ".pio", ".release", ".public-release"} or name.startswith(".xcode-derived")

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/src/tde_runtime/execution.py

@@ -121,7 +121,8 @@ class CapabilityExecutionEngine:
                 return self._blocked(COVERAGE_CAPABILITY_ID, COVERAGE_CAPABILITY_VERSION, [COVERAGE_ADAPTER_ID], result["limitations"], duration, result["status"])
             return self._coverage_result(context, result, duration)
         if identifier == DEPENDENCY_CAPABILITY_ID and selected_adapter == DEPENDENCY_ADAPTER_ID:
-            result = analyze_dependencies(context.repository_root, timeout)
+            settings = context.execution_options.get("capabilities", {}).get(DEPENDENCY_CAPABILITY_ID, {})
+            result = analyze_dependencies(context.repository_root, timeout, settings)
             duration = int((perf_counter() - started) * 1000)
             if result["status"] != "VALID":
                 return self._blocked(DEPENDENCY_CAPABILITY_ID, DEPENDENCY_CAPABILITY_VERSION, [DEPENDENCY_ADAPTER_ID], result["limitations"], duration)

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/src/tde_runtime/policies/generation-1.json

@@ -6,7 +6,7 @@
   "description": "Default, language-independent Generation 1 qualification policy.",
   "supportedCapabilities": ["code_size", "complexity", "coverage", "dependency_health"],
   "supportedSchemas": ["1.0.0"],
-  "supportedRuntimeVersions": ["0.2.0", "1.0.0rc1", "1.0.0rc2", "1.0.0rc3", "1.0.0"],
+  "supportedRuntimeVersions": ["0.2.0", "1.0.0rc1", "1.0.0rc2", "1.0.0rc3", "1.0.0", "1.0.1"],
   "rules": [
     {"id": "code_size.repository_lines", "type": "threshold", "capability": "code_size", "metric": "code_size.code_lines", "operator": "greater_than", "threshold": {"warning": 25000, "blocking": 50000}, "severity": {"warning": "WARNING", "blocking": "BLOCKING"}, "enabled": true, "rationale": "Large repositories require deliberate decomposition without treating established product repositories as a blocking condition."},
     {"id": "complexity.maximum", "type": "threshold", "capability": "complexity", "metric": "complexity.cyclomatic.maximum", "operator": "greater_than", "threshold": {"warning": 15, "blocking": 30}, "severity": {"warning": "WARNING", "blocking": "BLOCKING"}, "enabled": true, "rationale": "High cyclomatic complexity impedes safe change; the blocking threshold accommodates the current measured maximum while retaining a warning signal."},

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/src/tde_runtime/runtime.py

@@ -20,7 +20,7 @@ from .execution import CapabilityExecutionEngine
 from .runtime_qualification import RuntimeQualificationEngine
 from .schemas import SchemaRegistry
 
-RUNTIME_VERSION = "1.0.0"
+RUNTIME_VERSION = "1.0.1"
 EVIDENCE_SCHEMA_VERSION = "1.0.0"
 
 

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/src/technical_debt_engine_runtime.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: technical-debt-engine-runtime
-Version: 1.0.0
+Version: 1.0.1
 Summary: Technical Debt Engine runtime foundation API
 Requires-Python: >=3.11
 Requires-Dist: radon==6.0.1

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/tests/test_cli.py

@@ -41,8 +41,8 @@ class CliFoundationTests(unittest.TestCase):
         code, output = self.invoke("--format", "json", "--version")
         self.assertEqual(ExitCode.SUCCESS, code)
         version = json.loads(output)
-        self.assertEqual("1.0.0", version["cliVersion"])
-        self.assertEqual("1.0.0", version["runtimeVersion"])
+        self.assertEqual("1.0.1", version["cliVersion"])
+        self.assertEqual("1.0.1", version["runtimeVersion"])
         self.assertEqual("1.0.0", version["schemaVersion"])
         self.assertEqual("1", version["generation"])
 

