@juangcarmona/lighthouse-sdlc 0.13.0 → 0.14.0

package/src/implementation-runtime.mjs

@@ -1,7 +1,8 @@
 import { chmod, mkdir, writeFile, readdir, lstat, copyFile } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
-import { spawn } from 'node:child_process';
+import { spawn, execFileSync } from 'node:child_process';
 import { changesDigest } from './implementation.mjs';
+import { startEnvironment, environmentArgs, environmentReceipt, redactEnvironmentLog } from './execution-environment.mjs';
 
 export async function writableTree(root) {
   await chmod(root, 0o777);
@@ -12,6 +13,23 @@ export async function writableTree(root) {
     else throw Error('Workspace must contain regular files only');
   }
 }
+export async function prepareWorkspace(root, config) {
+  await writableTree(root);
+  // npm workspaces chmod linked executables; write permission alone is insufficient.
+  execFileSync('docker', ['run', '--rm', '--network', 'none', '--user', '0:0', '--cap-drop', 'ALL', '--cap-add', 'CHOWN', '--security-opt', 'no-new-privileges', '--read-only', '--mount', `type=bind,src=${root},dst=/workspace`, '--entrypoint', 'chown', config.image, '-R', `${config.uid}:${config.uid}`, '/workspace'], { stdio: 'inherit', timeout: 30000 });
+}
+export async function prepareImplementationWorkspace(workspace, config) {
+  await writableTree(workspace);
+  // Candidate-only Git metadata supports repository checks without copying checkout credentials or hooks.
+  await mkdir(join(workspace, '.git'));
+  const git = args => execFileSync('git', ['-C', workspace, '-c', 'core.hooksPath=/dev/null', ...args], {
+    env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_AUTHOR_NAME: 'Lighthouse validation', GIT_AUTHOR_EMAIL: 'validation@localhost', GIT_COMMITTER_NAME: 'Lighthouse validation', GIT_COMMITTER_EMAIL: 'validation@localhost' }, stdio: 'pipe',
+  });
+  git(['init', '--template=', '--initial-branch=validation']);
+  git(['add', '--force', '--all']);
+  git(['commit', '--allow-empty', '-m', 'Candidate snapshot; repository history is checked separately']);
+  await prepareWorkspace(workspace, config);
+}
 export async function copyEvidence(source, destination) {
   let bytes = 0, count = 0;
   async function visit(dir, relative = '') {
@@ -29,38 +47,44 @@ export async function copyEvidence(source, destination) {
   try { await lstat(source); } catch (error) { if (error.code === 'ENOENT') return; throw error; }
   await visit(source);
 }
-export async function runImplementationChecks({ config, request, changes, workspace, output, name, redact, cancelled }) {
-  await writableTree(workspace);
-  const receipt = { runId: request.runId, sourceRevision: request.sourceRevision, changesDigest: changesDigest(changes), checks: [] };
+export async function runImplementationChecks({ config, request, changes, workspace, output, name, redact, cancelled, selected = null }) {
+  await prepareImplementationWorkspace(workspace, config);
+  const receipt = { runId: request.runId, sourceRevision: request.sourceRevision, changesDigest: changesDigest(changes), image: config.image, environment: environmentReceipt(selected), checks: [] };
   const deadline = Date.now() + 600000;
   await mkdir(output, { recursive: true });
-  for (let i = 0; i < request.implementation.policy.checks.length; i++) {
-    const command = request.implementation.policy.checks[i];
-    const remaining = deadline - Date.now();
-    if (cancelled() || remaining <= 0) { receipt.checks.push({ command, exitCode: 124 }); continue; }
-    console.log(`Host check ${i + 1}: ${command.join(' ')}`);
-    let log = '', pending = '';
-    const args = ['run', '--rm', '--init', '--name', `${name}-checks`, '--user', `${config.uid}:${config.uid}`, '--cpus', '2', '--memory', '4g', '--pids-limit', '256', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', '--read-only', '--tmpfs', '/tmp:rw,size=1g,mode=1777', '--env', 'HOME=/tmp', '--env', 'CI=true', '--env', 'PLAYWRIGHT_BROWSERS_PATH=/workspace/.cache/ms-playwright', '--mount', `type=bind,src=${workspace},dst=/workspace`, '--workdir', '/workspace', '--entrypoint', command[0], config.image, ...command.slice(1)];
-    const exitCode = await new Promise(resolve => {
