@ai-sdlc/orchestrator 0.9.0 → 0.13.0

package/dist/cli/commands/init-templates.d.ts

@@ -0,0 +1,301 @@
+/**
+ * Embedded template strings scaffolded by `ai-sdlc init` (AISDLC-143).
+ *
+ * Why these live in code instead of being read from disk at runtime:
+ *  - The orchestrator ships as an npm package; users `npm i -g
+ *    @ai-sdlc/orchestrator` and run `ai-sdlc init` in a brand new repo.
+ *    The `dist/` payload would not include arbitrary `*.yml` source
+ *    fixtures unless we listed each one in `package.json#files` AND
+ *    plumbed a `__dirname`-based loader through esm import-meta.url.
+ *  - Embedded strings work identically when invoked via `node ./dist/...`
+ *    from a checkout, via `npx @ai-sdlc/orchestrator init`, or via a
+ *    pre-bundled binary, with no runtime filesystem dependency.
+ *
+ * Drift policy: when the canonical workflow at
+ * `.github/workflows/ai-sdlc-gate.yml` (or the audit-only
+ * `verify-attestation.yml`) is updated for adopters, mirror the change
+ * here. The init-workspace test suite includes a smoke check that the
+ * embedded copy at least parses as a YAML mapping; AISDLC-140 sub-3's
+ * cutover memo will add a hard byte-equality assertion against the live
+ * file once the framework's own copy stabilizes.
+ *
+ * Q-decisions baked into the templates:
+ *  - Q1 (prescriptive default): the gate workflow is scaffolded
+ *    unconditionally — every adopter gets `ai-sdlc/pr-ready` on day one.
+ *  - Q3 (attestation = audit-only): verify-attestation template is the
+ *    audit-only variant; signing infrastructure is opt-in via
+ *    `--with-attestation`.
+ *  - Q4(b) (interactive default with --yes escape hatch): see
+ *    `init-features.ts` for the wizard wiring; this module just supplies
+ *    the byte content.
+ */
+/** `.github/workflows/ai-sdlc-gate.yml` — single rollup PR-ready check. */
+export declare const AI_SDLC_GATE_WORKFLOW = "name: AI-SDLC PR Ready Gate\n\n# Single rollup status check `ai-sdlc/pr-ready` that aggregates every PR\n# signal AI-SDLC adopters need into ONE branch-protection entry. Replaces\n# the historical pattern of enumerating N required checks by name + app_id,\n# which is brittle against path filters, [skip ci] tokens, matrix changes,\n# and multi-app posters. See `docs/operations/quality-gate.md` for the\n# full rationale.\n#\n# Industry pattern: `re-actors/alls-green` (\"alls-green\") is the de facto\n# community fix; named adopters include aiohttp, attrs, conda, setuptools,\n# pytest, pip-tools, Open edX, PyCA, PyPA, Mergify.\n\non:\n  # AISDLC-261 PR #480 review fix: include 'ready_for_review' so the gate\n  # fires when adopters using the draft-PR flow (AISDLC-218) flip a PR\n  # from draft to ready. Without it, ai-sdlc/pr-ready stays unposted on\n  # the ready transition and branch protection fails.\n  pull_request:\n    types: [opened, synchronize, reopened, ready_for_review]\n  merge_group:\n    types: [checks_requested]\n\nconcurrency:\n  group: ai-sdlc-gate-${{ github.event.pull_request.number || github.event.merge_group.head_sha || github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  pull-requests: read\n  checks: write\n\njobs:\n  detect:\n    name: Detect Changes\n    runs-on: ubuntu-latest\n    outputs:\n      docs_only: ${{ steps.filter.outputs.docs_only }}\n    steps:\n      - uses: actions/checkout@v4\n      - id: filter\n        uses: dorny/paths-filter@v3\n        with:\n          predicate-quantifier: 'every'\n          filters: |\n            docs_only:\n              - 'docs/**'\n              - '*.md'\n\n  lint:\n    name: Lint & Format\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - run: pnpm lint\n      - run: pnpm format:check\n\n  build-test:\n    name: Build & Test (Node ${{ matrix.node-version }})\n    needs: detect\n    if: needs.detect.outputs.docs_only != 'true'\n    runs-on: ubuntu-latest\n    strategy:\n      fail-fast: false\n      matrix:\n        node-version: [20, 22]\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node-version }}\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - run: pnpm build\n      - run: pnpm test\n\n  coverage:\n    name: Coverage\n    needs: detect\n    if: needs.detect.outputs.docs_only != 'true'\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - run: pnpm build\n      - run: pnpm test:coverage\n\n  pr-ready:\n    name: ai-sdlc/pr-ready\n    needs: [detect, lint, build-test, coverage]\n    if: always()\n    runs-on: ubuntu-latest\n    steps:\n      - name: Aggregate required signals\n        uses: re-actors/alls-green@release/v1\n        with:\n          jobs: ${{ toJSON(needs) }}\n";
+/**
+ * `.github/workflows/verify-attestation.yml` — AUDIT-ONLY verifier.
+ *
+ * Per Q3 in /tmp/quality-gate-redesign-final.md, attestation infrastructure
+ * is opt-in and audit-only. This workflow logs verification results to the
+ * action run log but does NOT post a required-status check or block merges.
+ * Operators who want to promote attestation to a hard gate can edit the
+ * \`Log audit result\` step to write to commit statuses.
+ */
+export declare const VERIFY_ATTESTATION_WORKFLOW = "name: AI-SDLC Verify Review Attestation\n\n# Reads the DSSE attestation at .ai-sdlc/attestations/<head-sha>.dsse.json\n# and verifies the signature against any-of-N pubkeys in\n# .ai-sdlc/trusted-reviewers.yaml.\n#\n# AUDIT-ONLY: this workflow logs verification results (success/failure with\n# reason) for forensic purposes but does NOT post a required commit status.\n# The single merge gate is `ai-sdlc/pr-ready` from ai-sdlc-gate.yml.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened]\n    branches: [main]\n    paths-ignore:\n      - 'docs/**'\n      - '*.md'\n  merge_group:\n    types: [checks_requested]\n\nconcurrency:\n  group: verify-attestation-${{ github.event.pull_request.number || github.event.merge_group.head_sha }}\n  cancel-in-progress: true\n\njobs:\n  verify:\n    name: Verify attestation\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - name: Resolve subject SHA + base SHA from event payload\n        id: resolve\n        run: |\n          if [ \"${{ github.event_name }}\" = \"merge_group\" ]; then\n            echo \"head_sha=${{ github.event.merge_group.head_sha }}\" >> \"$GITHUB_OUTPUT\"\n            echo \"base_sha=${{ github.event.merge_group.base_sha }}\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"head_sha=${{ github.event.pull_request.head.sha }}\" >> \"$GITHUB_OUTPUT\"\n            echo \"base_sha=${{ github.event.pull_request.base.sha }}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n          ref: ${{ steps.resolve.outputs.head_sha }}\n\n      - name: Log audit result\n        env:\n          HEAD_SHA: ${{ steps.resolve.outputs.head_sha }}\n        run: |\n          if [ -f \".ai-sdlc/attestations/${HEAD_SHA}.dsse.json\" ]; then\n            echo \"::notice::ai-sdlc attestation AUDIT \u2014 envelope present at ${HEAD_SHA}\"\n          else\n            echo \"::notice::ai-sdlc attestation AUDIT \u2014 no envelope on ${HEAD_SHA} (audit-only, not blocking)\"\n          fi\n";
+/**
+ * `.husky/pre-push` snippet that signs an attestation when one is missing
+ * for the current HEAD. Installed when `--with-attestation` is opted in;
+ * the actual `sign-attestation.mjs` script ships separately with the
+ * orchestrator and is referenced by the canonical command stub here.
