Merge pull request #57 from chiruu12/fix/framework-hardening

Framework hardening and stabilization (phases 0-6)

Author: chiruu12

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [main, dev]
   pull_request:
     branches: [main, dev]
+  schedule:
+    # Weekly soak: wake-source leak stress (Phase 6 slice 6.3)
+    - cron: "0 6 * * 0"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -13,6 +16,7 @@ concurrency:
 jobs:
   lint:
     name: Lint & Type Check
+    if: github.event_name != 'schedule'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -26,7 +30,6 @@ jobs:
           python-version: "3.12"
 
       - name: Install dependencies
-        # The dev dependency-group is installed by `uv sync` automatically.
         run: uv sync --extra api
 
       - name: Ruff lint
@@ -38,8 +41,30 @@ jobs:
       - name: Mypy
         run: uv run mypy src/
 
-  test:
-    name: Test (Python ${{ matrix.python-version }})
+  test-fast:
+    name: Test (fast — PR gate)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: uv sync --extra api
+
+      - name: Run tests (excluding adversarial)
+        run: uv run pytest tests/ -v --ignore=tests/adversarial/ -x
+
+  test-full:
+    name: Test (full — merge gate, Python ${{ matrix.python-version }})
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -57,7 +82,6 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install dependencies
-        # The dev dependency-group is installed by `uv sync` automatically.
         run: uv sync --extra api
 
       - name: Run tests
@@ -68,10 +92,32 @@ jobs:
         # Coverage gating on one matrix leg only; ratchet the floor up as
         # coverage rises -- never lower it.
         if: matrix.python-version == '3.12'
-        run: uv run pytest tests/ -v --cov=hive --cov-report=term --cov-fail-under=73
+        run: uv run pytest tests/ -v --cov=hive --cov-report=term --cov-fail-under=77
+
+  resilience:
+    name: Adversarial / resilience gate
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: uv sync --extra api
+
+      - name: Adversarial / resilience gate
+        run: uv run pytest tests/adversarial/ -v --tb=short
 
   docs:
     name: Docs build
+    if: github.event_name != 'schedule'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -86,8 +132,9 @@ jobs:
       - name: Build docs (strict)
         run: uv run mkdocs build --strict
 
-  build:
-    name: Build wheel
+  build-clean:
+    name: Build (clean checkout)
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -96,11 +143,48 @@ jobs:
         with:
           version: "latest"
 
-      - name: Build
-        run: uv build
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Build from git archive
+        run: |
+          rm -rf /tmp/hive-ci-build
+          mkdir -p /tmp/hive-ci-build
+          git archive HEAD | tar -x -C /tmp/hive-ci-build
+          cd /tmp/hive-ci-build && uv build
 
       - name: Verify wheel contents
         run: |
+          cd /tmp/hive-ci-build
           python3 -m zipfile -l dist/*.whl | grep -q "hive/models.yaml"
           python3 -m zipfile -l dist/*.whl | grep -q "hive/profiles/"
           echo "Wheel contents verified"
+
+  soak:
+    name: Scheduled soak
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: uv sync --extra api
+
+      - name: Wake-source stress (50x)
+        run: |
+          for i in $(seq 1 50); do
+            echo "=== iteration $i/50 ==="
+            uv run pytest tests/adversarial/test_resource_exhaustion.py::TestWakeSourceCleanup::test_wake_source_does_not_leak_tasks -q --tb=short
+          done
+
+      - name: Full suite (ordering sensitivity)
+        run: uv run pytest tests/ -v --tb=short

.gitignore

@@ -233,3 +233,9 @@ launch/
 poker-engine/
 hive-arena/
 hum/
+
+# macOS
+.DS_Store
+
+# Local agent-tool state
+.commandcode/

ARCHITECTURE.md

@@ -17,7 +17,7 @@ src/hive/
 │   ├── profile.py    # AgentProfile — YAML-driven configuration
 │   ├── state.py      # AgentState, AgentStatus enum
 │   ├── existence.py  # ExistenceLoop — autonomous goal generation
-│   ├── goal_strategy.py # GoalStrategy protocol, GoalContext, Goal
+│   ├── goal_strategy.py # GoalStrategy protocol, GoalContext, GeneratedGoal
 │   ├── suffering.py  # SufferingState, StressorRegistry, stressor types
 │   ├── identity.py   # IdentityManager — narrative and opinions
 │   ├── delegation.py # DelegationEngine — inter-agent task routing

CLAUDE.md

@@ -105,6 +105,9 @@ src/hive/
 | Custom A2A pattern | Subclass `A2APattern`, `PatternRegistry.default().register(name, instance)` | `src/hive/interactions/registry.py` |
 | Custom goal strategy | Implement `GoalStrategy` protocol, pass to `HiveDaemon` | `src/hive/agents/goal_strategy.py` |
 | Daemon hooks | `daemon.hooks.on("event", callback)` | `src/hive/daemon/hooks.py` |
+| Phase guard | `PhaseGuard` protocol, `daemon.hooks.register_guard(phase, guard)` | `src/hive/daemon/gates.py` |
+| Wake source | `WakeSource` protocol, `daemon.add_wake_source(...)` | `src/hive/daemon/wakeup.py` |
+| Swarm policy | `SwarmPolicy` protocol, `HiveDaemon(swarm_policy=...)` | `src/hive/agents/swarm_policy.py` |
 | Agent profile | YAML in `profiles/` | `src/hive/agents/profile.py` |
 | Plugin toolkit | Drop in `.hive/plugins/` | `src/hive/runtime/plugin_loader.py` |
 | Custom STT provider | Implement `STTProvider` protocol | `src/hive/stt/base.py` |

