@ai-sdlc/orchestrator 0.4.0 → 0.5.0

package/dist/execute.js

@@ -5,13 +5,13 @@
  *   load config -> fetch issue -> validate -> check autonomy ->
  *   create branch -> invoke agent -> authorize -> validate -> push -> create PR -> comment
  */
-import { createGitHubIssueTracker, createGitHubSourceControl, routeByComplexity, evaluatePromotion, evaluateComplexity, selectModel, withSpan, getMeter, SPAN_NAMES, METRIC_NAMES, ATTRIBUTE_KEYS, } from '@ai-sdlc/reference';
+import { createGitHubSourceControl, routeByComplexity, evaluatePromotion, evaluateComplexity, selectModel, withSpan, getMeter, SPAN_NAMES, METRIC_NAMES, ATTRIBUTE_KEYS, } from '@ai-sdlc/reference';
 import { loadConfigAsync } from './config.js';
 import { validateIssue, validateIssueWithExtensions, parseComplexity } from './validate-issue.js';
 import { createLogger } from './logger.js';
 import { createStructuredConsoleLogger, createStructuredBufferLogger, } from './structured-logger.js';
 import { ClaudeCodeRunner } from './runners/claude-code.js';
-import { execFileAsync, getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, isAutonomousStrategy, recordMetric, validateAndAuditOutput, evaluatePipelineCompliance, authorizeFilesChanged, interpolateBranchPattern, interpolatePRTitle, } from './shared.js';
+import { execFileAsync, getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, isAutonomousStrategy, recordMetric, validateAndAuditOutput, evaluatePipelineCompliance, authorizeFilesChanged, interpolateBranchPattern, interpolatePRTitle, issueIdToNumber, formatIssueRef, } from './shared.js';
 import { checkKillSwitch, issueAgentCredentials, revokeAgentCredentials, classifyAndSubmitApproval, createPipelineSecurity, } from './security.js';
 import { createPipelineOrchestration, executePipelineOrchestration, validatePipelineHandoffs, } from './orchestration.js';
 import { createPipelineProvenance, attachProvenanceToPR, validatePipelineProvenance, } from './provenance.js';
@@ -21,7 +21,9 @@ import { createPipelineExpressionEvaluator, createPipelineLLMEvaluator, createPi
 import { verifyAuditIntegrity, createFileAuditLog, loadAuditEntries, computeAuditHash, } from './audit-extended.js';
 import { renderTemplate } from './notifications.js';
 import { admitIssueResource, createPipelineAdmission, } from './admission.js';
-import { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, scanPipelineAdapters, } from './adapters.js';
+import { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, scanPipelineAdapters, resolveIssueTrackerFromConfig, } from './adapters.js';
+import { existsSync, readFileSync, appendFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { defaultSandboxConstraints, DEFAULT_CONFIG_DIR_NAME, DEFAULT_PR_FOOTER, NOTIFICATION_TITLES, } from './defaults.js';
 import { checkFrameworkCompliance, getControlCatalog, getFrameworkMappings, listSupportedFrameworks, } from './compliance-extended.js';
 import { createSilentLogger, withPipelineSpanSync, getPipelineTracer, validateResourceSchema, } from './telemetry-extended.js';
@@ -31,9 +33,9 @@ import { CostTracker } from './cost-tracker.js';
 import { enrichAgentContext } from './context-enrichment.js';
 import { reportGateCheckRuns } from './check-runs.js';
 /**
- * Execute the full AI-SDLC pipeline for a given issue number.
+ * Execute the full AI-SDLC pipeline for a given issue ID.
  */
-export async function executePipeline(issueNumber, options = {}) {
+export async function executePipeline(issueId, options = {}) {
     const workDir = options.workDir ?? (await resolveRepoRoot());
     const configDir = options.configDir ?? `${workDir}/${DEFAULT_CONFIG_DIR_NAME}`;
     const log = options.logger ??
