From 1e7dd3f74a3fe57fa91b3f53f6f27862b4083561 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Fri, 24 Jul 2026 13:38:38 +0100 Subject: [PATCH 01/10] docs(agent-loop): plan repository-native SDLC assurance --- .../CHUNK_MAP.md | 16 +++ .../DECISIONS.md | 41 ++++++ .../DISCOVERY.md | 105 ++++++++++++++ .../INTENT.md | 107 +++++++++++++++ .../PLAN.md | 128 ++++++++++++++++++ .../RISKS.md | 17 +++ .../STATUS.md | 12 ++ ...NG-008-01-machine-checkable-chunk-scope.md | 125 +++++++++++++++++ ...8-02-scheduled-signed-state-drift-audit.md | 110 +++++++++++++++ ...NG-008-03-risk-routed-adversarial-proof.md | 115 ++++++++++++++++ ...-008-04-loop-memory-property-invariants.md | 106 +++++++++++++++ ...08-05-authorization-property-invariants.md | 108 +++++++++++++++ ...NG-008-06-changed-module-mutation-pilot.md | 113 ++++++++++++++++ ...ENG-008-07-lossless-review-memory-index.md | 116 ++++++++++++++++ .../merge-intents/WS-ENG-008-PLAN.json | 9 ++ 15 files changed, 1228 insertions(+) create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md create mode 100644 .agent-loop/merge-intents/WS-ENG-008-PLAN.json diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md new file mode 100644 index 00000000..1f5abbb5 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md @@ -0,0 +1,16 @@ +# Chunk Map: WS-ENG-008 — Repository-Native SDLC Assurance + +| Order | Chunk | Purpose | Risk | Dependency | State | +|---:|---|---|---:|---|---| +| 1 | `WS-ENG-008-01` | Enforce versioned machine-checkable chunk scope | L1 | Planning merge and signed start | Proposed | +| 2 | `WS-ENG-008-02` | Add read-only scheduled signed-state drift audit | L1 | 01 | Proposed | +| 3 | `WS-ENG-008-03` | Add risk-routed adversarial proof records | L1 | 01 | Proposed | +| 4 | `WS-ENG-008-04` | Add bounded loop-memory property invariants | L1 | 01–03 | Proposed | +| 5 | `WS-ENG-008-05` | Add bounded authorization property invariants | L1 | 04 and canonical AUTH reconciliation | Proposed | +| 6 | `WS-ENG-008-06` | Run a non-blocking changed-module mutation pilot | L1 | 01, 04–05, canonical CI/QUALITY reconciliation | Proposed | +| 7 | `WS-ENG-008-07` | Migrate root review history to a lossless indexed archive | L1 | Active root-log writers reconciled | Proposed | + +Only `WS-ENG-008-01` is named by the planning merge intent. Every later chunk +must be named by its predecessor's reviewed merge intent and receive a separate +signed start. No chunk starts automatically. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md new file mode 100644 index 00000000..2075f17f --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md @@ -0,0 +1,41 @@ +# Decisions: WS-ENG-008 — Repository-Native SDLC Assurance + +## D1 — Preserve the zero-trust loop as the enforcement mechanism + +“Repository-Native Human-Agent SDLC” names the broader development model. The +Codex-native zero-trust engineering loop remains its enforcement mechanism and +is not renamed away. + +## D2 — Enforce future contracts without guessing historical intent + +Machine scope applies to new or materially changed implementation/specification +contracts. Unchanged historical contracts remain governed by their reviewed +evidence and existing gates. + +## D3 — Keep scheduled drift verification read-only + +The scheduled job can detect and report but cannot sign, repair, push, dispatch, +approve, or merge. + +## D4 — Route adversarial proof instead of adding a universal reviewer + +Risk routing assigns explicit adversarial proof to high-risk work using existing +review ownership. Evidence records attempts and outcomes, not an empty file. + +## D5 — Measure mutation quality before setting a threshold + +The pilot is non-blocking and cannot reduce existing coverage gates. A blocking +mutation policy requires a later reviewed human decision based on hosted data. + +## D6 — Reconcile concurrent initiatives at every boundary + +Planning uses current signed state, but each implementation start, review, +publication, and merge repeats current-main and overlap checks. AUTH property +work and root-log archival have explicit concurrency waits. + +## D7 — Archive review memory losslessly + +Root review memory becomes an index only after byte-preserving archives and +link/reconstruction proof exist. Initiative review directories remain detailed +evidence. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md new file mode 100644 index 00000000..6b0e5686 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md @@ -0,0 +1,105 @@ +# Discovery: WS-ENG-008 — Repository-Native SDLC Assurance + +Discovery was performed read-only against trusted `main` +`bcf1292e1a591e3e84bf8ee212ee7191d80741fa` and signed +`automation/loop-memory` on 2026-07-24. + +## Current behavior + +- `scripts/check_internal_review_evidence.py` discovers changed files, resolves + required reviewer tracks, binds reviewed SHA provenance, and restricts + post-review changes. It does not parse or enforce contract path scope. +- `.agent-loop/templates/CHUNK_CONTRACT.md` requires human-readable allowed and + forbidden sections without a machine-readable schema. +- Some historical chunks use one-off shell regexes or reviewed-scope manifests; + there is no reusable canonical implementation. +- `.github/workflows/agent-gates.yml` runs evidence, merge-intent, Markdown, + stale-contract, and regression gates. No workflow uses `schedule`. +- `scripts/update_post_merge_memory.py` and + `scripts/check_loop_memory_state.py` already verify signed-state semantics and + closed-tree integrity during merge/start workflows. +- `.codex/agents/` contains senior, QA, security, product/ops, architecture, CI, + docs, reuse, and test-delta reviewers. No explicit adversarial proof contract + exists. +- `scripts/agent-gate-requirements.txt` and `backend/pyproject.toml` contain no + Hypothesis or mutation-testing dependency. +- Backend CI fans out four isolated shards, recombines exact artifacts, and + blocks at 78 percent global coverage plus multiple 90 percent protected + subsystem floors. +- `.agent-loop/REVIEW_LOG.md` is 147,017 bytes and 2,846 lines. Detailed review + evidence also lives under initiative `reviews/` directories. + +## Relevant files and modules + +| Area | Existing surfaces | Gap | +|---|---|---| +| Contract enforcement | `.agent-loop/templates/CHUNK_CONTRACT.md`, `scripts/check_internal_review_evidence.py`, `scripts/test_agent_gates.py` | No universal typed path delta enforcement. | +| Signed memory | `scripts/update_post_merge_memory.py`, `scripts/check_loop_memory_state.py`, `.github/workflows/loop-memory*.yml` | No independent read-only schedule. | +| Reviewer routing | `.agent-loop/policies/routing-policy.md`, `.codex/agents/*.toml`, `.agents/skills/risk-router/` | Adversarial attempts are implicit rather than stable evidence. | +| Property tests | Loop-memory tests and authorization tests | Extensive adversarial examples, no generated invariant exploration. | +| Mutation testing | Backend coverage workflow and coverage policy | Coverage measures execution, not fault sensitivity. | +| Review memory | Root `REVIEW_LOG.md`, initiative review directories | Root narrative grows linearly and duplicates detail. | + +## Concurrent initiative reconciliation + +| Initiative | Signed state at discovery | Concurrent repository state | ENG-008 rule | +|---|---|---|---| +| `WS-ART-001` | `WS-ART-001-03` active | Dedicated clean worktree; no PR yet | Do not touch ART application or artifact-custody surfaces. Reconcile before every ENG-008 PR. | +| `WS-AUTH-001` | `WS-AUTH-001-10C` active | PR #194 open; local repairs differ from its published head and Backend CI is failing | AUTH property chunk waits for AUTH to merge or stop, then rebases on its canonical result. | +| `WS-REV-001` | `WS-REV-001-03P` active | PR #195 open and green at discovery | Avoid project/review runtime files and reconcile its merge before later test work. | +| `WS-CON-001` | stopped at `02A`, next `02B` | Worktree has an unexplained local PDF deletion | No adoption or modification; deletion remains outside ENG-008. | +| `WS-QUAL-001` | absent from signed state | Two stale local worktrees; no current authority | Treat all QUALITY commits as discovery input only; mutation work starts from current main under ENG-008. | +| External PRs #62, #138, #149 | no active signed initiative authority | stale, conflicting, or missing current gates | Never merge as ENG-008 authority; inspect only as preserved proposals when relevant. | + +## Existing tests and gaps + +- Agent Gate tests strongly cover merge intent, evidence, workflow pinning, + coverage floors, signed state, and planning intake. +- Loop-memory tests already contain mutation matrices and replay/collision + cases, but generated state-space invariants are not property-tested. +- Authorization tests cover deny-default and action ownership through examples; + generated unknown/cross-resource/lifecycle combinations are not centralized. +- No test currently proves that every ordinary PR path is permitted by the + signed contract's machine-readable scope. +- No scheduled proof detects later automation-branch tampering between events. +- Coverage evidence cannot show whether assertions kill plausible behavioral + faults. + +## Dependencies and integrations + +- PyYAML is pinned for Agent Gates, but JSON is preferable for the first scope + schema because it avoids YAML coercion and duplicate-key ambiguity. +- Hypothesis would be a new test dependency in Agent Gates and later Backend. +- A mutation engine would be a new development/CI dependency and needs a hashed + or otherwise reproducible installation path. +- GitHub Actions scheduling runs workflow code from the default branch; the + drift job must use read-only `contents` and `actions` permissions. + +## Risks discovered + +| Risk | Impact | Required treatment | +|---|---|---| +| Glob semantics differ across platforms | Scope bypass or false rejection | Define one closed repository-relative grammar and test traversal, symlink, rename, and case behavior. | +| Legacy contracts lack schemas | Immediate repository-wide failure | Forward ratchet new/materially changed contracts; never infer old scope. | +| Scheduled audit becomes a repair path | Unreviewed signed-state mutation | Read-only permissions, no signing key, no publication command, regression-test workflow semantics. | +| Property suites are nondeterministic | Flaky required CI | Fixed profiles, stored counterexample text in evidence, bounded examples/deadlines, rerunnable seeds. | +| Mutation score is gamed | False assurance | Report eligible/killed/survived/timeout/excluded counts and classify survivors; do not use “kill one mutant.” | +| Review archive breaks references | Loss of durable evidence | Lossless byte-preserving archive, link map, root index, and stale-link tests. | +| Active PR advances main | Stale proof or merge conflict | Rebase/reconcile and rerun exact proof before each PR; signed contracts remain immutable. | + +## Unknowns requiring later measured evidence + +- Eligible module and runtime budget for the mutation pilot. +- Stable Hypothesis example/deadline profile under hosted runners. +- Archive period boundaries that produce useful index sizes without churn. +- Whether scheduled drift should alert through GitHub only or a later external + operations channel; this initiative adds no external notification secret. + +## Existing conventions to preserve + +- One signed active chunk per initiative; distinct initiatives may run concurrently. +- One PR and one schema-v2 merge intent per chunk. +- Exact-current-main signed starts and human-owned specific-PR merge approval. +- Internal reviewer completion before publication; external checks supplement it. +- Automated Merge Memory owns the generated branch and never starts successors. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md new file mode 100644 index 00000000..8abca78d --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md @@ -0,0 +1,107 @@ +# Intent: WS-ENG-008 — Repository-Native SDLC Assurance + +## Problem being solved + +Workstream's repository-native human-agent engineering loop now binds intent, +signed starts, evidence, review, merge decisions, and generated memory. Its +remaining assurance gaps are that most chunk scope is still interpreted from +prose, signed-state integrity is checked only on merge/start rather than on an +independent schedule, adversarial proof is implicit across reviewer tracks, +invariant tests are predominantly example-based, mutation quality is not +measured, and the root review log has grown to about 147 KB. + +## Why this work matters + +The loop is trustworthy only if authorization, scope, proof quality, and durable +memory remain independently verifiable as the repository and contributor count +grow. These controls must become stronger without slowing every change with +unbounded tests or creating a second authority path. + +## Current behavior + +- Signed starts and generated merge memory are canonical and initiative-local. +- Agent Gates bind merge intent and internal-review evidence to reviewed code. +- Chunk contracts state allowed files and non-goals in Markdown, but there is no + universal machine-enforced path contract for ordinary implementation PRs. +- No scheduled workflow independently audits the signed automation branch. +- Nine internal reviewer tracks exist; adversarial attempts are not represented + by a stable proof schema. +- Neither Hypothesis nor a mutation-testing engine is installed. +- Detailed initiative reviews coexist with a 147,017-byte root `REVIEW_LOG.md`. + +## Target behavior + +- New or materially changed chunk contracts carry a strict versioned scope block + that Agent Gates compare to the exact PR delta. +- A read-only schedule verifies signed-state custody, ancestry, ledger, + projections, active contracts, and closed-tree integrity without repairing. +- High-risk work records attacks attempted, observed denials, findings, and + untested surfaces through risk routing. +- Bounded property tests exercise loop-memory and authorization invariants with + deterministic replay evidence. +- A changed-module mutation pilot measures meaningful survivors before any + carefully calibrated blocking policy is proposed. +- Root review memory becomes a compact index with lossless archives and + initiative-owned detailed evidence. + +## Design chosen + +Deliver one assurance mechanism per reviewed chunk. Ratchet new enforcement +forward without retroactively rewriting hundreds of historical contracts. +Reuse the current signed-state verifier, internal evidence gate, risk router, +reviewer files, Backend aggregation, and initiative review directories. + +## Alternatives considered + +- A global mutation gate immediately was rejected because runtime, exclusions, + and baseline quality are not yet measured. +- A universal tenth reviewer was rejected because it would duplicate existing + security, QA, architecture, and test-delta tracks; adversarial proof will be + risk-routed instead. +- One scheduled job covering all runtime architecture was rejected because + signed-memory custody and subsystem runtime reachability have different + owners and failure semantics. +- Truncating `REVIEW_LOG.md` was rejected because review history must remain + lossless and linkable. + +## Boundaries preserved + +- Existing signed starts, start authority, cancellation approval, human merge + ownership, merge intent, coverage floors, and automated merge memory remain. +- ART, AUTH, and REV keep their current initiative-local signed authority. +- Existing patches and dormant QUALITY work are discovery input only. +- Scheduled verification is read-only and receives no signing secret or write + permission. +- Property and mutation testing do not change product behavior. + +## Expected risks + +- A scope schema could reject valid changes or permit path-pattern ambiguity. +- Scheduled auditing could produce noisy failures or accidentally gain write + authority. +- Property and mutation suites could destabilize or lengthen CI. +- Adversarial review could become duplicative checkbox evidence. +- Review-log migration could break historical links or collide with active PRs. + +## What must not change + +- No bypass for humans, agents, forks, administrators, existing patches, drafts, + or emergency work. +- No automatic start, merge, state repair, or review approval. +- No weakening of the 78 percent global or protected 90 percent coverage floors. +- No application behavior, product authorization, payment, or artifact-custody + change may be hidden inside this engineering initiative. + +## How this will be proven + +Each chunk has adversarial fixtures, exact allowed paths, required reviewers, +bounded runtime expectations, and a null or same-initiative successor. Hosted +CI remains authoritative. Concurrent active initiatives are reconciled against +exact current `main` before implementation, review, publication, and merge. + +## Human decisions required + +- Approve each implementation chunk's exact scope and PR independently. +- Decide after the mutation pilot whether any score becomes blocking. +- Approve the lossless review-log archive layout before migration. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md new file mode 100644 index 00000000..1de8dc85 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md @@ -0,0 +1,128 @@ +# Plan: WS-ENG-008 — Repository-Native SDLC Assurance + +## Proposed approach + +Strengthen the existing loop in dependency order: enforce the contract that +authorizes a diff, independently audit signed memory, formalize adversarial +proof, deepen invariant testing, measure mutation sensitivity, then compact +durable review navigation. Each mechanism lands independently and stops. + +## Design chosen + +### Forward-ratcheted contract scope + +New or materially changed implementation/specification contracts gain one +strict fenced JSON block. A dedicated parser validates exact keys, canonical +repository-relative patterns, reviewer names, and verification commands. Agent +Gates compare the PR's status-aware diff to this block and fail closed on +unmatched, forbidden, renamed, symlinked, submodule, or ambiguous paths. +Historical unchanged contracts are not guessed or rewritten. + +### Read-only drift audit + +A scheduled workflow checks out trusted `main`, fetches +`automation/loop-memory`, runs existing cryptographic and independent semantic +validators, checks main ancestry and active contract bindings, and publishes no +state. It has no signing secret and no write permission. Failure is diagnostic; +recovery remains the existing explicit process. + +### Risk-routed adversarial proof + +High-risk chunks record attack objective, boundary, method, expected denial, +observed evidence, findings, and untested surfaces. Existing reviewers own the +result through routing; no duplicative universal reviewer or empty findings +file is introduced. + +### Bounded property and mutation evidence + +Hypothesis is introduced first for pure loop reducers and validators, then for +authorization decision invariants after active AUTH work lands. Profiles are +deterministic and bounded. Mutation testing begins as a changed-module pilot +that reports complete classifications; it cannot weaken coverage or become a +blocking percentage until measured evidence supports a later human decision. + +### Lossless review index + +Root review history is copied byte-for-byte into versioned archives with a +linkable index. Initiative review directories remain detailed truth. No record +is deleted; future root entries become compact navigation only. + +## Alternatives rejected + +- Prose-only scope review: insufficiently deterministic. +- Automatic contract generation from the diff: retroactive authorization. +- Scheduled repair: creates a second write/authority path. +- One broad property suite required for every chunk: unbounded runtime and poor ownership. +- Immediate mutation threshold: no calibrated baseline. +- Empty adversarial findings file: proves no attempted attack. +- Destructive review-log rotation: breaks durable memory. + +## Boundaries preserved + +- No product, API, data, authorization grant, payment, artifact, or review + lifecycle behavior changes. +- No start/cancel authority, signing key, branch protection, secret, or human + merge policy changes. +- Existing CI and coverage floors may only be preserved or strengthened after + measured human approval. +- Active ART/AUTH/REV initiatives retain their scope and merge independently. + +## Risk routing + +| Chunk | Risk | SLA | Work type | Required reviewers | Human gate | +|---|---:|---:|---|---|---| +| `WS-ENG-008-01` | L1 | P1 | policy/CI | all nine tracks | Explicit PR merge approval | +| `WS-ENG-008-02` | L1 | P1 | workflow/security/operations | all nine tracks | Explicit PR merge approval | +| `WS-ENG-008-03` | L1 | P1 | policy/review evidence | all nine tracks | Explicit PR merge approval | +| `WS-ENG-008-04` | L1 | P2 | loop-security tests/dependency | all nine tracks | Explicit PR merge approval | +| `WS-ENG-008-05` | L1 | P2 | authorization tests/dependency | all nine tracks | Explicit PR merge approval after AUTH reconciliation | +| `WS-ENG-008-06` | L1 | P2 | CI/test dependency pilot | all nine tracks | Explicit PR merge approval and later separate threshold decision | +| `WS-ENG-008-07` | L1 | P2 | durable-memory migration/docs | all nine tracks | Explicit PR merge approval after concurrent log writers reconcile | + +Budget posture is careful for every chunk: bounded implementation, deterministic +proof before reviewer fanout, and no automatic successor. + +## Dependency and reconciliation order + +1. Contract enforcement lands before other assurance work. +2. Drift audit reuses canonical contract parsing and current signed validators. +3. Adversarial proof routing reuses contract reviewer metadata. +4. Loop property tests precede the broader authorization suite. +5. Authorization property work waits for AUTH-10C and any intervening AUTH merge. +6. Mutation pilot inspects dormant QUALITY patches only as discovery and starts + from the then-current canonical Backend workflow. +7. Review-log migration waits until active initiatives no longer carry root-log + changes, then preserves every newly merged entry. + +Before each chunk starts, the orchestrator fetches exact `main` and signed state, +checks the target initiative idle, audits concurrent PR path overlap, dispatches +the signed event, verifies its projection, and creates a fresh branch from that +main. Before publication and merge, it repeats base-delta reconciliation and +all contract proof. + +## Verification strategy + +- Parser and mutation matrices for schemas, paths, diff statuses, and reviewer sets. +- Workflow semantic tests for read-only permissions and absence of repair/signing paths. +- Independent signed-state fixture audits and scheduled-run dry runs. +- Deterministic Hypothesis profiles with replayable failing examples. +- Mutation pilot artifact integrity and survivor-classification tests. +- Byte/digest/link equality for review-log archives. +- Existing Agent Gates, Backend full CI, coverage floors, Markdown links, stale + wording, internal evidence gate, CodeRabbit, and human review remain required. + +## Rollout and rollback + +Each merge is forward-only and independently useful. If a new gate is too noisy, +repair it through a new reviewed chunk; do not disable or bypass it. Scheduled +audit failures never mutate state. Mutation evidence remains non-blocking during +the pilot. Archive migration preserves the original bytes, enabling audited +reconstruction without git history dependence. + +## Review strategy + +All seven chunks are L1 repository-assurance changes and receive senior, QA, +security, product/ops, architecture, CI integrity, docs, reuse, and test-delta +review. Each reviewer receives exact base, implementation SHA, signed start, +contract blob, concurrent-PR overlap report, and deterministic evidence. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md new file mode 100644 index 00000000..300b63ab --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md @@ -0,0 +1,17 @@ +# Risks: WS-ENG-008 — Repository-Native SDLC Assurance + +| ID | Risk | Impact | Control | +|---|---|---|---| +| R1 | Scope patterns are ambiguous or bypassable | Unauthorized files enter a chunk | Closed JSON schema, canonical paths, status-aware diff, traversal/symlink/rename/submodule/case mutations. | +| R2 | Forward ratchet breaks historical PRs | Existing maintenance becomes impossible | Enforce only new/materially changed contracts; test unchanged legacy behavior. | +| R3 | Scheduled audit obtains write authority | A diagnostic becomes a second state writer | Read-only permissions, no secret, no publish/recovery command, semantic workflow tests. | +| R4 | Drift audit is stale relative to concurrent merges | False incident or missed state | Resolve exact current main and automation tip at run time; distinguish transient advancement from corruption. | +| R5 | Adversarial evidence becomes checkbox theater | Review cost without assurance | Require attempted attack, expected denial, observed evidence, and untested surfaces. | +| R6 | Property tests become flaky or slow | CI reliability regresses | Deterministic bounded profiles, reproducible examples, measured hosted runtime. | +| R7 | AUTH property work conflicts with AUTH-10C | Stale or contradictory tests | Wait for canonical AUTH merge/stop, re-discover action/catalogue state, then start. | +| R8 | Mutation score is gamed or too expensive | False confidence or unusable CI | Complete counts, survivor classification, changed eligible modules only, non-blocking pilot. | +| R9 | Dormant QUALITY work is treated as authority | Unsigned stale implementation is published | Preserve as discovery input only; recreate accepted ideas after ENG-008 signed start. | +| R10 | Review-log migration loses or rewrites history | Durable evidence becomes unverifiable | Byte/digest preservation, link map, archives, exact reconstruction tests, no deletion before proof. | +| R11 | Root-log migration conflicts with active PRs | Entries disappear during rebase | Run last and reconcile every active/root-log-writing PR before review and merge. | +| R12 | ENG-008 blocks unrelated active initiatives | Reduced delivery throughput | Initiative-local authority, disjoint early paths, overlap audit before every chunk. | + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md new file mode 100644 index 00000000..97c0f1a2 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md @@ -0,0 +1,12 @@ +# Status: WS-ENG-008 — Repository-Native SDLC Assurance + +- Phase: planning intake review +- Active planning chunk: none +- Active implementation chunk: none +- Proposed planning merge: `WS-ENG-008-PLAN` +- Proposed first implementation chunk: `WS-ENG-008-01` +- Current gate: planning-only artifacts require internal review, exact-head + external checks, and explicit human merge approval +- Concurrent signed initiatives at planning base: ART-03, AUTH-10C, and REV-03P +- Successor after planning: `WS-ENG-008-01`, separate explicit start required + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md new file mode 100644 index 00000000..256b672a --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md @@ -0,0 +1,125 @@ +# Chunk Contract: WS-ENG-008-01 — Machine-Checkable Chunk Scope + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Make the allowed and forbidden path scope of new or materially changed chunks a +versioned, deterministic Agent Gate rather than reviewer-only prose. + +## Why this chunk exists + +Signed starts bind an exact contract, but ordinary PR delta scope is not yet +universally compared to a machine-readable contract block. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P1 + +## Start phase + +`implementation` + +## Allowed files + +```text +CONTRIBUTING.md +AGENTS.md +.agent-loop/templates/CHUNK_CONTRACT.md +.agent-loop/policies/repository-engineering-policy.md +.agent-loop/policies/definition-of-done.md +.github/workflows/agent-gates.yml +scripts/check_chunk_contract.py +scripts/check_internal_review_evidence.py +scripts/test_check_chunk_contract.py +scripts/test_agent_gates.py +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/merge-intents/WS-ENG-008-01.json +``` + +## Not allowed + +```text +application, API, database, migration, product lifecycle, or product authority changes +start/cancel/merge authority, loop-memory schema, signing, branch protection, environment, or secret changes +retroactive inference or mass rewrite of unchanged historical contracts +arbitrary shell execution from contract content +absolute paths, traversal, negation, brace expansion, platform-dependent glob behavior, symlink, or submodule acceptance +coverage, test, evidence, reviewer, PR, or human merge gate weakening +``` + +## Acceptance criteria + +- [ ] One strict versioned JSON block has exact typed keys for identity, phase, + risk, allowed paths, forbidden paths, required reviewers, and verification + command identifiers; duplicate blocks, duplicate keys/items, unknown keys, + malformed Unicode, noncanonical separators, and oversized input fail. +- [ ] The block identity and phase match the canonical heading and signed-start + contract selection; human-readable scope remains required and cannot + contradict the machine block. +- [ ] A closed repository-relative pattern grammar has deterministic semantics + for files and recursive directories without arbitrary regex or shell use. +- [ ] Status-aware base-to-head plus staged/dirty/untracked discovery rejects + every added, modified, deleted, renamed, copied, type-changed, symlinked, + executable, gitlink, case-colliding, or foreign path not allowed by the + contract, and rejects every forbidden match even when also allowed. +- [ ] The PR's exact one merge intent, initiative evidence/status, and permitted + post-review evidence paths are represented explicitly rather than hidden + exemptions. +- [ ] New/materially changed contracts require schema v1. Unchanged historical + contracts continue without inferred or retroactive scope. +- [ ] Required reviewer metadata agrees with the internal evidence gate; command + identifiers bind evidence without executing contract-provided text. +- [ ] Agent Gates invoke the checker on the exact PR base/head and fail closed + on unresolved refs, shallow history, ambiguity, or malformed contracts. +- [ ] Positive fixtures and one negative mutation per schema, identity, path, + diff-status, reviewer, command, legacy-ratchet, and workflow drift class pass. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-02` and requires a + separate explicit start. + +## Verification commands + +```bash +python3 scripts/test_check_chunk_contract.py +python3 scripts/test_agent_gates.py +python3 scripts/check_internal_review_evidence.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Can any changed path escape the signed contract through parsing or Git status semantics? +- Does the ratchet avoid guessing historical scope without creating a new bypass? +- Does the workflow execute only repository-owned checker code? + +## Stop conditions + +Stop if deterministic path semantics cannot be closed, historical contracts +must be rewritten, or any current evidence/review/coverage gate must weaken. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md new file mode 100644 index 00000000..a98d45a1 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md @@ -0,0 +1,110 @@ +# Chunk Contract: WS-ENG-008-02 — Scheduled Signed-State Drift Audit + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Independently and periodically verify signed loop-memory custody and semantic +consistency without granting the audit any repair or write capability. + +## Why this chunk exists + +Merge and start workflows validate state during events, but later corruption or +out-of-band drift currently has no scheduled detection path. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P1 + +## Start phase + +`implementation` + +## Allowed files + +```text +.github/workflows/loop-memory-drift-audit.yml +scripts/audit_loop_memory_drift.py +scripts/test_audit_loop_memory_drift.py +scripts/test_agent_gates.py +docs/operations_post_merge_memory.md +.agent-loop/policies/repository-engineering-policy.