@ai-sdlc/orchestrator 0.6.0 → 0.10.0

package/dist/cli/commands/init-features.js

@@ -0,0 +1,473 @@
+/**
+ * `ai-sdlc init` interactive wizard + feature dispatcher (AISDLC-143).
+ *
+ * Per Q4(b) of the operator-ratified quality-gate redesign, `ai-sdlc init`
+ * is a wizard by default with `--yes` for non-interactive (CI/scripts) and
+ * `--with-X` flags for explicit opt-in (`--with-dor`, `--with-attestation`,
+ * `--with-classifier`, `--with-branch-protection`). This module owns:
+ *
+ *   1. The ordered prompt list (resolveFeatureSelection).
+ *   2. The feature-toggle → file-write dispatcher (applyFeatureSelection).
+ *   3. The branch-protection helper (applyBranchProtection) including the
+ *      `--dry-run` JSON-print path required by AC #6.
+ *   4. The "next steps" summary printed at the end of init (AC #5).
+ *
+ * Test surface: every public function takes a small options bag with
+ * injectable side-effect adapters (prompter, writeFile, runCommand) so the
+ * test suite can drive every wizard branch hermetically without spinning
+ * up a TTY or shelling out to `gh`. Production callers in `init.ts` pass
+ * the real adapters.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { ATTESTATION_TEMPLATES, BASELINE_WORKFLOW_TEMPLATES, CLASSIFIER_TEMPLATES, DOR_TEMPLATES, HUSKY_PREPUSH_SIGN_SNIPPET, } from './init-templates.js';
+/** All feature flags off — used as the initial state before flags + prompts. */
+export const NO_FEATURES = {
+    dor: false,
+    attestation: false,
+    classifier: false,
+    branchProtection: false,
+};
+/** All features on — the answer used by `--yes` (accept all defaults). */
+export const ALL_FEATURES = {
+    dor: true,
+    attestation: true,
+    classifier: true,
+    branchProtection: true,
+};
+// ── Production adapter factory ───────────────────────────────────────────
+/**
+ * Build the production adapter bag. Pulled into a factory so tests can
+ * compose a partial override bag (e.g. only override `prompt`) and let
+ * the rest fall through to real disk writes.
+ *
+ * The `prompt` adapter is a lazy import of `@inquirer/prompts.confirm`
+ * so that:
+ *   1. Tests don't pay the import cost when they inject their own stub.
+ *   2. `--yes` runs (which never call `prompt`) don't pay it either.
+ *   3. The orchestrator's runtime `dist/` is smaller for the common case.
+ */
+export function buildProductionAdapters() {
+    return {
+        prompt: async (question, defaultYes) => {
+            // Lazy import — see docblock above for why.
+            const { confirm } = await import('@inquirer/prompts');
+            return confirm({ message: question, default: defaultYes });
+        },
+        writeFile: (path, contents) => writeFileSync(path, contents, 'utf-8'),
+        appendOnce: (path, contents, sentinel) => {
+            // Make sure the parent dir exists (appendFileSync errors with ENOENT
+            // otherwise; we may be writing into a freshly-created `.husky/`).
+            mkdirSync(dirname(path), { recursive: true });
+            const existing = existsSync(path) ? readFileSync(path, 'utf-8') : '';
+            if (existing.includes(sentinel))
+                return 'skipped';
+            const sep = existing.length > 0 && !existing.endsWith('\n') ? '\n' : '';
+            writeFileSync(path, existing + sep + contents, 'utf-8');
+            return 'appended';
+        },
+        mkdirp: (path) => mkdirSync(path, { recursive: true }),
+        exists: (path) => existsSync(path),
+        runCommand: (cmd, args) => {
+            try {
+                // Use `execFileSync` (no shell) so args are passed as a true
+                // argv array — never word-split or shell-interpreted. The prior
+                // `execSync(\`${cmd} ${args.join(' ')}\`)` form ran the command
+                // through `/bin/sh -c` and silently broke whenever any argument
+                // contained whitespace (e.g. macOS users with `~/Documents/My
+                // Project/` in their projectDir, where the `--input <tmpPath>`
+                // arg to `gh api` would word-split and `gh` would see two
+                // unrelated tokens — branch protection would silently fail or
+                // apply wrong content). Switching to `execFileSync` eliminates
+                // both word-splitting AND any shell-injection surface in one
+                // change. Stderr stays muted so users still get the clean
+                // single-line error rendered by `applyBranchProtection`.