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/tests/test_coverage.py

@@ -101,7 +101,7 @@ class CoverageBlackBoxTests(unittest.TestCase):
 
     def test_policy_threshold_uses_coverage_without_runtime_specific_policy_logic(self) -> None:
         (self.root / "coverage.xml").write_text(COBERTURA, encoding="utf-8")
-        policy = {"identifier": "coverage-policy", "version": "1.0.0", "scope": "repository", "owner": "tests", "description": "coverage threshold", "supportedCapabilities": ["coverage"], "supportedSchemas": ["1.0.0"], "supportedRuntimeVersions": ["1.0.0"], "rules": [{"id": "minimum-line-coverage", "type": "threshold", "capability": "coverage", "metric": "coverage.line_coverage", "operator": "less_than", "threshold": {"warning": 80, "blocking": 60}, "severity": {"warning": "WARNING", "blocking": "BLOCKING"}, "enabled": True, "rationale": "coverage floor"}]}
+        policy = {"identifier": "coverage-policy", "version": "1.0.0", "scope": "repository", "owner": "tests", "description": "coverage threshold", "supportedCapabilities": ["coverage"], "supportedSchemas": ["1.0.0"], "supportedRuntimeVersions": ["1.0.1"], "rules": [{"id": "minimum-line-coverage", "type": "threshold", "capability": "coverage", "metric": "coverage.line_coverage", "operator": "less_than", "threshold": {"warning": 80, "blocking": 60}, "severity": {"warning": "WARNING", "blocking": "BLOCKING"}, "enabled": True, "rationale": "coverage floor"}]}
         path = self.root / "policy.json"; path.write_text(json.dumps(policy), encoding="utf-8")
         code, result = self.invoke("--policy", str(path), "assess", "--capability", "coverage", str(self.root))
         self.assertEqual(ExitCode.FAILED, code)

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/tests/test_dependency_health.py

@@ -71,7 +71,7 @@ class DependencyHealthBlackBoxTests(unittest.TestCase):
 
     def test_unknown_dependency_and_policy_are_evaluated(self) -> None:
         self.project(missing=True); self.npm({})
-        policy = {"identifier": "dependency-policy", "version": "1.0.0", "scope": "repository", "owner": "tests", "description": "dependency threshold", "supportedCapabilities": ["dependency_health"], "supportedSchemas": ["1.0.0"], "supportedRuntimeVersions": ["1.0.0"], "rules": [{"id": "unknown", "type": "threshold", "capability": "dependency_health", "metric": "dependency_health.unknown_dependencies", "operator": "greater_than", "threshold": {"warning": 1, "blocking": 1}, "severity": {"warning": "WARNING", "blocking": "BLOCKING"}, "enabled": True, "rationale": "unknown dependencies"}]}
+        policy = {"identifier": "dependency-policy", "version": "1.0.0", "scope": "repository", "owner": "tests", "description": "dependency threshold", "supportedCapabilities": ["dependency_health"], "supportedSchemas": ["1.0.0"], "supportedRuntimeVersions": ["1.0.1"], "rules": [{"id": "unknown", "type": "threshold", "capability": "dependency_health", "metric": "dependency_health.unknown_dependencies", "operator": "greater_than", "threshold": {"warning": 1, "blocking": 1}, "severity": {"warning": "WARNING", "blocking": "BLOCKING"}, "enabled": True, "rationale": "unknown dependencies"}]}
         path = self.root / "policy.json"; path.write_text(json.dumps(policy), encoding="utf-8")
         code, result = self.invoke("--policy", str(path), "assess", "--capability", "dependency_health", str(self.root))
         self.assertEqual(ExitCode.FAILED, code)
@@ -105,6 +105,26 @@ class DependencyHealthBlackBoxTests(unittest.TestCase):
         self.assertEqual("NuGet", ecosystem["ecosystem"])
         self.assertEqual(["Example", "Transit"], ecosystem["outdatedDependencies"])
 