@@ -86,22 +88,22 @@ export async function executePipeline(issueNumber, options = {}) {
     // 2. Create adapters (or use injected ones)
     const { org, repo } = getGitHubConfig(options.secretStore);
     const ghConfig = { org, repo, token: { secretRef: 'github-token' } };
-    const tracker = options.tracker ?? createGitHubIssueTracker(ghConfig);
+    const tracker = options.tracker ?? resolveIssueTrackerFromConfig(config, ghConfig);
     const sc = options.sourceControl ?? createGitHubSourceControl(ghConfig);
     // 3. Fetch issue
     log.stage('validate-issue');
-    const issue = await tracker.getIssue(String(issueNumber));
+    const issue = await tracker.getIssue(issueId);
     // Store issue context in working memory if provided
     if (options.memory) {
         options.memory.working.set('currentIssue', {
-            number: issueNumber,
+            issueId,
             title: issue.title,
             description: issue.description,
         });
     }
     // Wrap pipeline body in try/catch to record failure episodes
     try {
-        return await executePipelineBody(issueNumber, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir);
+        return await executePipelineBody(issueId, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir);
     }
     catch (err) {
         // Record failure episode before rethrowing
@@ -109,18 +111,19 @@ export async function executePipeline(issueNumber, options = {}) {
             options.memory.episodic.append({
                 key: 'pipeline-execution',
                 value: {
-                    issueNumber,
+                    issueId,
                     outcome: 'failure',
                     error: err instanceof Error ? err.message : String(err),
                 },
-                metadata: { summary: `Failed issue #${issueNumber}: ${issue.title}` },
+                metadata: { summary: `Failed issue ${formatIssueRef(issueId)}: ${issue.title}` },
             });
             options.memory.working.clear();
         }
         throw err;
     }
 }
-async function executePipelineBody(issueNumber, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir) {
+async function executePipelineBody(issueId, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir) {
+    const issueNumber = issueIdToNumber(issueId);
     const meter = getMeter();
     // Discovery: register agent and resolve by issue labels
     const discovery = createPipelineDiscovery();
@@ -167,7 +170,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             auditLog.record({
                 actor: 'system',
                 action: 'evaluate',
-                resource: `issue#${issueNumber}`,
+                resource: `issue#${issueId}`,
                 policy: qualityGate.metadata.name,
                 decision: 'denied',
                 details: {
@@ -183,13 +186,13 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             const gateFailTitle = gateFailTpl
                 ? renderTemplate(gateFailTpl, { details: failures }).title
                 : NOTIFICATION_TITLES.issueValidationFailed;
-            await tracker.addComment(String(issueNumber), `## ${gateFailTitle}\n\n${gateFailBody}`);
-            throw new Error(`Issue #${issueNumber} failed quality gate validation`);
+            await tracker.addComment(issueId, `## ${gateFailTitle}\n\n${gateFailBody}`);
+            throw new Error(`Issue ${formatIssueRef(issueId)} failed quality gate validation:\n${failures}`);
         }
         auditLog.record({
             actor: 'system',
             action: 'evaluate',
-            resource: `issue#${issueNumber}`,
+            resource: `issue#${issueId}`,
             policy: qualityGate.metadata.name,
             decision: 'allowed',
         });
@@ -202,7 +205,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     auditLog.record({
         actor: 'system',
         action: 'route',
-        resource: `issue#${issueNumber}`,
+        resource: `issue#${issueId}`,
         decision: isAutonomousStrategy(strategy) ? 'allowed' : 'denied',
         details: { score: complexity, strategy },
     });
@@ -214,21 +217,21 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
                 title: NOTIFICATION_TITLES.complexityTooHigh,
                 body: `Issue complexity (${complexity}) routed as "${strategy}" — requires human involvement.`,
             };
-        await tracker.addComment(String(issueNumber), `## ${complexityComment.title}\n\n${complexityComment.body}`);
-        throw new Error(`Issue #${issueNumber} complexity ${complexity} routed as "${strategy}"`);
+        await tracker.addComment(issueId, `## ${complexityComment.title}\n\n${complexityComment.body}`);
+        throw new Error(`Issue ${formatIssueRef(issueId)} complexity ${complexity} routed as "${strategy}"`);
     }
     // Approval workflow check (after routing, before agent)
     if (options.security) {
-        const approval = await classifyAndSubmitApproval(options.security, complexity, agentRole.metadata.name, `Execute pipeline for issue #${issueNumber}`);
+        const approval = await classifyAndSubmitApproval(options.security, complexity, agentRole.metadata.name, `Execute pipeline for issue ${formatIssueRef(issueId)}`);
         if (approval.status === 'pending') {
-            throw new Error(`Issue #${issueNumber} requires approval (tier: ${approval.tier}) — status is pending`);
+            throw new Error(`Issue ${formatIssueRef(issueId)} requires approval (tier: ${approval.tier}) — status is pending`);
         }
     }
     // 6. Check autonomy level allows coding
     const currentLevel = resolveAutonomyLevel(autonomyPolicy);
     log.stageEnd('validate-issue');
     // 7. Create branch and checkout locally (read pattern from pipeline config)
-    const branchVars = { issueNumber: String(issueNumber), issueTitle: issue.title };
+    const branchVars = { issueNumber: issueId, issueTitle: issue.title };
     const branchName = interpolateBranchPattern(config.pipeline?.spec.branching?.pattern, branchVars);
     await sc.createBranch({ name: branchName });
     await execFileAsync('git', ['fetch', 'origin', branchName], { cwd: workDir });
@@ -248,6 +251,9 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             log.info(`Model selected: ${modelResult.model} (${modelResult.reason})`);
         }
     }
+    // 8b. Ensure .gitignore covers runtime artifacts so the agent doesn't
+    //     re-add entries on every run.
