@juangcarmona/lighthouse-sdlc 0.12.0 → 0.14.0

package/workflows/lighthouse-sdlc-review.md

@@ -1,41 +1,210 @@
 ---
-# Owned by @juangcarmona/lighthouse-sdlc. Compile with `gh aw compile`; do not edit the lock file.
+# Owned by lighthouse-sdlc. Regenerate the lock with gh aw v0.93.2.
 name: Lighthouse SDLC review
-description: Execute only the Lighthouse review stage and return its declared stage result.
-private: true
-runs-on: [self-hosted, linux, lighthouse-sdlc]
-runs-on-slim: ubuntu-24.04
-strict: true
-env:
-  LIGHTHOUSE_STAGE: review
-  LIGHTHOUSE_SKILL: node_modules/@juangcarmona/lighthouse-sdlc/skills/review/SKILL.md
+description: Assess review with OpenCode and retain a verified delivery record.
+run-name: "review #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
+concurrency:
+  group: lighthouse-issue-${{ inputs.issue }}
+  cancel-in-progress: false
+  queue: max
+  job-discriminator: ${{ github.run_id }}
 on:
-  workflow_call:
+  # The required preparation job authenticates the originating owner request.
+  roles: all
+  workflow_dispatch:
     inputs:
-      route:
-        description: Lighthouse route selected by the host.
+      issue:
+        description: Source issue
         required: true
         type: string
-      run-id:
-        description: Stable Lighthouse run identifier.
+      dispatch-request:
+        description: Authenticated router receipt comment ID
         required: true
         type: string
-      input:
-        description: Compact JSON input for this stage.
-        required: false
-        type: string
-        default: '{}'
-      previous-stage:
-        description: Previous stage artifact name.
-        required: false
-        type: string
-        default: integrate
+  needs: [prepare]
+if: needs.prepare.outputs.eligible == 'true'
+runs-on: [self-hosted, linux, lighthouse-workflow]
+runs-on-slim: ubuntu-24.04
+timeout-minutes: 15
+env:
+  LIGHTHOUSE_RECOVERY_ENABLED: ${{ vars.LIGHTHOUSE_RECOVERY_ENABLED }}
+  LIGHTHOUSE_STAGE: review
+  LIGHTHOUSE_DISPATCH_REQUIRED: "true"
+permissions:
+  contents: read
+engine:
+  id: opencode
+  command: node
 imports:
-  - shared/lighthouse-sdlc-stage.md
+  - shared/lighthouse-opencode.md
+# Subscription authentication runs inside the operator's Docker engine sandbox.
+# This profile does not claim AWF network isolation or API-proxy credential isolation.
+strict: false
+features:
+  dangerously-disable-sandbox-agent: true
+sandbox:
+  agent: false
+tools:
+  github: false
+safe-outputs:
+  create-issue: false
+  report-incomplete: false
+  threat-detection: false
+  report-failure-as-issue: false
+  report-missing-tool: false
+  report-missing-data: false
+  noop:
+    report-as-issue: false
+network:
+  allowed: []
+steps:
+  - name: Check out the authorized product revision
+    uses: actions/checkout@v5
+    with:
+      ref: ${{ needs.prepare.outputs.revision }}
+      persist-credentials: false
+  - name: Load the pinned harness package
+    uses: actions/checkout@v5
+    with:
+      repository: juangcarmona/lighthouse
+      ref: __LIGHTHOUSE_REF__
+      path: tools
+      persist-credentials: false
+  - name: Load the authorized issue context
+    uses: actions/download-artifact@v8
+    with:
+      name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+post-steps:
+  - name: Validate the Lighthouse result
+    run: node tools/src/packages/sdlc/src/completion-actions.mjs validate
+  - name: Preserve the result and runtime receipt
+    if: always()
+    uses: actions/upload-artifact@v7
+    with:
+      name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: |
+        ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/envelope.json
+        ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/runtime.json
+      if-no-files-found: error
+      retention-days: 14
+  - name: Preserve OpenCode diagnostic events
+    if: always()
+    uses: actions/upload-artifact@v7
+    with:
+      name: opencode-events-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: ${{ runner.temp }}/gh-aw/opencode-events-${{ github.run_id }}-${{ github.run_attempt }}.jsonl
+      if-no-files-found: ignore
+      retention-days: 14
+jobs:
+  prepare:
+    outputs:
+      eligible: ${{ steps.prepare.outputs.eligible }}
+      revision: ${{ steps.prepare.outputs.revision }}
+    name: Verify accepted commit, checks and evidence protection
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      checks: read
+      contents: read
+      pull-requests: read
+      issues: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Collect verified owner intent and reserve the issue
+        id: prepare
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/completion-actions.mjs prepare
+      - name: Preserve the execution request
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/
+          if-no-files-found: error
+          retention-days: 14
+      - name: Release reservation if preparation failed
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/completion-actions.mjs cleanup
+  publish:
+    concurrency:
+      group: lighthouse-process-publication
+      cancel-in-progress: false
+    name: Validate, publish and release
+    needs: [prepare, agent]
+    if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: write
+      checks: read
+      contents: write
+      pull-requests: write
+      issues: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Load the execution request
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Load the candidate result
+        if: needs.agent.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Require an executed agent
+        if: needs.agent.result != 'success'
+        run: |
+          echo 'The authorized agent did not complete successfully; inspect its execution.' >&2
+          exit 1
+      - name: Recheck authority and publish the validated result
+        if: needs.agent.result == 'success'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/completion-actions.mjs publish
+      - name: Preserve merge and publication receipts
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-completion-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/integration-receipt.json
+            ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/publication-receipt.json
+          if-no-files-found: warn
+          retention-days: 30
+      - name: Release the issue reservation
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/completion-actions.mjs cleanup
 ---
 
