@ai-sdlc/orchestrator 0.9.0 → 0.10.0

package/dist/cli/commands/init-templates.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Embedded template strings scaffolded by `ai-sdlc init` (AISDLC-143).
+ *
+ * Why these live in code instead of being read from disk at runtime:
+ *  - The orchestrator ships as an npm package; users `npm i -g
+ *    @ai-sdlc/orchestrator` and run `ai-sdlc init` in a brand new repo.
+ *    The `dist/` payload would not include arbitrary `*.yml` source
+ *    fixtures unless we listed each one in `package.json#files` AND
+ *    plumbed a `__dirname`-based loader through esm import-meta.url.
+ *  - Embedded strings work identically when invoked via `node ./dist/...`
+ *    from a checkout, via `npx @ai-sdlc/orchestrator init`, or via a
+ *    pre-bundled binary, with no runtime filesystem dependency.
+ *
+ * Drift policy: when the canonical workflow at
+ * `.github/workflows/ai-sdlc-gate.yml` (or the audit-only
+ * `verify-attestation.yml`) is updated for adopters, mirror the change
+ * here. The init-workspace test suite includes a smoke check that the
+ * embedded copy at least parses as a YAML mapping; AISDLC-140 sub-3's
+ * cutover memo will add a hard byte-equality assertion against the live
+ * file once the framework's own copy stabilizes.
+ *
+ * Q-decisions baked into the templates:
+ *  - Q1 (prescriptive default): the gate workflow is scaffolded
+ *    unconditionally — every adopter gets `ai-sdlc/pr-ready` on day one.
+ *  - Q3 (attestation = audit-only): verify-attestation template is the
+ *    audit-only variant; signing infrastructure is opt-in via
+ *    `--with-attestation`.
+ *  - Q4(b) (interactive default with --yes escape hatch): see
+ *    `init-features.ts` for the wizard wiring; this module just supplies
+ *    the byte content.
+ */
+/** `.github/workflows/ai-sdlc-gate.yml` — single rollup PR-ready check. */
+export declare const AI_SDLC_GATE_WORKFLOW = "name: AI-SDLC PR Ready Gate\n\n# Single rollup status check `ai-sdlc/pr-ready` that aggregates every PR\n# signal AI-SDLC adopters need into ONE branch-protection entry. Replaces\n# the historical pattern of enumerating N required checks by name + app_id,\n# which is brittle against path filters, [skip ci] tokens, matrix changes,\n# and multi-app posters. See `docs/operations/quality-gate.md` for the\n# full rationale.\n#\n# Industry pattern: `re-actors/alls-green` (\"alls-green\") is the de facto\n# community fix; named adopters include aiohttp, attrs, conda, setuptools,\n# pytest, pip-tools, Open edX, PyCA, PyPA, Mergify.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened]\n  merge_group:\n    types: [checks_requested]\n\nconcurrency:\n  group: ai-sdlc-gate-${{ github.event.pull_request.number || github.event.merge_group.head_sha || github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  pull-requests: read\n  checks: write\n\njobs:\n  detect:\n    name: Detect Changes\n    runs-on: ubuntu-latest\n    outputs:\n      docs_only: ${{ steps.filter.outputs.docs_only }}\n    steps:\n      - uses: actions/checkout@v4\n      - id: filter\n        uses: dorny/paths-filter@v3\n        with:\n          predicate-quantifier: 'every'\n          filters: |\n            docs_only:\n              - 'docs/**'\n              - '*.md'\n\n  lint:\n    name: Lint & Format\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - run: pnpm lint\n      - run: pnpm format:check\n\n  build-test:\n    name: Build & Test (Node ${{ matrix.node-version }})\n    needs: detect\n    if: needs.detect.outputs.docs_only != 'true'\n    runs-on: ubuntu-latest\n    strategy:\n      fail-fast: false\n      matrix:\n        node-version: [20, 22]\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node-version }}\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - run: pnpm build\n      - run: pnpm test\n\n  coverage:\n    name: Coverage\n    needs: detect\n    if: needs.detect.outputs.docs_only != 'true'\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - run: pnpm build\n      - run: pnpm test:coverage\n\n  pr-ready:\n    name: ai-sdlc/pr-ready\n    needs: [detect, lint, build-test, coverage]\n    if: always()\n    runs-on: ubuntu-latest\n    steps:\n      - name: Aggregate required signals\n        uses: re-actors/alls-green@release/v1\n        with:\n          jobs: ${{ toJSON(needs) }}\n";
+/**
+ * `.github/workflows/verify-attestation.yml` — AUDIT-ONLY verifier.
