@ai-sdlc/orchestrator 0.9.0 → 0.13.0

package/dist/sa-scoring/revision-proposal.js

@@ -0,0 +1,417 @@
+/**
+ * DIDRevisionProposal mechanism (RFC-0031).
+ *
+ * Implements the calibration-driven proposal mechanism that fires when the
+ * PPA flywheel accumulates sufficient evidence that a DID field has drifted
+ * from observed reality.
+ *
+ * What ships here:
+ *   - DIDRevisionProposal event shape + classification logic (§3, §5)
+ *   - SoulHealthDiagnostic event for unhealthy-drift path (§7)
+ *   - Approval routing by identityClass (§8)
+ *   - 14-day expiry + DIDRevisionProposalExpired event (§9)
+ *   - lockNoProposal opt-out per field from calibration config (OQ-12.3)
+ *   - Rejection learnings flowing back into the calibration log (OQ-12.5)
+ *   - Multi-field bundling explicitly deferred to v2 (OQ-12.2)
+ *   - Confidence derived from sample size + classification clarity + identityClass (OQ-12.1)
+ *   - PPA generates proposal regardless of pillar; pillar lead approves (OQ-12.4)
+ *
+ * Trigger entry point: `evaluateRevisionProposal()` — called after drift
+ * is detected (i.e., a `SoulDriftDetected` event fires). One call per
+ * field; bundling is v2.
+ *
+ * Scope: Shard-DID only. Platform-level DID changes are human-initiated.
+ */
+import { randomUUID } from 'crypto';
+import { DEFAULT_CONFIDENCE_HIGH_SAMPLE_SIZE, DEFAULT_CONFIDENCE_LOW_SAMPLE_SIZE, DEFAULT_REJECTION_WEIGHT_HIGH, DEFAULT_REJECTION_WEIGHT_MEDIUM, DEFAULT_REJECTION_WEIGHT_LOW, DEFAULT_CONFIDENCE_PENALTY_FLOOR, } from './revision-proposal-config.js';
+export { DEFAULT_CONFIDENCE_HIGH_SAMPLE_SIZE, DEFAULT_CONFIDENCE_LOW_SAMPLE_SIZE, DEFAULT_REJECTION_WEIGHT_HIGH, DEFAULT_REJECTION_WEIGHT_MEDIUM, DEFAULT_REJECTION_WEIGHT_LOW, DEFAULT_CONFIDENCE_PENALTY_FLOOR, DEFAULT_RESOLVED_CALIBRATION_CONFIG, validateRevisionProposalCalibrationConfig, resolveRevisionProposalCalibrationConfig, parseRevisionProposalCalibrationYaml, } from './revision-proposal-config.js';
+// ── Constants ────────────────────────────────────────────────────────
+/** Default trigger thresholds (§6). Configurable per deployment. */
+export const DEFAULT_DISMISS_THRESHOLD = 10;
+export const DEFAULT_DEMAND_MISALIGNMENT_THRESHOLD = 0.3;
+export const DEFAULT_DRIFT_EVENTS_THRESHOLD = 3;
+export const DEFAULT_TRIGGER_WINDOW_DAYS = 60;
+export const DEFAULT_PROPOSAL_EXPIRY_DAYS = 14;
+/** Classification thresholds per §7. */
+export const HEALTHY_ICP_MATCH_MIN = 0.6;
+export const UNHEALTHY_ICP_MATCH_MAX = 0.3;
+// ── Classification logic (§7) ────────────────────────────────────────
+/**
+ * Classify drift as healthy / unhealthy / ambiguous per RFC-0031 §7.
+ *
+ * ```
+ * healthy:    icpMatchRate > 0.6  AND NOT coreDIDFieldsAffected
+ * unhealthy:  icpMatchRate < 0.3  OR (coreDIDFieldsAffected AND dismissToEscalateRatio < 1.0)
+ * ambiguous:  everything else
+ * ```
+ */
+export function classifyDrift(evidence) {
+    const { demandClusterICPMatchRate, coreDIDFieldsAffected, dismissToEscalateRatio } = evidence;
+    if (demandClusterICPMatchRate > HEALTHY_ICP_MATCH_MIN && !coreDIDFieldsAffected) {
+        return 'healthy';
+    }
+    if (demandClusterICPMatchRate < UNHEALTHY_ICP_MATCH_MAX ||
+        (coreDIDFieldsAffected && dismissToEscalateRatio < 1.0)) {
+        return 'unhealthy';
+    }
+    return 'ambiguous';
+}
+// ── Approval routing (§8) ────────────────────────────────────────────
+/**
+ * Derive approval path from identityClass per RFC-0031 §8.