-# Lighthouse SDLC review worker
+# Review the accepted delivery
+
+Follow `/harness/skills/review/SKILL.md` using `/input/context.json`. The host supplies the accepted PR revision, intent and policy fingerprints, changed paths and authenticated GitHub check results. Source under `/workspace` is read-only. Inspect affected guidance and acceptance evidence; a green check alone does not establish intended behavior. Distinguish missing verification from a failed check.
 
-Execute only `review` by following `${{ env.LIGHTHOUSE_SKILL }}` and reading the integration result from `/tmp/gh-aw/agent/previous/stage-result.json` when present; for a supervised run, use the predecessor context in `/tmp/gh-aw/agent/input.json`. Preserve ProductShape and ArcShape citations in the delivery evidence.
+Explain each decision and finding in public progress messages. Write `/output/envelope.json` with the supplied identity. Return `blocked` for unresolved current-stage evidence or decisions. For review, include `output.retrospective` as concise Markdown: what went well, what went wrong, start doing, stop doing and improvement candidates with evidence and an owner. Do not infer recurrence from retries of a single issue. Separate actual source defects from process gaps; proposed guards need their own review and regression proof.
 
-Classify findings, record the outcome and learning, and write one valid result to `/tmp/gh-aw/agent/stage-result.json` with `stage: review`, `gate: null`, the review record in `output`, and separate evidence arrays. Do not open another delivery gate or invoke another stage. Call `noop` exactly once after recording the closing result.
+The publisher rechecks current authority, GitHub checks and reservation. Only an explicit owner dispatch with `merge: true` can authorize integration, and GitHub still enforces merge rules. A passed assessment never proves a merge occurred. Review records learning without changing permissions, opening issues or starting another stage. The host validates the envelope and records the gh-aw completion signal.