+ *
+ * Adopters typically already have a `.husky/pre-push` from their existing
+ * tooling; the wizard appends our snippet behind a sentinel so we can
+ * extend an existing hook without trampling user content.
+ */
+export declare const HUSKY_PREPUSH_SIGN_SNIPPET = "# ai-sdlc:attestation-sign-block\n# Signs the DSSE attestation envelope for the current HEAD when verdict\n# files exist. Skip with AI_SDLC_SKIP_ATTESTATION_SIGN=1.\nif [ -z \"${AI_SDLC_SKIP_ATTESTATION_SIGN:-}\" ] && [ -x \"./scripts/check-attestation-sign.sh\" ]; then\n  ./scripts/check-attestation-sign.sh\nfi\n# end ai-sdlc:attestation-sign-block\n";
+/**
+ * `.ai-sdlc/trusted-reviewers.yaml` stub — empty allowlist with operator
+ * instructions. The wizard scaffolds this so adopters have a single file
+ * to receive contributor pubkey PRs into; bootstrap a contributor with
+ * `/ai-sdlc init-signing-key` and append the printed YAML block.
+ */
+export declare const TRUSTED_REVIEWERS_STUB = "# Trusted contributor signing keys for review attestations.\n#\n# This file is a stub created by `ai-sdlc init --with-attestation`. Add\n# entries by running `/ai-sdlc init-signing-key` on a contributor's\n# machine and opening a PR that appends the printed YAML block below.\n#\n# Schema:\n#   - identity:  free-form string (typically email or GitHub handle)\n#   - machine:   free-form label (lets one identity register multiple keys)\n#   - pubkey:    PEM-encoded ed25519 public key (multi-line block scalar)\n#   - addedAt:   ISO 8601 date the entry was added\n#   - addedBy:   GitHub handle of the maintainer who approved this entry's PR\n#\n# The verifier in CI uses a strict YAML format: every scalar value\n# single-quoted; `pubkey:` is a `|` block scalar with each PEM line\n# indented exactly 6 spaces; no tab characters anywhere.\n\nreviewers: []\n";
+/**
+ * `.ai-sdlc/dor-config.yaml` stub — Definition-of-Ready rubric config.
+ *
+ * Mirrors the production DoR config used by the framework itself; ships
+ * in warn-only mode so a fresh adopter does not get blocked by the rubric
+ * while they tune it.
+ */
+export declare const DOR_CONFIG_STUB = "# Definition-of-Ready (DoR) gate configuration.\n#\n# The DoR rubric scores incoming issues + backlog tasks against seven\n# criteria (binary-testable ACs, no wishlist markers, references resolve,\n# bounded scope, surface named, done-state describable, no invisible\n# dependencies). Failing the rubric posts a clarification comment on the\n# issue / PR.\n#\n# Ships in warn-only mode by default \u2014 flip to 'enforce' after the soak\n# window confirms the false-positive rate is low.\n\napiVersion: ai-sdlc.io/v1alpha1\nkind: DorConfig\nmetadata:\n  name: ai-sdlc-dor\nspec:\n  rubricVersion: v1\n  evaluationMode: warn-only\n\n  notifications:\n    authorChannel: true\n    # dedicatedChannel:\n    #   slack: '#ai-sdlc-dor'\n\n  staleness:\n    warnAfterDays: 14\n    closeAfterDays: 28\n    closedLabel: 'closed-as-stale-dor'\n";
+/** `.github/workflows/dor-ingress.yml` — minimal DoR ingress shim. */
+export declare const DOR_INGRESS_WORKFLOW = "name: AI-SDLC DoR Ingress\n\n# Wires the DoR rubric into the GitHub issue + PR lifecycle:\n#   - issues:opened / issues:edited  \u2192 score the issue body, post the\n#     idempotent clarification comment when needs-clarification.\n#   - pull_request touching backlog/tasks/*.md \u2192 score the changed\n#     task bodies (the in-repo equivalent of an issue).\n#\n# Ships in warn-only mode (see .ai-sdlc/dor-config.yaml). Flip the\n# config's `evaluationMode` to `enforce` after the soak window.\n\non:\n  issues:\n    types: [opened, edited]\n  pull_request:\n    types: [opened, synchronize, reopened]\n    paths:\n      - 'backlog/tasks/*.md'\n\nconcurrency:\n  group: dor-ingress-${{ github.event.issue.number || github.event.pull_request.number }}\n  cancel-in-progress: true\n\njobs:\n  evaluate:\n    name: Evaluate against DoR rubric\n    runs-on: ubuntu-latest\n    permissions:\n      issues: write\n      pull-requests: write\n      contents: read\n    steps:\n      - uses: actions/checkout@v4\n      - uses: pnpm/action-setup@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n      - run: pnpm install --frozen-lockfile\n      - name: Evaluate DoR (placeholder \u2014 wire to your DoR runner)\n        run: |\n          echo \"::notice::DoR ingress shim invoked. Wire pnpm --filter @ai-sdlc/pipeline-cli evaluate-dor here.\"\n";
+/**
+ * `.ai-sdlc/review-classifier.yaml` stub — cost-optimized review tiers.
+ *
+ * The actual classifier code ships via AISDLC-141 (a follow-up). For now
+ * the wizard scaffolds the config stub + a pointer to the classifier
+ * docs so adopters who opt in via `--with-classifier` are ready to flip
+ * on the workflow once AISDLC-141 lands.
+ */
+export declare const REVIEW_CLASSIFIER_STUB = "# Review classifier configuration (AISDLC-141, follow-up).\n#\n# The review classifier inspects a PR diff and decides which review tier\n# to invoke (cheap-pattern-match \u2192 mid-tier-LLM \u2192 full reviewer fan-out)\n# to keep review costs bounded as PR volume grows.\n#\n# This file is a stub scaffolded by `ai-sdlc init --with-classifier`.\n# The classifier runtime ships in AISDLC-141; until then this config is\n# advisory only. See docs/operations/init.md for the migration path.\n\napiVersion: ai-sdlc.io/v1alpha1\nkind: ReviewClassifier\nmetadata:\n  name: default-classifier\nspec:\n  tiers:\n    - name: cheap\n      maxFilesChanged: 5\n      maxLinesChanged: 50\n      strategy: pattern-match\n    - name: mid\n      maxFilesChanged: 20\n      maxLinesChanged: 500\n      strategy: single-llm-pass\n    - name: full\n      strategy: full-reviewer-fanout\n  routing:\n    docsOnly: cheap\n    testOnly: cheap\n    default: mid\n";
+/**
+ * `.github/workflows/ai-sdlc-review.yml` — CI-side PR review workflow.
+ *
+ * Posts `Post Review Results` as a commit status so branch-protection can
+ * require it. Adopter repos that have not set up `ANTHROPIC_API_KEY` will
+ * see the job run but produce advisory-only output — the status check still
+ * posts `success` so it does not block merges.
+ *
+ * This is a simplified adopter-facing template. The AI-SDLC framework's
+ * own repo carries a more elaborate version that drives the full review
+ * fan-out pipeline (classifier, incremental review, etc.); adopters start
+ * here and can progressively opt into those features.
+ *
+ * Source of truth: `.github/workflows/ai-sdlc-review.yml` in the ai-sdlc
+ * framework repo (AISDLC-261). Mirror changes here when the adopter-facing
+ * surface evolves.
