@ai-sdlc/orchestrator 0.4.0 → 0.6.0

package/dist/action-enforcement.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Action enforcement — checks shell commands against blockedActions
+ * patterns from AgentRole constraints. Prevents agents from executing
+ * dangerous operations like merging PRs, force-pushing, or dismissing reviews.
+ */
+import type { AuditLog } from '@ai-sdlc/reference';
+export interface ActionEnforcementResult {
+    allowed: boolean;
+    /** The pattern that matched, if blocked. */
+    matchedPattern?: string;
+    /** The full command that was checked. */
+    command: string;
+}
+/**
+ * Check if a shell command is allowed by the blocked actions policy.
+ */
+export declare function checkAction(command: string, blockedActions: string[]): ActionEnforcementResult;
+/**
+ * Check an action and record the result in the audit log if blocked.
+ */
+export declare function enforceAction(command: string, blockedActions: string[], auditLog?: AuditLog, agentName?: string): ActionEnforcementResult;
+/**
+ * Default blocked actions for all agents.
+ */
+export declare const DEFAULT_BLOCKED_ACTIONS: string[];
+//# sourceMappingURL=action-enforcement.d.ts.map

package/dist/action-enforcement.js

@@ -0,0 +1,70 @@
+/**
+ * Action enforcement — checks shell commands against blockedActions
+ * patterns from AgentRole constraints. Prevents agents from executing
+ * dangerous operations like merging PRs, force-pushing, or dismissing reviews.
+ */
+/**
+ * Convert a glob-like blocked action pattern to a regex.
+ * Supports * (any characters) anywhere in the pattern.
+ */
+function patternToRegex(pattern) {
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+    const regexStr = escaped.replace(/\*/g, '.*');
+    return new RegExp(`^${regexStr}$`, 'i');
+}
+/**
+ * Check if a shell command is allowed by the blocked actions policy.
+ */
+export function checkAction(command, blockedActions) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return { allowed: true, command: trimmed };
+    for (const pattern of blockedActions) {
+        const regex = patternToRegex(pattern);
+        if (regex.test(trimmed)) {
+            return {
+                allowed: false,
+                matchedPattern: pattern,
+                command: trimmed,
+            };
+        }
+    }
+    return { allowed: true, command: trimmed };
+}
+/**
+ * Check an action and record the result in the audit log if blocked.
+ */
+export function enforceAction(command, blockedActions, auditLog, agentName) {
+    const result = checkAction(command, blockedActions);
+    if (!result.allowed && auditLog) {
+        auditLog.record({
+            actor: agentName ?? 'agent',
+            action: 'execute',
+            resource: `command/${result.command.slice(0, 100)}`,
+            decision: 'denied',
+            details: {
+                reason: 'blocked-action',
+                pattern: result.matchedPattern,
+                command: result.command,
+            },
+        });
+    }
+    return result;
+}
+/**
+ * Default blocked actions for all agents.
+ */
+export const DEFAULT_BLOCKED_ACTIONS = [
+    'gh pr merge*',
+    'git merge*',
+    'git push --force*',
+    'git push -f*',
+    'gh pr close*',
+    'gh issue close*',
+    'git branch -D*',
+    'git branch -d*',
+    'git reset --hard*',
+    'git checkout -- .',
+    'git restore .',
+];
+//# sourceMappingURL=action-enforcement.js.map