+                const stdout = execFileSync(cmd, args, {
+                    encoding: 'utf-8',
+                    stdio: ['ignore', 'pipe', 'ignore'],
+                });
+                return { stdout, exitCode: 0 };
+            }
+            catch (err) {
+                const e = err;
+                return {
+                    stdout: typeof e.stdout === 'string' ? e.stdout : (e.stdout?.toString() ?? ''),
+                    exitCode: e.status ?? 1,
+                };
+            }
+        },
+        log: (line) => console.log(line),
+    };
+}
+// ── Wizard ───────────────────────────────────────────────────────────────
+/**
+ * Resolve the per-feature on/off vector by combining (in priority order):
+ *   1. `--add <feature>` — if set, ONLY that feature is on; everything
+ *      else is suppressed (idempotent extension, AC #7).
+ *   2. `--yes` — accept every default (every feature on).
+ *   3. `--with-X` flags — opt-in without prompting.
+ *   4. Interactive prompts for any feature still undetermined.
+ *
+ * Returns a fully-determined FeatureSelection. The dispatcher then writes
+ * exactly the union of features marked true.
+ */
+export async function resolveFeatureSelection(flags, adapters) {
+    // ── Path 1: `--add` — single-feature extension ────────────────────────
+    if (flags.add) {
+        const sel = { ...NO_FEATURES };
+        switch (flags.add) {
+            case 'dor':
+                sel.dor = true;
+                break;
+            case 'attestation':
+                sel.attestation = true;
+                break;
+            case 'classifier':
+                sel.classifier = true;
+                break;
+            case 'branch-protection':
+                sel.branchProtection = true;
+                break;
+        }
+        return sel;
+    }
+    // ── Path 2: `--yes` — all defaults on, no prompts ─────────────────────
+    if (flags.yes) {
+        return { ...ALL_FEATURES };
+    }
+    // ── Path 3+4: `--with-X` overrides + prompts for the rest ─────────────
+    const sel = { ...NO_FEATURES };
+    // DoR
+    if (flags.withDor) {
+        sel.dor = true;
+    }
+    else {
+        sel.dor = await adapters.prompt('Will this repo use Definition-of-Ready gates?', true);
+    }
+    // Attestation
+    if (flags.withAttestation) {
+        sel.attestation = true;
+    }
+    else {
+        sel.attestation = await adapters.prompt('Do you want attestation infrastructure (audit-only)?', true);
+    }
+    // Classifier
+    if (flags.withClassifier) {
+        sel.classifier = true;
+    }
+    else {
+        sel.classifier = await adapters.prompt('Add review classifier for cost-optimized reviews?', true);
+    }
+    // Branch protection
+    if (flags.withBranchProtection) {
+        sel.branchProtection = true;
+    }
+    else {
+        sel.branchProtection = await adapters.prompt('Apply recommended branch protection? (required: ai-sdlc/pr-ready + codecov/patch)', true);
+    }
+    return sel;
+}
+/**
+ * Write the union of feature templates into the project dir. AC #4 says
+ * the BASELINE workflow templates (gate workflow) are always written; the
+ * per-feature template sets are written only when their toggle is on.
+ *
+ * Idempotent: any file that already exists at the target path is skipped
+ * with a "skip" log line. This is what makes `--add <feature>` safe to
+ * run on an already-initialized repo (AC #7).
+ */
+export async function applyFeatureSelection(projectDir, selection, flags, adapters) {
+    const result = { created: [], skipped: [], wouldCreate: [] };
+    // Build the union of templates to write.
+    const templateSets = [];
+    // `--add` mode: skip the baseline (we're EXTENDING an existing init).
+    if (!flags.add) {
+        templateSets.push(BASELINE_WORKFLOW_TEMPLATES);
+    }
+    if (selection.dor)
+        templateSets.push(DOR_TEMPLATES);
+    if (selection.attestation)
+        templateSets.push(ATTESTATION_TEMPLATES);
+    if (selection.classifier)
+        templateSets.push(CLASSIFIER_TEMPLATES);
+    for (const set of templateSets) {
+        for (const [relPath, contents] of Object.entries(set.files)) {
+            const absPath = join(projectDir, relPath);
+            if (flags.dryRun) {
+                result.wouldCreate.push(relPath);
+                adapters.log(`  would create ${relPath}`);
+                continue;
+            }
+            if (adapters.exists(absPath)) {
+                result.skipped.push(relPath);
+                adapters.log(`  skip ${relPath} (already exists)`);
+                continue;
+            }
+            // mkdir -p the parent
+            adapters.mkdirp(dirname(absPath));
+            adapters.writeFile(absPath, contents);
+            result.created.push(relPath);
+            adapters.log(`  created ${relPath}`);
+        }
+    }
+    // Husky pre-push sign hook is a separate concern from the
+    // FeatureTemplateSet because it's an APPEND (not a write-from-empty)
+    // — adopters often already have a .husky/pre-push from their existing
+    // tooling and we don't want to clobber it. Only fired when attestation
+    // is on.
