rune/scripts/admit_wave_d49_capability_everywhere.py

"""Admission dispatch for wave D49 — capability everywhere (owner doctrine).

The owner's D49 ruling (verbatim, 2026-10-22): "ive asked rune if she
can alter her code she said she needs shell access, and the ability to
read and write i want that ability to be in every pane, but when
something gets to become work it gets promoted into the task pane. she
also needs tools to be able to connect to git projects. and make that
native." Doctrine: capability is INHERENT in every pane — the write
family (write_file, edit_file, run_command) and the new native git
family ride the wire in CHAT/PLAN/TASK alike; the consent card remains
the work-promotion mechanism (organization, not permission); the real
safety layer is the scaffolding authority + contract gates at mutation
doors. Build: (1) ToolsetFor exposes the full suite in every mode; (2)
ExecuteGatedTool's write-refusal-by-mode retires, the dispatch-gate
seam and the genuinely-unavailable refusal stay; (3) the wire tool
descriptions state the write availability (the model asked for shell
access because the wire showed read-only — fix the wire); (4) a native
git family (git_status, git_diff, git_log, git_branch, git_commit,
git_add) shelling out to git in the repo root (DefaultRepoRoot seam),
porcelain-parsed honestly, typed JSON results, landing-law banned-path
refusals on git_add/git_commit; (5) the mode/toolset tests re-pinned
to CHAT=full-suite, red-first throughout.
approval_ref 'user:D49 owner ruling 2026-10-22 (capability in every
pane; native git tools)'.
"""
import json
import os
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))

from rune import construction_activation as cact  # noqa: E402
from rune import construction_admission as cadm  # noqa: E402
from rune import construction_mode as cmode  # noqa: E402
from rune import scaffold as sc  # noqa: E402

ROOT = os.path.join(os.path.dirname(__file__), "..")

OBJECTIVE = (
    "Build the owner's D49 doctrine — capability in every pane: (1) "
    "make ToolsetFor expose the full tool suite (read family + write "
    "family) in every mode so CHAT and PLAN carry write_file, "
    "edit_file and run_command like TASK does; (2) retire "
    "ExecuteGatedTool's write-refusal-by-mode so writes execute in any "
    "mode while keeping the dispatch-gate seam and the typed refusal "
    "for genuinely-unavailable tools; (3) state the write availability "
    "in the tool descriptions the wire carries so the model knows its "
    "shell and file abilities without asking; (4) add a native git "
    "tool family — git_status, git_diff, git_log, git_branch, "
    "git_commit, git_add — implemented by shelling out to git in the "
    "repo root through the DefaultRepoRoot seam, parsing porcelain "
    "output honestly, returning typed JSON, and refusing banned "
    "landing-law paths on git_add and git_commit; (5) re-pin the "
    "mode/toolset tests to the new doctrine (CHAT carries the full "
    "suite) red-first and keep the runecore package -race green"
)
AFFECTED = [
    "src/go/rune-core/",
    "scripts/admit_wave_d49_capability_everywhere.py",
]


def main() -> int:
    store = os.path.join(ROOT, "store", "scaffold")
    scaffold = sc.Scaffold(store, "rune")

    md = cmode.classify_mode(
        OBJECTIVE,
        target_project="rune",
        project_exists=True,
        affected_surface=AFFECTED,
    )
    print("classified mode:", md.mode)

    need = {
        "need_id": "need-wave-d49-capability-everywhere",
        "objective": OBJECTIVE,
        "origin": "worker",
        "project": "rune",
        "task_ref": "wave-d49-capability-everywhere",
        "affected_surface": AFFECTED,
        "evidence_refs": [
            "owner ruling D49 2026-10-22 (verbatim in session notes): "
            "capability in every pane, work promotes to the task pane, "
            "native git tools",
            "src/go/rune-core/internal/runecore/tools.go (the "
            "mode-gated toolset this wave supersedes)",
            "commit b35078bb (task channel inherits TASK semantics)",
            "scripts/check_landing.py rule 4 SWEEP_RACE_BANNED_PATHS "
            "(the landing-law banned-path set git_add/git_commit "
            "refuse)",
            "scripts/admit_wave_presentation.py (the admission "
            "pattern)",
        ],
    }
    act = cact.activate(md, need=need, scaffold=scaffold,
                        builder="wave-d49-capability-everywhere")
    print("activated:", act.get("activated"), act.get("mode"))

    env = cadm.admit(
        act,
        objective=OBJECTIVE,
        builder="wave-d49-capability-everywhere",
        affected_surface=AFFECTED,
        evidence_refs=need["evidence_refs"],
        origin="worker",
        task_ref="wave-d49-capability-everywhere",
        expected_new_entities=[
            "src/go/rune-core/internal/runecore (ToolsetFor full "
            "suite in every mode; ExecuteGatedTool write-refusal "
            "retired with the dispatch-gate seam kept; wire tool "
            "descriptions state write availability)",
            "src/go/rune-core/internal/runecore/gittools.go (the "
            "native git family: git_status, git_diff, git_log, "
            "git_branch, git_commit, git_add — stdlib git subprocess "
            "in the repo root, porcelain parsed honestly, typed JSON "
            "results, landing-law banned-path refusals)",
            "tests: red-first re-pins of the mode/toolset suites to "
            "CHAT=full-suite + per-tool git fixture tests, -race "
            "green",
        ],
        expected_runtime_effects=[
            "every pane's model sees and can execute the write family "
            "and the git family; work-shaped activity still promotes "
            "to the tasks pane via the consent card (organization, "
            "not permission)",
            "the model can connect to git projects natively: status, "
            "diff, log, branch, add and commit as first-class typed "
            "tool results",
            "the landing-law banned paths never enter a git tool "
            "staged tree or commit",
        ],
        verification_obligations=[
            "go test -race green for the whole runecore package "
            "(including the cloud wires); go vet + gofmt clean",
            "red-first evidence: the re-pinned suites fail against "
            "the pre-wave toolset before the implementation lands",
            "commit(s) name this contract; pre-commit staged gate "
            "green via this open contract",
        ],
        approval_ref="user:D49 owner ruling 2026-10-22 (capability in "
                     "every pane; native git tools)",
        contract_id="ADMIT-wave-d49-capability-everywhere",
        project_store=store,
        project_id="rune",
    )
    print(json.dumps(env, indent=2, default=str)[:2400])

if __name__ == "__main__":
    raise SystemExit(main())