package/dist/adapters.d.ts

@@ -3,7 +3,8 @@
  * webhook bridge, git-based adapter resolver, and adapter registry/scanner
  * into the dogfood pipeline.
  */
-import { type AdapterRegistry, type ScanOptions, type ScanResult, type WebhookBridge, type GitAdapterFetcher, type GitResolveResult, type AuditLog, type AuditSink, type Sandbox, type SecretStore, type MemoryStore, type EventBus, type CIPipeline } from '@ai-sdlc/reference';
+import type { AiSdlcConfig } from './config.js';
+import { type IssueTracker, type AdapterRegistry, type ScanOptions, type ScanResult, type WebhookBridge, type GitAdapterFetcher, type GitResolveResult, type AuditLog, type AuditSink, type Sandbox, type SecretStore, type MemoryStore, type EventBus, type CIPipeline } from '@ai-sdlc/reference';
 /**
  * Create an adapter registry pre-loaded with all built-in and community adapters.
  */
@@ -55,6 +56,20 @@ export declare function scanPipelineAdapters(options: ScanOptions): Promise<Scan
  * Requires `GITHUB_REPOSITORY_OWNER` and `GITHUB_REPOSITORY` env vars.
  */
 export declare function createPipelineCIAdapter(): CIPipeline;
-export { createGitHubCIPipeline, createDockerSandbox, createLinearIssueTracker, resolveSecret, createGitLabSourceControl, createGitLabCIPipeline, createJiraIssueTracker, createBacklogMdIssueTracker, createWebhookServer, createGitHubWebhookProvider, verifyGitHubSignature, createGitLabWebhookProvider, verifyGitLabToken, createJiraWebhookProvider, createLinearWebhookProvider, verifyLinearSignature, createAdapterRegistry, validateAdapterMetadata, parseMetadataYaml, scanLocalAdapters, createStubCodeAnalysis, createStubMessenger, createStubDeploymentTarget, createStubGitLabCI, createStubGitLabSource, createStubJira, createStubBitbucket, createStubSonarQube, createStubSemgrep, createInMemoryAuditSink, createFileSink, createEnvSecretStore, createInMemoryMemoryStore, createInProcessEventBus, createStubSandbox, createWebhookBridge, parseGitAdapterRef, buildRawUrl, createGitAdapterFetcher, createStubGitAdapterFetcher, resolveGitAdapter, } from '@ai-sdlc/reference';
-export type { AdapterRegistry, AdapterMetadata, AdapterStability, AdapterFactory, MetadataValidationResult, ScanOptions, ScanResult, WebhookBridge, WebhookTransformer, GitAdapterReference, GitAdapterFetcher, GitResolveResult, CIPipeline, CodeAnalysis, Messenger, DeploymentTarget, EventBus, IssueTracker, LinearClientLike, IssueComment, AdapterInterfaces, EventStream, IssueFilter, CommitStatus, TestResults, CoverageReport, Finding, SeveritySummary, DeploymentStatus, StubCodeAnalysisConfig, StubCodeAnalysisAdapter, NotificationLogEntry, StubMessengerAdapter, StubDeploymentTargetAdapter, StubGitLabCIAdapter, StubGitLabSourceAdapter, StubJiraAdapter, StubBitbucketAdapter, StubSonarQubeConfig, StubSonarQubeAdapter, StubSemgrepConfig, StubSemgrepAdapter, AuditSink, AuditLog, InMemoryAuditSink, SecretStore, Sandbox, MemoryStore, InMemoryMemoryStore, InProcessEventBus, DockerSandboxConfig, BuildStatus, GitLabConfig, JiraConfig, BacklogMdConfig, BacklogFs, WebhookServer, WebhookServerConfig, WebhookProviderConfig, GitHubWebhookConfig, GitHubWebhookBridges, GitLabWebhookConfig, JiraWebhookConfig, LinearWebhookConfig, } from '@ai-sdlc/reference';
+/**
+ * Resolve an IssueTracker from the adapterBindings in config.
+ *
+ * - 0 bindings → falls back to GitHub IssueTracker
+ * - 1 binding → returns that tracker directly
+ * - N bindings → wraps in CompositeIssueTracker
+ */
+export declare function resolveIssueTrackerFromConfig(config: AiSdlcConfig, fallbackGitHubConfig: {
+    org: string;
+    repo: string;
+    token: {
+        secretRef: string;
+    };
+}): IssueTracker;
+export { createGitHubCIPipeline, createDockerSandbox, createLinearIssueTracker, resolveSecret, createGitLabSourceControl, createGitLabCIPipeline, createJiraIssueTracker, createBacklogMdIssueTracker, createWebhookServer, createGitHubWebhookProvider, verifyGitHubSignature, createGitLabWebhookProvider, verifyGitLabToken, createJiraWebhookProvider, createLinearWebhookProvider, verifyLinearSignature, createAdapterRegistry, validateAdapterMetadata, parseMetadataYaml, scanLocalAdapters, createStubCodeAnalysis, createStubMessenger, createStubDeploymentTarget, createStubGitLabCI, createStubGitLabSource, createStubJira, createStubBitbucket, createStubSonarQube, createStubSemgrep, createInMemoryAuditSink, createFileSink, createEnvSecretStore, createInMemoryMemoryStore, createInProcessEventBus, createStubSandbox, createCompositeIssueTracker, createWebhookBridge, parseGitAdapterRef, buildRawUrl, createGitAdapterFetcher, createStubGitAdapterFetcher, resolveGitAdapter, } from '@ai-sdlc/reference';
+export type { AdapterRegistry, AdapterMetadata, AdapterStability, AdapterFactory, MetadataValidationResult, ScanOptions, ScanResult, WebhookBridge, WebhookTransformer, GitAdapterReference, GitAdapterFetcher, GitResolveResult, CIPipeline, CodeAnalysis, Messenger, DeploymentTarget, EventBus, IssueTracker, LinearClientLike, IssueComment, AdapterInterfaces, EventStream, IssueFilter, CommitStatus, TestResults, CoverageReport, Finding, SeveritySummary, DeploymentStatus, StubCodeAnalysisConfig, StubCodeAnalysisAdapter, NotificationLogEntry, StubMessengerAdapter, StubDeploymentTargetAdapter, StubGitLabCIAdapter, StubGitLabSourceAdapter, StubJiraAdapter, StubBitbucketAdapter, StubSonarQubeConfig, StubSonarQubeAdapter, StubSemgrepConfig, StubSemgrepAdapter, AuditSink, AuditLog, InMemoryAuditSink, SecretStore, Sandbox, MemoryStore, InMemoryMemoryStore, InProcessEventBus, DockerSandboxConfig, BuildStatus, GitLabConfig, JiraConfig, BacklogMdConfig, BacklogFs, WebhookServer, WebhookServerConfig, WebhookProviderConfig, GitHubWebhookConfig, GitHubWebhookBridges, GitLabWebhookConfig, JiraWebhookConfig, LinearWebhookConfig, CompositeIssueTrackerConfig, BackendRoute, } from '@ai-sdlc/reference';
 //# sourceMappingURL=adapters.d.ts.map

