@ai-sdlc/orchestrator 0.4.0 → 0.6.0

package/dist/cycle-utils.js

@@ -0,0 +1,77 @@
+/**
+ * Utility functions for cycle detection and handling.
+ */
+import { PipelineCycleDetector } from './pipeline-cycle-detector.js';
+import { NOTIFICATION_TITLES } from './defaults.js';
+/**
+ * Sanitize template content to prevent markdown/HTML injection.
+ * Strips HTML tags and limits length.
+ */
+function sanitizeTemplate(text) {
+    return text.replace(/<[^>]*>/g, '').slice(0, 2000);
+}
+/**
+ * Check for pipeline cycles and post notification if detected.
+ *
+ * The marker is generated upfront so the caller can append it to comments
+ * BEFORE executing the stage (records intent, prevents race conditions).
+ * Cycle detection accounts for the pending invocation (+1 to current count).
+ */
+export async function checkAndHandleCycle(options) {
+    const { issueOrPrId, stage, tracker, detector, notifySlack, cycleTemplate } = options;
+    // Detect cycles from existing comment markers (no +1 — marker is separate)
+    const cycleResult = await detector.detectCycle(tracker, issueOrPrId);
+    // Generate marker for the caller to append to comments
+    const marker = detector.recordInvocation(stage);
+    if (cycleResult.cycleDetected) {
+        const loopingSummary = cycleResult.loopingStages
+            .map((s) => `- **${s.stage}**: ${s.count}/${s.max} invocations`)
+            .join('\n');
+        const title = sanitizeTemplate(cycleTemplate?.title ?? NOTIFICATION_TITLES.pipelineCycleDetected);
+        const body = sanitizeTemplate(cycleTemplate?.body ??
+            `The pipeline has detected an infinite loop across the following stages:\n\n${loopingSummary}\n\n**Manual intervention is required** to resolve the cycle. Please review the issue and PR to determine the root cause.`);
+        const cycleMessage = `## ${title}\n\n${body}`;
+        // Post cycle detection comment
+        await tracker.addComment(issueOrPrId, cycleMessage);
+        // Send Slack notification if configured
+        if (notifySlack) {
+            const slackMessage = `:warning: *Pipeline Cycle Detected* for #${issueOrPrId}\n\nLooping stages:\n${cycleResult.loopingStages.map((s) => `• ${s.stage}: ${s.count}/${s.max}`).join('\n')}`;
+            await notifySlack(slackMessage).catch((err) => {
+                console.error('[cycle-detector] Slack notification failed:', err instanceof Error ? err.message : String(err));
+            });
+        }
+        return { cycleDetected: true, marker, cycleMessage };
+    }
+    return { cycleDetected: false, marker };
+}
+/**
+ * Create a cycle detector from pipeline config.
+ * Reads maxRetries from stage configurations.
+ */
+export function createCycleDetectorFromConfig(config) {
+    const detector = new PipelineCycleDetector();
+    if (config.stages) {
+        const overrides = {};
+        for (const stage of config.stages) {
+            const maxRetries = stage.onFailure?.maxRetries;
+            if (maxRetries !== undefined) {
+                if (stage.name === 'code') {
+                    overrides['fix-ci'] = maxRetries;
+                }
+                else if (stage.name === 'review') {
+                    overrides['fix-review'] = maxRetries;
+                }
+                else if (stage.name === 'admission' ||
+                    stage.name === 'triage' ||
+                    stage.name === 'agent') {
+                    overrides[stage.name] = maxRetries;
+                }
+            }
+        }
+        if (Object.keys(overrides).length > 0) {
+            detector.updateMaxInvocations(overrides);
+        }
+    }
+    return detector;
+}
+//# sourceMappingURL=cycle-utils.js.map

package/dist/defaults.d.ts

@@ -136,5 +136,10 @@ export declare const NOTIFICATION_TITLES: {
     readonly fixCIAgentFailed: "AI-SDLC: Fix-CI Agent Failed";
     readonly fixCIGuardrailViolations: "AI-SDLC: Fix-CI Guardrail Violations";
     readonly fixCIApplied: "AI-SDLC: Fix-CI Applied";
+    readonly fixReviewRetryLimit: "AI-SDLC: Fix-Review Retry Limit Reached";
+    readonly fixReviewAgentFailed: "AI-SDLC: Fix-Review Agent Failed";
+    readonly fixReviewGuardrailViolations: "AI-SDLC: Fix-Review Guardrail Violations";
+    readonly fixReviewApplied: "AI-SDLC: Fix-Review Applied";
+    readonly pipelineCycleDetected: "AI-SDLC: Pipeline Cycle Detected";
 };
 //# sourceMappingURL=defaults.d.ts.map

package/dist/defaults.js

@@ -214,5 +214,10 @@ export const NOTIFICATION_TITLES = {
