@guilz-dev/sdlc-gh 0.1.0

package/.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# Harness assets — require harness engineer review
+/.github/ @your-org/harness-engineers
+/evals/ @your-org/harness-engineers
+/docs/telemetry-schema.md @your-org/harness-engineers
+/docs/operations.md @your-org/harness-engineers

package/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,68 @@
+name: Bug report
+description: Report a defect in the harness, bootstrap flow, workflows, or documentation
+title: "[bug]: "
+labels:
+  - task:infra
+  - autonomy:L0
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: Short description of the problem.
+      placeholder: What is broken?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      description: Steps, commands, repository context, or workflow path needed to reproduce.
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      placeholder: What should have happened?
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      placeholder: What happened instead?
+    validations:
+      required: true
+
+  - type: input
+    id: stack
+    attributes:
+      label: Stack
+      description: One of `ts`, `python`, `go`, `ruby`, `php`, or `n/a`.
+      placeholder: ts
+    validations:
+      required: true
+
+  - type: input
+    id: node
+    attributes:
+      label: Node.js version
+      placeholder: 22.x
+    validations:
+      required: false
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or screenshots
+      description: Paste relevant output with secrets removed.
+    validations:
+      required: false

package/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

package/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,39 @@
+name: Feature request
+description: Propose an improvement to the harness, workflows, or adoption model
+title: "[feature]: "
+labels:
+  - task:infra
+  - autonomy:L0
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem statement
+      description: What pain point or gap are you trying to address?
+      placeholder: What is missing or too hard today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed change
+      placeholder: Describe the behavior or capability you want.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      placeholder: What did you try instead?
+    validations:
+      required: false
+
+  - type: textarea
+    id: impact
+    attributes:
+      label: Expected impact
+      description: Note affected stacks, workflows, or policy surfaces.
+    validations:
+      required: false

package/.github/ISSUE_TEMPLATE/support.yml

@@ -0,0 +1,56 @@
+name: Usage question
+description: Ask for help adopting or operating the harness
+title: "[support]: "
+body:
+  - type: dropdown
+    id: setup_type
+    attributes:
+      label: Setup type
+      options:
+        - Template repository
+        - Existing repository bootstrap
+        - Evaluating only
+    validations:
+      required: true
+
+  - type: dropdown
+    id: stack
+    attributes:
+      label: Stack
+      options:
+        - ts
+        - python
+        - go
+        - ruby
+        - php
+        - n/a
+    validations:
+      required: true
+
+  - type: textarea
+    id: question
+    attributes:
+      label: Question or blocker
+      description: Describe where adoption or operation is blocked.
+      placeholder: What are you trying to do, and where are you stuck?
+    validations:
+      required: true
+
+  - type: textarea
+    id: checks
+    attributes:
+      label: Checks already tried
+      description: Local commands or Actions jobs you already ran.
+      placeholder: |
+        - npm run validate
+        - harness-ci
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Include logs, screenshots, or links with secrets removed.
+    validations:
+      required: false

package/.github/ISSUE_TEMPLATE/task.yml

@@ -0,0 +1,89 @@
+name: Task
+description: Agent-delegated work item with CC-SD contract and acceptance criteria
+title: "[task]: "
+body:
+  - type: textarea
+    id: goal
+    attributes:
+      label: Goal
+      description: One short paragraph describing what this task achieves.
+      placeholder: One short paragraph describing what this task achieves.
+    validations:
+      required: true
+
+  - type: textarea
+    id: non_goals
+    attributes:
+      label: Non-goals
+      description: Bullet list of what this task must not do or change.
+      placeholder: |
+        - Item the task must not do or change
+    validations:
+      required: true
+
+  - type: textarea
+    id: constraints
+    attributes:
+      label: Constraints
+      description: Bullet list of technical or policy limits.
+      placeholder: |
+        - Technical or policy limits (stack, paths, time)
+    validations:
+      required: true
+
+  - type: textarea
+    id: acceptance_criteria
+    attributes:
+      label: Acceptance criteria
+      description: Checkbox or bullet list with testable outcomes. Copied into the PR review gate.
+      placeholder: |
+        - [ ] Criterion 1
+        - [ ] Criterion 2
+    validations:
+      required: true
+
+  - type: textarea
+    id: rollback_hints
+    attributes:
+      label: Rollback hints
+      description: Short revert or undo guidance if the change must be rolled back.
+      placeholder: How to revert this change immediately if needed.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: task_class
+    attributes:
+      label: Task class
+      description: The matching `task:*` label is synced automatically from this choice.
+      options:
+        - docs
+        - test-fix
+        - refactor
+        - feature-small
+        - dependency-bump
+        - infra
+        - security-sensitive
+    validations:
+      required: true
+
+  - type: dropdown
+    id: autonomy
+    attributes:
+      label: Max autonomy level
+      description: The matching `autonomy:*` label is synced automatically from this choice.
+      options:
+        - L0
+        - L1
+        - L2
+        - L3
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Optional background, links, or prior art.
+    validations:
+      required: false