+    if (selection.attestation && !flags.dryRun) {
+        const hookPath = join(projectDir, '.husky', 'pre-push');
+        if (!adapters.exists(hookPath)) {
+            // No existing hook — write a minimal one with the sign block.
+            adapters.mkdirp(dirname(hookPath));
+            adapters.writeFile(hookPath, `#!/usr/bin/env bash\nset -euo pipefail\n\n${HUSKY_PREPUSH_SIGN_SNIPPET}`);
+            result.created.push('.husky/pre-push');
+            adapters.log(`  created .husky/pre-push`);
+        }
+        else {
+            const status = adapters.appendOnce(hookPath, HUSKY_PREPUSH_SIGN_SNIPPET, '# ai-sdlc:attestation-sign-block');
+            if (status === 'appended') {
+                adapters.log(`  updated .husky/pre-push (appended sign block)`);
+            }
+            else {
+                result.skipped.push('.husky/pre-push');
+                adapters.log(`  skip .husky/pre-push (sign block already present)`);
+            }
+        }
+    }
+    else if (selection.attestation && flags.dryRun) {
+        result.wouldCreate.push('.husky/pre-push');
+        adapters.log('  would update .husky/pre-push (sign block)');
+    }
+    // Branch protection (always last — depends on the gate workflow being
+    // present so the required check exists when the rule is applied).
+    if (selection.branchProtection) {
+        result.branchProtection = await applyBranchProtection(projectDir, flags, adapters);
+    }
+    return result;
+}
+/**
+ * Recommended branch-protection ruleset for AI-SDLC adopters. AC #1 #4:
+ * the required checks are `ai-sdlc/pr-ready` (the gate aggregator) and
+ * `codecov/patch` (the de facto coverage signal). Other AI-SDLC apps
+ * post their own statuses but they're all rolled into pr-ready.
+ *
+ * The body conforms to the GitHub REST API
+ * `PUT /repos/{owner}/{repo}/branches/{branch}/protection` schema.
+ */
+export const RECOMMENDED_BRANCH_PROTECTION_BODY = {
+    required_status_checks: {
+        strict: true,
+        contexts: ['ai-sdlc/pr-ready', 'codecov/patch'],
+    },
+    enforce_admins: false,
+    required_pull_request_reviews: {
+        dismiss_stale_reviews: true,
+        require_code_owner_reviews: false,
+        required_approving_review_count: 1,
+    },
+    restrictions: null,
+    allow_force_pushes: false,
+    allow_deletions: false,
+};
+/**
+ * Apply (or print, in dry-run) the recommended branch protection rule
+ * to the `main` branch of the repo at `projectDir`. AC #6 explicitly
+ * requires that `--dry-run` print the JSON without applying.
+ *
+ * The repo identity (`owner/repo`) is resolved by shelling out to
+ * `gh repo view --json nameWithOwner -q .nameWithOwner`. We could parse
+ * the git remote ourselves (see git-remote.ts) but `gh` already resolves
+ * forks + renames + custom default branches consistently, and the user
+ * needs `gh` on PATH for the PUT to work anyway.
+ */
+export async function applyBranchProtection(projectDir, flags, adapters) {
+    const bodyJson = JSON.stringify(RECOMMENDED_BRANCH_PROTECTION_BODY, null, 2);
+    if (flags.dryRun) {
+        adapters.log('');
+        adapters.log('Branch-protection dry-run — would PUT the following body:');
+        adapters.log(bodyJson);
+        adapters.log('');
+        adapters.log('  endpoint: PUT /repos/{owner}/{repo}/branches/main/protection');
+        adapters.log('  apply with: gh api -X PUT repos/{owner}/{repo}/branches/main/protection ...');
+        return { applied: false, bodyJson };
+    }
+    // Resolve owner/repo via gh.
