@ai-sdlc/orchestrator 0.4.0 → 0.5.0

package/dist/triage.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Security triage pipeline — lightweight entry point that fetches an issue,
+ * runs the SecurityTriageRunner, posts findings as a comment, and applies
+ * a `rejected` or `triage-passed` label.
+ *
+ * **Asymmetric by design**: the triage agent can auto-reject issues above the
+ * risk threshold, but NEVER auto-approves (no `ai-ready` label).  A human
+ * must review the triage analysis and manually apply `ai-ready`.
+ */
+import type { IssueTracker } from '@ai-sdlc/reference';
+import { type SecurityTriageConfig, type TriageVerdict } from './runners/security-triage.js';
+import { type Logger } from './logger.js';
+export interface TriageOptions {
+    /** Override the issue tracker (skips config-driven resolution). */
+    tracker?: IssueTracker;
+    /** SecurityTriageRunner configuration overrides. */
+    triageConfig?: SecurityTriageConfig;
+    /** Custom logger. */
+    logger?: Logger;
+    /** Working directory for config loading. Defaults to cwd. */
+    workDir?: string;
+    /** If true, skip posting a comment to the issue. */
+    dryRun?: boolean;
+}
+export interface TriageResult {
+    issueId: string;
+    verdict: TriageVerdict;
+    /** Whether the issue was auto-rejected (riskScore >= threshold). */
+    rejected: boolean;
+    /** The label applied to the issue, if any. */
+    labelApplied?: string;
+    /** Error message if the triage pipeline failed. */
+    error?: string;
+}
+export declare function executeTriage(issueId: string, options?: TriageOptions): Promise<TriageResult>;
+//# sourceMappingURL=triage.d.ts.map