+ *
+ * - `core` → `triad` (all three pillar leads required)
+ * - `evolving` → `pillarLead` (owning lead + one other)
+ * - `undefined` → `triad` (default-tighten when class is undeclared)
+ * - ambiguous classification always → `triad` (§7 override)
+ */
+export function deriveApprovalPath(identityClass, classification) {
+    // AISDLC-271 PR #476 round-2: reject non-enum identityClass to prevent
+    // a future caller from passing untrusted input that downgrades the
+    // approval requirement (e.g. attacker passes 'evolving' for a core field
+    // → triad → pillarLead, weaker authorization).
+    assertValidIdentityClass(identityClass, 'deriveApprovalPath');
+    // Ambiguous drift always requires triad review regardless of identityClass (§7).
+    if (classification === 'ambiguous')
+        return 'triad';
+    if (identityClass === 'evolving')
+        return 'pillarLead';
+    // 'core' or unset → triad (safer default per §8)
+    return 'triad';
+}
+// ── Confidence calculation (OQ-12.1) ────────────────────────────────
+/**
+ * Compute proposal confidence from trigger evidence + classification clarity
+ * + identityClass (OQ-12.1 resolved position: confidence = f(sample size,
+ * classification clarity, identityClass)).
+ *
+ * Thresholds are per-org configurable via `.ai-sdlc/calibration.yaml`
+ * (Refit AISDLC-310). Defaults match the shipped AISDLC-271 values:
+ *
+ * - high:   sampleSize ≥ highSampleSize (default 20) AND classification != 'ambiguous' AND identityClass = 'evolving'
+ * - low:    sampleSize < lowSampleSize  (default 5)  OR classification = 'ambiguous'   OR identityClass = 'core'
+ * - medium: everything else
+ *
+ * @param calibrationConfig Optional resolved config from `parseRevisionProposalCalibrationYaml()`.
+ *   When omitted, shipped defaults (20 / 5) are used.
+ */
+export function computeConfidence(triggerEvidence, classification, identityClass, calibrationConfig) {
+    // AISDLC-271 PR #476 round-2 security follow-up: also guard the exported
+    // computeConfidence entry point. Without this an HTTP caller bypassing
+    // evaluateRevisionProposal could pass an invalid identityClass and
+    // receive an incorrect confidence weight (not a privilege escalation
+    // since deriveApprovalPath is separately guarded, but inconsistent
+    // defense-in-depth posture).
+    assertValidIdentityClass(identityClass, 'computeConfidence');
+    const sampleSize = triggerEvidence.dismissSignals + triggerEvidence.escalateSignals + triggerEvidence.driftEvents;
+    const highSampleSize = calibrationConfig?.confidenceThresholds.highSampleSize ?? DEFAULT_CONFIDENCE_HIGH_SAMPLE_SIZE;
+    const lowSampleSize = calibrationConfig?.confidenceThresholds.lowSampleSize ?? DEFAULT_CONFIDENCE_LOW_SAMPLE_SIZE;
+    if (sampleSize >= highSampleSize &&
+        classification !== 'ambiguous' &&
+        identityClass === 'evolving') {
+        return 'high';
+    }
+    if (sampleSize < lowSampleSize || classification === 'ambiguous' || identityClass === 'core') {
+        return 'low';
+    }
+    return 'medium';
+}
+/**
+ * Returns true if ANY trigger condition fires per RFC-0031 §6.
+ */
+export function triggerConditionMet(conditions, config = {}) {
+    const dismissThreshold = config.dismissThreshold ?? DEFAULT_DISMISS_THRESHOLD;
+    const demandThreshold = config.demandMisalignmentThreshold ?? DEFAULT_DEMAND_MISALIGNMENT_THRESHOLD;
+    const driftThreshold = config.driftEventsThreshold ?? DEFAULT_DRIFT_EVENTS_THRESHOLD;
+    return (conditions.dismissSignals >= dismissThreshold ||
+        conditions.demandMisalignment > demandThreshold ||
+        conditions.driftEvents >= driftThreshold);
+}
+/**
+ * Returns true if the given field is locked from auto-proposals per OQ-12.3.