+    const ownerRepo = adapters.runCommand('gh', [
+        'repo',
+        'view',
+        '--json',
+        'nameWithOwner',
+        '-q',
+        '.nameWithOwner',
+    ]);
+    if (ownerRepo.exitCode !== 0) {
+        return {
+            applied: false,
+            bodyJson,
+            error: `gh repo view failed: ${ownerRepo.stdout.trim() || 'unknown error'}`,
+        };
+    }
+    const slug = ownerRepo.stdout.trim();
+    if (!slug) {
+        return {
+            applied: false,
+            bodyJson,
+            error: 'gh repo view returned empty owner/repo',
+        };
+    }
+    // Use the file-based input form so we don't have to thread quoted JSON
+    // through a shell. We write to a tmpfile, point gh at it, and let the
+    // adapter's runCommand spawn `gh` directly.
+    const tmpPath = join(projectDir, '.ai-sdlc', 'branch-protection-body.json');
+    // adapters.runCommand can't write files, so we use the underlying
+    // primitives directly here — branch protection is a one-shot operation
+    // and doesn't need to be hermetic in the same way as the file writes.
+    // Tests inject a stub that intercepts the runCommand call and never
+    // touches this path. See test for the contract.
+    try {
+        mkdirSync(dirname(tmpPath), { recursive: true });
+        writeFileSync(tmpPath, bodyJson, 'utf-8');
+    }
+    catch (err) {
+        return {
+            applied: false,
+            bodyJson,
+            error: `failed to stage branch-protection body: ${err.message}`,
+        };
+    }
+    const apply = adapters.runCommand('gh', [
+        'api',
+        '-X',
+        'PUT',
+        `repos/${slug}/branches/main/protection`,
+        '--input',
+        tmpPath,
+    ]);
+    if (apply.exitCode !== 0) {
+        return {
+            applied: false,
+            bodyJson,
+            error: `gh api PUT failed: ${apply.stdout.trim() || 'unknown error'}`,
+        };
+    }
+    adapters.log(`  applied branch protection to ${slug}:main`);
+    return { applied: true, bodyJson };
+}
+// ── Next-steps summary ───────────────────────────────────────────────────
+/**
+ * Print the structured "next steps" summary at the end of init. AC #5:
+ * the summary must include operator action items conditional on which
+ * features were chosen (e.g. `gh secret set` commands when attestation
+ * was opted in).
+ *
+ * Returns the rendered summary as a string in addition to logging it,
+ * so tests can assert on it without re-stringifying console output.
+ */
+export function renderNextSteps(selection, result, adapters) {
+    const lines = [];
+    lines.push('');
+    lines.push('━━━ Next steps ━━━');
+    lines.push('');
+    // Always present (baseline gate)
+    lines.push('1. Commit the scaffolded files:');
+    lines.push('     git add .ai-sdlc .github/workflows package.json');
+    lines.push('     git commit -m "chore: bootstrap AI-SDLC config"');
+    lines.push('');
+    let stepN = 2;
+    if (selection.dor) {
+        lines.push(`${stepN}. DoR (Definition-of-Ready) is in WARN-ONLY mode by default.`);
+        lines.push('     Tune .ai-sdlc/dor-config.yaml then flip evaluationMode: enforce');
+        lines.push('     after a soak window confirms the false-positive rate is low.');
+        lines.push('');
+        stepN++;
+    }
+    if (selection.attestation) {
+        lines.push(`${stepN}. Attestation infrastructure was scaffolded in AUDIT-ONLY mode.`);
+        lines.push('     a) Bootstrap your signing key: /ai-sdlc init-signing-key');
+        lines.push('     b) Open a PR adding the printed YAML block to');
+        lines.push('        .ai-sdlc/trusted-reviewers.yaml');
+        // AISDLC-152: removed the optional CI-side signer step (the AISDLC-87
+        // CI-attestor was retired in AISDLC-140 sub-4 alongside attestation
+        // becoming audit-only). New adopters no longer need to provision the
+        // AI_SDLC_CI_ATTESTOR_PRIVATE_KEY secret.