     fixCIAgentFailed: 'AI-SDLC: Fix-CI Agent Failed',
     fixCIGuardrailViolations: 'AI-SDLC: Fix-CI Guardrail Violations',
     fixCIApplied: 'AI-SDLC: Fix-CI Applied',
+    fixReviewRetryLimit: 'AI-SDLC: Fix-Review Retry Limit Reached',
+    fixReviewAgentFailed: 'AI-SDLC: Fix-Review Agent Failed',
+    fixReviewGuardrailViolations: 'AI-SDLC: Fix-Review Guardrail Violations',
+    fixReviewApplied: 'AI-SDLC: Fix-Review Applied',
+    pipelineCycleDetected: 'AI-SDLC: Pipeline Cycle Detected',
 };
 //# sourceMappingURL=defaults.js.map

package/dist/execute.d.ts

@@ -14,6 +14,7 @@ import type { CodebaseContext } from './analysis/types.js';
 import type { AutonomyTracker } from './autonomy-tracker.js';
 import { CostTracker } from './cost-tracker.js';
 import type { StateStore } from './state/store.js';
+import type { PriorityScore } from './priority.js';
 export interface PipelineResult {
     prUrl: string;
     filesChanged: string[];
@@ -73,9 +74,11 @@ export interface ExecuteOptions {
     costTracker?: CostTracker;
     /** StateStore for episodic context enrichment. */
     stateStore?: StateStore;
+    /** Priority score from PPA scoring (set by watch loop or caller). */
+    priorityScore?: PriorityScore;
 }
 /**
- * Execute the full AI-SDLC pipeline for a given issue number.
+ * Execute the full AI-SDLC pipeline for a given issue ID.
  */
-export declare function executePipeline(issueNumber: number, options?: ExecuteOptions): Promise<PipelineResult>;
+export declare function executePipeline(issueId: string, options?: ExecuteOptions): Promise<PipelineResult>;
 //# sourceMappingURL=execute.d.ts.map

package/dist/execute.js

@@ -5,13 +5,14 @@
  *   load config -> fetch issue -> validate -> check autonomy ->
  *   create branch -> invoke agent -> authorize -> validate -> push -> create PR -> comment
  */
-import { createGitHubIssueTracker, createGitHubSourceControl, routeByComplexity, evaluatePromotion, evaluateComplexity, selectModel, withSpan, getMeter, SPAN_NAMES, METRIC_NAMES, ATTRIBUTE_KEYS, } from '@ai-sdlc/reference';
+import { createGitHubSourceControl, routeByComplexity, evaluatePromotion, evaluateComplexity, selectModel, withSpan, getMeter, SPAN_NAMES, METRIC_NAMES, ATTRIBUTE_KEYS, } from '@ai-sdlc/reference';
 import { loadConfigAsync } from './config.js';
 import { validateIssue, validateIssueWithExtensions, parseComplexity } from './validate-issue.js';
+import { validateAgentOutput } from './validate-agent-output.js';
 import { createLogger } from './logger.js';
 import { createStructuredConsoleLogger, createStructuredBufferLogger, } from './structured-logger.js';
 import { ClaudeCodeRunner } from './runners/claude-code.js';
-import { execFileAsync, getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, isAutonomousStrategy, recordMetric, validateAndAuditOutput, evaluatePipelineCompliance, authorizeFilesChanged, interpolateBranchPattern, interpolatePRTitle, } from './shared.js';
+import { execFileAsync, getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, isAutonomousStrategy, recordMetric, evaluatePipelineCompliance, authorizeFilesChanged, interpolateBranchPattern, interpolatePRTitle, issueIdToNumber, formatIssueRef, } from './shared.js';
 import { checkKillSwitch, issueAgentCredentials, revokeAgentCredentials, classifyAndSubmitApproval, createPipelineSecurity, } from './security.js';
 import { createPipelineOrchestration, executePipelineOrchestration, validatePipelineHandoffs, } from './orchestration.js';
 import { createPipelineProvenance, attachProvenanceToPR, validatePipelineProvenance, } from './provenance.js';
@@ -21,8 +22,10 @@ import { createPipelineExpressionEvaluator, createPipelineLLMEvaluator, createPi
 import { verifyAuditIntegrity, createFileAuditLog, loadAuditEntries, computeAuditHash, } from './audit-extended.js';
 import { renderTemplate } from './notifications.js';
 import { admitIssueResource, createPipelineAdmission, } from './admission.js';
-import { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, scanPipelineAdapters, } from './adapters.js';
-import { defaultSandboxConstraints, DEFAULT_CONFIG_DIR_NAME, DEFAULT_PR_FOOTER, NOTIFICATION_TITLES, } from './defaults.js';
+import { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, scanPipelineAdapters, resolveIssueTrackerFromConfig, } from './adapters.js';
