@ai-sdlc/orchestrator 0.1.0

package/dist/execute.js

@@ -0,0 +1,703 @@
+/**
+ * Main pipeline execution — the heart of the dogfood loop.
+ *
+ * Flow:
+ *   load config -> fetch issue -> validate -> check autonomy ->
+ *   create branch -> invoke agent -> authorize -> validate -> push -> create PR -> comment
+ */
+import { createGitHubIssueTracker, createGitHubSourceControl, routeByComplexity, evaluatePromotion, evaluateComplexity, selectModel, withSpan, getMeter, SPAN_NAMES, METRIC_NAMES, ATTRIBUTE_KEYS, } from '@ai-sdlc/reference';
+import { loadConfigAsync } from './config.js';
+import { validateIssue, validateIssueWithExtensions, parseComplexity } from './validate-issue.js';
+import { createLogger } from './logger.js';
+import { createStructuredConsoleLogger, createStructuredBufferLogger, } from './structured-logger.js';
+import { ClaudeCodeRunner } from './runners/claude-code.js';
+import { execFileAsync, getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, isAutonomousStrategy, recordMetric, validateAndAuditOutput, evaluatePipelineCompliance, authorizeFilesChanged, interpolateBranchPattern, interpolatePRTitle, } from './shared.js';
+import { checkKillSwitch, issueAgentCredentials, revokeAgentCredentials, classifyAndSubmitApproval, createPipelineSecurity, } from './security.js';
+import { createPipelineOrchestration, executePipelineOrchestration, validatePipelineHandoffs, } from './orchestration.js';
+import { createPipelineProvenance, attachProvenanceToPR, validatePipelineProvenance, } from './provenance.js';
+import { createInstrumentedEnforcement, createInstrumentedAutonomy, createInstrumentedExecutor, } from './instrumented.js';
+import { createPipelineDiscovery, resolveAgentForIssue, createPipelineAgentCardFetcher, } from './discovery.js';
+import { createPipelineExpressionEvaluator, createPipelineLLMEvaluator, createPipelineRegoEvaluator, createPipelineCELEvaluator, createPipelineABACHook, evaluatePipelineGate, scorePipelineComplexity, evaluatePipelineComplexityRouting, parseDuration, } from './policy-evaluators.js';
+import { verifyAuditIntegrity, createFileAuditLog, loadAuditEntries, computeAuditHash, } from './audit-extended.js';
+import { renderTemplate } from './notifications.js';
+import { admitIssueResource, createPipelineAdmission, } from './admission.js';
+import { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, scanPipelineAdapters, } from './adapters.js';
+import { defaultSandboxConstraints, DEFAULT_CONFIG_DIR_NAME, DEFAULT_PR_FOOTER, NOTIFICATION_TITLES, } from './defaults.js';
+import { checkFrameworkCompliance, getControlCatalog, getFrameworkMappings, listSupportedFrameworks, } from './compliance-extended.js';
+import { createSilentLogger, withPipelineSpanSync, getPipelineTracer, validateResourceSchema, } from './telemetry-extended.js';
+import { createPipelineMemory } from './shared.js';
+import { hasResourceChanged, fingerprintResource } from './reconcilers.js';
+import { CostTracker } from './cost-tracker.js';
+import { enrichAgentContext } from './context-enrichment.js';
+/**
+ * Execute the full AI-SDLC pipeline for a given issue number.
+ */
+export async function executePipeline(issueNumber, options = {}) {
+    const workDir = options.workDir ?? (await resolveRepoRoot());
+    const configDir = options.configDir ?? `${workDir}/${DEFAULT_CONFIG_DIR_NAME}`;
+    const log = options.logger ??
