diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md new file mode 100644 index 00000000..dd197f35 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md @@ -0,0 +1,15 @@ +# Chunk Map: WS-ENG-008 — Repository-Native SDLC Assurance + +| Order | Chunk | Purpose | Risk | Dependency | State | +|---:|---|---|---:|---|---| +| 1 | `WS-ENG-008-01` | Enforce versioned machine-checkable chunk scope | L1 | Planning merge and signed start | Proposed | +| 2 | `WS-ENG-008-02` | Add read-only scheduled signed-state drift audit | L1 | 01 | Proposed | +| 3 | `WS-ENG-008-03` | Add risk-routed adversarial proof records | L1 | 01 | Proposed | +| 4 | `WS-ENG-008-04` | Add bounded loop-memory property invariants | L1 | 01–03 | Proposed | +| 5 | `WS-ENG-008-05` | Add bounded authorization property invariants | L1 | 04 and canonical AUTH reconciliation | Proposed | +| 6 | `WS-ENG-008-06` | Run a non-blocking changed-module mutation pilot | L1 | 01, 04–05, canonical CI/QUALITY reconciliation | Proposed | +| 7 | `WS-ENG-008-07` | Migrate root review history to a lossless indexed archive | L1 | Active root-log writers reconciled | Proposed | + +Only `WS-ENG-008-01` is named by the planning merge intent. Every later chunk +must be named by its predecessor's reviewed merge intent and receive a separate +signed start. No chunk starts automatically. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md new file mode 100644 index 00000000..197318c3 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md @@ -0,0 +1,42 @@ +# Decisions: WS-ENG-008 — Repository-Native SDLC Assurance + +## D1 — Preserve the zero-trust loop as the enforcement mechanism + +“Repository-Native Human-Agent SDLC” names the broader development model. The +Codex-native zero-trust engineering loop remains its enforcement mechanism and +is not renamed away. + +## D2 — Enforce future contracts without guessing historical intent + +Machine scope applies to every implementation/specification start whose trusted- +main basis contains the `WS-ENG-008-01` merge intent. Chunk 01 must upgrade its +already-reviewed ENG-008 successors 02–07 before selecting 02. Chunks already +signed-active at cutover are the only grandfather set and remain bound to their +exact start event, contract blob, reviewed evidence, and existing gates. + +## D3 — Keep scheduled drift verification read-only + +The scheduled job can detect and report but cannot sign, repair, push, dispatch, +approve, or merge. + +## D4 — Route adversarial proof instead of adding a universal reviewer + +Risk routing assigns explicit adversarial proof to high-risk work using existing +review ownership. Evidence records attempts and outcomes, not an empty file. + +## D5 — Measure mutation quality before setting a threshold + +The pilot is non-blocking and cannot reduce existing coverage gates. A blocking +mutation policy requires a later reviewed human decision based on hosted data. + +## D6 — Reconcile concurrent initiatives at every boundary + +Planning uses current signed state, but each implementation start, review, +publication, and merge repeats current-main and overlap checks. AUTH property +work and root-log archival have explicit concurrency waits. + +## D7 — Archive review memory losslessly + +Root review memory becomes an index only after byte-preserving archives and +link/reconstruction proof exist. Initiative review directories remain detailed +evidence. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md new file mode 100644 index 00000000..9a4bac7d --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md @@ -0,0 +1,129 @@ +# Discovery: WS-ENG-008 — Repository-Native SDLC Assurance + +Discovery was performed read-only against trusted `main` +`bcf1292e1a591e3e84bf8ee212ee7191d80741fa` and signed +`automation/loop-memory` tip +`8affe98a0b877ba79abf9d23f86013f838985dcf` on 2026-07-24. + +Before final planning publication on 2026-07-26, the branch was reconciled to +trusted `main` `a04fd1a0a623b7150ec40c9934a9982f80a2dce7` and signed +`automation/loop-memory` tip +`33edd1a682ea5fe5ea973870f89bdd3a75a63da3`. The historical observations below +remain discovery provenance; the current signed projection is recorded in the +reconciliation addendum. + +## Current behavior + +- `scripts/check_internal_review_evidence.py` discovers changed files, resolves + required reviewer tracks, binds reviewed SHA provenance, and restricts + post-review changes. It does not parse or enforce contract path scope. +- `.agent-loop/templates/CHUNK_CONTRACT.md` requires human-readable allowed and + forbidden sections without a machine-readable schema. +- Some historical chunks use one-off shell regexes or reviewed-scope manifests; + there is no reusable canonical implementation. +- `.github/workflows/agent-gates.yml` runs evidence, merge-intent, Markdown, + stale-contract, and regression gates. No workflow uses `schedule`. +- `scripts/update_post_merge_memory.py` and + `scripts/check_loop_memory_state.py` already verify signed-state semantics and + closed-tree integrity during merge/start workflows. +- `.codex/agents/` contains senior, QA, security, product/ops, architecture, CI, + docs, reuse, and test-delta reviewers. No explicit adversarial proof contract + exists. +- `scripts/agent-gate-requirements.txt` and `backend/pyproject.toml` contain no + Hypothesis or mutation-testing dependency. +- At original discovery, Backend CI fanned out four isolated shards and + recombined exact artifacts. Final reconciliation records the replacement + four exact-custody semantic lanes. Both designs preserve the 78 percent global + coverage floor plus multiple 90 percent protected subsystem floors. +- `.agent-loop/REVIEW_LOG.md` is 147,017 bytes and 2,846 lines. Detailed review + evidence also lives under initiative `reviews/` directories. + +## Relevant files and modules + +| Area | Existing surfaces | Gap | +|---|---|---| +| Contract enforcement | `.agent-loop/templates/CHUNK_CONTRACT.md`, `scripts/check_internal_review_evidence.py`, `scripts/test_agent_gates.py` | No universal typed path delta enforcement. | +| Signed memory | `scripts/update_post_merge_memory.py`, `scripts/check_loop_memory_state.py`, `.github/workflows/loop-memory*.yml` | No independent read-only schedule. | +| Reviewer routing | `.agent-loop/policies/routing-policy.md`, `.codex/agents/*.toml`, `.agents/skills/risk-router/` | Adversarial attempts are implicit rather than stable evidence. | +| Property tests | Loop-memory tests and authorization tests | Extensive adversarial examples, no generated invariant exploration. | +| Mutation testing | Backend coverage workflow and coverage policy | Coverage measures execution, not fault sensitivity. | +| Review memory | Root `REVIEW_LOG.md`, initiative review directories | Root narrative grows linearly and duplicates detail. | + +## Concurrent initiative reconciliation + +| Initiative | Signed state at discovery | Concurrent repository state | ENG-008 rule | +|---|---|---|---| +| `WS-ART-001` | `WS-ART-001-03` active | Dedicated clean worktree; no PR yet | Do not touch ART application or artifact-custody surfaces. Reconcile before every ENG-008 PR. | +| `WS-AUTH-001` | `WS-AUTH-001-10C` active | PR #194 open; local repairs differ from its published head and Backend CI is failing | AUTH property chunk waits for AUTH to merge or stop, then rebases on its canonical result. | +| `WS-REV-001` | `WS-REV-001-03P` active | PR #195 open and green at discovery | Avoid project/review runtime files and reconcile its merge before later test work. | +| `WS-CON-001` | stopped at `02A`, next `02B` | Worktree has an unexplained local PDF deletion | No adoption or modification; deletion remains outside ENG-008. | +| `WS-QUAL-001` | absent from signed state | Two stale local worktrees; no current authority | Treat all QUALITY commits as discovery input only; mutation work starts from current main under ENG-008. | +| External PRs #62, #138, #149 | no active signed initiative authority | stale, conflicting, or missing current gates | Never merge as ENG-008 authority; inspect only as preserved proposals when relevant. | + +### Final current-main reconciliation + +| Initiative | Signed state at final reconciliation | ENG-008 boundary | +|---|---|---| +| `WS-ART-001` | stopped after `WS-ART-001-PLAN2`; next `WS-ART-001-03A` requires explicit start | No ART authority is borrowed. | +| `WS-AUTH-001` | stopped after `WS-AUTH-001-11`; next `WS-AUTH-001-11A` requires explicit start | Chunk 05 must start from the then-current canonical AUTH result. | +| `WS-REV-001` | `WS-REV-001-03P` remains signed-active | Avoid REV runtime and reconcile