+ */
+export declare const AI_SDLC_REVIEW_WORKFLOW = "name: AI-SDLC PR Review\n\n# Posts `Post Review Results` as a required commit status.\n# Docs-only PRs (spec/rfcs/**, docs/**, backlog/**, *.md) are short-circuited\n# with success so they do not block the merge queue.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened, ready_for_review]\n    branches: [main]\n    paths-ignore:\n      - 'spec/rfcs/**'\n      - 'docs/**'\n      - 'backlog/tasks/**'\n      - 'backlog/completed/**'\n      - '*.md'\n  merge_group:\n    types: [checks_requested]\n\nconcurrency:\n  group: review-${{ github.event.pull_request.number || github.event.merge_group.head_sha }}\n  cancel-in-progress: true\n\njobs:\n  docs-only-check:\n    name: Docs-only check\n    runs-on: ubuntu-latest\n    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n    permissions:\n      contents: read\n      statuses: write\n      pull-requests: read\n    steps:\n      - name: Resolve event SHA\n        id: resolve\n        run: |\n          if [ \"${{ github.event_name }}\" = \"merge_group\" ]; then\n            echo \"head_sha=${{ github.event.merge_group.head_sha }}\" >> \"${GITHUB_OUTPUT}\"\n            echo \"base_sha=${{ github.event.merge_group.base_sha }}\" >> \"${GITHUB_OUTPUT}\"\n            echo \"is_merge_group=true\" >> \"${GITHUB_OUTPUT}\"\n          else\n            echo \"head_sha=${{ github.event.pull_request.head.sha }}\" >> \"${GITHUB_OUTPUT}\"\n            echo \"is_merge_group=false\" >> \"${GITHUB_OUTPUT}\"\n          fi\n\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n          ref: ${{ steps.resolve.outputs.head_sha }}\n\n      - name: Detect docs-only changeset\n        id: detect\n        env:\n          GH_TOKEN: ${{ github.token }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          REPO: ${{ github.repository }}\n          IS_MERGE_GROUP: ${{ steps.resolve.outputs.is_merge_group }}\n          BASE_SHA: ${{ steps.resolve.outputs.base_sha }}\n          HEAD_SHA: ${{ steps.resolve.outputs.head_sha }}\n        run: |\n          set -euo pipefail\n          if [ \"${IS_MERGE_GROUP}\" = \"true\" ]; then\n            FILES=$(git -c core.quotePath=false diff --name-only \"${BASE_SHA}...${HEAD_SHA}\")\n          else\n            FILES=$(gh api \"repos/${REPO}/pulls/${PR_NUMBER}/files\" --paginate --jq '.[].filename')\n          fi\n          if [ -z \"${FILES}\" ]; then\n            echo \"all_docs=true\" >> \"${GITHUB_OUTPUT}\"\n            exit 0\n          fi\n          # Simple docs-only check: all files must be in docs, spec/rfcs, backlog, or *.md\n          ALL_DOCS=true\n          while IFS= read -r f; do\n            case \"$f\" in\n              docs/*|spec/rfcs/*|backlog/tasks/*|backlog/completed/*|*.md) ;;\n              *) ALL_DOCS=false; break ;;\n            esac\n          done <<< \"${FILES}\"\n          echo \"all_docs=${ALL_DOCS}\" >> \"${GITHUB_OUTPUT}\"\n\n      - name: Post Review Results (docs-only short-circuit)\n        if: steps.detect.outputs.all_docs == 'true'\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          HEAD_SHA: ${{ steps.resolve.outputs.head_sha }}\n        run: |\n          set -euo pipefail\n          gh api \"repos/${REPO}/statuses/${HEAD_SHA}\" \\\n            -X POST \\\n            -f state=success \\\n            -f context='Post Review Results' \\\n            -f description='docs-only changeset \u2014 review N/A'\n          echo \"Posted Post Review Results: success (docs-only) on ${HEAD_SHA}\"\n\n  review:\n    name: Post Review Results\n    runs-on: ubuntu-latest\n    if: >-\n      github.event_name == 'pull_request' &&\n      !startsWith(github.head_ref, 'release-please--') &&\n      github.event.pull_request.draft == false\n    needs: [docs-only-check]\n    permissions:\n      contents: read\n      pull-requests: write\n      statuses: write\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n\n      - name: Post Review Results (stub \u2014 fails closed by default)\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          # AISDLC-261 PR #480 review fix (CRITICAL): the stub now defaults to\n          # FAILURE so adopters who configure 'Post Review Results' as a required\n          # branch-protection check + enable auto-merge don't accidentally ship\n          # a phantom review gate that auto-merges every PR with zero review.\n          # To opt in to auto-pass while wiring your reviewers, set the repo\n          # variable AISDLC_REVIEW_STUB_AUTOPASS=true. Real reviewer wiring\n          # should replace this entire step.\n          AUTOPASS: ${{ vars.AISDLC_REVIEW_STUB_AUTOPASS }}\n        run: |\n          set -euo pipefail\n          if [ \"${AUTOPASS:-}\" = \"true\" ]; then\n            STATE=success\n            DESC='Review passed (STUB AUTOPASS \u2014 wire your reviewers, then unset AISDLC_REVIEW_STUB_AUTOPASS)'\n          else\n            STATE=failure\n            DESC='Review stub not wired. Either replace this workflow step with your reviewers OR set repo var AISDLC_REVIEW_STUB_AUTOPASS=true (acknowledged risk).'\n          fi\n          gh api \"repos/${REPO}/statuses/${HEAD_SHA}\" \\\n            -X POST \\\n            -f state=\"${STATE}\" \\\n            -f context='Post Review Results' \\\n            -f description=\"${DESC}\"\n          echo \"Posted Post Review Results: ${STATE} on ${HEAD_SHA}\"\n";
+/**
+ * `.github/workflows/auto-enable-auto-merge.yml` — auto-arms GitHub auto-merge
+ * on every new same-repo PR so the PR merges automatically as soon as required
+ * checks pass. Release-please PRs are excluded (operator arms manually).
+ *
+ * Source of truth: `.github/workflows/auto-enable-auto-merge.yml` in the
+ * ai-sdlc framework repo (AISDLC-261). Mirror changes here when the
+ * auto-merge strategy or exclude rules evolve.
+ *
+ * Requires:
+ *   - GitHub repo setting "Allow auto-merge" must be enabled.
+ *   - \`AI_SDLC_PAT\` secret with write access to the repo (or use
+ *     \`secrets.GITHUB_TOKEN\` if the repo's default token has write access).