+        lines.push('');
+        stepN++;
+    }
+    if (selection.classifier) {
+        lines.push(`${stepN}. Review classifier config was scaffolded.`);
+        lines.push('     The classifier RUNTIME ships in AISDLC-141 (follow-up). Until');
+        lines.push('     that lands, .ai-sdlc/review-classifier.yaml is advisory only.');
+        lines.push('');
+        stepN++;
+    }
+    if (selection.branchProtection) {
+        if (result.branchProtection?.applied) {
+            lines.push(`${stepN}. Branch protection on \`main\` was updated.`);
+            lines.push('     Required checks: ai-sdlc/pr-ready, codecov/patch');
+        }
+        else if (result.branchProtection?.error) {
+            lines.push(`${stepN}. Branch protection was NOT applied:`);
+            lines.push(`     ${result.branchProtection.error}`);
+            lines.push('     After resolving (gh auth login, repo permissions, etc.) re-run:');
+            lines.push('     ai-sdlc init --add branch-protection');
+        }
+        else {
+            lines.push(`${stepN}. Branch protection (dry-run) — see JSON above; apply with:`);
+            lines.push('     ai-sdlc init --add branch-protection');
+        }
+        lines.push('');
+        stepN++;
+    }
+    lines.push(`${stepN}. Verify your configuration: ai-sdlc health`);
+    lines.push('');
+    lines.push('Adopter docs: https://github.com/ai-sdlc-framework/ai-sdlc/blob/main/docs/operations/init.md');
+    const out = lines.join('\n');
+    for (const line of lines)
+        adapters.log(line);
+    return out;
+}
+// ── CLAUDE.md recommendation pointer (AC #4) ─────────────────────────────
+/**
+ * The pointer block we append to CLAUDE.md so a freshly-initialized repo's
+ * Claude Code sessions know where to find the AI-SDLC quality-gate docs.
+ * Idempotent — guarded by a sentinel so re-running init doesn't duplicate
+ * the block.
+ */
+export const CLAUDE_MD_POINTER = `
+<!-- ai-sdlc:recommendation-pointer -->
+## AI-SDLC quality gate
+
+This repo is bootstrapped with the AI-SDLC framework. The single PR-ready
+merge gate is \`ai-sdlc/pr-ready\` (see \`.github/workflows/ai-sdlc-gate.yml\`).
+Run \`ai-sdlc health\` to verify your local config; see
+\`docs/operations/init.md\` for the adopter guide.
+<!-- end ai-sdlc:recommendation-pointer -->
+`;
+/** Sentinel marker used by the CLAUDE.md pointer for idempotency. */
+export const CLAUDE_MD_SENTINEL = '<!-- ai-sdlc:recommendation-pointer -->';
+/**
+ * Append the recommendation pointer to CLAUDE.md (or create the file if
+ * missing). Idempotent: if the sentinel is already present we no-op.
+ */
+export function ensureClaudeMdPointer(projectDir, adapters, dryRun) {
+    const path = join(projectDir, 'CLAUDE.md');
+    if (dryRun) {
+        adapters.log('  would update CLAUDE.md (recommendation pointer)');
+        return;
+    }
+    if (!adapters.exists(path)) {
+        adapters.writeFile(path, `# Project instructions\n${CLAUDE_MD_POINTER}`);
+        adapters.log('  created CLAUDE.md');
+        return;
+    }
+    const status = adapters.appendOnce(path, CLAUDE_MD_POINTER, CLAUDE_MD_SENTINEL);
+    if (status === 'appended') {
+        adapters.log('  updated CLAUDE.md (recommendation pointer)');
+    }
+    else {
+        adapters.log('  skip CLAUDE.md (recommendation pointer already present)');
+    }
+}
+//# sourceMappingURL=init-features.js.map

package/dist/cli/commands/init-templates.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Embedded template strings scaffolded by `ai-sdlc init` (AISDLC-143).
+ *
+ * Why these live in code instead of being read from disk at runtime:
+ *  - The orchestrator ships as an npm package; users `npm i -g
+ *    @ai-sdlc/orchestrator` and run `ai-sdlc init` in a brand new repo.
+ *    The `dist/` payload would not include arbitrary `*.yml` source
+ *    fixtures unless we listed each one in `package.json#files` AND
+ *    plumbed a `__dirname`-based loader through esm import-meta.url.
+ *  - Embedded strings work identically when invoked via `node ./dist/...`
+ *    from a checkout, via `npx @ai-sdlc/orchestrator init`, or via a
+ *    pre-bundled binary, with no runtime filesystem dependency.
+ *
+ * Drift policy: when the canonical workflow at
+ * `.github/workflows/ai-sdlc-gate.yml` (or the audit-only
+ * `verify-attestation.yml`) is updated for adopters, mirror the change
+ * here. The init-workspace test suite includes a smoke check that the
+ * embedded copy at least parses as a YAML mapping; AISDLC-140 sub-3's
+ * cutover memo will add a hard byte-equality assertion against the live
+ * file once the framework's own copy stabilizes.
+ *
+ * Q-decisions baked into the templates:
+ *  - Q1 (prescriptive default): the gate workflow is scaffolded
+ *    unconditionally — every adopter gets `ai-sdlc/pr-ready` on day one.