its result before overlapping work. | +| `WS-CON-001` | stopped after `WS-CON-001-02A`; next `02B` requires explicit start | Local worktree state remains non-authoritative. | +| `WS-QUAL-001` | absent from signed state | Dormant patches remain discovery input only. | +| `WS-ENG-008` | absent from signed history | This additive planning intake may create only stopped PLAN state. | + +Current Backend CI uses four exact-custody semantic lanes with one combined +coverage result. The earlier four-shard topology remains historical discovery +context only and is not a protected future contract boundary. + +## Existing tests and gaps + +- Agent Gate tests strongly cover merge intent, evidence, workflow pinning, + coverage floors, signed state, and planning intake. +- Loop-memory tests already contain mutation matrices and replay/collision + cases, but generated state-space invariants are not property-tested. +- Authorization tests cover deny-default and action ownership through examples; + generated unknown/cross-resource/lifecycle combinations are not centralized. +- No test currently proves that every ordinary PR path is permitted by the + signed contract's machine-readable scope. +- No scheduled proof detects later automation-branch tampering between events. +- Coverage evidence cannot show whether assertions kill plausible behavioral + faults. + +## Dependencies and integrations + +- PyYAML is pinned for Agent Gates, but JSON is preferable for the first scope + schema because it avoids YAML coercion and duplicate-key ambiguity. +- Hypothesis would be a new test dependency in Agent Gates and later Backend. +- A mutation engine would be a new development/CI dependency and needs a hashed + or otherwise reproducible installation path. +- GitHub Actions scheduling runs workflow code from the default branch; the + drift job must use read-only `contents` and `actions` permissions. + +## Risks discovered + +| Risk | Impact | Required treatment | +|---|---|---| +| Glob semantics differ across platforms | Scope bypass or false rejection | Define one closed repository-relative grammar and test traversal, symlink, rename, and case behavior. | +| Legacy contracts lack schemas | Immediate repository-wide failure | Exact cutover: every post-cutover start requires schema; only work already signed-active at cutover may finish under its exact pre-cutover event and contract blob. | +| Git permits control and normalization-colliding path bytes | Line/display parsing can conceal a delta | Parse NUL-delimited bytes, reject invalid UTF-8/control/non-NFC names and normalization/casefold collisions. | +| Scheduled audit becomes a repair path | Unreviewed signed-state mutation | Read-only permissions, no signing key, no publication command, regression-test workflow semantics. | +| Property suites are nondeterministic | Flaky required CI | Fixed profiles, stored counterexample text in evidence, bounded examples/deadlines, rerunnable seeds. | +| Mutation score is gamed | False assurance | Report eligible/killed/survived/timeout/excluded counts and classify survivors; do not use “kill one mutant.” | +| Review archive breaks references | Loss of durable evidence | Lossless byte-preserving archive, link map, root index, and stale-link tests. | +| Active PR advances main | Stale proof or merge conflict | Rebase/reconcile and rerun exact proof before each PR; signed contracts remain immutable. | + +## Unknowns requiring later measured evidence + +- Eligible module and runtime budget for the mutation pilot. +- Stable Hypothesis example/deadline profile under hosted runners. +- Archive period boundaries that produce useful index sizes without churn. +- Whether scheduled drift should alert through GitHub only or a later external + operations channel; this initiative adds no external notification secret. + +## Existing conventions to preserve + +- One signed active chunk per initiative; distinct initiatives may run concurrently. +- One PR and one schema-v2 merge intent per chunk. +- Exact-current-main signed starts and human-owned specific-PR merge approval. +- Internal reviewer completion before publication; external checks supplement it. +- Automated Merge Memory owns the generated branch and never starts successors. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md new file mode 100644 index 00000000..d89a71ba --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md @@ -0,0 +1,108 @@ +# Intent: WS-ENG-008 — Repository-Native SDLC Assurance + +## Problem being solved + +Workstream's repository-native human-agent engineering loop now binds intent, +signed starts, evidence, review, merge decisions, and generated memory. Its +remaining assurance gaps are that most chunk scope is still interpreted from +prose, signed-state integrity is checked only on merge/start rather than on an +independent schedule, adversarial proof is implicit across reviewer tracks, +invariant tests are predominantly example-based, mutation quality is not +measured, and the root review log has grown to about 147 KB. + +## Why this work matters + +The loop is trustworthy only if authorization, scope, proof quality, and durable +memory remain independently verifiable as the repository and contributor count +grow. These controls must become stronger without slowing every change with +unbounded tests or creating a second authority path. + +## Current behavior + +- Signed starts and generated merge memory are canonical and initiative-local. +- Agent Gates bind merge intent and internal-review evidence to reviewed code. +- Chunk contracts state allowed files and non-goals in Markdown, but there is no + universal machine-enforced path contract for ordinary implementation PRs. +- No scheduled workflow independently audits the signed automation branch. +- Nine internal reviewer tracks exist; adversarial attempts are not represented + by a stable proof schema. +- Neither Hypothesis nor a mutation-testing engine is installed. +- Detailed initiative reviews coexist with a 147,017-byte root `REVIEW_LOG.md`. + +## Target behavior + +- Every implementation/specification start after the `WS-ENG-008-01` cutover + selects a strict versioned scope contract. Grandfathering is limited to work + already signed-active at cutover and bound to its pre-cutover event and + immutable contract blob. +- A read-only schedule verifies signed-state custody, ancestry, ledger, + projections, active contracts, and closed-tree integrity without repairing. +- High-risk work records attacks attempted, observed denials, findings, and + untested surfaces through risk routing. +- Bounded property tests exercise loop-memory and authorization invariants with + deterministic replay evidence. +- A changed-module mutation pilot measures meaningful survivors before any + carefully calibrated blocking policy is proposed. +- Root review memory becomes a compact index with lossless archives and + initiative-owned detailed evidence. + +## Design chosen + +Deliver one assurance mechanism per reviewed chunk. Ratchet new enforcement +forward without retroactively rewriting hundreds of historical contracts. +Reuse the current signed-state verifier, internal evidence gate, risk router, +reviewer files, Backend aggregation, and initiative review directories. + +## Alternatives considered + +- A global mutation gate immediately was rejected because runtime, exclusions, + and baseline quality are not yet measured. +- A universal tenth reviewer was rejected because it would duplicate existing + security, QA, architecture, and test-delta tracks; adversarial proof will be + risk-routed instead. +- One scheduled job covering all runtime architecture was rejected because + signed-memory custody and subsystem runtime reachability have different + owners and failure semantics. +- Truncating `REVIEW_LOG.md` was rejected because review history must remain + lossless and linkable. + +## Boundaries preserved + +- Existing signed starts, start authority, cancellation approval, human merge + ownership, merge intent, coverage floors, and automated merge memory remain. +- ART, AUTH, and REV keep their current initiative-local signed authority. +- Existing patches and dormant QUALITY work are discovery input only. +- Scheduled verification is read-only and receives no signing secret or write + permission. +- Property and mutation testing do not change product behavior. + +## Expected risks + +- A scope schema could reject valid changes or permit path-pattern ambiguity. +- Scheduled auditing could produce noisy failures or accidentally gain write + authority. +- Property and mutation suites could destabilize or lengthen CI. +- Adversarial review could become duplicative checkbox evidence. +- Review-log migration could break historical links or collide with active PRs. + +## What must not change + +- No bypass for humans, agents, forks, administrators, existing patches, drafts, + or emergency work. +- No automatic start, merge, state repair, or review approval. +- No weakening of the 78 percent global or protected 90 percent coverage floors. +- No application behavior, product authorization, payment, or artifact-custody + change may be hidden inside this engineering initiative. + +## How this will be proven + +Each chunk has adversarial fixtures, exact allowed paths, required reviewers, +bounded runtime expectations, and a null or same-initiative successor. Hosted +CI remains authoritative. Concurrent active initiatives are reconciled against +exact current `main` before implementation, review, publication, and merge. + +## Human decisions required + +- Approve each implementation chunk's exact scope and PR independently. +- Decide after the mutation pilot whether any score becomes blocking. +- Approve the lossless review-log archive layout before migration. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md new file mode 100644 index 00000000..343992a4 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md @@ -0,0 +1,141 @@ +# Plan: WS-ENG-008 — Repository-Native SDLC Assurance + +## Proposed approach + +Strengthen the existing loop in dependency order: enforce the contract that +authorizes a diff, independently audit signed memory, formalize adversarial +proof, deepen invariant testing, measure mutation sensitivity, then compact +durable review navigation. Each mechanism lands independently and stops. + +## Design chosen + +### Forward-ratcheted contract scope + +Every implementation/specification start after the `WS-ENG-008-01` merge must +select a contract carrying one strict fenced JSON block; there is no subjective +“material” exception. Chunk 01 also upgrades the already-added ENG-008 contracts +02–07 before it may name 02 as successor. Only chunks already signed-active at +the cutover may finish under an immutable grandfather record bound to the exact +pre-cutover start event and contract blob; stopped, proposed, or newly started +work cannot inherit that exemption. Grandfather records are never +inferred or mass-rewritten. A dedicated parser validates exact keys, canonical +repository-relative patterns, reviewer names, and verification commands. JSON +decoding uses an object-pairs hook (or equivalent) that rejects duplicate object +keys before exact-key and scope validation. Agent Gates compare the PR's +status-aware diff to this block and fail closed on +unmatched, forbidden, renamed, symlinked, submodule, or ambiguous paths. + +### Read-only drift audit + +A scheduled workflow checks out trusted `main`, fetches +`automation/loop-memory`, runs existing cryptographic and independent semantic +validators, checks main ancestry and active contract bindings, and publishes no +state. It has no signing secret and no write permission. Failure is diagnostic; +recovery remains the existing explicit process. + +### Risk-routed adversarial proof + +High-risk chunks record attack objective, boundary, method, expected denial, +observed evidence, findings, and untested surfaces. Existing reviewers own the +result through routing; no duplicative universal reviewer or empty findings +file is introduced. + +### Bounded property and mutation evidence + +Hypothesis is introduced first for pure loop reducers and validators, then for +authorization decision invariants after active AUTH work lands. Profiles are +deterministic and bounded. Mutation testing begins as a changed-module pilot +that reports complete classifications; it cannot weaken coverage or become a +blocking percentage until measured evidence supports a later human decision. + +### Lossless review index + +Root review history is copied byte-for-byte into versioned archives with a +linkable index. Initiative review directories remain detailed truth. No record +is deleted; future root entries become compact navigation only. + +## Alternatives rejected + +- Prose-only scope review: insufficiently deterministic. +- Automatic contract generation from the diff: retroactive authorization. +- Scheduled repair: creates a second write/authority path. +- One broad property suite required for every chunk: unbounded runtime and poor ownership. +- Immediate mutation threshold: no calibrated baseline. +- Empty adversarial findings file: proves no attempted attack. +- Destructive review-log rotation: breaks durable memory. + +## Boundaries preserved + +- No product, API, data, authorization grant, payment, artifact, or review + lifecycle behavior changes. +- No start/cancel authority, signing key, branch protection, secret, or human + merge policy changes. +- Existing CI and coverage floors may only be preserved or strengthened after + measured human approval. +- Concurrent ART/AUTH/REV initiatives retain their scope and merge independently. + +## Risk routing + +| Chunk | Risk | SLA | Work type | Required reviewers | Human gate | +|---|---:|---:|---|---|---| +| `WS-ENG-008-01` | L1 | P1 | policy/CI | all nine tracks | Explicit PR merge approval | +| `WS-ENG-008-02` | L1 | P1 | workflow/security/operations | all nine tracks | Explicit PR merge approval | +| `WS-ENG-008-03` | L1 | P1 | policy/review evidence | all nine tracks | Explicit PR merge approval | +| `WS-ENG-008-04` | L1 | P2 | loop-security tests/dependency | all nine tracks | Explicit PR merge approval | +| `WS-ENG-008-05` | L1 | P2 | authorization tests/dependency | all nine tracks | Explicit PR merge approval after AUTH reconciliation | +| `WS-ENG-008-06` | L1 | P2 | CI/test dependency pilot | all nine tracks | Explicit PR merge approval and later separate threshold decision | +| `WS-ENG-008-07` | L1 | P2 | durable-memory migration/docs | all nine tracks | Explicit PR merge approval after concurrent log writers reconcile | + +Budget posture is careful for every chunk: bounded implementation, deterministic +proof before reviewer fanout, and no automatic successor. + +## Dependency and reconciliation order + +1. Contract enforcement lands before other assurance work. +2. Drift audit reuses canonical contract parsing and current signed validators. +3. Adversarial proof routing reuses contract reviewer metadata. +4. Loop property tests precede the broader authorization suite. +5. Authorization property work reconciles the then-current canonical AUTH result + before its separate signed start. +6. Mutation pilot inspects dormant QUALITY patches only as discovery and starts + from the then-current canonical Backend workflow. +7. Review-log migration waits until active initiatives no longer carry root-log + changes, then preserves every newly merged entry. + +Before each chunk starts, the orchestrator fetches exact `main` and signed state, +checks the target initiative idle, audits concurrent PR path overlap, dispatches +the signed event, verifies its projection, and creates a fresh branch from that +main. Before publication and merge, it repeats base-delta reconciliation and +all contract proof. + +## Verification strategy + +- Parser and mutation matrices for schemas, paths, diff statuses, and reviewer sets. +- Byte-preserving NUL-delimited Git fixtures for controls, invalid UTF-8, + non-NFC names, normalization/casefold collisions, and rename/type changes. +- Workflow semantic tests for read-only permissions and absence of repair/signing paths. +- Independent signed-state fixture audits and scheduled-run dry runs. +- Deterministic Hypothesis profiles with replayable failing examples. +- Property suites have hosted hard limits of 120 seconds each, with the exact + head's elapsed time recorded; mutation execution has a 12-minute command + limit inside a 15-minute job limit and may add no more than two minutes to the + existing required Backend critical path because it runs as an independent lane. +- Mutation pilot artifact integrity and survivor-classification tests. +- Byte/digest/link equality for review-log archives. +- Existing Agent Gates, Backend full CI, coverage floors, Markdown links, stale + wording, internal evidence gate, CodeRabbit, and human review remain required. + +## Rollout and rollback + +Each merge is forward-only and independently useful. If a new gate is too noisy, +repair it through a new reviewed chunk; do not disable or bypass it. Scheduled +audit failures never mutate state. Mutation evidence remains non-blocking during +the pilot. Archive migration preserves the original bytes, enabling audited +reconstruction without git history dependence. + +## Review strategy + +All seven chunks are L1 repository-assurance changes and receive senior, QA, +security, product/ops, architecture, CI integrity, docs, reuse, and test-delta +review. Each reviewer receives exact base, implementation SHA, signed start, +contract blob, concurrent-PR overlap report, and deterministic evidence. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md new file mode 100644 index 00000000..645cd756 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md @@ -0,0 +1,17 @@ +# Risks: WS-ENG-008 — Repository-Native SDLC Assurance + +| ID | Risk | Impact | Control | +|---|---|---|---| +| R1 | Scope patterns are ambiguous or bypassable | Unauthorized files enter a chunk | Closed JSON schema, canonical paths, status-aware diff, traversal/symlink/rename/submodule/case mutations. | +| R1A | Git path bytes or Unicode aliases bypass line parsing | A hidden path escapes scope | NUL-delimited byte-preserving diff, strict UTF-8/NFC policy, control rejection, normalization/casefold collision tests. | +| R2 | Forward ratchet breaks already active work | Existing signed work becomes impossible to finish | Require schema for every post-cutover start; grandfather only chunks already signed-active at cutover and bind each to its exact start event and contract blob. | +| R3 | Scheduled audit obtains write authority | A diagnostic becomes a second state writer | Read-only permissions, no secret, no publish/recovery command, semantic workflow tests. | +| R4 | Drift audit is stale relative to concurrent merges | False incident or missed state | Resolve exact current main and automation tip at run time; distinguish transient advancement from corruption. | +| R5 | Adversarial evidence becomes checkbox theater | Review cost without assurance | Require attempted attack, expected denial, observed evidence, and untested surfaces. | +| R6 | Property tests become flaky or slow | CI reliability regresses | Deterministic bounded profiles, reproducible examples, measured hosted runtime. | +| R7 | AUTH property work conflicts with AUTH-10C | Stale or contradictory tests | Wait for canonical AUTH merge/stop, re-discover action/catalogue state, then start. | +| R8 | Mutation score is gamed or too expensive | False confidence or unusable CI | Complete counts, survivor classification, changed eligible modules only, non-blocking pilot. | +| R9 | Dormant QUALITY work is treated as authority | Unsigned stale implementation is published | Preserve as discovery input only; recreate accepted ideas after ENG-008 signed start. | +| R10 | Review-log migration loses or rewrites history | Durable evidence becomes unverifiable | Byte/digest preservation, link map, archives, exact reconstruction tests, no deletion before proof. | +| R11 | Root-log migration conflicts with active PRs | Entries disappear during rebase | Run last and reconcile every active/root-log-writing PR before review and merge. | +| R12 | ENG-008 blocks unrelated active initiatives | Reduced delivery throughput | Initiative-local authority, disjoint early paths, overlap audit before every chunk. | diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md new file mode 100644 index 00000000..fabf4e6f --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md @@ -0,0 +1,15 @@ +# Status: WS-ENG-008 — Repository-Native SDLC Assurance + +- Phase: planning intake review +- Active planning chunk: none +- Active implementation chunk: none +- Proposed planning merge: `WS-ENG-008-PLAN` +- Proposed first implementation chunk: `WS-ENG-008-01` +- Current gate: planning-only artifacts require internal review, exact-head + external checks, and explicit human merge approval +- Original discovery base: `bcf1292e1a591e3e84bf8ee212ee7191d80741fa` +- Final reconciled main: `a04fd1a0a623b7150ec40c9934a9982f80a2dce7` +- Final signed-state tip: `33edd1a682ea5fe5ea973870f89bdd3a75a63da3` +- Concurrent signed state at final reconciliation: REV-03P active; ART stopped + at PLAN2, AUTH stopped at 11, and CON stopped at 02A +- Successor after planning: `WS-ENG-008-01`, separate explicit start required diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md new file mode 100644 index 00000000..2fb0afba --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md @@ -0,0 +1,155 @@ +# Chunk Contract: WS-ENG-008-01 — Machine-Checkable Chunk Scope + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Make the allowed and forbidden path scope of every post-cutover implementation/ +specification start a versioned, deterministic Agent Gate, while grandfathering +only work already signed-active at the exact cutover. + +## Why this chunk exists + +Signed starts bind an exact contract, but ordinary PR delta scope is not yet +universally compared to a machine-readable contract block. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P1 + +## Start phase + +`implementation` + +## Allowed files + +```text +CONTRIBUTING.md +AGENTS.md +README.md +docs/glossary.md +docs/architecture_lockdown.md +.agent-loop/templates/CHUNK_CONTRACT.md +.agent-loop/policies/repository-engineering-policy.md +.agent-loop/policies/definition-of-done.md +.github/workflows/agent-gates.yml +scripts/check_chunk_contract.py +scripts/check_internal_review_evidence.py +scripts/test_check_chunk_contract.py +scripts/test_agent_gates.py +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-external-review-response.md +.agent-loop/merge-intents/WS-ENG-008-01.json +``` + +## Not allowed + +```text +application, API, database, migration, product lifecycle, or product authority changes +start/cancel/merge authority, loop-memory schema, signing, branch protection, environment, or secret changes +retroactive inference or mass rewrite of inactive historical contracts +arbitrary shell execution from contract content +absolute paths, traversal, negation, brace expansion, platform-dependent glob behavior, symlink, or submodule acceptance +coverage, test, evidence, reviewer, PR, or human merge gate weakening +``` + +## Acceptance criteria + +- [ ] One strict versioned JSON block has exact typed keys for identity, phase, + risk, allowed paths, forbidden paths, required reviewers, and verification + command identifiers; duplicate blocks, duplicate keys/items, unknown keys, + malformed Unicode, noncanonical separators, and oversized input fail. +- [ ] The block identity and phase match the canonical heading and signed-start + contract selection; human-readable scope remains required and cannot + contradict the machine block. +- [ ] A closed repository-relative pattern grammar has deterministic semantics + for files and recursive directories without arbitrary regex or shell use. +- [ ] Git status and diff parsing is byte-preserving and NUL-delimited (`-z` or + equivalent), decodes strict UTF-8, rejects C0/C1/DEL controls and non-NFC + names, and rejects byte, NFC, or casefold path collisions. Fixtures cover + tabs, newlines, invalid byte sequences, and distinct NFC/NFD names. +- [ ] Status-aware base-to-head plus staged/dirty/untracked discovery rejects + every added, modified, deleted, renamed, copied, type-changed, symlinked, + executable, gitlink, case-colliding, or foreign path not allowed by the + contract, and rejects every forbidden match even when also allowed. +- [ ] The PR's exact one merge intent, initiative evidence/status, and permitted + post-review evidence paths are represented explicitly rather than hidden + exemptions. +- [ ] Every implementation/specification start whose trusted-main basis contains + `.agent-loop/merge-intents/WS-ENG-008-01.json` requires a schema-v1 + contract. Only chunks already signed-active at the cutover may finish + under a grandfather record bound to the exact pre-cutover start event, + initiative/chunk identity, contract path, and contract blob. Stopped, + proposed, cancelled/restarted, or newly started work is never + grandfathered; there is no file-history or subjective exception. +- [ ] This chunk adds valid schema-v1 blocks to the already-reviewed + `WS-ENG-008-02` through `WS-ENG-008-07` contracts and proves them before + its merge intent may name 02. ENG-008 cannot exempt its own successors as + legacy contracts. +- [ ] Required reviewer metadata agrees with the internal evidence gate; command + identifiers bind evidence without executing contract-provided text. +- [ ] Agent Gates invoke the checker on the exact PR base/head and fail closed + on unresolved refs, shallow history, ambiguity, or malformed contracts. +- [ ] Positive fixtures and one negative mutation per schema, identity, path, + diff-status, reviewer, command, signed-active grandfather, restart, + post-cutover start, and workflow drift class pass. +- [ ] README, glossary, and architecture lockdown consistently define the + Repository-Native Human-Agent SDLC as the broader model and retain the + Codex-native zero-trust engineering loop as its enforcement mechanism. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-02` and requires a + separate explicit start. + +## Verification commands + +```bash +python3 scripts/test_check_chunk_contract.py +python3 scripts/test_agent_gates.py +python3 scripts/check_internal_review_evidence.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Can any changed path escape the signed contract through parsing or Git status semantics? +- Does the ratchet avoid guessing historical scope without creating a new bypass? +- Does the workflow execute only repository-owned checker code? + +## Stop conditions + +Stop if deterministic path semantics cannot be closed, historical contracts +must be rewritten, or any current evidence/review/coverage gate must weaken. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md new file mode 100644 index 00000000..119661de --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md @@ -0,0 +1,113 @@ +# Chunk Contract: WS-ENG-008-02 — Scheduled Signed-State Drift Audit + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Independently and periodically verify signed loop-memory custody and semantic +consistency without granting the audit any repair or write capability. + +## Why this chunk exists + +Merge and start workflows validate state during events, but later corruption or +out-of-band drift currently has no scheduled detection path. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P1 + +## Start phase + +`implementation` + +## Allowed files + +```text +.github/workflows/loop-memory-drift-audit.yml +scripts/audit_loop_memory_drift.py +scripts/test_audit_loop_memory_drift.py +scripts/test_agent_gates.py +docs/operations_post_merge_memory.md +.agent-loop/policies/repository-engineering-policy.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-external-review-response.md +.agent-loop/merge-intents/WS-ENG-008-02.json +``` + +## Not allowed + +```text +write permissions, signing keys, state publication, repair, replay, dispatch, approval, or merge behavior +changes to loop-memory reducers, signer, generated schema, start/cancel authority, or branch protection +application or product subsystem reachability checks +external notification credentials +coverage, test, review, or human gate weakening +``` + +## Acceptance criteria + +- [ ] Scheduled and manually dispatchable workflow runs only trusted default- + branch code with read-only contents/actions permissions and pinned actions. +- [ ] The job receives no signing secret, persists no credentials, and contains + no push, dispatch, replay, publish, apply-event, sign-state, or repair path. +- [ ] Audit verifies signature, manifest digests, exact closed tree, independent + semantic state, ledger chain, projections, current-main ancestry, and + active contract path/blob/heading/phase binding. +- [ ] Main or automation advancement during the audit is reported distinctly + from cryptographic or semantic corruption; no partial result is success. +- [ ] Missing branch, invalid key, shallow history, symlink/gitlink, extra file, + ledger collision, stale projection, duplicate active chunk, and broken + contract reference fail closed in fixtures. +- [ ] Workflow and script have bounded timeouts/output and produce diagnostic + artifacts containing no secret or mutable authority. +- [ ] Existing merge/start validation and recovery instructions remain canonical. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-03` and requires a + separate explicit start. + +## Verification commands + +```bash +python3 scripts/test_audit_loop_memory_drift.py +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Is the audit structurally incapable of writing or repairing state? +- Are advancement races distinguished from corruption without accepting either blindly? +- Does it reuse, rather than fork, canonical signature and semantic validation? + +## Stop conditions + +Stop if the audit needs a write token, signing secret, generated-state edit, or +new recovery path. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md new file mode 100644 index 00000000..2011de9e --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md @@ -0,0 +1,119 @@ +# Chunk Contract: WS-ENG-008-03 — Risk-Routed Adversarial Proof + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Require explicit, reviewable bypass attempts and outcomes for high-risk chunks +without adding a duplicative universal reviewer. + +## Why this chunk exists + +Existing reviewers assess adversarial concerns, but the attempts, expected +denials, observed evidence, and untested surfaces are not represented uniformly. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P1 + +## Start phase + +`implementation` + +## Allowed files + +```text +.agents/skills/risk-router/SKILL.md +.agents/skills/security-review/SKILL.md +.agents/skills/qa-review/SKILL.md +.agents/skills/evidence-gate/SKILL.md +.agent-loop/templates/CHUNK_CONTRACT.md +.agent-loop/templates/PR_TRUST_BUNDLE.md +.agent-loop/templates/ADVERSARIAL_PROOF.md +.agent-loop/policies/routing-policy.md +.github/pull_request_template.md +scripts/check_internal_review_evidence.py +scripts/test_agent_gates.py +CONTRIBUTING.md +AGENTS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-external-review-response.md +.agent-loop/merge-intents/WS-ENG-008-03.json +``` + +## Not allowed + +```text +new merge/start/cancel authority or automatic approval +replacement or weakening of any existing reviewer track +empty findings file as proof +runtime penetration, production credentials/data, destructive attack, or external target activity +application, API, database, product lifecycle, or coverage changes +``` + +## Acceptance criteria + +- [ ] Risk router deterministically requires adversarial proof for L0/L1 auth, + payment, audit/ledger, migration/schema, CI/workflow, signed-loop, + artifact-custody, data-ownership, secret, and tool-input surfaces. +- [ ] Evidence schema requires attack objective, boundary, safe method, expected + denial, observed result, proof reference, finding disposition, and untested + surfaces; an empty or claim-only file fails. +- [ ] Existing reviewer tracks own the proof and cannot all mark the relevant + security/QA/architecture concern unrelated. +- [ ] Internal evidence and trust templates link the exact adversarial proof for + routed chunks and preserve reviewed-SHA/post-review rules. +- [ ] Safe local fixture attempts never target production or require credentials. +- [ ] Positive and negative fixtures cover missing attempts, fabricated output, + unresolved findings, destructive methods, wrong chunk/SHA, and unrouted work. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-04` and requires a + separate explicit start. + +## Verification commands + +```bash +python3 scripts/test_agent_gates.py +python3 scripts/check_internal_review_evidence.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Does the proof show attempted denials rather than an empty compliance claim? +- Is routing bounded enough to avoid duplicating every reviewer on low-risk work? +- Are destructive and external attacks prohibited? + +## Stop conditions + +Stop if adversarial proof requires production access, destructive tests, a new +authority role, or removal of an existing reviewer. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md new file mode 100644 index 00000000..e00087ed --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md @@ -0,0 +1,113 @@ +# Chunk Contract: WS-ENG-008-04 — Loop-Memory Property Invariants + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Use bounded, reproducible property-based tests to explore signed loop-memory +invariants beyond hand-selected examples. + +## Why this chunk exists + +The reducer and validators have strong example/mutation coverage, but generated +event sequences can expose state interactions not anticipated in fixtures. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P2 + +## Start phase + +`implementation` + +## Allowed files + +```text +scripts/agent-gate-requirements.txt +scripts/assurance-requirements.txt +scripts/test_loop_memory_properties.py +scripts/test_agent_gates.py +.github/workflows/agent-gates.yml +docs/operations_post_merge_memory.