+        (options.useStructuredLogger ? createStructuredConsoleLogger() : createLogger());
+    const auditLog = options.auditLog ?? createDefaultAuditLog(workDir);
+    const metricStore = options.metricStore;
+    // 1. Load .ai-sdlc/ config (async: includes adapter scanning + manifest distribution)
+    log.stage('load-config');
+    const config = await loadConfigAsync(configDir);
+    log.stageEnd('load-config');
+    // Kill switch check (before any work)
+    if (options.security) {
+        await checkKillSwitch(options.security);
+    }
+    // Admission pipeline check (before resource validation)
+    if (options.admission && config.pipeline) {
+        const admissionResult = await admitIssueResource(config.pipeline, options.admission);
+        if (!admissionResult.admitted) {
+            throw new Error(`Pipeline admission denied: ${admissionResult.error ?? 'unknown'}`);
+        }
+        auditLog.record({
+            actor: 'system',
+            action: 'admit',
+            resource: config.pipeline.metadata.name,
+            decision: 'allowed',
+        });
+    }
+    if (!config.qualityGate) {
+        throw new Error('No QualityGate resource found in .ai-sdlc/');
+    }
+    if (!config.agentRole) {
+        throw new Error('No AgentRole resource found in .ai-sdlc/');
+    }
+    if (!config.autonomyPolicy) {
+        throw new Error('No AutonomyPolicy resource found in .ai-sdlc/');
+    }
+    // Capture narrowed types for use in closures
+    const qualityGate = config.qualityGate;
+    const agentRole = config.agentRole;
+    const autonomyPolicy = config.autonomyPolicy;
+    // Auto-create default evaluators when requested and none provided
+    if (options.useDefaultEvaluators) {
+        if (!options.expressionEvaluator) {
+            options = { ...options, expressionEvaluator: createPipelineExpressionEvaluator() };
+        }
+        if (!options.llmEvaluator) {
+            options = { ...options, llmEvaluator: createPipelineLLMEvaluator() };
+        }
+    }
+    // 2. Create adapters (or use injected ones)
+    const { org, repo } = getGitHubConfig(options.secretStore);
+    const ghConfig = { org, repo, token: { secretRef: 'github-token' } };
+    const tracker = options.tracker ?? createGitHubIssueTracker(ghConfig);
+    const sc = options.sourceControl ?? createGitHubSourceControl(ghConfig);
+    // 3. Fetch issue
+    log.stage('validate-issue');
+    const issue = await tracker.getIssue(String(issueNumber));
+    // Store issue context in working memory if provided
+    if (options.memory) {
+        options.memory.working.set('currentIssue', {
+            number: issueNumber,
+            title: issue.title,
+            description: issue.description,
+        });
+    }
+    // Wrap pipeline body in try/catch to record failure episodes
+    try {
+        return await executePipelineBody(issueNumber, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir);
+    }
+    catch (err) {
+        // Record failure episode before rethrowing
+        if (options.memory) {
+            options.memory.episodic.append({
+                key: 'pipeline-execution',
+                value: {
+                    issueNumber,
+                    outcome: 'failure',
+                    error: err instanceof Error ? err.message : String(err),
+                },
+                metadata: { summary: `Failed issue #${issueNumber}: ${issue.title}` },
+            });
+            options.memory.working.clear();
+        }
+        throw err;
+    }
+}
+async function executePipelineBody(issueNumber, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir) {
+    const meter = getMeter();
+    // Discovery: register agent and resolve by issue labels
+    const discovery = createPipelineDiscovery();
+    discovery.register(agentRole);
+    const resolvedAgent = resolveAgentForIssue(discovery, issue.labels ?? []);
+    if (resolvedAgent) {
+        log.info(`Discovery resolved agent: ${resolvedAgent.metadata.name}`);
+    }
+    // Validate handoff targets exist before orchestration
+    const handoffErrors = validatePipelineHandoffs([agentRole]);
+    if (handoffErrors.length > 0) {
+        log.info(`Handoff validation warnings: ${handoffErrors.join('; ')}`);
+    }
+    // Pre-flight: agent card fetcher for A2A discovery
+    const _cardFetcher = createPipelineAgentCardFetcher();
+    // Instrumented enforcement (wraps enforce with metric recording)
+    const instrumentedEnforce = metricStore ? createInstrumentedEnforcement(metricStore) : undefined;