+ *
+ * Proposal generation SKIPS locked fields. Operators remove entries from
+ * `lockNoProposal` to opt back in.
+ */
+export function isFieldLocked(field, lockConfig) {
+    return lockConfig.lockNoProposal?.includes(field) ?? false;
+}
+/**
+ * Evaluate whether a DIDRevisionProposal should be generated for a given
+ * DID field. Entry point called once per field (one-field-per-proposal in
+ * v1 per OQ-12.2).
+ *
+ * Returns a discriminated union describing what was produced:
+ * - `proposal`   — healthy drift; one DIDRevisionProposalEvent
+ * - `diagnostic` — unhealthy drift; one SoulHealthDiagnosticEvent
+ * - `ambiguous`  — both events produced, both flagged for triad review
+ * - `skipped`    — field is locked or trigger conditions not met
+ */
+export function evaluateRevisionProposal(input) {
+    // AISDLC-271 PR #476 round-2: validate identityClass at the entry point
+    // so any future caller passing untrusted input fails fast. Callers MUST
+    // derive identityClass from the compiled DID document (did-compiler.ts
+    // output), never from external request payloads or mutable records.
+    assertValidIdentityClass(input.identityClass, 'evaluateRevisionProposal');
+    // Opt-out check (OQ-12.3)
+    // AISDLC-310 review fix: honor both the legacy lockConfig AND the
+    // calibrationConfig.lockNoProposal field (populated from calibration.yaml).
+    // Either signal locks the field — they're additive opt-outs.
+    if (input.lockConfig && isFieldLocked(input.field, input.lockConfig)) {
+        return { kind: 'skipped', reason: 'locked' };
+    }
+    if (input.calibrationConfig?.lockNoProposal?.includes(input.field)) {
+        return { kind: 'skipped', reason: 'locked' };
+    }
+    // Trigger condition check (§6)
+    if (!triggerConditionMet(input.triggerConditions, input.config)) {
+        return { kind: 'skipped', reason: 'no-trigger' };
+    }
+    const nowMs = (input.now ?? (() => Date.now()))();
+    const expiryDays = input.config?.expiryDays ?? DEFAULT_PROPOSAL_EXPIRY_DAYS;
+    const triggerWindowDays = input.config?.triggerWindowDays ?? DEFAULT_TRIGGER_WINDOW_DAYS;
+    const createdAt = new Date(nowMs).toISOString();
+    const expiresAt = new Date(nowMs + expiryDays * 24 * 60 * 60 * 1000).toISOString();
+    const triggerEvidence = {
+        dismissSignals: input.triggerConditions.dismissSignals,
+        escalateSignals: input.triggerConditions.escalateSignals,
+        demandMisalignment: input.triggerConditions.demandMisalignment,
+        driftEvents: input.triggerConditions.driftEvents,
+        triggerWindow: `P${triggerWindowDays}D`,
+    };
+    const classification = classifyDrift(input.classificationEvidence);
+    const approvalPath = deriveApprovalPath(input.identityClass, classification);
+    const confidence = computeConfidence(triggerEvidence, classification, input.identityClass, input.calibrationConfig);
+    if (classification === 'healthy') {
+        const event = {
+            type: 'DIDRevisionProposal',
+            proposalId: randomUUID(),
+            scope: 'shard',
+            shardId: input.shardId,
+            field: input.field,
+            currentValue: input.currentValue,
+            proposedValue: input.proposedValue,
+            identityClass: input.identityClass,
+            classification,
+            classificationEvidence: input.classificationEvidence,
+            triggerEvidence,
+            confidence,
+            approvalPath,
+            expiresAt,
+            createdAt,
+            status: 'pending',
+        };
+        return { kind: 'proposal', event };
+    }
+    if (classification === 'unhealthy') {
+        const diagnostic = buildDiagnosticEvent(input.shardId, input.field, input.classificationEvidence, triggerEvidence, createdAt);
+        return { kind: 'diagnostic', event: diagnostic };
+    }
+    // Ambiguous — emit both (§7): proposal flagged for triad review + diagnostic