EXTENDING.md

@@ -213,30 +213,29 @@ async def test_brainstorm_pattern(tmp_path):
 ## 5. Custom Goal Strategy
 
 Implement the `GoalStrategy` protocol to control how agents generate goals when idle.
+Every call must return a `GeneratedGoal` with `cost_usd` and `tokens` set from any LLM
+work, even when `objective` is `None`.
 
 ```python
-from hive import GoalStrategy, GoalContext, Goal
-from uuid import uuid4
+from hive import GoalStrategy, GoalContext, GeneratedGoal
+from pathlib import Path
 
 class PrioritizedGoalStrategy:
     """Generate goals based on suffering and nudges."""
 
-    async def generate_goal(self, context: GoalContext) -> Goal | None:
+    async def generate_goal(self, context: GoalContext) -> GeneratedGoal:
         # Prioritize user nudges
         if context.nudges:
-            return Goal(
-                goal_id=f"goal-{uuid4().hex[:8]}",
+            return GeneratedGoal(
                 objective=f"Address user request: {context.nudges[0]}",
-                reasoning="User nudge takes priority",
             )
         # High suffering → self-care
         if context.suffering.cumulative_load > 0.7:
-            return Goal(
-                goal_id=f"goal-{uuid4().hex[:8]}",
+            return GeneratedGoal(
                 objective="Focus on resolving active stressors",
-                reasoning=f"Suffering load at {context.suffering.cumulative_load:.0%}",
             )
-        return None  # Fall through to default behavior
+        # LLM call with no actionable goal — still report spend
+        return GeneratedGoal(objective=None, cost_usd=0.0, tokens=0)
 
 # Pass to daemon
 from hive import HiveDaemon
@@ -246,7 +245,7 @@ daemon = HiveDaemon(hive_dir=Path(".hive"), goal_strategy=PrioritizedGoalStrateg
 ```python
 # Test
 import pytest
-from hive import GoalContext, GoalStrategy, SufferingState
+from hive import GoalContext, GeneratedGoal, SufferingState
 from hive.agents.profile import AgentProfile
 
 @pytest.mark.asyncio
@@ -261,9 +260,9 @@ async def test_prioritized_strategy():
         nudges=["Please write docs"],
         recent_goals=[],
     )
-    goal = await strategy.generate_goal(ctx)
-    assert goal is not None
-    assert "write docs" in goal.objective.lower()
+    result = await strategy.generate_goal(ctx)
+    assert result.objective is not None
+    assert "write docs" in result.objective.lower()
 ```
 
 ## 6. Daemon Hooks
@@ -357,7 +356,18 @@ def test_profile_loads():
 
 ## 8. Plugin System
 
-Drop a Python file containing a `Toolkit` subclass in `.hive/plugins/`. It's auto-discovered and loaded every 10 daemon cycles.
+Drop a Python file containing a `Toolkit` subclass in `.hive/plugins/`. Enable
+plugin loading in `.hive/config.yaml` first (disabled by default for security --
+plugins execute arbitrary Python with full process privileges, and agents can
+write new plugin files that hot-load every 10 daemon cycles):
+
+```yaml
+plugins:
+  enabled: true
+  allowlist: []   # optional: restrict to named files/stems
+```
+
+Once enabled, plugins are auto-discovered and loaded every 10 daemon cycles.
 
 ```python
 # .hive/plugins/calculator.py

docs/contributing.md

@@ -13,6 +13,30 @@ git checkout -b ci/improvement    # CI/CD changes
 
 Open a PR to `main`, wait for CI to pass, then merge.
 
+## Merge gate (CI)
+
+Every PR runs the **fast gate**; pushes to `main`/`dev` also run the **full merge gate**. See [framework stabilization index](plans/framework-stabilization-index.md) for measured baselines.
+
+### PR fast gate (required)
+
+```bash
+uv run ruff check src/ tests/
+uv run ruff format --check src/ tests/
+uv run mypy src/
+uv run pytest tests/ -v --ignore=tests/adversarial/
+uv run pytest tests/adversarial/ -v --tb=short
+uv run mkdocs build --strict
+```
+
+### Merge gate (push to main / dev)
+
+```bash
+uv run pytest tests/ -v --cov=hive --cov-report=term --cov-fail-under=77
+git archive HEAD | tar -x -C /tmp/hive-ci-build && cd /tmp/hive-ci-build && uv build
+```
+
+A weekly scheduled **soak** job repeats the wake-source leak test 50× and runs the full suite for ordering sensitivity.
+
 ## Development Setup
 
 ```bash
@@ -67,7 +91,6 @@ src/hive/
 ## Pull Request Guidelines
 
 - One logical change per PR
-- Tests must pass: `uv run pytest`
-- Lint must pass: `uv run ruff check src tests`
+- All [merge gate](#merge-gate-ci) commands must pass locally before opening a PR
 - Include a clear description of what changed and why
 - Reference any related issues