dorian V1 strengthening (1.0.0rc1)

[ajaysurya1221]

Summary

V1 strengthening program (from v0.11.0), released as the prerelease tag v1.0.0rc1 and
independently release-audited (FIXED_PASS). All additions are additive and backward-compatible.

• Python structural checkers py-signature: / py-const: (AST; close the symbol: existence
  and string:/regex: comment-survival ceilings; py-const: compares value and type).
• Semantic-context code: — regex over comment/docstring-stripped Python.
• Checker-strength / claim-risk diagnostics in dorian bindings (+ C4 adequacy lint); advisory.
• Multi-index binding — config keys in tracked .toml/.json (zero runtime deps; YAML excluded).
• Trusted-base revalidate --checker-source base / Action checker_trust: base — base-approved
  checker specs only for public/fork PRs (a trust root, not a sandbox).
• dorian bench warrant-quality — offline per-claim mutation scoring.
• Docs: V1_SCOPE.md, version-stamped BENCHMARK_CURRENT.md, historical benchmark labels.

Two adversarial reviews (implementation BLOCK → 6 must-fixes; independent release audit
FIXED_PASS → 2 doc-drift blockers + should-fixes) all resolved with regression tests.

Invariants preserved: ERROR ≠ BROKEN; checkers read-only (except C4/C5-shell); binding is
trigger-only; zero runtime dependencies. Release candidate, not final 1.0.0 (real-repo
public micro-benchmark + RC caveats remain post-V1; see docs/V1_SCOPE.md).

Test Plan

• CI matrix (Python 3.11 / 3.12 / 3.13) green on this PR
• Local at the release commit: uv run pytest → 735 passed (incl. slow); ruff clean; uv build +
  clean-venv install → dorian 1.0.0rc1; benchmarks reproduce unchanged; trusted-base exploit
  matrix (10 cases) passes.

Summary by CodeRabbit

• New Features

  • Python structural checkers: signature validation, constant value verification, semantic code matching
  • Trusted-base mode for secure pull request validation
  • Automatic config-key binding from TOML/JSON files
  • Warrant-quality benchmark harness
  • Checker strength and claim risk diagnostics

• Documentation

  • V1 scope and boundaries documented
  • Updated security guidance for untrusted sources
  • Versioned benchmark results published

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

This PR releases dorian v1.0.0rc1, adding five V1 features: Python-AST structural C3 checker forms (py-signature:, py-const:, code:); trusted-base checker-source mode for fork PR security; multi-index TOML/JSON config-key binding; advisory checker-strength/risk diagnostics; and an offline warrant-quality mutation harness. The version is bumped from 0.11.0 to 1.0.0rc1 with corresponding documentation and security boundary updates.

