Harden Doghouse trust, correctness, and character

.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.12']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[dev]
+      - name: Run tests
+        run: |
+          pytest -q

.github/workflows/publish.yml

@@ -0,0 +1,43 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install hatch
+        run: pip install 'hatch>=1.21,<2'
+      - name: Build package
+        run: hatch build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## [Unreleased]
+
+### Added
+
+- **Doghouse Flight Recorder**: A new agent-native engine for PR state reconstruction.
+- **CLI Subcommands**: `snapshot`, `watch`, `playback`, `export`.
+- **Blocking Matrix**: Logic to distinguish merge conflicts from secondary blockers.
+- **Local Awareness**: Detection of uncommitted/unpushed local repository state.
+- **Machine-Readable Output**: `--json` flag on `snapshot` for Thinking Automatons.
+- **Repro Bundles**: `export` command to create "Manuscript Fragments" for debugging.
+- **Snapshot Equivalence**: `Snapshot.is_equivalent_to()` for meaningful-change detection.
+
+### Fixed
+
+- **Merge-Readiness Semantics**: Formal approval state (`CHANGES_REQUESTED`, `REVIEW_REQUIRED`) is now separated from unresolved thread state. Stale `CHANGES_REQUESTED` no longer masquerades as active unresolved work when all threads are resolved.
+- **Verdict Priority Chain**: Fixed dead-code bug where `is_primary` default caused Priority 0 to swallow all BLOCKER-severity items. Merge-conflict check now uses explicit type match. Added approval-needed verdict at Priority 4.
+- **Repo-Context Consistency**: `watch` and `export` now honor `--repo owner/name` via centralized `resolve_repo_context()`. Previously they silently ignored `--repo` and queried the wrong repository.
+- **Packaging**: Fixed `pyproject.toml` readme path (`cli/README.md` → `README.md`). Editable install now works.
+- **Watch Snapshot Spam**: `record_sortie()` no longer persists duplicate snapshots on identical polls. Only meaningful state transitions (head SHA change, blocker set change) create new ledger entries.
+- **Severity Comparison Bug**: Blocker merge logic used alphabetical string comparison on enum values, causing BLOCKER to rank below WARNING. Now uses explicit numeric `rank` property.
+- **Architecture Violation**: `RecorderService` no longer imports from the adapter layer. New `GitPort` ABC in `core/ports/`; `GitAdapter` implements it; callers provide the concrete adapter.
+- **Dead Makefile Target**: Removed non-existent `history` command from Makefile.
+- **Empty PR ID Args**: `gh pr view ""` replaced with conditional arg construction (omit pr_id when None).
+- **Fragile Check Names**: Status checks with no `context` or `name` now default to `"unknown"` instead of producing `check-None` collisions.
+- **Variable Shadowing**: Local `snapshot` variable in the `snapshot()` function no longer shadows the function name.
+- **Mid-Module Imports**: `PlaybackService`, `Path`, `time` moved to top-of-file imports.
+- **Missing Timeouts**: All `subprocess.run` calls in `GitAdapter` and `export` now have timeouts.
+- **Bare Except**: GraphQL thread fetch now catches specific exceptions instead of bare `Exception`.
+- **Repo Name Validation**: Storage adapter validates repo names against `[\w.-]+` pattern.
+- **Resolve Truthiness**: `resolve_repo_context` uses `is None` checks instead of falsy checks.
+- **Export Absolute Path**: Export now prints the absolute path of the repro bundle.
+- **Blocker Metadata Copy**: `Blocker.__post_init__` now defensively copies `metadata` dict.
+- **Domain Purity**: `verdict_display` and all randomized variation lists moved from domain layer to CLI presentation layer.
+- **Unused Dependencies**: Removed `requests` and `textual` from `pyproject.toml`.
+- **CI/CD Hardening**: Scoped `id-token:write` to publish job only; added job timeouts and `fail-fast: false`; pinned hatch; reduced `pull-requests` to read; tightened tag pattern.
+- **Code Hygiene**: Removed unused imports across domain and adapter modules; modernized type annotations to `list`/`dict`/`X | None` syntax; added `Blocker` import to `recorder_service.py`.
+- **Core Immutability**: Snapshot and Blocker objects own defensive copies of mutable data.
+- **Deterministic Delta**: Sorted blocker IDs for stable output across runs.
+- **Docs Drift**: Archived legacy TUI documentation; brought PRODUCTION_LOG incidents into template compliance.
+
+### Tests
+
+- Covers blocker-semantics interactions (review/thread, verdict priority chain, severity ranking).
+- Verifies repo-context consistency (all commands use `resolve_repo_context`).
+- Pins watch persistence behavior (dedup on identical polls, persist on meaningful change).
+- Validates snapshot equivalence and blocker signature.
+- Includes packaging smoke tests (readme path, metadata, entry point).
+- Exercises theatrical verdict variations from CLI presentation layer.