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/merge-intents/WS-ENG-008-02.json +``` + +## Not allowed + +```text +write permissions, signing keys, state publication, repair, replay, dispatch, approval, or merge behavior +changes to loop-memory reducers, signer, generated schema, start/cancel authority, or branch protection +application or product subsystem reachability checks +external notification credentials +coverage, test, review, or human gate weakening +``` + +## Acceptance criteria + +- [ ] Scheduled and manually dispatchable workflow runs only trusted default- + branch code with read-only contents/actions permissions and pinned actions. +- [ ] The job receives no signing secret, persists no credentials, and contains + no push, dispatch, replay, publish, apply-event, sign-state, or repair path. +- [ ] Audit verifies signature, manifest digests, exact closed tree, independent + semantic state, ledger chain, projections, current-main ancestry, and + active contract path/blob/heading/phase binding. +- [ ] Main or automation advancement during the audit is reported distinctly + from cryptographic or semantic corruption; no partial result is success. +- [ ] Missing branch, invalid key, shallow history, symlink/gitlink, extra file, + ledger collision, stale projection, duplicate active chunk, and broken + contract reference fail closed in fixtures. +- [ ] Workflow and script have bounded timeouts/output and produce diagnostic + artifacts containing no secret or mutable authority. +- [ ] Existing merge/start validation and recovery instructions remain canonical. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-03` and requires a + separate explicit start. + +## Verification commands + +```bash +python3 scripts/test_audit_loop_memory_drift.py +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Is the audit structurally incapable of writing or repairing state? +- Are advancement races distinguished from corruption without accepting either blindly? +- Does it reuse, rather than fork, canonical signature and semantic validation? + +## Stop conditions + +Stop if the audit needs a write token, signing secret, generated-state edit, or +new recovery path. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md new file mode 100644 index 00000000..c2b19e20 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md @@ -0,0 +1,115 @@ +# Chunk Contract: WS-ENG-008-03 — Risk-Routed Adversarial Proof + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Require explicit, reviewable bypass attempts and outcomes for high-risk chunks +without adding a duplicative universal reviewer. + +## Why this chunk exists + +Existing reviewers assess adversarial concerns, but the attempts, expected +denials, observed evidence, and untested surfaces are not represented uniformly. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P1 + +## Start phase + +`implementation` + +## Allowed files + +```text +.agents/skills/risk-router/SKILL.md +.agents/skills/security-review/SKILL.md +.agents/skills/qa-review/SKILL.md +.agents/skills/evidence-gate/SKILL.md +.agent-loop/templates/CHUNK_CONTRACT.md +.agent-loop/templates/PR_TRUST_BUNDLE.md +.agent-loop/templates/ADVERSARIAL_PROOF.md +.agent-loop/policies/routing-policy.md +.github/pull_request_template.md +scripts/check_internal_review_evidence.py +scripts/test_agent_gates.py +CONTRIBUTING.md +AGENTS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/merge-intents/WS-ENG-008-03.json +``` + +## Not allowed + +```text +new merge/start/cancel authority or automatic approval +replacement or weakening of any existing reviewer track +empty findings file as proof +runtime penetration, production credentials/data, destructive attack, or external target activity +application, API, database, product lifecycle, or coverage changes +``` + +## Acceptance criteria + +- [ ] Risk router deterministically requires adversarial proof for L0/L1 auth, + payment, audit/ledger, migration/schema, CI/workflow, signed-loop, + artifact-custody, data-ownership, secret, and tool-input surfaces. +- [ ] Evidence schema requires attack objective, boundary, safe method, expected + denial, observed result, proof reference, finding disposition, and untested + surfaces; an empty or claim-only file fails. +- [ ] Existing reviewer tracks own the proof and cannot all mark the relevant + security/QA/architecture concern unrelated. +- [ ] Internal evidence and trust templates link the exact adversarial proof for + routed chunks and preserve reviewed-SHA/post-review rules. +- [ ] Safe local fixture attempts never target production or require credentials. +- [ ] Positive and negative fixtures cover missing attempts, fabricated output, + unresolved findings, destructive methods, wrong chunk/SHA, and unrouted work. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-04` and requires a + separate explicit start. + +## Verification commands + +```bash +python3 scripts/test_agent_gates.py +python3 scripts/check_internal_review_evidence.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Does the proof show attempted denials rather than an empty compliance claim? +- Is routing bounded enough to avoid duplicating every reviewer on low-risk work? +- Are destructive and external attacks prohibited? + +## Stop conditions + +Stop if adversarial proof requires production access, destructive tests, a new +authority role, or removal of an existing reviewer. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md new file mode 100644 index 00000000..be6ddc54 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md @@ -0,0 +1,106 @@ +# Chunk Contract: WS-ENG-008-04 — Loop-Memory Property Invariants + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Use bounded, reproducible property-based tests to explore signed loop-memory +invariants beyond hand-selected examples. + +## Why this chunk exists + +The reducer and validators have strong example/mutation coverage, but generated +event sequences can expose state interactions not anticipated in fixtures. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P2 + +## Start phase + +`implementation` + +## Allowed files + +```text +scripts/agent-gate-requirements.txt +scripts/test_loop_memory_properties.py +scripts/test_agent_gates.py +.github/workflows/agent-gates.yml +docs/operations_post_merge_memory.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/merge-intents/WS-ENG-008-04.json +``` + +## Not allowed + +```text +loop-memory reducer, signer, schema, authority, workflow write behavior, or recovery changes +auth/application/product behavior +unbounded examples, nondeterministic network/time dependence, or hidden flaky retry +coverage, test, review, or human gate weakening +``` + +## Acceptance criteria + +- [ ] Hypothesis is exactly pinned with reproducible dependency evidence. +- [ ] A bounded CI profile and a documented deeper local profile have explicit + examples, deadlines, health checks, and failure reproduction instructions. +- [ ] Generated event sequences prove at most one active chunk per initiative, + concurrent independence, completed identity non-restart, cross-initiative + denial, stale-main/tip denial, idempotent replay, and projection/ledger + agreement. +- [ ] Invalid paths, phases, identities, permissions, blob bindings, collisions, + and malformed scalar types fail closed without partial state mutation. +- [ ] Properties reuse real reducers/validators and compare independent + invariants; they do not reimplement expected behavior identically. +- [ ] Hosted runtime is measured and remains inside the chunk's approved budget. +- [ ] Existing deterministic regression and coverage suites remain unchanged. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-05` and requires a + separate explicit start. + +## Verification commands + +```bash +PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -p hypothesis.extra.pytestplugin -q scripts/test_loop_memory_properties.py +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Are the properties independent, bounded, deterministic, and security-relevant? +- Can every failing case be reproduced from evidence? +- Did the chunk avoid changing the behavior it tests? + +## Stop conditions + +Stop if Hypothesis introduces flaky required CI, cannot be reproducibly pinned, +or exposes a production behavior fix outside this test-only contract. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md new file mode 100644 index 00000000..6998209b --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md @@ -0,0 +1,108 @@ +# Chunk Contract: WS-ENG-008-05 — Authorization Property Invariants + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Add bounded property tests for deny-default authorization, action custody, +resource scope, lifecycle state, and grant invariants after active AUTH work is canonical. + +## Why this chunk exists + +Authorization has extensive examples, but generated combinations can prove +closed behavior across unknown actions, actors, scopes, and lifecycle states. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P2 + +## Start phase + +`implementation` + +## Allowed files + +```text +backend/pyproject.toml +backend/tests/test_authorization_properties.py +docs/operations_authorization_service.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/merge-intents/WS-ENG-008-05.json +``` + +## Not allowed + +```text +authorization application code, catalogue, kernel, schemas, routes, grants, audit, migration, or activation changes +changes before AUTH-10C and any intervening AUTH work are merged/stopped and rediscovered +database/network dependence for pure properties +coverage, test, auth-denial, review, or human gate weakening +``` + +## Acceptance criteria + +- [ ] Start evidence is based on main containing the canonical outcome of + AUTH-10C and discovery records exact current action/catalogue ownership. +- [ ] Hypothesis dependency is exactly pinned and reuses the bounded profiles + established by `WS-ENG-008-04` without a second composition path. +- [ ] Generated unknown actions/resources/actors deny by default with bounded + non-sensitive errors and no grant/evidence mutation. +- [ ] Project/resource scope cannot cross tenants or projects; revoked, + expired, future, wrong-kind, and lifecycle-ineligible grants never allow. +- [ ] Planned actions remain unreachable until their owning activation chunk; + custody transfer alone cannot enable them. +- [ ] Authorized combinations preserve exact action/resource/actor lineage and + do not imply unrelated permissions. +- [ ] Tests exercise public kernel/service contracts without copying the + implementation's decision expression into the oracle. +- [ ] Hosted runtime and failure reproduction remain bounded. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-06` and requires a + separate explicit start. + +## Verification commands + +```bash +cd backend +python -m pytest -q tests/test_authorization_properties.py +ruff check tests/test_authorization_properties.py +cd .. +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Are the properties aligned with the post-AUTH-10C canonical contract? +- Do the oracles remain independent of the implementation? +- Does any test accidentally activate or redefine an AUTH action? + +## Stop conditions + +Stop if AUTH remains active/unmerged, tests require production-code changes, or +the property oracle cannot be independent. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md new file mode 100644 index 00000000..a7119981 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md @@ -0,0 +1,113 @@ +# Chunk Contract: WS-ENG-008-06 — Changed-Module Mutation Pilot + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Measure whether tests detect plausible faults in eligible changed pure-logic +modules without immediately imposing an uncalibrated global merge threshold. + +## Why this chunk exists + +Coverage proves execution but not assertion sensitivity. Workstream has no +mutation-testing engine or authenticated mutation evidence. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P2 + +## Start phase + +`implementation` + +## Allowed files + +```text +backend/pyproject.toml +backend/scripts/mutation_policy.py +backend/tests/test_mutation_policy.py +.github/workflows/backend.yml +scripts/test_agent_gates.py +docs/operations_backend_testing.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/merge-intents/WS-ENG-008-06.json +``` + +## Not allowed + +```text +application behavior or production dependency changes +global or blocking mutation percentage +replacement, reduction, or bypass of coverage, shards, API E2E, or full-suite aggregation +mutation of migrations, generated code, schemas/declarations, adapters, or unowned modules without explicit eligibility +use of stale QUALITY branches as implementation authority +unbounded runtime, silent timeout exclusion, or “one mutant killed” success rule +``` + +## Acceptance criteria + +- [ ] Discovery reconciles current Backend workflow and records which dormant + QUALITY ideas, if any, are recreated rather than cherry-picked as authority. +- [ ] One exactly pinned mutation engine runs only eligible changed pure-logic + modules under a deterministic bounded selection and timeout policy. +- [ ] Authenticated evidence reports eligible, generated, killed, survived, + timeout, suspicious, excluded, and error counts plus module/test identity. +- [ ] Every survivor and non-killed category requires explicit classification; + missing or malformed evidence fails the pilot job. +- [ ] Pilot is non-blocking only with respect to score; infrastructure errors, + malformed evidence, scope escape, or weakened coverage remain blocking. +- [ ] Existing full suite, API E2E, shards, 78 percent global floor, and protected + 90 percent floors remain exact and authoritative. +- [ ] Hosted duration is measured. A later blocking threshold requires a separate + reviewed plan and explicit human decision. +- [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-07` and requires a + separate explicit start. + +## Verification commands + +```bash +cd backend +python -m pytest -q tests/test_mutation_policy.py +ruff check scripts/mutation_policy.py tests/test_mutation_policy.py +cd .. +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Is the pilot genuinely bounded and non-gamable? +- Are coverage and full-suite gates unchanged? +- Is all dormant QUALITY work treated only as discovery input? + +## Stop conditions + +Stop if the engine cannot be pinned, hosted runtime is unbounded, evidence is +not complete, or any existing required test/coverage lane must weaken. + diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md new file mode 100644 index 00000000..ade1ed16 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md @@ -0,0 +1,116 @@ +# Chunk Contract: WS-ENG-008-07 — Lossless Review Memory Index + +## Parent initiative + +`WS-ENG-008` — Repository-Native SDLC Assurance + +## Goal + +Replace the growing root review narrative with a compact index while preserving +every historical byte, link, and initiative-owned detailed evidence. + +## Why this chunk exists + +The 147 KB root log is expensive for agents to load and duplicates detailed +initiative review files, but it remains widely referenced durable memory. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md` + +## Risk class + +L1 + +## SLA + +P2 + +## Start phase + +`implementation` + +## Allowed files + +```text +.agent-loop/README.md +.agent-loop/REVIEW_LOG.md +.agent-loop/review-log-archive/** +.agent-loop/policies/repository-engineering-policy.md +scripts/check_review_log_archive.py +scripts/test_check_review_log_archive.py +scripts/check_loop_memory_state.py +scripts/check_stale_artifact_contracts.py +scripts/test_agent_gates.py +AGENTS.md +CONTRIBUTING.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/merge-intents/WS-ENG-008-07.json +``` + +## Not allowed + +```text +deletion, paraphrase, deduplication, reorder, or silent correction of historical review entries +generated automation-branch schema or signed-state changes +application, API, database, product lifecycle, workflow permission, test, or coverage weakening +migration while another reviewed/open PR still writes root REVIEW_LOG.md without exact reconciliation +automatic successor declaration +``` + +## Acceptance criteria + +- [ ] Discovery re-fetches all open PRs and current main immediately before the + migration; every root-log delta is reconciled or the chunk stops. +- [ ] Versioned archive files preserve the complete pre-migration root narrative + byte-for-byte in one documented concatenation order with stored SHA-256 + digests and deterministic reconstruction. +- [ ] Root `REVIEW_LOG.md` becomes a bounded index linking archive periods, + initiative review directories, current conventions, and reconstruction proof. +- [ ] Historical repository links remain valid or receive an explicit lossless + mapping; no initiative evidence file is rewritten merely for relocation. +- [ ] New detailed review evidence remains initiative-owned; root additions are + compact navigation rather than duplicate narrative. +- [ ] Checker rejects missing/extra/reordered bytes, digest mismatch, broken + links, duplicate periods, path traversal, symlink, and oversized index. +- [ ] Existing stale-contract and authored-memory checks understand the index + without weakening their semantic rules. +- [ ] Exactly one schema-v2 merge intent declares no successor. + +## Verification commands + +```bash +python3 scripts/test_check_review_log_archive.py +python3 scripts/check_review_log_archive.py +python3 scripts/test_agent_gates.py +python3 scripts/check_loop_memory_state.