package/dist/adapters.js

@@ -14,6 +14,8 @@ createStubCodeAnalysis, createStubMessenger, createStubDeploymentTarget, createS
 createInMemoryAuditSink, createFileSink, createAuditLog, createEnvSecretStore, createInMemoryMemoryStore, createInProcessEventBus, createStubSandbox, 
 // Docker sandbox
 createDockerSandbox, 
+// OpenShell sandbox
+createOpenShellSandbox, 
 // Backlog.md adapter
 createBacklogMdIssueTracker, 
 // Webhook bridge (used in function body)
@@ -21,7 +23,13 @@ createWebhookBridge,
 // Git resolver (used in function bodies)
 createStubGitAdapterFetcher, createGitAdapterFetcher, resolveGitAdapter, 
 // GitHub CI adapter
-createGitHubCIPipeline, } from '@ai-sdlc/reference';
+createGitHubCIPipeline, 
+// GitHub issue tracker
+createGitHubIssueTracker, 
+// Composite issue tracker
+createCompositeIssueTracker, 
+// Production adapters (for resolveIssueTrackerFromConfig)
+createJiraIssueTracker, createLinearIssueTracker, } from '@ai-sdlc/reference';
 /**
  * Create an adapter registry pre-loaded with all built-in and community adapters.
  */
@@ -69,6 +77,24 @@ export function createPipelineAdapterRegistry() {
         };
         return createDockerSandbox(exec, config);
     });
+    registry.register(stubMeta('openshell-sandbox', 'OpenShell Sandbox', 'Sandbox@v1', 'openshell'), () => {
+        const exec = async (cmd) => {
+            const { exec: cpExec } = await import('node:child_process');
+            const { promisify } = await import('node:util');
+            const execAsync = promisify(cpExec);
+            const { stdout } = await execAsync(cmd);
+            return stdout;
+        };
+        const config = {
+            workDir: process.env.AI_SDLC_WORK_DIR,
+            binaryPath: process.env.AI_SDLC_OPENSHELL_BIN,
+            autoProviders: [
+                { name: 'claude', type: 'claude' },
+                { name: 'github', type: 'github' },
+            ],
+        };
+        return createOpenShellSandbox(exec, config);
+    });
     registry.register(stubMeta('env-secret-store', 'Environment Secret Store', 'SecretStore@v1', 'env'), () => createEnvSecretStore());
     registry.register(stubMeta('memory-store', 'In-Memory Memory Store', 'MemoryStore@v1', 'memory'), () => createInMemoryMemoryStore());
     registry.register(stubMeta('in-process-event-bus', 'In-Process Event Bus', 'EventBus@v1', 'in-process'), () => createInProcessEventBus());
@@ -87,7 +113,12 @@ export function resolveInfrastructure(registry, config) {
     const auditLog = createAuditLog(auditSink);
     // Resolve from registry — factories are guaranteed present when using
     // createPipelineAdapterRegistry(), but we guard for custom registries.
-    const sandboxProvider = process.env.AI_SDLC_SANDBOX_PROVIDER === 'docker' ? 'docker-sandbox' : 'stub-sandbox';
+    const sandboxEnv = process.env.AI_SDLC_SANDBOX_PROVIDER;
+    const sandboxProvider = sandboxEnv === 'openshell'
+        ? 'openshell-sandbox'
+        : sandboxEnv === 'docker'
+            ? 'docker-sandbox'
+            : 'stub-sandbox';
     const sandbox = registry.getFactory(sandboxProvider)?.() ?? createStubSandbox();
     const secretStore = registry.getFactory('env-secret-store')?.() ??
         createEnvSecretStore();
@@ -140,6 +171,63 @@ export function createPipelineCIAdapter() {
         workflowFile: process.env.AI_SDLC_WORKFLOW_FILE ?? DEFAULT_WORKFLOW_FILE,
     });
 }
+// ── Issue tracker resolution from config ────────────────────────────
+/**
+ * Resolve an IssueTracker from the adapterBindings in config.
+ *
+ * - 0 bindings → falls back to GitHub IssueTracker
+ * - 1 binding → returns that tracker directly
+ * - N bindings → wraps in CompositeIssueTracker
+ */
+export function resolveIssueTrackerFromConfig(config, fallbackGitHubConfig) {
+    const bindings = (config.adapterBindings ?? []).filter((b) => b.spec.interface === 'IssueTracker');
+    if (bindings.length === 0) {
+        return createGitHubIssueTracker(fallbackGitHubConfig);
+    }
+    const backends = bindings.map((binding) => {
+        const cfg = binding.spec.config ?? {};
+        switch (binding.spec.type) {
+            case 'backlog-md':
+                return {
+                    prefix: cfg.taskPrefix ?? 'AISDLC',
+                    adapter: createBacklogMdIssueTracker({
+                        backlogDir: cfg.backlogDir ?? './backlog',
+                        taskPrefix: cfg.taskPrefix,
+                    }),
+                };
+            case 'github':
+                return {
+                    prefix: null,
+                    adapter: createGitHubIssueTracker({
+                        org: cfg.org ?? fallbackGitHubConfig.org,
+                        repo: cfg.repo ?? fallbackGitHubConfig.repo,
+                        token: fallbackGitHubConfig.token,
+                    }),
+                };
+            case 'jira':
+                return {
+                    prefix: cfg.projectKey ?? null,
+                    adapter: createJiraIssueTracker(cfg),
+                };
+            case 'linear':
+                return {
+                    prefix: cfg.teamKey ?? null,
+                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                    adapter: createLinearIssueTracker(cfg),
+                };
+            default:
+                // Unknown type — fall back to GitHub
+                return {
+                    prefix: null,
+                    adapter: createGitHubIssueTracker(fallbackGitHubConfig),
+                };
+        }
+    });
+    if (backends.length === 1) {
+        return backends[0].adapter;
+    }
+    return createCompositeIssueTracker({ backends });
+}
 // Direct re-exports (passthrough)
 export { 
 // Core adapters
@@ -158,6 +246,8 @@ createAdapterRegistry, validateAdapterMetadata, parseMetadataYaml, scanLocalAdap
 createStubCodeAnalysis, createStubMessenger, createStubDeploymentTarget, createStubGitLabCI, createStubGitLabSource, createStubJira, createStubBitbucket, createStubSonarQube, createStubSemgrep, 
 // Infrastructure adapter stubs
 createInMemoryAuditSink, createFileSink, createEnvSecretStore, createInMemoryMemoryStore, createInProcessEventBus, createStubSandbox, 
+// Composite issue tracker
+createCompositeIssueTracker, 
 // Webhook bridge
 createWebhookBridge, 
 // Git resolver

