@juangcarmona/lighthouse-sdlc 0.13.0 → 0.14.0

package/workflows/lighthouse-sdlc-implement.md

@@ -1,17 +1,35 @@
 ---
 # Owned by lighthouse-sdlc. Regenerate the lock with gh aw v0.93.2.
 name: Lighthouse SDLC implement
-description: Implement an owner-approved proposal in an isolated workspace and deliver a reviewable PR.
+description: Plan and implement an authorized issue in an isolated workspace and deliver a reviewable PR.
+run-name: "implement #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
+concurrency:
+  group: lighthouse-issue-${{ inputs.issue }}
+  cancel-in-progress: false
+  queue: max
+  job-discriminator: ${{ github.run_id }}
 on:
-  workflow_call:
+  # The required preparation job authenticates the originating owner request.
+  roles: all
+  workflow_dispatch:
     inputs:
       issue:
+        description: Source issue
+        required: true
+        type: string
+      dispatch-request:
+        description: Authenticated router receipt comment ID
         required: true
         type: string
   needs: [prepare]
+if: needs.prepare.outputs.eligible == 'true'
 runs-on: [self-hosted, linux, lighthouse-workflow]
 runs-on-slim: ubuntu-24.04
 timeout-minutes: 55
+env:
+  LIGHTHOUSE_RECOVERY_ENABLED: ${{ vars.LIGHTHOUSE_RECOVERY_ENABLED }}
+  LIGHTHOUSE_STAGE: implement
+  LIGHTHOUSE_DISPATCH_REQUIRED: "true"
 permissions:
   contents: read
 engine:
@@ -44,6 +62,7 @@ steps:
     uses: actions/checkout@v5
     with:
       persist-credentials: false
+      ref: ${{ needs.prepare.outputs.source_revision }}
   - name: Load the pinned harness package
     uses: actions/checkout@v5
     with:
@@ -54,7 +73,7 @@ steps:
   - name: Load the authorized issue context
     uses: actions/download-artifact@v8
     with:
-      name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+      name: lighthouse-implement-input-${{ inputs.issue }}-${{ github.run_attempt }}
       path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
 post-steps:
   - name: Validate the Lighthouse result
@@ -63,7 +82,7 @@ post-steps:
     if: always()
     uses: actions/upload-artifact@v7
     with:
-      name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+      name: lighthouse-implement-result-${{ inputs.issue }}-${{ github.run_attempt }}
       path: |
         ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/envelope.json
         ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/runtime.json
@@ -83,12 +102,15 @@ post-steps:
     if: always()
     uses: actions/upload-artifact@v7
     with:
-      name: opencode-events-${{ inputs.issue }}-${{ github.run_attempt }}
+      name: opencode-implement-events-${{ inputs.issue }}-${{ github.run_attempt }}
       path: ${{ runner.temp }}/gh-aw/opencode-events-${{ github.run_id }}-${{ github.run_attempt }}.jsonl
       if-no-files-found: ignore
       retention-days: 14
 jobs:
   prepare:
+    outputs:
+      eligible: ${{ steps.prepare.outputs.eligible }}
+      source_revision: ${{ steps.prepare.outputs.source_revision }}
     name: Authorize and reserve issue
     runs-on: ubuntu-24.04
     permissions:
@@ -112,9 +134,10 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: node src/packages/sdlc/src/issue-actions.mjs prepare
       - name: Preserve the execution request
+        if: steps.prepare.outputs.eligible == 'true'
         uses: actions/upload-artifact@v7
         with:
-          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          name: lighthouse-implement-input-${{ inputs.issue }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/
           if-no-files-found: error
           retention-days: 14
@@ -126,9 +149,10 @@ jobs:
   publish:
     name: Validate, publish and release
     needs: [prepare, agent]
-    if: always() && needs.prepare.result == 'success'
+    if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     permissions:
+      actions: write
       contents: write
       issues: write
       pull-requests: write
@@ -146,14 +170,19 @@ jobs:
       - name: Load the execution request
         uses: actions/download-artifact@v8
         with:
-          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          name: lighthouse-implement-input-${{ inputs.issue }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Load the candidate result
         if: needs.agent.result == 'success'
         uses: actions/download-artifact@v8
         with:
-          name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+          name: lighthouse-implement-result-${{ inputs.issue }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Require an executed agent
+        if: needs.agent.result != 'success'
+        run: |
+          echo 'The authorized agent did not complete successfully; inspect its execution.' >&2
+          exit 1
       - name: Recheck authority and publish the validated result
         if: needs.agent.result == 'success'
         env:
@@ -166,9 +195,9 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
 ---
 