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-external-review-response.md +.agent-loop/merge-intents/WS-ENG-008-04.json +``` + +## Not allowed + +```text +loop-memory reducer, signer, schema, authority, workflow write behavior, or recovery changes +auth/application/product behavior +unbounded examples, nondeterministic network/time dependence, or hidden flaky retry +coverage, test, review, or human gate weakening +``` + +## Acceptance criteria + +- [ ] Hypothesis and every transitive distribution are exactly pinned and + hash-locked in `scripts/assurance-requirements.txt`; CI installs it with + `--require-hashes`. +- [ ] A bounded CI profile and a documented deeper local profile have explicit + examples, deadlines, health checks, and failure reproduction instructions. +- [ ] Generated event sequences prove at most one active chunk per initiative, + concurrent independence, completed identity non-restart, cross-initiative + denial, stale-main/tip denial, idempotent replay, and projection/ledger + agreement. +- [ ] Invalid paths, phases, identities, permissions, blob bindings, collisions, + and malformed scalar types fail closed without partial state mutation. +- [ ] Properties reuse real reducers/validators and compare independent + invariants; they do not reimplement expected behavior identically. +- [ ] The focused hosted property command has a hard 120-second limit and its + exact-head elapsed time is recorded; timeout is failure, never retry/skip. +- [ ] Existing deterministic regression and coverage suites remain unchanged. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-05` and requires a + separate explicit start. + +## Verification commands + +```bash +PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -p hypothesis.extra.pytestplugin -q scripts/test_loop_memory_properties.py +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Are the properties independent, bounded, deterministic, and security-relevant? +- Can every failing case be reproduced from evidence? +- Did the chunk avoid changing the behavior it tests? + +## Stop conditions + +Stop if Hypothesis introduces flaky required CI, cannot be reproducibly pinned, +or exposes a production behavior fix outside this test-only contract. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md new file mode 100644 index 00000000..97cdbd82 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md @@ -0,0 +1,116 @@ +# Chunk Contract: WS-ENG-008-05 — Authorization Property Invariants + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Add bounded property tests for deny-default authorization, action custody, +resource scope, lifecycle state, and grant invariants after active AUTH work is canonical. + +## Why this chunk exists + +Authorization has extensive examples, but generated combinations can prove +closed behavior across unknown actions, actors, scopes, and lifecycle states. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P2 + +## Start phase + +`implementation` + +## Allowed files + +```text +backend/pyproject.toml +backend/tests/test_authorization_properties.py +.github/workflows/backend.yml +scripts/assurance-requirements.txt +docs/operations_authorization_service.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-external-review-response.md +.agent-loop/merge-intents/WS-ENG-008-05.json +``` + +## Not allowed + +```text +authorization application code, catalogue, kernel, schemas, routes, grants, audit, migration, or activation changes +changes before AUTH-10C and any intervening AUTH work are merged/stopped and rediscovered +database/network dependence for pure properties +coverage, test, auth-denial, review, or human gate weakening +``` + +## Acceptance criteria + +- [ ] Start evidence is based on main containing the canonical outcome of + AUTH-10C and discovery records exact current action/catalogue ownership. +- [ ] Backend installs the exact hash-locked Hypothesis closure from + `scripts/assurance-requirements.txt` with `--require-hashes` and reuses the + bounded profiles established by `WS-ENG-008-04` without a second path. +- [ ] Generated unknown actions/resources/actors deny by default with bounded + non-sensitive errors and no grant/evidence mutation. +- [ ] Project/resource scope cannot cross tenants or projects; revoked, + expired, future, wrong-kind, and lifecycle-ineligible grants never allow. +- [ ] Planned actions remain unreachable until their owning activation chunk; + custody transfer alone cannot enable them. +- [ ] Authorized combinations preserve exact action/resource/actor lineage and + do not imply unrelated permissions. +- [ ] Tests exercise public kernel/service contracts without copying the + implementation's decision expression into the oracle. +- [ ] The focused hosted authorization property command has a hard 120-second + limit and records exact-head elapsed time; timeout is failure. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-06` and requires a + separate explicit start. + +## Verification commands + +```bash +cd backend +python -m pytest -q tests/test_authorization_properties.py +ruff check tests/test_authorization_properties.py +cd .. +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Are the properties aligned with the post-AUTH-10C canonical contract? +- Do the oracles remain independent of the implementation? +- Does any test accidentally activate or redefine an AUTH action? + +## Stop conditions + +Stop if AUTH remains active/unmerged, tests require production-code changes, or +the property oracle cannot be independent. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md new file mode 100644 index 00000000..b3b4835f --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md @@ -0,0 +1,122 @@ +# Chunk Contract: WS-ENG-008-06 — Changed-Module Mutation Pilot + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Measure whether tests detect plausible faults in eligible changed pure-logic +modules without immediately imposing an uncalibrated global merge threshold. + +## Why this chunk exists + +Coverage proves execution but not assertion sensitivity. Workstream has no +mutation-testing engine or authenticated mutation evidence. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P2 + +## Start phase + +`implementation` + +## Allowed files + +```text +backend/pyproject.toml +backend/scripts/mutation_policy.py +backend/tests/test_mutation_policy.py +.github/workflows/backend.yml +scripts/assurance-requirements.txt +scripts/test_agent_gates.py +docs/operations_backend_testing.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-external-review-response.md +.agent-loop/merge-intents/WS-ENG-008-06.json +``` + +## Not allowed + +```text +application behavior or production dependency changes +global or blocking mutation percentage +replacement, reduction, or bypass of coverage, semantic lanes, API E2E, or full-suite aggregation +mutation of migrations, generated code, schemas/declarations, adapters, or unowned modules without explicit eligibility +use of stale QUALITY branches as implementation authority +unbounded runtime, silent timeout exclusion, or “one mutant killed” success rule +``` + +## Acceptance criteria + +- [ ] Discovery reconciles current Backend workflow and records which dormant + QUALITY ideas, if any, are recreated rather than cherry-picked as authority. +- [ ] One mutation engine and its complete transitive closure are exactly pinned + and hash-locked in `scripts/assurance-requirements.txt`, installed with + `--require-hashes`, and run only on eligible changed pure-logic modules. +- [ ] Authenticated evidence reports eligible, generated, killed, survived, + timeout, suspicious, excluded, and error counts plus module/test identity. +- [ ] Every survivor and non-killed category requires explicit classification; + missing or malformed evidence fails the pilot job. +- [ ] Pilot is non-blocking only with respect to score; infrastructure errors, + malformed evidence, scope escape, or weakened coverage remain blocking. +- [ ] Existing full suite, API E2E, exact-custody semantic lanes, 78 percent + global floor, and protected 90 percent floors remain exact and authoritative. +- [ ] Mutation execution has a hard 12-minute command limit inside a 15-minute + job limit, records exact-head elapsed time, and runs independently so it + adds no more than two minutes to the existing required Backend critical + path. A later blocking threshold requires a separate reviewed plan and + explicit human decision. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-07` and requires a + separate explicit start. + +## Verification commands + +```bash +cd backend +python -m pytest -q tests/test_mutation_policy.py +ruff check scripts/mutation_policy.py tests/test_mutation_policy.py +cd .. +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Is the pilot genuinely bounded and non-gamable? +- Are coverage and full-suite gates unchanged? +- Is all dormant QUALITY work treated only as discovery input? + +## Stop conditions + +Stop if the engine cannot be pinned, hosted runtime is unbounded, evidence is +not complete, or any existing required test/coverage lane must weaken. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md new file mode 100644 index 00000000..dd9232df --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md @@ -0,0 +1,134 @@ +# Chunk Contract: WS-ENG-008-07 — Lossless Review Memory Index + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Replace the growing root review narrative with a compact index while preserving +every historical byte, link, and initiative-owned detailed evidence. + +## Why this chunk exists + +The 147 KB root log is expensive for agents to load and duplicates detailed +initiative review files, but it remains widely referenced durable memory. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P2 + +## Start phase + +`implementation` + +Execution remains blocked until this planning intake is merged, chunks 01–06 +are completed in order, and the explicit post-merge signed start selects this +exact contract from current trusted `main`. + +## Allowed files + +```text +.agent-loop/README.md +.agent-loop/REVIEW_LOG.md +.agent-loop/review-log-archive/** +.agent-loop/policies/repository-engineering-policy.md +scripts/check_review_log_archive.py +scripts/test_check_review_log_archive.py +scripts/check_loop_memory_state.py +scripts/check_stale_artifact_contracts.py +scripts/check_markdown_links.py +scripts/check_stale_workstream_wording.py +scripts/test_agent_gates.py +AGENTS.md +CONTRIBUTING.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-external-review-response.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-pre-migration-reconciliation.json +.agent-loop/merge-intents/WS-ENG-008-07.json +``` + +## Not allowed + +```text +deletion, paraphrase, deduplication, reorder, or silent correction of historical review entries +generated automation-branch schema or signed-state changes +application, API, database, product lifecycle, workflow permission, test, or coverage weakening +migration while another reviewed/open PR still writes root REVIEW_LOG.md without exact reconciliation +automatic successor declaration +``` + +## Acceptance criteria + +- [ ] Discovery re-fetches all open PRs and current main immediately before the + migration; every root-log delta is reconciled or the chunk stops. A + durable pre-migration JSON snapshot records the fetch timestamp, exact + main SHA, every open PR number and head SHA, root-log SHA-256 digest, and + explicit reconciliation result. +- [ ] Versioned archive files preserve the complete pre-migration root narrative + byte-for-byte in one documented concatenation order with stored SHA-256 + digests and deterministic reconstruction. +- [ ] Root `REVIEW_LOG.md` becomes a bounded index linking archive periods, + initiative review directories, current conventions, and reconstruction + proof. Its complete UTF-8 encoding, including every newline byte, is at + most 32,768 bytes. +- [ ] Historical repository links remain valid or receive an explicit lossless + mapping; no initiative evidence file is rewritten merely for relocation. +- [ ] New detailed review evidence remains initiative-owned; root additions are + compact navigation rather than duplicate narrative. +- [ ] Checker rejects missing/extra/reordered bytes, digest mismatch, broken + links, duplicate periods, path traversal, symlink, an index over 32,768 + UTF-8 bytes including newline bytes, or a reconciliation snapshot whose + main/PR heads/root digest do not bind the migrated input. +- [ ] Existing stale-contract and authored-memory checks understand the index + without weakening their semantic rules. +- [ ] Exactly one schema-v2 merge intent declares no successor. + +## Verification commands + +```bash +python3 scripts/test_check_review_log_archive.py +python3 scripts/check_review_log_archive.py +python3 scripts/test_agent_gates.py +python3 scripts/check_loop_memory_state.py +python3 scripts/check_stale_artifact_contracts.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Can the exact old root log be reconstructed without relying on Git history? +- Are current navigation and future ownership clearer and bounded? +- Was every concurrent root-log writer reconciled immediately before merge? + +## Stop conditions + +Stop if any history cannot be preserved byte-for-byte, links cannot be mapped, +or concurrent PRs still carry unresolved root-log changes. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md new file mode 100644 index 00000000..b5b0321d --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md @@ -0,0 +1,113 @@ +# Internal Review Evidence + +## Chunk + +`WS-ENG-008-PLAN` — Repository-Native SDLC Assurance Planning + +This planning review covers the initiative artifacts and reviewed contracts +`WS-ENG-008-01` through `WS-ENG-008-07`. It authorizes no implementation and +leaves both active slots empty. + +## Required Statements + +open sub-agent sessions: none + +valid findings addressed: yes + +## Reviewed Revision + +Reviewed code SHA: 8ce2c1cffd63ba9a8a4867773fe38d7861d2fa69 + +Reviewed at: 2026-07-26T01:29:34Z + +Reviewer run IDs: senior-engineering=`ci02b_lane_runner`; +QA/test=`ci02b_cr_arch`; security/auth=`ci02b_cr_ci`; +product/ops=`ci02b_cr_docs`; architecture=`ci02b_cr_arch`; +CI-integrity=`ci02b_cr_ci`; docs=`ci02b_cr_docs`; +reuse/dedup=`ci02b_cr_reuse`; test-delta=`ci02b_cr_test_delta`. + +After the reviewed SHA, only this evidence and trust bundle changed. + +## Reviewer Results + +| Reviewer | Result | Blocking findings | Notes | +|---|---:|---|---| +| senior engineering | PASS | None | Signed-active-only grandfathering, successor conversion, sequencing, semantic lanes, and budgets are bounded. | +| QA/test | PASS | None | Exact start ratchet, negative path cases, measurable limits, and acceptance criteria pass. | +| security/auth | PASS | None | Event/blob binding, path-byte controls, read-only audit, and AUTH reconciliation are explicit. | +| product/ops | PASS | None | Engineering assurance remains separate from product review and Contributor authority. | +| architecture | PASS | None | ENG-008 cannot exempt successors or post-cutover starts; canonical authority paths remain. | +| CI integrity | PASS | None | Planning changes no CI surface; future locks and budgets preserve blocking gates. | +| docs | PASS | None | Historical discovery and current reconciliation are distinct and consistent. | +| reuse/dedup | PASS | None | Existing validators, evidence gate, risk router, reviewers, aggregation, and initiative reviews are reused. | +| test delta | PASS | None | Planning-only diff changes no test, workflow, threshold, or application file. | + +## Valid Findings Addressed + +- Replaced subjective “materially changed” scope with an exact start cutover: + every post-cutover implementation/specification start requires schema; only + chunks already signed-active at cutover are grandfathered, bound to their + exact start event and contract blob. +- Required chunk 01 to convert and validate ENG-008 contracts 02–07 before it + may name chunk 02, closing the initiative's self-exemption gap. +- Required byte-preserving NUL-delimited Git parsing, strict UTF-8 and NFC, + control-character rejection, normalization/casefold collision rejection, and + adversarial path fixtures. +- Assigned canonical terminology reconciliation to chunk 01 for README, + glossary, and architecture lockdown while retaining zero-trust loop + terminology; this additive planning intake does not edit those files. +- Set 120-second hosted limits for each property suite and a 12-minute command/ + 15-minute job budget plus two-minute critical-path cap for mutation testing. +- Required complete transitive hash locks and `--require-hashes` installation + for assurance tools. +- Removed trailing blank lines and unified the cutover rule across every artifact. +- Replaced broad initiative allowlists with explicit per-chunk contract, status, + internal evidence, trust-bundle, external-response, and specialized proof paths. +- Required duplicate JSON object-key rejection, exact signed discovery + provenance, and a deterministic lossless review-log migration snapshot and + 32,768-byte UTF-8 index ceiling. +- Closed the file-history grandfather bypass: only chunks signed-active at the + exact cutover may finish under an event/identity/path/blob-bound record; + stopped, new, cancelled/restarted, and