+ */
+export declare const AUTO_ENABLE_AUTO_MERGE_WORKFLOW = "name: Auto-enable auto-merge on PR open\n\n# Enables GitHub's auto-merge on every new same-repo PR. Once required\n# checks pass, GitHub adds the PR to the merge queue which rebases + runs\n# CI + merges if green. No human click needed.\n#\n# Requires repo setting \"Allow auto-merge\" to be enabled (Settings \u2192 General).\n# Requires a PAT or GitHub App token with `pull_requests: write` stored as\n# the `AI_SDLC_PAT` repository secret (or swap for `github.token` if your\n# repo grants it write access).\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened, ready_for_review]\n  check_suite:\n    types: [completed]\n  status:\n\npermissions:\n  pull-requests: write\n  contents: write\n\njobs:\n  enable-auto-merge:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Discover PR for this event\n        id: discover\n        env:\n          GH_TOKEN: ${{ secrets.AI_SDLC_PAT }}\n          GH_REPO: ${{ github.repository }}\n          EVENT_NAME: ${{ github.event_name }}\n          PR_NUMBER_FROM_PR_EVENT: ${{ github.event.pull_request.number }}\n          HEAD_SHA: ${{ github.event.check_suite.head_sha || github.event.sha || github.sha }}\n        run: |\n          set -euo pipefail\n          if [ \"$EVENT_NAME\" = \"pull_request\" ]; then\n            echo \"pr=$PR_NUMBER_FROM_PR_EVENT\" >> \"$GITHUB_OUTPUT\"\n          else\n            PR=$(gh api \"/repos/$GH_REPO/commits/$HEAD_SHA/pulls\" --jq '.[] | select(.state == \"open\") | .number' | head -1)\n            echo \"pr=${PR:-}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Skip when no PR matches\n        if: steps.discover.outputs.pr == ''\n        run: echo \"[auto-enable] no open PR for this event \u2014 nothing to arm.\"\n\n      - name: Skip drafts, fork PRs, and release-please PRs\n        id: guard\n        if: steps.discover.outputs.pr != ''\n        env:\n          GH_TOKEN: ${{ secrets.AI_SDLC_PAT }}\n          GH_REPO: ${{ github.repository }}\n          PR: ${{ steps.discover.outputs.pr }}\n          REPO: ${{ github.repository }}\n        run: |\n          set -euo pipefail\n          PR_INFO=$(gh pr view \"$PR\" --json isDraft,headRepositoryOwner,headRepository,headRefName \\\n            -q '{isDraft: .isDraft, headRefName: .headRefName, headFull: (((.headRepositoryOwner.login // \"\") + \"/\" + (.headRepository.name // \"\")) // \"\")}')\n          IS_DRAFT=$(echo \"$PR_INFO\" | jq -r '.isDraft')\n          HEAD_FULL=$(echo \"$PR_INFO\" | jq -r '.headFull')\n          HEAD_REF=$(echo \"$PR_INFO\" | jq -r '.headRefName')\n          if [ \"$IS_DRAFT\" = \"true\" ]; then\n            echo \"[auto-enable] PR #$PR is draft \u2014 skipping.\"\n            echo \"skip=true\" >> \"$GITHUB_OUTPUT\"\n          elif [ \"$HEAD_FULL\" = \"/\" ] || [ -z \"$HEAD_FULL\" ]; then\n            # AISDLC-261 PR #480 review fix: defensive \u2014 head repository was\n            # deleted or API returned an empty shape. Refuse to arm; operator\n            # can re-arm manually if intended.\n            echo \"[auto-enable] PR #$PR has no resolvable head repository \u2014 skipping.\"\n            echo \"skip=true\" >> \"$GITHUB_OUTPUT\"\n          elif [ \"$HEAD_FULL\" != \"$REPO\" ]; then\n            echo \"[auto-enable] PR #$PR is from a fork ($HEAD_FULL) \u2014 skipping.\"\n            echo \"skip=true\" >> \"$GITHUB_OUTPUT\"\n          elif case \"$HEAD_REF\" in release-please--*) true ;; *) false ;; esac; then\n            echo \"[auto-enable] PR #$PR is a release-please PR \u2014 skipping. Arm manually when ready.\"\n            echo \"skip=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"skip=false\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Refresh auto-merge\n        if: steps.discover.outputs.pr != '' && steps.guard.outputs.skip != 'true'\n        env:\n          GH_TOKEN: ${{ secrets.AI_SDLC_PAT }}\n          PR: ${{ steps.discover.outputs.pr }}\n        run: |\n          # disable-then-arm to clear any stale GitHub auto-merge state.\n          gh pr merge --disable-auto \"$PR\" 2>/dev/null || true\n          gh pr merge --auto \"$PR\"\n";
+/**
+ * `.ai-sdlc/calibration.yaml` — per-org calibration config for the
+ * RFC-0031 DIDRevisionProposal mechanism (Refit AISDLC-310).
+ *
+ * Exposes OQ-12.1 (confidence thresholds) and OQ-12.5 (rejection weights +
+ * penalty floor) as per-org configurable defaults. All values default to
+ * the operator-affirmed shipped defaults from AISDLC-271 / PR #476.
+ *
+ * Drift policy: when `parseRevisionProposalCalibrationYaml()` in
+ * `orchestrator/src/sa-scoring/revision-proposal-config.ts` gains new
+ * config fields, mirror them here. The values in this template MUST match
+ * the DEFAULT_* constants exported from that module.
+ */
+export declare const CALIBRATION_YAML_STUB = "# RFC-0031 DIDRevisionProposal calibration config (Refit AISDLC-310).\n#\n# Configures per-org thresholds and weights for the calibration-driven\n# DID revision proposal mechanism. All values below are the shipped\n# defaults (operator-affirmed 2026-05-16 audit). Adjust to tune the\n# mechanism for your SOUL-drift cadence and review culture.\n#\n# Validation rules (enforced at load time by the runtime):\n#   - confidenceThresholds.highSampleSize > lowSampleSize > 0\n#   - all rejectionPrecedent.weights in [0, 1]\n#   - rejectionPrecedent.confidencePenaltyFloor in [0, 1]\n\ncalibration:\n  # Fields that should never receive auto-proposals (OQ-12.3).\n  # Add JSON-path identifiers for fields the triad has decided to lock.\n  # Operators remove entries from this list to opt back in.\n  lockNoProposal: []\n    # - $.identityClass.evolving.voiceRegister\n    # - $.identityClass.core.soulPurpose.mission\n\n  # Confidence threshold configuration (OQ-12.1).\n  # Sample size = dismissSignals + escalateSignals + driftEvents.\n  confidenceThresholds:\n    highSampleSize: 20     # sample size >= this \u2192 HIGH confidence (if other conditions met)\n    lowSampleSize: 5       # sample size <  this \u2192 LOW confidence (regardless of other conditions)\n\n  # Rejection precedent configuration (OQ-12.5).\n  # When a proposal is rejected, a weight is stored in the rejection record\n  # and averaged across prior rejections to suppress future confidence for\n  # the same field.  Formula: factor = max(floor, 1.0 - avgWeight x 0.5)\n  rejectionPrecedent:\n    weights:\n      highConfidenceRejection: 0.8   # strong disagreement signal\n      mediumConfidenceRejection: 0.5 # moderate disagreement\n      lowConfidenceRejection: 0.2    # expected noise level; low weight\n    confidencePenaltyFloor: 0.2      # max 80% suppression; raise to be more conservative\n";
+/**
+ * `.ai-sdlc/embedding-config.yaml` — per-org embedding-framework defaults
+ * per RFC-0019 §15.1 (operator re-walkthrough 2026-05-21). Includes every
+ * NEW field surfaced by the re-walkthrough (marked as such inline):
+ *   - scaleEscalationHeuristic (OQ-1)
+ *   - perConsumerOverridesAllowed (OQ-2)
+ *   - crossProviderPolicy split (OQ-3)
+ *   - catalogDedup milestones (OQ-4)
+ *   - unifiedCostReport (OQ-6 + OQ-7)
+ *   - adapterBillingModelRespected (OQ-7)
+ *
+ * The framework reads this file when `AI_SDLC_EMBEDDING_PROVIDER=on` AND
+ * `Pipeline.spec.embedding` is present. Per-pipeline fields in
+ * `Pipeline.spec.embedding` override the corresponding per-org defaults here.
+ *
+ * The file is OPTIONAL — when absent, framework defaults apply (matching
+ * the values below). Operators commit this file to make the defaults
+ * explicit + reviewable.