package/workflows/lighthouse-sdlc-router.yml

@@ -1,35 +1,71 @@
-# Optional GitHub-native refinement adapter; source owned by lighthouse-sdlc.
+# Optional GitHub-native stage adapter; source owned by lighthouse-sdlc.
 name: Lighthouse SDLC router
-run-name: "Refine #${{ github.event.issue.number || inputs.issue }} · ${{ github.actor }}"
+run-name: "${{ (github.event_name == 'workflow_run' && 'Delivery after CI') || inputs.stage || github.event.label.name || ((github.event.pull_request || github.event.issue.pull_request) && 'PR review') || (github.event_name == 'issue_comment' && 'reply') || 'refine' }} #${{ github.event.issue.number || github.event.pull_request.number || inputs.issue }} · ${{ github.actor }}"
 on:
   issues:
-    types: [labeled]
+    types: [labeled, unlabeled]
   issue_comment:
     types: [created]
+  pull_request_review:
+    types: [submitted]
+  pull_request_review_comment:
+    types: [created]
+  workflow_run:
+    workflows: ["*"]
+    types: [completed]
   workflow_dispatch:
     inputs:
       issue:
-        description: Open issue to refine
+        description: Work item to process
+        required: true
+        type: string
+      stage:
+        description: Authorized lifecycle stage
         required: true
+        default: refine
+        type: choice
+        options: [refine, propose, implement, integrate, review]
+      after_run:
+        description: Recheck a completed execution through the same continuation rules
+        required: false
         type: string
+      pull_request:
+        description: PR number for integrate or review
+        required: false
+        type: string
+      head:
+        description: Full accepted PR head SHA for integrate or review
+        required: false
+        type: string
+      merge:
+        description: Explicitly authorize integrating this accepted PR head
+        required: false
+        default: false
+        type: boolean
 permissions:
   contents: read
-concurrency:
-  group: lighthouse-issue-${{ github.event.issue.number || inputs.issue }}
-  cancel-in-progress: false
+env:
+  LIGHTHOUSE_ENABLED_STAGES: refine,propose,implement,integrate,review
+  LIGHTHOUSE_AUTO_IMPLEMENT: true
+  LIGHTHOUSE_COMPLETION_ENABLED: true
 jobs:
   route:
     if: >-
       vars.LIGHTHOUSE_AUTOMATION_ENABLED == 'true' &&
-      github.actor == github.repository_owner &&
-      !github.event.issue.pull_request &&
-      (github.event_name == 'workflow_dispatch' ||
-       (github.event_name == 'issues' && github.event.label.name == 'refine') ||
-       (github.event_name == 'issue_comment' && contains(github.event.issue.labels.*.name, 'needs-info')))
+      (github.actor == github.repository_owner || github.event_name == 'workflow_run') &&
+      (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_run' ||
+       (github.event_name == 'issues' && (github.event.label.name == 'refine' || github.event.label.name == 'propose' || github.event.label.name == 'implement' || (github.event.action == 'unlabeled' && github.event.label.name == 'future'))) ||
+       github.event_name == 'issue_comment' || github.event_name == 'pull_request_review' || github.event_name == 'pull_request_review_comment')
     runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
     outputs:
       run: ${{ steps.route.outputs.run }}
       issue: ${{ steps.route.outputs.issue }}
+      stage: ${{ steps.route.outputs.stage }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -41,14 +77,52 @@ jobs:
           node-version: 24
       - name: Route the authorized event
         id: route
+        env:
+          GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_COMPLETION_ENABLED: true
         run: node src/packages/sdlc/src/issue-actions.mjs route
-  refine:
+  dispatch:
+    name: 📥 Dispatch selected stage
     needs: route
     if: needs.route.outputs.run == 'true'
+    concurrency:
+      group: lighthouse-dispatch-${{ needs.route.outputs.issue }}
+      cancel-in-progress: false
+      queue: max
+    runs-on: ubuntu-24.04
     permissions:
-      actions: read
+      actions: write
       contents: read
       issues: write
-    uses: ./.github/workflows/lighthouse-sdlc-refine.lock.yml
-    with:
-      issue: ${{ needs.route.outputs.issue }}
+      pull-requests: read
+    env:
+      LIGHTHOUSE_ISSUE: ${{ needs.route.outputs.issue }}
+      LIGHTHOUSE_STAGE: ${{ needs.route.outputs.stage }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Record the authorized request
+        id: request
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs dispatch-prepare
+      - name: Preserve the request before dispatch
+        if: steps.request.outputs.send == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ steps.request.outputs.artifact }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/dispatch.json
+          retention-days: 14
+          if-no-files-found: error
+      - name: Dispatch the independent stage
+        if: steps.request.outputs.send == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_DISPATCH_COMMENT: ${{ steps.request.outputs.comment }}
+        run: node src/packages/sdlc/src/issue-actions.mjs dispatch-send