Changes

dorian V1 Feature Set

Layer / File(s)	Summary
Python AST structural C3 checkers src/dorian/pyast.py, src/dorian/checkers/c3_ref.py, src/dorian/seal.py, src/dorian/bindings.py, spec/checkers.md, docs/AGENT_CLAIMS.md, tests/test_pystructural.py, tests/test_semantic_context.py	Adds pyast.py implementing code_only_python, check_signature, and check_const (AST-based, no execution); extends c3_ref.check() with py-signature:, py-const:, and code: (comments/docstrings stripped) branches; centralizes file-operand prefix detection in seal.py via _C3_FILE_OPERAND_FORMS; propagates constant to bindings.py; spec and full test coverage added.
Trusted-base checker-source mode src/dorian/revalidate.py, src/dorian/cli.py, src/dorian/commands.py, action/action.yml, action/README.md, SECURITY.md, docs/SECURITY_BOUNDARY.md, docs/TRUSTED_BASE_ACTION_DESIGN.md, tests/test_trusted_base.py, tests/test_action_security_defaults.py, tests/test_claude_code_docs.py, tests/test_render_md.py	revalidate() gains checker_source parameter; _load_base_warrant() loads and integrity-verifies base sidecars with fail-closed caching; PR-added/modified executable checkers are skipped under "base" mode; RevalResult gains a notes field surfaced in text/markdown renders; --checker-source CLI option and DORIAN_CHECKER_SOURCE env added; checker_trust input wired into Action via DORIAN_CHECKER_SOURCE; security docs updated from "not implemented" to shipped V1; full end-to-end and CLI tests added.
Multi-index config-key binding src/dorian/symbol_index.py, src/dorian/commands.py, tests/test_config_binding.py, tests/test_symbol_index.py	Adds config_key_index, claim_config_watch_paths, claim_watch_paths, and ambiguous_config_mentions to symbol_index.py; updates cmd_verify, cmd_bind_suggest, and cmd_rebind to use unified multi-index watch paths; stopword set prevents over-binding on common PEP 621 keys; comprehensive test suite including end-to-end revocation on config drift.
Checker strength and claim risk diagnostics src/dorian/strength.py, src/dorian/commands.py, tests/test_strength.py	New strength.py computes truth-strength for C1/C3/C4/C5 checkers, detects kind-vs-strength adequacy mismatches, statically lints C4 test nodes for vacuous assertions, and rolls binding flags into per-claim high/medium/low risk; integrated into _emit_binding_gate_warnings and cmd_bindings output; full test suite with CLI integration test.
Warrant-quality offline mutation harness bench/warrant_quality.py, src/dorian/commands.py, tests/test_warrant_quality.py	Adds bench/warrant_quality.py implementing deterministic C3 mutation generation (symbol:, py-const:, py-signature:), sandboxed mutation running (path-escape blocked), verdict-to-outcome mapping (caught/missed/brittle/ok/ceiling), claim quality scoring (weak/brittle/strong/unscored), and JSON/text output; registered as dorian bench warrant-quality; tests include sandbox-containment and CLI smoke test.
Version bump, benchmark docs, and V1 scope pyproject.toml, src/dorian/__init__.py, docs/V1_SCOPE.md, docs/BENCHMARK_CURRENT.md, docs/BENCHMARK_BINDING_LIFECYCLE.md, docs/ROADMAP_BACKLOG.md, docs/START_HERE.md, README.md, .gitignore, tests/test_benchmark_evidence.py	Version bumped to 1.0.0rc1; new V1_SCOPE.md enumerates V1 capabilities and non-goals; BENCHMARK_CURRENT.md documents current benchmark environment and results; historical benchmark docs labeled; README.md updated with trust state semantics, command surface changes, and benchmark historical references; benchmark hygiene enforced via test_benchmark_evidence.py.

Sequence Diagram(s)

sequenceDiagram
  participant PR as PR CI (Action)
  participant cmd as commands.cmd_revalidate
  participant reval as revalidate()
  participant base as _load_base_warrant()
  participant git as git base ref
  participant checker as _check_claim()

  PR->>cmd: checker_trust=base, since=base_sha
  cmd->>reval: checker_source="base", since=base_sha
  loop per artifact claim
    reval->>base: artifact_uri, base_sha
    base->>git: read .warrant sidecar at base_sha
    git-->>base: raw bytes or FileNotFoundError
    base-->>reval: Warrant | None
    alt base warrant missing or tampered
      reval-->>reval: claim → ERRORED, no execution
    else PR added/modified executable checker
      reval-->>reval: record trust-root note, use base spec
      reval->>checker: base-approved CheckerSpec
      checker-->>reval: PASS | FAIL | ERROR
    else spec unchanged
      reval->>checker: base spec
      checker-->>reval: PASS | FAIL | ERROR
    end
  end
  reval-->>cmd: RevalResult(notes=[...])
  cmd-->>PR: exit code + sticky PR comment

Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related PRs

• ajaysurya1221/dorian#4: Directly modifies src/dorian/bindings.py's _checker_named_files C3 branch, the same function updated here to use _C3_FILE_OPERAND_FORMS.
• ajaysurya1221/dorian#3: Introduces referenced_paths in src/dorian/seal.py, the same function updated here to use _C3_FILE_OPERAND_FORMS for expanded C3 operand handling.

Poem

🐇 A rabbit hops through AST trees,
Checking signatures with greatest of ease!
Base warrants guarded, no forks may deceive,
Config keys indexed, so watchers don't grieve.
Mutations measured, the warrant stands strong—
V1 has shipped, and the wait wasn't long! 🎉

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dorian-v1-strengthening