@juangcarmona/lighthouse-sdlc 0.15.2 → 0.16.1

package/workflows/lighthouse-sdlc-product-change.md

@@ -0,0 +1,195 @@
+---
+# Owned by lighthouse-sdlc. Regenerate the lock with gh aw v0.93.2.
+name: product-change
+description: Prepare and publish an authenticated Product Change candidate for an authorized issue idea.
+run-name: "product change #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
+concurrency:
+  group: lighthouse-issue-${{ inputs.issue }}
+  cancel-in-progress: false
+  queue: max
+  job-discriminator: ${{ github.run_id }}
+on:
+  roles: all
+  workflow_dispatch:
+    inputs:
+      issue:
+        description: Source issue containing the product idea
+        required: true
+        type: string
+      dispatch-request:
+        description: Authenticated router receipt comment ID
+        required: true
+        type: string
+  needs: [prepare]
+if: needs.prepare.outputs.eligible == 'true'
+runs-on: [self-hosted, linux, lighthouse-workflow]
+runs-on-slim: ubuntu-24.04
+timeout-minutes: 30
+env:
+  LIGHTHOUSE_STAGE: propose
+  LIGHTHOUSE_WORKER: product-change
+  LIGHTHOUSE_DISPATCH_REQUIRED: "true"
+  LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: "true"
+permissions:
+  contents: read
+engine:
+  id: opencode
+  command: node
+imports:
+  - shared/lighthouse-opencode.md
+strict: false
+features:
+  dangerously-disable-sandbox-agent: true
+sandbox:
+  agent: false
+tools:
+  github: false
+safe-outputs:
+  create-issue: false
+  report-incomplete: false
+  threat-detection: false
+  report-failure-as-issue: false
+  report-missing-tool: false
+  report-missing-data: false
+  noop:
+    report-as-issue: false
+network:
+  allowed: []
+steps:
+  - name: Check out the authorized product revision
+    uses: actions/checkout@v5
+    with:
+      persist-credentials: false
+      ref: ${{ needs.prepare.outputs.source_revision }}
+  - name: Load the pinned harness package
+    uses: actions/checkout@v5
+    with:
+      repository: juangcarmona/lighthouse
+      ref: __LIGHTHOUSE_REF__
+      path: .lighthouse-harness
+      persist-credentials: false
+  - name: Load the authorized product request
+    uses: actions/download-artifact@v8
+    with:
+      name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+post-steps:
+  - name: Validate the Lighthouse result
+    run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs validate
+  - name: Preserve the result and runtime receipt
+    if: always()
+    uses: actions/upload-artifact@v7
+    with:
+      name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: |
+        ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/envelope.json
+        ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/runtime.json
+      if-no-files-found: error
+      retention-days: 14
+jobs:
+  prepare:
+    outputs:
+      eligible: ${{ steps.prepare.outputs.eligible }}
+      source_revision: ${{ steps.prepare.outputs.source_revision }}
+    name: Authenticate and checkpoint the idea
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+      LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: "true"
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Install provider integration when the adopter configured it
+        run: |
+          npm ci --ignore-scripts
+          npm install --no-save --package-lock=false --ignore-scripts @prodshape/integration-openspec@0.6.6
+      - name: Collect verified intent and reserve the issue
+        id: prepare
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs prepare
+      - name: Preserve the execution request
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/
+          if-no-files-found: error
+          retention-days: 14
+      - name: Release reservation if preparation failed
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs cleanup
+  publish:
+    name: Validate and publish the product candidate
+    needs: [prepare, agent]
+    if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          ref: ${{ needs.prepare.outputs.source_revision }}
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          path: .lighthouse-harness
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Install the repository and optional product provider
+        run: |
+          npm ci --ignore-scripts
+          npm install --no-save --package-lock=false --ignore-scripts @prodshape/integration-openspec@0.6.6
+      - name: Load the request and candidate
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Load the product result
+        if: needs.agent.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Require a completed worker
+        if: needs.agent.result != 'success'
+        run: exit 1
+      - name: Recheck authority and publish the candidate
+        if: needs.agent.result == 'success'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs publish
+      - name: Release the execution reservation
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs cleanup
+---
+
+# Prepare a product change from an idea
+
+Read the authenticated context and follow `/harness/skills/product-change/SKILL.md`. Use the installed ProductShape schema instructions included in `context.productChange`. The issue title and body define the idea and the host's `context.productChange.parent` defines the scope and authorization. Compare it with the accepted product model, then return one of `aligned`, `candidate` or `blocked` in `result.output.productChange`.
+
+For a candidate, return the complete provider-owned change files under `context.productChange.root`, the host-assigned `changeName`, CHG ID, proposal digest, baseline digest and successful provider validation summary. Keep the manifest in draft status. Do not approve, apply, alter the accepted model, publish a branch or continue implementation. The trusted publisher rechecks the exact candidate, validates it against the current accepted model, publishes the PR and requests an explicit product decision. Product approval, apply, implementation, merge and release are separate effects.
+
+Return the supplied stage result identity and keep the enclosing lifecycle stage as `propose`. A product idea does not grant implementation authority. The host owns all GitHub effects and releases execution resources when the decision request is durable.