package/dist/triage.js

@@ -0,0 +1,133 @@
+/**
+ * Security triage pipeline — lightweight entry point that fetches an issue,
+ * runs the SecurityTriageRunner, posts findings as a comment, and applies
+ * a `rejected` or `triage-passed` label.
+ *
+ * **Asymmetric by design**: the triage agent can auto-reject issues above the
+ * risk threshold, but NEVER auto-approves (no `ai-ready` label).  A human
+ * must review the triage analysis and manually apply `ai-ready`.
+ */
+import { join } from 'node:path';
+import { loadConfigAsync } from './config.js';
+import { resolveIssueTrackerFromConfig } from './adapters.js';
+import { getGitHubConfig } from './shared.js';
+import { DEFAULT_CONFIG_DIR_NAME } from './defaults.js';
+import { SecurityTriageRunner, } from './runners/security-triage.js';
+import { createLogger } from './logger.js';
+// ── Labels ──────────────────────────────────────────────────────────
+const LABEL_REJECTED = 'security-rejected';
+const LABEL_TRIAGE_PASSED = 'triage-passed';
+// ── Comment formatting ──────────────────────────────────────────────
+function formatTriageComment(verdict, rejected) {
+    const icon = rejected ? '🚨' : verdict.riskScore >= 3 ? '⚠️' : '✅';
+    const status = rejected ? 'REJECTED' : 'PASSED';
+    const lines = [
+        `## ${icon} Security Triage: ${status}`,
+        '',
+        `**Risk Score:** ${verdict.riskScore}/10`,
+        `**Safe:** ${verdict.safe}`,
+        '',
+    ];
+    if (verdict.findings.length > 0) {
+        lines.push('### Findings', '');
+        for (const finding of verdict.findings) {
+            lines.push(`- ${finding}`);
+        }
+        lines.push('');
+    }
+    lines.push('### Rationale', '', verdict.rationale, '');
+    if (rejected) {
+        lines.push('---', '> This issue has been automatically rejected due to a high risk score.', '> A maintainer may override this by removing the `security-rejected` label', '> and manually applying `ai-ready` after review.');
+    }
+    else {
+        lines.push('---', '> This issue passed automated security triage.', '> A maintainer must still manually apply the `ai-ready` label to enable AI processing.');
+    }
+    lines.push('', '*Analyzed by [AI-SDLC Security Triage](https://github.com/ai-sdlc-framework/ai-sdlc)*');
+    return lines.join('\n');
+}
+// ── Pipeline ────────────────────────────────────────────────────────
+export async function executeTriage(issueId, options = {}) {
+    const workDir = options.workDir ?? process.cwd();
+    const log = options.logger ?? createLogger();
+    log.info(`[triage] Starting security triage for issue ${issueId}`);
+    // ── Resolve issue tracker ───────────────────────────────────────
+    let tracker;
+    if (options.tracker) {
+        tracker = options.tracker;
+    }
+    else {
+        const configDir = join(workDir, DEFAULT_CONFIG_DIR_NAME);
+        const config = await loadConfigAsync(configDir);
+        const ghConfig = getGitHubConfig();
+        tracker = resolveIssueTrackerFromConfig(config, {
+            org: ghConfig.org,
+            repo: ghConfig.repo,
+            token: { secretRef: 'GITHUB_TOKEN' },
+        });
+    }
+    // ── Fetch issue ─────────────────────────────────────────────────
+    const issue = await tracker.getIssue(issueId);
+    log.info(`[triage] Fetched issue: "${issue.title}"`);
+    // ── Run triage ──────────────────────────────────────────────────
+    const runner = new SecurityTriageRunner(options.triageConfig);
+    const agentResult = await runner.run({
+        issueId,
+        issueTitle: issue.title,
+        issueBody: issue.description ?? '',
+        workDir,
+        branch: 'main',
+        constraints: {
+            maxFilesPerChange: 0,
+            requireTests: false,
+            blockedPaths: ['**/*'],
+        },
+    });
+    if (!agentResult.success) {
+        log.error(`[triage] Triage failed: ${agentResult.error}`);
+        return {
+            issueId,
+            verdict: {
+                safe: false,
+                riskScore: 7,
+                findings: ['Triage pipeline error — treating as suspicious'],
+                sanitizedDescription: '',
+                rationale: agentResult.error ?? 'Unknown error',
+            },
+            rejected: true,
+            error: agentResult.error,
+        };
+    }
+    // ── Parse verdict ───────────────────────────────────────────────
+    const verdict = JSON.parse(agentResult.summary);
+    const rejected = verdict.riskScore >= runner.rejectThreshold;
+    log.info(`[triage] Verdict: riskScore=${verdict.riskScore}, safe=${verdict.safe}, rejected=${rejected}`);
+    // ── Post comment & apply label ──────────────────────────────────
+    if (!options.dryRun) {
+        const comment = formatTriageComment(verdict, rejected);
+        try {
+            await tracker.addComment(issueId, comment);
+            log.info(`[triage] Posted triage comment on issue ${issueId}`);
+        }
+        catch (err) {
+            log.error(`[triage] Failed to post comment: ${err}`);
+        }
+        const label = rejected ? LABEL_REJECTED : LABEL_TRIAGE_PASSED;
+        try {
+            const existingLabels = issue.labels ?? [];
+            await tracker.updateIssue(issueId, {
+                labels: [
+                    ...existingLabels.filter((l) => l !== LABEL_REJECTED && l !== LABEL_TRIAGE_PASSED),
+                    label,
+                ],
+            });
+            log.info(`[triage] Applied label "${label}" to issue ${issueId}`);
+            return { issueId, verdict, rejected, labelApplied: label };
+        }
+        catch (err) {
+            log.error(`[triage] Failed to apply label: ${err}`);
+            return { issueId, verdict, rejected, error: `Label application failed: ${err}` };
+        }
+    }
+    return { issueId, verdict, rejected };
+}
+//# sourceMappingURL=triage.js.map