+import { existsSync, readFileSync, appendFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { defaultSandboxConstraints, DEFAULT_CONFIG_DIR_NAME, DEFAULT_PR_FOOTER, DEFAULT_LINT_COMMAND, DEFAULT_FORMAT_COMMAND, DEFAULT_COMMIT_MESSAGE_TEMPLATE, DEFAULT_COMMIT_CO_AUTHOR, NOTIFICATION_TITLES, } from './defaults.js';
 import { checkFrameworkCompliance, getControlCatalog, getFrameworkMappings, listSupportedFrameworks, } from './compliance-extended.js';
 import { createSilentLogger, withPipelineSpanSync, getPipelineTracer, validateResourceSchema, } from './telemetry-extended.js';
 import { createPipelineMemory } from './shared.js';
@@ -31,9 +34,9 @@ import { CostTracker } from './cost-tracker.js';
 import { enrichAgentContext } from './context-enrichment.js';
 import { reportGateCheckRuns } from './check-runs.js';
 /**
- * Execute the full AI-SDLC pipeline for a given issue number.
+ * Execute the full AI-SDLC pipeline for a given issue ID.
  */
-export async function executePipeline(issueNumber, options = {}) {
+export async function executePipeline(issueId, options = {}) {
     const workDir = options.workDir ?? (await resolveRepoRoot());
     const configDir = options.configDir ?? `${workDir}/${DEFAULT_CONFIG_DIR_NAME}`;
     const log = options.logger ??
@@ -86,22 +89,22 @@ export async function executePipeline(issueNumber, options = {}) {
     // 2. Create adapters (or use injected ones)
     const { org, repo } = getGitHubConfig(options.secretStore);
     const ghConfig = { org, repo, token: { secretRef: 'github-token' } };
-    const tracker = options.tracker ?? createGitHubIssueTracker(ghConfig);
+    const tracker = options.tracker ?? resolveIssueTrackerFromConfig(config, ghConfig);
     const sc = options.sourceControl ?? createGitHubSourceControl(ghConfig);
     // 3. Fetch issue
     log.stage('validate-issue');
-    const issue = await tracker.getIssue(String(issueNumber));
+    const issue = await tracker.getIssue(issueId);
     // Store issue context in working memory if provided
     if (options.memory) {
         options.memory.working.set('currentIssue', {
-            number: issueNumber,
+            issueId,
             title: issue.title,
             description: issue.description,
         });
     }
     // Wrap pipeline body in try/catch to record failure episodes
     try {
-        return await executePipelineBody(issueNumber, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir);
+        return await executePipelineBody(issueId, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir);
     }
     catch (err) {
         // Record failure episode before rethrowing
@@ -109,19 +112,50 @@ export async function executePipeline(issueNumber, options = {}) {
             options.memory.episodic.append({
                 key: 'pipeline-execution',
                 value: {
-                    issueNumber,
+                    issueId,
                     outcome: 'failure',
                     error: err instanceof Error ? err.message : String(err),
                 },
-                metadata: { summary: `Failed issue #${issueNumber}: ${issue.title}` },
+                metadata: { summary: `Failed issue ${formatIssueRef(issueId)}: ${issue.title}` },
             });
             options.memory.working.clear();
         }
         throw err;
     }
 }
-async function executePipelineBody(issueNumber, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir) {
+async function executePipelineBody(issueId, issue, config, qualityGate, agentRole, autonomyPolicy, tracker, sc, auditLog, metricStore, options, log, workDir) {
+    const issueNumber = issueIdToNumber(issueId);
     const meter = getMeter();
+    // Slack notifications (optional — activates when SLACK_BOT_TOKEN is set)
+    let slackThreadId;
+    const slackToken = process.env.SLACK_BOT_TOKEN;
+    const slackChannel = process.env.SLACK_CHANNEL;
+    const notifySlack = async (message) => {
+        if (!slackToken || !slackChannel)
+            return;
+        try {
+            const body = { channel: slackChannel, text: message };
+            if (slackThreadId)
+                body.thread_ts = slackThreadId;
+            const res = await fetch('https://slack.com/api/chat.postMessage', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${slackToken}`,
+                },
+                body: JSON.stringify(body),
+            });
+            const data = (await res.json());
+            // Capture the first message's timestamp as thread ID
+            if (data.ok && !slackThreadId && data.ts) {
+                slackThreadId = data.ts;