post-cutover work require schema. +- Reconciled the future mutation contract to current exact-custody semantic + lanes while retaining the earlier shard topology as historical discovery. + +## Concurrent Initiative Reconciliation + +- Historical discovery pinned ART-03, AUTH-10C, and REV-03P exactly. +- Final reconciliation pins current main `a04fd1a0a623b7150ec40c9934a9982f80a2dce7` + and signed-state tip `33edd1a682ea5fe5ea973870f89bdd3a75a63da3`. +- ART is stopped at PLAN2, AUTH is stopped at 11, and REV-03P remains active. +- AUTH property work starts only from the then-current canonical AUTH result. +- CON remains stopped; its unexplained local PDF deletion is not adopted. +- Dormant QUALITY work and stale external PRs remain discovery input only. +- Every implementation boundary repeats exact-main, signed-state, and path-overlap checks. + +## Commands Run + +```bash +python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Results + +- Planning merge intent passed for `WS-ENG-008-PLAN`. +- 100 Agent Gate tests passed. +- Markdown links passed for all 16 changed planning Markdown files. +- Stale wording and exact diff integrity passed. +- The reviewed diff is one additive initiative tree plus one merge intent. + +## Remaining Risks + +- Any concurrent PR may advance `main`; the planning PR must reconcile and rerun + exact evidence before merge if its base changes. +- Tool choice and hosted runtime remain implementation-chunk decisions inside + the reviewed dependency, evidence, and timeout boundaries. +- Planning merge grants no implementation authority. Chunk 01 still requires a + separate signed start after canonical post-merge reconciliation. +- The prior Backend failure belonged to the retired dependency/workflow state. + Exact-head Backend CI must pass again against current main before merge. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md new file mode 100644 index 00000000..5d67b1f0 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md @@ -0,0 +1,158 @@ +# PR Trust Bundle + +## Chunk + +`WS-ENG-008-PLAN` — Repository-Native SDLC Assurance Planning + +Merge intent: `.agent-loop/merge-intents/WS-ENG-008-PLAN.json` + +## Goal + +Establish a reviewed, planning-only initiative for machine-enforced contract +scope, scheduled signed-state auditing, adversarial proof, property testing, +mutation evidence, and lossless review-memory indexing. + +## Human-approved intent + +- Intent: `../INTENT.md` +- Plan: `../PLAN.md` +- Chunk map: `../CHUNK_MAP.md` + +## Signed Start Provenance + +- Signed start run: N/A — first-new-initiative planning intake +- Discovery main SHA: `bcf1292e1a591e3e84bf8ee212ee7191d80741fa` +- Reconciled main SHA: `a04fd1a0a623b7150ec40c9934a9982f80a2dce7` +- Reconciled signed-state tip: `33edd1a682ea5fe5ea973870f89bdd3a75a63da3` +- Phase: planning intake; no active planning or implementation chunk +- Contract paths: `../chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md`, + `../chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md`, + `../chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md`, + `../chunks/WS-ENG-008-04-loop-memory-property-invariants.md`, + `../chunks/WS-ENG-008-05-authorization-property-invariants.md`, + `../chunks/WS-ENG-008-06-changed-module-mutation-pilot.md`, and + `../chunks/WS-ENG-008-07-lossless-review-memory-index.md` +- Signed contract blob SHA: N/A until post-merge explicit start selects chunk 01 +- Reviewed planning SHA: `8ce2c1cffd63ba9a8a4867773fe38d7861d2fa69` + +Only independently verified signed automation state is canonical authority. +Planning intake records stopped state and cannot authorize implementation. + +## What changed + +- Added the seven canonical initiative root planning files. +- Added seven sequential L1 implementation contracts. +- Added one schema-v2 PLAN merge intent naming only chunk 01. +- Added the exact required internal review evidence and this trust bundle. + +## Why it changed + +Workstream's loop is healthy, but ordinary scope remains prose-reviewed, signed +state lacks independent scheduled drift detection, and deeper proof mechanisms +need bounded repository-native ownership. + +## Design chosen + +One assurance mechanism per PR, ordered by dependency. Contract enforcement +comes first and must upgrade all later ENG-008 contracts. Scheduled audit is +read-only. Adversarial proof uses existing reviewers. Property and mutation +testing are bounded and reproducible. Review memory is archived losslessly last. + +## Alternatives rejected + +- Immediate global mutation threshold: no calibrated evidence. +- Universal tenth reviewer: duplicates current track ownership. +- Scheduled repair: creates a second state writer. +- Destructive review-log truncation: loses durable evidence. +- Reusing dormant work as authority: violates signed start custody. + +## Scope control + +The PR adds only one new initiative directory and one PLAN merge intent. It +changes no existing file, workflow, application, test, dependency, permission, +coverage threshold, generated state, or product behavior. + +## Product Behavior + +- [x] No Workstream product behavior changed. + +## Acceptance criteria proof + +- [x] Complete intent, discovery, plan, chunk map, status, risks, and decisions. +- [x] Seven bounded contracts with allowed files, prohibitions, measurable proof, + all required reviewers, human focus, and stop conditions. +- [x] Historical and current ART/AUTH/REV/CON/QUALITY state reconciled without + borrowing initiative authority. +- [x] Objective scope cutover and successor conversion close self-exemption. +- [x] One merge intent names same-initiative chunk 01 with explicit start true. +- [x] Status claims no active planning or implementation chunk. + +## Tests/checks run + +```bash +python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +Result: all passed; 100 Agent Gate tests and 16 planning Markdown link checks. + +## Test delta + +- No tests, workflows, coverage settings, or application files changed. +- The planning contracts specify future tests but implement none. + +## CI integrity + +- [x] Coverage thresholds unchanged +- [x] Lint/typecheck/test commands unchanged +- [x] No workflow or package-script weakening +- [x] No dependency added +- [x] No unpinned GitHub Action +- [x] Planning intake remains additive and stopped + +## Reviewer results + +Reviewed planning SHA: `8ce2c1cffd63ba9a8a4867773fe38d7861d2fa69` + +Reviewer run IDs: `ci02b_lane_runner`, `ci02b_cr_arch`, `ci02b_cr_ci`, +`ci02b_cr_docs`, `ci02b_cr_reuse`, and `ci02b_cr_test_delta`. + +All nine tracks pass after the bounded internal and external repair cycles. See +`WS-ENG-008-PLAN-internal-review-evidence.md`. + +## External review + +| Source | Status | Notes | +|---|---:|---| +| CodeRabbit | Prior comments resolved; rerun pending | Nine comments were verified and repaired; the reconciled final head still needs its follow-up audit. | +| GitHub Agent Gates | Prior head passed | Must pass again on the exact reconciled PR head. | +| GitHub Backend | Prior failure superseded | Must pass the current semantic-lane workflow on the exact reconciled PR head. | + +## Remaining risks + +- Concurrent active PRs may advance main and require rebase/re-review evidence. +- Implementation tool choices remain bounded decisions in their owning chunks. +- Human approval of this PR establishes planning only, never a signed start. + +## Follow-up work + +After merge and successful Automated Merge Memory, stop. Chunk 01 begins only +after an explicit user instruction and successful signed start on exact main. + +## Human review focus + +- Is contract enforcement first and does it govern contracts 02–07? +- Is scheduled verification structurally read-only? +- Are property/mutation budgets objective and non-weakening? +- Are concurrent initiatives preserved without borrowing their authority? + +## Human merge ownership + +- [ ] I can explain what changed. +- [ ] I can explain why it changed. +- [ ] I know what could break. +- [ ] I accept the remaining risks. +- [ ] The user explicitly approved this specific PR for merge. diff --git a/.agent-loop/merge-intents/WS-ENG-008-PLAN.json b/.agent-loop/merge-intents/WS-ENG-008-PLAN.json new file mode 100644 index 00000000..0ffe1d01 --- /dev/null +++ b/.agent-loop/merge-intents/WS-ENG-008-PLAN.json @@ -0,0 +1,9 @@ +{ + "schema_version": 2, + "initiative_id": "WS-ENG-008", + "chunk_id": "WS-ENG-008-PLAN", + "chunk_title": "Repository-Native SDLC Assurance Planning", + "next_chunk_id": "WS-ENG-008-01", + "next_chunk_title": "Machine-Checkable Chunk Scope", + "next_requires_explicit_start": true +}