+ *
+ * Per Q3 in /tmp/quality-gate-redesign-final.md, attestation infrastructure
+ * is opt-in and audit-only. This workflow logs verification results to the
+ * action run log but does NOT post a required-status check or block merges.
+ * Operators who want to promote attestation to a hard gate can edit the
+ * \`Log audit result\` step to write to commit statuses.
+ */
+export declare const VERIFY_ATTESTATION_WORKFLOW = "name: AI-SDLC Verify Review Attestation\n\n# Reads the DSSE attestation at .ai-sdlc/attestations/<head-sha>.dsse.json\n# and verifies the signature against any-of-N pubkeys in\n# .ai-sdlc/trusted-reviewers.yaml.\n#\n# AUDIT-ONLY: this workflow logs verification results (success/failure with\n# reason) for forensic purposes but does NOT post a required commit status.\n# The single merge gate is `ai-sdlc/pr-ready` from ai-sdlc-gate.yml.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened]\n    branches: [main]\n    paths-ignore:\n      - 'docs/**'\n      - '*.md'\n  merge_group:\n    types: [checks_requested]\n\nconcurrency:\n  group: verify-attestation-${{ github.event.pull_request.number || github.event.merge_group.head_sha }}\n  cancel-in-progress: true\n\njobs:\n  verify:\n    name: Verify attestation\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - name: Resolve subject SHA + base SHA from event payload\n        id: resolve\n        run: |\n          if [ \"${{ github.event_name }}\" = \"merge_group\" ]; then\n            echo \"head_sha=${{ github.event.merge_group.head_sha }}\" >> \"$GITHUB_OUTPUT\"\n            echo \"base_sha=${{ github.event.merge_group.base_sha }}\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"head_sha=${{ github.event.pull_request.head.sha }}\" >> \"$GITHUB_OUTPUT\"\n            echo \"base_sha=${{ github.event.pull_request.base.sha }}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n          ref: ${{ steps.resolve.outputs.head_sha }}\n\n      - name: Log audit result\n        env:\n          HEAD_SHA: ${{ steps.resolve.outputs.head_sha }}\n        run: |\n          if [ -f \".ai-sdlc/attestations/${HEAD_SHA}.dsse.json\" ]; then\n            echo \"::notice::ai-sdlc attestation AUDIT \u2014 envelope present at ${HEAD_SHA}\"\n          else\n            echo \"::notice::ai-sdlc attestation AUDIT \u2014 no envelope on ${HEAD_SHA} (audit-only, not blocking)\"\n          fi\n";
+/**
+ * `.husky/pre-push` snippet that signs an attestation when one is missing
+ * for the current HEAD. Installed when `--with-attestation` is opted in;
+ * the actual `sign-attestation.mjs` script ships separately with the
+ * orchestrator and is referenced by the canonical command stub here.
+ *
+ * Adopters typically already have a `.husky/pre-push` from their existing
+ * tooling; the wizard appends our snippet behind a sentinel so we can
+ * extend an existing hook without trampling user content.
+ */
+export declare const HUSKY_PREPUSH_SIGN_SNIPPET = "# ai-sdlc:attestation-sign-block\n# Signs the DSSE attestation envelope for the current HEAD when verdict\n# files exist. Skip with AI_SDLC_SKIP_ATTESTATION_SIGN=1.\nif [ -z \"${AI_SDLC_SKIP_ATTESTATION_SIGN:-}\" ] && [ -x \"./scripts/check-attestation-sign.sh\" ]; then\n  ./scripts/check-attestation-sign.sh\nfi\n# end ai-sdlc:attestation-sign-block\n";
+/**
+ * `.ai-sdlc/trusted-reviewers.yaml` stub — empty allowlist with operator
+ * instructions. The wizard scaffolds this so adopters have a single file
+ * to receive contributor pubkey PRs into; bootstrap a contributor with
+ * `/ai-sdlc init-signing-key` and append the printed YAML block.
