@juangcarmona/lighthouse-sdlc 0.12.0 → 0.14.0

package/src/implementation.mjs

@@ -0,0 +1,155 @@
+import { readFile, writeFile, mkdir, readdir, lstat, mkdtemp, rm } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { tmpdir } from 'node:os';
+import { spawnSync, execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { proposalRoot, changeName } from './proposal.mjs';
+import { validateEnvironment } from './execution-environment.mjs';
+
+const hash = value => createHash('sha256').update(value).digest('hex');
+const safePath = path => typeof path === 'string' && path.length < 300 && !path.startsWith('/') && !path.includes('\\') && !path.split('/').some(p => !p || p === '.' || p === '..' || p === '.git');
+const protectedPath = path => /^(?:\.lighthouse|\.agents|\.product|\.git|\.opencode)(?:\/|$)/.test(path) || /(?:^|\/)(?:\.env(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519)$/.test(path) || path.startsWith('.github/') || /(?:^|\/)(?:AGENTS|CLAUDE)\.md$/.test(path);
+export const changesDigest = changes => hash(JSON.stringify(changes));
+export function validateImplementationPolicy(policy, issue) {
+  if (!policy || Object.keys(policy).filter(k => !['seed', 'proposal'].includes(k)).sort().join(',') !== 'checks,paths,reviewRequired,scope' || typeof policy.reviewRequired !== 'boolean' || ('proposal' in policy && (!Number.isSafeInteger(policy.proposal) || policy.proposal < 1)) || typeof policy.scope !== 'string' || !policy.scope.trim() || policy.scope.length > 4000) throw Error('Invalid implementation policy');
+  if (!Array.isArray(policy.paths) || !policy.paths.length || policy.paths.length > 40 || policy.paths.some(p => p !== '*' && (!safePath(p.replace(/\/$/, '')) || protectedPath(p) || p.startsWith('openspec/') && p !== `${proposalRoot(issue)}/tasks.md` && p !== `${proposalRoot(issue)}/` || p.startsWith('.github/') && !/^\.github\/workflows\/[\w-]+\.ya?ml$/.test(p)))) throw Error('Implementation policy needs safe paths');
+  if (!Array.isArray(policy.checks) || !policy.checks.length || policy.checks.length > 12 || policy.checks.some(c => !Array.isArray(c) || !c.length || c.length > 30 || c.some(a => typeof a !== 'string' || !a || a.length > 1000 || /[\0\r\n]/.test(a)))) throw Error('Implementation policy needs bounded command argument arrays');
+  if ('seed' in policy && (!policy.seed || typeof policy.seed !== 'object' || Object.keys(policy.seed).sort().join(',') !== 'base,head' || !/^[a-f0-9]{40}$/.test(policy.seed.base ?? '') || !/^[a-f0-9]{40}$/.test(policy.seed.head ?? ''))) throw Error('Seed must identify immutable base and head commits');
+  return policy;
+}
+export const withinScope = (path, policy) => safePath(path) && !protectedPath(path) && policy.paths.some(p => p === '*' || (p.endsWith('/') ? path.startsWith(p) : path === p));
+
+export async function loadImplementation(api, issue, owner, revision, defaultBranch) {
+  const config = await api(`contents/.lighthouse/implement.json?ref=${revision}`, 'GET', undefined, true);
+  const configured = config ? JSON.parse(Buffer.from(config.content, 'base64').toString()) : {};
+  let policy = configured[issue] ?? configured.defaults;
+  if (!policy) {
+    const manifest = await api(`contents/package.json?ref=${revision}`, 'GET', undefined, true);
+    const pkg = manifest ? JSON.parse(Buffer.from(manifest.content, 'base64').toString()) : {};
+    if (!pkg.scripts?.verify) throw Error('Configure repository implementation checks in .lighthouse/implement.json defaults, or provide npm run verify');
+    policy = { scope: 'Implement only this issue and its acceptance criteria.', paths: ['*'], checks: [['npm', 'ci', '--ignore-scripts'], ['npm', 'run', 'verify']], reviewRequired: false };
+  }
+  const planCheck = ['npx', '--yes', '--package=@fission-ai/openspec@1.15.0', 'openspec', 'validate', changeName(issue), '--strict', '--no-interactive'];
+  policy = validateImplementationPolicy(policy, issue);
+  policy = { ...policy, checks: [...policy.checks, planCheck] };
+  const environmentFile = await api(`contents/.lighthouse/environment.json?ref=${revision}`, 'GET', undefined, true);
+  const environment = environmentFile ? validateEnvironment(JSON.parse(Buffer.from(environmentFile.content, 'base64').toString())) : null;
+  return { policy, proposal: { root: proposalRoot(issue) }, ...(environment ? { environment } : {}) };
+}
+
+// A reviewed immutable seed recovers a failed attempt without updating its branch.
