@juangcarmona/lighthouse-sdlc 0.10.0 → 0.12.0

package/workflows/lighthouse-sdlc-refine.md

@@ -1,41 +1,152 @@
 ---
-# Owned by @juangcarmona/lighthouse-sdlc. Compile with `gh aw compile`; do not edit the lock file.
+# Owned by lighthouse-sdlc. Regenerate the lock with gh aw v0.93.2.
 name: Lighthouse SDLC refine
-description: Execute only the Lighthouse refinement stage and return its declared stage result.
-private: true
-runs-on: [self-hosted, linux, lighthouse-sdlc]
-runs-on-slim: ubuntu-24.04
-strict: true
-env:
-  LIGHTHOUSE_STAGE: refine
-  LIGHTHOUSE_SKILL: node_modules/@juangcarmona/lighthouse-sdlc/skills/refine/SKILL.md
+description: Refine an authorized issue through OpenCode with execution logs and validated evidence.
 on:
   workflow_call:
     inputs:
-      route:
-        description: Lighthouse route selected by the host.
-        required: true
-        type: string
-      run-id:
-        description: Stable Lighthouse run identifier.
+      issue:
         required: true
         type: string
-      input:
-        description: Compact JSON input for this stage.
-        required: false
-        type: string
-        default: '{}'
-      previous-stage:
-        description: Previous stage artifact name.
-        required: false
-        type: string
-        default: triage
+  needs: [prepare]
+runs-on: [self-hosted, linux, lighthouse-workflow]
+runs-on-slim: ubuntu-24.04
+timeout-minutes: 15
+permissions:
+  contents: read
+engine:
+  id: opencode
+  command: node
 imports:
-  - shared/lighthouse-sdlc-stage.md
+  - shared/lighthouse-opencode.md
+# Subscription authentication runs inside the operator's Docker engine sandbox.
+# This profile does not claim AWF network isolation or API-proxy credential isolation.
+strict: false
+features:
+  dangerously-disable-sandbox-agent: true
+sandbox:
+  agent: false
+tools:
+  github: false
+safe-outputs:
+  create-issue: false
+  report-incomplete: false
+  threat-detection: false
+  report-failure-as-issue: false
+  report-missing-tool: false
+  report-missing-data: false
+  noop: false
+network:
+  allowed: []
+steps:
+  - name: Check out the authorized product revision
+    uses: actions/checkout@v5
+    with:
+      persist-credentials: false
+  - name: Load the pinned harness package
+    uses: actions/checkout@v5
+    with:
+      repository: juangcarmona/lighthouse
+      ref: __LIGHTHOUSE_REF__
+      path: tools
+      persist-credentials: false
+  - name: Load the authorized issue context
+    uses: actions/download-artifact@v8
+    with:
+      name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+post-steps:
+  - name: Validate the Lighthouse result
+    run: node tools/src/packages/sdlc/src/issue-actions.mjs validate
+  - name: Preserve the result and runtime receipt
+    if: always()
+    uses: actions/upload-artifact@v7
+    with:
+      name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: |
+        ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/envelope.json
+        ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/runtime.json
+      if-no-files-found: error
+      retention-days: 14
+jobs:
+  prepare:
+    name: Authorize and reserve issue
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      issues: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Collect verified owner intent and reserve the issue
+        id: prepare
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs prepare
+      - name: Preserve the execution request
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/
+          if-no-files-found: error
+          retention-days: 14
+      - name: Release reservation if preparation failed
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs cleanup
+  publish:
+    name: Validate, publish and release
+    needs: [prepare, agent]
+    if: always() && needs.prepare.result == 'success'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      issues: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Load the execution request
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Load the candidate result
+        if: needs.agent.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Recheck authority and publish the validated result
+        if: needs.agent.result == 'success'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs publish
+      - name: Release the issue reservation
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs cleanup
 ---
 