+    const proposal = {
+        type: 'DIDRevisionProposal',
+        proposalId: randomUUID(),
+        scope: 'shard',
+        shardId: input.shardId,
+        field: input.field,
+        currentValue: input.currentValue,
+        proposedValue: input.proposedValue,
+        identityClass: input.identityClass,
+        classification: 'ambiguous',
+        classificationEvidence: input.classificationEvidence,
+        triggerEvidence,
+        confidence,
+        approvalPath: 'triad', // Always triad for ambiguous (§7 + §8)
+        expiresAt,
+        createdAt,
+        status: 'pending',
+    };
+    const diagnostic = buildDiagnosticEvent(input.shardId, input.field, input.classificationEvidence, triggerEvidence, createdAt);
+    return { kind: 'ambiguous', proposal, diagnostic };
+}
+function buildDiagnosticEvent(shardId, field, classificationEvidence, triggerEvidence, createdAt) {
+    const recommendation = classificationEvidence.demandClusterICPMatchRate < UNHEALTHY_ICP_MATCH_MAX
+        ? 'review-demand-source'
+        : 'tighten-admission-threshold';
+    return {
+        type: 'SoulHealthDiagnostic',
+        proposalId: randomUUID(),
+        shardId,
+        field,
+        classification: 'unhealthy',
+        classificationEvidence,
+        triggerEvidence,
+        recommendation,
+        createdAt,
+    };
+}
+// ── Proposal expiry (§9) ─────────────────────────────────────────────
+/**
+ * AISDLC-271 PR #476 round-2 hardening: defensive validators for the
+ * caller-supplied surface that becomes attack surface once persistence /
+ * HTTP layers ship (RFC §9 explicitly defers those layers to a future
+ * task; until then these functions are pure-library and not reachable
+ * from external input — but the validators are still correct on
+ * trusted input AND lock down the contract for the future caller).
+ *
+ * IDENTITY_CLASS_VALUES enforces the schema boundary: callers MUST
+ * derive identityClass from the compiled DID
+ * document (did-compiler.ts output), not from a request payload. This
+ * runtime check ensures no future caller accidentally trusts a
+ * webhook / issue-body / mutable-record value.
+ *
+ * `assertValidExpiresAt` ensures the persisted proposal record's
+ * expiresAt is a parseable ISO-8601 timestamp. Re-armed-past-expiry
+ * via mutation requires the persistence layer to enforce immutability
+ * AT WRITE TIME — see RFC-0031 §9 follow-up.
+ */
+const IDENTITY_CLASS_VALUES = ['core', 'evolving'];
+function assertValidIdentityClass(identityClass, where) {
+    if (identityClass === undefined)
+        return; // undefined → triad default per §8 — safe
+    if (!IDENTITY_CLASS_VALUES.includes(identityClass)) {
+        throw new Error(`[revision-proposal] ${where}: invalid identityClass ${JSON.stringify(identityClass)}. ` +
+            `Must be one of ${JSON.stringify(IDENTITY_CLASS_VALUES)}. ` +
+            `Callers MUST derive identityClass from the compiled DID document, never from external input.`);
+    }
+}
+function assertValidExpiresAt(expiresAt, where) {
+    if (typeof expiresAt !== 'string' || isNaN(Date.parse(expiresAt))) {
+        throw new Error(`[revision-proposal] ${where}: invalid expiresAt ${JSON.stringify(expiresAt)}. ` +
+            `Must be ISO-8601 string. ` +
+            `Persistence layer MUST treat expiresAt as immutable to prevent re-arming past expiry.`);
+    }
+}
+function assertValidActor(actor, where) {
+    if (typeof actor !== 'string' || actor.trim().length < 3) {
+        throw new Error(`[revision-proposal] ${where}: invalid actor identity ${JSON.stringify(actor)}. ` +
+            `Must be a non-empty string of length ≥ 3 after trimming whitespace. ` +
+            `Persistence/HTTP callers MUST validate actor matches an authenticated session identity.`);
+    }
+}
+/**
+ * Check whether a proposal has passed its `expiresAt` timestamp.