-# Implement the approved change
+# Plan and implement the issue
 
-Execute `implement` using `/input/context.json` and `/harness/skills/implement/SKILL.md`. Read the merged proposal at `context.implementation.proposal.root`, the repository policy and the authorized scope. Work inside `/workspace`, a disposable writable copy; only `implementation.policy.paths` may change. The packaged harness and context remain read-only.
+Execute `implement` using `/input/context.json` and `/harness/skills/implement/SKILL.md`. Read the issue, owner answers and repository policy. Use `context.proposal.instructions` to create or update the OpenSpec proposal, design, specifications and tasks in `context.proposal.root` before implementing those tasks. Planning artifacts and code belong to the same implementation PR. Work inside `/workspace`, a disposable writable copy; only `implementation.policy.paths` may change. The packaged harness and context remain read-only.
 
 Report public progress before inspection and whenever a decision, test result or blocker changes the plan. Explain the evidence briefly; avoid dumping tool payloads. Use the shell to install public dependencies, edit source and run checks. Preserve content and author-owned work. Record completed tasks accurately. Store screenshots, test reports and a concise retrospective in `/output/evidence/`; the host retains them as Actions artifacts.
 

package/workflows/lighthouse-sdlc-integrate.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"5c4c64e18fc5fcaf0cdf5616f3ed3608e0309d7de468af329f5b3401e57b17b8","body_hash":"71107231af6c0ea2e2f2880e7bfcf90d02e031b1db4c95a2d5b456e934f6f1ed","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"1d79f54dd473b3b7b99489938a07aa275f5d05d36bf8b3654aa9d1d7b3b04f9f","body_hash":"71107231af6c0ea2e2f2880e7bfcf90d02e031b1db4c95a2d5b456e934f6f1ed","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -30,6 +30,8 @@
 #     - shared/lighthouse-opencode.md
 #
 # Frontmatter env variables:
+#   - LIGHTHOUSE_DISPATCH_REQUIRED: (main workflow)
+#   - LIGHTHOUSE_RECOVERY_ENABLED: (main workflow)
 #   - LIGHTHOUSE_STAGE: (main workflow)
 #
 # Secrets used:
@@ -55,38 +57,36 @@
 
 name: "Lighthouse SDLC integrate"
 on:
-  workflow_call:
+  # roles: all # Roles processed as role check in pre-activation job
+  workflow_dispatch:
     inputs:
       aw_context:
         default: ""
         description: "Agent caller context (Reserved for Agentic Workflows)."
         required: false
         type: string
+      dispatch-request:
+        description: Authenticated router receipt comment ID
+        required: true
+        type: string
       issue:
+        description: Source issue
         required: true
         type: string
-    secrets:
-      COPILOT_GITHUB_TOKEN:
-        required: false
-      GH_AW_DEFAULT_OTLP_ENDPOINT:
-        required: false
-      GH_AW_DEFAULT_OTLP_HEADERS:
-        required: false
-      GH_AW_GITHUB_MCP_SERVER_TOKEN:
-        required: false
-      GH_AW_GITHUB_TOKEN:
-        required: false
 
 # Jobs receive only their explicitly declared permissions.
 permissions: {}
 
 concurrency:
-  group: "gh-aw-lighthouse-sdlc-integrate-${{ github.run_id }}"
+  cancel-in-progress: false
+  group: lighthouse-issue-${{ inputs.issue }}
   queue: max
 