+export async function loadImplementationSeed(api, policy, revision) {
+  if (!policy.seed) return null;
+  const { base, head } = policy.seed;
+  const commit = await api(`git/commits/${head}`);
+  if (commit.parents?.length !== 1 || commit.parents[0].sha !== base) throw Error('Seed must be one commit directly based on the declared revision');
+  const trees = [];
+  for (const sha of [base, head, revision]) {
+    const tree = await api(`git/trees/${sha}?recursive=1`);
+    if (tree.truncated || !Array.isArray(tree.tree) || tree.tree.length > 10000) throw Error('Seed tree exceeds bounds');
+    trees.push(new Map(tree.tree.filter(f => f.type !== 'tree').map(f => [f.path, f])));
+  }
+  const [before, after, current] = trees, changes = [];
+  let bytes = 0;
+  for (const path of [...new Set([...before.keys(), ...after.keys()])].sort()) {
+    const old = before.get(path), next = after.get(path), live = current.get(path);
+    if (old?.sha === next?.sha && old?.mode === next?.mode) continue;
+    if (!withinScope(path, policy) || old?.sha !== live?.sha || old?.mode !== live?.mode) throw Error('Seed conflicts with current source or write scope');
+    if ([old, next].filter(Boolean).some(f => f.type !== 'blob' || !['100644', '100755'].includes(f.mode))) throw Error('Seed contains a link or non-regular change');
+    if (changes.length >= 512) throw Error('Seed exceeds changed-file bound');
+    let content = null;
+    if (next) {
+      const blob = await api(`git/blobs/${next.sha}`);
+      if (blob.encoding !== 'base64' || blob.size > 4 * 1024 * 1024) throw Error('Seed blob exceeds bounds');
+      content = blob.content.replaceAll('\n', '');
+      bytes += Buffer.byteLength(content, 'base64');
+      if (bytes > 16 * 1024 * 1024) throw Error('Seed exceeds byte bounds');
+    }
+    changes.push({ path, mode: next?.mode ?? old.mode, content });
+  }
+  return validateChanges(changes, policy);
+}
+
+// Honor Git ignores for new output without hiding tracked edits or following source links.