+ *
+ * AISDLC-271 PR #476 round-2: validates expiresAt is parseable. Pre-fix
+ * a malformed (or attacker-mutated) expiresAt would silently NEVER
+ * expire because Date.parse returns NaN and `NaN <= now` is always false.
+ */
+export function isProposalExpired(proposal, nowMs) {
+    assertValidExpiresAt(proposal.expiresAt, 'isProposalExpired');
+    const now = nowMs ?? Date.now();
+    return Date.parse(proposal.expiresAt) <= now;
+}
+/**
+ * Archive expired proposals and emit `DIDRevisionProposalExpired` events.
+ * Returns the list of expiry events for caller to process (persist / alert).
+ *
+ * Per §9: expiry without resolution emits the event — operator alert, not
+ * silent dismissal. Auto-archives by setting status to 'expired'.
+ */
+export function archiveExpiredProposals(proposals, nowMs) {
+    const now = nowMs ?? Date.now();
+    const expired = [];
+    const remaining = [];
+    for (const p of proposals) {
+        if (p.status !== 'pending') {
+            remaining.push(p);
+            continue;
+        }
+        if (isProposalExpired(p, now)) {
+            expired.push({
+                type: 'DIDRevisionProposalExpired',
+                proposalId: p.proposalId,
+                shardId: p.shardId,
+                field: p.field,
+                classification: p.classification,
+                createdAt: p.createdAt,
+                expiredAt: new Date(now).toISOString(),
+            });
+            remaining.push({ ...p, status: 'expired' });
+        }
+        else {
+            remaining.push(p);
+        }
+    }
+    return { expired, remaining };
+}
+// ── Rejection learnings (OQ-12.5) ────────────────────────────────────
+/**
+ * Record a proposal rejection and compute the `rejectionPrecedentWeight`
+ * to feed back into future trigger evaluations (OQ-12.5 resolved position:
+ * rejection rationale captured in calibration log; future trigger evaluations
+ * weight rejection-precedent into confidence).
+ *
+ * Weight formula (defaults from AISDLC-271, per-org configurable via
+ * `calibration.yaml` — Refit AISDLC-310 / RFC-0031 §12.6):
+ *   - high-confidence proposals that were rejected → 0.8 (default)
+ *   - medium-confidence → 0.5 (default)
+ *   - low-confidence → 0.2 default (expected noise level, lower weight)
+ *
+ * Callers persist this record to their calibration log; the next trigger
+ * evaluation should factor it in by reducing effective confidence.
+ *
+ * @param calibrationConfig Optional resolved config from `parseRevisionProposalCalibrationYaml()`.
+ *   When omitted, shipped AISDLC-271 weights (0.8 / 0.5 / 0.2) are used.
+ */
+export function recordRejection(proposal, rejectedBy, rationale, now, calibrationConfig) {
+    // AISDLC-271 PR #476 round-2: defensive validation of rejectedBy. The
+    // persistence/HTTP layer (when added) MUST validate this against the
+    // authenticated session identity — without it, an attacker who can call
+    // recordRejection forges identity strings and floods the rejection log
+    // to permanently suppress proposals via computeRejectionPrecedentFactor.
+    // This length check is the in-library minimum; the calling layer is
+    // responsible for the authoritative authorization check.
+    assertValidActor(rejectedBy, 'recordRejection');
+    if (typeof rationale !== 'string' || rationale.trim().length < 10) {
+        throw new Error(`[revision-proposal] recordRejection: rationale must be ≥10 chars after trimming ` +
+            `(got ${typeof rationale === 'string' ? rationale.trim().length : 'non-string'}). ` +
+            `Persistence layer captures this in the calibration log for future trigger evaluations.`);
+    }
+    const nowMs = (now ?? (() => Date.now()))();
+    const w = calibrationConfig?.rejectionPrecedent.weights;
+    const weightByConfidence = {
+        high: w?.highConfidenceRejection ?? DEFAULT_REJECTION_WEIGHT_HIGH,
+        medium: w?.mediumConfidenceRejection ?? DEFAULT_REJECTION_WEIGHT_MEDIUM,
+        low: w?.lowConfidenceRejection ?? DEFAULT_REJECTION_WEIGHT_LOW,
+    };
+    return {
+        proposalId: proposal.proposalId,
+        shardId: proposal.shardId,
+        field: proposal.field,
+        rejectedBy,
+        rationale,
+        rejectedAt: new Date(nowMs).toISOString(),
+        classification: proposal.classification,
+        rejectionPrecedentWeight: weightByConfidence[proposal.confidence],
+    };
+}
+/**
+ * Apply rejection precedent to reduce effective trigger confidence.