package/workflows/lighthouse-sdlc-propose.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"9f1eb00a7ca17acea34862222ba6ea4384d9396a356f5d02c3d5af885e01a378","body_hash":"64c05adc2e6fd3f631b84ea421688ae91dfad6c946b0fb6f8dedf577c8c5bf2a","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"c27655e49e0c2a6bbcc2f99a4a861c3bcc504599303ed34da08fd0fa7020b692","body_hash":"64c05adc2e6fd3f631b84ea421688ae91dfad6c946b0fb6f8dedf577c8c5bf2a","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -510,7 +510,7 @@ jobs:
       - name: Load the pinned harness package
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
-          path: tools
+          path: .lighthouse-harness
           persist-credentials: false
           ref: __LIGHTHOUSE_REF__
           repository: juangcarmona/lighthouse
@@ -749,7 +749,7 @@ jobs:
           export GH_AW_AWF_EXECUTION_EVIDENCE_FILE="/tmp/gh-aw/agent_execution.json"
           export no_proxy="${NO_PROXY:-}"
           printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
-          cd "${GITHUB_WORKSPACE}" && node tools/src/packages/sdlc/src/opencode-execute.mjs "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
+          cd "${GITHUB_WORKSPACE}" && node .lighthouse-harness/src/packages/sdlc/src/opencode-execute.mjs "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
           GH_AW_ADMISSION_MAX_AI_CREDITS: ${{ needs.activation.outputs.admission-max-ai-credits }}
           GH_AW_ADMISSION_RESULT: ${{ needs.activation.outputs.admission-result }}
@@ -862,7 +862,7 @@ jobs:
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
       - name: Validate the Lighthouse result
-        run: node tools/src/packages/sdlc/src/issue-actions.mjs validate
+        run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs validate
       - if: always()
         name: Preserve the result and runtime receipt
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

package/workflows/lighthouse-sdlc-propose.md

@@ -68,7 +68,7 @@ steps:
     with:
       repository: juangcarmona/lighthouse
       ref: __LIGHTHOUSE_REF__
-      path: tools
+      path: .lighthouse-harness
       persist-credentials: false
   - name: Load the authorized issue context
     uses: actions/download-artifact@v8
@@ -77,7 +77,7 @@ steps:
       path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
 post-steps:
   - name: Validate the Lighthouse result
-    run: node tools/src/packages/sdlc/src/issue-actions.mjs validate
+    run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs validate
   - name: Preserve the result and runtime receipt
     if: always()
     uses: actions/upload-artifact@v7

package/workflows/lighthouse-sdlc-refine.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"b4ec13bf1f2bca420114208bc2ea15998f9cd7f4cd5c1eb667d0a8d3466022a7","body_hash":"00aaac0798637a281758028c249e7c1086c7ca9e32ea9cb2ef51af769c3e2586","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a5265cd1fefec15589c48dd95878589ed94bf99e08e50b1ee574951bd90e175c","body_hash":"00aaac0798637a281758028c249e7c1086c7ca9e32ea9cb2ef51af769c3e2586","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -510,7 +510,7 @@ jobs:
       - name: Load the pinned harness package
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
-          path: tools
+          path: .lighthouse-harness
           persist-credentials: false
           ref: __LIGHTHOUSE_REF__
           repository: juangcarmona/lighthouse
@@ -749,7 +749,7 @@ jobs:
           export GH_AW_AWF_EXECUTION_EVIDENCE_FILE="/tmp/gh-aw/agent_execution.json"
           export no_proxy="${NO_PROXY:-}"
           printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
-          cd "${GITHUB_WORKSPACE}" && node tools/src/packages/sdlc/src/opencode-execute.mjs "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
+          cd "${GITHUB_WORKSPACE}" && node .lighthouse-harness/src/packages/sdlc/src/opencode-execute.mjs "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
           GH_AW_ADMISSION_MAX_AI_CREDITS: ${{ needs.activation.outputs.admission-max-ai-credits }}
           GH_AW_ADMISSION_RESULT: ${{ needs.activation.outputs.admission-result }}
@@ -862,7 +862,7 @@ jobs:
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
       - name: Validate the Lighthouse result
-        run: node tools/src/packages/sdlc/src/issue-actions.mjs validate
+        run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs validate
       - if: always()
         name: Preserve the result and runtime receipt
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