-      const child = spawn('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] });
-      const timer = setTimeout(() => { child.kill('SIGTERM'); spawn('docker', ['rm', '-f', `${name}-checks`], { stdio: 'ignore' }); }, remaining);
-      const consume = chunk => {
-        pending += chunk;
-        let end;
-        while ((end = pending.indexOf('\n')) >= 0) {
-          const line = redact(pending.slice(0, end)); pending = pending.slice(end + 1);
-          if (log.length < 512000) { log += line + '\n'; console.log(`[Check] ${line.slice(0, 1000)}`); }
-        }
-        if (pending.length > 65536) pending = '[oversized check log line omitted]\n';
-      };
-      for (const stream of [child.stdout, child.stderr]) { stream.setEncoding('utf8'); stream.on('data', consume); }
-      child.on('error', () => { clearTimeout(timer); resolve(127); });
-      child.on('close', code => { clearTimeout(timer); resolve(code ?? 124); });
-    });
-    log += redact(pending).slice(0, 65536);
-    await writeFile(join(output, `check-${i + 1}.log`), log);
-    receipt.checks.push({ command, exitCode });
-    console.log(`Host check ${i + 1} exit: ${exitCode}`);
-  }
+  const runtime = await startEnvironment({ selected, name: `${name}-validation`, uid: config.uid });
+  const originalRedact = redact;
+  redact = text => originalRedact(redactEnvironmentLog(runtime, text));
+  try {
+    for (let i = 0; i < request.implementation.policy.checks.length; i++) {
+      const command = request.implementation.policy.checks[i];
+      const remaining = deadline - Date.now();
+      if (cancelled() || remaining <= 0) { receipt.checks.push({ command, exitCode: 124 }); continue; }
+      console.log(`Host check ${i + 1}: ${command.join(' ')}`);
+      let log = '', pending = '';
+      const args = ['run', '--rm', '--init', '--name', `${name}-checks`, '--user', `${config.uid}:${config.uid}`, '--cpus', '2', '--memory', '4g', '--pids-limit', '256', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', '--read-only', '--tmpfs', '/tmp:rw,exec,size=1g,mode=1777', '--env', 'HOME=/tmp', '--env', 'CI=true', '--env', 'PLAYWRIGHT_BROWSERS_PATH=/workspace/.cache/ms-playwright', ...environmentArgs(runtime), '--mount', `type=bind,src=${workspace},dst=/workspace`, '--workdir', '/workspace', '--entrypoint', command[0], config.image, ...command.slice(1)];
+      const exitCode = await new Promise(resolve => {
+        const child = spawn('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        const timer = setTimeout(() => { child.kill('SIGTERM'); spawn('docker', ['rm', '-f', `${name}-checks`], { stdio: 'ignore' }); }, remaining);
+        const consume = chunk => {
+          pending += chunk;
+          let end;
+          while ((end = pending.indexOf('\n')) >= 0) {
+            const line = redact(pending.slice(0, end)); pending = pending.slice(end + 1);
+            if (log.length < 512000) { log += line + '\n'; console.log(`[Check] ${line.slice(0, 1000)}`); }
+          }
+          if (pending.length > 65536) pending = '[oversized check log line omitted]\n';
+        };
+        for (const stream of [child.stdout, child.stderr]) { stream.setEncoding('utf8'); stream.on('data', consume); }
+        child.on('error', () => { clearTimeout(timer); resolve(127); });
+        child.on('close', code => { clearTimeout(timer); resolve(code ?? 124); });
+      });
+      log += redact(pending).slice(0, 65536);
+      await writeFile(join(output, `check-${i + 1}.log`), log);
+      receipt.checks.push({ command, exitCode });
+      console.log(`Host check ${i + 1} exit: ${exitCode}`);
+    }
+  } finally { receipt.serviceCleanup = runtime.cleanup() !== false; }
+  if (!receipt.serviceCleanup && receipt.checks.length) { receipt.checks.at(-1).exitCode = 1; receipt.checks.at(-1).reason = 'Environment cleanup failed; operator cleanup required'; }
   return receipt;
 }

package/src/implementation.mjs

@@ -3,34 +3,38 @@ import { join, dirname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { spawnSync, execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { proposalRoot } from './proposal.mjs';
+import { proposalRoot, changeName } from './proposal.mjs';
+import { validateEnvironment } from './execution-environment.mjs';
 