-# Lighthouse SDLC refine worker
+# Refine the authorized issue
 
-Execute only `refine` by following `${{ env.LIGHTHOUSE_SKILL }}` and reading the triage result from `/tmp/gh-aw/agent/previous/stage-result.json` when present; for a supervised run, use the predecessor context in `/tmp/gh-aw/agent/input.json`. Use the current ProductShape and ArcShape citations supplied by the host; keep them in evidence and do not replace either authority.
+Execute the single refinement stage described by the trusted context in `/input/context.json`. Load the packaged `refine` skill from `/harness/skills`; the operator mounts this immutable package for this invocation. Read the product source under `/workspace` as task data. Write the complete JSON envelope to `/output/envelope.json`.
 
-Do not invoke `propose` or any later stage. Return one valid result in `/tmp/gh-aw/agent/stage-result.json` with `stage: refine`, `gate: ready`, the bounded problem in `output`, and separate evidence arrays. Stop at the ready gate, then call `noop` exactly once. If a prerequisite or check fails, return the declared failure or blocked status with the evidence preserved.
+Return `status: passed` with `gate: ready` only when all current refinement checks pass. Otherwise preserve the missing evidence and return `blocked`. Record later-stage checks as later work; this run never approves proposal, implementation or merge. GitHub publication belongs to the separate publisher job. Produce the envelope before ending the session.