-run-name: "Lighthouse SDLC integrate"
+run-name: "integrate #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
 
 env:
+  LIGHTHOUSE_DISPATCH_REQUIRED: "true"
+  LIGHTHOUSE_RECOVERY_ENABLED: ${{ vars.LIGHTHOUSE_RECOVERY_ENABLED }}
   LIGHTHOUSE_STAGE: integrate
   OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.GH_AW_DEFAULT_OTLP_ENDPOINT || vars.GH_AW_DEFAULT_OTLP_ENDPOINT }}
   OTEL_SERVICE_NAME: gh-aw.lighthouse-sdlc-integrate
@@ -101,7 +101,7 @@ jobs:
     needs:
       - pre_activation
       - prepare
-    if: needs.pre_activation.outputs.activated == 'true'
+    if: needs.pre_activation.outputs.activated == 'true' && (needs.prepare.outputs.eligible == 'true')
     runs-on: ubuntu-24.04
     # Permissions for the activation job (workflow permissions default to none).
     permissions:
@@ -111,7 +111,6 @@ jobs:
       GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}
       GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
     outputs:
-      artifact_prefix: ${{ steps.artifact-prefix.outputs.prefix }}
       aw_context: ${{ steps.generate_aw_info.outputs.aw_context }}
       comment_id: ""
       comment_repo: ""
@@ -129,10 +128,6 @@ jobs:
       setup-span-id: ${{ steps.setup.outputs.span-id }}
       setup-trace-id: ${{ steps.setup.outputs.trace-id }}
       stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}
-      target_checkout_ref: ${{ steps.resolve-host-repo.outputs.target_checkout_ref }}
-      target_ref: ${{ steps.resolve-host-repo.outputs.target_ref }}
-      target_repo: ${{ steps.resolve-host-repo.outputs.target_repo }}
-      target_repo_name: ${{ steps.resolve-host-repo.outputs.target_repo_name }}
     steps:
       - name: Setup Scripts
         id: setup
@@ -151,27 +146,6 @@ jobs:
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
       - name: Mask OTLP telemetry headers
         run: bash "${RUNNER_TEMP}/gh-aw/actions/mask_otlp_headers.sh"
-      - name: Resolve host repo for activation checkout
-        id: resolve-host-repo
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          JOB_WORKFLOW_REPOSITORY: ${{ job.workflow_repository }}
-          JOB_WORKFLOW_SHA: ${{ job.workflow_sha }}
-          JOB_WORKFLOW_REF: ${{ job.workflow_ref }}
-          JOB_WORKFLOW_FILE_PATH: ${{ job.workflow_file_path }}
-        with:
-          script: |
-            const path = require('path');
-            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
-            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require(path.join(actionsDir, 'resolve_host_repo.cjs'));
-            await main();
-      - name: Compute artifact prefix
-        id: artifact-prefix
-        env:
-          INPUTS_JSON: ${{ toJSON(inputs) }}
-        run: bash "${RUNNER_TEMP}/gh-aw/actions/compute_artifact_prefix.sh"
       - name: Generate agentic run info
         id: generate_aw_info
         env:
@@ -194,7 +168,6 @@ jobs:
           GH_AW_INFO_AGENT_RUNTIME: ""
           GH_AW_INFO_MODEL_CONFIG: '{"routing":{"enabled":false}}'
           GH_AW_COMPILED_STRICT: "false"
-          GH_AW_INFO_TARGET_REPO: ${{ steps.resolve-host-repo.outputs.target_repo }}
           GH_AW_INFO_FEATURES: '{"dangerously-disable-sandbox-agent":true}'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -266,19 +239,10 @@ jobs:
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
           GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
           GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
-      - name: Print cross-repo setup guidance
-        if: failure() && steps.resolve-host-repo.outputs.target_repo != github.repository
-        run: |
-          echo "::error::COPILOT_GITHUB_TOKEN must be configured in the CALLER repository's secrets."
-          echo "::error::For cross-repo workflow_call, secrets must be set in the repository that triggers the workflow."
-          echo "::error::See: https://github.github.com/gh-aw/patterns/central-repo-ops/#cross-repo-setup"
       - name: Checkout .github and .agents folders
-        if: steps.resolve-host-repo.outputs.target_repo == github.repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          repository: ${{ steps.resolve-host-repo.outputs.target_repo }}
-          ref: ${{ steps.resolve-host-repo.outputs.target_checkout_ref }}
           sparse-checkout: |
             .github
             .agents
@@ -412,7 +376,7 @@ jobs:
         if: success() || failure()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: ${{ steps.artifact-prefix.outputs.prefix }}info
+          name: info
           path: /tmp/gh-aw/aw_info.json
           if-no-files-found: ignore
           retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '0' }}
@@ -424,7 +388,7 @@ jobs:
         if: success() || failure()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: ${{ steps.artifact-prefix.outputs.prefix }}activation
+          name: activation
           include-hidden-files: true
           path: |
             /tmp/gh-aw/aw_info.json
@@ -447,7 +411,7 @@ jobs:
     needs:
       - activation
       - prepare
-    if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'
+    if: (needs.prepare.outputs.eligible == 'true') && (needs.activation.outputs.daily_ai_credits_exceeded != 'true')
     runs-on:
     - self-hosted
     - linux
@@ -455,9 +419,6 @@ jobs:
     # Permissions for the agent job (workflow permissions default to none).
     permissions:
       contents: read
-    concurrency:
-      group: "gh-aw-opencode-lighthouse-sdlc-integrate"
-      queue: max
     timeout-minutes: 60
     env:
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
@@ -479,7 +440,6 @@ jobs:
       ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}
       aic: ${{ steps.parse-mcp-gateway.outputs.aic }}
       ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}
-      artifact_prefix: ${{ needs.activation.outputs.artifact_prefix }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
@@ -535,7 +495,7 @@ jobs:
       - name: Download activation artifact
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
-          name: ${{ needs.activation.outputs.artifact_prefix }}activation
+          name: activation
           path: /tmp/gh-aw
       - name: Check out the authorized product revision
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
@@ -929,7 +889,7 @@ jobs:
         continue-on-error: true
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: ${{ needs.activation.outputs.artifact_prefix }}agent-output-fallback
+          name: agent-output-fallback
           path: |
             /tmp/gh-aw/agent_output.json
             /tmp/gh-aw/safeoutputs.jsonl
@@ -951,7 +911,7 @@ jobs:
         continue-on-error: true
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: ${{ needs.activation.outputs.artifact_prefix }}agent
+          name: agent
           path: |
             /tmp/gh-aw/aw-prompts/prompt.txt
             /tmp/gh-aw/agent_execution.json
@@ -990,7 +950,7 @@ jobs:
       actions: read
       issues: write
     concurrency:
-      group: "gh-aw-conclusion-lighthouse-sdlc-integrate"
+      group: "gh-aw-conclusion-lighthouse-sdlc-integrate-${{ github.run_id }}"
       cancel-in-progress: false
       queue: max
     env:
@@ -1021,7 +981,7 @@ jobs:
         continue-on-error: true
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
-          pattern: "{${{ needs.activation.outputs.artifact_prefix }}agent,${{ needs.activation.outputs.artifact_prefix }}agent-output-fallback}"
+          pattern: "{agent,agent-output-fallback}"
           merge-multiple: true
           path: /tmp/gh-aw/
       - name: Setup agent output environment variable
@@ -1039,7 +999,7 @@ jobs:
         continue-on-error: true
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
-          pattern: ${{ needs.activation.outputs.artifact_prefix }}safe-outputs-items
+          pattern: safe-outputs-items
           merge-multiple: true
           path: /tmp/gh-aw/
       - name: Process no-op messages
@@ -1164,7 +1124,7 @@ jobs:
         continue-on-error: true
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: ${{ needs.activation.outputs.artifact_prefix }}usage
+          name: usage
           path: |
             /tmp/gh-aw/usage/aw_session.jsonl
             /tmp/gh-aw/usage/aw_info.json
@@ -1199,7 +1159,7 @@ jobs:
         continue-on-error: true
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: ${{ needs.activation.outputs.artifact_prefix }}usage
+          name: usage
           path: |
             /tmp/gh-aw/usage/aw_session.jsonl
             /tmp/gh-aw/usage/aw_info.json
@@ -1234,7 +1194,7 @@ jobs:
     env:
       GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
     outputs:
-      activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }}
+      activated: ${{ 'true' }}
       matched_command: ''
       setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
       setup-span-id: ${{ steps.setup.outputs.span-id }}
@@ -1252,20 +1212,6 @@ jobs:
           GH_AW_INFO_VERSION: "2.1.0"
           GH_AW_INFO_ENGINE_ID: "opencode"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
-      - name: Check team membership for workflow
-        id: check_membership
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          GH_AW_REQUIRED_ROLES: "admin,maintainer,write"
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const path = require('path');
-            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
-            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require(path.join(actionsDir, 'check_membership.cjs'));
-            await main();
 