 const hash = value => createHash('sha256').update(value).digest('hex');
 const safePath = path => typeof path === 'string' && path.length < 300 && !path.startsWith('/') && !path.includes('\\') && !path.split('/').some(p => !p || p === '.' || p === '..' || p === '.git');
-const protectedPath = path => /^(?:\.lighthouse|\.agents|\.product)(?:\/|$)/.test(path) || /(?:^|\/)(?:\.env(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519)$/.test(path) || path.startsWith('.github/');
+const protectedPath = path => /^(?:\.lighthouse|\.agents|\.product|\.git|\.opencode)(?:\/|$)/.test(path) || /(?:^|\/)(?:\.env(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519)$/.test(path) || path.startsWith('.github/') || /(?:^|\/)(?:AGENTS|CLAUDE)\.md$/.test(path);
 export const changesDigest = changes => hash(JSON.stringify(changes));
 export function validateImplementationPolicy(policy, issue) {
-  if (!policy || Object.keys(policy).filter(k => k !== 'seed').sort().join(',') !== 'checks,paths,proposal,reviewRequired,scope' || typeof policy.reviewRequired !== 'boolean' || !Number.isSafeInteger(policy.proposal) || policy.proposal < 1 || typeof policy.scope !== 'string' || !policy.scope.trim() || policy.scope.length > 4000) throw Error('Invalid implementation policy');
-  if (!Array.isArray(policy.paths) || !policy.paths.length || policy.paths.length > 40 || policy.paths.some(p => !safePath(p.replace(/\/$/, '')) || protectedPath(p) || p.startsWith('openspec/') && p !== `${proposalRoot(issue)}/tasks.md` || p.startsWith('.github/') && !/^\.github\/workflows\/[\w-]+\.ya?ml$/.test(p))) throw Error('Implementation policy needs explicit safe paths; only this proposal tasks file may change');
+  if (!policy || Object.keys(policy).filter(k => !['seed', 'proposal'].includes(k)).sort().join(',') !== 'checks,paths,reviewRequired,scope' || typeof policy.reviewRequired !== 'boolean' || ('proposal' in policy && (!Number.isSafeInteger(policy.proposal) || policy.proposal < 1)) || typeof policy.scope !== 'string' || !policy.scope.trim() || policy.scope.length > 4000) throw Error('Invalid implementation policy');
+  if (!Array.isArray(policy.paths) || !policy.paths.length || policy.paths.length > 40 || policy.paths.some(p => p !== '*' && (!safePath(p.replace(/\/$/, '')) || protectedPath(p) || p.startsWith('openspec/') && p !== `${proposalRoot(issue)}/tasks.md` && p !== `${proposalRoot(issue)}/` || p.startsWith('.github/') && !/^\.github\/workflows\/[\w-]+\.ya?ml$/.test(p)))) throw Error('Implementation policy needs safe paths');
   if (!Array.isArray(policy.checks) || !policy.checks.length || policy.checks.length > 12 || policy.checks.some(c => !Array.isArray(c) || !c.length || c.length > 30 || c.some(a => typeof a !== 'string' || !a || a.length > 1000 || /[\0\r\n]/.test(a)))) throw Error('Implementation policy needs bounded command argument arrays');
   if ('seed' in policy && (!policy.seed || typeof policy.seed !== 'object' || Object.keys(policy.seed).sort().join(',') !== 'base,head' || !/^[a-f0-9]{40}$/.test(policy.seed.base ?? '') || !/^[a-f0-9]{40}$/.test(policy.seed.head ?? ''))) throw Error('Seed must identify immutable base and head commits');
   return policy;
 }
-export const withinScope = (path, policy) => safePath(path) && !protectedPath(path) && policy.paths.some(p => p.endsWith('/') ? path.startsWith(p) : path === p);
+export const withinScope = (path, policy) => safePath(path) && !protectedPath(path) && policy.paths.some(p => p === '*' || (p.endsWith('/') ? path.startsWith(p) : path === p));
 