+    def test_nuget_uses_configured_declared_target_framework(self) -> None:
+        project = self.root / "app.csproj"
+        project.write_text('<Project><PropertyGroup><TargetFrameworks>net10.0-maccatalyst;net10.0-windows10.0.19041.0</TargetFrameworks></PropertyGroup><ItemGroup><PackageReference Include="Example" Version="1.0.0" /></ItemGroup></Project>', encoding="utf-8")
+        (self.root / ".tde.yml").write_text("capabilities:\n  dependency_health:\n    nugetFramework: net10.0-windows10.0.19041.0\n", encoding="utf-8")
+        payload = {"projects": [{"frameworks": [{"topLevelPackages": [{"id": "Example", "latestVersion": "2.0.0"}], "transitivePackages": []}]}]}
+        self.tool("dotnet", 'if [ "$1" = "--version" ]; then echo "10.0"; else case "$*" in *"--framework net10.0-windows10.0.19041.0"*) printf "%s\\n" \'' + json.dumps(payload) + '\';; *) echo "wrong framework command: $*" >&2; exit 1;; esac; fi\n')
+        code, result = self.assess()
+        self.assertEqual(ExitCode.SUCCESS, code)
+        ecosystem = result["evidence"]["adapterResults"][0]["evidence"]["ecosystems"][0]
+        self.assertEqual(["Example"], ecosystem["outdatedDependencies"])
+
+    def test_nuget_rejects_framework_not_declared_by_project(self) -> None:
+        (self.root / "app.csproj").write_text('<Project><PropertyGroup><TargetFramework>net10.0</TargetFramework></PropertyGroup><ItemGroup><PackageReference Include="Example" Version="1.0.0" /></ItemGroup></Project>', encoding="utf-8")
+        (self.root / ".tde.yml").write_text("capabilities:\n  dependency_health:\n    nugetFramework: net10.0-windows10.0.19041.0\n", encoding="utf-8")
+        self.tool("dotnet", 'if [ "$1" = "--version" ]; then echo "10.0"; else exit 99; fi\n')
+        code, result = self.assess()
+        self.assertEqual(ExitCode.BLOCKED, code)
+        self.assertEqual("BLOCKED", result["status"])
+        self.assertIn("validated canonical evidence", result["reason"])
+
     def test_nuget_restore_failure_fails_closed(self) -> None:
         (self.root / "app.csproj").write_text('<Project><ItemGroup><PackageReference Include="Example" Version="1.0.0" /></ItemGroup></Project>', encoding="utf-8")
         payload = {"version": 1, "problems": [{"text": "Restore failed", "level": "error"}]}

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/tests/test_public_policy_configuration.py

@@ -51,7 +51,7 @@ class PublicPolicyConfigurationTests(unittest.TestCase):
             "identifier": "example.code-size", "version": "2026.1", "scope": "repository",
             "owner": "example", "description": "Example organization policy.",
             "supportedCapabilities": ["code_size"], "supportedSchemas": ["1.0.0"],
-            "supportedRuntimeVersions": ["1.0.0"],
+            "supportedRuntimeVersions": ["1.0.1"],
             "rules": [{"id": "example.code-size.lines", "type": "threshold", "capability": "code_size",
                        "metric": "code_size.code_lines", "operator": "greater_than",
                        "threshold": {"warning": threshold, "blocking": threshold + 1000},
@@ -93,7 +93,7 @@ class PublicPolicyConfigurationTests(unittest.TestCase):
                      *evidence["assessment"]["capabilityExecutions"]]:
             self.assertEqual("1.0.0", item["schema"]["version"])
             self.assertEqual("1", item["schema"]["compatibilityVersion"])
-            self.assertEqual("1.0.0", item["schema"]["runtimeVersion"])
+            self.assertEqual("1.0.1", item["schema"]["runtimeVersion"])
         record = next((location / "evidence").glob("*.json"))
         persisted = json.loads(record.read_text(encoding="utf-8"))
         persisted["evidence"]["policyEvidence"]["schema"]["version"] = "999.0.0"

{technical_debt_engine_runtime-1.0.0 → technical_debt_engine_runtime-1.0.1}/tests/test_runtime.py

@@ -61,7 +61,7 @@ class RuntimeFoundationTests(unittest.TestCase):
 
     def test_context_contains_canonical_runtime_values(self) -> None:
         result = Runtime().execute(self.root)
-        self.assertEqual("1.0.0", result.context.runtime_version)
+        self.assertEqual("1.0.1", result.context.runtime_version)
         self.assertEqual("1.0.0", result.context.schema_version)
         self.assertTrue(result.context.execution_id.startswith("execution."))
         self.assertEqual("content_digest", result.context.candidate["identityType"])