+            }
+        }
+        catch {
+            // Best-effort — don't fail the pipeline for Slack
+        }
+    };
+    await notifySlack(`:rocket: *Pipeline started* for <https://github.com/${process.env.GITHUB_REPOSITORY ?? ''}/issues/${issueId}|#${issueId}: ${issue.title}>`);
     // Discovery: register agent and resolve by issue labels
     const discovery = createPipelineDiscovery();
     discovery.register(agentRole);
@@ -167,7 +201,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             auditLog.record({
                 actor: 'system',
                 action: 'evaluate',
-                resource: `issue#${issueNumber}`,
+                resource: `issue#${issueId}`,
                 policy: qualityGate.metadata.name,
                 decision: 'denied',
                 details: {
@@ -183,13 +217,13 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             const gateFailTitle = gateFailTpl
                 ? renderTemplate(gateFailTpl, { details: failures }).title
                 : NOTIFICATION_TITLES.issueValidationFailed;
-            await tracker.addComment(String(issueNumber), `## ${gateFailTitle}\n\n${gateFailBody}`);
-            throw new Error(`Issue #${issueNumber} failed quality gate validation`);
+            await tracker.addComment(issueId, `## ${gateFailTitle}\n\n${gateFailBody}`);
+            throw new Error(`Issue ${formatIssueRef(issueId)} failed quality gate validation:\n${failures}`);
         }
         auditLog.record({
             actor: 'system',
             action: 'evaluate',
-            resource: `issue#${issueNumber}`,
+            resource: `issue#${issueId}`,
             policy: qualityGate.metadata.name,
             decision: 'allowed',
         });
@@ -202,7 +236,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     auditLog.record({
         actor: 'system',
         action: 'route',
-        resource: `issue#${issueNumber}`,
+        resource: `issue#${issueId}`,
         decision: isAutonomousStrategy(strategy) ? 'allowed' : 'denied',
         details: { score: complexity, strategy },
     });
@@ -214,21 +248,21 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
                 title: NOTIFICATION_TITLES.complexityTooHigh,
                 body: `Issue complexity (${complexity}) routed as "${strategy}" — requires human involvement.`,
             };
-        await tracker.addComment(String(issueNumber), `## ${complexityComment.title}\n\n${complexityComment.body}`);
-        throw new Error(`Issue #${issueNumber} complexity ${complexity} routed as "${strategy}"`);
+        await tracker.addComment(issueId, `## ${complexityComment.title}\n\n${complexityComment.body}`);
+        throw new Error(`Issue ${formatIssueRef(issueId)} complexity ${complexity} routed as "${strategy}"`);
     }
     // Approval workflow check (after routing, before agent)
     if (options.security) {
-        const approval = await classifyAndSubmitApproval(options.security, complexity, agentRole.metadata.name, `Execute pipeline for issue #${issueNumber}`);
+        const approval = await classifyAndSubmitApproval(options.security, complexity, agentRole.metadata.name, `Execute pipeline for issue ${formatIssueRef(issueId)}`);
         if (approval.status === 'pending') {
-            throw new Error(`Issue #${issueNumber} requires approval (tier: ${approval.tier}) — status is pending`);
+            throw new Error(`Issue ${formatIssueRef(issueId)} requires approval (tier: ${approval.tier}) — status is pending`);
         }
     }
     // 6. Check autonomy level allows coding
     const currentLevel = resolveAutonomyLevel(autonomyPolicy);
     log.stageEnd('validate-issue');
     // 7. Create branch and checkout locally (read pattern from pipeline config)
-    const branchVars = { issueNumber: String(issueNumber), issueTitle: issue.title };
+    const branchVars = { issueNumber: issueId, issueTitle: issue.title };
     const branchName = interpolateBranchPattern(config.pipeline?.spec.branching?.pattern, branchVars);
     await sc.createBranch({ name: branchName });
     await execFileAsync('git', ['fetch', 'origin', branchName], { cwd: workDir });
@@ -248,9 +282,31 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             log.info(`Model selected: ${modelResult.model} (${modelResult.reason})`);
         }
     }
+    // 8b. Ensure .gitignore covers runtime artifacts so the agent doesn't
+    //     re-add entries on every run.