 export async function loadImplementation(api, issue, owner, revision, defaultBranch) {
-  const config = await api(`contents/.lighthouse/implement.json?ref=${revision}`);
-  const policy = validateImplementationPolicy(JSON.parse(Buffer.from(config.content, 'base64').toString())[issue], issue);
-  const pr = await api(`pulls/${policy.proposal}`);
-  if (!pr.merged || pr.merged_by?.login !== owner || pr.base.ref !== defaultBranch || pr.base.repo.full_name !== pr.head.repo?.full_name) throw Error('Implementation requires a proposal merged by the repository owner');
-  const files = await api(`pulls/${policy.proposal}/files?per_page=100`);
-  if (files.length !== pr.changed_files || files.length < 4 || files.length > 24 || files.some(f => !f.filename.startsWith(`${proposalRoot(issue)}/`) || f.status !== 'added')) throw Error('Proposal must contain only the added OpenSpec change');
-  for (const required of ['proposal.md', 'design.md', 'tasks.md']) if (!files.some(f => f.filename === `${proposalRoot(issue)}/${required}`)) throw Error('Incomplete approved proposal');
-  for (const file of files) {
-    const current = await api(`contents/${file.filename}?ref=${revision}`);
-    if (current.sha !== file.sha) throw Error('Approved proposal changed; review a new proposal before implementation');
+  const config = await api(`contents/.lighthouse/implement.json?ref=${revision}`, 'GET', undefined, true);
+  const configured = config ? JSON.parse(Buffer.from(config.content, 'base64').toString()) : {};
+  let policy = configured[issue] ?? configured.defaults;
+  if (!policy) {
+    const manifest = await api(`contents/package.json?ref=${revision}`, 'GET', undefined, true);
+    const pkg = manifest ? JSON.parse(Buffer.from(manifest.content, 'base64').toString()) : {};
+    if (!pkg.scripts?.verify) throw Error('Configure repository implementation checks in .lighthouse/implement.json defaults, or provide npm run verify');
+    policy = { scope: 'Implement only this issue and its acceptance criteria.', paths: ['*'], checks: [['npm', 'ci', '--ignore-scripts'], ['npm', 'run', 'verify']], reviewRequired: false };
   }
-  return { policy, proposal: { number: pr.number, url: pr.html_url, head: pr.head.sha, merge: pr.merge_commit_sha, root: proposalRoot(issue) } };
+  const planCheck = ['npx', '--yes', '--package=@fission-ai/openspec@1.15.0', 'openspec', 'validate', changeName(issue), '--strict', '--no-interactive'];
+  policy = validateImplementationPolicy(policy, issue);
+  policy = { ...policy, checks: [...policy.checks, planCheck] };
+  const environmentFile = await api(`contents/.lighthouse/environment.json?ref=${revision}`, 'GET', undefined, true);
+  const environment = environmentFile ? validateEnvironment(JSON.parse(Buffer.from(environmentFile.content, 'base64').toString())) : null;
+  return { policy, proposal: { root: proposalRoot(issue) }, ...(environment ? { environment } : {}) };
 }
 
