truthstone 0.2.0__tar.gz

truthstone-0.2.0/.agents/plugins/marketplace.json

@@ -0,0 +1,32 @@
+{
+  "name": "truthstone",
+  "interface": {
+    "displayName": "Truthstone"
+  },
+  "plugins": [
+    {
+      "name": "truthstone",
+      "source": {
+        "source": "local",
+        "path": "./plugins/truthstone"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    },
+    {
+      "name": "truthstone-practices",
+      "source": {
+        "source": "local",
+        "path": "./plugins/truthstone-practices"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    }
+  ]
+}

truthstone-0.2.0/.claude-plugin/marketplace.json

@@ -0,0 +1,25 @@
+{
+  "name": "truthstone",
+  "owner": {
+    "name": "Tohin Majumder",
+    "email": "tohin1400@gmail.com",
+    "url": "https://github.com/tohin003"
+  },
+  "description": "Truthstone (previously named AgentGuard): a deterministic reliability layer for coding agents.",
+  "plugins": [
+    {
+      "name": "truthstone",
+      "source": "./plugins/truthstone-claude",
+      "description": "Checks what a request takes for granted, sends irreversible or destructive commands to you for sign-off, and holds a \"done\" that the recorded test evidence contradicts, for Claude Code. Installs its local runtime with uv on first use.",
+      "category": "development",
+      "tags": ["guardrails", "reliability", "hooks", "verification"]
+    },
+    {
+      "name": "truthstone-practices",
+      "source": "./plugins/truthstone-practices",
+      "description": "Six instruction-only skills: evidence before done, ground claims, scope discipline, proportional planning, safe shell, diff review.",
+      "version": "1.0.0",
+      "category": "development"
+    }
+  ]
+}

truthstone-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,97 @@
+# Lint and test on every push to master and every pull request (IMPROVEMENTS.md M6).
+#
+# Blocking: Linux and macOS x Python 3.12 and 3.13 x {base install, all extras}. The base
+# install has no tree-sitter, so the TS/JS symbol tests skip there and run in all-extras.
+#
+# Informational: Windows. It is not a supported platform this release, so it never blocks a
+# merge (continue-on-error); it runs the same suite, including the fail-open tests, to show
+# whether Truthstone at least stays out of the way there.
+#
+# Every job points TRUTHSTONE_HOME at the runner's temp directory: nothing may read or write
+# a real ~/.truthstone (the test suite isolates each test as well).
+
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: ${{ matrix.os }} / Python ${{ matrix.python }} / ${{ matrix.extras }}
+    runs-on: ${{ matrix.os }}
+    # The suite takes about 10 minutes on Linux and 35 to 45 on macOS runners.
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        python: ["3.12", "3.13"]
+        extras: [base, all-extras]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv and Python ${{ matrix.python }}
+        uses: astral-sh/setup-uv@v10.3.3
+        with:
+          python-version: ${{ matrix.python }}
+          enable-cache: true
+
+      - name: Use a temporary TRUTHSTONE_HOME
+        shell: bash
+        run: |
+          mkdir -p "$RUNNER_TEMP/truthstone-home"
+          echo "TRUTHSTONE_HOME=$RUNNER_TEMP/truthstone-home" >> "$GITHUB_ENV"
+
+      - name: Install (base)
+        if: matrix.extras == 'base'
+        run: uv sync
+
+      - name: Install (all extras)
+        if: matrix.extras == 'all-extras'
+        run: uv sync --all-extras
+
+      - name: Lint
+        run: uv run ruff check src tests
+
+      - name: Test
+        run: uv run pytest -q
+
+  windows:
+    name: windows-latest / Python 3.13 / all-extras (informational)
+    runs-on: windows-latest
+    # Windows is unsupported this release (IMPROVEMENTS.md R2): report, never block.
+    continue-on-error: true
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv and Python 3.13
+        uses: astral-sh/setup-uv@v10.3.3
+        with:
+          python-version: "3.13"
+          enable-cache: true
+
+      - name: Use a temporary TRUTHSTONE_HOME
+        shell: bash
+        run: |
+          mkdir -p "$RUNNER_TEMP/truthstone-home"
+          echo "TRUTHSTONE_HOME=$RUNNER_TEMP/truthstone-home" >> "$GITHUB_ENV"
+
+      - name: Install (all extras)
+        run: uv sync --all-extras
+
+      - name: Lint
+        run: uv run ruff check src tests
+
+      - name: Test
+        run: uv run pytest -q

truthstone-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,96 @@
+# Publish to PyPI when a release tag (v*) is pushed.
+#
+# Uses PyPI Trusted Publishing (OpenID Connect): no API token is stored anywhere. The PyPI
+# project is configured to trust exactly this repository, this workflow file (release.yml)
+# and the `pypi` environment. In the repository settings you can add a required reviewer to
+# that environment, so that every publish waits for a human click.
+#
+# Release checklist: bump the version in pyproject.toml AND in every hook plugin's manifest,
+# commit, then `git tag v<version> && git push origin v<version>`. The hook plugins install
+# their runtime from that same tag, so the tag must match their manifests exactly. The
+# version check below refuses to publish otherwise.
+
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test before publishing
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.3.3
+        with:
+          enable-cache: true
+      - name: Install with every extra
+        run: uv sync --all-extras
+      - name: Lint
+        run: uv run ruff check src tests
+      - name: Test
+        env:
+          PYTHONDONTWRITEBYTECODE: "1"
+        run: |
+          export TRUTHSTONE_HOME="$(mktemp -d)"
+          uv run pytest -o addopts="" -q -p no:warnings
+
+  build:
+    name: Build and verify
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.3.3
+      - name: The tag, the package and the hook plugins agree on the version
+        run: |
+          python3 - <<'PY'
+          import json, os, pathlib, sys, tomllib
+
+          tag = os.environ["GITHUB_REF_NAME"]
+          package = tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"]
+          problems = []
+          if tag != f"v{package}":
+              problems.append(f"tag {tag} != v{package} (pyproject.toml)")
+          # A hook plugin installs its runtime from git tag v<manifest version>, so every
+          # plugin that ships hooks must carry exactly the released version.
+          for manifest in sorted(pathlib.Path("plugins").glob("*/.*-plugin/plugin.json")):
+              plugin_dir = manifest.parent.parent
+              if not (plugin_dir / "hooks").is_dir():
+                  continue  # hook-free plugins (skills only) version independently
+              version = json.loads(manifest.read_text()).get("version")
+              if version != package:
+                  problems.append(f"{manifest}: version {version!r} != {package!r}")
+          if problems:
+              sys.exit("refusing to publish:\n  " + "\n  ".join(problems))
+          print(f"ok: {tag}")
+          PY
+      - name: Build the sdist and wheel
+        run: uv build
+      - name: Check the distribution metadata
+        run: uvx twine check --strict dist/*
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/truthstone
+    permissions:
+      id-token: write  # Trusted Publishing; nothing else needs write access
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

truthstone-0.2.0/.gitignore

@@ -0,0 +1,15 @@
+.DS_Store
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+dist/
+build/
+*.egg-info/
+
+# Truthstone runtime state (per-workspace)
+.truthstone/
+.agentguard/