package/.github/agents/implementer.agent.md

@@ -0,0 +1,17 @@
+---
+name: implementer
+description: Implement tasks with read, edit, and test tools. Default L1 agent.
+tools: ["read", "edit", "search", "execute"]
+handoffs:
+  - agent: triager
+    when: Task classification unclear
+---
+
+# Implementer
+
+1. Read the Issue CC-SD contract: `Goal`, `Non-goals`, `Constraints`, `Acceptance criteria`, `Rollback hints`.
+2. Treat `Goal`, `Non-goals`, `Constraints`, and `Acceptance criteria` as the implementation boundary.
+3. Implement minimal change within autonomy size limits.
+4. Run stack-appropriate tests locally or in CI.
+5. Open draft PR summarizing contract-relevant points (`Goal implemented`, `Non-goals preserved`, `Constraints handled`, `Acceptance criteria`, `Rollback`).
+6. Never approve your own PR.

package/.github/agents/reviewer.agent.md

@@ -0,0 +1,18 @@
+---
+name: reviewer
+description: Review PRs against acceptance criteria. Read-only, no edits.
+tools: ["read", "search"]
+---
+
+# Reviewer
+
+Evaluate PRs using docs/arch.md §5.5 and the linked Issue CC-SD contract:
+
+1. **Requirement fit** — `Goal` and `Acceptance criteria` met?
+2. **Non-goal preservation** — out-of-scope items from `Non-goals` untouched?
+3. **Boundary compliance** — `Constraints` respected?
+4. Test adequacy — tests constrain the change?
+5. Accountability — eval scores, cost, trace links present?
+6. **Rollback ease** — `Rollback hints` / PR `Rollback` section plausible?
+
+Compare **Issue → PR summary → diff** in one pass. Post review comments only; do not push commits.

package/.github/agents/triager.agent.md

@@ -0,0 +1,13 @@
+---
+name: triager
+description: Classify issues with task_class and autonomy labels. Read-only.
+tools: ["read"]
+---
+
+# Triager
+
+1. Read the Issue CC-SD contract: `Goal`, `Non-goals`, `Constraints`, `Acceptance criteria`, `Rollback hints`.
+2. Assign exactly one `task:*` label and one `autonomy:*` label per docs/operations.md.
+3. For `task:docs` or `task:test-fix` with `autonomy:L1`: verify all five CC-SD fields are present and usable (not blank or placeholder-only). **No usable CC-SD contract, no L1 delegation** — request author fixes or assign lower autonomy.
+4. Hand off to implementer for L1+ tasks with a complete contract.
+5. Do not edit code or create PRs.

package/.github/aw/actions-lock.json

@@ -0,0 +1,9 @@
+{
+  "entries": {
+    "github/gh-aw-actions/setup@v0.81.6": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.81.6",
+      "sha": "ba6380cc6e5be5d21677bebe04d52fb48e3abec7"
+    }
+  }
+}