+    ensureRuntimeGitignore(workDir);
     // 9. Invoke agent (with sandbox + JIT credential lifecycle when security is provided)
     log.stage('agent');
     const runner = options.runner ?? new ClaudeCodeRunner();
@@ -258,7 +264,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     try {
         if (options.security) {
             const timeoutMs = codeStage?.timeout ? parseDuration(codeStage.timeout) : undefined;
-            sandboxId = await options.security.sandbox.isolate(`issue-${issueNumber}`, defaultSandboxConstraints(workDir, timeoutMs));
+            sandboxId = await options.security.sandbox.isolate(`issue-${issueId}`, defaultSandboxConstraints(workDir, timeoutMs));
         }
         // Issue JIT credentials before agent execution
         const jitCred = options.security
@@ -272,7 +278,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             // Enrich agent context with episodic memory
             const episodicContext = options.stateStore
                 ? enrichAgentContext(options.stateStore, {
-                    issueNumber,
+                    issueNumber: issueNumber ?? undefined,
                     agentName: effectiveAgent.metadata.name,
                     files: result ? result.filesChanged : undefined,
                 })
@@ -280,9 +286,10 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             const orchestrationResult = await executePipelineOrchestration(plan, [effectiveAgent], async (agent) => {
                 return withSpan(SPAN_NAMES.AGENT_TASK, {
                     [ATTRIBUTE_KEYS.AGENT]: agent.metadata.name,
-                    [ATTRIBUTE_KEYS.RESOURCE_NAME]: `issue#${issueNumber}`,
+                    [ATTRIBUTE_KEYS.RESOURCE_NAME]: `issue#${issueId}`,
                 }, () => runner.run({
-                    issueNumber,
+                    issueId,
+                    issueNumber: issueNumber ?? undefined,
                     issueTitle: issue.title,
                     issueBody: issue.description ?? '',
                     workDir,
@@ -296,6 +303,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
                     memory: options.memory,
                     codebaseContext: options.codebaseContext,
                     episodicContext,
+                    sandboxId,
                 }));
             });
             // Extract the AgentResult from orchestration output
@@ -319,8 +327,8 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
                 const agentFailComment = agentFailTpl
                     ? renderTemplate(agentFailTpl, { stageName: 'code', details: errorDetail })
                     : { title: NOTIFICATION_TITLES.agentFailed, body: errorDetail };
-                await tracker.addComment(String(issueNumber), `## ${agentFailComment.title}\n\n${agentFailComment.body}`);
-                throw new Error(`Agent failed on issue #${issueNumber}: ${err}`);
+                await tracker.addComment(issueId, `## ${agentFailComment.title}\n\n${agentFailComment.body}`);
+                throw new Error(`Agent failed on issue ${formatIssueRef(issueId)}: ${err}`);
             }
             result = stepOutput;
             log.stageEnd('agent');
@@ -367,7 +375,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             auditLog,
             log,
             onViolation: async (violationList) => {
-                await tracker.addComment(String(issueNumber), `## ${NOTIFICATION_TITLES.guardrailViolations}\n\n${violationList}`);
+                await tracker.addComment(issueId, `## ${NOTIFICATION_TITLES.guardrailViolations}\n\n${violationList}`);
             },
         });
     });
@@ -396,7 +404,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             auditLog.record({
                 actor: 'system',
                 action: 'evaluate',
-                resource: `issue#${issueNumber}`,
+                resource: `issue#${issueId}`,
                 policy: 'post-agent-gates',
                 decision: gateResults.every((g) => g.verdict === 'pass') ? 'allowed' : 'denied',
                 details: {
@@ -423,7 +431,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
         auditLog.record({
             actor: 'system',
             action: 'evaluate',
-            resource: `issue#${issueNumber}`,
+            resource: `issue#${issueId}`,
             policy: 'post-agent-complexity',
             decision: 'allowed',
             details: {
@@ -468,9 +476,14 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             promptText: issue.description,
             cost: costReceipt,
         });
-        provenanceBlock = '\n\n' + attachProvenanceToPR(provenance);
+        let provenanceText = attachProvenanceToPR(provenance);
+        // Include priority score in provenance section when available
+        if (options.priorityScore) {
+            provenanceText += `\n- **Priority Score**: ${options.priorityScore.composite.toFixed(4)} (confidence: ${options.priorityScore.confidence.toFixed(2)})`;
+        }
+        provenanceBlock = '\n\n' + provenanceText;
     }
-    const prVars = { issueNumber: String(issueNumber), issueTitle: issue.title };
+    const prVars = { issueNumber: issueId, issueTitle: issue.title };
     const prTitle = interpolatePRTitle(prConfig?.titleTemplate, prVars);
     const closeKeyword = prConfig?.closeKeyword ?? 'Closes';