+export async function sourceFiles(root, baseline) {
+  const metadata = baseline ? await mkdtemp(join(tmpdir(), 'lighthouse-ignore-')) : null;
+  const gitEnv = { ...process.env, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_COUNT: '0' };
+  if (metadata) execFileSync('git', ['init', '--bare', '-q', metadata], { env: gitEnv });
+  const trackedDirectories = new Set();
+  for (const path of baseline?.keys() ?? []) { let parent = dirname(path); while (parent !== '.') { trackedDirectories.add(parent); parent = dirname(parent); } }
+  const files = new Map(); let bytes = 0;
+  async function visit(dir, relative = '') {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+      if (entry.name === '.git') continue;
+      const path = relative ? `${relative}/${entry.name}` : entry.name, target = join(dir, entry.name);
+      if (metadata && !baseline.has(path) && !trackedDirectories.has(path)) {
+        const ignored = spawnSync('git', ['--git-dir', metadata, '--work-tree', root, 'check-ignore', '--no-index', '-z', '--stdin'], { input: path + '\0', env: gitEnv, timeout: 10000, maxBuffer: 4096 });
+        if (ignored.status === 0) continue;
+        if (ignored.status !== 1) throw Error('Unable to resolve ignored implementation output');
+      }
+      const stat = await lstat(target);
+      if (!safePath(path) || stat.isSymbolicLink() || !stat.isDirectory() && !stat.isFile()) throw Error(`Unsafe implementation file: ${path}`);
+      if (stat.isDirectory()) await visit(target, path);
+      else {
+        bytes += stat.size;
+        if (bytes > 64 * 1024 * 1024 || files.size >= 5000) throw Error('Implementation source exceeds bounds');
+        files.set(path, { content: await readFile(target), mode: stat.mode & 0o111 ? '100755' : '100644' });
+      }
+    }
+  }
+  try { await visit(root); return files; } finally { if (metadata) await rm(metadata, { recursive: true, force: true }); }
+}
+export function collectChanges(before, after, policy) {
+  const changes = [];
+  for (const path of [...new Set([...before.keys(), ...after.keys()])].sort()) {
+    const old = before.get(path), current = after.get(path);
+    if (old && current && old.content.equals(current.content) && old.mode === current.mode) continue;
+    changes.push({ path, mode: current?.mode ?? old?.mode ?? '100644', content: current ? current.content.toString('base64') : null });
+  }
+  return validateChanges(changes, policy);
+}
+export function validateChanges(changes, policy) {
+  if (!Array.isArray(changes) || changes.length > 512) throw Error('Implementation exceeds 512 changed files');
+  const seen = new Set(); let bytes = 0;
+  for (const file of changes) {
+    if (!file || Object.keys(file).sort().join(',') !== 'content,mode,path' || !withinScope(file.path, policy) || seen.has(file.path) || !['100644', '100755'].includes(file.mode) || file.content !== null && (typeof file.content !== 'string' || Buffer.from(file.content, 'base64').toString('base64') !== file.content)) throw Error('Invalid or out-of-scope implementation change');
+    seen.add(file.path);
+    const buffer = Buffer.from(file.content ?? '', 'base64'); bytes += buffer.length;
+    if (buffer.length > 4 * 1024 * 1024 || bytes > 16 * 1024 * 1024) throw Error('Implementation exceeds byte bounds');
+    if (/\b(?:sk-|ghp_|github_pat_)[A-Za-z0-9_-]{15,}|-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----/.test(buffer.toString())) throw Error(`Credential-shaped content rejected in ${file.path}`);
+  }
+  return changes;
+}
+export async function materializeCandidate(before, changes, destination) {
+  const files = new Map(before);
+  for (const file of changes) if (file.content === null) files.delete(file.path); else files.set(file.path, { content: Buffer.from(file.content, 'base64'), mode: file.mode });
+  for (const [path, file] of files) { await mkdir(dirname(join(destination, path)), { recursive: true, mode: 0o777 }); await writeFile(join(destination, path), file.content, { mode: file.mode === '100755' ? 0o777 : 0o666 }); }