package/workflows/lighthouse-sdlc-refine.md

@@ -68,7 +68,7 @@ steps:
     with:
       repository: juangcarmona/lighthouse
       ref: __LIGHTHOUSE_REF__
-      path: tools
+      path: .lighthouse-harness
       persist-credentials: false
   - name: Load the authorized issue context
     uses: actions/download-artifact@v8
@@ -77,7 +77,7 @@ steps:
       path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
 post-steps:
   - name: Validate the Lighthouse result
-    run: node tools/src/packages/sdlc/src/issue-actions.mjs validate
+    run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs validate
   - name: Preserve the result and runtime receipt
     if: always()
     uses: actions/upload-artifact@v7

package/workflows/lighthouse-sdlc-review.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"71a9cc0055e7e8bad0c8eeb083c3105f576f83c52f1139b7f8bcfdb15b90ff58","body_hash":"13d2a6e093a7dc59f842bf0e8e8ea2a1c5a2879c8608b026dac1197b022baebe","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"51e11118c2e24416a675a933e087c252883092fb009eebf147578c58b5a535f7","body_hash":"13d2a6e093a7dc59f842bf0e8e8ea2a1c5a2879c8608b026dac1197b022baebe","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -510,7 +510,7 @@ jobs:
       - name: Load the pinned harness package
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
-          path: tools
+          path: .lighthouse-harness
           persist-credentials: false
           ref: __LIGHTHOUSE_REF__
           repository: juangcarmona/lighthouse
@@ -749,7 +749,7 @@ jobs:
           export GH_AW_AWF_EXECUTION_EVIDENCE_FILE="/tmp/gh-aw/agent_execution.json"
           export no_proxy="${NO_PROXY:-}"
           printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
-          cd "${GITHUB_WORKSPACE}" && node tools/src/packages/sdlc/src/opencode-execute.mjs "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
+          cd "${GITHUB_WORKSPACE}" && node .lighthouse-harness/src/packages/sdlc/src/opencode-execute.mjs "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
           GH_AW_ADMISSION_MAX_AI_CREDITS: ${{ needs.activation.outputs.admission-max-ai-credits }}
           GH_AW_ADMISSION_RESULT: ${{ needs.activation.outputs.admission-result }}
@@ -862,7 +862,7 @@ jobs:
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
       - name: Validate the Lighthouse result
-        run: node tools/src/packages/sdlc/src/completion-actions.mjs validate
+        run: node .lighthouse-harness/src/packages/sdlc/src/completion-actions.mjs validate
       - if: always()
         name: Preserve the result and runtime receipt
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

package/workflows/lighthouse-sdlc-review.md

@@ -68,7 +68,7 @@ steps:
     with:
       repository: juangcarmona/lighthouse
       ref: __LIGHTHOUSE_REF__
-      path: tools
+      path: .lighthouse-harness
       persist-credentials: false
   - name: Load the authorized issue context
     uses: actions/download-artifact@v8
@@ -77,7 +77,7 @@ steps:
       path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
 post-steps:
   - name: Validate the Lighthouse result
-    run: node tools/src/packages/sdlc/src/completion-actions.mjs validate
+    run: node .lighthouse-harness/src/packages/sdlc/src/completion-actions.mjs validate
   - name: Preserve the result and runtime receipt
     if: always()
     uses: actions/upload-artifact@v7