+ *  - Q3 (attestation = audit-only): verify-attestation template is the
+ *    audit-only variant; signing infrastructure is opt-in via
+ *    `--with-attestation`.
+ *  - Q4(b) (interactive default with --yes escape hatch): see
+ *    `init-features.ts` for the wizard wiring; this module just supplies
+ *    the byte content.
+ */
+/** `.github/workflows/ai-sdlc-gate.yml` — single rollup PR-ready check. */
+export declare const AI_SDLC_GATE_WORKFLOW = "name: AI-SDLC PR Ready Gate\n\n# Single rollup status check `ai-sdlc/pr-ready` that aggregates every PR\n# signal AI-SDLC adopters need into ONE branch-protection entry. Replaces\n# the historical pattern of enumerating N required checks by name + app_id,\n# which is brittle against path filters, [skip ci] tokens, matrix changes,\n# and multi-app posters. See `docs/operations/quality-gate.md` for the\n# full rationale.\n#\n# Industry pattern: `re-actors/alls-green` (\"alls-green\") is the de facto\n# community fix; named adopters include aiohttp, attrs, conda, setuptools,\n# pytest, pip-tools, Open edX, PyCA, PyPA, Mergify.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened]\n  merge_group:\n    types: [checks_requested]\n\nconcurrency:\n  group: ai-sdlc-gate-${{ github.event.pull_request.number || github.event.merge_group.head_sha || github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  pull-requests: read\n  checks: write\n\njobs:\n  detect:\n    name: Detect Changes\n    runs-on: ubuntu-latest\n    outputs:\n      docs_only: ${{ steps.filter.outputs.docs_only }}\n    steps:\n      - uses: actions/checkout@v4\n      - id: filter\n        uses: dorny/paths-filter@v3\n        with:\n          predicate-quantifier: 'every'\n          filters: |\n            docs_only:\n              - 'docs/**'\n              - '*.md'\n\n  lint:\n    name: Lint & Format\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - run: pnpm lint\n      - run: pnpm format:check\n\n  build-test:\n    name: Build & Test (Node ${{ matrix.node-version }})\n    needs: detect\n    if: needs.detect.outputs.docs_only != 'true'\n    runs-on: ubuntu-latest\n    strategy:\n      fail-fast: false\n      matrix:\n        node-version: [20, 22]\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node-version }}\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - run: pnpm build\n      - run: pnpm test\n\n  coverage:\n    name: Coverage\n    needs: detect\n    if: needs.detect.outputs.docs_only != 'true'\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - run: pnpm build\n      - run: pnpm test:coverage\n\n  pr-ready:\n    name: ai-sdlc/pr-ready\n    needs: [detect, lint, build-test, coverage]\n    if: always()\n    runs-on: ubuntu-latest\n    steps:\n      - name: Aggregate required signals\n        uses: re-actors/alls-green@release/v1\n        with:\n          jobs: ${{ toJSON(needs) }}\n";
+/**
+ * `.github/workflows/verify-attestation.yml` — AUDIT-ONLY verifier.
+ *
+ * Per Q3 in /tmp/quality-gate-redesign-final.md, attestation infrastructure
+ * is opt-in and audit-only. This workflow logs verification results to the
+ * action run log but does NOT post a required-status check or block merges.
+ * Operators who want to promote attestation to a hard gate can edit the
+ * \`Log audit result\` step to write to commit statuses.