     const targetBranch = config.pipeline?.spec.branching?.targetBranch ?? 'main';
@@ -486,7 +499,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             if (section === 'changes')
                 parts.push('## Changes', '', result.filesChanged.map((f) => `- \`${f}\``).join('\n'));
             if (section === 'closes')
-                parts.push('', `${closeKeyword} #${issueNumber}`);
+                parts.push('', `${closeKeyword} ${formatIssueRef(issueId)}`);
         }
         const footer = options.prFooter ?? DEFAULT_PR_FOOTER;
         parts.push('', '---', footer);
@@ -504,7 +517,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             action: 'create',
             resource: 'pull-request',
             decision: 'allowed',
-            details: { prUrl: prResult.url, issueNumber },
+            details: { prUrl: prResult.url, issueId },
         });
         return prResult;
     });
@@ -514,15 +527,15 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     const prCreatedComment = prCreatedTemplate
         ? renderTemplate(prCreatedTemplate, {
             prUrl: pr.url,
-            issueNumber: String(issueNumber),
+            issueNumber: issueId,
         })
         : { title: NOTIFICATION_TITLES.prCreated, body: `Pull request created: ${pr.url}` };
-    await tracker.addComment(String(issueNumber), `## ${prCreatedComment.title}\n\n${prCreatedComment.body}`);
+    await tracker.addComment(issueId, `## ${prCreatedComment.title}\n\n${prCreatedComment.body}`);
     // 14b. Record cost from agent result
     if (options.costTracker && result.tokenUsage) {
         const tu = result.tokenUsage;
         options.costTracker.recordCost({
-            runId: `run-${Date.now()}-${issueNumber}`,
+            runId: `run-${Date.now()}-${issueId}`,
             agentName: agentRole.metadata.name,
             pipelineType: 'execute',
             model: tu.model,
@@ -530,7 +543,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             outputTokens: tu.outputTokens,
             cacheReadTokens: tu.cacheReadTokens,
             stageName: 'code',
-            issueNumber,
+            issueNumber: issueNumber ?? undefined,
         });
     }
     // 14c. Record task outcome in autonomy tracker
@@ -617,18 +630,35 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     }
     // 17. Record episodic memory (success)
     if (options.memory) {
+        const episodicValue = {
+            issueId,
+            prUrl: pr.url,
+            filesChanged: result.filesChanged.length,
+            outcome: 'success',
+        };
+        if (options.priorityScore) {
+            episodicValue.priorityComposite = options.priorityScore.composite;
+            episodicValue.priorityConfidence = options.priorityScore.confidence;
+        }
         options.memory.episodic.append({
             key: 'pipeline-execution',
-            value: {
-                issueNumber,
-                prUrl: pr.url,
-                filesChanged: result.filesChanged.length,
-                outcome: 'success',
-            },
-            metadata: { summary: `Completed issue #${issueNumber}: ${issue.title}` },
+            value: episodicValue,
+            metadata: { summary: `Completed issue ${formatIssueRef(issueId)}: ${issue.title}` },
         });
         options.memory.working.clear();
     }
+    // 17b. Record priority calibration sample for feedback loop
+    if (options.stateStore && options.priorityScore) {
+        options.stateStore.savePrioritySample({
+            issueId,
+            priorityComposite: options.priorityScore.composite,
+            priorityConfidence: options.priorityScore.confidence,
+            priorityDimensions: JSON.stringify(options.priorityScore.dimensions),
+            actualComplexity: complexity,
+            filesChanged: result.filesChanged.length,
+            outcome: 'success',
+        });
+    }
     // 18. Audit integrity verification (non-blocking)
     if (options.auditFilePath) {
         try {
@@ -738,4 +768,29 @@ function runPipelineDiagnostics(input) {
         // which would empty it before artifact upload can capture the contents.
     }
 }
+// ── Gitignore helper ─────────────────────────────────────────────────
+const RUNTIME_GITIGNORE_ENTRIES = [
+    '# AI-SDLC runtime artifacts',
+    '.ai-sdlc/state.db',
+    '.ai-sdlc/state/',
+    '.ai-sdlc/audit.jsonl',
+];
+/**
+ * Ensure .gitignore in the working directory covers AI-SDLC runtime artifacts.
+ * Without this the agent sees untracked runtime files and appends duplicate
+ * gitignore entries on every run.
+ */
+function ensureRuntimeGitignore(workDir) {
+    try {
+        const gitignorePath = join(workDir, '.gitignore');
+        const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf-8') : '';
+        const missing = RUNTIME_GITIGNORE_ENTRIES.filter((entry) => !existing.includes(entry));
+        if (missing.length === 0)
+            return;
+        appendFileSync(gitignorePath, '\n' + missing.join('\n') + '\n', 'utf-8');
+    }
+    catch {
+        // Best-effort — workDir may not exist yet in tests or dry-run scenarios
+    }
+}
 //# sourceMappingURL=execute.js.map

package/dist/fix-ci.js

@@ -8,7 +8,7 @@ import { loadConfig } from './config.js';
 import { createLogger } from './logger.js';