+ */
+export declare const EMBEDDING_CONFIG_YAML_STUB = "# Per-org embedding-framework defaults (RFC-0019 \u00A715.1).\n#\n# Read by the framework when AI_SDLC_EMBEDDING_PROVIDER=on. Per-pipeline\n# fields under spec.embedding override these defaults. The file is\n# OPTIONAL \u2014 when absent, the framework defaults below apply.\n#\n# Reference: spec/rfcs/RFC-0019-embedding-provider-adapter.md \u00A715.1\n# Runbook:   docs/operations/embedding-providers.md\n\nembedding:\n  provider: openai-text-embedding-3-small   # default adapter (OQ-5 + Phase 1)\n\n  storage:                              # OQ-1 \u2014 JSONL backend + scale-escalation heuristic\n    backend: jsonl\n    path: ${ARTIFACTS_DIR}/_embeddings/\n    gcRetentionDays: 90                 # mtime-based GC threshold\n    scaleEscalationHeuristic:           # NEW (re-walkthrough): operator-visible swap trigger\n      maxEntriesPerProvider: 100000     # > 100K \u2192 swap to sqlite or vector DB\n      maxP95ReadLatencyMs: 250          # OR > 250ms p95 read \u2192 swap\n      operatorRunbook: docs/operations/embedding-providers.md#scale-escalation\n\n  staleVectorPolicy:                    # OQ-2 \u2014 per-org default + per-consumer override\n    default: lazy-re-embed              # alternatives: fail-loud | warn\n    logToCatalog: true                  # log every stale-vector event as Decision\n    perConsumerOverridesAllowed: true   # NEW (re-walkthrough): consumers may pin policy at API\n                                        # site (e.g., RFC-0009 E\u03C4 drift pins fail-loud regardless\n                                        # of org default to preserve historical-trajectory fidelity)\n\n  crossProviderPolicy:                  # OQ-3 \u2014 split (re-walkthrough refinement)\n    crossProvider: refuse               # ALWAYS strict no-op cross-PROVIDER (openai vs cohere)\n                                        # \u2192 Decision: cross-provider-comparison-attempted\n    crossVersionWithinProvider: delegate-to-staleVectorPolicy\n                                        # cross-VERSION delegates to OQ-2 (resolves v0.2 conflict)\n\n  deprecation:                          # OQ-4 \u2014 three-layer precedence + catalog dedup\n    gracePeriodDays: 90                 # framework default; adapter may declare defaultGracePeriodDays\n    strictModeAtDeprecatedAt: false\n    catalogDedup:                       # NEW (re-walkthrough): prevent Decision flood under orchestrator\n      enabled: true\n      milestonesDaysBeforeDeprecatedAt: [89, 60, 30, 7, 1]\n                                        # emit Decisions at milestones, NOT per-load\n\n  costTracking:                         # OQ-6 \u2014 distinct line item + per-consumer attribution\n    lineItem: embeddingTokens\n    budgetIntegration: rfc-0004\n    consumerLabelRequired: false        # NEW (re-walkthrough): optional but recommended;\n                                        # callers pass consumerLabel for per-category attribution\n                                        # (e.g., 'rfc-0009-tessellation-drift', 'rfc-0008-ppa-similarity')\n    unifiedCostReport:                  # NEW (re-walkthrough): cross-substrate finance view\n      enabled: true                     # aggregates embeddingTokens + inputTokens + outputTokens +\n                                        # SubscriptionLedger window cost; tagged by costModel\n      costModelLabels:\n        - subscription-quota            # Claude Code Max / Codex\n        - pay-per-token                 # OpenAI / Cohere / future Anthropic embeddings if launched\n\n  subscriptionLedgerInteraction:        # OQ-7 \u2014 separation + per-adapter billingModel\n    consumeQuotaDefault: false          # default for pay-per-token adapters\n    adapterBillingModelRespected: true  # NEW (re-walkthrough): adapter declares\n                                        # 'pay-per-token' | 'subscription-quota' in capability matrix;\n                                        # subscription-quota adapters route through SubscriptionLedger\n                                        # (e.g., future Anthropic embeddings if shipped)\n";
+/**
+ * Per-soul DesignSystemBinding template (RFC-0009 Phase 2.2).
+ *
+ * Scaffolded at `.ai-sdlc/souls/<slug>/design-system-binding.yaml` for
+ * each soul in a Tessellated Platform. The `spec.extends` field records
+ * the parent platform-root DSB name, implementing the additive inheritance
+ * chain described in RFC-0009 §6.
+ *
+ * Drift policy: when `DesignSystemBindingSpec` gains new required fields,
+ * mirror them here so that freshly-scaffolded soul DSBs are immediately valid.
+ *
+ * @param soulSlug - the soul identifier (e.g. "soul-a"); used in resource name
+ * @param platformDsbName - the parent platform-root DSB name (defaults to
+ *   the literal placeholder `platform-dsb` for adopters to replace)
+ */
+export declare function buildSoulDsbTemplate(soulSlug: string, platformDsbName?: string): string;
+/**
+ * The set of feature templates exported as a single map so the wizard
+ * dispatcher can iterate without each feature growing its own switch
+ * statement.
+ *
+ * Each entry maps a relative path inside the target repo to the literal
+ * bytes to write. Paths are POSIX-style; the writer joins them onto the
+ * project dir using `node:path/join` which is platform-correct.
+ */
+export interface FeatureTemplateSet {
+    /** Files under the project root keyed by relative POSIX path. */
+    files: Record<string, string>;
+}
+export declare const DOR_TEMPLATES: FeatureTemplateSet;
+export declare const ATTESTATION_TEMPLATES: FeatureTemplateSet;
+export declare const CLASSIFIER_TEMPLATES: FeatureTemplateSet;
+/**
+ * `.ai-sdlc/quality-monitoring.yaml` stub — RFC-0025 §13.1 per-org config.
+ *
+ * AISDLC-305 / Phase 4: ships the documented §13.1 defaults across all
+ * resolved OQ surfaces:
+ *   - OQ-1 confidence-bucketed classifier thresholds
+ *   - OQ-2 per-axis severity weights
+ *   - OQ-3 multi-window recurrence
+ *   - OQ-4 framework-bug suggest-only attribution
+ *   - OQ-5 upstream reporting (operator-initiated)
+ *   - OQ-6 coverage-gap response
+ *   - OQ-7 composite determinism sampling
+ *   - OQ-9 operator-time-cost instrumentation
+ *   - OQ-10 vendor-namespace enforcement (strict by default)
+ *
+ * All values are commented-out so the file is documentation-as-data: the
+ * defaults inside `pipeline-cli/src/tui/analytics/quality-monitoring-config.ts`
+ * remain the source of truth, but operators get a complete cribsheet of
+ * what they can tune by un-commenting and editing.