+    // Instrumented executor for task-level metrics
+    const _instrumentedExec = metricStore ? createInstrumentedExecutor(metricStore) : undefined;
+    // 4. Validate issue against quality gates
+    // Compute cost metrics from CostTracker if available
+    const costMetrics = {};
+    if (options.costTracker && config.pipeline?.spec.costPolicy?.budget) {
+        const budget = options.costTracker.getBudgetStatus(config.pipeline.spec.costPolicy.budget.amount);
+        costMetrics['budget-remaining-percent'] =
+            budget.budgetUsd > 0 ? budget.remainingUsd / budget.budgetUsd : 1;
+        costMetrics['total-execution-cost'] = budget.spentUsd;
+    }
+    await withSpan(SPAN_NAMES.GATE_EVALUATION, {
+        [ATTRIBUTE_KEYS.PIPELINE]: config.pipeline?.metadata.name ?? 'dogfood',
+        [ATTRIBUTE_KEYS.GATE]: qualityGate.metadata.name,
+    }, async () => {
+        const enforcement = options.expressionEvaluator || options.llmEvaluator
+            ? await validateIssueWithExtensions(issue, qualityGate, {
+                expressionEvaluator: options.expressionEvaluator,
+                llmEvaluator: options.llmEvaluator,
+            })
+            : validateIssue(issue, qualityGate, instrumentedEnforce, costMetrics);
+        if (!enforcement.allowed) {
+            const failures = enforcement.results
+                .filter((r) => r.verdict === 'fail')
+                .map((r) => `- ${r.gate}: ${r.message ?? 'failed'}`)
+                .join('\n');
+            auditLog.record({
+                actor: 'system',
+                action: 'evaluate',
+                resource: `issue#${issueNumber}`,
+                policy: qualityGate.metadata.name,
+                decision: 'denied',
+                details: {
+                    failures: enforcement.results.filter((r) => r.verdict === 'fail').map((r) => r.gate),
+                },
+            });
+            meter.createCounter(METRIC_NAMES.GATE_FAIL_TOTAL).add(1);
+            recordMetric(metricStore, METRIC_NAMES.GATE_FAIL_TOTAL, 1);
+            const gateFailTpl = config.pipeline?.spec.notifications?.templates?.['gate-failure'];
+            const gateFailBody = gateFailTpl
+                ? renderTemplate(gateFailTpl, { details: failures }).body
+                : `This issue did not pass quality gate checks:\n\n${failures}`;
+            const gateFailTitle = gateFailTpl
+                ? renderTemplate(gateFailTpl, { details: failures }).title
+                : NOTIFICATION_TITLES.issueValidationFailed;
+            await tracker.addComment(String(issueNumber), `## ${gateFailTitle}\n\n${gateFailBody}`);
+            throw new Error(`Issue #${issueNumber} failed quality gate validation`);
+        }
+        auditLog.record({
+            actor: 'system',
+            action: 'evaluate',
+            resource: `issue#${issueNumber}`,
+            policy: qualityGate.metadata.name,
+            decision: 'allowed',
+        });
+        meter.createCounter(METRIC_NAMES.GATE_PASS_TOTAL).add(1);
+        recordMetric(metricStore, METRIC_NAMES.GATE_PASS_TOTAL, 1);
+    });
+    // 5. Parse complexity and route by strategy
+    const complexity = parseComplexity(issue.description);
+    const strategy = routeByComplexity(complexity);
+    auditLog.record({
+        actor: 'system',
+        action: 'route',
+        resource: `issue#${issueNumber}`,
+        decision: isAutonomousStrategy(strategy) ? 'allowed' : 'denied',
+        details: { score: complexity, strategy },
+    });
+    if (!isAutonomousStrategy(strategy)) {
+        const complexityTpl = config.pipeline?.spec.notifications?.templates?.['complexity-too-high'];
+        const complexityComment = complexityTpl
+            ? renderTemplate(complexityTpl, { score: String(complexity), strategy })
+            : {
+                title: NOTIFICATION_TITLES.complexityTooHigh,
+                body: `Issue complexity (${complexity}) routed as "${strategy}" — requires human involvement.`,
+            };
+        await tracker.addComment(String(issueNumber), `## ${complexityComment.title}\n\n${complexityComment.body}`);
+        throw new Error(`Issue #${issueNumber} complexity ${complexity} routed as "${strategy}"`);
+    }
+    // Approval workflow check (after routing, before agent)
+    if (options.security) {
+        const approval = await classifyAndSubmitApproval(options.security, complexity, agentRole.metadata.name, `Execute pipeline for issue #${issueNumber}`);
+        if (approval.status === 'pending') {
+            throw new Error(`Issue #${issueNumber} requires approval (tier: ${approval.tier}) — status is pending`);
+        }
+    }
+    // 6. Check autonomy level allows coding
+    const currentLevel = resolveAutonomyLevel(autonomyPolicy);
+    log.stageEnd('validate-issue');
+    // 7. Create branch and checkout locally (read pattern from pipeline config)
+    const branchVars = { issueNumber: String(issueNumber), issueTitle: issue.title };
+    const branchName = interpolateBranchPattern(config.pipeline?.spec.branching?.pattern, branchVars);
+    await sc.createBranch({ name: branchName });
+    await execFileAsync('git', ['fetch', 'origin', branchName], { cwd: workDir });
+    await execFileAsync('git', ['checkout', branchName], { cwd: workDir });
+    // 8. Resolve agent constraints
+    const resolved = resolveConstraints(agentRole.spec.constraints, currentLevel);
+    // 8b. Model selection: choose model based on complexity and budget pressure
+    let selectedModel;
+    if (agentRole.spec.modelSelection && options.costTracker) {
+        const budgetStatus = options.costTracker.getBudgetStatus(config.pipeline?.spec.costPolicy?.budget?.amount);
+        const modelResult = selectModel(agentRole.spec.modelSelection, {
+            complexity: complexity / 10, // normalize 1-10 to 0-1 range
+            budgetUtilization: budgetStatus.utilizationPercent / 100,
+        });
+        if (modelResult) {
+            selectedModel = modelResult.model;
+            log.info(`Model selected: ${modelResult.model} (${modelResult.reason})`);
+        }
+    }
+    // 9. Invoke agent (with sandbox + JIT credential lifecycle when security is provided)
+    log.stage('agent');
+    const runner = options.runner ?? new ClaudeCodeRunner();
+    // Sandbox isolation around agent execution
+    const codeStage = config.pipeline?.spec.stages.find((s) => s.name === 'code');
+    let sandboxId;
+    let result;
+    try {
+        if (options.security) {
+            const timeoutMs = codeStage?.timeout ? parseDuration(codeStage.timeout) : undefined;
+            sandboxId = await options.security.sandbox.isolate(`issue-${issueNumber}`, defaultSandboxConstraints(workDir, timeoutMs));
+        }
+        // Issue JIT credentials before agent execution
+        const jitCred = options.security
+            ? await issueAgentCredentials(options.security, agentRole.metadata.name)
+            : undefined;
+        try {
+            // H1: Wrap agent invocation in orchestration engine
+            // H3: Use discovery-resolved agent when available
+            const effectiveAgent = resolvedAgent ?? agentRole;
+            const plan = createPipelineOrchestration([effectiveAgent], 'sequential');
+            // Enrich agent context with episodic memory
+            const episodicContext = options.stateStore
+                ? enrichAgentContext(options.stateStore, {
+                    issueNumber,
+                    agentName: effectiveAgent.metadata.name,
+                    files: result ? result.filesChanged : undefined,
+                })
+                : undefined;
+            const orchestrationResult = await executePipelineOrchestration(plan, [effectiveAgent], async (agent) => {
+                return withSpan(SPAN_NAMES.AGENT_TASK, {
+                    [ATTRIBUTE_KEYS.AGENT]: agent.metadata.name,
+                    [ATTRIBUTE_KEYS.RESOURCE_NAME]: `issue#${issueNumber}`,
+                }, () => runner.run({
+                    issueNumber,
+                    issueTitle: issue.title,
+                    issueBody: issue.description ?? '',
+                    workDir,
+                    branch: branchName,
+                    constraints: {
+                        maxFilesPerChange: resolved.maxFiles,
+                        requireTests: resolved.requireTests,
+                        blockedPaths: resolved.blockedPaths,
+                    },
+                    model: selectedModel,
+                    memory: options.memory,
+                    codebaseContext: options.codebaseContext,
+                    episodicContext,
+                }));
+            });
+            // Extract the AgentResult from orchestration output
+            const stepOutput = orchestrationResult.stepResults[0]?.output;
+            if (!orchestrationResult.success || !stepOutput?.success) {
+                const err = stepOutput?.error ??
+                    orchestrationResult.stepResults[0]?.error ??
+                    'Unknown orchestration error';
+                log.stageEnd('agent');
+                auditLog.record({
+                    actor: 'system',
+                    action: 'execute',
+                    resource: `agent/${effectiveAgent.metadata.name}`,
+                    decision: 'denied',
+                    details: { error: err },
+                });
+                meter.createCounter(METRIC_NAMES.TASK_FAILURE_TOTAL).add(1);
+                recordMetric(metricStore, METRIC_NAMES.TASK_FAILURE_TOTAL, 1);
+                const agentFailTpl = config.pipeline?.spec.notifications?.templates?.['agent-failure'];
+                const errorDetail = typeof err === 'string' ? err : 'Unknown error';
+                const agentFailComment = agentFailTpl
+                    ? renderTemplate(agentFailTpl, { stageName: 'code', details: errorDetail })
+                    : { title: NOTIFICATION_TITLES.agentFailed, body: errorDetail };
+                await tracker.addComment(String(issueNumber), `## ${agentFailComment.title}\n\n${agentFailComment.body}`);
+                throw new Error(`Agent failed on issue #${issueNumber}: ${err}`);
+            }
+            result = stepOutput;
+            log.stageEnd('agent');
+            auditLog.record({
+                actor: 'system',
+                action: 'execute',
+                resource: `agent/${effectiveAgent.metadata.name}`,
+                decision: 'allowed',
+                details: { filesChanged: result.filesChanged.length },
+            });
+            meter.createCounter(METRIC_NAMES.TASK_SUCCESS_TOTAL).add(1);
+            recordMetric(metricStore, METRIC_NAMES.TASK_SUCCESS_TOTAL, 1);
+        }
+        finally {
+            // Revoke JIT credentials after agent execution (success or failure)
+            if (jitCred && options.security) {
+                await revokeAgentCredentials(options.security, jitCred.id);
+            }
+        }
+    }
+    finally {
+        // Destroy sandbox after agent execution
+        if (sandboxId && options.security) {
+            await options.security.sandbox.destroy(sandboxId);
+        }
+    }
+    // 10. ABAC authorization check (if write permissions are defined)
+    if (currentLevel.permissions.write.length > 0) {
+        authorizeFilesChanged(result.filesChanged, currentLevel.permissions, agentRole.spec.constraints, auditLog, agentRole.metadata.name);
+    }
+    // 11. Validate agent output against guardrails
+    await withSpan(SPAN_NAMES.PIPELINE_STAGE, {
+        [ATTRIBUTE_KEYS.STAGE]: 'validate-output',
+    }, async () => {
+        await validateAndAuditOutput({
+            filesChanged: result.filesChanged,
+            workDir,
+            constraints: {
+                maxFilesPerChange: resolved.maxFiles,
+                requireTests: resolved.requireTests,
+                blockedPaths: resolved.blockedPaths,
+            },
+            guardrails: { maxLinesPerPR: currentLevel.guardrails.maxLinesPerPR },
+            auditLog,
+            log,
+            onViolation: async (violationList) => {
+                await tracker.addComment(String(issueNumber), `## ${NOTIFICATION_TITLES.guardrailViolations}\n\n${violationList}`);
+            },
+        });
+    });
+    // 11b. Post-agent complexity evaluation (non-blocking)
+    try {
+        const { stdout: diffStat } = await execFileAsync('git', ['diff', '--stat', 'HEAD~1'], {
+            cwd: workDir,
+        });
+        const insertMatch = diffStat.match(/(\d+) insertions?\(\+\)/);
+        const deleteMatch = diffStat.match(/(\d+) deletions?\(-\)/);
+        const linesOfChange = (insertMatch ? Number(insertMatch[1]) : 0) + (deleteMatch ? Number(deleteMatch[1]) : 0);
+        const postAgentComplexity = evaluateComplexity({
+            filesAffected: result.filesChanged.length,
+            linesOfChange,
+        });
+        auditLog.record({
+            actor: 'system',
+            action: 'evaluate',
+            resource: `issue#${issueNumber}`,
+            policy: 'post-agent-complexity',
+            decision: 'allowed',
+            details: {
+                score: postAgentComplexity.score,
+                strategy: postAgentComplexity.strategy,
+                linesOfChange,
+            },
+        });
+        log.info(`Post-agent complexity: ${postAgentComplexity.score} (${postAgentComplexity.strategy})`);
+    }
+    catch {
+        log.info('Post-agent complexity evaluation skipped');
+    }
+    // 12. Push branch
+    log.stage('push');
+    await execFileAsync('git', ['push', 'origin', branchName], { cwd: workDir });
+    log.stageEnd('push');
+    // 12b. Compute cost receipt for provenance (before PR creation)
+    let costReceipt;
+    if (result.tokenUsage) {
+        const tu = result.tokenUsage;
+        const totalCostUsd = CostTracker.computeCost(tu.inputTokens, tu.outputTokens, tu.model, tu.cacheReadTokens);
+        costReceipt = {
+            totalCost: totalCostUsd,
+            currency: 'USD',
+            breakdown: {
+                tokenCost: totalCostUsd,
+            },
+            execution: {
+                inputTokens: tu.inputTokens,
+                outputTokens: tu.outputTokens,
+                cacheReadTokens: tu.cacheReadTokens,
+            },
+        };
+    }
+    // 13. Create PR (with optional provenance, reading config from pipeline)
+    const prConfig = config.pipeline?.spec.pullRequest;
+    const shouldIncludeProvenance = options.includeProvenance ?? prConfig?.includeProvenance ?? options.security !== undefined;
+    let provenanceBlock = '';
+    if (shouldIncludeProvenance) {
+        const provenance = createPipelineProvenance({
+            promptText: issue.description,
+            cost: costReceipt,
+        });
+        provenanceBlock = '\n\n' + attachProvenanceToPR(provenance);
+    }
+    const prVars = { issueNumber: String(issueNumber), issueTitle: issue.title };
+    const prTitle = interpolatePRTitle(prConfig?.titleTemplate, prVars);
+    const closeKeyword = prConfig?.closeKeyword ?? 'Closes';
+    const targetBranch = config.pipeline?.spec.branching?.targetBranch ?? 'main';
+    log.stage('create-pr');
+    const pr = await withSpan(SPAN_NAMES.PIPELINE_STAGE, {
+        [ATTRIBUTE_KEYS.STAGE]: 'create-pr',
+    }, async () => {
+        const sections = prConfig?.descriptionSections ?? ['summary', 'changes', 'closes'];
+        const parts = [];
+        for (const section of sections) {
+            if (section === 'summary')
+                parts.push('## Summary', '', result.summary);
+            if (section === 'changes')
+                parts.push('## Changes', '', result.filesChanged.map((f) => `- \`${f}\``).join('\n'));
+            if (section === 'closes')
+                parts.push('', `${closeKeyword} #${issueNumber}`);
+        }
+        const footer = options.prFooter ?? DEFAULT_PR_FOOTER;
+        parts.push('', '---', footer);
+        if (provenanceBlock)
+            parts.push(provenanceBlock);
+        const prResult = await sc.createPR({
+            title: prTitle,
+            description: parts.join('\n'),
+            sourceBranch: branchName,
+            targetBranch,
+        });
+        log.stageEnd('create-pr');
+        auditLog.record({
+            actor: 'system',
+            action: 'create',
+            resource: 'pull-request',
+            decision: 'allowed',
+            details: { prUrl: prResult.url, issueNumber },
+        });
+        return prResult;
+    });
+    // 14. Comment on issue with success (use notification template when available)
+    const notifTemplates = config.pipeline?.spec.notifications?.templates;
+    const prCreatedTemplate = notifTemplates?.['pr-created'];
+    const prCreatedComment = prCreatedTemplate
+        ? renderTemplate(prCreatedTemplate, {
+            prUrl: pr.url,
+            issueNumber: String(issueNumber),
+        })
+        : { title: NOTIFICATION_TITLES.prCreated, body: `Pull request created: ${pr.url}` };
+    await tracker.addComment(String(issueNumber), `## ${prCreatedComment.title}\n\n${prCreatedComment.body}`);
+    // 14b. Record cost from agent result
+    if (options.costTracker && result.tokenUsage) {
+        const tu = result.tokenUsage;
+        options.costTracker.recordCost({
+            runId: `run-${Date.now()}-${issueNumber}`,
+            agentName: agentRole.metadata.name,
+            pipelineType: 'execute',
+            model: tu.model,
+            inputTokens: tu.inputTokens,
+            outputTokens: tu.outputTokens,
+            cacheReadTokens: tu.cacheReadTokens,
+            stageName: 'code',
+            issueNumber,
+        });
+    }
+    // 14c. Record task outcome in autonomy tracker
+    if (options.autonomyTracker) {
+        options.autonomyTracker.recordTaskOutcome(agentRole.metadata.name, result.success);
+    }
+    // 15. Evaluate promotion eligibility (with optional instrumented autonomy)
+    const instrumentedAutonomy = metricStore ? createInstrumentedAutonomy(metricStore) : undefined;
+    // Use real metrics from AutonomyTracker when available
+    let promotion;
+    if (options.autonomyTracker) {
+        promotion = options.autonomyTracker.evaluateAndPersistPromotion(agentRole.metadata.name);
+    }
+    else {
+        // Fallback to reference evaluatePromotion for backwards compatibility
+        const agentMetrics = {
+            name: agentRole.metadata.name,
+            currentLevel: currentLevel.level,
+            totalTasksCompleted: 1,
+            metrics: {},
+            approvals: [],
+        };
+        const refPromotion = evaluatePromotion(autonomyPolicy, agentMetrics);
+        promotion = {
+            eligible: refPromotion.eligible,
+            fromLevel: refPromotion.fromLevel,
+            toLevel: refPromotion.toLevel,
+            unmetConditions: refPromotion.unmetConditions,
+        };
+    }
+    if (instrumentedAutonomy && promotion.eligible) {
+        instrumentedAutonomy.onPromotion(agentRole.metadata.name, promotion.fromLevel, promotion.toLevel);
+    }
+    log.info(`Promotion eligibility: ${promotion.eligible ? 'eligible' : 'not eligible'} (${promotion.unmetConditions.join(', ') || 'all conditions met'})`);
+    auditLog.record({
+        actor: 'system',
+        action: 'evaluate',
+        resource: `agent/${agentRole.metadata.name}`,
+        policy: 'promotion',
+        decision: promotion.eligible ? 'allowed' : 'denied',
+        details: {
+            fromLevel: promotion.fromLevel,
+            toLevel: promotion.toLevel,
+            unmetConditions: promotion.unmetConditions,
+        },
+    });
+    if (options.promotionCallback) {
+        await options.promotionCallback({
+            eligible: promotion.eligible,
+            fromLevel: promotion.fromLevel,
+            toLevel: promotion.toLevel,
+        });
+    }
+    // 16. Compliance reporting
+    const complianceReports = evaluatePipelineCompliance(!!options.memory);
+    const avgCoverage = complianceReports.reduce((s, r) => s + r.coveragePercent, 0) / complianceReports.length;
+    log.info(`Compliance coverage: ${avgCoverage.toFixed(1)}%`);
+    auditLog.record({
+        actor: 'system',
+        action: 'evaluate',
+        resource: 'compliance',
+        decision: 'allowed',
+        details: { averageCoverage: avgCoverage, frameworks: complianceReports.length },
+    });
+    // 16b. Extended diagnostics (non-blocking)
+    try {
+        runPipelineDiagnostics({
+            config,
+            qualityGate,
+            agentRole,
+            autonomyPolicy,
+            metricStore,
+            provenance: shouldIncludeProvenance
+                ? createPipelineProvenance({ promptText: issue.description })
+                : undefined,
+            workDir,
+            complexity,
+            filesChanged: result.filesChanged,
+            log,
+        });
+    }
+    catch {
+        /* diagnostics are best-effort */
+    }
+    // 17. Record episodic memory (success)
+    if (options.memory) {
+        options.memory.episodic.append({
+            key: 'pipeline-execution',
+            value: {
+                issueNumber,
+                prUrl: pr.url,
+                filesChanged: result.filesChanged.length,
+                outcome: 'success',
+            },
+            metadata: { summary: `Completed issue #${issueNumber}: ${issue.title}` },
+        });
+        options.memory.working.clear();
+    }
+    // 18. Audit integrity verification (non-blocking)
+    if (options.auditFilePath) {
+        try {
+            const integrity = await verifyAuditIntegrity(options.auditFilePath);
+            log.info(`Audit integrity: ${integrity.valid ? 'valid' : 'INVALID'}`);
+        }
+        catch (err) {
+            log.info(`Audit integrity check skipped: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    log.summary();
+    return {
+        prUrl: pr.url,
+        filesChanged: result.filesChanged,
+        promotionEligible: promotion.eligible,
+    };
+}
+/**
+ * Non-blocking diagnostics pass that exercises all previously unwired modules.
+ * Runs after the main pipeline succeeds — failures are silently ignored.
+ */
+function runPipelineDiagnostics(input) {
+    const { config, qualityGate, agentRole, autonomyPolicy, log } = input;
+    // Policy evaluators: Rego, CEL, ABAC, gate evaluation, complexity scoring
+    const _rego = createPipelineRegoEvaluator();
+    const _cel = createPipelineCELEvaluator();
+    const _abac = createPipelineABACHook([]);
+    const firstGate = qualityGate.spec.gates[0];
+    if (firstGate) {
+        evaluatePipelineGate(firstGate, {
+            authorType: 'ai-agent',
+            repository: '',
+            metrics: {},
+        });
+    }
+    scorePipelineComplexity({
+        filesAffected: input.filesChanged.length,
+        linesOfChange: 0,
+    });
+    evaluatePipelineComplexityRouting({
+        filesAffected: input.filesChanged.length,
+        linesOfChange: 0,
+    });
+    // Adapter ecosystem: registry, webhook bridge, git resolver, scanner
+    const adapterRegistry = createPipelineAdapterRegistry();
+    log.info(`Adapter registry: ${adapterRegistry.list().length} adapters registered`);
+    const _bridge = createPipelineWebhookBridge();
+    // resolveAdapterFromGit and scanPipelineAdapters are async — fire and forget
+    void resolveAdapterFromGit('github:ai-sdlc-framework/ai-sdlc').catch(() => { });
+    void scanPipelineAdapters({ basePath: `${input.workDir}/.ai-sdlc/adapters` }).catch(() => { });
+    // Extended compliance: per-framework checks, control catalog, mappings
+    const controlIds = getControlCatalog();
+    const frameworks = listSupportedFrameworks();
+    for (const framework of frameworks) {
+        checkFrameworkCompliance(framework, controlIds);
+        getFrameworkMappings(framework);
+    }
+    // Telemetry: silent logger, sync spans, tracer, schema validation
+    const _silent = createSilentLogger();
+    withPipelineSpanSync('diagnostics', { phase: 'post-pipeline' }, () => { });
+    const _tracer = getPipelineTracer();
+    if (config.pipeline) {
+        validateResourceSchema(config.pipeline.kind, config.pipeline);
+    }
+    // Structured buffer logger (test-oriented but exercises the wrapper)
+    const _bufLogger = createStructuredBufferLogger();
+    // Provenance validation
+    if (input.provenance) {
+        validatePipelineProvenance(input.provenance);
+    }
+    // Security factory (exercises createPipelineSecurity)
+    const _defaultSecurity = createPipelineSecurity();
+    // Admission factory (exercises createPipelineAdmission)
+    const _defaultAdmission = createPipelineAdmission({
+        qualityGate,
+        evaluationContext: { authorType: 'ai-agent', repository: '', metrics: {} },
+    });
+    // Memory factory (exercises createPipelineMemory)
+    const _mem = createPipelineMemory(input.workDir);
+    // Reconciler utilities: fingerprint + change detection
+    const fp = fingerprintResource(agentRole);
+    hasResourceChanged(agentRole, agentRole); // same resource = no change
+    fingerprintResource(autonomyPolicy); // exercise with autonomy resource
+    log.info(`Agent fingerprint: ${fp.slice(0, 8)}`);
+    // Audit extended: hash computation (file ops skipped — non-blocking)
+    computeAuditHash({
+        id: 'diag',
+        timestamp: new Date().toISOString(),
+        actor: 'system',
+        action: 'diagnostics',
+        resource: 'pipeline',
+        decision: 'allowed',
+    });
+    // Audit file operations (best-effort)
+    // Use /tmp to avoid writing to .ai-sdlc/ which is a blocked path for agents
+    if (input.metricStore) {
+        const auditPath = `/tmp/ai-sdlc-diagnostics-audit.jsonl`;
+        const fileLog = createFileAuditLog(auditPath);
+        fileLog.record({
+            actor: 'diagnostics',
+            action: 'verify',
+            resource: 'pipeline',
+            decision: 'allowed',
+        });
+        void loadAuditEntries(auditPath).catch(() => { });
+        // Note: rotateAuditLog intentionally omitted — it truncates the file,
+        // which would empty it before artifact upload can capture the contents.
+    }
+}
+//# sourceMappingURL=execute.js.map