+ */
+export declare const TRUSTED_REVIEWERS_STUB = "# Trusted contributor signing keys for review attestations.\n#\n# This file is a stub created by `ai-sdlc init --with-attestation`. Add\n# entries by running `/ai-sdlc init-signing-key` on a contributor's\n# machine and opening a PR that appends the printed YAML block below.\n#\n# Schema:\n#   - identity:  free-form string (typically email or GitHub handle)\n#   - machine:   free-form label (lets one identity register multiple keys)\n#   - pubkey:    PEM-encoded ed25519 public key (multi-line block scalar)\n#   - addedAt:   ISO 8601 date the entry was added\n#   - addedBy:   GitHub handle of the maintainer who approved this entry's PR\n#\n# The verifier in CI uses a strict YAML format: every scalar value\n# single-quoted; `pubkey:` is a `|` block scalar with each PEM line\n# indented exactly 6 spaces; no tab characters anywhere.\n\nreviewers: []\n";
+/**
+ * `.ai-sdlc/dor-config.yaml` stub — Definition-of-Ready rubric config.
+ *
+ * Mirrors the production DoR config used by the framework itself; ships
+ * in warn-only mode so a fresh adopter does not get blocked by the rubric
+ * while they tune it.
+ */
+export declare const DOR_CONFIG_STUB = "# Definition-of-Ready (DoR) gate configuration.\n#\n# The DoR rubric scores incoming issues + backlog tasks against seven\n# criteria (binary-testable ACs, no wishlist markers, references resolve,\n# bounded scope, surface named, done-state describable, no invisible\n# dependencies). Failing the rubric posts a clarification comment on the\n# issue / PR.\n#\n# Ships in warn-only mode by default \u2014 flip to 'enforce' after the soak\n# window confirms the false-positive rate is low.\n\napiVersion: ai-sdlc.io/v1alpha1\nkind: DorConfig\nmetadata:\n  name: ai-sdlc-dor\nspec:\n  rubricVersion: v1\n  evaluationMode: warn-only\n\n  notifications:\n    authorChannel: true\n    # dedicatedChannel:\n    #   slack: '#ai-sdlc-dor'\n\n  staleness:\n    warnAfterDays: 14\n    closeAfterDays: 28\n    closedLabel: 'closed-as-stale-dor'\n";
+/** `.github/workflows/dor-ingress.yml` — minimal DoR ingress shim. */
+export declare const DOR_INGRESS_WORKFLOW = "name: AI-SDLC DoR Ingress\n\n# Wires the DoR rubric into the GitHub issue + PR lifecycle:\n#   - issues:opened / issues:edited  \u2192 score the issue body, post the\n#     idempotent clarification comment when needs-clarification.\n#   - pull_request touching backlog/tasks/*.md \u2192 score the changed\n#     task bodies (the in-repo equivalent of an issue).\n#\n# Ships in warn-only mode (see .ai-sdlc/dor-config.yaml). Flip the\n# config's `evaluationMode` to `enforce` after the soak window.\n\non:\n  issues:\n    types: [opened, edited]\n  pull_request:\n    types: [opened, synchronize, reopened]\n    paths:\n      - 'backlog/tasks/*.md'\n\nconcurrency:\n  group: dor-ingress-${{ github.event.issue.number || github.event.pull_request.number }}\n  cancel-in-progress: true\n\njobs:\n  evaluate:\n    name: Evaluate against DoR rubric\n    runs-on: ubuntu-latest\n    permissions:\n      issues: write\n      pull-requests: write\n      contents: read\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - name: Evaluate DoR (placeholder \u2014 wire to your DoR runner)\n        run: |\n          echo \"::notice::DoR ingress shim invoked. Wire pnpm --filter @ai-sdlc/pipeline-cli evaluate-dor here.\"\n";
+/**
+ * `.ai-sdlc/review-classifier.yaml` stub — cost-optimized review tiers.