 import { createStructuredConsoleLogger } from './structured-logger.js';
 import { ClaudeCodeRunner } from './runners/claude-code.js';
-import { execFileAsync, getGitHubConfig, extractIssueNumber, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, recordMetric, validateAndAuditOutput, authorizeFilesChanged, } from './shared.js';
+import { execFileAsync, getGitHubConfig, extractIssueId, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, recordMetric, validateAndAuditOutput, authorizeFilesChanged, issueIdToNumber, } from './shared.js';
 import { renderTemplate } from './notifications.js';
 import { parseDuration } from './policy-evaluators.js';
 import { checkKillSwitch, issueAgentCredentials, revokeAgentCredentials, } from './security.js';
@@ -157,24 +157,25 @@ export async function executeFixCI(prNumber, runId, options = {}) {
         cwd: workDir,
     });
     const currentBranch = branchStdout.trim();
-    const issueNumber = extractIssueNumber(currentBranch);
-    if (issueNumber === null) {
-        throw new Error(`Branch "${currentBranch}" does not match ai-sdlc/issue-N pattern`);
+    const issueId = extractIssueId(currentBranch);
+    if (issueId === null) {
+        throw new Error(`Branch "${currentBranch}" does not match ai-sdlc/issue-<id> pattern`);
     }
+    const issueNumber = issueIdToNumber(issueId);
     // 5. Resolve autonomy level and constraints
     const currentLevel = resolveAutonomyLevel(autonomyPolicy);
     const resolved = resolveConstraints(agentRole.spec.constraints, currentLevel);
     // 6. Fetch issue data (via tracker when available)
-    let issueTitle = `Issue #${issueNumber}`;
+    let issueTitle = `Issue ${issueId}`;
     let issueBody = '';
     if (trackerAvailable) {
-        const issueData = await getTracker().getIssue(String(issueNumber));
+        const issueData = await getTracker().getIssue(issueId);
         issueTitle = issueData.title;
         issueBody = issueData.description ?? '';
     }
     // Store issue context in working memory
     if (options.memory) {
-        options.memory.working.set('currentIssue', { prNumber, issueNumber, currentBranch });
+        options.memory.working.set('currentIssue', { prNumber, issueId, currentBranch });
     }
     // Query episodic memory for previous fix-CI attempts
     if (options.memory) {
@@ -195,7 +196,7 @@ export async function executeFixCI(prNumber, runId, options = {}) {
         try {
             if (options.security) {
                 const timeoutMs = codeStage?.timeout ? parseDuration(codeStage.timeout) : undefined;
-                sandboxId = await options.security.sandbox.isolate(`issue-${issueNumber}`, defaultSandboxConstraints(workDir, timeoutMs));
+                sandboxId = await options.security.sandbox.isolate(`issue-${issueId}`, defaultSandboxConstraints(workDir, timeoutMs));
             }
             // Issue JIT credentials before agent execution
             const jitCred = options.security
@@ -207,7 +208,8 @@ export async function executeFixCI(prNumber, runId, options = {}) {
                     [ATTRIBUTE_KEYS.RESOURCE_NAME]: `pr#${prNumber}`,
                 }, async () => {
                     const r = await runner.run({
-                        issueNumber,
+                        issueId,
+                        issueNumber: issueNumber ?? undefined,
                         issueTitle,
                         issueBody,
                         workDir,
@@ -349,7 +351,7 @@ export async function executeFixCI(prNumber, runId, options = {}) {
                 key: 'fix-ci-execution',
                 value: {
                     prNumber,
-                    issueNumber,
+                    issueId,
                     filesChanged: result.filesChanged.length,
                     outcome: 'success',
                 },
@@ -365,7 +367,7 @@ export async function executeFixCI(prNumber, runId, options = {}) {
                 key: 'fix-ci-execution',
                 value: {
                     prNumber,
-                    issueNumber,
+                    issueId,
                     outcome: 'failure',
                     error: err instanceof Error ? err.message : String(err),
                 },

package/dist/index.d.ts

@@ -5,7 +5,8 @@ export { validateAgentOutput, type ValidationContext, type ValidationResult, typ
 export { createLogger, type Logger } from './logger.js';
 export { validateConfigFiles, type FileValidationResult } from './validate-config.js';
 export { executeFixCI, countRetryAttempts, fetchCILogs, type FixCIOptions } from './fix-ci.js';
-export { getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, mergeBlockedPaths, isAutonomousStrategy, recordMetric, validateAndAuditOutput, createPipelineMemory, evaluatePipelineCompliance, authorizeFilesChanged, extractIssueNumber, BRANCH_PATTERN, createAbacPermissionHook, createBlockedPathsHook, createAuditLoggingHook, createPipelineAuthorizationChain, type GitHubEnvConfig, type ValidateAndAuditParams, } from './shared.js';
+export { executeTriage, type TriageOptions, type TriageResult } from './triage.js';
+export { getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, mergeBlockedPaths, isAutonomousStrategy, recordMetric, validateAndAuditOutput, createPipelineMemory, evaluatePipelineCompliance, authorizeFilesChanged, extractIssueNumber, extractIssueId, issueIdToNumber, formatIssueRef, BRANCH_PATTERN, createAbacPermissionHook, createBlockedPathsHook, createAuditLoggingHook, createPipelineAuthorizationChain, type GitHubEnvConfig, type ValidateAndAuditParams, } from './shared.js';