+ */
+export declare const VERIFY_ATTESTATION_WORKFLOW = "name: AI-SDLC Verify Review Attestation\n\n# Reads the DSSE attestation at .ai-sdlc/attestations/<head-sha>.dsse.json\n# and verifies the signature against any-of-N pubkeys in\n# .ai-sdlc/trusted-reviewers.yaml.\n#\n# AUDIT-ONLY: this workflow logs verification results (success/failure with\n# reason) for forensic purposes but does NOT post a required commit status.\n# The single merge gate is `ai-sdlc/pr-ready` from ai-sdlc-gate.yml.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened]\n    branches: [main]\n    paths-ignore:\n      - 'docs/**'\n      - '*.md'\n  merge_group:\n    types: [checks_requested]\n\nconcurrency:\n  group: verify-attestation-${{ github.event.pull_request.number || github.event.merge_group.head_sha }}\n  cancel-in-progress: true\n\njobs:\n  verify:\n    name: Verify attestation\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - name: Resolve subject SHA + base SHA from event payload\n        id: resolve\n        run: |\n          if [ \"${{ github.event_name }}\" = \"merge_group\" ]; then\n            echo \"head_sha=${{ github.event.merge_group.head_sha }}\" >> \"$GITHUB_OUTPUT\"\n            echo \"base_sha=${{ github.event.merge_group.base_sha }}\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"head_sha=${{ github.event.pull_request.head.sha }}\" >> \"$GITHUB_OUTPUT\"\n            echo \"base_sha=${{ github.event.pull_request.base.sha }}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n          ref: ${{ steps.resolve.outputs.head_sha }}\n\n      - name: Log audit result\n        env:\n          HEAD_SHA: ${{ steps.resolve.outputs.head_sha }}\n        run: |\n          if [ -f \".ai-sdlc/attestations/${HEAD_SHA}.dsse.json\" ]; then\n            echo \"::notice::ai-sdlc attestation AUDIT \u2014 envelope present at ${HEAD_SHA}\"\n          else\n            echo \"::notice::ai-sdlc attestation AUDIT \u2014 no envelope on ${HEAD_SHA} (audit-only, not blocking)\"\n          fi\n";
+/**
+ * `.husky/pre-push` snippet that signs an attestation when one is missing
+ * for the current HEAD. Installed when `--with-attestation` is opted in;
+ * the actual `sign-attestation.mjs` script ships separately with the
+ * orchestrator and is referenced by the canonical command stub here.
+ *
+ * Adopters typically already have a `.husky/pre-push` from their existing
+ * tooling; the wizard appends our snippet behind a sentinel so we can
+ * extend an existing hook without trampling user content.
+ */
+export declare const HUSKY_PREPUSH_SIGN_SNIPPET = "# ai-sdlc:attestation-sign-block\n# Signs the DSSE attestation envelope for the current HEAD when verdict\n# files exist. Skip with AI_SDLC_SKIP_ATTESTATION_SIGN=1.\nif [ -z \"${AI_SDLC_SKIP_ATTESTATION_SIGN:-}\" ] && [ -x \"./scripts/check-attestation-sign.sh\" ]; then\n  ./scripts/check-attestation-sign.sh\nfi\n# end ai-sdlc:attestation-sign-block\n";
+/**
+ * `.ai-sdlc/trusted-reviewers.yaml` stub — empty allowlist with operator
+ * instructions. The wizard scaffolds this so adopters have a single file
+ * to receive contributor pubkey PRs into; bootstrap a contributor with
+ * `/ai-sdlc init-signing-key` and append the printed YAML block.
+ */
+export declare const TRUSTED_REVIEWERS_STUB = "# Trusted contributor signing keys for review attestations.\n#\n# This file is a stub created by `ai-sdlc init --with-attestation`. Add\n# entries by running `/ai-sdlc init-signing-key` on a contributor's\n# machine and opening a PR that appends the printed YAML block below.\n#\n# Schema:\n#   - identity:  free-form string (typically email or GitHub handle)\n#   - machine:   free-form label (lets one identity register multiple keys)\n#   - pubkey:    PEM-encoded ed25519 public key (multi-line block scalar)\n#   - addedAt:   ISO 8601 date the entry was added\n#   - addedBy:   GitHub handle of the maintainer who approved this entry's PR\n#\n# The verifier in CI uses a strict YAML format: every scalar value\n# single-quoted; `pubkey:` is a `|` block scalar with each PEM line\n# indented exactly 6 spaces; no tab characters anywhere.\n\nreviewers: []\n";
+/**
+ * `.ai-sdlc/dor-config.yaml` stub — Definition-of-Ready rubric config.
+ *
+ * Mirrors the production DoR config used by the framework itself; ships
+ * in warn-only mode so a fresh adopter does not get blocked by the rubric
+ * while they tune it.