+ *
+ * The actual classifier code ships via AISDLC-141 (a follow-up). For now
+ * the wizard scaffolds the config stub + a pointer to the classifier
+ * docs so adopters who opt in via `--with-classifier` are ready to flip
+ * on the workflow once AISDLC-141 lands.
+ */
+export declare const REVIEW_CLASSIFIER_STUB = "# Review classifier configuration (AISDLC-141, follow-up).\n#\n# The review classifier inspects a PR diff and decides which review tier\n# to invoke (cheap-pattern-match \u2192 mid-tier-LLM \u2192 full reviewer fan-out)\n# to keep review costs bounded as PR volume grows.\n#\n# This file is a stub scaffolded by `ai-sdlc init --with-classifier`.\n# The classifier runtime ships in AISDLC-141; until then this config is\n# advisory only. See docs/operations/init.md for the migration path.\n\napiVersion: ai-sdlc.io/v1alpha1\nkind: ReviewClassifier\nmetadata:\n  name: default-classifier\nspec:\n  tiers:\n    - name: cheap\n      maxFilesChanged: 5\n      maxLinesChanged: 50\n      strategy: pattern-match\n    - name: mid\n      maxFilesChanged: 20\n      maxLinesChanged: 500\n      strategy: single-llm-pass\n    - name: full\n      strategy: full-reviewer-fanout\n  routing:\n    docsOnly: cheap\n    testOnly: cheap\n    default: mid\n";
+/**
+ * The set of feature templates exported as a single map so the wizard
+ * dispatcher can iterate without each feature growing its own switch
+ * statement.
+ *
+ * Each entry maps a relative path inside the target repo to the literal
+ * bytes to write. Paths are POSIX-style; the writer joins them onto the
+ * project dir using `node:path/join` which is platform-correct.
+ */
+export interface FeatureTemplateSet {
+    /** Files under the project root keyed by relative POSIX path. */
+    files: Record<string, string>;
+}
+export declare const DOR_TEMPLATES: FeatureTemplateSet;
+export declare const ATTESTATION_TEMPLATES: FeatureTemplateSet;
+export declare const CLASSIFIER_TEMPLATES: FeatureTemplateSet;
+/**
+ * Always-on baseline workflow templates (regardless of wizard answers).
+ * Matches AC #4 in AISDLC-143: pipeline.yaml + agent-role.yaml +
+ * quality-gate.yaml + autonomy-policy.yaml are scaffolded by `initProject`
+ * (existing logic) and the gate workflow is scaffolded by this map.
+ */
+export declare const BASELINE_WORKFLOW_TEMPLATES: FeatureTemplateSet;
+//# sourceMappingURL=init-templates.d.ts.map

package/dist/cli/commands/init-templates.js

@@ -0,0 +1,399 @@
+/**
+ * Embedded template strings scaffolded by `ai-sdlc init` (AISDLC-143).
+ *
+ * Why these live in code instead of being read from disk at runtime:
+ *  - The orchestrator ships as an npm package; users `npm i -g
+ *    @ai-sdlc/orchestrator` and run `ai-sdlc init` in a brand new repo.
+ *    The `dist/` payload would not include arbitrary `*.yml` source
+ *    fixtures unless we listed each one in `package.json#files` AND
+ *    plumbed a `__dirname`-based loader through esm import-meta.url.
+ *  - Embedded strings work identically when invoked via `node ./dist/...`
+ *    from a checkout, via `npx @ai-sdlc/orchestrator init`, or via a
+ *    pre-bundled binary, with no runtime filesystem dependency.
+ *
+ * Drift policy: when the canonical workflow at
+ * `.github/workflows/ai-sdlc-gate.yml` (or the audit-only
+ * `verify-attestation.yml`) is updated for adopters, mirror the change
+ * here. The init-workspace test suite includes a smoke check that the
+ * embedded copy at least parses as a YAML mapping; AISDLC-140 sub-3's
+ * cutover memo will add a hard byte-equality assertion against the live
+ * file once the framework's own copy stabilizes.