+}
+export function validateCheckReceipt(receipt, request, changes) {
+  if (receipt?.runId !== request.runId || receipt.sourceRevision !== request.sourceRevision || receipt.changesDigest !== changesDigest(changes) || !Array.isArray(receipt.checks) || receipt.checks.length !== request.implementation.policy.checks.length) throw Error('Implementation check receipt identity mismatch');
+  for (let i = 0; i < receipt.checks.length; i++) if (JSON.stringify(receipt.checks[i].command) !== JSON.stringify(request.implementation.policy.checks[i]) || !Number.isInteger(receipt.checks[i].exitCode)) throw Error('Implementation check receipt command mismatch');
+  if (request.implementation.environment) {
+    const declaration = validateEnvironment(request.implementation.environment);
+    if (!/^sha256:[a-f0-9]{64}$/.test(receipt.image ?? '') || receipt.environment?.image !== receipt.image || receipt.environment?.profile !== declaration.profile || !Array.isArray(receipt.environment.services) || receipt.environment.services.length !== declaration.services.length || receipt.environment.services.some(s => s.type !== 'postgresql' || !/^sha256:[a-f0-9]{64}$/.test(s.image ?? ''))) throw Error('Implementation environment receipt mismatch');
+  }
+  return receipt.serviceCleanup !== false && receipt.checks.every(c => c.exitCode === 0);
+}
+export async function createImplementationPullRequest(api, snapshot, changes, body, runUrl, draft, beforeWrite) {
+  validateChanges(changes, snapshot.implementation.policy);
+  if (!changes.length) throw Error('No implementation changes to publish');
+  const commit = await api(`git/commits/${snapshot.sourceRevision}`), entries = [];
+  for (const file of changes) {
+    const sha = file.content === null ? null : (await api('git/blobs', 'POST', { content: file.content, encoding: 'base64' })).sha;
+    entries.push({ path: file.path, mode: file.mode, type: 'blob', sha });
+  }
+  const tree = await api('git/trees', 'POST', { base_tree: commit.tree.sha, tree: entries });
+  const created = await api('git/commits', 'POST', { message: `feat: implement issue #${snapshot.issue}`, tree: tree.sha, parents: [snapshot.sourceRevision] });
+  await beforeWrite();
+  if (snapshot.implementationReview) {
+    await api(`git/refs/heads/${snapshot.implementationReview.branch}`, 'PATCH', { sha: created.sha, force: false });
+    return { number: snapshot.implementationReview.number, html_url: snapshot.implementationReview.url, head: { sha: created.sha, ref: snapshot.implementationReview.branch } };
+  }
+  const branch = `lighthouse/implement-${snapshot.issue}-${snapshot.runId.slice(0, 12)}`;
+  await api('git/refs', 'POST', { ref: `refs/heads/${branch}`, sha: created.sha });
+  return api('pulls', 'POST', { title: snapshot.title.slice(0, 180), head: branch, base: snapshot.defaultBranch, draft, body: `${body}\n\nCloses #${snapshot.issue}. Planning artifacts and implementation are reviewed together in this PR.\n\n[Checks, screenshots and retrospective](${runUrl}). Comment here to request changes, or approve when ready.\n\n<!-- lighthouse-implementation:${snapshot.runId} -->` });
+}

package/src/install-workflows.mjs

@@ -3,12 +3,21 @@ import { resolve, join, dirname } from 'node:path';
 import { execFileSync } from 'node:child_process';
 
 const [target, revision, ...flags] = process.argv.slice(2);
-if (!target || !/^[a-f0-9]{40}$/.test(revision ?? '') || flags.some(x => !['--apply', '--replace-reviewed'].includes(x))) throw Error('Usage: install-workflows <repository> <immutable-lighthouse-commit> [--apply] [--replace-reviewed]');
+if (!target || !/^[a-f0-9]{40}$/.test(revision ?? '') || flags.some(x => !['--apply', '--replace-reviewed', '--with-propose', '--with-implement', '--with-completion', '--with-maintenance'].includes(x))) throw Error('Usage: install-workflows <repository> <immutable-lighthouse-commit> [--apply] [--replace-reviewed] [--with-propose] [--with-implement] [--with-completion] [--with-maintenance]');