+ */
+export declare const DOR_CONFIG_STUB = "# Definition-of-Ready (DoR) gate configuration.\n#\n# The DoR rubric scores incoming issues + backlog tasks against seven\n# criteria (binary-testable ACs, no wishlist markers, references resolve,\n# bounded scope, surface named, done-state describable, no invisible\n# dependencies). Failing the rubric posts a clarification comment on the\n# issue / PR.\n#\n# Ships in warn-only mode by default \u2014 flip to 'enforce' after the soak\n# window confirms the false-positive rate is low.\n\napiVersion: ai-sdlc.io/v1alpha1\nkind: DorConfig\nmetadata:\n  name: ai-sdlc-dor\nspec:\n  rubricVersion: v1\n  evaluationMode: warn-only\n\n  notifications:\n    authorChannel: true\n    # dedicatedChannel:\n    #   slack: '#ai-sdlc-dor'\n\n  staleness:\n    warnAfterDays: 14\n    closeAfterDays: 28\n    closedLabel: 'closed-as-stale-dor'\n";
+/** `.github/workflows/dor-ingress.yml` — minimal DoR ingress shim. */
+export declare const DOR_INGRESS_WORKFLOW = "name: AI-SDLC DoR Ingress\n\n# Wires the DoR rubric into the GitHub issue + PR lifecycle:\n#   - issues:opened / issues:edited  \u2192 score the issue body, post the\n#     idempotent clarification comment when needs-clarification.\n#   - pull_request touching backlog/tasks/*.md \u2192 score the changed\n#     task bodies (the in-repo equivalent of an issue).\n#\n# Ships in warn-only mode (see .ai-sdlc/dor-config.yaml). Flip the\n# config's `evaluationMode` to `enforce` after the soak window.\n\non:\n  issues:\n    types: [opened, edited]\n  pull_request:\n    types: [opened, synchronize, reopened]\n    paths:\n      - 'backlog/tasks/*.md'\n\nconcurrency:\n  group: dor-ingress-${{ github.event.issue.number || github.event.pull_request.number }}\n  cancel-in-progress: true\n\njobs:\n  evaluate:\n    name: Evaluate against DoR rubric\n    runs-on: ubuntu-latest\n    permissions:\n      issues: write\n      pull-requests: write\n      contents: read\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - name: Evaluate DoR (placeholder \u2014 wire to your DoR runner)\n        run: |\n          echo \"::notice::DoR ingress shim invoked. Wire pnpm --filter @ai-sdlc/pipeline-cli evaluate-dor here.\"\n";
+/**
+ * `.ai-sdlc/review-classifier.yaml` stub — cost-optimized review tiers.
+ *
+ * The actual classifier code ships via AISDLC-141 (a follow-up). For now
+ * the wizard scaffolds the config stub + a pointer to the classifier
+ * docs so adopters who opt in via `--with-classifier` are ready to flip
+ * on the workflow once AISDLC-141 lands.
+ */
+export declare const REVIEW_CLASSIFIER_STUB = "# Review classifier configuration (AISDLC-141, follow-up).\n#\n# The review classifier inspects a PR diff and decides which review tier\n# to invoke (cheap-pattern-match \u2192 mid-tier-LLM \u2192 full reviewer fan-out)\n# to keep review costs bounded as PR volume grows.\n#\n# This file is a stub scaffolded by `ai-sdlc init --with-classifier`.\n# The classifier runtime ships in AISDLC-141; until then this config is\n# advisory only. See docs/operations/init.md for the migration path.\n\napiVersion: ai-sdlc.io/v1alpha1\nkind: ReviewClassifier\nmetadata:\n  name: default-classifier\nspec:\n  tiers:\n    - name: cheap\n      maxFilesChanged: 5\n      maxLinesChanged: 50\n      strategy: pattern-match\n    - name: mid\n      maxFilesChanged: 20\n      maxLinesChanged: 500\n      strategy: single-llm-pass\n    - name: full\n      strategy: full-reviewer-fanout\n  routing:\n    docsOnly: cheap\n    testOnly: cheap\n    default: mid\n";
+/**
+ * The set of feature templates exported as a single map so the wizard
+ * dispatcher can iterate without each feature growing its own switch
+ * statement.
+ *
+ * Each entry maps a relative path inside the target repo to the literal
+ * bytes to write. Paths are POSIX-style; the writer joins them onto the
+ * project dir using `node:path/join` which is platform-correct.
+ */
+export interface FeatureTemplateSet {
+    /** Files under the project root keyed by relative POSIX path. */
+    files: Record<string, string>;
+}
+export declare const DOR_TEMPLATES: FeatureTemplateSet;
+export declare const ATTESTATION_TEMPLATES: FeatureTemplateSet;
+export declare const CLASSIFIER_TEMPLATES: FeatureTemplateSet;
+/**
+ * Always-on baseline workflow templates (regardless of wizard answers).
+ * Matches AC #4 in AISDLC-143: pipeline.yaml + agent-role.yaml +
+ * quality-gate.yaml + autonomy-policy.yaml are scaffolded by `initProject`
+ * (existing logic) and the gate workflow is scaffolded by this map.
+ */
+export declare const BASELINE_WORKFLOW_TEMPLATES: FeatureTemplateSet;
+//# sourceMappingURL=init-templates.d.ts.map