 // A reviewed immutable seed recovers a failed attempt without updating its branch.
@@ -112,7 +116,7 @@ export function validateChanges(changes, policy) {
     seen.add(file.path);
     const buffer = Buffer.from(file.content ?? '', 'base64'); bytes += buffer.length;
     if (buffer.length > 4 * 1024 * 1024 || bytes > 16 * 1024 * 1024) throw Error('Implementation exceeds byte bounds');
-    if (/\b(?:sk-|ghp_|github_pat_)[A-Za-z0-9_-]{15,}|-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----/.test(buffer.toString())) throw Error('Credential-shaped content rejected');
+    if (/\b(?:sk-|ghp_|github_pat_)[A-Za-z0-9_-]{15,}|-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----/.test(buffer.toString())) throw Error(`Credential-shaped content rejected in ${file.path}`);
   }
   return changes;
 }
@@ -124,7 +128,11 @@ export async function materializeCandidate(before, changes, destination) {
 export function validateCheckReceipt(receipt, request, changes) {
   if (receipt?.runId !== request.runId || receipt.sourceRevision !== request.sourceRevision || receipt.changesDigest !== changesDigest(changes) || !Array.isArray(receipt.checks) || receipt.checks.length !== request.implementation.policy.checks.length) throw Error('Implementation check receipt identity mismatch');
   for (let i = 0; i < receipt.checks.length; i++) if (JSON.stringify(receipt.checks[i].command) !== JSON.stringify(request.implementation.policy.checks[i]) || !Number.isInteger(receipt.checks[i].exitCode)) throw Error('Implementation check receipt command mismatch');
-  return receipt.checks.every(c => c.exitCode === 0);
+  if (request.implementation.environment) {
+    const declaration = validateEnvironment(request.implementation.environment);
+    if (!/^sha256:[a-f0-9]{64}$/.test(receipt.image ?? '') || receipt.environment?.image !== receipt.image || receipt.environment?.profile !== declaration.profile || !Array.isArray(receipt.environment.services) || receipt.environment.services.length !== declaration.services.length || receipt.environment.services.some(s => s.type !== 'postgresql' || !/^sha256:[a-f0-9]{64}$/.test(s.image ?? ''))) throw Error('Implementation environment receipt mismatch');
+  }
+  return receipt.serviceCleanup !== false && receipt.checks.every(c => c.exitCode === 0);
 }
 export async function createImplementationPullRequest(api, snapshot, changes, body, runUrl, draft, beforeWrite) {
   validateChanges(changes, snapshot.implementation.policy);
@@ -137,7 +145,11 @@ export async function createImplementationPullRequest(api, snapshot, changes, bo
   const tree = await api('git/trees', 'POST', { base_tree: commit.tree.sha, tree: entries });
   const created = await api('git/commits', 'POST', { message: `feat: implement issue #${snapshot.issue}`, tree: tree.sha, parents: [snapshot.sourceRevision] });
   await beforeWrite();
+  if (snapshot.implementationReview) {
+    await api(`git/refs/heads/${snapshot.implementationReview.branch}`, 'PATCH', { sha: created.sha, force: false });
+    return { number: snapshot.implementationReview.number, html_url: snapshot.implementationReview.url, head: { sha: created.sha, ref: snapshot.implementationReview.branch } };
+  }
   const branch = `lighthouse/implement-${snapshot.issue}-${snapshot.runId.slice(0, 12)}`;
   await api('git/refs', 'POST', { ref: `refs/heads/${branch}`, sha: created.sha });
-  return api('pulls', 'POST', { title: `Implementation for #${snapshot.issue}: ${snapshot.title.slice(0, 140)}`, head: branch, base: snapshot.defaultBranch, draft, body: `${body}\n\nRelated to #${snapshot.issue}. [Approved proposal](${snapshot.implementation.proposal.url}).\n\n[Execution, checks and process evidence](${runUrl}). Download the implementation evidence and OpenCode events artifacts. Review remains required; this workflow never merges or closes the issue.\n\n<!-- lighthouse-implementation:${snapshot.runId} -->` });
+  return api('pulls', 'POST', { title: snapshot.title.slice(0, 180), head: branch, base: snapshot.defaultBranch, draft, body: `${body}\n\nCloses #${snapshot.issue}. Planning artifacts and implementation are reviewed together in this PR.\n\n[Checks, screenshots and retrospective](${runUrl}). Comment here to request changes, or approve when ready.\n\n<!-- lighthouse-implementation:${snapshot.runId} -->` });
 }

package/src/install-workflows.mjs

@@ -3,18 +3,21 @@ import { resolve, join, dirname } from 'node:path';
 import { execFileSync } from 'node:child_process';
 