package/dist/types.d.ts

@@ -3,7 +3,7 @@
  * Ensures all reference types are accessible through the orchestrator package
  * for downstream consumers without direct reference dependency.
  */
-export type { ApiVersion, Metadata, Condition, SecretRef, MetricCondition, Duration, Resource, TriggerFilter, Trigger, Provider, RoutingStrategy, ComplexityThreshold, Routing, Stage, PipelineSpec, PipelinePhase, PipelineStatus, Pipeline, AgentConstraints, HandoffContractRef, Handoff, SkillExample, Skill, AgentCard, AgentRoleSpec, AgentRoleStatus, AgentRole, GateScope, MetricRule, ToolRule, ReviewerRule, DocumentationRule, ProvenanceRule, ExpressionRule, GateRule, EnforcementLevel, Override, RetryPolicy, Evaluation, Gate, QualityGateSpec, QualityGateStatus, QualityGate, Permissions, ApprovalRequirement, Guardrails, MonitoringLevel, AutonomyLevel, PromotionCriteria, DemotionTrigger, AgentAutonomyStatus, AutonomyPolicySpec, AutonomyPolicyStatus, AutonomyPolicy, AdapterInterface, HealthCheck, AdapterBindingSpec, AdapterBindingStatus, AdapterBinding, AnyResource, ResourceKind, ValidationError, } from '@ai-sdlc/reference';
+export type { ApiVersion, Metadata, Condition, SecretRef, MetricCondition, Duration, Resource, TriggerFilter, Trigger, Provider, RoutingStrategy, ComplexityThreshold, Routing, Stage, PipelineSpec, PipelinePhase, PipelineStatus, Pipeline, AgentConstraints, HandoffContractRef, Handoff, SkillExample, Skill, AgentCard, AgentRoleSpec, AgentRoleStatus, AgentRole, GateScope, MetricRule, ToolRule, ReviewerRule, DocumentationRule, ProvenanceRule, ExpressionRule, GateRule, EnforcementLevel, Override, RetryPolicy, Evaluation, Gate, QualityGateSpec, QualityGateStatus, QualityGate, Permissions, ApprovalRequirement, Guardrails, MonitoringLevel, AutonomyLevel, PromotionCriteria, DemotionTrigger, AgentAutonomyStatus, AutonomyPolicySpec, AutonomyPolicyStatus, AutonomyPolicy, AdapterInterface, HealthCheck, AdapterBindingSpec, AdapterBindingStatus, AdapterBinding, AnyResource, ResourceKind, PriorityPolicy, PriorityDimensionConfig, PriorityDimensionsConfig, PriorityCalibrationConfig, PriorityAdaptersConfig, ValidationError, } from '@ai-sdlc/reference';
 export type { GateVerdict, DemotionResult, ComplexityFactor, AuthorizationContext, AuthorizationResult, AuthIdentity, AuthenticationResult, Authenticator, MutatingGateContext, ExpressionEvaluator, ExpressionVerdict, LLMEvaluationDimension, LLMEvaluationResult, LLMGateVerdict, } from '@ai-sdlc/reference';
 export type { AgentExecutionState, HandoffValidationError, SchemaResolver, SchemaValidationError, MemoryTier, MemoryEntry, WorkingMemory, ShortTermMemory, LongTermMemory, SharedMemory, EpisodicMemory, } from '@ai-sdlc/reference';
 //# sourceMappingURL=types.d.ts.map

package/dist/watch.d.ts

@@ -6,6 +6,8 @@
  */
 import { type ReconcilerConfig, type ReconcileResult, type Pipeline, type QualityGate, type AutonomyPolicy, type AgentRole, type MetricStore } from '@ai-sdlc/reference';
 import { type ExecuteOptions } from './execute.js';
+import { type PriorityInput } from './priority.js';
+import type { PriorityPolicy } from '@ai-sdlc/reference';
 export interface WatchOptions {
     /** Override the reconciler config (poll interval, concurrency, backoff). */
     reconcilerConfig?: Partial<ReconcilerConfig>;
@@ -21,10 +23,12 @@ export interface WatchOptions {
     qualityGates?: QualityGate[];
     /** Optional autonomy policies for autonomy reconciler evaluation. */
     autonomyPolicies?: AutonomyPolicy[];
+    /** Priority scoring policy configuration. */
+    priorityPolicy?: PriorityPolicy;
 }
 export interface WatchHandle {
-    /** Enqueue a pipeline resource for reconciliation. */
-    enqueue(pipeline: Pipeline, issueNumber: number): void;
+    /** Enqueue a pipeline resource for reconciliation. Optionally provide PriorityInput for scoring. */
+    enqueue(pipeline: Pipeline, issueId: string, priorityInput?: PriorityInput): void;
     /** Enqueue a quality gate resource for reconciliation. */
     enqueueGate(gate: QualityGate): void;
     /** Enqueue an autonomy policy resource for reconciliation. */

