From bcaba6b70834f87682bb73d499308632eebdca02 Mon Sep 17 00:00:00 2001 From: mayor Date: Thu, 27 Aug 2026 14:46:32 -0300 Subject: [PATCH 1/2] chore: checkpoint active generated lane --- .github/workflows/ci.yml | 14 ++++- .gitignore | 1 + .mise.toml | 30 +++++++---- .pre-commit-config.yaml | 113 ++------------------------------------- Makefile | 96 +++++++++++++++++++-------------- pyproject.toml | 6 ++- 6 files changed, 95 insertions(+), 165 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 15e6097a..535214e9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -72,8 +72,6 @@ jobs: testmon-v1-${{ runner.os }}-${{ runner.arch }}-py3.13-${{ hashFiles('uv.lock', '**/uv.lock') }}- testmon-v1-${{ runner.os }}-${{ runner.arch }}-py3.13- - - - name: setup (blocking) # Why (mro-v4p5): explicit CI=Y on every make invocation (job env is not enough for matrix/docker parity). run: CI=Y make setup @@ -94,6 +92,18 @@ jobs: # Why (mro-v4p5): explicit CI=Y on every make invocation (job env is not enough for matrix/docker parity). run: CI=Y make check + # Why (aihub-v01jg): CI=Y runs ONE HALF of the gate set + # (lint pyright security markdown smells); the complement + # (pyrefly mypy) is owned by + # CI=N and, without this step, ran on developer + # machines only. That split let real defects reach main twice: five + # missing-attribute errors and an inconsistent-inheritance error, each + # green in CI and red locally. The two contexts are strict complements by + # construction, so running both here costs one extra pass and closes the + # hole rather than trusting everyone to run the other half by hand. + - name: check complement (blocking) + run: CI=N make check + - name: Dump reports on failure if: ${{ failure() }} run: | diff --git a/.gitignore b/.gitignore index 8ed12bfa..bdae0b58 100644 --- a/.gitignore +++ b/.gitignore @@ -210,6 +210,7 @@ secrets.yml .beads/.* !.beads/config.yaml .beads/proxieddb/ +.beads.gate.lock .dolt/ *.db .beads-credential-key diff --git a/.mise.toml b/.mise.toml index 8b16bcba..242e730a 100644 --- a/.mise.toml +++ b/.mise.toml @@ -12,18 +12,28 @@ # gitleaks_version, tokei_version, qlty_version, beads.selector, beads.version) [tools] python = "3.13" +# uv is deliberately absent: codegen.yaml declares it "supplied by the caller +# environment and deliberately not pinned", and no `uv_version` exists on the +# toolchain SSOT to render. Emitting one made every conform run fail with +# "'uv_version' is undefined". The minimum version is enforced where it is +# actually observable instead — tool_bootstrap_recipe.j2 compares the running +# `uv --version` against its floor during `make setup`. # Native toolchain (single source: Infra.codegen.toolchain in codegen.yaml). -kubectl = "1.32.0" -helm = "3.19.4" -kind = "0.31.0" -taplo = "0.10.0" -ast-grep = "0.45.0" -gitleaks = "8.30.1" -tokei = "14.0.0" +kubectl = "1.32" +helm = "3.19" +kind = "0.31" +taplo = "0.10" +ast-grep = "0.45" +gitleaks = "8.30" +tokei = "14.0" # qlty ships no mise registry alias; the github backend selector is the only # resolvable form (bare 'qlty' fails mise install: 'not found in registry'). -"github:qltysh/qlty" = "0.642.0" +"github:qltysh/qlty" = "0.642" # Go runtime for the Go projects in this workspace. -go = "1.26.5" -"github:marlon-costa-dc/beads" = "1.1.2-dc1" +go = "1.26" +[tools."github:marlon-costa-dc/beads"] +version = "latest" +prerelease = true +minimum_release_age = "0s" + # End SECTION: tools diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index ebba9d28..f9ed7633 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -23,113 +23,6 @@ repos: # and write intent cannot leak into an independently declared hook step. # A step declaring gates_skip (mro-ucxgl) narrows CHECK_GATES for the hook # context only: local `make check` and the `docs` verb keep the full set. - - - id: flext-pre-commit-setup - name: make setup - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make setup' - pass_filenames: false - always_run: true - stages: [pre-commit] - - - id: flext-pre-commit-gen - name: make gen APPLY=Y - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make gen APPLY=Y' - pass_filenames: false - always_run: true - stages: [pre-commit] - - - id: flext-pre-commit-fmt - name: make fmt APPLY=Y - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make fmt APPLY=Y' - pass_filenames: false - always_run: true - stages: [pre-commit] - - - id: flext-pre-commit-fix - name: make fix APPLY=Y - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make fix APPLY=Y' - pass_filenames: false - always_run: true - stages: [pre-commit] - - - id: flext-pre-commit-check - name: make check - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make check' - pass_filenames: false - always_run: true - stages: [pre-commit] - - - - id: flext-pre-push-setup - name: make setup - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make setup' - pass_filenames: false - always_run: true - stages: [pre-push] - - - id: flext-pre-push-gen - name: make gen APPLY=Y - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make gen APPLY=Y' - pass_filenames: false - always_run: true - stages: [pre-push] - - - id: flext-pre-push-fmt - name: make fmt APPLY=Y - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make fmt APPLY=Y' - pass_filenames: false - always_run: true - stages: [pre-push] - - - id: flext-pre-push-fix - name: make fix APPLY=Y - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make fix APPLY=Y' - pass_filenames: false - always_run: true - stages: [pre-push] - - - id: flext-pre-push-check - name: make check - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make check' - pass_filenames: false - always_run: true - stages: [pre-push] - - - id: flext-pre-push-test-cache-clear - name: make test WHAT=cache-clear APPLY=Y - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make test WHAT=cache-clear APPLY=Y' - pass_filenames: false - always_run: true - stages: [pre-push] - - - id: flext-pre-push-test-full - name: make test WHAT=full - language: system - entry: >- - bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make test WHAT=full' - pass_filenames: false - always_run: true - stages: [pre-push] - + # Stage gates (operator law 2026-08-24): each stage renders only when its + # config gate (make.pre_commit / make.pre_push) is enabled. Disabled by + # default; re-enable case by case in config/codegen.yaml. diff --git a/Makefile b/Makefile index 3ccaaf2f..858d9547 100644 --- a/Makefile +++ b/Makefile @@ -93,17 +93,15 @@ MAKEFILE_ROOT := $(patsubst %/,%,$(dir $(SELF_MAKEFILE))) PROJECT_ROOT := $(MAKEFILE_ROOT) override export FLEXT_PYTEST_TARGET_RAW := tests WORKSPACE ?= $(PROJECT_ROOT) -# `make` targets a member checkout when PROJECT names a workspace member and -# WORKSPACE was not overridden on the command line. PROJECT alone used to keep -# WORKSPACE at the workspace root, so finish looked up lanes in the wrong git -# primary and failed with "worktree branch is not registered". -ifeq ($(filter command line override,$(origin WORKSPACE)),) -ifneq ($(strip $(PROJECT)),) -ifneq ($(filter $(PROJECT),$(WORKSPACE_MEMBERS)),) -override WORKSPACE := $(PROJECT_ROOT)/$(PROJECT) -endif -endif -endif +# The member-selection block used to appear TWICE: once here against +# PROJECT_ROOT and again below against WORKSPACE_ROOT. Both guarded on the same +# `origin WORKSPACE` condition, so the second `override` always won and the +# first was dead -- while still contributing its `endif`s, which is how the +# generated