 export { DEFAULT_MODEL, DEFAULT_GITHUB_ORG, DEFAULT_GITHUB_REPO, DEFAULT_GITHUB_REPOSITORY, DEFAULT_CONFIG_DIR_NAME, DEFAULT_SANDBOX_MEMORY_MB, DEFAULT_SANDBOX_CPU_PERCENT, DEFAULT_SANDBOX_NETWORK_POLICY, DEFAULT_SANDBOX_TIMEOUT_MS, defaultSandboxConstraints, DEFAULT_RUNNER_TIMEOUT_MS, DEFAULT_ALLOWED_TOOLS, DEFAULT_MAX_FILES_PER_CHANGE, DEFAULT_REQUIRE_TESTS, DEFAULT_BLOCKED_PATHS, DEFAULT_MAX_FIX_ATTEMPTS, DEFAULT_MAX_LOG_LINES, DEFAULT_GH_CLI_TIMEOUT_MS, DEFAULT_JIT_TTL_MS, DEFAULT_JIT_SCOPE, DEFAULT_BRANCH_TEMPLATE, DEFAULT_BRANCH_PATTERN, DEFAULT_PR_TITLE_TEMPLATE, DEFAULT_PR_FOOTER, DEFAULT_COMPLEXITY_THRESHOLDS, DEFAULT_MAX_LINES_PER_PR, DEFAULT_ANALYSIS_INCLUDE, DEFAULT_ANALYSIS_EXCLUDE, DEFAULT_GIT_HISTORY_DAYS, DEFAULT_HOTSPOT_THRESHOLD, NOTIFICATION_TITLES, DEFAULT_MODEL_COSTS, DEFAULT_COST_BUDGET_USD, DEFAULT_DASHBOARD_REFRESH_MS, PROGRESSIVE_GATE_PROFILES, DEFAULT_LINT_COMMAND, DEFAULT_FORMAT_COMMAND, DEFAULT_COMMIT_MESSAGE_TEMPLATE, DEFAULT_COMMIT_CO_AUTHOR, DEFAULT_OPENAI_API_URL, DEFAULT_OPENAI_MODEL, DEFAULT_ANTHROPIC_API_URL, DEFAULT_ANTHROPIC_MODEL, DEFAULT_GENERIC_LLM_MODEL, DEFAULT_LLM_TIMEOUT_MS, DEFAULT_LLM_MAX_TOKENS, DEFAULT_LLM_SYSTEM_PROMPT, DEFAULT_DOCKER_IMAGE, DEFAULT_WORKFLOW_FILE, DEFAULT_LABEL_TO_SKILL_MAP, DEFAULT_ANALYSIS_CACHE_TTL_MS, } from './defaults.js';
 export type { ComplexityBand, GateProfile } from './defaults.js';
 export { renderTemplate } from './notifications.js';
@@ -16,19 +17,20 @@ export { createPipelineMetricStore, createInstrumentedEnforcement, createInstrum
 export { createPipelineDiscovery, findMatchingAgent, resolveAgentForIssue, matchAgentBySkill, createStubAgentCardFetcher, createPipelineAgentCardFetcher, } from './discovery.js';
 export { createStructuredConsoleLogger, createStructuredBufferLogger, } from './structured-logger.js';
 export { startWatch, type WatchOptions, type WatchHandle } from './watch.js';
+export { computePriority, rankWorkItems, type PriorityScore, type PriorityInput, type PriorityConfig, } from './priority.js';
 export { createPipelineOrchestration, executePipelineOrchestration, validatePipelineHandoffs, sequential, parallel, hybrid, hierarchical, swarm, validateHandoff, simpleSchemaValidate, } from './orchestration.js';
 export { createPipelineRegoEvaluator, createPipelineCELEvaluator, createPipelineABACHook, createPipelineExpressionEvaluator, createPipelineLLMEvaluator, evaluatePipelineGate, scorePipelineComplexity, evaluatePipelineComplexityRouting, } from './policy-evaluators.js';
-export { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, resolveInfrastructure, scanPipelineAdapters, } from './adapters.js';
+export { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, resolveInfrastructure, resolveIssueTrackerFromConfig, scanPipelineAdapters, } from './adapters.js';
 export { createPipelineReconciler, createGateReconciler, createAutonomyReconciler, hasResourceChanged, fingerprintResource, } from './reconcilers.js';
 export { createFileAuditLog, verifyAuditIntegrity, loadAuditEntries, rotateAuditLog, computeAuditHash, } from './audit-extended.js';
 export { checkFrameworkCompliance, getControlCatalog, getFrameworkMappings, listSupportedFrameworks, } from './compliance-extended.js';
 export { createSilentLogger, withPipelineSpanSync, getPipelineTracer, validateResourceSchema, } from './telemetry-extended.js';
-export { ClaudeCodeRunner, ClaudeCodeRunner as GitHubActionsRunner, GenericLLMRunner, CopilotRunner, CursorRunner, CodexRunner, RunnerRegistry, createRunnerRegistry, type AgentRunner, type AgentContext, type AgentResult, type GenericLLMConfig, type RegisteredRunner, } from './runners/index.js';
+export { ClaudeCodeRunner, ClaudeCodeRunner as GitHubActionsRunner, GenericLLMRunner, CopilotRunner, CursorRunner, CodexRunner, RunnerRegistry, createRunnerRegistry, SecurityTriageRunner, type AgentRunner, type AgentContext, type AgentResult, type GenericLLMConfig, type RegisteredRunner, type SecurityTriageConfig, type TriageVerdict, } from './runners/index.js';
 export type { TokenUsage } from './runners/index.js';
 export { SlackMessenger, TeamsMessenger, NotificationRouter } from './notifications/index.js';
 export type { SlackConfig, TeamsConfig, PipelineEvent, PipelineEventType, NotificationRoute, NotificationTemplate, } from './notifications/index.js';
 export { StateStore } from './state/index.js';
-export type { HotspotRecord, RoutingDecision, CostLedgerEntry, GateThresholdOverride, AutonomyEvent, AutonomyEventType, HandoffEvent, DeploymentRecord, DeploymentRecordState, RolloutStepRecord, AuditEntryRecord, } from './state/index.js';
+export type { HotspotRecord, RoutingDecision, CostLedgerEntry, GateThresholdOverride, AutonomyEvent, AutonomyEventType, HandoffEvent, DeploymentRecord, DeploymentRecordState, RolloutStepRecord, AuditEntryRecord, PriorityCalibrationSample, } from './state/index.js';
 export { createKubernetesTarget, createVercelTarget, createFlyioTarget, createHttpMetricsCollector, createStubMetricsCollector, RolloutController, } from './deploy/index.js';