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +- Can the exact old root log be reconstructed without relying on Git history? +- Are current navigation and future ownership clearer and bounded? +- Was every concurrent root-log writer reconciled immediately before merge? + +## Stop conditions + +Stop if any history cannot be preserved byte-for-byte, links cannot be mapped, +or concurrent PRs still carry unresolved root-log changes. + diff --git a/.agent-loop/merge-intents/WS-ENG-008-PLAN.json b/.agent-loop/merge-intents/WS-ENG-008-PLAN.json new file mode 100644 index 00000000..0ffe1d01 --- /dev/null +++ b/.agent-loop/merge-intents/WS-ENG-008-PLAN.json @@ -0,0 +1,9 @@ +{ + "schema_version": 2, + "initiative_id": "WS-ENG-008", + "chunk_id": "WS-ENG-008-PLAN", + "chunk_title": "Repository-Native SDLC Assurance Planning", + "next_chunk_id": "WS-ENG-008-01", + "next_chunk_title": "Machine-Checkable Chunk Scope", + "next_requires_explicit_start": true +} From 44fd7fd3cee9f4ce86d56c142e4ca3dcfc0696c6 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Fri, 24 Jul 2026 13:46:42 +0100 Subject: [PATCH 02/10] docs(agent-loop): close ENG-008 plan review gaps --- .../CHUNK_MAP.md | 1 - .../DECISIONS.md | 9 ++++---- .../DISCOVERY.md | 4 ++-- .../INTENT.md | 1 - .../PLAN.md | 16 ++++++++++---- .../RISKS.md | 2 +- .../STATUS.md | 1 - ...NG-008-01-machine-checkable-chunk-scope.md | 21 ++++++++++++++++--- ...8-02-scheduled-signed-state-drift-audit.md | 1 - ...NG-008-03-risk-routed-adversarial-proof.md | 1 - ...-008-04-loop-memory-property-invariants.md | 9 +++++--- ...08-05-authorization-property-invariants.md | 11 ++++++---- ...NG-008-06-changed-module-mutation-pilot.md | 14 ++++++++----- ...ENG-008-07-lossless-review-memory-index.md | 1 - 14 files changed, 60 insertions(+), 32 deletions(-) diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md index 1f5abbb5..dd197f35 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/CHUNK_MAP.md @@ -13,4 +13,3 @@ Only `WS-ENG-008-01` is named by the planning merge intent. Every later chunk must be named by its predecessor's reviewed merge intent and receive a separate signed start. No chunk starts automatically. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md index 2075f17f..47a5902e 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md @@ -8,9 +8,11 @@ is not renamed away. ## D2 — Enforce future contracts without guessing historical intent -Machine scope applies to new or materially changed implementation/specification -contracts. Unchanged historical contracts remain governed by their reviewed -evidence and existing gates. +Machine scope applies to every implementation/specification contract changed in +a PR whose base contains the `WS-ENG-008-01` merge intent. Chunk 01 must upgrade +its already-reviewed ENG-008 successors 02–07 before selecting 02. Unchanged +pre-cutover contracts are the only grandfather set and remain governed by their +reviewed evidence and existing gates. ## D3 — Keep scheduled drift verification read-only @@ -38,4 +40,3 @@ work and root-log archival have explicit concurrency waits. Root review memory becomes an index only after byte-preserving archives and link/reconstruction proof exist. Initiative review directories remain detailed evidence. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md index 6b0e5686..a2746094 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md @@ -80,7 +80,8 @@ Discovery was performed read-only against trusted `main` | Risk | Impact | Required treatment | |---|---|---| | Glob semantics differ across platforms | Scope bypass or false rejection | Define one closed repository-relative grammar and test traversal, symlink, rename, and case behavior. | -| Legacy contracts lack schemas | Immediate repository-wide failure | Forward ratchet new/materially changed contracts; never infer old scope. | +| Legacy contracts lack schemas | Immediate repository-wide failure | Exact cutover: every changed contract after the 01 merge requires schema; unchanged pre-cutover contracts alone are grandfathered. | +| Git permits control and normalization-colliding path bytes | Line/display parsing can conceal a delta | Parse NUL-delimited bytes, reject invalid UTF-8/control/non-NFC names and normalization/casefold collisions. | | Scheduled audit becomes a repair path | Unreviewed signed-state mutation | Read-only permissions, no signing key, no publication command, regression-test workflow semantics. | | Property suites are nondeterministic | Flaky required CI | Fixed profiles, stored counterexample text in evidence, bounded examples/deadlines, rerunnable seeds. | | Mutation score is gamed | False assurance | Report eligible/killed/survived/timeout/excluded counts and classify survivors; do not use “kill one mutant.” | @@ -102,4 +103,3 @@ Discovery was performed read-only against trusted `main` - Exact-current-main signed starts and human-owned specific-PR merge approval. - Internal reviewer completion before publication; external checks supplement it. - Automated Merge Memory owns the generated branch and never starts successors. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md index 8abca78d..a400abba 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md @@ -104,4 +104,3 @@ exact current `main` before implementation, review, publication, and merge. - Approve each implementation chunk's exact scope and PR independently. - Decide after the mutation pilot whether any score becomes blocking. - Approve the lossless review-log archive layout before migration. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md index 1de8dc85..56719135 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md @@ -11,12 +11,15 @@ durable review navigation. Each mechanism lands independently and stops. ### Forward-ratcheted contract scope -New or materially changed implementation/specification contracts gain one -strict fenced JSON block. A dedicated parser validates exact keys, canonical +Every implementation/specification contract changed in a PR whose base contains +the `WS-ENG-008-01` merge intent must carry one strict fenced JSON block; there +is no subjective “material” exception. Chunk 01 also upgrades the already-added +ENG-008 contracts 02–07 before it may name 02 as successor. Contracts unchanged +since a pre-cutover base form the immutable grandfather set and are never +inferred or mass-rewritten. A dedicated parser validates exact keys, canonical repository-relative patterns, reviewer names, and verification commands. Agent Gates compare the PR's status-aware diff to this block and fail closed on unmatched, forbidden, renamed, symlinked, submodule, or ambiguous paths. -Historical unchanged contracts are not guessed or rewritten. ### Read-only drift audit @@ -103,9 +106,15 @@ all contract proof. ## Verification strategy - Parser and mutation matrices for schemas, paths, diff statuses, and reviewer sets. +- Byte-preserving NUL-delimited Git fixtures for controls, invalid UTF-8, + non-NFC names, normalization/casefold collisions, and rename/type changes. - Workflow semantic tests for read-only permissions and absence of repair/signing paths. - Independent signed-state fixture audits and scheduled-run dry runs. - Deterministic Hypothesis profiles with replayable failing examples. +- Property suites have hosted hard limits of 120 seconds each, with the exact + head's elapsed time recorded; mutation execution has a 12-minute command + limit inside a 15-minute job limit and may add no more than two minutes to the + existing required Backend critical path because it runs as an independent lane. - Mutation pilot artifact integrity and survivor-classification tests. - Byte/digest/link equality for review-log archives. - Existing Agent Gates, Backend full CI, coverage floors, Markdown links, stale @@ -125,4 +134,3 @@ All seven chunks are L1 repository-assurance changes and receive senior, QA, security, product/ops, architecture, CI integrity, docs, reuse, and test-delta review. Each reviewer receives exact base, implementation SHA, signed start, contract blob, concurrent-PR overlap report, and deterministic evidence. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md index 300b63ab..7586e5f2 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md @@ -3,6 +3,7 @@ | ID | Risk | Impact | Control | |---|---|---|---| | R1 | Scope patterns are ambiguous or bypassable | Unauthorized files enter a chunk | Closed JSON schema, canonical paths, status-aware diff, traversal/symlink/rename/submodule/case mutations. | +| R1A | Git path bytes or Unicode aliases bypass line parsing | A hidden path escapes scope | NUL-delimited byte-preserving diff, strict UTF-8/NFC policy, control rejection, normalization/casefold collision tests. | | R2 | Forward ratchet breaks historical PRs | Existing maintenance becomes impossible | Enforce only new/materially changed contracts; test unchanged legacy behavior. | | R3 | Scheduled audit obtains write authority | A diagnostic becomes a second state writer | Read-only permissions, no secret, no publish/recovery command, semantic workflow tests. | | R4 | Drift audit is stale relative to concurrent merges | False incident or missed state | Resolve exact current main and automation tip at run time; distinguish transient advancement from corruption. | @@ -14,4 +15,3 @@ | R10 | Review-log migration loses or rewrites history | Durable evidence becomes unverifiable | Byte/digest preservation, link map, archives, exact reconstruction tests, no deletion before proof. | | R11 | Root-log migration conflicts with active PRs | Entries disappear during rebase | Run last and reconcile every active/root-log-writing PR before review and merge. | | R12 | ENG-008 blocks unrelated active initiatives | Reduced delivery throughput | Initiative-local authority, disjoint early paths, overlap audit before every chunk. | - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md index 97c0f1a2..f3e6cf9c 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md @@ -9,4 +9,3 @@ external checks, and explicit human merge approval - Concurrent signed initiatives at planning base: ART-03, AUTH-10C, and REV-03P - Successor after planning: `WS-ENG-008-01`, separate explicit start required - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md index 256b672a..44c4460c 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md @@ -37,6 +37,9 @@ P1 ```text CONTRIBUTING.md AGENTS.md +README.md +docs/glossary.md +docs/architecture_lockdown.md .agent-loop/templates/CHUNK_CONTRACT.md .agent-loop/policies/repository-engineering-policy.md .agent-loop/policies/definition-of-done.md @@ -71,6 +74,10 @@ coverage, test, evidence, reviewer, PR, or human merge gate weakening contradict the machine block. - [ ] A closed repository-relative pattern grammar has deterministic semantics for files and recursive directories without arbitrary regex or shell use. +- [ ] Git status and diff parsing is byte-preserving and NUL-delimited (`-z` or + equivalent), decodes strict UTF-8, rejects C0/C1/DEL controls and non-NFC + names, and rejects byte, NFC, or casefold path collisions. Fixtures cover + tabs, newlines, invalid byte sequences, and distinct NFC/NFD names. - [ ] Status-aware base-to-head plus staged/dirty/untracked discovery rejects every added, modified, deleted, renamed, copied, type-changed, symlinked, executable, gitlink, case-colliding, or foreign path not allowed by the @@ -78,14 +85,23 @@ coverage, test, evidence, reviewer, PR, or human merge gate weakening - [ ] The PR's exact one merge intent, initiative evidence/status, and permitted post-review evidence paths are represented explicitly rather than hidden exemptions. -- [ ] New/materially changed contracts require schema v1. Unchanged historical - contracts continue without inferred or retroactive scope. +- [ ] Every implementation/specification contract changed in a PR whose base + contains `.agent-loop/merge-intents/WS-ENG-008-01.json` requires schema + v1. Unchanged contracts from a pre-cutover base alone are grandfathered; + there is no subjective material-change exception. +- [ ] This chunk adds valid schema-v1 blocks to the already-reviewed + `WS-ENG-008-02` through `WS-ENG-008-07` contracts and proves them before + its merge intent may name 02. ENG-008 cannot exempt its own successors as + legacy contracts. - [ ] Required reviewer metadata agrees with the internal evidence gate; command identifiers bind evidence without executing contract-provided text. - [ ] Agent Gates invoke the checker on the exact PR base/head and fail closed on unresolved refs, shallow history, ambiguity, or malformed contracts. - [ ] Positive fixtures and one negative mutation per schema, identity, path, diff-status, reviewer, command, legacy-ratchet, and workflow drift class pass. +- [ ] README, glossary, and architecture lockdown consistently define the + Repository-Native Human-Agent SDLC as the broader model and retain the + Codex-native zero-trust engineering loop as its enforcement mechanism. - [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-02` and requires a separate explicit start. @@ -122,4 +138,3 @@ git diff --check origin/main...HEAD Stop if deterministic path semantics cannot be closed, historical contracts must be rewritten, or any current evidence/review/coverage gate must weaken. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md index a98d45a1..518bc89b 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md @@ -107,4 +107,3 @@ git diff --check origin/main...HEAD Stop if the audit needs a write token, signing secret, generated-state edit, or new recovery path. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md index c2b19e20..fbeb307f 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md @@ -112,4 +112,3 @@ git diff --check origin/main...HEAD Stop if adversarial proof requires production access, destructive tests, a new authority role, or removal of an existing reviewer. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md index be6ddc54..8e224467 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md @@ -36,6 +36,7 @@ P2 ```text scripts/agent-gate-requirements.txt +scripts/assurance-requirements.txt scripts/test_loop_memory_properties.py scripts/test_agent_gates.py .github/workflows/agent-gates.yml @@ -55,7 +56,9 @@ coverage, test, review, or human gate weakening ## Acceptance criteria -- [ ] Hypothesis is exactly pinned with reproducible dependency evidence. +- [ ] Hypothesis and every transitive distribution are exactly pinned and + hash-locked in `scripts/assurance-requirements.txt`; CI installs it with + `--require-hashes`. - [ ] A bounded CI profile and a documented deeper local profile have explicit examples, deadlines, health checks, and failure reproduction instructions. - [ ] Generated event sequences prove at most one active chunk per initiative, @@ -66,7 +69,8 @@ coverage, test, review, or human gate weakening and malformed scalar types fail closed without partial state mutation. - [ ] Properties reuse real reducers/validators and compare independent invariants; they do not reimplement expected behavior identically. -- [ ] Hosted runtime is measured and remains inside the chunk's approved budget. +- [ ] The focused hosted property command has a hard 120-second limit and its + exact-head elapsed time is recorded; timeout is failure, never retry/skip. - [ ] Existing deterministic regression and coverage suites remain unchanged. - [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-05` and requires a separate explicit start. @@ -103,4 +107,3 @@ git diff --check origin/main...HEAD Stop if Hypothesis introduces flaky required CI, cannot be reproducibly pinned, or exposes a production behavior fix outside this test-only contract. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md index 6998209b..26bb624f 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md @@ -37,6 +37,8 @@ P2 ```text backend/pyproject.toml backend/tests/test_authorization_properties.py +.github/workflows/backend.yml +scripts/assurance-requirements.txt docs/operations_authorization_service.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** .agent-loop/merge-intents/WS-ENG-008-05.json @@ -55,8 +57,9 @@ coverage, test, auth-denial, review, or human gate weakening - [ ] Start evidence is based on main containing the canonical outcome of AUTH-10C and discovery records exact current action/catalogue ownership. -- [ ] Hypothesis dependency is exactly pinned and reuses the bounded profiles - established by `WS-ENG-008-04` without a second composition path. +- [ ] Backend installs the exact hash-locked Hypothesis closure from + `scripts/assurance-requirements.txt` with `--require-hashes` and reuses the + bounded profiles established by `WS-ENG-008-04` without a second path. - [ ] Generated unknown actions/resources/actors deny by default with bounded non-sensitive errors and no grant/evidence mutation. - [ ] Project/resource scope cannot cross tenants or projects; revoked, @@ -67,7 +70,8 @@ coverage, test, auth-denial, review, or human gate weakening do not imply unrelated permissions. - [ ] Tests exercise public kernel/service contracts without copying the implementation's decision expression into the oracle. -- [ ] Hosted runtime and failure reproduction remain bounded. +- [ ] The focused hosted authorization property command has a hard 120-second + limit and records exact-head elapsed time; timeout is failure. - [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-06` and requires a separate explicit start. @@ -105,4 +109,3 @@ git diff --check origin/main...HEAD Stop if AUTH remains active/unmerged, tests require production-code changes, or the property oracle cannot be independent. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md index a7119981..c5a9e2fb 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md @@ -39,6 +39,7 @@ backend/pyproject.toml backend/scripts/mutation_policy.py backend/tests/test_mutation_policy.py .github/workflows/backend.yml +scripts/assurance-requirements.txt scripts/test_agent_gates.py docs/operations_backend_testing.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** @@ -60,8 +61,9 @@ unbounded runtime, silent timeout exclusion, or “one mutant killed” success - [ ] Discovery reconciles current Backend workflow and records which dormant QUALITY ideas, if any, are recreated rather than cherry-picked as authority. -- [ ] One exactly pinned mutation engine runs only eligible changed pure-logic - modules under a deterministic bounded selection and timeout policy. +- [ ] One mutation engine and its complete transitive closure are exactly pinned + and hash-locked in `scripts/assurance-requirements.txt`, installed with + `--require-hashes`, and run only on eligible changed pure-logic modules. - [ ] Authenticated evidence reports eligible, generated, killed, survived, timeout, suspicious, excluded, and error counts plus module/test identity. - [ ] Every survivor and non-killed category requires explicit classification; @@ -70,8 +72,11 @@ unbounded runtime, silent timeout exclusion, or “one mutant killed” success malformed evidence, scope escape, or weakened coverage remain blocking. - [ ] Existing full suite, API E2E, shards, 78 percent global floor, and protected 90 percent floors remain exact and authoritative. -- [ ] Hosted duration is measured. A later blocking threshold requires a separate - reviewed plan and explicit human decision. +- [ ] Mutation execution has a hard 12-minute command limit inside a 15-minute + job limit, records exact-head elapsed time, and runs independently so it + adds no more than two minutes to the existing required Backend critical + path. A later blocking threshold requires a separate reviewed plan and + explicit human decision. - [ ] Exactly one schema-v2 merge intent names `WS-ENG-008-07` and requires a separate explicit start. @@ -110,4 +115,3 @@ git diff --check origin/main...HEAD Stop if the engine cannot be pinned, hosted runtime is unbounded, evidence is not complete, or any existing required test/coverage lane must weaken. - diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md index ade1ed16..594e9a98 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md @@ -113,4 +113,3 @@ git diff --check origin/main...HEAD Stop if any history cannot be preserved byte-for-byte, links cannot be mapped, or concurrent PRs still carry unresolved root-log changes. - From 85bd98d6c55b066c9f1a44bc8aa83514911f4ea0 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Fri, 24 Jul 2026 13:49:51 +0100 Subject: [PATCH 03/10] docs(agent-loop): make scope ratchet wording exact --- .../WS-ENG-008-repository-native-sdlc-assurance/INTENT.md | 5 +++-- .../WS-ENG-008-repository-native-sdlc-assurance/RISKS.md | 2 +- .../chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md | 5 +++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md index a400abba..ce3e9743 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md @@ -31,8 +31,9 @@ unbounded tests or creating a second authority path. ## Target behavior -- New or materially changed chunk contracts carry a strict versioned scope block - that Agent Gates compare to the exact PR delta. +- Every implementation/specification contract changed in a PR whose base + contains the `WS-ENG-008-01` merge intent carries a strict versioned scope + block; only unchanged pre-cutover contracts are grandfathered. - A read-only schedule verifies signed-state custody, ancestry, ledger, projections, active contracts, and closed-tree integrity without repairing. - High-risk work records attacks attempted, observed denials, findings, and diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md index 7586e5f2..4a076639 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md @@ -4,7 +4,7 @@ |---|---|---|---| | R1 | Scope patterns are ambiguous or bypassable | Unauthorized files enter a chunk | Closed JSON schema, canonical paths, status-aware diff, traversal/symlink/rename/submodule/case mutations. | | R1A | Git path bytes or Unicode aliases bypass line parsing | A hidden path escapes scope | NUL-delimited byte-preserving diff, strict UTF-8/NFC policy, control rejection, normalization/casefold collision tests. | -| R2 | Forward ratchet breaks historical PRs | Existing maintenance becomes impossible | Enforce only new/materially changed contracts; test unchanged legacy behavior. | +| R2 | Forward ratchet breaks historical PRs | Existing maintenance becomes impossible | Require schema for every changed contract when the PR base contains the 01 merge intent; grandfather only unchanged pre-cutover contracts. | | R3 | Scheduled audit obtains write authority | A diagnostic becomes a second state writer | Read-only permissions, no secret, no publish/recovery command, semantic workflow tests. | | R4 | Drift audit is stale relative to concurrent merges | False incident or missed state | Resolve exact current main and automation tip at run time; distinguish transient advancement from corruption. | | R5 | Adversarial evidence becomes checkbox theater | Review cost without assurance | Require attempted attack, expected denial, observed evidence, and untested surfaces. | diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md index 44c4460c..ef818adf 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md @@ -6,8 +6,9 @@ ## Goal -Make the allowed and forbidden path scope of new or materially changed chunks a -versioned, deterministic Agent Gate rather than reviewer-only prose. +Make the allowed and forbidden path scope of every implementation/specification +contract changed after the exact 01 cutover a versioned, deterministic Agent +Gate, while grandfathering only unchanged pre-cutover contracts. ## Why this chunk exists From 985bc87efddbce59295899259512b702b16065d1 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Fri, 24 Jul 2026 13:53:26 +0100 Subject: [PATCH 04/10] docs(agent-loop): record ENG-008 planning review --- ...S-ENG-008-PLAN-internal-review-evidence.md | 92 +++++++++++ .../WS-ENG-008-PLAN-pr-trust-bundle.md | 148 ++++++++++++++++++ 2 files changed, 240 insertions(+) create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md create mode 100644 .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md new file mode 100644 index 00000000..dc62e0de --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md @@ -0,0 +1,92 @@ +# Internal Review Evidence + +## Chunk + +`WS-ENG-008-PLAN` — Repository-Native SDLC Assurance Planning + +This planning review covers the initiative artifacts and reviewed contracts +`WS-ENG-008-01` through `WS-ENG-008-07`. It authorizes no implementation and +leaves both active slots empty. + +## Required Statements + +open sub-agent sessions: none + +valid findings addressed: yes + +## Reviewed Revision + +Reviewed code SHA: 85bd98d6c55b066c9f1a44bc8aa83514911f4ea0 + +Reviewed at: 2026-07-24T12:51:59Z + +Reviewer run IDs: eng008_plan_senior_arch_docs, eng008_plan_qa_ci_tests, eng008_plan_security_ops_reuse + +After the reviewed SHA, only evidence and status files changed. + +## Reviewer Results + +| Reviewer | Result | Blocking findings | Notes | +|---|---:|---|---| +| senior engineering | PASS AFTER FIXES | None | Exact cutover, successor conversion, sequencing, and runtime budgets are bounded. | +| QA/test | PASS AFTER FIXES | None | Objective ratchet, negative path cases, measurable limits, and testable acceptance criteria pass. | +| security/auth | PASS AFTER FIXES | None | NUL-delimited bytes, UTF-8/NFC/control rejection, collision proof, read-only audit, and AUTH wait are explicit. | +| product/ops | PASS | None | Engineering assurance remains separate from product review and Contributor authority. | +| architecture | PASS AFTER FIXES | None | ENG-008 cannot exempt its successors; current validators and authority paths remain canonical. | +| CI integrity | PASS AFTER FIXES | None | Hash-locked dependencies and numeric budgets preserve all existing blocking gates. | +| docs | PASS AFTER FIXES | None | Canonical terminology surfaces are assigned without editing them in planning intake. | +| reuse/dedup | PASS | None | Existing validators, evidence gate, risk router, reviewers, aggregation, and initiative reviews are reused. | +| test delta | PASS | None | Planning-only diff changes no test, workflow, threshold, or application file. | + +## Valid Findings Addressed + +- Replaced subjective “materially changed” scope with an exact cutover: every + contract changed when its PR base contains the 01 merge intent requires schema; + only unchanged pre-cutover contracts are grandfathered. +- Required chunk 01 to convert and validate ENG-008 contracts 02–07 before it + may name chunk 02, closing the initiative's self-exemption gap. +- Required byte-preserving NUL-delimited Git parsing, strict UTF-8 and NFC, + control-character rejection, normalization/casefold collision rejection, and + adversarial path fixtures. +- Added canonical terminology reconciliation to README, glossary, and + architecture lockdown while retaining zero-trust loop terminology. +- Set 120-second hosted limits for each property suite and a 12-minute command/ + 15-minute job budget plus two-minute critical-path cap for mutation testing. +- Required complete transitive hash locks and `--require-hashes` installation + for assurance tools. +- Removed trailing blank lines and unified the cutover rule across every artifact. + +## Concurrent Initiative Reconciliation + +- ART-03, AUTH-10C, and REV-03P retain their signed initiative-local authority. +- AUTH property work waits for the canonical AUTH result. +- CON remains stopped; its unexplained local PDF deletion is not adopted. +- Dormant QUALITY work and stale external PRs remain discovery input only. +- Every implementation boundary repeats exact-main, signed-state, and path-overlap checks. + +## Commands Run + +```bash +python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Results + +- Planning merge intent passed for `WS-ENG-008-PLAN`. +- 100 Agent Gate tests passed. +- Markdown links passed for all 14 planning Markdown files. +- Stale wording and exact diff integrity passed. +- The reviewed diff is one additive initiative tree plus one merge intent. + +## Remaining Risks + +- Open AUTH and REV PRs may advance `main`; the planning PR must rebase and rerun + exact evidence before merge if its base changes. +- Tool choice and hosted runtime remain implementation-chunk decisions inside + the reviewed dependency, evidence, and timeout boundaries. +- Planning merge grants no implementation authority. Chunk 01 still requires a + separate signed start after canonical post-merge reconciliation. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md new file mode 100644 index 00000000..7e34adef --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md @@ -0,0 +1,148 @@ +# PR Trust Bundle + +## Chunk + +`WS-ENG-008-PLAN` — Repository-Native SDLC Assurance Planning + +Merge intent: `.agent-loop/merge-intents/WS-ENG-008-PLAN.json` + +## Goal + +Establish a reviewed, planning-only initiative for machine-enforced contract +scope, scheduled signed-state auditing, adversarial proof, property testing, +mutation evidence, and lossless review-memory indexing. + +## Human-approved intent + +- Intent: `../INTENT.md` +- Plan: `../PLAN.md` +- Chunk map: `../CHUNK_MAP.md` + +## Signed Start Provenance + +- Signed start run: N/A — first-new-initiative planning intake +- Authorized main SHA: `bcf1292e1a591e3e84bf8ee212ee7191d80741fa` +- Phase: planning intake; no active planning or implementation chunk +- Contract path: reviewed contracts `../chunks/WS-ENG-008-01-*.md` through `07` +- Signed contract blob SHA: N/A until post-merge explicit start selects chunk 01 +- Reviewed planning SHA: `85bd98d6c55b066c9f1a44bc8aa83514911f4ea0` + +Only independently verified signed automation state is canonical authority. +Planning intake records stopped state and cannot authorize implementation. + +## What changed + +- Added the seven canonical initiative root planning files. +- Added seven sequential L1 implementation contracts. +- Added one schema-v2 PLAN merge intent naming only chunk 01. +- Added the exact required internal review evidence and this trust bundle. + +## Why it changed + +Workstream's loop is healthy, but ordinary scope remains prose-reviewed, signed +state lacks independent scheduled drift detection, and deeper proof mechanisms +need bounded repository-native ownership. + +## Design chosen + +One assurance mechanism per PR, ordered by dependency. Contract enforcement +comes first and must upgrade all later ENG-008 contracts. Scheduled audit is +read-only. Adversarial proof uses existing reviewers. Property and mutation +testing are bounded and reproducible. Review memory is archived losslessly last. + +## Alternatives rejected + +- Immediate global mutation threshold: no calibrated evidence. +- Universal tenth reviewer: duplicates current track ownership. +- Scheduled repair: creates a second state writer. +- Destructive review-log truncation: loses durable evidence. +- Reusing dormant work as authority: violates signed start custody. + +## Scope control + +The PR adds only one new initiative directory and one PLAN merge intent. It +changes no existing file, workflow, application, test, dependency, permission, +coverage threshold, generated state, or product behavior. + +## Product Behavior + +- [x] No Workstream product behavior changed. + +## Acceptance criteria proof + +- [x] Complete intent, discovery, plan, chunk map, status, risks, and decisions. +- [x] Seven bounded contracts with allowed files, prohibitions, measurable proof, + all required reviewers, human focus, and stop conditions. +- [x] ART/AUTH/REV concurrent state and CON/QUALITY dormant state reconciled. +- [x] Objective scope cutover and successor conversion close self-exemption. +- [x] One merge intent names same-initiative chunk 01 with explicit start true. +- [x] Status claims no active planning or implementation chunk. + +## Tests/checks run + +```bash +python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +Result: all passed; 100 Agent Gate tests and 14 planning Markdown link checks. + +## Test delta + +- No tests, workflows, coverage settings, or application files changed. +- The planning contracts specify future tests but implement none. + +## CI integrity + +- [x] Coverage thresholds unchanged +- [x] Lint/typecheck/test commands unchanged +- [x] No workflow or package-script weakening +- [x] No dependency added +- [x] No unpinned GitHub Action +- [x] Planning intake remains additive and stopped + +## Reviewer results + +Reviewed planning SHA: `85bd98d6c55b066c9f1a44bc8aa83514911f4ea0` + +Reviewer run IDs: `eng008_plan_senior_arch_docs`, +`eng008_plan_qa_ci_tests`, `eng008_plan_security_ops_reuse` + +All nine tracks pass after two bounded repair cycles. See +`WS-ENG-008-PLAN-internal-review-evidence.md`. + +## External review + +| Source | Status | Notes | +|---|---:|---| +| CodeRabbit | Pending | Review after publication; supplementary only. | +| GitHub checks | Pending | Exact final PR head must pass. | + +## Remaining risks + +- Concurrent active PRs may advance main and require rebase/re-review evidence. +- Implementation tool choices remain bounded decisions in their owning chunks. +- Human approval of this PR establishes planning only, never a signed start. + +## Follow-up work + +After merge and successful Automated Merge Memory, stop. Chunk 01 begins only +after an explicit user instruction and successful signed start on exact main. + +## Human review focus + +- Is contract enforcement first and does it govern contracts 02–07? +- Is scheduled verification structurally read-only? +- Are property/mutation budgets objective and non-weakening? +- Are concurrent initiatives preserved without borrowing their authority? + +## Human merge ownership + +- [ ] I can explain what changed. +- [ ] I can explain why it changed. +- [ ] I know what could break. +- [ ] I accept the remaining risks. +- [ ] The user explicitly approved this specific PR for merge. From b1af02a1df2a3588600acc79838fb774c1eee0c9 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Fri, 24 Jul 2026 14:06:56 +0100 Subject: [PATCH 05/10] docs(agent-loop): tighten assurance contracts after review --- .../DISCOVERY.md | 3 ++- .../PLAN.md | 6 +++-- ...NG-008-01-machine-checkable-chunk-scope.md | 11 +++++++- ...8-02-scheduled-signed-state-drift-audit.md | 5 +++- ...NG-008-03-risk-routed-adversarial-proof.md | 6 ++++- ...