package/.github/copilot-instructions.md

@@ -0,0 +1,35 @@
+# Copilot instructions — global harness policy
+
+## Principles
+
+1. Walls are deterministic — never rely on prompt politeness alone.
+2. No destructive commands (`git push --force`, `rm -rf /`, production DB).
+3. Respect change size limits per autonomy level (see docs/operations.md).
+4. Out of scope: production secrets, billing, legal, PII without human approval.
+
+## CC-SD contract (L1 docs / test-fix)
+
+When implementing `task:docs` or `task:test-fix` at `autonomy:L1`, treat the Issue as the spec:
+
+- `Goal`, `Non-goals`, `Constraints`, `Acceptance criteria`, `Rollback hints` (required)
+- `Additional context` (optional)
+
+Implementer boundary: `Goal`, `Non-goals`, `Constraints`, `Acceptance criteria`.
+Reviewer checks requirement fit and non-goal preservation.
+v1 does not enforce CC-SD on `feature-small`, `infra`, or `security-sensitive`.
+
+## Change size
+
+- L1: max 300 LOC, 8 files
+- L2: max 120 LOC, 4 files
+- L3: max 60 LOC, 2 files
+
+Split large changes instead of exceeding limits.
+
+## Task classes
+
+Use Issue labels `task:*` and `autonomy:*`. Default to L1 for implementation tasks.
+
+## Review
+
+Human gate is PR review only. Mirror the Issue contract in the PR summary and include harness context when available.

package/.github/hooks/hooks.json

@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "hooks": [
+    {
+      "event": "preToolUse",
+      "matcher": "shell",
+      "pattern": "git push --force|git push -f|rm -rf /|drop database|DROP TABLE",
+      "action": "block",
+      "message": "Destructive operation blocked by harness policy"
+    }
+  ]
+}

package/.github/instructions/core.instructions.md

@@ -0,0 +1,11 @@
+---
+description: Core harness conventions for all paths
+applyTo: "**/*"
+---
+
+# Core instructions
+
+- Match existing code style in the target stack profile.
+- Add or update tests for behavior changes.
+- Keep PRs within autonomy size limits.
+- Do not modify `.github/workflows/` without `task:infra` label and human review.

package/.github/instructions/profiles/go.instructions.md

@@ -0,0 +1,10 @@
+---
+description: Go conventions
+applyTo: "**/*.go"
+---
+
+# Go profile
+
+- Run `go vet` and `go test ./...` before finishing.
+- Follow standard Go project layout.
+- Keep functions focused; document exported symbols.

package/.github/instructions/profiles/php.instructions.md

@@ -0,0 +1,11 @@
+---
+description: PHP conventions
+applyTo: "**/*.{php,composer.json,composer.lock}"
+---
+
+# PHP profile
+
+- Follow PSR-12; use PHP_CodeSniffer or project linter.
+- Tests with PHPUnit in `tests/`.
+- Use Composer; commit `composer.lock` when the project locks dependencies.
+- Type-hint public methods where supported by the project's PHP version.

package/.github/instructions/profiles/python.instructions.md

@@ -0,0 +1,11 @@
+---
+description: Python conventions
+applyTo: "**/*.py"
+---
+
+# Python profile
+
+- Follow PEP 8; use ruff for lint.
+- Type hints on public functions.
+- Tests with pytest in `tests/`.
+- Use virtualenv or project-standard dependency management.

package/.github/instructions/profiles/ruby.instructions.md

@@ -0,0 +1,11 @@
+---
+description: Ruby conventions
+applyTo: "**/*.{rb,rake,Gemfile,Gemfile.lock}"
+---
+
+# Ruby profile
+
+- Follow project style; use RuboCop for lint.
+- Tests with RSpec in `spec/`.
+- Use Bundler; commit `Gemfile.lock` when the project locks dependencies.
+- Prefer explicit requires or Zeitwerk-style autoloading per project layout.

package/.github/instructions/profiles/typescript.instructions.md

@@ -0,0 +1,11 @@
+---
+description: TypeScript and JavaScript conventions
+applyTo: "**/*.{ts,tsx,js,mjs,cjs}"
+---
+
+# TypeScript profile
+
+- Use strict TypeScript; run `tsc --noEmit` before finishing.
+- Prefer Biome or project linter for formatting and lint.
+- Tests with Vitest or project test runner.
+- No `any` without justification in PR notes.