package/dist/admission-score.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Issue admission scoring — maps GitHub issue fields to PPA dimensions
+ * and determines whether an issue should enter the pipeline.
+ *
+ * Extracted from dogfood/scripts/ppa-score.ts for reuse across CLI
+ * scripts and workflows.
+ */
+import { type PriorityInput, type PriorityScore, type PriorityConfig } from './priority.js';
+/**
+ * GitHub author_association values indicating trust level.
+ * OWNER/MEMBER/COLLABORATOR = trusted (project team)
+ * CONTRIBUTOR = semi-trusted (has had PRs merged)
+ * NONE = untrusted (external)
+ */
+export type AuthorAssociation = 'OWNER' | 'MEMBER' | 'COLLABORATOR' | 'CONTRIBUTOR' | 'FIRST_TIMER' | 'FIRST_TIME_CONTRIBUTOR' | 'NONE';
+export interface AdmissionInput {
+    issueNumber: number;
+    title: string;
+    body: string;
+    labels: string[];
+    /** Total thumbsUp + heart reactions. */
+    reactionCount: number;
+    /** Number of human comments. */
+    commentCount: number;
+    /** ISO timestamp of issue creation. */
+    createdAt: string;
+    /** GitHub author_association — determines trust-based signal boosting. */
+    authorAssociation?: AuthorAssociation;
+}
+export interface AdmissionThresholds {
+    minimumScore: number;
+    minimumConfidence: number;
+}
+export interface IssueAdmissionResult {
+    admitted: boolean;
+    score: PriorityScore;
+    reason: string;
+    suggestions?: string[];
+}
+/**
+ * Map GitHub issue fields to PPA PriorityInput dimensions.
+ *
+ * Heuristics (ported from dogfood/scripts/ppa-score.ts):
+ * - Labels → bug severity, soul alignment hints, builder conviction
+ * - Reactions → team consensus, customer request count
+ * - Comments → demand signal
+ * - Body complexity section → complexity score
+ * - Issue age → competitive drift
+ */
+export declare function mapIssueToPriorityInput(input: AdmissionInput): PriorityInput;
+/**
+ * Score a GitHub issue for pipeline admission using the Product Priority Algorithm.
+ *
+ * Returns whether the issue is admitted (score and confidence above thresholds)
+ * along with the full score and, if rejected, suggestions for improvement.
+ */
+export declare function scoreIssueForAdmission(input: AdmissionInput, thresholds: AdmissionThresholds, priorityConfig?: PriorityConfig): IssueAdmissionResult;
+//# sourceMappingURL=admission-score.d.ts.map