+ * When a field has prior rejection records, the aggregated precedent
+ * weight penalises future proposals for the same field.
+ *
+ * Formula (RFC-0031 §12.6): `factor = max(floor, 1.0 - avgWeight × 0.5)`
+ * where `floor` is `confidencePenaltyFloor` from calibration config
+ * (default 0.2 — at most 80% suppression).
+ *
+ * Returns a factor in `[floor, 1.0]`. Callers decide how to interpret.
+ *
+ * @param calibrationConfig Optional resolved config from `parseRevisionProposalCalibrationYaml()`.
+ *   When omitted, shipped AISDLC-271 floor (0.2) is used.
+ */
+export function computeRejectionPrecedentFactor(field, rejections, calibrationConfig) {
+    const fieldRejections = rejections.filter((r) => r.field === field);
+    if (fieldRejections.length === 0)
+        return 1.0;
+    // Average rejection precedent weight across all prior rejections for this field.
+    const avgWeight = fieldRejections.reduce((acc, r) => acc + r.rejectionPrecedentWeight, 0) /
+        fieldRejections.length;
+    // The precedent factor reduces future proposal confidence:
+    // higher avg rejection weight → lower factor (penalty)
+    const rawFactor = 1.0 - avgWeight * 0.5;
+    const floor = calibrationConfig?.rejectionPrecedent.confidencePenaltyFloor ??
+        DEFAULT_CONFIDENCE_PENALTY_FLOOR;
+    return Math.max(floor, rawFactor);
+}
+//# sourceMappingURL=revision-proposal.js.map

package/dist/signal-ingestion/adapters/community-thread.d.ts

@@ -0,0 +1,43 @@
+import type { RawSignal, SignalSourceAdapter } from '../types.js';
+/**
+ * Default env var holding either a Discord bot token or a Slack bot token
+ * per RFC-0030 OQ-13.1 v0.3 re-walkthrough. Both platforms support bot-token
+ * based access without OAuth; the env var name follows the
+ * `SIGNAL_<PLATFORM>_BOT_TOKEN` convention.
+ *
+ * Adapters wired to a single platform set the env var name explicitly via
+ * `envVarName`; the default `SIGNAL_COMMUNITY_BOT_TOKEN` is the generic
+ * fallback for adopters who alias their secret manager output.
+ */
+export declare const DEFAULT_COMMUNITY_THREAD_ENV_VAR = "SIGNAL_COMMUNITY_BOT_TOKEN";
+export interface CommunityThreadAdapterOptions {
+    signals?: RawSignal[];
+    available?: boolean;
+    /** Legacy test override (pre-OQ-13.1 v0.3); emits collapsed Decision. */
+    credentialInvalid?: boolean;
+    /** RFC-0030 OQ-13.1 v0.3: env-var missing test override. */
+    credentialNotConfigured?: boolean;
+    /** RFC-0030 OQ-13.1 v0.3: env-var present but upstream rejected. */
+    credentialRejected?: boolean;
+    /** Override the env var name (e.g. `SIGNAL_DISCORD_BOT_TOKEN`). */
+    envVarName?: string;
+    /** Optional explicit env accessor (test seam). Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /**
+     * When `true`, the adapter probes its env var. See `SupportTicketAdapter`
+     * for backward-compat rationale (`false` default).