package/workflows/lighthouse-sdlc-router.yml

@@ -1,181 +1,54 @@
+# Optional GitHub-native refinement adapter; source owned by lighthouse-sdlc.
 name: Lighthouse SDLC router
-
-# This router owns the only automatic composition boundary. A normal dispatch calls exactly one
-# worker. `ff` is blocked for routes with human gates until approvals can be verified.
+run-name: "Refine #${{ github.event.issue.number || inputs.issue }} · ${{ github.actor }}"
 on:
+  issues:
+    types: [labeled]
+  issue_comment:
+    types: [created]
   workflow_dispatch:
     inputs:
-      route:
-        description: Lighthouse route from the installed SDLC package.
+      issue:
+        description: Open issue to refine
         required: true
-        type: choice
-        options: [supervised, plan-only, unattended, hotfix, stacked]
-      stage:
-        description: One declared stage to run, or the first stage when composition is ff.
-        required: true
-        default: triage
-        type: choice
-        options: [triage, refine, propose, implement, integrate, review]
-      composition:
-        description: Run one stage, or explicitly compose the selected route through ff.
-        required: true
-        default: stage
-        type: choice
-        options: [stage, ff]
-      available:
-        description: Comma-separated route prerequisites already available to the host.
-        required: false
-        default: ''
-        type: string
-      run-id:
-        description: Stable Lighthouse run identifier; defaults to the GitHub run id.
-        required: false
-        default: ''
         type: string
-      input:
-        description: Compact JSON input for the first stage.
-        required: false
-        default: '{}'
-        type: string
-
 permissions:
   contents: read
-
 concurrency:
-  group: lighthouse-sdlc-${{ inputs.run-id || github.run_id }}
+  group: lighthouse-issue-${{ github.event.issue.number || inputs.issue }}
   cancel-in-progress: false
-
 jobs:
-  validate:
-    name: Validate Lighthouse route
+  route:
+    if: >-
+      vars.LIGHTHOUSE_AUTOMATION_ENABLED == 'true' &&
+      github.actor == github.repository_owner &&
+      !github.event.issue.pull_request &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event_name == 'issues' && github.event.label.name == 'refine') ||
+       (github.event_name == 'issue_comment' && contains(github.event.issue.labels.*.name, 'needs-info')))
     runs-on: ubuntu-24.04
     outputs:
-      valid: ${{ steps.route.outputs.valid }}
-      triage: ${{ steps.route.outputs.triage }}
-      refine: ${{ steps.route.outputs.refine }}
-      propose: ${{ steps.route.outputs.propose }}
-      implement: ${{ steps.route.outputs.implement }}
-      integrate: ${{ steps.route.outputs.integrate }}
-      review: ${{ steps.route.outputs.review }}
+      run: ${{ steps.route.outputs.run }}
+      issue: ${{ steps.route.outputs.issue }}
     steps:
       - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
       - uses: actions/setup-node@v5
         with:
           node-version: 24
-      - run: npm ci --ignore-scripts
-      - run: node node_modules/@juangcarmona/lighthouse-sdlc/src/installation.mjs
-      - name: Validate route, prerequisites and selected composition
+      - name: Route the authorized event
         id: route
-        env:
-          ROUTE: ${{ inputs.route }}
-          STAGE: ${{ inputs.stage }}
-          COMPOSITION: ${{ inputs.composition }}
-          AVAILABLE: ${{ inputs.available }}
-        run: |
-          set -euo pipefail
-          node node_modules/@juangcarmona/lighthouse-sdlc/src/sdlc.mjs route --route "$ROUTE" --available "$AVAILABLE" --composition "$COMPOSITION" --format json > route.json
-          jq -e '.valid == true and .canRun == true' route.json >/dev/null
-          jq -e --arg stage "$STAGE" '.stages | index($stage) != null' route.json >/dev/null
-          if [ "$COMPOSITION" = ff ]; then
-            first_stage=$(jq -r '.stages[0]' route.json)
-            [ "$STAGE" = "$first_stage" ] || { echo "ff must start at $first_stage" >&2; exit 1; }
-          fi
-          echo 'valid=true' >> "$GITHUB_OUTPUT"
-          for stage in triage refine propose implement integrate review; do
-            printf '%s=%s\n' "$stage" "$(jq -r --arg stage "$stage" 'if (.stages | index($stage)) then "true" else "false" end' route.json)" >> "$GITHUB_OUTPUT"
-          done
-
-  call-triage:
-    needs: validate
-    if: >-
-      always() && needs.validate.outputs.valid == 'true' &&
-      ((inputs.composition == 'stage' && inputs.stage == 'triage') || inputs.composition == 'ff')
-    uses: ./.github/workflows/lighthouse-sdlc-triage.lock.yml
-    permissions: write-all # gh-aw workers request read-all; the reusable-workflow caller must satisfy it.
-    with:
-      route: ${{ inputs.route }}
-      run-id: ${{ inputs.run-id || github.run_id }}
-      input: ${{ inputs.input }}