-008-04-loop-memory-property-invariants.md | 5 +++- ...08-05-authorization-property-invariants.md | 6 ++++- ...NG-008-06-changed-module-mutation-pilot.md | 6 ++++- ...ENG-008-07-lossless-review-memory-index.md | 26 ++++++++++++++++--- ...S-ENG-008-PLAN-internal-review-evidence.md | 5 ++-- .../WS-ENG-008-PLAN-pr-trust-bundle.md | 8 +++++- 11 files changed, 71 insertions(+), 16 deletions(-) diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md index a2746094..f12fdbf2 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md @@ -2,7 +2,8 @@ Discovery was performed read-only against trusted `main` `bcf1292e1a591e3e84bf8ee212ee7191d80741fa` and signed -`automation/loop-memory` on 2026-07-24. +`automation/loop-memory` tip +`8affe98a0b877ba79abf9d23f86013f838985dcf` on 2026-07-24. ## Current behavior diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md index 56719135..ed386ef1 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md @@ -17,8 +17,10 @@ is no subjective “material” exception. Chunk 01 also upgrades the already-ad ENG-008 contracts 02–07 before it may name 02 as successor. Contracts unchanged since a pre-cutover base form the immutable grandfather set and are never inferred or mass-rewritten. A dedicated parser validates exact keys, canonical -repository-relative patterns, reviewer names, and verification commands. Agent -Gates compare the PR's status-aware diff to this block and fail closed on +repository-relative patterns, reviewer names, and verification commands. JSON +decoding uses an object-pairs hook (or equivalent) that rejects duplicate object +keys before exact-key and scope validation. Agent Gates compare the PR's +status-aware diff to this block and fail closed on unmatched, forbidden, renamed, symlinked, submodule, or ambiguous paths. ### Read-only drift audit diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md index ef818adf..0c5236ee 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md @@ -49,7 +49,16 @@ scripts/check_chunk_contract.py scripts/check_internal_review_evidence.py scripts/test_check_chunk_contract.py scripts/test_agent_gates.py -.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-pr-trust-bundle.md .agent-loop/merge-intents/WS-ENG-008-01.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md index 518bc89b..e7d4351b 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md @@ -41,7 +41,10 @@ scripts/test_audit_loop_memory_drift.py scripts/test_agent_gates.py docs/operations_post_merge_memory.md .agent-loop/policies/repository-engineering-policy.md -.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-pr-trust-bundle.md .agent-loop/merge-intents/WS-ENG-008-02.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md index fbeb307f..d10f82c3 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md @@ -48,7 +48,11 @@ scripts/check_internal_review_evidence.py scripts/test_agent_gates.py CONTRIBUTING.md AGENTS.md -.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-adversarial-proof.md .agent-loop/merge-intents/WS-ENG-008-03.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md index 8e224467..1346af08 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md @@ -41,7 +41,10 @@ scripts/test_loop_memory_properties.py scripts/test_agent_gates.py .github/workflows/agent-gates.yml docs/operations_post_merge_memory.md -.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-pr-trust-bundle.md .agent-loop/merge-intents/WS-ENG-008-04.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md index 26bb624f..46599c2f 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md @@ -40,7 +40,11 @@ backend/tests/test_authorization_properties.py .github/workflows/backend.yml scripts/assurance-requirements.txt docs/operations_authorization_service.md -.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-adversarial-proof.md .agent-loop/merge-intents/WS-ENG-008-05.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md index c5a9e2fb..49202e9d 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md @@ -42,7 +42,11 @@ backend/tests/test_mutation_policy.py scripts/assurance-requirements.txt scripts/test_agent_gates.py docs/operations_backend_testing.md -.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-adversarial-proof.md .agent-loop/merge-intents/WS-ENG-008-06.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md index 594e9a98..4205d0b2 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md @@ -32,6 +32,10 @@ P2 `implementation` +Execution remains blocked until this planning intake is merged, chunks 01–06 +are completed in order, and the explicit post-merge signed start selects this +exact contract from current trusted `main`. + ## Allowed files ```text @@ -43,10 +47,16 @@ scripts/check_review_log_archive.py scripts/test_check_review_log_archive.py scripts/check_loop_memory_state.py scripts/check_stale_artifact_contracts.py +scripts/check_markdown_links.py +scripts/check_stale_workstream_wording.py scripts/test_agent_gates.py AGENTS.md CONTRIBUTING.md -.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/** +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-pre-migration-reconciliation.json .agent-loop/merge-intents/WS-ENG-008-07.json ``` @@ -63,18 +73,25 @@ automatic successor declaration ## Acceptance criteria - [ ] Discovery re-fetches all open PRs and current main immediately before the - migration; every root-log delta is reconciled or the chunk stops. + migration; every root-log delta is reconciled or the chunk stops. A + durable pre-migration JSON snapshot records the fetch timestamp, exact + main SHA, every open PR number and head SHA, root-log SHA-256 digest, and + explicit reconciliation result. - [ ] Versioned archive files preserve the complete pre-migration root narrative byte-for-byte in one documented concatenation order with stored SHA-256 digests and deterministic reconstruction. - [ ] Root `REVIEW_LOG.md` becomes a bounded index linking archive periods, - initiative review directories, current conventions, and reconstruction proof. + initiative review directories, current conventions, and reconstruction + proof. Its complete UTF-8 encoding, including every newline byte, is at + most 32,768 bytes. - [ ] Historical repository links remain valid or receive an explicit lossless mapping; no initiative evidence file is rewritten merely for relocation. - [ ] New detailed review evidence remains initiative-owned; root additions are compact navigation rather than duplicate narrative. - [ ] Checker rejects missing/extra/reordered bytes, digest mismatch, broken - links, duplicate periods, path traversal, symlink, and oversized index. + links, duplicate periods, path traversal, symlink, an index over 32,768 + UTF-8 bytes including newline bytes, or a reconciliation snapshot whose + main/PR heads/root digest do not bind the migrated input. - [ ] Existing stale-contract and authored-memory checks understand the index without weakening their semantic rules. - [ ] Exactly one schema-v2 merge intent declares no successor. @@ -86,6 +103,7 @@ python3 scripts/test_check_review_log_archive.py python3 scripts/check_review_log_archive.py python3 scripts/test_agent_gates.py python3 scripts/check_loop_memory_state.py +python3 scripts/check_stale_artifact_contracts.py python3 scripts/check_markdown_links.py python3 scripts/check_stale_workstream_wording.py git diff --check origin/main...HEAD diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md index dc62e0de..9c07b8cc 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md @@ -48,8 +48,9 @@ After the reviewed SHA, only evidence and status files changed. - Required byte-preserving NUL-delimited Git parsing, strict UTF-8 and NFC, control-character rejection, normalization/casefold collision rejection, and adversarial path fixtures. -- Added canonical terminology reconciliation to README, glossary, and - architecture lockdown while retaining zero-trust loop terminology. +- Assigned canonical terminology reconciliation to chunk 01 for README, + glossary, and architecture lockdown while retaining zero-trust loop + terminology; this additive planning intake does not edit those files. - Set 120-second hosted limits for each property suite and a 12-minute command/ 15-minute job budget plus two-minute critical-path cap for mutation testing. - Required complete transitive hash locks and `--require-hashes` installation diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md index 7e34adef..a27fa2af 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md @@ -23,7 +23,13 @@ mutation evidence, and lossless review-memory indexing. - Signed start run: N/A — first-new-initiative planning intake - Authorized main SHA: `bcf1292e1a591e3e84bf8ee212ee7191d80741fa` - Phase: planning intake; no active planning or implementation chunk -- Contract path: reviewed contracts `../chunks/WS-ENG-008-01-*.md` through `07` +- Contract paths: `../chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md`, + `../chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md`, + `../chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md`, + `../chunks/WS-ENG-008-04-loop-memory-property-invariants.md`, + `../chunks/WS-ENG-008-05-authorization-property-invariants.md`, + `../chunks/WS-ENG-008-06-changed-module-mutation-pilot.md`, and + `../chunks/WS-ENG-008-07-lossless-review-memory-index.md` - Signed contract blob SHA: N/A until post-merge explicit start selects chunk 01 - Reviewed planning SHA: `85bd98d6c55b066c9f1a44bc8aa83514911f4ea0` From 9ce7bf3d3e0a7eae2a18ff85a7d9c22f60b0ab65 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Fri, 24 Jul 2026 14:09:33 +0100 Subject: [PATCH 06/10] docs(agent-loop): authorize external review evidence paths --- .../chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md | 1 + .../chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md | 1 + .../chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md | 1 + .../chunks/WS-ENG-008-04-loop-memory-property-invariants.md | 1 + .../chunks/WS-ENG-008-05-authorization-property-invariants.md | 1 + .../chunks/WS-ENG-008-06-changed-module-mutation-pilot.md | 1 + .../chunks/WS-ENG-008-07-lossless-review-memory-index.md | 1 + 7 files changed, 7 insertions(+) diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md index 0c5236ee..ca10e600 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md @@ -59,6 +59,7 @@ scripts/test_agent_gates.py .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-internal-review-evidence.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-external-review-response.md .agent-loop/merge-intents/WS-ENG-008-01.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md index e7d4351b..119661de 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md @@ -45,6 +45,7 @@ docs/operations_post_merge_memory.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-internal-review-evidence.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-external-review-response.md .agent-loop/merge-intents/WS-ENG-008-02.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md index d10f82c3..2011de9e 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md @@ -53,6 +53,7 @@ AGENTS.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-internal-review-evidence.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-pr-trust-bundle.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-external-review-response.md .agent-loop/merge-intents/WS-ENG-008-03.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md index 1346af08..e00087ed 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md @@ -45,6 +45,7 @@ docs/operations_post_merge_memory.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-internal-review-evidence.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-external-review-response.md .agent-loop/merge-intents/WS-ENG-008-04.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md index 46599c2f..97cdbd82 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md @@ -45,6 +45,7 @@ docs/operations_authorization_service.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-internal-review-evidence.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-pr-trust-bundle.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-external-review-response.md .agent-loop/merge-intents/WS-ENG-008-05.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md index 49202e9d..7585c212 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md @@ -47,6 +47,7 @@ docs/operations_backend_testing.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-internal-review-evidence.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-pr-trust-bundle.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-adversarial-proof.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-external-review-response.md .agent-loop/merge-intents/WS-ENG-008-06.json ``` diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md index 4205d0b2..dd9232df 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md @@ -56,6 +56,7 @@ CONTRIBUTING.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-internal-review-evidence.