+ */
+export declare const QUALITY_MONITORING_CONFIG_STUB = "# RFC-0025 Framework Quality Monitoring configuration (\u00A713.1).\n#\n# Per-org overrides for the AI-SDLC framework's failure-mode taxonomy,\n# severity rubric, attribution UX, and self-improvement metrics. Every\n# block below ships with sensible small-to-medium-team defaults\n# (un-commented entries override the defaults).\n#\n# Lifecycle:\n#   - Drop this file in `.ai-sdlc/` to override defaults org-wide.\n#   - Pass `--severity-weight <axis>=<value>` on relevant CLIs for a\n#     one-shot debugging override (precedence: CLI > YAML > defaults).\n#   - The loader rejects un-namespaced custom subclasses by default\n#     (OQ-10 strict enforcement); set `vendor-namespace.enforce: warn`\n#     to downgrade to a soft warning during migration (deprecated).\n#\n# See RFC-0025 \u00A713.1 for the full schema rationale + OQ resolutions.\n\nquality:\n  # OQ-1 / Phase 2 \u2014 Confidence-bucketed classifier (three-tier).\n  # classifier:\n  #   confidenceThresholds:\n  #     autoClassify: 0.7   # \u2265 this \u2192 auto-classify into the resolved class\n  #     ambiguous: 0.3      # \u2265 this and < autoClassify \u2192 ambiguous;\n  #                         # < this \u2192 unclassified, log-only\n\n  # OQ-2 / Phase 4 \u2014 Per-axis severity weights for the \u00A77 composite rubric.\n  # Multiplies the qualitative axis (low=0, medium=1, high=2) before the\n  # max + frequency bump. A weight of 1.0 is the qualitative-bucket default.\n  # severity-weights:\n  #   operator-time-cost: 1.0\n  #   framework-recurrence: 1.0\n  #   blast-radius: 1.0\n\n  # OQ-3 / Phase 3 \u2014 Multi-window recurrence (simultaneously computed).\n  # recurrence-windows:\n  #   - 7d   # flap detection\n  #   - 30d  # standard recurrence\n  #   - 90d  # legacy regression\n\n  # OQ-4 / Phase 4 \u2014 Framework-bug attribution UX. Default is suggest-only\n  # (small-team-safe per the operator-affirmed OQ-4 resolution). Flip\n  # `autoAttribute: true` to force-assign the top candidates on creation.\n  # framework-bug:\n  #   autoAttribute: false\n  #   suggestionCount: 3\n  #   attributionSources:\n  #     - codeowners\n  #     # - git-blame   # v2 extension (RFC-0025 \u00A713.1)\n  #     # - recent-pr   # v2 extension\n\n  # OQ-5 / Phase 6 \u2014 Operator-initiated upstream reporting. Set\n  # `repoUrl` to your framework-repo to enable `cli-quality report-upstream`.\n  # upstream-reporting:\n  #   repoUrl: \"https://github.com/<org>/<repo>\"\n  #   prefilledIssueTemplate: \".ai-sdlc/templates/framework-bug-report.md\"\n\n  # OQ-6 / Phase 5 \u2014 Coverage-gap response. Composes with RFC-0024\n  # emergent capture (capture-record with source: framework-coverage-gap).\n  # coverage-gap:\n  #   autoQuarantine: true\n  #   fileCapture: true\n\n  # OQ-7 / Phase 5 \u2014 Composite determinism-detection sampling. Risk-based\n  # concentration via blast-radius matches the framework's deterministic-\n  # first preflight ladder (RFC-0035 \u00A75).\n  # determinism-detection:\n  #   defaultSampleRate: 0.02            # 1-in-50 baseline\n  #   alwaysOnRequiresDeterminism: true\n  #   alwaysOnTopBlastRadiusDecile: true\n\n  # OQ-9 / Phase 5 \u2014 Operator-time-cost instrumentation. AFK filter zeroes\n  # out elapsed-time over inactivity gaps > N minutes (default 30).\n  # operator-time-cost:\n  #   afkInactivityMinutes: 30\n\n  # OQ-10 / Phase 6 \u2014 Vendor-namespace enforcement for custom failure-mode\n  # subclasses. Matches Kubernetes CRD / npm scoped / Go module convention.\n  # vendor-namespace:\n  #   enforce: reject    # or 'warn' (deprecated) / 'none' (deprecated)\n\n  # OQ-10 / Phase 6 \u2014 Adopter-declared custom failure-mode subclasses.\n  # Each entry MUST use a vendor reverse-DNS prefix under the default\n  # `enforce: reject`. Un-prefixed entries error at resource-load time.\n  # customSubclasses:\n  #   - acme-corp:custom-gate-faulty\n  #   - acme-corp:billing-timeout\n";
+/**
+ * `.ai-sdlc/templates/framework-bug-report.md` stub — adopter-customisable
+ * template for the OQ-5 upstream-reporting CLI (\`cli-quality report-upstream\`).
+ *
+ * The template uses double-brace placeholders that the
+ * \`tui/analytics/upstream-reporter.ts\` module replaces at render time:
+ *   {{subclass}}, {{severity_composite}}, {{severity_otc}},
+ *   {{severity_blast}}, {{severity_freq}}, {{ts}}, {{task_id}},
+ *   {{worker_id}}, {{rationale}}, {{suggested_fix}}, {{related_paths}},
+ *   {{exit_code}}, {{source}}, {{stderr_tail}}
+ *
+ * Adopters can re-order sections + add markdown but should keep the
+ * placeholder names — the renderer's substitution table is fixed.
+ */
+export declare const FRAMEWORK_BUG_REPORT_TEMPLATE_STUB = "## Framework bug \u2014 {{subclass}}\n\n**Severity:** {{severity_composite}} (operator-time-cost={{severity_otc}}, blast-radius={{severity_blast}}, frequency={{severity_freq}})\n**Subclass:** `{{subclass}}`\n**Reported at (capture timestamp):** {{ts}}\n**Related task:** {{task_id}}\n**Worker:** {{worker_id}}\n\n### What happened\n\nThe AI-SDLC framework's RFC-0025 quality monitor classified this failure as\n`framework-misbehaved` / `{{subclass}}`. Per the classifier's rationale:\n\n> {{rationale}}\n\n### Suggested fix (heuristic \u2014 please verify)\n\n{{suggested_fix}}\n\n### Related code paths\n\n{{related_paths}}\n\n### Anonymised repro\n\nThe framework anonymised the failure context before this template\nrendered: absolute home paths were collapsed to `~/\u2026`, worktree paths to\n`<worktree>`, and any apparent secret tokens (sk-\u2026, ghp_\u2026, xoxb-\u2026) or\nemail addresses were replaced with `<REDACTED-\u2026>`. The operator should\nstill inspect the body before submitting.\n\n```\nexit code: {{exit_code}}\nsource:    {{source}}\n\n{{stderr_tail}}\n```\n\n### Operator checklist (before clicking Submit)\n\n- [ ] I have reviewed the anonymised repro for any remaining sensitive context.\n- [ ] The classifier's rationale matches what I observed locally.\n- [ ] The suggested fix and related paths look correct for this failure.\n- [ ] I am willing to follow up on the issue if the maintainers ask for more context.\n\n---\n\n_This issue was pre-generated by `cli-quality report-upstream` (RFC-0025 \u00A713 OQ-5)._\n_The operator reviewed and submitted this report. No automatic telemetry was transmitted._\n";
+/**
+ * Quality-monitoring template set scaffolded by the wizard's
+ * \`--with-quality-monitoring\` / \`--add quality-monitoring\` flag
+ * (AISDLC-305). Bundles the OQ-2 + OQ-4 + OQ-5 surfaces:
+ *
+ *   1. \`.ai-sdlc/quality-monitoring.yaml\` — RFC-0025 §13.1 per-org config
+ *      with all blocks commented-out (shipping defaults documented inline).
+ *   2. \`.ai-sdlc/templates/framework-bug-report.md\` — adopter-customisable
+ *      template for the OQ-5 upstream-reporting CLI.
+ *
+ * Idempotent: files already present at the target paths are skipped by the
+ * dispatcher.
+ */
+export declare const QUALITY_MONITORING_TEMPLATES: FeatureTemplateSet;
+/**
+ * `.ai-sdlc/signal-ingestion.yaml` stub — RFC-0030 Signal Ingestion Pipeline.
+ *
+ * AISDLC-348 / Phase 6: ships the full §11 config schema with every block
+ * commented-out under `enabled: false`. The pipeline is OFF until the
+ * operator explicitly flips `enabled: true` AND opts in via the
+ * `AI_SDLC_SIGNAL_INGESTION` flag during the soak window.