 const [target, revision, ...flags] = process.argv.slice(2);
-if (!target || !/^[a-f0-9]{40}$/.test(revision ?? '') || flags.some(x => !['--apply', '--replace-reviewed', '--with-propose', '--with-implement', '--with-completion'].includes(x))) throw Error('Usage: install-workflows <repository> <immutable-lighthouse-commit> [--apply] [--replace-reviewed] [--with-propose] [--with-implement] [--with-completion]');
+if (!target || !/^[a-f0-9]{40}$/.test(revision ?? '') || flags.some(x => !['--apply', '--replace-reviewed', '--with-propose', '--with-implement', '--with-completion', '--with-maintenance'].includes(x))) throw Error('Usage: install-workflows <repository> <immutable-lighthouse-commit> [--apply] [--replace-reviewed] [--with-propose] [--with-implement] [--with-completion] [--with-maintenance]');
 const apply = flags.includes('--apply'), replace = flags.includes('--replace-reviewed');
 const completion = flags.includes('--with-completion');
 const implement = flags.includes('--with-implement') || completion;
 const propose = flags.includes('--with-propose') || implement;
-const files = ['lighthouse-sdlc-router.yml', 'lighthouse-sdlc-refine.md', 'shared/lighthouse-opencode.md', ...(propose ? ['lighthouse-sdlc-propose.md'] : []), ...(implement ? ['lighthouse-sdlc-implement.md'] : []), ...(completion ? ['lighthouse-sdlc-integrate.md', 'lighthouse-sdlc-review.md'] : [])];
+const files = [...(flags.includes('--with-maintenance') ? ['lighthouse-worker-maintenance.yml'] : []), 'lighthouse-sdlc-router.yml', 'lighthouse-sdlc-refine.md', 'shared/lighthouse-opencode.md', ...(propose ? ['lighthouse-sdlc-propose.md', 'lighthouse-sdlc-apply-review.md'] : []), ...(implement ? ['lighthouse-sdlc-implement.md'] : []), ...(completion ? ['lighthouse-sdlc-integrate.md', 'lighthouse-sdlc-review.md'] : [])];
 const root = resolve(target), planned = [];
 for (const name of files) {
   let content = (await readFile(new URL(`../workflows/${name}`, import.meta.url), 'utf8')).replaceAll('__LIGHTHOUSE_REF__', revision);
-  if (name === 'lighthouse-sdlc-router.yml' && !completion) content = content.split('  integrate:\n')[0].replace(', integrate, review]', ']').replace(/      pull_request:\n[\s\S]*?(?=permissions:)/, '');
-  if (name === 'lighthouse-sdlc-router.yml' && !implement) content = content.split('  implement:\n')[0].replace(', implement]', ']').replace(" || github.event.label.name == 'implement'", '');
-  if (name === 'lighthouse-sdlc-router.yml' && !propose) content = content.split('  propose:\n')[0].replace('options: [refine, propose]', 'options: [refine]').replace(" || github.event.label.name == 'propose'", '');
+  if (name === 'lighthouse-sdlc-router.yml') {
+    const enabled = ['refine', ...(propose ? ['propose'] : []), ...(implement ? ['implement'] : []), ...(completion ? ['integrate', 'review'] : [])];
+    content = content.replace('LIGHTHOUSE_ENABLED_STAGES: refine,propose,implement,integrate,review', `LIGHTHOUSE_ENABLED_STAGES: ${enabled.join(',')}`).replace('options: [refine, propose, implement, integrate, review]', `options: [${enabled.join(', ')}]`);
+    if (!implement) content = content.replace('LIGHTHOUSE_AUTO_IMPLEMENT: true', 'LIGHTHOUSE_AUTO_IMPLEMENT: false');
+    if (!completion) content = content.replaceAll('LIGHTHOUSE_COMPLETION_ENABLED: true', 'LIGHTHOUSE_COMPLETION_ENABLED: false');
+  }
   const path = join(root, '.github/workflows', name);
   const exists = await access(path).then(() => true, () => false);
   if (exists && await readFile(path, 'utf8') !== content && !replace) throw Error(`Existing workflow differs: ${path}; review the diff before --replace-reviewed`);
@@ -25,6 +28,6 @@ if (apply) {
   const compiler = execFileSync('gh', ['aw', '--version'], { encoding: 'utf8' }).trim();
   if (!/\bv?0\.93\.2\b/.test(compiler)) throw Error(`gh-aw v0.93.2 is required; found ${compiler}`);
   for (const { path, content } of planned) { await mkdir(dirname(path), { recursive: true }); await writeFile(path, content); }
-  for (const stage of completion ? ['refine', 'propose', 'implement', 'integrate', 'review'] : implement ? ['refine', 'propose', 'implement'] : propose ? ['refine', 'propose'] : ['refine']) execFileSync('gh', ['aw', 'compile', `lighthouse-sdlc-${stage}`], { cwd: root, stdio: 'inherit' });
+  for (const stage of completion ? ['refine', 'propose', 'implement', 'integrate', 'review', 'apply-review'] : implement ? ['refine', 'propose', 'implement', 'apply-review'] : propose ? ['refine', 'propose', 'apply-review'] : ['refine']) execFileSync('gh', ['aw', 'compile', `lighthouse-sdlc-${stage}`], { cwd: root, stdio: 'inherit' });
 }
-console.log(`Enabled workers: ${completion ? 'refine, propose, implement, integrate, review' : implement ? 'refine, propose, implement' : propose ? 'refine, propose' : 'refine'}. Enable LIGHTHOUSE_AUTOMATION_ENABLED only after provisioning and reviewing the runner. Unselected workflows are never installed or deleted implicitly.`);
+console.log(`Enabled workers: ${completion ? 'refine, propose, implement, integrate, review, apply-review' : implement ? 'refine, propose, implement, apply-review' : propose ? 'refine, propose, apply-review' : 'refine'}. Enable LIGHTHOUSE_AUTOMATION_ENABLED only after provisioning and reviewing the runner. Unselected workflows are never installed or deleted implicitly.`);