+     */
+    probeEnvVar?: boolean;
+}
+export declare class CommunityThreadSignalSourceAdapter implements SignalSourceAdapter {
+    private readonly options;
+    readonly name = "signal-source-community-thread";
+    readonly defaultTier = 2;
+    /** OAuth NOT required for v1 Discord-bot-token / Slack-bot-token model. */
+    readonly requiresOAuth = false;
+    constructor(options?: CommunityThreadAdapterOptions);
+    get envVarName(): string;
+    isAvailable(): Promise<boolean>;
+    fetchSignals(since: Date): Promise<RawSignal[]>;
+}
+//# sourceMappingURL=community-thread.d.ts.map

package/dist/signal-ingestion/adapters/community-thread.js

@@ -0,0 +1,55 @@
+import { AdapterCredentialInvalid, AdapterCredentialNotConfigured, AdapterCredentialRejected, } from '../errors.js';
+/**
+ * Default env var holding either a Discord bot token or a Slack bot token
+ * per RFC-0030 OQ-13.1 v0.3 re-walkthrough. Both platforms support bot-token
+ * based access without OAuth; the env var name follows the
+ * `SIGNAL_<PLATFORM>_BOT_TOKEN` convention.
+ *
+ * Adapters wired to a single platform set the env var name explicitly via
+ * `envVarName`; the default `SIGNAL_COMMUNITY_BOT_TOKEN` is the generic
+ * fallback for adopters who alias their secret manager output.
+ */
+export const DEFAULT_COMMUNITY_THREAD_ENV_VAR = 'SIGNAL_COMMUNITY_BOT_TOKEN';
+export class CommunityThreadSignalSourceAdapter {
+    options;
+    name = 'signal-source-community-thread';
+    defaultTier = 2;
+    /** OAuth NOT required for v1 Discord-bot-token / Slack-bot-token model. */
+    requiresOAuth = false;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    get envVarName() {
+        return this.options.envVarName ?? DEFAULT_COMMUNITY_THREAD_ENV_VAR;
+    }
+    async isAvailable() {
+        if (this.options.available !== undefined)
+            return this.options.available;
+        if (this.options.probeEnvVar) {
+            const env = this.options.env ?? process.env;
+            const v = env[this.envVarName];
+            return typeof v === 'string' && v.trim().length > 0;
+        }
+        return true;
+    }
+    async fetchSignals(since) {
+        if (this.options.credentialNotConfigured) {
+            throw new AdapterCredentialNotConfigured(this.name, this.envVarName);
+        }
+        if (this.options.credentialRejected) {
+            throw new AdapterCredentialRejected(this.name);
+        }
+        if (this.options.credentialInvalid) {
+            throw new AdapterCredentialInvalid(this.name);
+        }
+        if (this.options.probeEnvVar && this.options.available === undefined) {
+            const env = this.options.env ?? process.env;
+            const v = env[this.envVarName];
+            if (!(typeof v === 'string' && v.trim().length > 0)) {
+                throw new AdapterCredentialNotConfigured(this.name, this.envVarName);
+            }
+        }
+        return (this.options.signals ?? []).filter((signal) => signal.sourceTimestamp >= since);
+    }
+}
+//# sourceMappingURL=community-thread.js.map

package/dist/signal-ingestion/adapters/in-app-feedback.d.ts

@@ -0,0 +1,67 @@
+import type { RawSignal, SignalSourceAdapter } from '../types.js';
+/**
+ * RFC-0030 OQ-13.1 v0.3 re-walkthrough: env-var-based in-app-feedback
+ * adapter (e.g. Productboard, Pendo, in-house widget). Reads its API key from
+ * `SIGNAL_IN_APP_FEEDBACK_API_KEY`. Phase 1 ships env-var-based adapters
+ * ONLY; OAuth-required services defer to the future credential-management RFC.
+ *
+ * Two distinct failure modes per OQ-13.1 v0.3:
+ *  - **Not configured** — env var missing or empty → emit setup task.
+ *  - **Rejected** — env var present but upstream auth call failed → emit
+ *    rotation task.
+ *
+ * The Phase 1 adapter is in-memory (test fixture mode) — production wiring
+ * to a real upstream service is per-deployment. The env-var probe + dual
+ * failure-mode split are the contract this adapter ships.
+ */
+export interface InAppFeedbackAdapterOptions {
+    signals?: RawSignal[];
+    /**
+     * Test override: when set, bypasses the env-var probe and `isAvailable()`
+     * returns this value directly. Useful for fixtures that need to simulate
+     * "configured but upstream rejected" without touching `process.env`.
+     */
+    available?: boolean;
+    /**
+     * Test override: when `true`, `fetchSignals()` raises
+     * `AdapterCredentialNotConfigured` regardless of env probe (test seam for
+     * forcing the "not configured" Decision path).
