Ticket graphs

Rewrite ONE unique forge module as entirely new, behavior-preserving, installable, control-config'd Python, per the FORGE-wide refactor standard #200 (#std). This ticket covers ONE module — the one identified below — and nothing else. It was filed against the module's DEDUPLICATED identity, so if that module was copy-pasted across the forge, every copy is covered by this single ticket. MODULE KEY : forge-rw:0fa5adae91bb3f70 (the ticketer's idempotency marker — it lives in this ticket's TITLE. Do not edit the title, or the module will be re-filed as a duplicate.) IDENTITY : AST-NORMALIZED — codebean's `_ast_norm` (#183), i.e. ast.dump(ast.parse(ast.unparse(ast.parse(src)))). Copies of this module that differ only in comments, blank lines, quoting or spacing carry the SAME module-sha and are covered by THIS ticket. A differing docstring is real content, so a module whose docstring differs is a DIFFERENT module with its own ticket. SIZE : 2813 bytes EXTENSION : .py CANONICAL SOURCE (the location this ticket is named for): repo : agent_tools_suite path : test_crank_discipline.py ref : HEAD (HEAD) blob : c028a3239bdf61c9509c0ea7d89924b3ead83bc5 (git blob sha1) REFERENCE ONLY — you do NOT need this command. This module's bytes are embedded COMPLETE in THE ORIGINAL SOURCE block below, and that is what the rewrite is based on. For a reader who does have forge access: git --git-dir=/Users/stevenpeterson/code/installed/jazz-project/config/forge/remotes/agent_tools_suite.git cat-file blob c028a3239bdf61c9509c0ea7d89924b3ead83bc5 THE SAME MODULE ALSO LIVES AT THESE FORGE TIPS: none — this module is unique to agent_tools_suite among the repos scanned so far. HISTORICAL OCCURRENCES of this exact blob — every OTHER DISTINCT {repo, path} the omni-git index (`occ`, joined on the git blob sha1) records this byte-identical file at, with the index's own `ts` for the first row of each. Any place this run enumerated LIVE is listed under the forge tips above, not here. Context for the rewrite, not extra work: testmonkeyalpha-group/jazz-forge/agent_tools_suite:test_crank_discipline.py [occ.ts gitlab] THE ORIGINAL SOURCE, EMBEDDED — YOU NEED NO FORGE ACCESS TO DO THIS TICKET. The module's own bytes are reproduced below, inside this ticket. THEY are the authoritative copy and the behavior-preserving basis: rewrite from them. The `git --git-dir=... cat-file blob` command under CANONICAL SOURCE above is kept only as a REFERENCE for a reader who happens to have forge access — running it is NOT part of this ticket. (Why the bytes are here at all: the pair_loop worker that executes this ticket is sandboxed to the ticket's own congruency worktree and cannot read the forge's bare repos. Ticket #346 is the fix that put them on the ticket.) The block BEGINS at the line ===ORIGINAL SOURCE (verbatim, the behavior-preserving basis)=== and ENDS at the first line ===END SOURCE=== Everything strictly between those two lines is the module — 2813 byte(s), byte for byte, with no re-indentation, no re-wrapping and nothing elided. ===ORIGINAL SOURCE (verbatim, the behavior-preserving basis)=== #!/usr/bin/env python3 """Prove crank_discipline: the gate refuses without a ticket / without provenance, and run_confined blocks every escape class while allowing a legitimate repo edit. ~/jail/.venv/bin/python test_crank_discipline.py """ import os import sys import tempfile HERE = os.path.dirname(os.path.abspath(__file__)) sys.path.insert(0, HERE) import crank_discipline as D # noqa: E402 passed = failed = 0 def check(name, ok): global passed, failed passed, failed = passed + bool(ok), failed + (not ok) print(f" {'✓' if ok else '✗ FAIL'} {name}") def refused(thunk): try: thunk() return False except D.CrankRefused: return True print("\ncrank_discipline — the inescapable gate") # 1. gate(): intent hard; ticket hard WHEN congruency is reachable; down -> proceed (best-effort) D.record = lambda component, intent, session: {"component": component} # provenance not under test check("no intent -> refused", refused(lambda: D.gate("workstation", ""))) D.has_open_ticket = lambda component: False # reachable, no ticket check("reachable + no ticket -> refused", refused(lambda: D.gate("workstation", "crank it"))) def _down(component): raise OSError("congruency unreachable") D.has_open_ticket = _down # congruency down check("congruency down -> ticket best-effort, proceeds", D.gate("workstation", "x")["component"] == "workstation") D.has_open_ticket = lambda component: True # reachable, ticket present check("reachable + ticket -> passes", D.gate("workstation", "x")["component"] == "workstation") # 2. run_confined(): the audit-veto blocks escapes, allows a legit repo edit ESCAPES = { "shell-out": "import subprocess\nsubprocess.run(['echo','x'])\n", "network": "import socket\nsocket.create_connection(('example.com', 80))\n", "home write": "import os\nopen(os.path.expanduser('~/.claude/EVIL'),'w').write('x')\n", "out-of-repo": "import os\nopen(os.path.expanduser('~/EVIL_probe'),'w').write('x')\n", } LEGIT = "open('target.txt','w').write('ok')\nprint('patched')\n" with tempfile.TemporaryDirectory() as sandbox: for name, src in ESCAPES.items(): patch = os.path.join(sandbox, "patch.py") open(patch, "w").write(src) check(f"run_confined blocks {name}", refused(lambda: D.run_confined(patch, sandbox))) patch = os.path.join(sandbox, "patch.py") open(patch, "w").write(LEGIT) D.run_confined(patch, sandbox) check("run_confined allows a legit repo edit", open(os.path.join(sandbox, "target.txt")).read() == "ok") print(f"\n{'PASS' if not failed else 'FAIL'} — {passed} passed, {failed} failed") sys.exit(1 if failed else 0) ===END SOURCE=== THE CALLABLE SURFACE — every callable in the original, lowered with codebean's `lower_node` (#183). The rewrite must present THIS surface (same names, same parameters, same defaults) so callers of the original keep working: check(name, ok) refused(thunk) _down(component) CAPTURED BEHAVIORAL EXEMPLARS: none. no function in this module is minable — criteria_miner mines only self-contained pure functions (it refuses anything that mentions a world-touching or non-deterministic name, plus methods and no-arg functions), and nothing here qualified This does NOT weaken the ticket's bar — it MOVES the work: you must write the equivalence exemplars by hand from the original's behavior before rewriting, and they are what settles this ticket. THE STANDARD — #200's four requirements, which this ticket exists to enforce. All four are the standard's own words; none is optional: 1. BEHAVIOR-PRESERVING, VERIFIED NOT ASSERTED — the deliverable is ENTIRELY NEW source code (rewritten, not copied). It must reproduce the ORIGINAL's behavior, and the proof is the exemplars above (captured via codebean lower_* #183 + criteria_miner IO-exemplars, exactly as #200 specifies). 2. A PYTHON MODULE — regardless of the source language. This module's source is `.py`; the rewrite is Python either way. 3. INSTALLABLE — a proper package: pyproject.toml, `pip install -e .` works, console entry points where applicable. WRITE ONLY YOUR OWN MODULE FILE at forge2/<repo>/<module>.py. Do NOT hand-author pyproject.toml or __init__.py: the harness DERIVES them ADDITIVELY from the modules present (congruency/tools/ forge_package.py, #410 — the analogue of the tag-registry fix #281), so your unit never conflicts with, or clobbers, a sibling module of the same forge2/<repo>/ package. A package-level pyproject includes every .py in the directory, so your module installs and imports as `<repo>.<module>` the moment it lands. 4. CONTROL-CONFIG'D — NO hardcoded paths or params. A JSON/registry config object drives it (the install.json / registry.json idiom of this repo), and per note-for-claude a tool that cannot see its config THROWS rather than guessing a default. Add ONLY your own `forge2.<repo>.<module>` section to the package's registry.json (create the file if it is absent); NEVER read, edit or drop a sibling module's section — the sections are disjoint keys and stay additive that way. ACCEPTANCE (#200's, per rewrite ticket) — this ticket settles when ALL of: a. the new source reproduces every captured exemplar above, plus the edge cases you add for what sampling cannot reach (paste the runs as evidence); b. it presents the callable surface above, so existing callers keep working; c. `pip install -e .` installs it clean from its own pyproject.toml; d. it runs off a config object with ZERO hardcoded settings, and throws without one. Kind is `build` (a pair: coder + adversarial tester). This ticket hangs off #200 by a `spawned` edge, so a stop ticket aimed at #200 brakes every rewrite in this programme. Filed mechanically by checkouts/current/congruency/tools/forge_refactor_ticketer.py under ticket #201, from the forge bare repos at /Users/stevenpeterson/code/installed/jazz-project/config/forge/remotes. Its original source is embedded above (#346), so this ticket is complete on its own.

— browse congruency source (forge-parked tree)