+ *
+ * Like `QUALITY_MONITORING_CONFIG_STUB`, this file is documentation-as-data:
+ * the runtime defaults inside `orchestrator/src/signal-ingestion/config.ts`
+ * (DEFAULT_SIGNAL_INGESTION_CONFIG) are the source of truth, but operators
+ * get a complete cribsheet of what they can tune. Tier multipliers, ICP
+ * resonance weights, SA-resonance thresholds, Tier-2 significance gate,
+ * clustering algorithm, D1 composition split, and adapter list are all
+ * documented inline with the shipped defaults.
+ *
+ * Drift policy: when DEFAULT_SIGNAL_INGESTION_CONFIG gains new fields,
+ * mirror them here so freshly-scaffolded configs are immediately complete.
+ * The values in the commented blocks below MUST match the constants in
+ * `config.ts`.
+ *
+ * Configuration changes to this file emit `SignalIngestionConfigChanged`
+ * events to `events.jsonl` (see RFC-0030 §11 closing note + AISDLC-348
+ * governance event logger). Operators should treat tier-multiplier edits,
+ * threshold tweaks, and adapter list changes as governance-relevant: they
+ * change which customer signals the framework treats as load-bearing
+ * demand and therefore affect D1 scoring upstream of the dispatcher.
+ */
+export declare const SIGNAL_INGESTION_CONFIG_STUB = "# RFC-0030 Signal Ingestion Pipeline configuration (\u00A711).\n#\n# Per-org config for the Demand Sources \u2192 D1 pipeline. Pluggable source\n# adapters fetch raw signals (support tickets, community threads, manual\n# entries), classify them by tier + ICP + recency, cluster them into\n# demand themes, filter through SA resonance, and feed D1 cluster-level\n# demand scores into PPA.\n#\n# Ships DISABLED by default. The pipeline is gated by both:\n#   1. `spec.enabled: true` in this file\n#   2. `AI_SDLC_SIGNAL_INGESTION` env flag set to a truthy value during\n#      the soak window (1/true/yes/on). Post-promotion the flag is default-on\n#      and only the YAML toggle matters.\n#\n# Configuration changes emit `SignalIngestionConfigChanged` governance\n# events to `<ARTIFACTS_DIR>/_orchestrator/events-YYYY-MM-DD.jsonl`. Edits\n# to tier multipliers, thresholds, or adapter lists are governance-relevant\n# (RFC-0030 \u00A711 closing note) \u2014 log + product-lead review them like any\n# other DID-adjacent decision.\n#\n# Operator runbook: docs/operations/signal-ingestion.md\n# Promotion runbook: docs/operations/signal-ingestion-promotion.md\n# Schema: spec/schemas/signal-ingestion-config.v1.schema.json\n# RFC: spec/rfcs/RFC-0030-signal-ingestion-pipeline.md\n# Re-walkthrough (2026-05-26): AISDLC-430..434 rolled up OQ-13.1..13.5\n# refinements onto the shipped Phase 1-6 substrate. All refinements\n# reflected in this stub and the runbook.\n\napiVersion: ai-sdlc.io/v1alpha1\nkind: SignalIngestionConfig\nmetadata:\n  name: signal-ingestion\nspec:\n  # Master switch. Flip to `true` AFTER:\n  #   1. You have configured at least one working adapter under `adapters:`\n  #   2. You have set the `AI_SDLC_SIGNAL_INGESTION` env flag (soak window)\n  #   3. You have read docs/operations/signal-ingestion.md for the runbook\n  enabled: false\n\n  # Tier multipliers (RFC-0030 \u00A76.1).\n  # Per-customer-tier weight applied at D1 scoring time. The Churned multiplier\n  # (default 2.0) is intentionally high: churned customers are the strongest\n  # signal of product-market gap. Tune for your deployment heterogeneity \u2014\n  # B2B enterprise platforms typically raise `enterprise` (e.g. 5.0) and\n  # flatten `smb` / `free` (e.g. 0.25). Consumer products typically flatten\n  # all tiers to ~1.0 since tier is less informative.\n  # tierMultipliers:\n  #   enterprise: 3.0\n  #   mid: 1.5\n  #   smb: 1.0\n  #   free: 0.5\n  #   churned: 2.0\n\n  # ICP resonance weights (RFC-0030 \u00A76.2).\n  # Strong = signal source matches declared ICP segments verbatim.\n  # Partial = adjacent segment (e.g. enterprise but wrong industry vertical).\n  # Weak = peripheral (e.g. student account on a B2B product).\n  # icpResonanceWeights:\n  #   strong: 1.5\n  #   partial: 1.0\n  #   weak: 0.5\n\n  # Recency decay half-life in days (RFC-0030 \u00A76.3).\n  # Exponential decay; signals older than ~6 months contribute < 2% of their\n  # original weight at the default. Shorten (e.g. 14) for rapidly-evolving\n  # products; lengthen (e.g. 60) for products with slow signal cycles.\n  # recencyHalfLifeDays: 30\n\n  # Tier 2 significance threshold (RFC-0030 \u00A78).\n  # Tier 2 signals (community, competitive) only feed D1 once a cluster crosses\n  # ALL of these gates. The `minTier1SignalCount: 1` gate is the structural\n  # defense against adversarial flooding (OQ-13.5): community buzz without\n  # any direct customer signal stays in the monitor-only zone.\n  # tier2SignificanceThreshold:\n  #   minSignalCount: 5\n  #   minUniqueSources: 3\n  #   minTier1SignalCount: 1\n  #   minClusterAgeDays: 7\n\n  # SA resonance thresholds (RFC-0030 \u00A79).\n  # Per RFC-0029 Principle 4 \"The Soul Holds\" \u2014 high-SA clusters get full\n  # weight, mid-SA discounted, low-SA flagged for review, zero-SA excluded.\n  # When aggregate cluster SA resonance drops below 0.4 sustained for\n  # 3 sprints, the SoulDriftDetected event fires with\n  # `driftSource: demandMisalignment`.\n  # saResonanceThresholds:\n  #   fullWeight: 0.7\n  #   discounted: 0.4\n  #   excluded: 0.0\n\n  # Clustering algorithm + similarity threshold (RFC-0030 \u00A77).\n  # `bm25` is the deterministic-first default (no external dependencies).\n  # `embedding` requires a configured RFC-0019 embedding provider adapter.\n  # Raise `similarityThreshold` (closer to 1.0) for stricter clustering;\n  # lower for looser theme aggregation.\n  # clustering:\n  #   algorithm: bm25\n  #   similarityThreshold: 0.6\n\n  # D1 composition weights (RFC-0030 \u00A710 / AISDLC-347 Phase 5).\n  # Non-replacement: signal-pipeline-derived demand and human-authored\n  # backlog-item demand both feed D1. The composer normalises the pair to\n  # sum to 1; default 50/50 keeps neither stream dominant out of the box.\n  # Raise `signalPipelineWeight` after the pipeline has soaked and you\n  # trust its output more than manual translation.\n  # d1Composition:\n  #   signalPipelineWeight: 0.5\n  #   backlogItemWeight: 0.5\n\n  # Adapter list (RFC-0030 \u00A75 / OQ-13.1 v0.3 re-walkthrough \u2014 AISDLC-430).\n  # v1 ships env-var-based adapters ONLY. OAuth-required adapters (full\n  # Salesforce / HubSpot, Zendesk-with-OAuth) wait for the credential-mgmt\n  # RFC. Adapters declaring `requiresOAuth: true` are refused at\n  # registration with Decision: adapter-requires-credential-mgmt-rfc.