+     */
+    credentialNotConfigured?: boolean;
+    /**
+     * Test override: when `true`, `fetchSignals()` raises
+     * `AdapterCredentialRejected` (env var was present but upstream said 401/403).
+     */
+    credentialRejected?: boolean;
+    /**
+     * Override the env var name (defaults to `SIGNAL_IN_APP_FEEDBACK_API_KEY`).
+     * Allows adopters to wire to their existing secret-naming convention.
+     */
+    envVarName?: string;
+    /**
+     * Optional explicit env accessor (test seam). Defaults to `process.env`.
+     * Allows hermetic tests without mutating the global process env.
+     */
+    env?: NodeJS.ProcessEnv;
+}
+export declare const DEFAULT_IN_APP_FEEDBACK_ENV_VAR = "SIGNAL_IN_APP_FEEDBACK_API_KEY";
+export declare class InAppFeedbackSignalSourceAdapter implements SignalSourceAdapter {
+    private readonly options;
+    readonly name = "signal-source-in-app-feedback";
+    readonly defaultTier = 1;
+    /** OAuth NOT required — env-var-based API key only. */
+    readonly requiresOAuth = false;
+    constructor(options?: InAppFeedbackAdapterOptions);
+    /** Resolve the env var name for this adapter. */
+    get envVarName(): string;
+    /**
+     * Adapter availability: env-var-probe-based. Returns `true` when the
+     * configured env var is present and non-empty, OR when the `available`
+     * test override is set. Returns `false` otherwise — the registry will
+     * surface `Decision: adapter-credential-not-configured` rather than
+     * blocking the pipeline.
+     */
+    isAvailable(): Promise<boolean>;
+    fetchSignals(since: Date): Promise<RawSignal[]>;
+}
+//# sourceMappingURL=in-app-feedback.d.ts.map

package/dist/signal-ingestion/adapters/in-app-feedback.js

@@ -0,0 +1,51 @@
+import { AdapterCredentialNotConfigured, AdapterCredentialRejected } from '../errors.js';
+export const DEFAULT_IN_APP_FEEDBACK_ENV_VAR = 'SIGNAL_IN_APP_FEEDBACK_API_KEY';
+export class InAppFeedbackSignalSourceAdapter {
+    options;
+    name = 'signal-source-in-app-feedback';
+    defaultTier = 1;
+    /** OAuth NOT required — env-var-based API key only. */
+    requiresOAuth = false;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    /** Resolve the env var name for this adapter. */
+    get envVarName() {
+        return this.options.envVarName ?? DEFAULT_IN_APP_FEEDBACK_ENV_VAR;
+    }
+    /**
+     * Adapter availability: env-var-probe-based. Returns `true` when the
+     * configured env var is present and non-empty, OR when the `available`
+     * test override is set. Returns `false` otherwise — the registry will
+     * surface `Decision: adapter-credential-not-configured` rather than
+     * blocking the pipeline.
+     */
+    async isAvailable() {
+        if (this.options.available !== undefined)
+            return this.options.available;
+        const env = this.options.env ?? process.env;
+        const v = env[this.envVarName];
+        return typeof v === 'string' && v.trim().length > 0;
+    }
+    async fetchSignals(since) {
+        // Test overrides take precedence so fixtures can exercise both failure
+        // paths regardless of env state.
+        if (this.options.credentialNotConfigured) {
+            throw new AdapterCredentialNotConfigured(this.name, this.envVarName);
+        }
+        if (this.options.credentialRejected) {
+            throw new AdapterCredentialRejected(this.name);
+        }
+        // Production path: re-probe env var (unless `available: true` was set as
+        // an explicit bypass for hermetic tests that don't care about env probing).
+        if (this.options.available === undefined) {
+            const env = this.options.env ?? process.env;
+            const v = env[this.envVarName];
+            if (!(typeof v === 'string' && v.trim().length > 0)) {
+                throw new AdapterCredentialNotConfigured(this.name, this.envVarName);
+            }
+        }
+        return (this.options.signals ?? []).filter((signal) => signal.sourceTimestamp >= since);
+    }
+}
+//# sourceMappingURL=in-app-feedback.js.map