 const apply = flags.includes('--apply'), replace = flags.includes('--replace-reviewed');
-const files = ['lighthouse-sdlc-router.yml', 'lighthouse-sdlc-refine.md', 'shared/lighthouse-opencode.md'];
+const completion = flags.includes('--with-completion');
+const implement = flags.includes('--with-implement') || completion;
+const propose = flags.includes('--with-propose') || implement;
+const files = [...(flags.includes('--with-maintenance') ? ['lighthouse-worker-maintenance.yml'] : []), 'lighthouse-sdlc-router.yml', 'lighthouse-sdlc-refine.md', 'shared/lighthouse-opencode.md', ...(propose ? ['lighthouse-sdlc-propose.md', 'lighthouse-sdlc-apply-review.md'] : []), ...(implement ? ['lighthouse-sdlc-implement.md'] : []), ...(completion ? ['lighthouse-sdlc-integrate.md', 'lighthouse-sdlc-review.md'] : [])];
 const root = resolve(target), planned = [];
 for (const name of files) {
-  const content = (await readFile(new URL(`../workflows/${name}`, import.meta.url), 'utf8')).replaceAll('__LIGHTHOUSE_REF__', revision);
+  let content = (await readFile(new URL(`../workflows/${name}`, import.meta.url), 'utf8')).replaceAll('__LIGHTHOUSE_REF__', revision);
+  if (name === 'lighthouse-sdlc-router.yml') {
+    const enabled = ['refine', ...(propose ? ['propose'] : []), ...(implement ? ['implement'] : []), ...(completion ? ['integrate', 'review'] : [])];
+    content = content.replace('LIGHTHOUSE_ENABLED_STAGES: refine,propose,implement,integrate,review', `LIGHTHOUSE_ENABLED_STAGES: ${enabled.join(',')}`).replace('options: [refine, propose, implement, integrate, review]', `options: [${enabled.join(', ')}]`);
+    if (!implement) content = content.replace('LIGHTHOUSE_AUTO_IMPLEMENT: true', 'LIGHTHOUSE_AUTO_IMPLEMENT: false');
+    if (!completion) content = content.replaceAll('LIGHTHOUSE_COMPLETION_ENABLED: true', 'LIGHTHOUSE_COMPLETION_ENABLED: false');
+  }
   const path = join(root, '.github/workflows', name);
   const exists = await access(path).then(() => true, () => false);
   if (exists && await readFile(path, 'utf8') !== content && !replace) throw Error(`Existing workflow differs: ${path}; review the diff before --replace-reviewed`);
@@ -19,6 +28,6 @@ if (apply) {
   const compiler = execFileSync('gh', ['aw', '--version'], { encoding: 'utf8' }).trim();
   if (!/\bv?0\.93\.2\b/.test(compiler)) throw Error(`gh-aw v0.93.2 is required; found ${compiler}`);
   for (const { path, content } of planned) { await mkdir(dirname(path), { recursive: true }); await writeFile(path, content); }
-  execFileSync('gh', ['aw', 'compile', 'lighthouse-sdlc-refine'], { cwd: root, stdio: 'inherit' });
+  for (const stage of completion ? ['refine', 'propose', 'implement', 'integrate', 'review', 'apply-review'] : implement ? ['refine', 'propose', 'implement', 'apply-review'] : propose ? ['refine', 'propose', 'apply-review'] : ['refine']) execFileSync('gh', ['aw', 'compile', `lighthouse-sdlc-${stage}`], { cwd: root, stdio: 'inherit' });
 }
-console.log('Enabled worker: refine. Enable LIGHTHOUSE_AUTOMATION_ENABLED only after provisioning and reviewing the runner. Unselected workflows are never installed or deleted implicitly.');
+console.log(`Enabled workers: ${completion ? 'refine, propose, implement, integrate, review, apply-review' : implement ? 'refine, propose, implement, apply-review' : propose ? 'refine, propose, apply-review' : 'refine'}. Enable LIGHTHOUSE_AUTOMATION_ENABLED only after provisioning and reviewing the runner. Unselected workflows are never installed or deleted implicitly.`);

package/src/integration-evidence.mjs

@@ -0,0 +1,80 @@
+import { verifyDispatchOrigin, stagePath } from './stage-dispatch.mjs';
+import { authorizeCompletion } from './completion.mjs';
+import { createHash } from 'node:crypto';
+import { fingerprint, sha } from './completion.mjs';
+import { validateEvidenceRecord, validateEvidenceIndex } from './evidence.mjs';
+
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+
+// Read retained integration evidence, not bot prose or the current review's future publication.