package/workflows/lighthouse-worker-maintenance.yml

@@ -0,0 +1,126 @@
+name: Lighthouse worker maintenance
+on:
+  schedule:
+    - cron: '17,47 * * * *'
+  workflow_dispatch:
+    inputs:
+      issue:
+        description: Optional source issue; empty scans open owner issues
+        required: false
+        type: string
+permissions:
+  contents: read
+env:
+  LIGHTHOUSE_MAINTENANCE_ENABLED: ${{ vars.LIGHTHOUSE_MAINTENANCE_ENABLED }}
+  LIGHTHOUSE_RECOVERY_ENABLED: ${{ vars.LIGHTHOUSE_RECOVERY_ENABLED }}
+jobs:
+  scan:
+    if: vars.LIGHTHOUSE_AUTOMATION_ENABLED == 'true' && vars.LIGHTHOUSE_MAINTENANCE_ENABLED == 'true' && github.actor == github.repository_owner
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      actions: read
+      issues: read
+    outputs:
+      issues: ${{ steps.scan.outputs.issues }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - id: scan
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/worker-maintenance.mjs scan
+  reconcile:
+    needs: scan
+    if: needs.scan.outputs.issues != '[]'
+    strategy:
+      fail-fast: false
+      max-parallel: 5
+      matrix:
+        issue: ${{ fromJSON(needs.scan.outputs.issues) }}
+    concurrency:
+      group: lighthouse-dispatch-${{ matrix.issue }}
+      cancel-in-progress: false
+      queue: max
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      actions: write
+      issues: write
+      pull-requests: read
+    env:
+      LIGHTHOUSE_ISSUE: ${{ matrix.issue }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Reconcile and record one bounded retry
+        id: request
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/worker-maintenance.mjs prepare
+      - name: Preserve request before dispatch
+        if: steps.request.outputs.send == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ steps.request.outputs.artifact }}
+          path: ${{ runner.temp }}/lighthouse-maintenance-${{ github.run_id }}-${{ matrix.issue }}/dispatch.json
+          retention-days: 14
+          if-no-files-found: error
+      - name: Send the recorded retry once
+        if: steps.request.outputs.send == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_DISPATCH_COMMENT: ${{ steps.request.outputs.comment }}
+        run: node src/packages/sdlc/src/worker-maintenance.mjs send
+      - name: Preserve observations
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-maintenance-${{ matrix.issue }}
+          path: ${{ runner.temp }}/lighthouse-maintenance-${{ github.run_id }}-${{ matrix.issue }}/observations.json
+          retention-days: 14
+          if-no-files-found: error
+  report:
+    needs: [scan, reconcile]
+    if: always() && needs.scan.result == 'success' && needs.scan.outputs.issues != '[]' && vars.LIGHTHOUSE_REPORT_INDEX_ISSUE != ''
+    concurrency:
+      group: lighthouse-worker-reports
+      cancel-in-progress: false
+      queue: max
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      actions: read
+      issues: write
+    env:
+      LIGHTHOUSE_REPORT_INDEX_ISSUE: ${{ vars.LIGHTHOUSE_REPORT_INDEX_ISSUE }}
+      LIGHTHOUSE_OBSERVED_ISSUES: ${{ needs.scan.outputs.issues }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: lighthouse-maintenance-*
+          path: ${{ runner.temp }}/worker-observations
+      - name: Reconcile and update worker error reports
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/worker-maintenance.mjs report

package/workflows/shared/lighthouse-opencode.md

@@ -11,10 +11,12 @@ engine:
     execution:
       command-name: node
       args: [tools/src/packages/sdlc/src/opencode-execute.mjs]
-      step-name: Execute OpenCode CLI
+      step-name: OpenCode progress and result
       write-timestamp: true
     log-parser: |
       function parseLog(logContent) {
-        return require("./parse_opencode_log.cjs").parseOpenCodeLog(logContent);
+        const fs = require("fs");
+        const events = require("path").join(process.env.RUNNER_TEMP, "gh-aw", `opencode-events-${process.env.GITHUB_RUN_ID}-${process.env.GITHUB_RUN_ATTEMPT}.jsonl`);
+        return require("./parse_opencode_log.cjs").parseOpenCodeLog(fs.existsSync(events) ? fs.readFileSync(events, "utf8") : logContent);
       }
 ---