\n  #\n  # Shipped adapters and their credential env vars:\n  #   - signal-source-support-ticket  \u2192 SIGNAL_ZENDESK_PAT\n  #   - signal-source-community-thread \u2192 SIGNAL_COMMUNITY_BOT_TOKEN\n  #   - signal-source-in-app-feedback  \u2192 SIGNAL_IN_APP_FEEDBACK_API_KEY\n  #   - signal-source-manual           \u2192 no credential (see manualEntry block)\n  #\n  # Credential failure Decisions:\n  #   - adapter-credential-not-configured: env var missing \u2192 SET the var\n  #   - adapter-credential-rejected: env var present but auth failed \u2192 ROTATE\n  # Pipeline continues with remaining valid adapters in both cases (G0).\n  # adapters:\n  #   - signal-source-support-ticket\n  #   - signal-source-community-thread\n  #   - signal-source-in-app-feedback\n\n  # Language acceptance (RFC-0030 OQ-13.2 v0.3 re-walkthrough \u2014 AISDLC-431).\n  # Detection: `franc` library (deterministic; <10ms per signal; JS-native;\n  # MIT-licensed; 95%+ accuracy on text >50 chars). Language detection runs\n  # at the classifier before any clustering step.\n  # Default [en] \u2014 English-only. Orgs with non-English customer bases can\n  # add languages: [en, fr, es, de, ja, ...]. Note the documented trade-off:\n  # BM25 clustering degrades ~15-30% precision without per-language\n  # stopwords/stemming (Robertson & Zaragoza \u00A73.5). LLM ICP-resonance and\n  # embedding clustering are native multi-language (no degradation there).\n  # Non-accepted signals: Decision: signal-language-unsupported \u2014 dropped and\n  # logged to catalog for visible-gap metric; pipeline continues (G0).\n  # Opt in knowingly \u2014 see docs/operations/signal-ingestion.md \u00A72.5.\n  # acceptedLanguages:\n  #   - en\n\n  # Per-stage data residency enforcement (RFC-0030 OQ-13.3 v0.3 \u2014 AISDLC-432).\n  # RFC-0022 owns regime DECLARATION (compliance.yaml). This block gates\n  # ENFORCEMENT at each signal-pipeline stage. All points default ON when\n  # any regime is declared; disable selectively only when your regime allows it\n  # (rare \u2014 every override emits SignalIngestionConfigChanged).\n  # residencyEnforcement:\n  #   sourceFromCompliancePosture: true   # derive allowedRegions from RFC-0022\n  #   enforcementPoints:\n  #     fetchSignals: true                # refuse out-of-region signals at adapter\n  #     clustering: true                  # prevent cross-region cluster merging\n  #     storage: true                     # persist residencyRegion field; elevate cross-region read audit\n  #     unifiedCostReport: true           # break out per-region cost attribution\n  #   multiPostureBehavior: union         # GDPR+HIPAA: strictest of both applies\n\n  # Manual-entry anti-gaming (RFC-0030 OQ-13.4 v0.3 re-walkthrough \u2014 AISDLC-430).\n  # RFC-0022 OQ-2 audit trail pattern preserved (forced attestedBy +\n  # auto-filled attestedAt). Three additional anti-gaming hooks:\n  #   1. Per-operator daily rate limit (default 10/day). Above cap:\n  #      Decision: manual-signal-rate-limit-exceeded.\n  #   2. Optional evidenceUrl (call recording, ticket URL, transcript link).\n  #      When present, audit trail is materially stronger.\n  #   3. Rolling 7d manual-share quality metric. Above 30% sustained:\n  #      Decision: manual-signal-share-elevated (warning, not block).\n  # manualEntry:\n  #   dailyCapPerOperator: 10             # per-operator per-UTC-day; 0 = disabled\n  #   evidenceUrlOptional: true           # framework treats evidenceUrl as optional\n  #   qualityMetric:\n  #     enabled: true\n  #     windowDays: 7\n  #     shareWarningThreshold: 0.30       # >30% rolling 7d triggers Decision\n\n  # Adversarial-injection defense (RFC-0030 OQ-13.5 v0.3 \u2014 AISDLC-433).\n  # Two layers:\n  #   1. Tier 2 significance threshold (\u00A78) \u2014 structural floor requiring \u22651\n  #      Tier 1 signal per cluster.\n  #   2. Z-score detector \u2014 runtime anomaly layer on rolling 7d baseline.\n  # Trigger: volume > 3\u03C3 above baseline AND unique sources in window < 3.\n  # Quarantine: flagged signals recorded but NOT fed to D1; auto-expires 24h.\n  # One-click unquarantine logs Decision: signal-flooding-false-positive for\n  # v2 reputation-weighting calibration. Reputation-weighting deferred to v2\n  # (cold-start unsafe \u2014 requires 7+ corpus windows of baseline data).\n  # flooding:\n  #   detection:\n  #     algorithm: z-score               # only z-score supported (AISDLC-433)\n  #     zScoreThreshold: 3.0\n  #     windowMinutes: 60\n  #     minUniqueSourcesForSuspicion: 3\n  #     baselineDays: 7\n  #   quarantine:\n  #     enabled: true\n  #     durationHours: 24\n";
+/**
+ * Signal-ingestion template set scaffolded by the wizard's
+ * \`--with-signal-ingestion\` / \`--add signal-ingestion\` flag (AISDLC-348).
+ *
+ * Ships the per-org config stub disabled-by-default. The pipeline runtime
+ * lives in \`orchestrator/src/signal-ingestion/\`; this template just gives
+ * adopters the documented config surface to start from.
+ *
+ * Idempotent: existing files at the target paths are skipped by the
+ * dispatcher.
+ */
+export declare const SIGNAL_INGESTION_TEMPLATES: FeatureTemplateSet;
+/**
+ * Workflow template set scaffolded by `--with-workflows` / `--add workflows`
+ * (AISDLC-261). Bundles all four canonical GitHub Actions workflow files that
+ * an adopter needs for the AI-SDLC framework to function end-to-end:
+ *
+ *   1. `ai-sdlc-gate.yml` — single rollup `ai-sdlc/pr-ready` check (always-on baseline).
+ *   2. `verify-attestation.yml` — DSSE envelope verifier (audit-only).
+ *   3. `ai-sdlc-review.yml` — CI-side reviewer fan-out + `Post Review Results` status.
+ *   4. `auto-enable-auto-merge.yml` — arms auto-merge on every same-repo PR.
+ *
+ * Idempotent: files already present are skipped by default; `--force` overwrites.
+ *
+ * Source of truth: `.github/workflows/` in the ai-sdlc framework repo.
+ * Mirror changes here when the adopter-facing API evolves.
+ */
+export declare const WORKFLOWS_TEMPLATES: FeatureTemplateSet;
+/**
+ * Always-on baseline workflow templates (regardless of wizard answers).
+ * Matches AC #4 in AISDLC-143: pipeline.yaml + agent-role.yaml +
+ * quality-gate.yaml + autonomy-policy.yaml are scaffolded by `initProject`
+ * (existing logic) and the gate workflow is scaffolded by this map.
+ *
+ * AISDLC-305 / Phase 4 (RFC-0025): the quality-monitoring config + the
+ * upstream-report template are part of the BASELINE because they are pure
+ * documentation-as-data (every block commented-out, shipping defaults
+ * documented inline). Adopters get the §13.1 cribsheet by default; the
+ * `.gitignore`-friendly behavior is to commit it as-is and uncomment
+ * blocks per-org as needed.
+ */
+export declare const BASELINE_WORKFLOW_TEMPLATES: FeatureTemplateSet;
+//# sourceMappingURL=init-templates.d.ts.map