package/dist/admission-score.js

@@ -0,0 +1,164 @@
+/**
+ * Issue admission scoring — maps GitHub issue fields to PPA dimensions
+ * and determines whether an issue should enter the pipeline.
+ *
+ * Extracted from dogfood/scripts/ppa-score.ts for reuse across CLI
+ * scripts and workflows.
+ */
+import { computePriority, } from './priority.js';
+// ── Mapping ──────────────────────────────────────────────────────────
+/**
+ * Map GitHub issue fields to PPA PriorityInput dimensions.
+ *
+ * Heuristics (ported from dogfood/scripts/ppa-score.ts):
+ * - Labels → bug severity, soul alignment hints, builder conviction
+ * - Reactions → team consensus, customer request count
+ * - Comments → demand signal
+ * - Body complexity section → complexity score
+ * - Issue age → competitive drift
+ */
+export function mapIssueToPriorityInput(input) {
+    const labels = input.labels;
+    const assoc = input.authorAssociation ?? 'NONE';
+    // ── Trust-based signal boosting ────────────────────────────────
+    // Trusted sources (project team) get baseline conviction and demand.
+    // Untrusted sources need external validation (reactions, comments).
+    const isTrusted = assoc === 'OWNER' || assoc === 'MEMBER' || assoc === 'COLLABORATOR';
+    const isContributor = assoc === 'CONTRIBUTOR';
+    // ── Complexity from issue body ───────────────────────────────
+    const complexityMatch = input.body?.match(/###?\s*Complexity\s*\n+\s*(\d+)/i);
+    const complexity = complexityMatch ? Number(complexityMatch[1]) : undefined;
+    // ── Bug severity from labels ─────────────────────────────────
+    let bugSeverity;
+    if (labels.includes('critical') || labels.includes('P0'))
+        bugSeverity = 5;
+    else if (labels.includes('bug'))
+        bugSeverity = 3;
+    // ── Soul alignment heuristic from labels ─────────────────────
+    let soulAlignment = 0.5;
+    if (labels.includes('security') || labels.includes('security-triage'))
+        soulAlignment = 0.7;
+    if (labels.includes('enhancement'))
+        soulAlignment = 0.6;
+    if (labels.includes('governance') || labels.includes('compliance'))
+        soulAlignment = 0.85;
+    if (labels.includes('spec') || labels.includes('rfc'))
+        soulAlignment = 0.9;
+    // Trusted authors get a soul alignment floor — they know the project mission
+    if (isTrusted && soulAlignment < 0.6)
+        soulAlignment = 0.6;
+    // ── Reactions → demand / consensus ───────────────────────────
+    const reactionConsensus = Math.min(1, input.reactionCount / 5);
+    // Trusted sources carry implicit team consensus
+    const teamConsensus = isTrusted ? Math.max(0.5, reactionConsensus) : reactionConsensus;
+    // ── Comment count → demand signal ────────────────────────────
+    const commentDemand = Math.min(1, input.commentCount / 5);
+    // Trusted sources filing an issue IS demand — they wouldn't file it otherwise
+    const demandSignal = isTrusted
+        ? Math.max(0.4, commentDemand)
+        : isContributor
+            ? Math.max(0.2, commentDemand)
+            : commentDemand;
+    // ── Builder conviction ─────────────────────────────────────────
+    // Trusted: high conviction (they're the builders)
+    // Contributor: moderate (proven track record)
+    // ai-eligible label: explicit signal
+    // Default: low (needs validation)
+    const builderConviction = labels.includes('ai-eligible')
+        ? 0.8
+        : isTrusted
+            ? 0.8
+            : isContributor
+                ? 0.6
+                : 0.4;
+    // ── Age → competitive drift ──────────────────────────────────
+    const ageMs = Date.now() - new Date(input.createdAt).getTime();
+    const ageDays = ageMs / (1000 * 60 * 60 * 24);