+export async function readIntegrationEvidence(api, completion, pinned = null) {
+  const binding = completion.binding, owner = binding.repository.split('/')[0];
+  if (!completion.merged) return null;
+  const commit = pinned?.commit ?? (await api(`git/ref/heads/${completion.profile.evidenceBranch}`)).object.sha;
+  if (!sha(commit)) throw Error('Invalid retained evidence commit');
+  const tree = await api(`git/trees/${commit}?recursive=1`);
+  if (tree.truncated || tree.tree.length > 10000) throw Error('Retained evidence tree exceeds bounds');
+  const paths = new Map(tree.tree.map(f => [f.path, f]));
+  let bytes = 0;
+  const read = async path => {
+    const entry = paths.get(path);
+    if (entry?.type !== 'blob' || entry.mode !== '100644') throw Error('Retained evidence must be a regular file');
+    const parts = path.split('/');
+    for (let i = 1; i < parts.length; i++) if (paths.get(parts.slice(0, i).join('/'))?.type !== 'tree') throw Error('Invalid retained evidence ancestor');
+    const blob = await api(`git/blobs/${entry.sha}`);
+    if (blob.encoding !== 'base64' || blob.size > 1024 * 1024) throw Error('Retained evidence blob exceeds bounds');
+    const content = Buffer.from(blob.content, 'base64'); bytes += content.length;
+    if (content.length !== blob.size || bytes > 4 * 1024 * 1024 || createHash('sha1').update(`blob ${content.length}\0`).update(content).digest('hex') !== entry.sha) throw Error('Retained evidence bytes do not match GitHub identity or bounds');
+    return content.toString();
+  };
+  const pattern = new RegExp(`^docs/process/\\d{8}-${binding.issue}-[a-z0-9-]+/runs/[1-9][0-9]*/attempt-[0-9]+/post-integration/evidence-record\\.json$`);
+  const candidates = [...paths.keys()].filter(p => pattern.test(p) && (!pinned || p === pinned.path)).sort().reverse();
+  if (candidates.length > 100) throw Error('Too many retained integration candidates');
+  for (const path of candidates) {
+    const raw = await read(path), record = JSON.parse(raw), payload = record.payload;
+    if (payload?.stage !== 'integrate' || record.status !== 'passed') continue;
+    if (['repository', 'issue', 'pr', 'head', 'intent', 'policy', 'prIntent', 'files'].some(k => payload.binding?.[k] !== binding[k])) continue;
+    if (validateEvidenceRecord(record).length) throw Error('Invalid retained integration record');
+    const prefix = path.slice(0, -'evidence-record.json'.length), index = JSON.parse(await read(prefix + 'evidence-index.json'));
+    if (validateEvidenceIndex(index).length || index.repository !== binding.repository || index.revision !== completion.merge || !index.records.some(r => r.id === record.id && r.path === 'evidence-record.json' && r.sha256 === digest(raw))) throw Error('Retained integration index does not bind the record');
+    const names = ['receipt.json', 'stage-result.json', 'report.md', 'retrospective.md'], files = {};
+    if (record.artifacts.length !== names.length) throw Error('Incomplete retained integration artifacts');
+    for (const name of names) {
+      const artifact = record.artifacts.find(a => a.path === name);
+      files[name] = await read(prefix + name);
+      if (!artifact || artifact.sha256 !== digest(files[name])) throw Error('Retained integration artifact hash mismatch');
+    }
+    const receipt = JSON.parse(files['receipt.json']), result = JSON.parse(files['stage-result.json']);