Makefile

@@ -0,0 +1,42 @@
+.PHONY: dev-venv test snapshot playback watch export clean help
+
+VENV = .venv
+PYTHON = $(VENV)/bin/python3
+PIP = $(VENV)/bin/pip
+
+help:
+	@echo "Doghouse Makefile"
+	@echo "  dev-venv: Create venv and install dependencies"
+	@echo "  test: Run unit tests"
+	@echo "  snapshot [PR=id]: Capture PR state"
+	@echo "  playback NAME=name: Run a playback fixture"
+	@echo "  watch [PR=id]: Monitor PR live"
+	@echo "  export [PR=id]: Create repro bundle"
+
+dev-venv:
+	python3 -m venv $(VENV)
+	$(PIP) install --upgrade pip
+	$(PIP) install -e .[dev]
+
+test:
+	PYTHONPATH=src $(PYTHON) -m pytest tests/doghouse
+
+snapshot:
+	@if [ -z "$(PR)" ]; then PYTHONPATH=src $(PYTHON) -m doghouse.cli.main snapshot; \
+	else PYTHONPATH=src $(PYTHON) -m doghouse.cli.main snapshot --pr $(PR); fi
+
+playback:
+	@if [ -z "$(NAME)" ]; then echo "Usage: make playback NAME=pb1_push_delta"; exit 1; fi
+	PYTHONPATH=src $(PYTHON) -m doghouse.cli.main playback $(NAME)
+
+watch:
+	@if [ -z "$(PR)" ]; then PYTHONPATH=src $(PYTHON) -m doghouse.cli.main watch; \
+	else PYTHONPATH=src $(PYTHON) -m doghouse.cli.main watch --pr $(PR); fi
+
+export:
+	@if [ -z "$(PR)" ]; then PYTHONPATH=src $(PYTHON) -m doghouse.cli.main export; \
+	else PYTHONPATH=src $(PYTHON) -m doghouse.cli.main export --pr $(PR); fi
+
+clean:
+	rm -rf build/ dist/ *.egg-info
+	find . -type d -name "__pycache__" -exec rm -rf {} +

PRODUCTION_LOG.mg

@@ -0,0 +1,85 @@
+# Draft Punks — Production Log
+
+Guideline: Append an entry for any unexpected/unanticipated work, dependency, requirement, or risk we discover during implementation and testing.
+
+Template
+
+````markdown
+## Incident: <title>
+
+Timestamp: <YYYY-MM-DD HH:MM:SS local>
+
+Task: <current task id>
+
+### Problem
+
+<problem description>
+
+### Resolution
+
+<resolution>
+
+### What could we have done differently
+
+<how could this have been anticipated? how should we have planned for this? what can we do better next time to avoid this sort of issue again?>
+````
+
+## Incident: Product Pivot to CLI-Only (Git-backed State)
+
+Timestamp: 2025-11-07 19:07:32
+
+Task: DP-F-20 / Sprint 0 planning
+
+### Problem
+TUI cannot be driven programmatically in our harness and is slower to iterate for both humans and LLMs.
+
+### Resolution
+Pivot to a CLI-only experience with a Git-backed state repo and JSONL stdio server. Update SPRINTS.md, add CLI-STATE.md, and refocus FEATURES/TASKLIST over time.
+
+### What could we have done differently
+Call out environment constraints earlier and consider dual-mode from day one. Favor CLI-first for automation-heavy tools; treat TUI as an optional skin over the same state engine.
+
+## Incident: Local test runner missing (pytest not installed)
+
+Timestamp: 2025-11-08 ~00:00:00 (estimated; exact time not recorded)
+
+Task: DP-F-30 / Thread verbs + Debug LLM (tests-first)
+
+### Problem
+The environment lacks `pytest`, so tests could not be executed immediately after adding failing tests.
+
+### Resolution
+Committed failing tests first, then implemented the features. Left tests in place for local/CI execution. Next dev step is `make dev-venv && . .venv/bin/activate && pip install -e .[dev] && pytest`.
+
+### What could we have done differently
+Include a lightweight script or Makefile target that ensures a dev venv with pytest is provisioned before test steps, or run tests inside CI where the toolchain is guaranteed.
+
+## Incident: Doghouse Reboot (The Great Pivot)
+
+Timestamp: 2026-03-27 14:00:00 (estimated)
+
+Task: DP-F-21 / Doghouse flight recorder reboot
+
+### Problem
+Project had drifted into "GATOS" and "git-mind" concepts that strayed from the original PhiedBach vision and immediate needs.
+
+### Resolution
+Rebooted the project to focus on **DOGHOUSE**, the PR flight recorder. Deleted legacy TUI/kernel, implemented hexagonal core, and restored the original lore.
+
+### What could we have done differently
+Established clearer scope boundaries earlier. The pivot from TUI to CLI to git-mind to Doghouse reflects successive scope corrections that could have been one decision with a tighter product brief upfront.
+
+## Incident: Doghouse Refinement (Ze Radar)
+
+Timestamp: 2026-03-28 15:00:00 (estimated)
+
+Task: DP-F-21 / Refinement & CodeRabbit feedback
+
+### Problem
+The initial Doghouse cut lacked live monitoring, repro capabilities, and sensitivity to merge conflicts vs. secondary check failures.
+
+### Resolution
+Implemented `doghouse watch`, `doghouse export`, and the Blocking Matrix. Hardened adapters with timeouts and deduplication. Addressed 54 threads of feedback.
+
+### What could we have done differently
+Include watch/export in the initial cut. The design brief (flight-recorder-brief.md) already described these use cases but they were deferred to a second pass, creating churn when the first review surfaced them as gaps.