package/dist/watch.js

@@ -7,6 +7,7 @@
 import { ReconcilerLoop, createResourceCache, instrumentReconciler, } from '@ai-sdlc/reference';
 import { executePipeline } from './execute.js';
 import { createPipelineReconciler, createGateReconciler, createAutonomyReconciler, } from './reconcilers.js';
+import { computePriority } from './priority.js';
 /**
  * Start a reconciler watch loop that continuously processes pipeline resources.
  */
@@ -30,15 +31,15 @@ export function startWatch(options = {}) {
         switch (resource.kind) {
             case 'Pipeline': {
                 const pipeline = resource;
-                const issueNumber = issueMap.get(pipeline.metadata.name);
-                if (!issueNumber) {
+                const issueId = issueMap.get(pipeline.metadata.name);
+                if (!issueId) {
                     return {
                         type: 'error',
-                        error: new Error(`No issue number for pipeline ${pipeline.metadata.name}`),
+                        error: new Error(`No issue ID for pipeline ${pipeline.metadata.name}`),
                     };
                 }
                 try {
-                    await executePipeline(issueNumber, {
+                    await executePipeline(issueId, {
                         ...options.executeOptions,
                     });
                     const result = { type: 'success' };
@@ -68,9 +69,36 @@ export function startWatch(options = {}) {
     }
     const loop = new ReconcilerLoop(reconcileFn, options.reconcilerConfig);
     loop.start();
+    // Map to hold priority scores for pipelines
+    const priorityScores = new Map();
     return {
-        enqueue(pipeline, issueNumber) {
-            issueMap.set(pipeline.metadata.name, issueNumber);
+        enqueue(pipeline, issueId, priorityInput) {
+            issueMap.set(pipeline.metadata.name, issueId);
+            // Priority scoring when policy is enabled
+            if (options.priorityPolicy?.enabled && priorityInput) {
+                const config = options.priorityPolicy.dimensions?.humanCurveWeights
+                    ? { humanCurveWeights: options.priorityPolicy.dimensions.humanCurveWeights }
+                    : undefined;
+                const score = computePriority(priorityInput, config);
+                // Skip items below minimum score
+                if (options.priorityPolicy.minimumScore !== undefined &&
+                    score.composite < options.priorityPolicy.minimumScore) {
+                    return;
+                }
+                // Flag items below minimum confidence (still enqueue, but mark)
+                if (options.priorityPolicy.minimumConfidence !== undefined &&
+                    score.confidence < options.priorityPolicy.minimumConfidence) {
+                    // Store the score with a low-confidence flag for downstream consumers
+                    priorityScores.set(pipeline.metadata.name, score);
+                }
+                else {
+                    priorityScores.set(pipeline.metadata.name, score);
+                }
+                if (cache.shouldReconcile(pipeline)) {
+                    loop.enqueue(pipeline, score.composite);
+                }
+                return;
+            }
             if (cache.shouldReconcile(pipeline)) {
                 loop.enqueue(pipeline);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdlc/orchestrator",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "AI-SDLC Orchestrator — long-running runtime that drives issues through the complete SDLC with AI agents",
   "license": "Apache-2.0",
   "repository": {
@@ -45,11 +45,12 @@
     "better-sqlite3": "^11.0.0",
     "commander": "^12.0.0",
     "yaml": "^2.7.0",
-    "@ai-sdlc/reference": "0.4.0"
+    "@ai-sdlc/reference": "0.5.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.0",
     "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "^3.2.4",
     "tsx": "^4.19.0",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
@@ -58,6 +59,7 @@
     "build": "tsc",
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "test:watch": "vitest"
   }
 }