package/src/integration-evidence.mjs

@@ -1,3 +1,5 @@
+import { verifyDispatchOrigin, stagePath } from './stage-dispatch.mjs';
+import { authorizeCompletion } from './completion.mjs';
 import { createHash } from 'node:crypto';
 import { fingerprint, sha } from './completion.mjs';
 import { validateEvidenceRecord, validateEvidenceIndex } from './evidence.mjs';
@@ -48,7 +50,29 @@ export async function readIntegrationEvidence(api, completion, pinned = null) {
     if (!/^[1-9][0-9]*$/.test(workflow?.runId ?? '') || !/^[1-9][0-9]*$/.test(workflow?.attempt ?? '')) throw Error('Invalid retained workflow identity');
     if (!path.includes(`/runs/${workflow.runId}/attempt-${String(workflow.attempt).padStart(4, '0')}/`)) throw Error('Retained workflow identity differs from its path');
     const run = await api(`actions/runs/${workflow.runId}`);
-    if (run.repository?.full_name !== binding.repository || run.event !== 'workflow_dispatch' || run.path !== '.github/workflows/lighthouse-sdlc-router.yml' || run.actor?.login !== owner || run.triggering_actor?.login !== owner || run.head_sha !== payload.binding.base || String(run.run_attempt) !== String(workflow.attempt) || run.status !== 'completed' || run.conclusion !== 'success') throw Error('Retained integration workflow is not authenticated and successful');
+    let originEvent, originName;
+    if (workflow.dispatchOrigin) {
+      const origin = workflow.dispatchOrigin;
+      const parent = await api(`actions/runs/${origin.receipt.routerRunId}/attempts/${origin.receipt.routerAttempt}`);
+      verifyDispatchOrigin(origin.request, origin.receipt, parent, run, binding.repository, owner, binding.issue);
+      if (origin.request.stage !== 'integrate' || origin.request.sourceRevision !== payload.binding.base || String(origin.receipt.workerRunId) !== String(run.id)) throw Error('Retained integration dispatch mismatch');
+      originEvent = origin.request.event; originName = origin.request.eventName;
+    }
+    let manual = run.event === 'workflow_dispatch' && run.actor?.login === owner && run.triggering_actor?.login === owner && run.head_sha === payload.binding.base;
+    if (originEvent) {
+      manual = false;
+      if (originName === 'workflow_dispatch' && !originEvent.inputs?.after_run) {
+        const authorization = authorizeCompletion(originEvent, { GITHUB_EVENT_NAME: originName, GITHUB_ACTOR: owner, GITHUB_TRIGGERING_ACTOR: owner, GITHUB_REPOSITORY_OWNER: owner }, 'integrate');
+        manual = authorization.merge && authorization.issue === binding.issue && authorization.pr === binding.pr && authorization.head === binding.head;
+      }
+    }
+    let approved = false;
+    const approval = receipt.authorization.approval;
+    if ((['pull_request_review', 'workflow_run'].includes(originName ?? run.event) || originEvent?.inputs?.after_run) && approval?.owner === owner && approval.head === binding.head && Number.isSafeInteger(approval.id)) {
+      const review = await api(`pulls/${binding.pr}/reviews/${approval.id}`);
+      approved = review.user?.login === owner && review.state === 'APPROVED' && review.commit_id === binding.head;
+    }
+    if (run.repository?.full_name !== binding.repository || !(manual || approved) || run.path !== (workflow.dispatchOrigin ? stagePath('integrate') : '.github/workflows/lighthouse-sdlc-router.yml') || String(run.run_attempt) !== String(workflow.attempt) || run.status !== 'completed' || run.conclusion !== 'success') throw Error('Retained integration workflow is not authenticated and successful');
     return { evidenceId: `integration:${workflow.runId}:${workflow.attempt}`, commit, path, recordSha256: digest(raw), url: `https://github.com/${binding.repository}/blob/${commit}/${prefix}report.md`, receipt, workflow: { ...workflow, conclusion: run.conclusion, actor: run.actor.login }, report: files['report.md'] };
   }
   if (pinned) throw Error('Previously supplied integration evidence is unavailable or stale');