+ *
+ * Q-decisions baked into the templates:
+ *  - Q1 (prescriptive default): the gate workflow is scaffolded
+ *    unconditionally — every adopter gets `ai-sdlc/pr-ready` on day one.
+ *  - Q3 (attestation = audit-only): verify-attestation template is the
+ *    audit-only variant; signing infrastructure is opt-in via
+ *    `--with-attestation`.
+ *  - Q4(b) (interactive default with --yes escape hatch): see
+ *    `init-features.ts` for the wizard wiring; this module just supplies
+ *    the byte content.
+ */
+/** `.github/workflows/ai-sdlc-gate.yml` — single rollup PR-ready check. */
+export const AI_SDLC_GATE_WORKFLOW = `name: AI-SDLC PR Ready Gate
+
+# Single rollup status check \`ai-sdlc/pr-ready\` that aggregates every PR
+# signal AI-SDLC adopters need into ONE branch-protection entry. Replaces
+# the historical pattern of enumerating N required checks by name + app_id,
+# which is brittle against path filters, [skip ci] tokens, matrix changes,
+# and multi-app posters. See \`docs/operations/quality-gate.md\` for the
+# full rationale.
+#
+# Industry pattern: \`re-actors/alls-green\` ("alls-green") is the de facto
+# community fix; named adopters include aiohttp, attrs, conda, setuptools,
+# pytest, pip-tools, Open edX, PyCA, PyPA, Mergify.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  merge_group:
+    types: [checks_requested]
+
+concurrency:
+  group: ai-sdlc-gate-\${{ github.event.pull_request.number || github.event.merge_group.head_sha || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: read
+  checks: write
+
+jobs:
+  detect:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    outputs:
+      docs_only: \${{ steps.filter.outputs.docs_only }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          predicate-quantifier: 'every'
+          filters: |
+            docs_only:
+              - 'docs/**'
+              - '*.md'
+
+  lint:
+    name: Lint & Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm lint
+      - run: pnpm format:check
+
+  build-test:
+    name: Build & Test (Node \${{ matrix.node-version }})
+    needs: detect
+    if: needs.detect.outputs.docs_only != 'true'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [20, 22]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: \${{ matrix.node-version }}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+      - run: pnpm test
+
+  coverage:
+    name: Coverage
+    needs: detect
+    if: needs.detect.outputs.docs_only != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+      - run: pnpm test:coverage
+
+  pr-ready:
+    name: ai-sdlc/pr-ready
+    needs: [detect, lint, build-test, coverage]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Aggregate required signals
+        uses: re-actors/alls-green@release/v1
+        with:
+          jobs: \${{ toJSON(needs) }}
+`;
+/**
+ * `.github/workflows/verify-attestation.yml` — AUDIT-ONLY verifier.
+ *
+ * Per Q3 in /tmp/quality-gate-redesign-final.md, attestation infrastructure
+ * is opt-in and audit-only. This workflow logs verification results to the
+ * action run log but does NOT post a required-status check or block merges.
+ * Operators who want to promote attestation to a hard gate can edit the
+ * \`Log audit result\` step to write to commit statuses.
+ */
+export const VERIFY_ATTESTATION_WORKFLOW = `name: AI-SDLC Verify Review Attestation
+
+# Reads the DSSE attestation at .ai-sdlc/attestations/<head-sha>.dsse.json
+# and verifies the signature against any-of-N pubkeys in
+# .ai-sdlc/trusted-reviewers.yaml.
+#
+# AUDIT-ONLY: this workflow logs verification results (success/failure with
+# reason) for forensic purposes but does NOT post a required commit status.
+# The single merge gate is \`ai-sdlc/pr-ready\` from ai-sdlc-gate.yml.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+  merge_group:
+    types: [checks_requested]
+
+concurrency:
+  group: verify-attestation-\${{ github.event.pull_request.number || github.event.merge_group.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Verify attestation
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Resolve subject SHA + base SHA from event payload
+        id: resolve
+        run: |
+          if [ "\${{ github.event_name }}" = "merge_group" ]; then
+            echo "head_sha=\${{ github.event.merge_group.head_sha }}" >> "$GITHUB_OUTPUT"
+            echo "base_sha=\${{ github.event.merge_group.base_sha }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "head_sha=\${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
+            echo "base_sha=\${{ github.event.pull_request.base.sha }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: \${{ steps.resolve.outputs.head_sha }}
+
+      - name: Log audit result
+        env:
+          HEAD_SHA: \${{ steps.resolve.outputs.head_sha }}
+        run: |
+          if [ -f ".ai-sdlc/attestations/\${HEAD_SHA}.dsse.json" ]; then
+            echo "::notice::ai-sdlc attestation AUDIT — envelope present at \${HEAD_SHA}"
+          else
+            echo "::notice::ai-sdlc attestation AUDIT — no envelope on \${HEAD_SHA} (audit-only, not blocking)"
+          fi
+`;
+/**
+ * `.husky/pre-push` snippet that signs an attestation when one is missing
+ * for the current HEAD. Installed when `--with-attestation` is opted in;
+ * the actual `sign-attestation.mjs` script ships separately with the
+ * orchestrator and is referenced by the canonical command stub here.
+ *
+ * Adopters typically already have a `.husky/pre-push` from their existing
+ * tooling; the wizard appends our snippet behind a sentinel so we can
+ * extend an existing hook without trampling user content.
+ */
+export const HUSKY_PREPUSH_SIGN_SNIPPET = `# ai-sdlc:attestation-sign-block
+# Signs the DSSE attestation envelope for the current HEAD when verdict
+# files exist. Skip with AI_SDLC_SKIP_ATTESTATION_SIGN=1.
+if [ -z "\${AI_SDLC_SKIP_ATTESTATION_SIGN:-}" ] && [ -x "./scripts/check-attestation-sign.sh" ]; then
+  ./scripts/check-attestation-sign.sh
+fi
+# end ai-sdlc:attestation-sign-block
+`;
+/**
+ * `.ai-sdlc/trusted-reviewers.yaml` stub — empty allowlist with operator
+ * instructions. The wizard scaffolds this so adopters have a single file
+ * to receive contributor pubkey PRs into; bootstrap a contributor with
+ * `/ai-sdlc init-signing-key` and append the printed YAML block.
+ */
+export const TRUSTED_REVIEWERS_STUB = `# Trusted contributor signing keys for review attestations.
+#
+# This file is a stub created by \`ai-sdlc init --with-attestation\`. Add
+# entries by running \`/ai-sdlc init-signing-key\` on a contributor's
+# machine and opening a PR that appends the printed YAML block below.
+#
+# Schema:
+#   - identity:  free-form string (typically email or GitHub handle)
+#   - machine:   free-form label (lets one identity register multiple keys)
+#   - pubkey:    PEM-encoded ed25519 public key (multi-line block scalar)
+#   - addedAt:   ISO 8601 date the entry was added
+#   - addedBy:   GitHub handle of the maintainer who approved this entry's PR
+#
+# The verifier in CI uses a strict YAML format: every scalar value
+# single-quoted; \`pubkey:\` is a \`|\` block scalar with each PEM line
+# indented exactly 6 spaces; no tab characters anywhere.
+
+reviewers: []
+`;
+/**
+ * `.ai-sdlc/dor-config.yaml` stub — Definition-of-Ready rubric config.
+ *
+ * Mirrors the production DoR config used by the framework itself; ships
+ * in warn-only mode so a fresh adopter does not get blocked by the rubric
+ * while they tune it.
+ */
+export const DOR_CONFIG_STUB = `# Definition-of-Ready (DoR) gate configuration.
+#
+# The DoR rubric scores incoming issues + backlog tasks against seven
+# criteria (binary-testable ACs, no wishlist markers, references resolve,
+# bounded scope, surface named, done-state describable, no invisible
+# dependencies). Failing the rubric posts a clarification comment on the
+# issue / PR.
+#
+# Ships in warn-only mode by default — flip to 'enforce' after the soak
+# window confirms the false-positive rate is low.