+    ensureRuntimeGitignore(workDir);
     // 9. Invoke agent (with sandbox + JIT credential lifecycle when security is provided)
     log.stage('agent');
+    // Post progress comment so users can see the pipeline is working
+    await tracker.addComment(issueId, `## AI-SDLC: Agent Started\n\n` +
+        `The AI agent is now working on this issue on branch \`${branchName}\`.\n\n` +
+        `| Detail | Value |\n|---|---|\n` +
+        `| Model | ${selectedModel ?? 'default'} |\n` +
+        `| Complexity | ${complexity} |\n` +
+        `| Strategy | ${strategy} |\n`);
+    await notifySlack(`:hammer_and_wrench: Agent working on \`${branchName}\` (model: ${selectedModel ?? 'default'}, complexity: ${complexity})`);
     const runner = options.runner ?? new ClaudeCodeRunner();
+    // Set up progress tracking — collects streaming events for the activity log
+    const progressLog = [];
+    const onProgress = (event) => {
+        const timestamp = new Date().toISOString().slice(11, 19);
+        if (event.type === 'tool_start' && event.tool) {
+            progressLog.push(`[${timestamp}] ${event.tool}${event.file ? `: ${event.file}` : ''}`);
+        }
+        else if (event.type === 'cost') {
+            progressLog.push(`[${timestamp}] Cost: $${event.costUsd?.toFixed(4)}`);
+        }
+    };
     // Sandbox isolation around agent execution
     const codeStage = config.pipeline?.spec.stages.find((s) => s.name === 'code');
     let sandboxId;
@@ -258,7 +314,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     try {
         if (options.security) {
             const timeoutMs = codeStage?.timeout ? parseDuration(codeStage.timeout) : undefined;
-            sandboxId = await options.security.sandbox.isolate(`issue-${issueNumber}`, defaultSandboxConstraints(workDir, timeoutMs));
+            sandboxId = await options.security.sandbox.isolate(`issue-${issueId}`, defaultSandboxConstraints(workDir, timeoutMs));
         }
         // Issue JIT credentials before agent execution
         const jitCred = options.security
@@ -272,7 +328,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             // Enrich agent context with episodic memory
             const episodicContext = options.stateStore
                 ? enrichAgentContext(options.stateStore, {
-                    issueNumber,
+                    issueNumber: issueNumber ?? undefined,
                     agentName: effectiveAgent.metadata.name,
                     files: result ? result.filesChanged : undefined,
                 })
@@ -280,9 +336,10 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             const orchestrationResult = await executePipelineOrchestration(plan, [effectiveAgent], async (agent) => {
                 return withSpan(SPAN_NAMES.AGENT_TASK, {
                     [ATTRIBUTE_KEYS.AGENT]: agent.metadata.name,
-                    [ATTRIBUTE_KEYS.RESOURCE_NAME]: `issue#${issueNumber}`,
+                    [ATTRIBUTE_KEYS.RESOURCE_NAME]: `issue#${issueId}`,
                 }, () => runner.run({
-                    issueNumber,
+                    issueId,
+                    issueNumber: issueNumber ?? undefined,
                     issueTitle: issue.title,
                     issueBody: issue.description ?? '',
                     workDir,
@@ -296,6 +353,13 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
                     memory: options.memory,
                     codebaseContext: options.codebaseContext,
                     episodicContext,
+                    sandboxId,
+                    lintCommand: DEFAULT_LINT_COMMAND,
+                    formatCommand: DEFAULT_FORMAT_COMMAND,
+                    typecheckCommand: process.env.AI_SDLC_TYPECHECK_COMMAND,
+                    commitMessageTemplate: DEFAULT_COMMIT_MESSAGE_TEMPLATE,
+                    commitCoAuthor: DEFAULT_COMMIT_CO_AUTHOR,
+                    onProgress,
                 }));
             });
             // Extract the AgentResult from orchestration output
@@ -319,8 +383,8 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
                 const agentFailComment = agentFailTpl
                     ? renderTemplate(agentFailTpl, { stageName: 'code', details: errorDetail })
                     : { title: NOTIFICATION_TITLES.agentFailed, body: errorDetail };