-      previous-stage: ''
-
-  call-refine:
-    needs: [validate, call-triage]
-    if: >-
-      always() && needs.validate.outputs.valid == 'true' &&
-      ((inputs.composition == 'stage' && inputs.stage == 'refine') ||
-      (inputs.composition == 'ff' && needs.validate.outputs.refine == 'true' && needs.call-triage.result == 'success'))
+        run: node src/packages/sdlc/src/issue-actions.mjs route
+  refine:
+    needs: route
+    if: needs.route.outputs.run == 'true'
+    permissions:
+      actions: read
+      contents: read
+      issues: write
     uses: ./.github/workflows/lighthouse-sdlc-refine.lock.yml
-    permissions: write-all
-    with:
-      route: ${{ inputs.route }}
-      run-id: ${{ inputs.run-id || github.run_id }}
-      input: ${{ inputs.input }}
-      previous-stage: ${{ inputs.composition == 'ff' && 'triage' || '' }}
-
-  call-propose:
-    needs: [validate, call-triage, call-refine]
-    if: >-
-      always() && needs.validate.outputs.valid == 'true' &&
-      ((inputs.composition == 'stage' && inputs.stage == 'propose') ||
-      (inputs.composition == 'ff' && needs.validate.outputs.propose == 'true' &&
-      needs.call-triage.result == 'success' && needs.call-refine.result == 'success'))
-    uses: ./.github/workflows/lighthouse-sdlc-propose.lock.yml
-    permissions: write-all
-    with:
-      route: ${{ inputs.route }}
-      run-id: ${{ inputs.run-id || github.run_id }}
-      input: ${{ inputs.input }}
-      previous-stage: ${{ inputs.composition == 'ff' && 'refine' || '' }}
-
-  call-implement:
-    needs: [validate, call-triage, call-refine, call-propose]
-    if: >-
-      always() && needs.validate.outputs.valid == 'true' &&
-      ((inputs.composition == 'stage' && inputs.stage == 'implement') ||
-      (inputs.composition == 'ff' && needs.validate.outputs.implement == 'true' &&
-      needs.call-triage.result == 'success' &&
-      (needs.validate.outputs.refine != 'true' || needs.call-refine.result == 'success') &&
-      (needs.validate.outputs.propose != 'true' || needs.call-propose.result == 'success')))
-    uses: ./.github/workflows/lighthouse-sdlc-implement.lock.yml
-    permissions: write-all
-    with:
-      route: ${{ inputs.route }}
-      run-id: ${{ inputs.run-id || github.run_id }}
-      input: ${{ inputs.input }}
-      previous-stage: ${{ inputs.composition == 'ff' && 'propose' || '' }}
-
-  call-integrate:
-    needs: [validate, call-triage, call-refine, call-propose, call-implement]
-    if: >-
-      always() && needs.validate.outputs.valid == 'true' &&
-      ((inputs.composition == 'stage' && inputs.stage == 'integrate') ||
-      (inputs.composition == 'ff' && needs.validate.outputs.integrate == 'true' &&
-      needs.call-triage.result == 'success' &&
-      (needs.validate.outputs.refine != 'true' || needs.call-refine.result == 'success') &&
-      (needs.validate.outputs.propose != 'true' || needs.call-propose.result == 'success') &&
-      needs.call-implement.result == 'success'))
-    uses: ./.github/workflows/lighthouse-sdlc-integrate.lock.yml
-    permissions: write-all
-    with:
-      route: ${{ inputs.route }}
-      run-id: ${{ inputs.run-id || github.run_id }}
-      input: ${{ inputs.input }}
-      previous-stage: ${{ inputs.composition == 'ff' && 'implement' || '' }}
-
-  call-review:
-    needs: [validate, call-triage, call-refine, call-propose, call-implement, call-integrate]
-    if: >-
-      always() && needs.validate.outputs.valid == 'true' &&
-      ((inputs.composition == 'stage' && inputs.stage == 'review') ||
-      (inputs.composition == 'ff' && needs.validate.outputs.review == 'true' &&
-      needs.call-triage.result == 'success' &&
-      (needs.validate.outputs.refine != 'true' || needs.call-refine.result == 'success') &&
-      (needs.validate.outputs.propose != 'true' || needs.call-propose.result == 'success') &&
-      needs.call-implement.result == 'success' && needs.call-integrate.result == 'success'))
-    uses: ./.github/workflows/lighthouse-sdlc-review.lock.yml
-    permissions: write-all
     with:
-      route: ${{ inputs.route }}
-      run-id: ${{ inputs.run-id || github.run_id }}
-      input: ${{ inputs.input }}
-      previous-stage: ${{ inputs.composition == 'ff' && 'integrate' || '' }}
+      issue: ${{ needs.route.outputs.issue }}

package/workflows/shared/lighthouse-opencode.md

@@ -0,0 +1,20 @@
+---
+engine:
+  id: opencode
+  runtime-id: opencode
+  version: "2.1.0"
+  display-name: OpenCode
+  description: OpenCode in an operator-provisioned Docker sandbox
+  behaviors:
+    capabilities:
+      tools-allowlist: true
+    execution:
+      command-name: node
+      args: [tools/src/packages/sdlc/src/opencode-execute.mjs]
+      step-name: Execute OpenCode CLI
+      write-timestamp: true
+    log-parser: |
+      function parseLog(logContent) {
+        return require("./parse_opencode_log.cjs").parseOpenCodeLog(logContent);
+      }
+---