+    const competitiveDrift = Math.min(1, Math.max(0, (ageDays - 30) / 180));
+    // ── Security-rejected veto ───────────────────────────────────
+    if (labels.includes('security-rejected')) {
+        return {
+            itemId: `#${input.issueNumber}`,
+            title: input.title,
+            description: input.body ?? '',
+            labels,
+            soulAlignment: 0, // veto
+        };
+    }
+    return {
+        itemId: `#${input.issueNumber}`,
+        title: input.title,
+        description: input.body ?? '',
+        labels,
+        soulAlignment,
+        bugSeverity,
+        customerRequestCount: input.reactionCount,
+        demandSignal,
+        builderConviction,
+        complexity,
+        competitiveDrift,
+        teamConsensus,
+        explicitPriority: labels.includes('high') ? 0.8 : labels.includes('low') ? 0.2 : undefined,
+    };
+}
+// ── Suggestions ──────────────────────────────────────────────────────
+function generateSuggestions(input, score) {
+    const suggestions = [];
+    const d = score.dimensions;
+    if (score.confidence < 0.2) {
+        suggestions.push('Add more detail to improve scoring confidence (complexity, acceptance criteria, labels)');
+    }
+    if (!input.body?.match(/###?\s*Complexity\s*\n/i)) {
+        suggestions.push('Add a `### Complexity` section with a score from 1-10');
+    }
+    if (!input.body?.match(/###?\s*Acceptance Criteria/i)) {
+        suggestions.push('Add an `### Acceptance Criteria` section with testable criteria');
+    }
+    if (input.body.length < 50) {
+        suggestions.push('Provide a more detailed description of the problem or feature');
+    }
+    const assoc = input.authorAssociation ?? 'NONE';
+    const isTrusted = assoc === 'OWNER' || assoc === 'MEMBER' || assoc === 'COLLABORATOR';
+    if (d.demandPressure < 0.3 && !isTrusted) {
+        suggestions.push('Low demand signal — add reactions or comments to show interest');
+    }
+    if (d.soulAlignment < 0.5) {
+        suggestions.push('Add labels that indicate alignment with the project mission (e.g., governance, spec, security)');
+    }
+    return suggestions;
+}
+// ── Public API ───────────────────────────────────────────────────────
+/**
+ * Score a GitHub issue for pipeline admission using the Product Priority Algorithm.
+ *
+ * Returns whether the issue is admitted (score and confidence above thresholds)
+ * along with the full score and, if rejected, suggestions for improvement.
+ */
+export function scoreIssueForAdmission(input, thresholds, priorityConfig) {
+    const priorityInput = mapIssueToPriorityInput(input);
+    const score = computePriority(priorityInput, priorityConfig);
+    const scorePasses = score.composite >= thresholds.minimumScore;
+    const confidencePasses = score.confidence >= thresholds.minimumConfidence;
+    const admitted = scorePasses && confidencePasses;
+    if (admitted) {
+        return {
+            admitted: true,
+            score,
+            reason: `Score ${score.composite.toFixed(4)} meets threshold ${thresholds.minimumScore} with ${(score.confidence * 100).toFixed(0)}% confidence`,
+        };
+    }
+    const reasons = [];
+    if (!scorePasses) {
+        reasons.push(`score ${score.composite.toFixed(4)} below minimum ${thresholds.minimumScore}`);
+    }
+    if (!confidencePasses) {
+        reasons.push(`confidence ${(score.confidence * 100).toFixed(0)}% below minimum ${(thresholds.minimumConfidence * 100).toFixed(0)}%`);
+    }
+    return {
+        admitted: false,
+        score,
+        reason: `Not admitted: ${reasons.join('; ')}`,
+        suggestions: generateSuggestions(input, score),
+    };
+}
+//# sourceMappingURL=admission-score.js.map