+
+apiVersion: ai-sdlc.io/v1alpha1
+kind: DorConfig
+metadata:
+  name: ai-sdlc-dor
+spec:
+  rubricVersion: v1
+  evaluationMode: warn-only
+
+  notifications:
+    authorChannel: true
+    # dedicatedChannel:
+    #   slack: '#ai-sdlc-dor'
+
+  staleness:
+    warnAfterDays: 14
+    closeAfterDays: 28
+    closedLabel: 'closed-as-stale-dor'
+`;
+/** `.github/workflows/dor-ingress.yml` — minimal DoR ingress shim. */
+export const DOR_INGRESS_WORKFLOW = `name: AI-SDLC DoR Ingress
+
+# Wires the DoR rubric into the GitHub issue + PR lifecycle:
+#   - issues:opened / issues:edited  → score the issue body, post the
+#     idempotent clarification comment when needs-clarification.
+#   - pull_request touching backlog/tasks/*.md → score the changed
+#     task bodies (the in-repo equivalent of an issue).
+#
+# Ships in warn-only mode (see .ai-sdlc/dor-config.yaml). Flip the
+# config's \`evaluationMode\` to \`enforce\` after the soak window.
+
+on:
+  issues:
+    types: [opened, edited]
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'backlog/tasks/*.md'
+
+concurrency:
+  group: dor-ingress-\${{ github.event.issue.number || github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  evaluate:
+    name: Evaluate against DoR rubric
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Evaluate DoR (placeholder — wire to your DoR runner)
+        run: |
+          echo "::notice::DoR ingress shim invoked. Wire pnpm --filter @ai-sdlc/pipeline-cli evaluate-dor here."
+`;
+/**
+ * `.ai-sdlc/review-classifier.yaml` stub — cost-optimized review tiers.
+ *
+ * The actual classifier code ships via AISDLC-141 (a follow-up). For now
+ * the wizard scaffolds the config stub + a pointer to the classifier
+ * docs so adopters who opt in via `--with-classifier` are ready to flip
+ * on the workflow once AISDLC-141 lands.
+ */
+export const REVIEW_CLASSIFIER_STUB = `# Review classifier configuration (AISDLC-141, follow-up).
+#
+# The review classifier inspects a PR diff and decides which review tier
+# to invoke (cheap-pattern-match → mid-tier-LLM → full reviewer fan-out)
+# to keep review costs bounded as PR volume grows.
+#
+# This file is a stub scaffolded by \`ai-sdlc init --with-classifier\`.
+# The classifier runtime ships in AISDLC-141; until then this config is
+# advisory only. See docs/operations/init.md for the migration path.
+
+apiVersion: ai-sdlc.io/v1alpha1
+kind: ReviewClassifier
+metadata:
+  name: default-classifier
+spec:
+  tiers:
+    - name: cheap
+      maxFilesChanged: 5
+      maxLinesChanged: 50
+      strategy: pattern-match
+    - name: mid
+      maxFilesChanged: 20
+      maxLinesChanged: 500
+      strategy: single-llm-pass
+    - name: full
+      strategy: full-reviewer-fanout
+  routing:
+    docsOnly: cheap
+    testOnly: cheap
+    default: mid
+`;
+export const DOR_TEMPLATES = {
+    files: {
+        '.ai-sdlc/dor-config.yaml': DOR_CONFIG_STUB,
+        '.github/workflows/dor-ingress.yml': DOR_INGRESS_WORKFLOW,
+    },
+};
+export const ATTESTATION_TEMPLATES = {
+    files: {
+        '.ai-sdlc/trusted-reviewers.yaml': TRUSTED_REVIEWERS_STUB,
+        '.github/workflows/verify-attestation.yml': VERIFY_ATTESTATION_WORKFLOW,
+        // The .gitkeep ensures the attestations dir is tracked in git so the
+        // first PR's envelope lands cleanly without "directory does not exist"
+        // errors from the signing script.
+        '.ai-sdlc/attestations/.gitkeep': '',
+    },
+};
+export const CLASSIFIER_TEMPLATES = {
+    files: {
+        '.ai-sdlc/review-classifier.yaml': REVIEW_CLASSIFIER_STUB,
+    },
+};
+/**
+ * Always-on baseline workflow templates (regardless of wizard answers).