package/.github/labels.yml

@@ -0,0 +1,55 @@
+- name: task:docs
+  color: "0E8A16"
+  description: Documentation changes
+
+- name: task:test-fix
+  color: "1D76DB"
+  description: Test repair or addition
+
+- name: task:refactor
+  color: "FBCA04"
+  description: Behavior-preserving refactor
+
+- name: task:feature-small
+  color: "5319E7"
+  description: Small feature addition
+
+- name: task:dependency-bump
+  color: "BFD4F2"
+  description: Dependency update
+
+- name: task:infra
+  color: "D93F0B"
+  description: CI, IaC, permissions
+
+- name: task:gh-aw-dogfood
+  color: "C5DEF5"
+  description: Bounded gh-aw validation on sdlc-gh (see docs/gh-aw-dogfood.md)
+
+- name: outer-loop:harness-revision
+  color: "FEF2C0"
+  description: Nightly review routed harness revision work item (#4)
+
+- name: outer-loop:wall-addition
+  color: "FBCA04"
+  description: Nightly review routed wall addition work item (#4)
+
+- name: task:security-sensitive
+  color: "B60205"
+  description: Auth, billing, secrets
+
+- name: autonomy:L0
+  color: "EDEDED"
+  description: Proposal only
+
+- name: autonomy:L1
+  color: "C2E0C6"
+  description: Draft PR, human review required
+
+- name: autonomy:L2
+  color: "FEF2C0"
+  description: Auto-merge candidate after walls
+
+- name: autonomy:L3
+  color: "E99695"
+  description: Limited auto-merge (docs etc.)

package/.github/pull_request_template.md

@@ -0,0 +1,33 @@
+## Summary
+
+<!-- What changed and why (one paragraph) -->
+
+## Goal implemented
+
+<!-- How the PR fulfills the Issue Goal -->
+
+## Non-goals preserved
+
+<!-- Confirm out-of-scope items from the Issue were not touched -->
+
+## Constraints handled
+
+<!-- How technical/policy limits from the Issue were respected -->
+
+## Acceptance criteria
+
+- [ ] 
+
+## Rollback
+
+<!-- How to revert this change immediately if needed -->
+
+## Harness context (auto-filled when available)
+
+| Field | Value |
+|-------|-------|
+| Eval score | |
+| AI credits | |
+| Trace link | |
+| Instructions SHA | |
+| Retry count | |

package/.github/ruleset.example.json

@@ -0,0 +1,33 @@
+{
+  "name": "main-protection",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/main"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "required_status_checks": [
+          { "context": "harness-static" },
+          { "context": "diff-size" },
+          { "context": "issue-spec-check" }
+        ]
+      }
+    }
+  ],
+  "_comment": "Canonical template for scripts/setup-github.sh. The setup script injects product-ci-{stack} from .harness-stack and keeps issue-spec-check required for all repos."
+}

package/.github/ruleset.harness-eval.example.json

@@ -0,0 +1,29 @@
+{
+  "name": "harness-pr-eval-required",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": { "include": ["refs/heads/main"] }
+  },
+  "rules": [
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "require_code_owner_review": true
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "required_status_checks": [
+          { "context": "harness-static" },
+          { "context": "select" },
+          { "context": "trajectory-conventions" }
+        ]
+      }
+    }
+  ],
+  "_comment": "Add prompt-eval when GitHub Models is enabled. Apply to harness-asset PRs after eval-ci is green."
+}

package/.github/skills/quality-loop/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: quality-loop
+description: Verify changes against acceptance criteria before marking complete. Use when implementing or reviewing tasks.
+---
+
+# Quality loop
+
+1. Read Issue CC-SD contract: `Goal`, `Non-goals`, `Constraints`, `Acceptance criteria`, `Rollback hints`.
+2. Implement minimal change within autonomy limits and non-goals.
+3. Run stack tests and harness CI locally if possible.
+4. If checks fail, fix and retry (max per docs/operations.md).
+5. Update PR with contract summary fields and harness context table.
+6. Before marking complete, re-check:
+   - all `Acceptance criteria` satisfied
+   - `Non-goals` were not violated
+   - `Constraints` were respected
+   - `Rollback hints` remain plausible
+7. Stop when all criteria are met or escalate on repeated failure.
+
+## References
+
+- docs/operations.md — thresholds and retry policy
+- docs/failure-taxonomy.md — classify failures