-                await tracker.addComment(String(issueNumber), `## ${agentFailComment.title}\n\n${agentFailComment.body}`);
-                throw new Error(`Agent failed on issue #${issueNumber}: ${err}`);
+                await tracker.addComment(issueId, `## ${agentFailComment.title}\n\n${agentFailComment.body}`);
+                throw new Error(`Agent failed on issue ${formatIssueRef(issueId)}: ${err}`);
             }
             result = stepOutput;
             log.stageEnd('agent');
@@ -351,11 +415,31 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     if (currentLevel.permissions.write.length > 0) {
         authorizeFilesChanged(result.filesChanged, currentLevel.permissions, agentRole.spec.constraints, auditLog, agentRole.metadata.name);
     }
-    // 11. Validate agent output against guardrails
-    await withSpan(SPAN_NAMES.PIPELINE_STAGE, {
+    // 11. Post activity log so users can see what the agent did
+    const activitySection = progressLog.length > 0
+        ? `### Activity Log\n\n\`\`\`\n${progressLog.slice(-40).join('\n')}\n\`\`\``
+        : '';
+    await tracker.addComment(issueId, `## AI-SDLC: Agent Complete\n\n` +
+        `**${result.filesChanged.length} files changed.** Pushing branch...\n\n` +
+        activitySection);
+    await notifySlack(`:white_check_mark: Agent complete — ${result.filesChanged.length} files changed. Pushing...`);
+    // 12. Push branch (before validation to preserve work even if validation fails)
+    log.stage('push');
+    await execFileAsync('git', ['push', 'origin', branchName], { cwd: workDir });
+    log.stageEnd('push');
+    auditLog.record({
+        actor: 'system',
+        action: 'push',
+        resource: `branch/${branchName}`,
+        decision: 'allowed',
+        details: { filesChanged: result.filesChanged.length, issueId },
+    });
+    // 13. Validate agent output against guardrails (after push)
+    const validation = await withSpan(SPAN_NAMES.PIPELINE_STAGE, {
         [ATTRIBUTE_KEYS.STAGE]: 'validate-output',
     }, async () => {
-        await validateAndAuditOutput({
+        log.stage('validate-output');
+        const validationResult = await validateAgentOutput({
             filesChanged: result.filesChanged,
             workDir,
             constraints: {
@@ -364,14 +448,37 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
                 blockedPaths: resolved.blockedPaths,
             },
             guardrails: { maxLinesPerPR: currentLevel.guardrails.maxLinesPerPR },
-            auditLog,
-            log,
-            onViolation: async (violationList) => {
-                await tracker.addComment(String(issueNumber), `## ${NOTIFICATION_TITLES.guardrailViolations}\n\n${violationList}`);
-            },
         });
+        log.stageEnd('validate-output');
+        return validationResult;
     });
-    // 11b. Evaluate quality gates and report as GitHub Check Runs
+    if (!validation.passed) {
+        // Record validation failure in audit log
+        auditLog.record({
+            actor: 'system',
+            action: 'check',
+            resource: 'agent-output',
+            decision: 'denied',
+            details: { violations: validation.violations.map((v) => v.rule) },
+        });
+        // Post comment explaining the violations
+        const violationList = validation.violations
+            .map((v) => `- **${v.rule}**: ${v.message}`)
+            .join('\n');
+        await tracker.addComment(issueId, `## ${NOTIFICATION_TITLES.guardrailViolations}\n\n${violationList}\n\n` +
+            `The branch \`${branchName}\` has been pushed with your changes. You can review the work, ` +
+            `cherry-pick valid changes, or adjust the guardrails as needed.`);
+        // Exit without creating PR
+        throw new Error(`Agent output failed guardrail validation. Branch ${branchName} preserved for review.`);
+    }
+    // Validation passed — record success
+    auditLog.record({
+        actor: 'system',
+        action: 'check',
+        resource: 'agent-output',
+        decision: 'allowed',
+    });
+    // 13b. Evaluate quality gates and report as GitHub Check Runs
     if (qualityGate.spec.gates.length > 0) {
         try {
             const { stdout: headSha } = await execFileAsync('git', ['rev-parse', 'HEAD'], {