+ * Matches AC #4 in AISDLC-143: pipeline.yaml + agent-role.yaml +
+ * quality-gate.yaml + autonomy-policy.yaml are scaffolded by `initProject`
+ * (existing logic) and the gate workflow is scaffolded by this map.
+ */
+export const BASELINE_WORKFLOW_TEMPLATES = {
+    files: {
+        '.github/workflows/ai-sdlc-gate.yml': AI_SDLC_GATE_WORKFLOW,
+    },
+};
+//# sourceMappingURL=init-templates.js.map

package/dist/cli/commands/init.d.ts

@@ -12,8 +12,24 @@
  *    orchestrator version that ran init, with an inline opt-out hint.
  *  - Skip `.cursor/mcp.json` unless Cursor is detected (project-local
  *    `.cursor/`, user-global `~/.cursor/`) or `--cursor` is passed.
+ *
+ * AISDLC-143 enhancements (Q4(b) of the quality-gate redesign):
+ *  - Default invocation is now an interactive WIZARD (DoR / attestation /
+ *    classifier / branch-protection prompts) so adopters get a guided
+ *    bootstrap instead of having to read the docs to discover features.
+ *  - `--yes` short-circuits all prompts to "accept defaults" (CI/scripts).
+ *  - `--with-X` flags opt into individual features without prompting.
+ *  - `--add <feature>` extends an already-initialized repo with a single
+ *    feature, idempotently — re-running on an initialized repo is safe.
+ *  - `.github/workflows/ai-sdlc-gate.yml` is scaffolded UNCONDITIONALLY
+ *    so every adopter gets the `ai-sdlc/pr-ready` rollup check on day one
+ *    (Q1: prescriptive default).
+ *  - A "next steps" summary closes the run with operator action items
+ *    conditional on which features were chosen.
  */
 import { Command } from 'commander';
+import { type WizardFlags } from './init-features.js';
+export declare const PIPELINE_YAML = "apiVersion: ai-sdlc.io/v1alpha1\nkind: Pipeline\nmetadata:\n  name: default\nspec:\n  triggers:\n    - event: issue.labeled\n      filter:\n        labels:\n          - ai-eligible\n  providers:\n    sourceControl:\n      type: github\n      config:\n        org: your-org\n  stages:\n    - name: validate\n      qualityGates:\n        - default-gates\n    - name: code\n      agent: default-agent\n      timeout: PT30M\n      onFailure:\n        strategy: retry\n        maxRetries: 2\n    - name: review\n      qualityGates:\n        - default-gates\n  # backlog: holds settings specific to the backlog-task (/ai-sdlc execute)\n  # workflow. These were formerly in a separate pipeline-backlog.yaml file\n  # (deprecated by AISDLC-245.5). Slash commands + pipeline-cli readers\n  # prefer this canonical location.\n  backlog:\n    branching:\n      pattern: 'ai-sdlc/{issueIdLower}-{slug}'\n      targetBranch: main\n      cleanup: on-merge\n    pullRequest:\n      titleTemplate: 'feat: {issueTitle} ({issueId})'\n      descriptionSections:\n        - summary\n        - changes\n        - closes\n      includeProvenance: true\n      closeKeyword: References\n";
 /**
  * Tier-based agent-role templates (AISDLC-79).
  *
@@ -28,5 +44,11 @@ export type AgentRoleTier = 'coding' | 'research' | 'meta';
 export declare const AGENT_ROLE_TIERS: readonly AgentRoleTier[];
 /** Resolve the agent-role.yaml template for a given tier. Default = `coding`. */
 export declare function getAgentRoleYaml(tier?: AgentRoleTier): string;
+/**
+ * Build the WizardFlags struct from Commander's parsed options. Pulled
+ * out into a function so tests can drive the wizard pipeline directly
+ * without going through Commander's stateful option store.
+ */
+export declare function buildWizardFlags(opts: Record<string, unknown>): WizardFlags;
 export declare const initCommand: Command;
 //# sourceMappingURL=init.d.ts.map