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-external-review-response.md .agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-pre-migration-reconciliation.json .agent-loop/merge-intents/WS-ENG-008-07.json ``` From 88225791bc6734ed5f9013d5611f6223244b0f96 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Fri, 24 Jul 2026 14:16:00 +0100 Subject: [PATCH 07/10] docs(agent-loop): record final assurance plan review --- .../WS-ENG-008-PLAN-internal-review-evidence.md | 13 +++++++++++-- .../reviews/WS-ENG-008-PLAN-pr-trust-bundle.md | 11 ++++++----- 2 files changed, 17 insertions(+), 7 deletions(-) diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md index 9c07b8cc..dec3d0b6 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md @@ -16,9 +16,9 @@ valid findings addressed: yes ## Reviewed Revision -Reviewed code SHA: 85bd98d6c55b066c9f1a44bc8aa83514911f4ea0 +Reviewed code SHA: 9ce7bf3d3e0a7eae2a18ff85a7d9c22f60b0ab65 -Reviewed at: 2026-07-24T12:51:59Z +Reviewed at: 2026-07-24T13:12:00Z Reviewer run IDs: eng008_plan_senior_arch_docs, eng008_plan_qa_ci_tests, eng008_plan_security_ops_reuse @@ -56,6 +56,11 @@ After the reviewed SHA, only evidence and status files changed. - Required complete transitive hash locks and `--require-hashes` installation for assurance tools. - Removed trailing blank lines and unified the cutover rule across every artifact. +- Replaced broad initiative allowlists with explicit per-chunk contract, status, + internal evidence, trust-bundle, external-response, and specialized proof paths. +- Required duplicate JSON object-key rejection, exact signed discovery + provenance, and a deterministic lossless review-log migration snapshot and + 32,768-byte UTF-8 index ceiling. ## Concurrent Initiative Reconciliation @@ -91,3 +96,7 @@ git diff --check origin/main...HEAD the reviewed dependency, evidence, and timeout boundaries. - Planning merge grants no implementation authority. Chunk 01 still requires a separate signed start after canonical post-merge reconciliation. +- Backend CI on the published PR installed unbounded `ruff 0.16.0` and exposed + 374 pre-existing lint findings although Agent Gates passed. This planning-only + intake cannot repair that unrelated current-main dependency drift; a separate + authorized CI repair must restore the Backend gate before merge. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md index a27fa2af..f26270b4 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md @@ -31,7 +31,7 @@ mutation evidence, and lossless review-memory indexing. `../chunks/WS-ENG-008-06-changed-module-mutation-pilot.md`, and `../chunks/WS-ENG-008-07-lossless-review-memory-index.md` - Signed contract blob SHA: N/A until post-merge explicit start selects chunk 01 -- Reviewed planning SHA: `85bd98d6c55b066c9f1a44bc8aa83514911f4ea0` +- Reviewed planning SHA: `9ce7bf3d3e0a7eae2a18ff85a7d9c22f60b0ab65` Only independently verified signed automation state is canonical authority. Planning intake records stopped state and cannot authorize implementation. @@ -112,20 +112,21 @@ Result: all passed; 100 Agent Gate tests and 14 planning Markdown link checks. ## Reviewer results -Reviewed planning SHA: `85bd98d6c55b066c9f1a44bc8aa83514911f4ea0` +Reviewed planning SHA: `9ce7bf3d3e0a7eae2a18ff85a7d9c22f60b0ab65` Reviewer run IDs: `eng008_plan_senior_arch_docs`, `eng008_plan_qa_ci_tests`, `eng008_plan_security_ops_reuse` -All nine tracks pass after two bounded repair cycles. See +All nine tracks pass after the bounded internal and external repair cycles. See `WS-ENG-008-PLAN-internal-review-evidence.md`. ## External review | Source | Status | Notes | |---|---:|---| -| CodeRabbit | Pending | Review after publication; supplementary only. | -| GitHub checks | Pending | Exact final PR head must pass. | +| CodeRabbit | Repairs addressed; rerun pending | Nine comments were verified and repaired; the exact final head still needs its follow-up audit. | +| GitHub Agent Gates | Passed on prior published head | Must pass again on the exact final PR head. | +| GitHub Backend | Blocked by current-main dependency drift | Runner resolved unbounded `ruff 0.16.0`, exposing 374 existing lint findings; repair belongs to a separate authorized CI chunk. | ## Remaining risks From 890fc1171032b8323bf0da3ae5b7dfaa6ddce122 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sun, 26 Jul 2026 02:20:59 +0100 Subject: [PATCH 08/10] docs(agent-loop): reconcile ENG-008 planning base --- .../DISCOVERY.md | 18 ++++++++++++++++++ .../PLAN.md | 5 +++-- .../STATUS.md | 6 +++++- ...WS-ENG-008-PLAN-internal-review-evidence.md | 15 ++++++++------- .../reviews/WS-ENG-008-PLAN-pr-trust-bundle.md | 13 ++++++++----- 5 files changed, 42 insertions(+), 15 deletions(-) diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md index f12fdbf2..255dd318 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md @@ -5,6 +5,13 @@ Discovery was performed read-only against trusted `main` `automation/loop-memory` tip `8affe98a0b877ba79abf9d23f86013f838985dcf` on 2026-07-24. +Before final planning publication on 2026-07-26, the branch was reconciled to +trusted `main` `a04fd1a0a623b7150ec40c9934a9982f80a2dce7` and signed +`automation/loop-memory` tip +`33edd1a682ea5fe5ea973870f89bdd3a75a63da3`. The historical observations below +remain discovery provenance; the current signed projection is recorded in the +reconciliation addendum. + ## Current behavior - `scripts/check_internal_review_evidence.py` discovers changed files, resolves @@ -52,6 +59,17 @@ Discovery was performed read-only against trusted `main` | `WS-QUAL-001` | absent from signed state | Two stale local worktrees; no current authority | Treat all QUALITY commits as discovery input only; mutation work starts from current main under ENG-008. | | External PRs #62, #138, #149 | no active signed initiative authority | stale, conflicting, or missing current gates | Never merge as ENG-008 authority; inspect only as preserved proposals when relevant. | +### Final current-main reconciliation + +| Initiative | Signed state at final reconciliation | ENG-008 boundary | +|---|---|---| +| `WS-ART-001` | stopped after `WS-ART-001-PLAN2`; next `WS-ART-001-03A` requires explicit start | No ART authority is borrowed. | +| `WS-AUTH-001` | stopped after `WS-AUTH-001-11`; next `WS-AUTH-001-11A` requires explicit start | Chunk 05 must start from the then-current canonical AUTH result. | +| `WS-REV-001` | `WS-REV-001-03P` remains signed-active | Avoid REV runtime and reconcile its result before overlapping work. | +| `WS-CON-001` | stopped after `WS-CON-001-02A`; next `02B` requires explicit start | Local worktree state remains non-authoritative. | +| `WS-QUAL-001` | absent from signed state | Dormant patches remain discovery input only. | +| `WS-ENG-008` | absent from signed history | This additive planning intake may create only stopped PLAN state. | + ## Existing tests and gaps - Agent Gate tests strongly cover merge intent, evidence, workflow pinning, diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md index ed386ef1..ef19a182 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md @@ -70,7 +70,7 @@ is deleted; future root entries become compact navigation only. merge policy changes. - Existing CI and coverage floors may only be preserved or strengthened after measured human approval. -- Active ART/AUTH/REV initiatives retain their scope and merge independently. +- Concurrent ART/AUTH/REV initiatives retain their scope and merge independently. ## Risk routing @@ -93,7 +93,8 @@ proof before reviewer fanout, and no automatic successor. 2. Drift audit reuses canonical contract parsing and current signed validators. 3. Adversarial proof routing reuses contract reviewer metadata. 4. Loop property tests precede the broader authorization suite. -5. Authorization property work waits for AUTH-10C and any intervening AUTH merge. +5. Authorization property work reconciles the then-current canonical AUTH result + before its separate signed start. 6. Mutation pilot inspects dormant QUALITY patches only as discovery and starts from the then-current canonical Backend workflow. 7. Review-log migration waits until active initiatives no longer carry root-log diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md index f3e6cf9c..fabf4e6f 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md @@ -7,5 +7,9 @@ - Proposed first implementation chunk: `WS-ENG-008-01` - Current gate: planning-only artifacts require internal review, exact-head external checks, and explicit human merge approval -- Concurrent signed initiatives at planning base: ART-03, AUTH-10C, and REV-03P +- Original discovery base: `bcf1292e1a591e3e84bf8ee212ee7191d80741fa` +- Final reconciled main: `a04fd1a0a623b7150ec40c9934a9982f80a2dce7` +- Final signed-state tip: `33edd1a682ea5fe5ea973870f89bdd3a75a63da3` +- Concurrent signed state at final reconciliation: REV-03P active; ART stopped + at PLAN2, AUTH stopped at 11, and CON stopped at 02A - Successor after planning: `WS-ENG-008-01`, separate explicit start required diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md index dec3d0b6..b289059a 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md @@ -64,8 +64,11 @@ After the reviewed SHA, only evidence and status files changed. ## Concurrent Initiative Reconciliation -- ART-03, AUTH-10C, and REV-03P retain their signed initiative-local authority. -- AUTH property work waits for the canonical AUTH result. +- Historical discovery pinned ART-03, AUTH-10C, and REV-03P exactly. +- Final reconciliation pins current main `a04fd1a0a623b7150ec40c9934a9982f80a2dce7` + and signed-state tip `33edd1a682ea5fe5ea973870f89bdd3a75a63da3`. +- ART is stopped at PLAN2, AUTH is stopped at 11, and REV-03P remains active. +- AUTH property work starts only from the then-current canonical AUTH result. - CON remains stopped; its unexplained local PDF deletion is not adopted. - Dormant QUALITY work and stale external PRs remain discovery input only. - Every implementation boundary repeats exact-main, signed-state, and path-overlap checks. @@ -90,13 +93,11 @@ git diff --check origin/main...HEAD ## Remaining Risks -- Open AUTH and REV PRs may advance `main`; the planning PR must rebase and rerun +- Any concurrent PR may advance `main`; the planning PR must reconcile and rerun exact evidence before merge if its base changes. - Tool choice and hosted runtime remain implementation-chunk decisions inside the reviewed dependency, evidence, and timeout boundaries. - Planning merge grants no implementation authority. Chunk 01 still requires a separate signed start after canonical post-merge reconciliation. -- Backend CI on the published PR installed unbounded `ruff 0.16.0` and exposed - 374 pre-existing lint findings although Agent Gates passed. This planning-only - intake cannot repair that unrelated current-main dependency drift; a separate - authorized CI repair must restore the Backend gate before merge. +- The prior Backend failure belonged to the retired dependency/workflow state. + Exact-head Backend CI must pass again against current main before merge. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md index f26270b4..c9609902 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md @@ -21,7 +21,9 @@ mutation evidence, and lossless review-memory indexing. ## Signed Start Provenance - Signed start run: N/A — first-new-initiative planning intake -- Authorized main SHA: `bcf1292e1a591e3e84bf8ee212ee7191d80741fa` +- Discovery main SHA: `bcf1292e1a591e3e84bf8ee212ee7191d80741fa` +- Reconciled main SHA: `a04fd1a0a623b7150ec40c9934a9982f80a2dce7` +- Reconciled signed-state tip: `33edd1a682ea5fe5ea973870f89bdd3a75a63da3` - Phase: planning intake; no active planning or implementation chunk - Contract paths: `../chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md`, `../chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md`, @@ -79,7 +81,8 @@ coverage threshold, generated state, or product behavior. - [x] Complete intent, discovery, plan, chunk map, status, risks, and decisions. - [x] Seven bounded contracts with allowed files, prohibitions, measurable proof, all required reviewers, human focus, and stop conditions. -- [x] ART/AUTH/REV concurrent state and CON/QUALITY dormant state reconciled. +- [x] Historical and current ART/AUTH/REV/CON/QUALITY state reconciled without + borrowing initiative authority. - [x] Objective scope cutover and successor conversion close self-exemption. - [x] One merge intent names same-initiative chunk 01 with explicit start true. - [x] Status claims no active planning or implementation chunk. @@ -124,9 +127,9 @@ All nine tracks pass after the bounded internal and external repair cycles. See | Source | Status | Notes | |---|---:|---| -| CodeRabbit | Repairs addressed; rerun pending | Nine comments were verified and repaired; the exact final head still needs its follow-up audit. | -| GitHub Agent Gates | Passed on prior published head | Must pass again on the exact final PR head. | -| GitHub Backend | Blocked by current-main dependency drift | Runner resolved unbounded `ruff 0.16.0`, exposing 374 existing lint findings; repair belongs to a separate authorized CI chunk. | +| CodeRabbit | Prior comments resolved; rerun pending | Nine comments were verified and repaired; the reconciled final head still needs its follow-up audit. | +| GitHub Agent Gates | Prior head passed | Must pass again on the exact reconciled PR head. | +| GitHub Backend | Prior failure superseded | Must pass the current semantic-lane workflow on the exact reconciled PR head. | ## Remaining risks From 8ce2c1cffd63ba9a8a4867773fe38d7861d2fa69 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sun, 26 Jul 2026 02:26:22 +0100 Subject: [PATCH 09/10] docs(agent-loop): close ENG-008 scope ratchet --- .../DECISIONS.md | 10 ++++----- .../DISCOVERY.md | 13 +++++++---- .../INTENT.md | 7 +++--- .../PLAN.md | 12 +++++----- .../RISKS.md | 2 +- ...NG-008-01-machine-checkable-chunk-scope.md | 22 +++++++++++-------- ...NG-008-06-changed-module-mutation-pilot.md | 6 ++--- ...S-ENG-008-PLAN-internal-review-evidence.md | 7 +++--- 8 files changed, 46 insertions(+), 33 deletions(-) diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md index 47a5902e..197318c3 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DECISIONS.md @@ -8,11 +8,11 @@ is not renamed away. ## D2 — Enforce future contracts without guessing historical intent -Machine scope applies to every implementation/specification contract changed in -a PR whose base contains the `WS-ENG-008-01` merge intent. Chunk 01 must upgrade -its already-reviewed ENG-008 successors 02–07 before selecting 02. Unchanged -pre-cutover contracts are the only grandfather set and remain governed by their -reviewed evidence and existing gates. +Machine scope applies to every implementation/specification start whose trusted- +main basis contains the `WS-ENG-008-01` merge intent. Chunk 01 must upgrade its +already-reviewed ENG-008 successors 02–07 before selecting 02. Chunks already +signed-active at cutover are the only grandfather set and remain bound to their +exact start event, contract blob, reviewed evidence, and existing gates. ## D3 — Keep scheduled drift verification read-only diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md index 255dd318..9a4bac7d 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/DISCOVERY.md @@ -31,9 +31,10 @@ reconciliation addendum. exists. - `scripts/agent-gate-requirements.txt` and `backend/pyproject.toml` contain no Hypothesis or mutation-testing dependency. -- Backend CI fans out four isolated shards, recombines exact artifacts, and - blocks at 78 percent global coverage plus multiple 90 percent protected - subsystem floors. +- At original discovery, Backend CI fanned out four isolated shards and + recombined exact artifacts. Final reconciliation records the replacement + four exact-custody semantic lanes. Both designs preserve the 78 percent global + coverage floor plus multiple 90 percent protected subsystem floors. - `.agent-loop/REVIEW_LOG.md` is 147,017 bytes and 2,846 lines. Detailed review evidence also lives under initiative `reviews/` directories. @@ -70,6 +71,10 @@ reconciliation addendum. | `WS-QUAL-001` | absent from signed state | Dormant patches remain discovery input only. | | `WS-ENG-008` | absent from signed history | This additive planning intake may create only stopped PLAN state. | +Current Backend CI uses four exact-custody semantic lanes with one combined +coverage result. The earlier four-shard topology remains historical discovery +context only and is not a protected future contract boundary. + ## Existing tests and gaps - Agent Gate tests strongly cover merge intent, evidence, workflow pinning, @@ -99,7 +104,7 @@ reconciliation addendum. | Risk | Impact | Required treatment | |---|---|---| | Glob semantics differ across platforms | Scope bypass or false rejection | Define one closed repository-relative grammar and test traversal, symlink, rename, and case behavior. | -| Legacy contracts lack schemas | Immediate repository-wide failure | Exact cutover: every changed contract after the 01 merge requires schema; unchanged pre-cutover contracts alone are grandfathered. | +| Legacy contracts lack schemas | Immediate repository-wide failure | Exact cutover: every post-cutover start requires schema; only work already signed-active at cutover may finish under its exact pre-cutover event and contract blob. | | Git permits control and normalization-colliding path bytes | Line/display parsing can conceal a delta | Parse NUL-delimited bytes, reject invalid UTF-8/control/non-NFC names and normalization/casefold collisions. | | Scheduled audit becomes a repair path | Unreviewed signed-state mutation | Read-only permissions, no signing key, no publication command, regression-test workflow semantics. | | Property suites are nondeterministic | Flaky required CI | Fixed profiles, stored counterexample text in evidence, bounded examples/deadlines, rerunnable seeds. | diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md index ce3e9743..d89a71ba 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/INTENT.md @@ -31,9 +31,10 @@ unbounded tests or creating a second authority path. ## Target behavior -- Every implementation/specification contract changed in a PR whose base - contains the `WS-ENG-008-01` merge intent carries a strict versioned scope - block; only unchanged pre-cutover contracts are grandfathered. +- Every implementation/specification start after the `WS-ENG-008-01` cutover + selects a strict versioned scope contract. Grandfathering is limited to work + already signed-active at cutover and bound to its pre-cutover event and + immutable contract blob. - A read-only schedule verifies signed-state custody, ancestry, ledger, projections, active contracts, and closed-tree integrity without repairing. - High-risk work records attacks attempted, observed denials, findings, and diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md index ef19a182..343992a4 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/PLAN.md @@ -11,11 +11,13 @@ durable review navigation. Each mechanism lands independently and stops. ### Forward-ratcheted contract scope -Every implementation/specification contract changed in a PR whose base contains -the `WS-ENG-008-01` merge intent must carry one strict fenced JSON block; there -is no subjective “material” exception. Chunk 01 also upgrades the already-added -ENG-008 contracts 02–07 before it may name 02 as successor. Contracts unchanged -since a pre-cutover base form the immutable grandfather set and are never +Every implementation/specification start after the `WS-ENG-008-01` merge must +select a contract carrying one strict fenced JSON block; there is no subjective +“material” exception. Chunk 01 also upgrades the already-added ENG-008 contracts +02–07 before it may name 02 as successor. Only chunks already signed-active at +the cutover may finish under an immutable grandfather record bound to the exact +pre-cutover start event and contract blob; stopped, proposed, or newly started +work cannot inherit that exemption. Grandfather records are never inferred or mass-rewritten. A dedicated parser validates exact keys, canonical repository-relative patterns, reviewer names, and verification commands. JSON decoding uses an object-pairs hook (or equivalent) that rejects duplicate object diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md index 4a076639..645cd756 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/RISKS.md @@ -4,7 +4,7 @@ |---|---|---|---| | R1 | Scope patterns are ambiguous or bypassable | Unauthorized files enter a chunk | Closed JSON schema, canonical paths, status-aware diff, traversal/symlink/rename/submodule/case mutations. | | R1A | Git path bytes or Unicode aliases bypass line parsing | A hidden path escapes scope | NUL-delimited byte-preserving diff, strict UTF-8/NFC policy, control rejection, normalization/casefold collision tests. | -| R2 | Forward ratchet breaks historical PRs | Existing maintenance becomes impossible | Require schema for every changed contract when the PR base contains the 01 merge intent; grandfather only unchanged pre-cutover contracts. | +| R2 | Forward ratchet breaks already active work | Existing signed work becomes impossible to finish | Require schema for every post-cutover start; grandfather only chunks already signed-active at cutover and bind each to its exact start event and contract blob. | | R3 | Scheduled audit obtains write authority | A diagnostic becomes a second state writer | Read-only permissions, no secret, no publish/recovery command, semantic workflow tests. | | R4 | Drift audit is stale relative to concurrent merges | False incident or missed state | Resolve exact current main and automation tip at run time; distinguish transient advancement from corruption. | | R5 | Adversarial evidence becomes checkbox theater | Review cost without assurance | Require attempted attack, expected denial, observed evidence, and untested surfaces. | diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md index ca10e600..2fb0afba 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md @@ -6,9 +6,9 @@ ## Goal -Make the allowed and forbidden path scope of every implementation/specification -contract changed after the exact 01 cutover a versioned, deterministic Agent -Gate, while grandfathering only unchanged pre-cutover contracts. +Make the allowed and forbidden path scope of every post-cutover implementation/ +specification start a versioned, deterministic Agent Gate, while grandfathering +only work already signed-active at the exact cutover. ## Why this chunk exists @@ -68,7 +68,7 @@ scripts/test_agent_gates.py ```text application, API, database, migration, product lifecycle, or product authority changes start/cancel/merge authority, loop-memory schema, signing, branch protection, environment, or secret changes -retroactive inference or mass rewrite of unchanged historical contracts +retroactive inference or mass rewrite of inactive historical contracts arbitrary shell execution from contract content absolute paths, traversal, negation, brace expansion, platform-dependent glob behavior, symlink, or submodule acceptance coverage, test, evidence, reviewer, PR, or human merge gate weakening @@ -96,10 +96,13 @@ coverage, test, evidence, reviewer, PR, or human merge gate weakening - [ ] The PR's exact one merge intent, initiative evidence/status, and permitted post-review evidence paths are represented explicitly rather than hidden exemptions. -- [ ] Every implementation/specification contract changed in a PR whose base - contains `.agent-loop/merge-intents/WS-ENG-008-01.json` requires schema - v1. Unchanged contracts from a pre-cutover base alone are grandfathered; - there is no subjective material-change exception. +- [ ] Every implementation/specification start whose trusted-main basis contains + `.agent-loop/merge-intents/WS-ENG-008-01.json` requires a schema-v1 + contract. Only chunks already signed-active at the cutover may finish + under a grandfather record bound to the exact pre-cutover start event, + initiative/chunk identity, contract path, and contract blob. Stopped, + proposed, cancelled/restarted, or newly started work is never + grandfathered; there is no file-history or subjective exception. - [ ] This chunk adds valid schema-v1 blocks to the already-reviewed `WS-ENG-008-02` through `WS-ENG-008-07` contracts and proves them before its merge intent may name 02. ENG-008 cannot exempt its own successors as @@ -109,7 +112,8 @@ coverage, test, evidence, reviewer, PR, or human merge gate weakening - [ ] Agent Gates invoke the checker on the exact PR base/head and fail closed on unresolved refs, shallow history, ambiguity, or malformed contracts. - [ ] Positive fixtures and one negative mutation per schema, identity, path, - diff-status, reviewer, command, legacy-ratchet, and workflow drift class pass. + diff-status, reviewer, command, signed-active grandfather, restart, + post-cutover start, and workflow drift class pass. - [ ] README, glossary, and architecture lockdown consistently define the Repository-Native Human-Agent SDLC as the broader model and retain the Codex-native zero-trust engineering loop as its enforcement mechanism. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md index 7585c212..b3b4835f 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md @@ -56,7 +56,7 @@ docs/operations_backend_testing.md ```text application behavior or production dependency changes global or blocking mutation percentage -replacement, reduction, or bypass of coverage, shards, API E2E, or full-suite aggregation +replacement, reduction, or bypass of coverage, semantic lanes, API E2E, or full-suite aggregation mutation of migrations, generated code, schemas/declarations, adapters, or unowned modules without explicit eligibility use of stale QUALITY branches as implementation authority unbounded runtime, silent timeout exclusion, or “one mutant killed” success rule @@ -75,8 +75,8 @@ unbounded runtime, silent timeout exclusion, or “one mutant killed” success missing or malformed evidence fails the pilot job. - [ ] Pilot is non-blocking only with respect to score; infrastructure errors, malformed evidence, scope escape, or weakened coverage remain blocking. -- [ ] Existing full suite, API E2E, shards, 78 percent global floor, and protected - 90 percent floors remain exact and authoritative. +- [ ] Existing full suite, API E2E, exact-custody semantic lanes, 78 percent + global floor, and protected 90 percent floors remain exact and authoritative. - [ ] Mutation execution has a hard 12-minute command limit inside a 15-minute job limit, records exact-head elapsed time, and runs independently so it adds no more than two minutes to the existing required Backend critical diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md index b289059a..1bfa1a6e 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md @@ -40,9 +40,10 @@ After the reviewed SHA, only evidence and status files changed. ## Valid Findings Addressed -- Replaced subjective “materially changed” scope with an exact cutover: every - contract changed when its PR base contains the 01 merge intent requires schema; - only unchanged pre-cutover contracts are grandfathered. +- Replaced subjective “materially changed” scope with an exact start cutover: + every post-cutover implementation/specification start requires schema; only + chunks already signed-active at cutover are grandfathered, bound to their + exact start event and contract blob. - Required chunk 01 to convert and validate ENG-008 contracts 02–07 before it may name chunk 02, closing the initiative's self-exemption gap. - Required byte-preserving NUL-delimited Git parsing, strict UTF-8 and NFC, From b1bc0a90601cca9d34e2e1511fcf3ea871536b45 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sun, 26 Jul 2026 02:30:28 +0100 Subject: [PATCH 10/10] docs(agent-loop): bind final ENG-008 planning review --- ...S-ENG-008-PLAN-internal-review-evidence.md | 31 ++++++++++++------- .../WS-ENG-008-PLAN-pr-trust-bundle.md | 10 +++--- 2 files changed, 25 insertions(+), 16 deletions(-) diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md index 1bfa1a6e..b5b0321d 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-internal-review-evidence.md @@ -16,25 +16,29 @@ valid findings addressed: yes ## Reviewed Revision -Reviewed code SHA: 9ce7bf3d3e0a7eae2a18ff85a7d9c22f60b0ab65 +Reviewed code SHA: 8ce2c1cffd63ba9a8a4867773fe38d7861d2fa69 -Reviewed at: 2026-07-24T13:12:00Z +Reviewed at: 2026-07-26T01:29:34Z -Reviewer run IDs: eng008_plan_senior_arch_docs, eng008_plan_qa_ci_tests, eng008_plan_security_ops_reuse +Reviewer run IDs: senior-engineering=`ci02b_lane_runner`; +QA/test=`ci02b_cr_arch`; security/auth=`ci02b_cr_ci`; +product/ops=`ci02b_cr_docs`; architecture=`ci02b_cr_arch`; +CI-integrity=`ci02b_cr_ci`; docs=`ci02b_cr_docs`; +reuse/dedup=`ci02b_cr_reuse`; test-delta=`ci02b_cr_test_delta`. -After the reviewed SHA, only evidence and status files changed. +After the reviewed SHA, only this evidence and trust bundle changed. ## Reviewer Results | Reviewer | Result | Blocking findings | Notes | |---|---:|---|---| -| senior engineering | PASS AFTER FIXES | None | Exact cutover, successor conversion, sequencing, and runtime budgets are bounded. | -| QA/test | PASS AFTER FIXES | None | Objective ratchet, negative path cases, measurable limits, and testable acceptance criteria pass. | -| security/auth | PASS AFTER FIXES | None | NUL-delimited bytes, UTF-8/NFC/control rejection, collision proof, read-only audit, and AUTH wait are explicit. | +| senior engineering | PASS | None | Signed-active-only grandfathering, successor conversion, sequencing, semantic lanes, and budgets are bounded. | +| QA/test | PASS | None | Exact start ratchet, negative path cases, measurable limits, and acceptance criteria pass. | +| security/auth | PASS | None | Event/blob binding, path-byte controls, read-only audit, and AUTH reconciliation are explicit. | | product/ops | PASS | None | Engineering assurance remains separate from product review and Contributor authority. | -| architecture | PASS AFTER FIXES | None | ENG-008 cannot exempt its successors; current validators and authority paths remain canonical. | -| CI integrity | PASS AFTER FIXES | None | Hash-locked dependencies and numeric budgets preserve all existing blocking gates. | -| docs | PASS AFTER FIXES | None | Canonical terminology surfaces are assigned without editing them in planning intake. | +| architecture | PASS | None | ENG-008 cannot exempt successors or post-cutover starts; canonical authority paths remain. | +| CI integrity | PASS | None | Planning changes no CI surface; future locks and budgets preserve blocking gates. | +| docs | PASS | None | Historical discovery and current reconciliation are distinct and consistent. | | reuse/dedup | PASS | None | Existing validators, evidence gate, risk router, reviewers, aggregation, and initiative reviews are reused. | | test delta | PASS | None | Planning-only diff changes no test, workflow, threshold, or application file. | @@ -62,6 +66,11 @@ After the reviewed SHA, only evidence and status files changed. - Required duplicate JSON object-key rejection, exact signed discovery provenance, and a deterministic lossless review-log migration snapshot and 32,768-byte UTF-8 index ceiling. +- Closed the file-history grandfather bypass: only chunks signed-active at the + exact cutover may finish under an event/identity/path/blob-bound record; + stopped, new, cancelled/restarted, and post-cutover work require schema. +- Reconciled the future mutation contract to current exact-custody semantic + lanes while retaining the earlier shard topology as historical discovery. ## Concurrent Initiative Reconciliation @@ -88,7 +97,7 @@ git diff --check origin/main...HEAD - Planning merge intent passed for `WS-ENG-008-PLAN`. - 100 Agent Gate tests passed. -- Markdown links passed for all 14 planning Markdown files. +- Markdown links passed for all 16 changed planning Markdown files. - Stale wording and exact diff integrity passed. - The reviewed diff is one additive initiative tree plus one merge intent. diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md index c9609902..5d67b1f0 100644 --- a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md +++ b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-PLAN-pr-trust-bundle.md @@ -33,7 +33,7 @@ mutation evidence, and lossless review-memory indexing. `../chunks/WS-ENG-008-06-changed-module-mutation-pilot.md`, and `../chunks/WS-ENG-008-07-lossless-review-memory-index.md` - Signed contract blob SHA: N/A until post-merge explicit start selects chunk 01 -- Reviewed planning SHA: `9ce7bf3d3e0a7eae2a18ff85a7d9c22f60b0ab65` +- Reviewed planning SHA: `8ce2c1cffd63ba9a8a4867773fe38d7861d2fa69` Only independently verified signed automation state is canonical authority. Planning intake records stopped state and cannot authorize implementation. @@ -97,7 +97,7 @@ python3 scripts/check_stale_workstream_wording.py git diff --check origin/main...HEAD ``` -Result: all passed; 100 Agent Gate tests and 14 planning Markdown link checks. +Result: all passed; 100 Agent Gate tests and 16 planning Markdown link checks. ## Test delta @@ -115,10 +115,10 @@ Result: all passed; 100 Agent Gate tests and 14 planning Markdown link checks. ## Reviewer results -Reviewed planning SHA: `9ce7bf3d3e0a7eae2a18ff85a7d9c22f60b0ab65` +Reviewed planning SHA: `8ce2c1cffd63ba9a8a4867773fe38d7861d2fa69` -Reviewer run IDs: `eng008_plan_senior_arch_docs`, -`eng008_plan_qa_ci_tests`, `eng008_plan_security_ops_reuse` +Reviewer run IDs: `ci02b_lane_runner`, `ci02b_cr_arch`, `ci02b_cr_ci`, +`ci02b_cr_docs`, `ci02b_cr_reuse`, and `ci02b_cr_test_delta`. All nine tracks pass after the bounded internal and external repair cycles. See `WS-ENG-008-PLAN-internal-review-evidence.md`.