   prepare:
     name: Verify accepted commit, checks and evidence protection
@@ -1280,6 +1226,7 @@ jobs:
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     outputs:
+      eligible: ${{ steps.prepare.outputs.eligible }}
       revision: ${{ steps.prepare.outputs.revision }}
     steps:
       - name: Configure GH_HOST for enterprise compatibility
@@ -1305,6 +1252,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
       - name: Preserve the execution request
+        if: steps.prepare.outputs.eligible == 'true'
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           if-no-files-found: error
@@ -1322,7 +1270,7 @@ jobs:
     needs:
       - agent
       - prepare
-    if: always() && needs.prepare.result == 'success'
+    if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     # Permissions for the publish job (workflow permissions default to none).
     permissions:
@@ -1366,6 +1314,11 @@ jobs:
         with:
           name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Require an executed agent
+        if: needs.agent.result != 'success'
+        run: |
+          echo 'The authorized agent did not complete successfully; inspect its execution.' >&2
+          exit 1
       - name: Recheck authority and publish the validated result
         if: needs.agent.result == 'success'
         run: node src/packages/sdlc/src/completion-actions.mjs publish

package/workflows/lighthouse-sdlc-integrate.md

@@ -2,18 +2,34 @@
 # Owned by lighthouse-sdlc. Regenerate the lock with gh aw v0.93.2.
 name: Lighthouse SDLC integrate
 description: Assess integrate with OpenCode and retain a verified delivery record.
+run-name: "integrate #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
+concurrency:
+  group: lighthouse-issue-${{ inputs.issue }}
+  cancel-in-progress: false
+  queue: max
+  job-discriminator: ${{ github.run_id }}
 on:
-  workflow_call:
+  # The required preparation job authenticates the originating owner request.
+  roles: all
+  workflow_dispatch:
     inputs:
       issue:
+        description: Source issue
+        required: true
+        type: string
+      dispatch-request:
+        description: Authenticated router receipt comment ID
         required: true
         type: string
   needs: [prepare]
+if: needs.prepare.outputs.eligible == 'true'
 runs-on: [self-hosted, linux, lighthouse-workflow]
 runs-on-slim: ubuntu-24.04
 timeout-minutes: 15
 env:
+  LIGHTHOUSE_RECOVERY_ENABLED: ${{ vars.LIGHTHOUSE_RECOVERY_ENABLED }}
   LIGHTHOUSE_STAGE: integrate
+  LIGHTHOUSE_DISPATCH_REQUIRED: "true"
 permissions:
   contents: read
 engine:
@@ -83,6 +99,7 @@ post-steps:
 jobs:
   prepare:
     outputs:
+      eligible: ${{ steps.prepare.outputs.eligible }}
       revision: ${{ steps.prepare.outputs.revision }}
     name: Verify accepted commit, checks and evidence protection
     runs-on: ubuntu-24.04
@@ -109,6 +126,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: node src/packages/sdlc/src/completion-actions.mjs prepare
       - name: Preserve the execution request
+        if: steps.prepare.outputs.eligible == 'true'
         uses: actions/upload-artifact@v7
         with:
           name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
@@ -126,7 +144,7 @@ jobs:
       cancel-in-progress: false
     name: Validate, publish and release
     needs: [prepare, agent]
-    if: always() && needs.prepare.result == 'success'
+    if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     permissions:
       actions: write
@@ -156,6 +174,11 @@ jobs:
         with:
           name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Require an executed agent
+        if: needs.agent.result != 'success'
+        run: |
+          echo 'The authorized agent did not complete successfully; inspect its execution.' >&2
+          exit 1
       - name: Recheck authority and publish the validated result
         if: needs.agent.result == 'success'
         env: