@ai-sdlc/orchestrator 0.10.0 → 0.14.0

package/dist/admission-score.d.ts

@@ -25,6 +25,18 @@ export interface AdmissionInput {
     commentCount: number;
     /** ISO timestamp of issue creation. */
     createdAt: string;
+    /**
+     * Canonical work item ID for dep-graph lookups (RFC-0014 / RFC-0009 Phase 2.1).
+     *
+     * When present, used instead of `#${issueNumber}` to match the work item
+     * against dep-graph snapshot entries (which use backlog task IDs like
+     * `AISDLC-313`). Backlog adapters set this from the task's frontmatter `id`.
+     *
+     * Absent for GitHub-issue based inputs — the admission composite falls back
+     * to `#${issueNumber}` which is consistent with `mapIssueToPriorityInput`'s
+     * `itemId` field.
+     */
+    workItemId?: string;
     /** GitHub author_association — determines trust-based signal boosting. */
     authorAssociation?: AuthorAssociation;
     /** GitHub login of the issue author (used by C5 principal match). */
@@ -116,6 +128,24 @@ export interface DesignAuthoritySignal {
      * RFC's §14.2 weighting constraint.
      */
     principalsDeclared?: boolean;
+    /**
+     * RFC-0008 §C5 Source 3 — automated compliance-assessment signal in [-1, 1].
+     *
+     * Populated by `buildDesignAuthoritySignal` when the resolved DSB carries
+     * `status.tokenCompliance.currentCoverage`:
+     *   >= 0.8 (80 %) → small positive signal (+0.3): design system is healthy here
+     *   < 0.4  (40 %) → small negative signal (-0.2): design system is fragile here
+     *   otherwise     → 0 (neutral)
+     *
+     * This signal fires from the DSB health data alone — no principal participation
+     * required. It is additive to the principal-participation weight in
+     * `computeDesignAuthorityWeight`, so a fully-loaded DSB with high compliance
+     * produces `hcDesign > 0` even when no design-authority principal commented.
+     *
+     * Absent (undefined) when no DSB is resolved or the DSB lacks token-compliance
+     * status — callers treat absence the same as 0.
+     */
+    complianceSignal?: number;
 }
 export interface AdmissionThresholds {
     minimumScore: number;

package/dist/admission-score.js

@@ -45,7 +45,10 @@ export function mapIssueToPriorityInput(input) {
     const isTrusted = assoc === 'OWNER' || assoc === 'MEMBER' || assoc === 'COLLABORATOR';
     const isContributor = assoc === 'CONTRIBUTOR';
     // ── Complexity from issue body, AC count, or backlog context ─
-    const complexityMatch = input.body?.match(/###?\s*Complexity\s*\n+\s*(\d+)/i);
+    // Horizontal-whitespace classes ([ \t]) around \n+ so the sub-patterns can't
+    // overlap (\s includes \n) — avoids polynomial backtracking on attacker-
+    // controlled issue bodies (CodeQL js/polynomial-redos).
+    const complexityMatch = input.body?.match(/###?[ \t]*Complexity[ \t]*\n+[ \t]*(\d+)/i);
     let complexity = complexityMatch ? Number(complexityMatch[1]) : undefined;
     // Backlog tasks rarely include a `### Complexity` header — fall back to AC count
     // (each AC is roughly one logical unit; clamp at 10).

package/dist/analysis/file-walker.js

@@ -28,7 +28,12 @@ const MODULE_MARKERS = ['index.ts', 'index.js', 'index.mjs', 'package.json'];
 function matchesGlob(filePath, patterns) {
     for (const pattern of patterns) {
         // Simple glob matching: supports ** and *
+        // Escape backslashes FIRST before any other replacement so that the
+        // subsequent `.replace(/\./g, '\\.')` doesn't produce `\\.` sequences
+        // that are themselves broken when the input contained a `\`
+        // (CodeQL js/incomplete-sanitization alert #67).
         const regex = pattern
+            .replace(/\\/g, '\\\\')
             .replace(/\./g, '\\.')
             .replace(/\*\*/g, '{{GLOBSTAR}}')
             .replace(/\*/g, '[^/]*')

package/dist/backlog-adapter.d.ts

@@ -18,6 +18,36 @@
  */
 import type { PriorityInput, QualityFlag } from '@ai-sdlc/reference';
 import { type AdmissionInput } from './admission-score.js';
+/**
+ * Extract a code-area string from a list of file/path references.
+ *
+ * Algorithm:
+ *   1. Filter references down to path-like strings (not URLs, not AISDLC-N
+ *      IDs, not RFC-NNNN IDs) — the path-like entries are the ones that
+ *      carry blast-radius signal.
+ *   2. Compute the deepest common path prefix across all filtered paths
+ *      at the directory level (e.g. `pipeline-cli/src/orchestrator/filters/x.ts`
+ *      + `pipeline-cli/src/orchestrator/loop.ts` → `pipeline-cli/src/orchestrator`).
+ *   3. Return the prefix, or `undefined` when there are no path references.
+ *
+ * The caller uses the result to populate `EnrichmentContext.codeArea` so
+ * `buildCodeAreaQuality()` can look up per-area metrics instead of the
+ * uniform Eρ variance of 0.30.
+ *
+ * @param references  Raw reference strings from frontmatter `references:` AND
+ *                    any `## References` body section — callers are responsible
+ *                    for merging both sources before calling here.
+ */
+export declare function extractCodeAreaFromReferences(references: string[]): string | undefined;
+/**
+ * Parse file-path references from a `## References` markdown section.
+ *
+ * The body format is a bullet list where each item may be a bare path,
+ * a backtick-quoted path, a description with an inline path, or a mix.
+ * We extract the first backtick-quoted segment or the first slash-
+ * containing word from each bullet.
+ */
+export declare function parseBodyReferences(body: string): string[];
 export interface BacklogAcceptanceCriterion {
     index: number;
     text: string;
@@ -38,6 +68,11 @@ export interface BacklogTaskSnapshot {
     createdBy?: string;
     acceptanceCriteria: BacklogAcceptanceCriterion[];
     references: string[];
+    /**
+     * References extracted from the `## References` body section.
+     * Merged with frontmatter `references` when computing `codeArea`.
+     */
+    bodyReferences: string[];
     /** Task IDs this task is blocked by (frontmatter `dependencies`). */
     dependencies: string[];
     /** Filesystem path the snapshot was read from. */
@@ -83,6 +118,16 @@ export interface BacklogAdmissionMapping {
     priorityInputOverrides: Partial<PriorityInput>;
     /** Quality flags surfaced for renderers (zombie close, etc). */
     qualityFlags: QualityFlag[];
+    /**
+     * Deepest common path prefix computed from all references in the task
+     * (frontmatter `references:` + `## References` body section).
+     *
+     * Pass to `EnrichmentContext.codeArea` when calling `enrichAdmissionInput()`
+     * so `buildCodeAreaQuality()` can look up per-area metrics instead of the
+     * uniform Eρ variance of 0.30. Undefined when the task has no file-path
+     * references — callers should fall through to the uniform default.
+     */
+    codeArea: string | undefined;
 }
 /**
  * Map a Backlog snapshot onto an `AdmissionInput` plus the

package/dist/backlog-adapter.js

@@ -20,6 +20,139 @@ import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
 import { normalizeBacklogPriority } from './admission-score.js';
+// ── Code-area extraction ────────────────────────────────────────────
+/**
+ * Extract a code-area string from a list of file/path references.
+ *
+ * Algorithm:
+ *   1. Filter references down to path-like strings (not URLs, not AISDLC-N
+ *      IDs, not RFC-NNNN IDs) — the path-like entries are the ones that
+ *      carry blast-radius signal.
+ *   2. Compute the deepest common path prefix across all filtered paths
+ *      at the directory level (e.g. `pipeline-cli/src/orchestrator/filters/x.ts`
+ *      + `pipeline-cli/src/orchestrator/loop.ts` → `pipeline-cli/src/orchestrator`).
+ *   3. Return the prefix, or `undefined` when there are no path references.
+ *
+ * The caller uses the result to populate `EnrichmentContext.codeArea` so
+ * `buildCodeAreaQuality()` can look up per-area metrics instead of the
+ * uniform Eρ variance of 0.30.
+ *
+ * @param references  Raw reference strings from frontmatter `references:` AND
+ *                    any `## References` body section — callers are responsible
+ *                    for merging both sources before calling here.
+ */
+export function extractCodeAreaFromReferences(references) {
+    // Strip leading/trailing backtick pairs, parentheses, brackets and whitespace
+    // (common in `## References` bullet items like `` `path/to/file.ts` ``).
+    const cleaned = references.map((r) => r
+        .replace(/^[`(['"]*/, '')
+        .replace(/[`)\]'"]*$/, '')
+        .trim());
+    // Keep only path-like references. Exclude:
+    //   - URLs (http://, https://, ...)
+    //   - AISDLC-N IDs
+    //   - RFC-NNNN IDs
+    //   - Plain words with no path separator
+    //   - Empty strings
+    const pathRefs = cleaned.filter((r) => {
+        if (!r)
+            return false;
+        if (/^https?:\/\//i.test(r))
+            return false;
+        if (/^aisdlc-\d+$/i.test(r))
+            return false;
+        if (/^rfc-\d{4}/i.test(r))
+            return false;
+        // Must contain at least one path separator to be treated as a file path.
+        // Also accept paths that look like `dir/file.ext` with an extension.
+        return r.includes('/');
+    });
+    if (pathRefs.length === 0)
+        return undefined;
+    if (pathRefs.length === 1) {
+        return pathPrefix(pathRefs[0]);
+    }
+    // Compute the deepest common directory prefix.
+    const segments = pathRefs.map((r) => pathPrefix(r).split('/'));
+    let common = segments[0];
+    for (let i = 1; i < segments.length; i++) {
+        common = commonPrefix(common, segments[i]);
+    }
+    if (common.length === 0)
+        return undefined;
+    return common.join('/');
+}
+/**
+ * Return the directory portion of a path reference.
+ * `pipeline-cli/src/foo.ts` → `pipeline-cli/src`
+ * `pipeline-cli/src/orchestrator/` → `pipeline-cli/src/orchestrator`
+ * `pipeline-cli/src/orchestrator` → `pipeline-cli/src`  (no trailing slash → treat as file)
+ */
+function pathPrefix(ref) {
+    const stripped = ref.replace(/\/$/, ''); // remove trailing slash
+    const lastSlash = stripped.lastIndexOf('/');
+    // If the last segment looks like a file (has an extension) or the path has a
+    // trailing slash (already a directory reference), take the parent. Otherwise
+    // treat the whole thing as a directory.
+    const lastSegment = lastSlash >= 0 ? stripped.slice(lastSlash + 1) : stripped;
+    if (lastSlash < 0)
+        return stripped; // bare filename with no directory
+    // Has a dot in the last segment AND it's not a hidden dir like `.ai-sdlc` → file
+    if (lastSegment.includes('.') && !lastSegment.startsWith('.')) {
+        return stripped.slice(0, lastSlash);
+    }
+    return stripped; // already a directory path
+}
+/**
+ * Longest common prefix of two string arrays (segment-by-segment).
+ */
+function commonPrefix(a, b) {
+    const result = [];
+    const len = Math.min(a.length, b.length);
+    for (let i = 0; i < len; i++) {
+        if (a[i] !== b[i])
+            break;
+        result.push(a[i]);
+    }
+    return result;
+}
+/**
+ * Parse file-path references from a `## References` markdown section.
+ *
+ * The body format is a bullet list where each item may be a bare path,
+ * a backtick-quoted path, a description with an inline path, or a mix.
+ * We extract the first backtick-quoted segment or the first slash-
+ * containing word from each bullet.
+ */
+export function parseBodyReferences(body) {
+    // Split the body by `## ` headings (preserving each section in its entirety)
+    // then find the `## References` section specifically. This avoids regex
+    // backtracking issues with greedy vs lazy quantifiers when the body contains
+    // multiple `## ` headings.
+    const sections = body.split(/\n(?=##\s)/);
+    const section = sections.find((s) => /^##\s+References\b/i.test(s));
+    if (!section)
+        return [];
+    const out = [];
+    for (const line of section.split(/\r?\n/)) {
+        // Must be a bullet item.
+        if (!/^\s*-\s/.test(line))
+            continue;
+        const content = line.replace(/^\s*-\s+/, '');
+        // Prefer backtick-quoted path.
+        const btMatch = content.match(/`([^`]+)`/);
+        if (btMatch) {
+            out.push(btMatch[1]);
+            continue;
+        }
+        // Fall back to the first slash-containing token.
+        const tokens = content.split(/\s+/);
+        const pathToken = tokens.find((t) => t.includes('/'));
+        if (pathToken)
+            out.push(pathToken);
+    }
+    return out;
+}
 // ── Parser ──────────────────────────────────────────────────────────
 /**
  * Parse a Backlog.md task markdown file into `BacklogTaskSnapshot`.
@@ -38,6 +171,10 @@ export function parseBacklogTask(content, sourcePath) {
     const dependencies = normaliseStringArray(fm.dependencies);
     const description = extractSection(content, 'Description');
     const acceptanceCriteria = extractAcceptanceCriteria(content);
+    // Strip frontmatter block before parsing body sections (the `---` block
+    // can contain `## References`-like content that would confuse body parsing).
+    const bodyOnly = content.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '');
+    const bodyReferences = parseBodyReferences(bodyOnly);
     return {
         id,
         numericId,
@@ -51,6 +188,7 @@ export function parseBacklogTask(content, sourcePath) {
         createdBy: fm.created_by ? String(fm.created_by).trim() : undefined,
         acceptanceCriteria,
         references,
+        bodyReferences,
         dependencies,
         sourcePath,
     };
@@ -308,6 +446,12 @@ export function mapBacklogTaskToAdmissionInput(snap, options = {}) {
             status: snap.status,
         },
     };
+    // ── Code-area extraction ─────────────────────────────────────────
+    // Merge frontmatter references + body references and compute the deepest
+    // common path prefix. The result is forwarded to EnrichmentContext.codeArea
+    // so admission scoring can use per-area Eρ variance instead of 0.30.
+    const allReferences = [...snap.references, ...snap.bodyReferences];
+    const codeArea = extractCodeAreaFromReferences(allReferences);
     const priorityInputOverrides = {};
     if (soulAlignment !== 0.5)
         priorityInputOverrides.soulAlignment = soulAlignment;
@@ -329,7 +473,7 @@ export function mapBacklogTaskToAdmissionInput(snap, options = {}) {
         priorityInputOverrides.defectRiskFactor = defectRiskFactor;
     if (qualityFlags.length > 0)
         priorityInputOverrides.qualityFlags = qualityFlags;
-    return { input, priorityInputOverrides, qualityFlags };
+    return { input, priorityInputOverrides, qualityFlags, codeArea };
 }
 function buildAdmissionBody(snap, complexity) {
     const parts = [];

package/dist/calibration.d.ts

@@ -10,6 +10,12 @@
  *
  * Per v1.1 note: this adjusts the multiplicative Cκ term, NOT SA-2
  * directly. Per-dimension calibration lands in PPA v1.1 §17.
+ *
+ * RFC-0009 Phase 2.2 extension: `buildSoulCalibrationMatrix` aggregates
+ * Cκ coefficients per-soul × per-dimension (N×M cells). Feedback events
+ * tagged with a soul slug as their `category` and a SA dimension drive
+ * the matrix cells. Souls × dimensions with insufficient data are omitted
+ * from the matrix (callers fall back to the scalar coefficient or 1.0).
  */
 import type { SaDimension } from './state/types.js';
 import type { SAFeedbackStore } from './sa-scoring/feedback-store.js';
@@ -40,4 +46,79 @@ export interface BuildCategoryCoefficientsInput {
  * scalar fallback applies to them.
  */
 export declare function buildCategoryCoefficients(feedback: SAFeedbackStore, input?: BuildCategoryCoefficientsInput): Record<string, number>;
+/**
+ * Input options for `buildSoulCalibrationMatrix`.
+ */
+export interface BuildSoulCalibrationMatrixInput {
+    /**
+     * Soul slugs to include in the matrix (N axis).
+     * Feedback events whose `category` matches a slug are collected.
+     */
+    souls: readonly string[];
+    /**
+     * SA dimensions to include in the matrix (M axis).
+     * When absent, all SA dimensions are sampled.
+     */
+    dimensions?: readonly SaDimension[];
+    /** Trailing-window filter (ISO timestamp). */
+    since?: string;
+    /**
+     * Minimum feedback event count per (soul, dimension) cell before a
+     * coefficient is emitted. Cells below this threshold are omitted from
+     * the matrix — callers should fall back to 1.0 (neutral) for absent cells.
+     */
+    minSampleSize?: number;
+}
+/**
+ * The N×M Cκ calibration matrix for a tessellated platform.
+ *
+ *   cells[soulSlug][dimension] = calibration coefficient in [0.7, 1.3]
+ *
+ * Cells omitted from the map have insufficient feedback data.
+ * Callers treat absent cells as 1.0 (neutral, no calibration adjustment).
+ */
+export interface SoulCalibrationMatrix {
+    /**
+     * N×M map: `{ soulSlug: { saDimension: coefficient } }`.
+     * Only cells with sufficient data are present.
+     */
+    cells: Record<string, Record<string, number>>;
+    /**
+     * Souls (N axis) included in this matrix — equal to `input.souls`.
+     * Useful for distinguishing "soul has data but coefficient is neutral"
+     * from "soul was not included in the query".
+     */
+    souls: readonly string[];
+    /**
+     * SA dimensions (M axis) sampled — equal to `input.dimensions` when
+     * provided, or all dimensions found in the feedback window.
+     */
+    dimensions: readonly string[];
+}
+/**
+ * Aggregate Cκ calibration coefficients per-soul × per-dimension (N×M cells).
+ *
+ * Feedback events tagged with:
+ *   - `category = <soul-slug>` (identifies which soul the feedback is for)
+ *   - `dimension = <SA-1 | SA-2>` (SA dimension the feedback applies to)
+ *
+ * ...drive the per-cell coefficient using the same formula as
+ * `computeCalibrationCoefficient`.
+ *
+ * Usage in tessellated admission scoring (RFC-0009 §6):
+ *   - Look up `matrix.cells[targetSoul][dimension]` for the effective Cκ
+ *   - Fall back to 1.0 (neutral) when the cell is absent (insufficient data)
+ *   - Cross-soul aggregate: apply `crossSoulScoringRule` over per-soul cells
+ *
+ * @example
+ * ```ts
+ * const matrix = buildSoulCalibrationMatrix(feedback, {
+ *   souls: ['soul-a', 'soul-b', 'soul-c'],
+ *   dimensions: ['SA-1', 'SA-2'],
+ *   minSampleSize: 5,
+ * });
+ * const ckSoulA = matrix.cells['soul-a']?.['SA-1'] ?? 1.0;
+ * ```
+ */
+export declare function buildSoulCalibrationMatrix(feedback: SAFeedbackStore, input: BuildSoulCalibrationMatrixInput): SoulCalibrationMatrix;
 //# sourceMappingURL=calibration.d.ts.map

package/dist/calibration.js

@@ -10,6 +10,12 @@
  *
  * Per v1.1 note: this adjusts the multiplicative Cκ term, NOT SA-2
  * directly. Per-dimension calibration lands in PPA v1.1 §17.
+ *
+ * RFC-0009 Phase 2.2 extension: `buildSoulCalibrationMatrix` aggregates
+ * Cκ coefficients per-soul × per-dimension (N×M cells). Feedback events
+ * tagged with a soul slug as their `category` and a SA dimension drive
+ * the matrix cells. Souls × dimensions with insufficient data are omitted
+ * from the matrix (callers fall back to the scalar coefficient or 1.0).
  */
 export const CALIBRATION_MIN = 0.7;
 export const CALIBRATION_MAX = 1.3;
@@ -73,4 +79,74 @@ export function buildCategoryCoefficients(feedback, input = {}) {
     }
     return result;
 }
+/** All recognized SA dimensions for default matrix columns. */
+const ALL_SA_DIMENSIONS = ['SA-1', 'SA-2'];
+/**
+ * Aggregate Cκ calibration coefficients per-soul × per-dimension (N×M cells).
+ *
+ * Feedback events tagged with:
+ *   - `category = <soul-slug>` (identifies which soul the feedback is for)
+ *   - `dimension = <SA-1 | SA-2>` (SA dimension the feedback applies to)
+ *
+ * ...drive the per-cell coefficient using the same formula as
+ * `computeCalibrationCoefficient`.
+ *
+ * Usage in tessellated admission scoring (RFC-0009 §6):
+ *   - Look up `matrix.cells[targetSoul][dimension]` for the effective Cκ
+ *   - Fall back to 1.0 (neutral) when the cell is absent (insufficient data)
+ *   - Cross-soul aggregate: apply `crossSoulScoringRule` over per-soul cells
+ *
+ * @example
+ * ```ts
+ * const matrix = buildSoulCalibrationMatrix(feedback, {
+ *   souls: ['soul-a', 'soul-b', 'soul-c'],
+ *   dimensions: ['SA-1', 'SA-2'],
+ *   minSampleSize: 5,
+ * });
+ * const ckSoulA = matrix.cells['soul-a']?.['SA-1'] ?? 1.0;
+ * ```
+ */
+export function buildSoulCalibrationMatrix(feedback, input) {
+    const dims = input.dimensions ?? ALL_SA_DIMENSIONS;
+    const cells = {};
+    for (const soul of input.souls) {
+        const soulCells = {};
+        for (const dim of dims) {
+            const window = { dimension: dim, since: input.since };
+            const events = feedback.list(window).filter((e) => e.category === soul);
+            if (events.length === 0)
+                continue;
+            const bucket = {
+                accepts: 0,
+                dismisses: 0,
+                escalates: 0,
+                overrides: 0,
+            };
+            for (const e of events) {
+                switch (e.signal) {
+                    case 'accept':
+                        bucket.accepts++;
+                        break;
+                    case 'dismiss':
+                        bucket.dismisses++;
+                        break;
+                    case 'escalate':
+                        bucket.escalates++;
+                        break;
+                    case 'override':
+                        bucket.overrides = (bucket.overrides ?? 0) + 1;
+                        break;
+                }
+            }
+            const sampleSize = bucket.accepts + bucket.dismisses + bucket.escalates;
+            if (sampleSize < (input.minSampleSize ?? 1))
+                continue;
+            soulCells[dim] = computeCalibrationCoefficient(bucket);
+        }
+        if (Object.keys(soulCells).length > 0) {
+            cells[soul] = soulCells;
+        }
+    }
+    return { cells, souls: input.souls, dimensions: dims };
+}
 //# sourceMappingURL=calibration.js.map

package/dist/cli/commands/git-remote.js

@@ -29,7 +29,7 @@ export function parseRemoteUrl(url) {
         return { org: sshShort[1].split('/').slice(-1)[0], repo: sshShort[2], detected: true };
     }
     // SSH or HTTPS with a scheme
-    let parsed = null;
+    let parsed;
     try {
         parsed = new URL(trimmed);
     }