Makefile ended up with one more `endif` than it had conditionals +# ("extraneous 'endif'"). The surviving block is the correct one: +# WORKSPACE_ROOT is derived from the superproject below, whereas PROJECT_ROOT +# is this checkout, so only the former resolves a member of the governing +# workspace. # === SECTION: WORKSPACE_ROOT isolation (managed) === # Source: computed (rule: derive from current checkout unless caller overrides) # Rule: WORKSPACE_ROOT is always derived from the current checkout unless the @@ -138,8 +136,8 @@ _ALLOWED_WHATS_help := usage $(shell sed -n 's/^_custom_help_\([a-z0-9_-]*\):.*/ _ALLOWED_WHATS_setup := environment $(shell sed -n 's/^_custom_setup_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') _ALLOWED_WHATS_deps := check lock upgrade $(shell sed -n 's/^_custom_deps_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') _ALLOWED_WHATS_build := artifacts $(shell sed -n 's/^_custom_build_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') -_ALLOWED_WHATS_check := all $(shell sed -n 's/^_custom_check_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') -_ALLOWED_WHATS_test := all full profile cache-status cache-clear cache-checkpoint $(shell sed -n 's/^_custom_test_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') +_ALLOWED_WHATS_check := all lint pyrefly mypy pyright security markdown smells $(shell sed -n 's/^_custom_check_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') +_ALLOWED_WHATS_test := all cache-status cache-clear cache-checkpoint $(shell sed -n 's/^_custom_test_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') _ALLOWED_WHATS_fmt := check all apply $(shell sed -n 's/^_custom_fmt_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') _ALLOWED_WHATS_fix := check all apply $(shell sed -n 's/^_custom_fix_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') _ALLOWED_WHATS_run := default $(shell sed -n 's/^_custom_run_\([a-z0-9_-]*\):.*/\1/p' "$(MAKEFILE_ROOT)/custom.mk" 2>/dev/null | sort -u | tr '\n' ' ') @@ -179,7 +177,6 @@ UV_BOOTSTRAP_FLAGS := --isolated --all-groups --all-extras # End SECTION: infra bootstrap - _DEFAULT_help := usage _DEFAULT_deps := check _DEFAULT_build := artifacts @@ -418,7 +415,7 @@ define _run_for_selected_projects done endef -.PHONY: $(PUBLIC_VERBS) _builtin_help_usage _builtin_setup_environment _builtin_deps_check _builtin_deps_lock _builtin_deps_upgrade _builtin_build_artifacts _builtin_check_all _builtin_test_all _builtin_test_full _builtin_test_profile _builtin_test_cache-status _builtin_test_cache-clear _builtin_test_cache-checkpoint _builtin_fmt_check _builtin_fmt_all _builtin_fmt_apply _builtin_fix_check _builtin_fix_all _builtin_fix_apply _builtin_run_default _builtin_status_diagnostics _builtin_docs_all _builtin_docs_generate _builtin_docs_fix _builtin_docs_audit _builtin_docs_build _builtin_docs_validate _builtin_clean_status _builtin_clean_generated _builtin_release_status _builtin_gen_check _builtin_gen_all _builtin_gen_apply _builtin_mod_check _builtin_mod_all _builtin_mod_apply +.PHONY: $(PUBLIC_VERBS) _builtin_help_usage _builtin_setup_environment _builtin_deps_check _builtin_deps_lock _builtin_deps_upgrade _builtin_build_artifacts _builtin_check_all _builtin_test_all _builtin_test_cache-status _builtin_test_cache-clear _builtin_test_cache-checkpoint _builtin_fmt_check _builtin_fmt_all _builtin_fmt_apply _builtin_fix_check _builtin_fix_all _builtin_fix_apply _builtin_run_default _builtin_status_diagnostics _builtin_docs_all _builtin_docs_generate _builtin_docs_fix _builtin_docs_audit _builtin_docs_build _builtin_docs_validate _builtin_clean_status _builtin_clean_generated _builtin_release_status _builtin_gen_check _builtin_gen_all _builtin_gen_apply _builtin_mod_check _builtin_mod_all _builtin_mod_apply $(filter-out setup,$(PUBLIC_VERBS)): $(call _dispatch,$@) @@ -506,8 +503,9 @@ _builtin_help_usage: @printf ' %-10s WHAT=%s APPLY=Y\n' 'mod' "$$(printf '%s' '$(_ALLOWED_WHATS_mod)' | awk '{$$1=$$1; gsub(/ /, "|"); print}')"; - @printf ' %-10s %s\n' 'WORKSPACE' 'target repository (default: current project)'; @printf ' %-10s %s\n' 'PROJECT' 'member checkout when WORKSPACE unset'; + @printf ' %-10s %s\n' 'BEAD' 'lane-root bead id for lane tracking'; + @printf ' %-10s %s\n' 'WORKSPACE' 'target repository (default: current project)'; @printf '\n%s\n' 'Custom hooks (custom.mk):'; @printf ' %s\n' 'Define pre-, post-, pre--, post--'; @printf ' %s\n' 'in custom.mk to wrap one declared handler.'; @@ -772,7 +770,7 @@ _builtin_deps_upgrade: _builtin_require_environment set --; \ for project in $$selected; do set -- "$$@" --projects "$$project"; done; \ $(PROJECT_FLEXT_INFRA) deps modernize --workspace "$(PROJECT_ROOT)" \ - --apply --rewrite-constraints --skip-check "$$@" + --apply $(if $(strip $(DEPENDENCY)),,--rewrite-constraints) --skip-check "$$@" $(call _run_for_selected_projects,) @@ -783,19 +781,29 @@ _builtin_build_artifacts: # by `make fix APPLY=Y` and formatting by `make fmt APPLY=Y`, both run BEFORE # check. APPLY here made the same tools run twice with conflicting intents, # so it is rejected instead of silently honoured; FIX=1 became the `fix` verb. -# CI=Y runs make.ci.check_gates and CI=N runs its strict -# complement, make.ci.local_check_gates (RULING 2: rules not skip-list). +# Under CI=Y the run is narrowed to make.ci.check_gates -- +# the strict complement of make.ci.local_check_gates, derived at the config +# owner so the two contexts can never overlap nor leave a gate unowned. _builtin_check_all: _builtin_require_environment @set -eu; \ gates="$(strip $(CHECK_GATES))"; \ if [ -z "$$gates" ]; then gates="$$(printf '%s' '$(CHECK_GATES_DEFAULT)' | tr ' ' ',')"; fi; \ gates="$$(printf '%s' "$$gates" | tr -d '[:space:]')"; \ if [ "$(strip $(CI))" = "Y" ]; then \ - gates="lint,pyright,security,markdown,smells"; \ + filtered=""; \ + for gate in $$(printf '%s' "$$gates" | tr ',' ' '); do \ + owned=0; \ + if [ "$$gate" = "lint" ]; then owned=1; fi; \ + if [ "$$gate" = "pyright" ]; then owned=1; fi; \ + if [ "$$gate" = "security" ]; then owned=1; fi; \ + if [ "$$gate" = "markdown" ]; then owned=1; fi; \ + if [ "$$gate" = "smells" ]; then owned=1; fi; \ + if [ "$$owned" -eq 1 ]; then \ + if [ -n "$$filtered" ]; then filtered="$$filtered,$$gate"; else filtered="$$gate"; fi; \ + fi; \ + done; \ + gates="$$filtered"; \ printf 'INFO: CI=Y runs check gates: lint pyright security markdown smells\n'; \ - elif [ "$(strip $(CI))" = "N" ]; then \ - gates="pyrefly,mypy"; \ - printf 'INFO: CI=N runs check gates: pyrefly mypy\n'; \ fi; \ for gate in $$(printf '%s' "$$gates" | tr ',' ' '); do \ case " $(CHECK_GATES_ALLOWED) " in *" $$gate "*) ;; \ @@ -808,19 +816,34 @@ _builtin_check_all: _builtin_require_environment fi; \ $(PROJECT_FLEXT_INFRA) check run --workspace "$(PROJECT_ROOT)" --gates "$$gates" --projects . -_builtin_test_all: _builtin_require_environment - @$(PYTEST_BOUNDED) $(UV_RUN) python -m flext_infra._pytest_entry +_builtin_check_lint: _builtin_require_environment + @$(PROJECT_FLEXT_INFRA) check run --workspace "$(PROJECT_ROOT)" --gates "lint" --projects . +_builtin_check_pyrefly: _builtin_require_environment + @$(PROJECT_FLEXT_INFRA) check run --workspace "$(PROJECT_ROOT)" --gates "pyrefly" --projects . -_builtin_test_full: _builtin_require_environment +_builtin_check_mypy: _builtin_require_environment + @$(PROJECT_FLEXT_INFRA) check run --workspace "$(PROJECT_ROOT)" --gates "mypy" --projects . - @$(PYTEST_BOUNDED) $(UV_RUN) python -m flext_infra._pytest_entry +_builtin_check_pyright: _builtin_require_environment + @$(PROJECT_FLEXT_INFRA) check run --workspace "$(PROJECT_ROOT)" --gates "pyright" --projects . + +_builtin_check_security: _builtin_require_environment + @$(PROJECT_FLEXT_INFRA) check run --workspace "$(PROJECT_ROOT)" --gates "security" --projects . -_builtin_test_profile: _builtin_require_environment +_builtin_check_markdown: _builtin_require_environment + @$(PROJECT_FLEXT_INFRA) check run --workspace "$(PROJECT_ROOT)" --gates "markdown" --projects . + +_builtin_check_smells: _builtin_require_environment + @$(PROJECT_FLEXT_INFRA) check run --workspace "$(PROJECT_ROOT)" --gates "smells" --projects . + + +_builtin_test_all: _builtin_require_environment @$(PYTEST_BOUNDED) $(UV_RUN) python -m flext_infra._pytest_entry + _builtin_test_cache-status: _builtin_require_environment @$(PYTEST_BOUNDED) $(UV_RUN) python -m flext_infra._pytest_entry @@ -916,25 +939,16 @@ _builtin_release_status: _builtin_require_environment @git -C "$(PROJECT_ROOT)" diff --quiet @git -C "$(PROJECT_ROOT)" diff --cached --quiet -# Every command here writes to the SAME root, derived from the invocation -# point. `deps modernize`/`extra-paths` used to receive WORKSPACE_ROOT while -# `conform` received PROJECT_ROOT, so a gen run inside one member rewrote the -# pyproject of ~30 siblings and left each dirty. Because gen runs inside check -# and check runs in the pre-commit hook, one commit in any lane dirtied every -# sibling -- the "workspace changed during Make check" abort. It -# also kept the fixed point out of reach: each run rewrote the siblings, so -# the next run found a difference again. At the workspace root PROJECT_ROOT is -# already the workspace, so fan-out survives exactly where it belongs. +# Generation has one owner. Conform preserves the caller's scope and applies +# the complete dependency/tooling projection before it verifies its fixed point. +# Dependency upgrades remain a separate explicit verb because they rewrite lock +# floors; gen must never run a second pyproject writer over conform's result. _builtin_gen_check: _builtin_require_environment @$(PROJECT_FLEXT_INFRA) codegen conform --root "$(PROJECT_ROOT)" --scope "$(CODEGEN_SCOPE)" --mode check - @$(PROJECT_FLEXT_INFRA) deps modernize --workspace "$(PROJECT_ROOT)" --check - @$(PROJECT_FLEXT_INFRA) deps extra-paths --workspace "$(PROJECT_ROOT)" --check _builtin_gen_all: _builtin_require_environment $(call _require_apply) @$(PROJECT_FLEXT_INFRA) codegen conform --root "$(PROJECT_ROOT)" --scope "$(CODEGEN_SCOPE)" --mode apply - @$(PROJECT_FLEXT_INFRA) deps modernize --workspace "$(PROJECT_ROOT)" --apply - @$(PROJECT_FLEXT_INFRA) deps extra-paths --workspace "$(PROJECT_ROOT)" --apply _builtin_gen_apply: _builtin_gen_all diff --git a/pyproject.toml b/pyproject.toml index cd11fba2..63bb0ca1 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -347,8 +347,6 @@ reportUnusedFunction = "error" reportUnusedImport = "error" reportUnusedVariable = "error" typeCheckingMode = "strict" -venv = ".venv" -venvPath = ".." [[tool.pyright.executionEnvironments]] extraPaths = ["src"] @@ -588,6 +586,10 @@ name = "flext-infra" [tool.uv.exclude-newer-package] cryptography = false +django-stubs = "2026-08-13T00:00:00Z" +mkdocstrings-python = "2026-08-18T00:00:00Z" +mypy = "2026-08-15T03:04:00Z" +types-setuptools = "2026-08-13T00:00:00Z" [tool.vulture] exclude = ["*/_protocols/*"] From 619c8e44635138215c7d22a1efff4e01f61463ee Mon Sep 17 00:00:00 2001 From: mayor Date: Thu, 27 Aug 2026 14:46:40 -0300 Subject: [PATCH 2/2] chore: propagate beads 1.2.2 and gc 3307 --- .beads/config.yaml | 13 +++++++------ .beads/metadata.json | 4 ++-- .envrc | 7 +++++++ .gitignore | 1 + .vscode/settings.json | 9 ++++++--- 5 files changed, 23 insertions(+), 