+    if (fingerprint(receipt) !== fingerprint(payload.receipt) || receipt.state !== 'merged' || receipt.sha !== completion.merge || receipt.acceptedHead !== binding.head || receipt.authorization?.merge !== true || receipt.authorization.head !== binding.head || receipt.authorization.issue !== binding.issue || receipt.authorization.pr !== binding.pr || result.stage !== 'integrate' || result.status !== 'passed') throw Error('Retained integration receipt does not match the accepted delivery');
+    const workflow = payload.workflow;
+    if (!/^[1-9][0-9]*$/.test(workflow?.runId ?? '') || !/^[1-9][0-9]*$/.test(workflow?.attempt ?? '')) throw Error('Invalid retained workflow identity');
+    if (!path.includes(`/runs/${workflow.runId}/attempt-${String(workflow.attempt).padStart(4, '0')}/`)) throw Error('Retained workflow identity differs from its path');
+    const run = await api(`actions/runs/${workflow.runId}`);
+    let originEvent, originName;
+    if (workflow.dispatchOrigin) {
+      const origin = workflow.dispatchOrigin;
+      const parent = await api(`actions/runs/${origin.receipt.routerRunId}/attempts/${origin.receipt.routerAttempt}`);
+      verifyDispatchOrigin(origin.request, origin.receipt, parent, run, binding.repository, owner, binding.issue);
+      if (origin.request.stage !== 'integrate' || origin.request.sourceRevision !== payload.binding.base || String(origin.receipt.workerRunId) !== String(run.id)) throw Error('Retained integration dispatch mismatch');
+      originEvent = origin.request.event; originName = origin.request.eventName;
+    }
+    let manual = run.event === 'workflow_dispatch' && run.actor?.login === owner && run.triggering_actor?.login === owner && run.head_sha === payload.binding.base;
+    if (originEvent) {
+      manual = false;
+      if (originName === 'workflow_dispatch' && !originEvent.inputs?.after_run) {
+        const authorization = authorizeCompletion(originEvent, { GITHUB_EVENT_NAME: originName, GITHUB_ACTOR: owner, GITHUB_TRIGGERING_ACTOR: owner, GITHUB_REPOSITORY_OWNER: owner }, 'integrate');
+        manual = authorization.merge && authorization.issue === binding.issue && authorization.pr === binding.pr && authorization.head === binding.head;
+      }
+    }
+    let approved = false;
+    const approval = receipt.authorization.approval;
+    if ((['pull_request_review', 'workflow_run'].includes(originName ?? run.event) || originEvent?.inputs?.after_run) && approval?.owner === owner && approval.head === binding.head && Number.isSafeInteger(approval.id)) {
+      const review = await api(`pulls/${binding.pr}/reviews/${approval.id}`);
+      approved = review.user?.login === owner && review.state === 'APPROVED' && review.commit_id === binding.head;
+    }
+    if (run.repository?.full_name !== binding.repository || !(manual || approved) || run.path !== (workflow.dispatchOrigin ? stagePath('integrate') : '.github/workflows/lighthouse-sdlc-router.yml') || String(run.run_attempt) !== String(workflow.attempt) || run.status !== 'completed' || run.conclusion !== 'success') throw Error('Retained integration workflow is not authenticated and successful');
+    return { evidenceId: `integration:${workflow.runId}:${workflow.attempt}`, commit, path, recordSha256: digest(raw), url: `https://github.com/${binding.repository}/blob/${commit}/${prefix}report.md`, receipt, workflow: { ...workflow, conclusion: run.conclusion, actor: run.actor.login }, report: files['report.md'] };
+  }
+  if (pinned) throw Error('Previously supplied integration evidence is unavailable or stale');
+  return null;
+}