 export type { DeploymentTargetConfig, HealthCheckConfig, DeploymentState, DeploymentResult, DeploymentTarget, ExecFn, FetchFn, KubernetesConfig, VercelConfig, FlyioConfig, CanaryStep, CanaryConfig, BlueGreenConfig, RollingConfig, RolloutStrategy, RolloutPhase, RolloutStatus, RolloutMetrics, MetricsSource, RolloutControllerConfig, HttpMetricsConfig, } from './deploy/index.js';
 export { getComplexityBand, getGateProfile, adjustEnforcement, adjustGateForComplexity, adjustGatesForComplexity, computeGateAdjustments, } from './progressive-gates.js';

package/dist/index.js

@@ -6,8 +6,9 @@ export { validateAgentOutput, } from './validate-agent-output.js';
 export { createLogger } from './logger.js';
 export { validateConfigFiles } from './validate-config.js';
 export { executeFixCI, countRetryAttempts, fetchCILogs } from './fix-ci.js';
+export { executeTriage } from './triage.js';
 // Shared utilities
-export { getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, mergeBlockedPaths, isAutonomousStrategy, recordMetric, validateAndAuditOutput, createPipelineMemory, evaluatePipelineCompliance, authorizeFilesChanged, extractIssueNumber, BRANCH_PATTERN, createAbacPermissionHook, createBlockedPathsHook, createAuditLoggingHook, createPipelineAuthorizationChain, } from './shared.js';
+export { getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, mergeBlockedPaths, isAutonomousStrategy, recordMetric, validateAndAuditOutput, createPipelineMemory, evaluatePipelineCompliance, authorizeFilesChanged, extractIssueNumber, extractIssueId, issueIdToNumber, formatIssueRef, BRANCH_PATTERN, createAbacPermissionHook, createBlockedPathsHook, createAuditLoggingHook, createPipelineAuthorizationChain, } from './shared.js';
 // Defaults
 export { DEFAULT_MODEL, DEFAULT_GITHUB_ORG, DEFAULT_GITHUB_REPO, DEFAULT_GITHUB_REPOSITORY, DEFAULT_CONFIG_DIR_NAME, DEFAULT_SANDBOX_MEMORY_MB, DEFAULT_SANDBOX_CPU_PERCENT, DEFAULT_SANDBOX_NETWORK_POLICY, DEFAULT_SANDBOX_TIMEOUT_MS, defaultSandboxConstraints, DEFAULT_RUNNER_TIMEOUT_MS, DEFAULT_ALLOWED_TOOLS, DEFAULT_MAX_FILES_PER_CHANGE, DEFAULT_REQUIRE_TESTS, DEFAULT_BLOCKED_PATHS, DEFAULT_MAX_FIX_ATTEMPTS, DEFAULT_MAX_LOG_LINES, DEFAULT_GH_CLI_TIMEOUT_MS, DEFAULT_JIT_TTL_MS, DEFAULT_JIT_SCOPE, DEFAULT_BRANCH_TEMPLATE, DEFAULT_BRANCH_PATTERN, DEFAULT_PR_TITLE_TEMPLATE, DEFAULT_PR_FOOTER, DEFAULT_COMPLEXITY_THRESHOLDS, DEFAULT_MAX_LINES_PER_PR, DEFAULT_ANALYSIS_INCLUDE, DEFAULT_ANALYSIS_EXCLUDE, DEFAULT_GIT_HISTORY_DAYS, DEFAULT_HOTSPOT_THRESHOLD, NOTIFICATION_TITLES, DEFAULT_MODEL_COSTS, DEFAULT_COST_BUDGET_USD, DEFAULT_DASHBOARD_REFRESH_MS, PROGRESSIVE_GATE_PROFILES, DEFAULT_LINT_COMMAND, DEFAULT_FORMAT_COMMAND, DEFAULT_COMMIT_MESSAGE_TEMPLATE, DEFAULT_COMMIT_CO_AUTHOR, DEFAULT_OPENAI_API_URL, DEFAULT_OPENAI_MODEL, DEFAULT_ANTHROPIC_API_URL, DEFAULT_ANTHROPIC_MODEL, DEFAULT_GENERIC_LLM_MODEL, DEFAULT_LLM_TIMEOUT_MS, DEFAULT_LLM_MAX_TOKENS, DEFAULT_LLM_SYSTEM_PROMPT, DEFAULT_DOCKER_IMAGE, DEFAULT_WORKFLOW_FILE, DEFAULT_LABEL_TO_SKILL_MAP, DEFAULT_ANALYSIS_CACHE_TTL_MS, } from './defaults.js';
 // Notifications
@@ -26,12 +27,14 @@ export { createPipelineDiscovery, findMatchingAgent, resolveAgentForIssue, match
 export { createStructuredConsoleLogger, createStructuredBufferLogger, } from './structured-logger.js';
 // Watch mode
 export { startWatch } from './watch.js';
+// Priority scoring (PPA)
+export { computePriority, rankWorkItems, } from './priority.js';
 // Agent orchestration
 export { createPipelineOrchestration, executePipelineOrchestration, validatePipelineHandoffs, sequential, parallel, hybrid, hierarchical, swarm, validateHandoff, simpleSchemaValidate, } from './orchestration.js';
 // Policy evaluators
 export { createPipelineRegoEvaluator, createPipelineCELEvaluator, createPipelineABACHook, createPipelineExpressionEvaluator, createPipelineLLMEvaluator, evaluatePipelineGate, scorePipelineComplexity, evaluatePipelineComplexityRouting, } from './policy-evaluators.js';
 // Adapter ecosystem
-export { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, resolveInfrastructure, scanPipelineAdapters, } from './adapters.js';
+export { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, resolveInfrastructure, resolveIssueTrackerFromConfig, scanPipelineAdapters, } from './adapters.js';
 // Reconcilers (generalized names)
 export { createPipelineReconciler, createGateReconciler, createAutonomyReconciler, hasResourceChanged, fingerprintResource, } from './reconcilers.js';
 // Extended audit
@@ -41,7 +44,7 @@ export { checkFrameworkCompliance, getControlCatalog, getFrameworkMappings, list
 // Extended telemetry
 export { createSilentLogger, withPipelineSpanSync, getPipelineTracer, validateResourceSchema, } from './telemetry-extended.js';
 // Runners
-export { ClaudeCodeRunner, ClaudeCodeRunner as GitHubActionsRunner, GenericLLMRunner, CopilotRunner, CursorRunner, CodexRunner, RunnerRegistry, createRunnerRegistry, } from './runners/index.js';
+export { ClaudeCodeRunner, ClaudeCodeRunner as GitHubActionsRunner, GenericLLMRunner, CopilotRunner, CursorRunner, CodexRunner, RunnerRegistry, createRunnerRegistry, SecurityTriageRunner, } from './runners/index.js';
 // Notifications
 export { SlackMessenger, TeamsMessenger, NotificationRouter } from './notifications/index.js';
 // State store

package/dist/orchestrator.d.ts

@@ -74,7 +74,7 @@ export declare class Orchestrator {
     /**
      * Run the full pipeline for a single issue.
      */
-    run(issueNumber: number, overrides?: Partial<ExecuteOptions>): Promise<PipelineResult>;
+    run(issueId: string, overrides?: Partial<ExecuteOptions>): Promise<PipelineResult>;
     /**
      * Start watch mode — continuous reconciliation loop.
      */

package/dist/orchestrator.js

@@ -8,6 +8,7 @@ import { executeFixCI } from './fix-ci.js';
 import { loadConfig } from './config.js';
 import { StateStore } from './state/index.js';
 import { createLogger } from './logger.js';
+import { issueIdToNumber } from './shared.js';
 import { analyzeCodebase } from './analysis/analyzer.js';
 import { buildCodebaseContext } from './analysis/context-builder.js';
 import { DEFAULT_ANALYSIS_CACHE_TTL_MS } from './defaults.js';
@@ -48,14 +49,16 @@ export class Orchestrator {
     /**
      * Run the full pipeline for a single issue.
      */
-    async run(issueNumber, overrides) {
-        const runId = `run-${Date.now()}-${issueNumber}`;
+    async run(issueId, overrides) {
+        const issueNumber = issueIdToNumber(issueId);
+        const runId = `run-${Date.now()}-${issueId}`;
         const startedAt = new Date().toISOString();
         // Record pipeline start in state store
         if (this._state) {
             this._state.savePipelineRun({
                 runId,
-                issueNumber,
+                issueId,
+                issueNumber: issueNumber ?? undefined,
                 pipelineType: 'execute',
                 status: 'running',
                 currentStage: 'init',
@@ -84,11 +87,16 @@ export class Orchestrator {
         }
         // Notify plugins before run
         for (const plugin of this.plugins) {
-            await plugin.beforeRun?.({ runId, issueNumber, startedAt });
+            await plugin.beforeRun?.({
+                runId,
+                issueId,
+                issueNumber: issueNumber ?? undefined,
+                startedAt,
+            });
         }
         const runStart = Date.now();
         try {
-            const result = await executePipeline(issueNumber, {
+            const result = await executePipeline(issueId, {
                 configDir: this.config.configDir,
                 workDir: this.config.workDir,
                 runner: this.config.runner,
@@ -109,7 +117,8 @@ export class Orchestrator {
                     }),
                 });
                 this._state.saveEpisodicRecord({
-                    issueNumber,
+                    issueId,
+                    issueNumber: issueNumber ?? undefined,
                     pipelineType: 'execute',
                     outcome: 'success',
                     filesChanged: result.filesChanged.length,
@@ -118,7 +127,13 @@ export class Orchestrator {
             // Notify plugins after successful run
             const durationMs = Date.now() - runStart;
             for (const plugin of this.plugins) {
-                await plugin.afterRun?.({ runId, issueNumber, result, durationMs });
+                await plugin.afterRun?.({
+                    runId,
+                    issueId,
+                    issueNumber: issueNumber ?? undefined,
+                    result,
+                    durationMs,
+                });
             }
             return result;
         }
@@ -131,7 +146,8 @@ export class Orchestrator {
                     }),
                 });
                 this._state.saveEpisodicRecord({
-                    issueNumber,
+                    issueId,
+                    issueNumber: issueNumber ?? undefined,
                     pipelineType: 'execute',
                     outcome: 'failure',
                     errorMessage: err instanceof Error ? err.message : String(err),
@@ -141,7 +157,13 @@ export class Orchestrator {
             const errorDurationMs = Date.now() - runStart;
             const error = err instanceof Error ? err : new Error(String(err));
             for (const plugin of this.plugins) {
-                await plugin.onError?.({ runId, issueNumber, error, durationMs: errorDurationMs });
+                await plugin.onError?.({
+                    runId,
+                    issueId,
+                    issueNumber: issueNumber ?? undefined,
+                    error,
+                    durationMs: errorDurationMs,
+                });
             }
             throw err;
         }