11 deletions(-) diff --git a/.beads/config.yaml b/.beads/config.yaml index 21caad8d..64064052 100644 --- a/.beads/config.yaml +++ b/.beads/config.yaml @@ -3,16 +3,16 @@ # @flext-ssot: config/workspace.yaml (ledger_id) + flext-infra config/codegen.yaml (toolchain.beads.server) # @flext-maintenance: do not edit generated projections; edit the SSOT and regenerate # Generated by `flext-infra gen conform`. -# Source: issue_prefix/database = workspace manifest ledger_id (config key: -# ledger_id) falling back to the canonical project name when undeclared. +# Source: database and default issue prefix = workspace manifest ledger_id; +# ledger_prefix is an optional distinct issue-prefix override. # Source: dolt server block = flext-infra config/codegen.yaml # toolchain.beads.server (machine-wide shared Dolt server facts). -# Routing-only client config: this attached standalone owns no tracker state; -# bd commands route to the shared ledger below. Local data is never written. +# Owned ledger config: the workspace root owns this tracker; conform +# initializes and verifies it against the pinned binary. issue-prefix: "mro" -# Dolt shared-server connection (machine-wide shared server on :3308). -# The `mro` database lives there; a repository-local server is never used. +# Dolt server connection (Gas Town town server on :3307). +# The `flext` database lives there; a repository-local server is never used. dolt: mode: server shared-server: false @@ -21,3 +21,4 @@ dolt: user: root database: flext auto-commit: "on" +prefix: "flext" diff --git a/.beads/metadata.json b/.beads/metadata.json index 92736b90..7a33bf43 100644 --- a/.beads/metadata.json +++ b/.beads/metadata.json @@ -3,6 +3,6 @@ "backend": "dolt", "dolt_mode": "server", "dolt_database": "flext", - "dolt_server_port": 3307, - "dolt_server_host": "127.0.0.1" + "dolt_server_host": "127.0.0.1", + "dolt_server_port": 3307 } diff --git a/.envrc b/.envrc index d698723c..c1ee6df9 100644 --- a/.envrc +++ b/.envrc @@ -17,7 +17,14 @@ watch_file pyproject.toml PROJECT_ROOT="$(find_up pyproject.toml)" PROJECT_ROOT="${PROJECT_ROOT%/*}" VENV_DIR="${PROJECT_ROOT}/.venv" +PROJECT_SCRATCH="${PROJECT_ROOT}/.test-tmp" +mkdir -p "${PROJECT_SCRATCH}" +if command -v chattr >/dev/null 2>&1 && [[ "$(stat -f -c %T "${PROJECT_SCRATCH}")" == "btrfs" ]]; then + chattr +C "${PROJECT_SCRATCH}" +fi export PROJECT_ROOT +export TMPDIR="${PROJECT_SCRATCH}" +export GOTMPDIR="${PROJECT_SCRATCH}" export PYTHON_KEYRING_BACKEND="keyring.backends.null.Keyring" # mro-38p39 (cProfile evidence): PYTHONDONTWRITEBYTECODE=1 disabled the import # cache, so every CLI invocation recompiled ~935 modules — 1.72s of pure diff --git a/.gitignore b/.gitignore index bdae0b58..be4b5761 100644 --- a/.gitignore +++ b/.gitignore @@ -244,6 +244,7 @@ __pyrefly_virtual__/ .omo/ .pylance_cache/ .pytest_cache/ +.test-tmp/ .testmondata .testmondata-wal .testmondata-shm diff --git a/.vscode/settings.json b/.vscode/settings.json index 7fda9e2f..f9208d55 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -58,7 +58,8 @@ "**/.bkp": true, "**/.testmondata": true, "**/.testmondata-wal": true, - "**/.testmondata-shm": true + "**/.testmondata-shm": true, + "**/.test-tmp": true }, "files.watcherExclude": { "**/__pycache__/**": true, @@ -104,7 +105,8 @@ "**/.bkp/**": true, "**/.testmondata/**": true, "**/.testmondata-wal/**": true, - "**/.testmondata-shm/**": true + "**/.testmondata-shm/**": true, + "**/.test-tmp/**": true }, "search.exclude": { "**/__pycache__": true, @@ -149,7 +151,8 @@ "**/.bkp": true, "**/.testmondata": true, "**/.testmondata-wal": true, - "**/.testmondata-shm": true + "**/.testmondata-shm": true, + "**/.test-tmp": true }, "python.analysis.diagnosticSeverityOverrides": { "reportUntypedBaseClass": "none"