package/dist/cli/commands/init.js

@@ -134,24 +134,20 @@ spec:
       action: demote-one-level
       cooldown: 2w
 `;
-const GITIGNORE_ENTRIES = [
-    '# AI-SDLC runtime artifacts',
-    '.ai-sdlc/state.db',
-    '.ai-sdlc/state/',
-    '.ai-sdlc/audit.jsonl',
-];
+const GITIGNORE_PATHS = ['.ai-sdlc/state.db', '.ai-sdlc/state/', '.ai-sdlc/audit.jsonl'];
 /** Ensure .gitignore includes AI-SDLC runtime artifact entries. */
 function ensureGitignore(projectDir, dryRun, prefix = '') {
     const gitignorePath = join(projectDir, '.gitignore');
     const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf-8') : '';
-    const missing = GITIGNORE_ENTRIES.filter((entry) => !existing.includes(entry));
+    // Only check path entries (not comments) to avoid duplicate blocks
+    const missing = GITIGNORE_PATHS.filter((entry) => !existing.includes(entry));
     if (missing.length === 0)
         return;
     if (dryRun) {
         console.log(`${prefix}  Would update .gitignore`);
         return;
     }
-    const block = '\n' + missing.join('\n') + '\n';
+    const block = '\n# AI-SDLC runtime artifacts\n' + missing.join('\n') + '\n';
     appendFileSync(gitignorePath, block, 'utf-8');
     console.log(`${prefix}  updated .gitignore`);
 }

package/dist/cli/commands/run.js

@@ -6,7 +6,7 @@ import { Orchestrator } from '../../orchestrator.js';
 import { formatOutput } from '../formatters/index.js';
 export const runCommand = new Command('run')
     .description('Run the AI-SDLC pipeline for a specific issue')
-    .requiredOption('-i, --issue <number>', 'Issue number to process', parseInt)
+    .requiredOption('-i, --issue <id>', 'Issue ID to process')
     .option('--state <path>', 'SQLite state database path')
     .action(async (opts, cmd) => {
     const globalOpts = cmd.parent?.opts() ?? {};
@@ -19,7 +19,7 @@ export const runCommand = new Command('run')
         const result = await orchestrator.run(opts.issue);
         console.log(formatOutput(format, {
             type: 'run',
-            issueNumber: opts.issue,
+            issueId: opts.issue,
             prUrl: result.prUrl,
             filesChanged: result.filesChanged.length,
             promotionEligible: result.promotionEligible,