@@ -396,7 +503,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             auditLog.record({
                 actor: 'system',
                 action: 'evaluate',
-                resource: `issue#${issueNumber}`,
+                resource: `issue#${issueId}`,
                 policy: 'post-agent-gates',
                 decision: gateResults.every((g) => g.verdict === 'pass') ? 'allowed' : 'denied',
                 details: {
@@ -408,7 +515,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             log.info('Post-agent gate evaluation skipped');
         }
     }
-    // 11c. Post-agent complexity evaluation (non-blocking)
+    // 13c. Post-agent complexity evaluation (non-blocking)
     try {
         const { stdout: diffStat } = await execFileAsync('git', ['diff', '--stat', 'HEAD~1'], {
             cwd: workDir,
@@ -423,7 +530,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
         auditLog.record({
             actor: 'system',
             action: 'evaluate',
-            resource: `issue#${issueNumber}`,
+            resource: `issue#${issueId}`,
             policy: 'post-agent-complexity',
             decision: 'allowed',
             details: {
@@ -437,11 +544,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     catch {
         log.info('Post-agent complexity evaluation skipped');
     }
-    // 12. Push branch
-    log.stage('push');
-    await execFileAsync('git', ['push', 'origin', branchName], { cwd: workDir });
-    log.stageEnd('push');
-    // 12b. Compute cost receipt for provenance (before PR creation)
+    // 14. Compute cost receipt for provenance (before PR creation)
     let costReceipt;
     if (result.tokenUsage) {
         const tu = result.tokenUsage;
@@ -459,7 +562,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             },
         };
     }
-    // 13. Create PR (with optional provenance, reading config from pipeline)
+    // 15. Create PR (with optional provenance, reading config from pipeline)
     const prConfig = config.pipeline?.spec.pullRequest;
     const shouldIncludeProvenance = options.includeProvenance ?? prConfig?.includeProvenance ?? options.security !== undefined;
     let provenanceBlock = '';
@@ -468,9 +571,14 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             promptText: issue.description,
             cost: costReceipt,
         });
-        provenanceBlock = '\n\n' + attachProvenanceToPR(provenance);
+        let provenanceText = attachProvenanceToPR(provenance);
+        // Include priority score in provenance section when available
+        if (options.priorityScore) {
+            provenanceText += `\n- **Priority Score**: ${options.priorityScore.composite.toFixed(4)} (confidence: ${options.priorityScore.confidence.toFixed(2)})`;
+        }
+        provenanceBlock = '\n\n' + provenanceText;
     }
-    const prVars = { issueNumber: String(issueNumber), issueTitle: issue.title };
+    const prVars = { issueNumber: issueId, issueTitle: issue.title };
     const prTitle = interpolatePRTitle(prConfig?.titleTemplate, prVars);
     const closeKeyword = prConfig?.closeKeyword ?? 'Closes';
     const targetBranch = config.pipeline?.spec.branching?.targetBranch ?? 'main';
@@ -486,7 +594,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             if (section === 'changes')
                 parts.push('## Changes', '', result.filesChanged.map((f) => `- \`${f}\``).join('\n'));
             if (section === 'closes')
-                parts.push('', `${closeKeyword} #${issueNumber}`);
+                parts.push('', `${closeKeyword} ${formatIssueRef(issueId)}`);
         }
         const footer = options.prFooter ?? DEFAULT_PR_FOOTER;
         parts.push('', '---', footer);
@@ -504,7 +612,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             action: 'create',
             resource: 'pull-request',
             decision: 'allowed',
-            details: { prUrl: prResult.url, issueNumber },
+            details: { prUrl: prResult.url, issueId },
         });
         return prResult;
     });
@@ -514,15 +622,16 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     const prCreatedComment = prCreatedTemplate
         ? renderTemplate(prCreatedTemplate, {
             prUrl: pr.url,
-            issueNumber: String(issueNumber),
+            issueNumber: issueId,
         })
         : { title: NOTIFICATION_TITLES.prCreated, body: `Pull request created: ${pr.url}` };
-    await tracker.addComment(String(issueNumber), `## ${prCreatedComment.title}\n\n${prCreatedComment.body}`);
+    await tracker.addComment(issueId, `## ${prCreatedComment.title}\n\n${prCreatedComment.body}`);
+    await notifySlack(`:pull_request: PR created: ${pr.url}`);
     // 14b. Record cost from agent result
     if (options.costTracker && result.tokenUsage) {
         const tu = result.tokenUsage;
         options.costTracker.recordCost({
-            runId: `run-${Date.now()}-${issueNumber}`,
+            runId: `run-${Date.now()}-${issueId}`,
             agentName: agentRole.metadata.name,
             pipelineType: 'execute',
             model: tu.model,
@@ -530,7 +639,7 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
             outputTokens: tu.outputTokens,
             cacheReadTokens: tu.cacheReadTokens,
             stageName: 'code',
-            issueNumber,
+            issueNumber: issueNumber ?? undefined,
         });
     }
     // 14c. Record task outcome in autonomy tracker
@@ -617,18 +726,35 @@ async function executePipelineBody(issueNumber, issue, config, qualityGate, agen
     }
     // 17. Record episodic memory (success)
     if (options.memory) {
+        const episodicValue = {
+            issueId,
+            prUrl: pr.url,
+            filesChanged: result.filesChanged.length,
+            outcome: 'success',
+        };
+        if (options.priorityScore) {
+            episodicValue.priorityComposite = options.priorityScore.composite;
+            episodicValue.priorityConfidence = options.priorityScore.confidence;
+        }
         options.memory.episodic.append({
             key: 'pipeline-execution',
-            value: {
-                issueNumber,
-                prUrl: pr.url,
-                filesChanged: result.filesChanged.length,
-                outcome: 'success',
-            },
-            metadata: { summary: `Completed issue #${issueNumber}: ${issue.title}` },
+            value: episodicValue,
+            metadata: { summary: `Completed issue ${formatIssueRef(issueId)}: ${issue.title}` },
         });
         options.memory.working.clear();
     }
+    // 17b. Record priority calibration sample for feedback loop
+    if (options.stateStore && options.priorityScore) {
+        options.stateStore.savePrioritySample({
+            issueId,
+            priorityComposite: options.priorityScore.composite,
+            priorityConfidence: options.priorityScore.confidence,
+            priorityDimensions: JSON.stringify(options.priorityScore.dimensions),
+            actualComplexity: complexity,
+            filesChanged: result.filesChanged.length,
+            outcome: 'success',
+        });
+    }
     // 18. Audit integrity verification (non-blocking)
     if (options.auditFilePath) {
         try {
@@ -738,4 +864,28 @@ function runPipelineDiagnostics(input) {
         // which would empty it before artifact upload can capture the contents.
     }
 }
+// ── Gitignore helper ─────────────────────────────────────────────────
+const RUNTIME_GITIGNORE_PATHS = ['.ai-sdlc/state.db', '.ai-sdlc/state/', '.ai-sdlc/audit.jsonl'];
+/**
+ * Ensure .gitignore in the working directory covers AI-SDLC runtime artifacts.
+ * Without this the agent sees untracked runtime files and appends duplicate
+ * gitignore entries on every run.
+ *
+ * Only checks path entries (not the comment header) to avoid false mismatches.
+ * Writes the block once with any missing paths.
+ */
+function ensureRuntimeGitignore(workDir) {
+    try {
+        const gitignorePath = join(workDir, '.gitignore');
+        const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf-8') : '';
+        const missing = RUNTIME_GITIGNORE_PATHS.filter((entry) => !existing.includes(entry));
+        if (missing.length === 0)
+            return;
+        const block = '\n# AI-SDLC runtime artifacts\n' + missing.join('\n') + '\n';
+        appendFileSync(gitignorePath, block, 'utf-8');
+    }
+    catch {
+        // Best-effort — workDir may not exist yet in tests or dry-run scenarios
+    }
+}
 //# sourceMappingURL=execute.js.map