package/dist/config.d.ts

@@ -11,7 +11,10 @@ export interface AiSdlcConfig {
     agentRole?: AgentRole;
     qualityGate?: QualityGate;
     autonomyPolicy?: AutonomyPolicy;
+    /** @deprecated Use `adapterBindings` instead. Returns the first binding if any exist. */
     adapterBinding?: AdapterBinding;
+    /** All AdapterBinding resources found in the config directory. */
+    adapterBindings?: AdapterBinding[];
     adapterRegistry?: AdapterRegistry;
 }
 /**

package/dist/config.js

@@ -9,12 +9,12 @@ import { readFileSync, readdirSync, existsSync } from 'node:fs';
 import { resolve, join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
 import { validateResource, createAdapterRegistry, scanLocalAdapters, } from '@ai-sdlc/reference';
+/** Resource kinds that allow only a single instance. */
 const KIND_KEY = {
     Pipeline: 'pipeline',
     AgentRole: 'agentRole',
     QualityGate: 'qualityGate',
     AutonomyPolicy: 'autonomyPolicy',
-    AdapterBinding: 'adapterBinding',
 };
 /**
  * Load all YAML files from the given directory, validate each against
@@ -39,11 +39,20 @@ export function loadConfig(configDir) {
             throw new Error(`Validation failed for ${file}:\n${msgs}`);
         }
         const resource = result.data;
-        const key = KIND_KEY[resource.kind];
-        if (key) {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            config[key] = resource;
+        if (resource.kind === 'AdapterBinding') {
+            (config.adapterBindings ??= []).push(resource);
         }
+        else {
+            const key = KIND_KEY[resource.kind];
+            if (key) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                config[key] = resource;
+            }
+        }
+    }
+    // Backward compat: set adapterBinding to the first binding
+    if (config.adapterBindings?.length) {
+        config.adapterBinding = config.adapterBindings[0];
     }
     return config;
 }

package/dist/cycle-utils.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Utility functions for cycle detection and handling.
+ */
+import type { IssueTracker } from '@ai-sdlc/reference';
+import { PipelineCycleDetector, type PipelineStage } from './pipeline-cycle-detector.js';
+export interface CycleHandlerOptions {
+    /** Issue or PR identifier. */
+    issueOrPrId: string;
+    /** Stage being invoked. */
+    stage: PipelineStage;
+    /** Issue tracker for fetching/posting comments. */
+    tracker: IssueTracker;
+    /** Cycle detector instance. */
+    detector: PipelineCycleDetector;
+    /** Optional Slack notification callback. */
+    notifySlack?: (message: string) => Promise<void>;
+    /** Custom cycle notification template (optional). */
+    cycleTemplate?: {
+        title: string;
+        body: string;
+    };
+}
+export interface CycleCheckResult {
+    /** Whether a cycle was detected. */
+    cycleDetected: boolean;
+    /** Marker to append to comments for tracking. */
+    marker: string;
+    /** Formatted message describing the cycle (if detected). */
+    cycleMessage?: string;
+}
+/**
+ * Check for pipeline cycles and post notification if detected.
+ *
+ * The marker is generated upfront so the caller can append it to comments
+ * BEFORE executing the stage (records intent, prevents race conditions).
+ * Cycle detection accounts for the pending invocation (+1 to current count).
+ */
+export declare function checkAndHandleCycle(options: CycleHandlerOptions): Promise<CycleCheckResult>;
+/**
+ * Create a cycle detector from pipeline config.
+ * Reads maxRetries from stage configurations.
+ */
+export declare function createCycleDetectorFromConfig(config: {
+    stages?: Array<{
+        name: string;
+        onFailure?: {
+            maxRetries?: number;
+        };
+    }>;
+}): PipelineCycleDetector;
+//# sourceMappingURL=cycle-utils.d.ts.map