package/workflows/lighthouse-sdlc-router.yml

@@ -1,6 +1,6 @@
 # Optional GitHub-native stage adapter; source owned by lighthouse-sdlc.
 name: router
-run-name: "${{ (github.event_name == 'workflow_run' && 'Delivery after CI') || inputs.stage || github.event.label.name || ((github.event.pull_request || github.event.issue.pull_request) && 'PR review') || (github.event_name == 'issue_comment' && 'reply') || 'refine' }} #${{ github.event.issue.number || github.event.pull_request.number || inputs.issue }} · ${{ github.actor }}"
+run-name: "${{ (github.event_name == 'workflow_run' && 'Delivery after CI') || inputs.workflow || inputs.stage || github.event.label.name || ((github.event.pull_request || github.event.issue.pull_request) && 'PR review') || (github.event_name == 'issue_comment' && 'reply') || 'refine' }} #${{ github.event.issue.number || github.event.pull_request.number || inputs.issue }} · ${{ github.actor }}"
 on:
   issues:
     types: [labeled, unlabeled]
@@ -26,9 +26,15 @@ on:
       stage:
         description: Authorized lifecycle stage
         required: true
-        default: refine
+        default: propose
         type: choice
         options: [triage, refine, propose, implement, integrate, review]
+      workflow:
+        description: Select the authorized workflow
+        required: true
+        default: stage
+        type: choice
+        options: [stage, product-change]
       after_run:
         description: Recheck a completed execution through the same continuation rules
         required: false
@@ -52,6 +58,7 @@ env:
   LIGHTHOUSE_ENABLED_STAGES: triage,refine,propose,implement,integrate,review
   LIGHTHOUSE_AUTO_IMPLEMENT: true
   LIGHTHOUSE_COMPLETION_ENABLED: true
+  LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: false
 jobs:
   pr-state:
     if: >-
@@ -99,6 +106,7 @@ jobs:
       run: ${{ steps.route.outputs.run }}
       issue: ${{ steps.route.outputs.issue }}
       stage: ${{ steps.route.outputs.stage }}
+      worker: ${{ steps.route.outputs.worker }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -113,6 +121,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           LIGHTHOUSE_COMPLETION_ENABLED: true
+          LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: ${{ env.LIGHTHOUSE_PRODUCT_CHANGE_ENABLED }}
         run: node src/packages/sdlc/src/issue-actions.mjs route
   dispatch:
     name: 📥 Dispatch selected stage
@@ -131,6 +140,7 @@ jobs:
     env:
       LIGHTHOUSE_ISSUE: ${{ needs.route.outputs.issue }}
       LIGHTHOUSE_STAGE: ${{ needs.route.outputs.stage }}
+      LIGHTHOUSE_WORKER: ${{ needs.route.outputs.worker }}
     steps:
       - uses: actions/checkout@v5
         with:

package/workflows/lighthouse-sdlc-triage.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"774a39cc660dd7589cbba460421a95c9fec2bcb21b73471ae90bc9b625eeb767","body_hash":"b6819b09222b408b8140fdc320e7270d45149ccb70442e528ef4f0ffa86e985c","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2ef374e6036e86ca382e1352ebbbe6367c0836d172b705f4fe450d24ad7921f7","body_hash":"b6819b09222b408b8140fdc320e7270d45149ccb70442e528ef4f0ffa86e985c","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -510,7 +510,7 @@ jobs:
       - name: Load the pinned harness package
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
-          path: tools
+          path: .lighthouse-harness
           persist-credentials: false
           ref: __LIGHTHOUSE_REF__
           repository: juangcarmona/lighthouse
@@ -749,7 +749,7 @@ jobs:
           export GH_AW_AWF_EXECUTION_EVIDENCE_FILE="/tmp/gh-aw/agent_execution.json"
           export no_proxy="${NO_PROXY:-}"
           printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
-          cd "${GITHUB_WORKSPACE}" && node tools/src/packages/sdlc/src/opencode-execute.mjs "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
+          cd "${GITHUB_WORKSPACE}" && node .lighthouse-harness/src/packages/sdlc/src/opencode-execute.mjs "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
           GH_AW_ADMISSION_MAX_AI_CREDITS: ${{ needs.activation.outputs.admission-max-ai-credits }}
           GH_AW_ADMISSION_RESULT: ${{ needs.activation.outputs.admission-result }}
@@ -862,7 +862,7 @@ jobs:
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
       - name: Validate the Lighthouse result
-        run: node tools/src/packages/sdlc/src/issue-actions.mjs validate
+        run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs validate
       - if: always()
         name: Preserve the result and runtime receipt
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

package/workflows/lighthouse-sdlc-triage.md

@@ -66,7 +66,7 @@ steps:
     with:
       repository: juangcarmona/lighthouse
       ref: __LIGHTHOUSE_REF__
-      path: tools
+      path: .lighthouse-harness
       persist-credentials: false
   - name: Load the authorized issue context
     uses: actions/download-artifact@v8
@@ -75,7 +75,7 @@ steps:
       path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
 post-steps:
   - name: Validate the Lighthouse result
-    run: node tools/src/packages/sdlc/src/issue-actions.mjs validate
+    run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs validate
   - name: Preserve the result and runtime receipt
     if: always()
     uses: actions/upload-artifact@v7

package/workflows/lighthouse-sdlc-unattended.yml

@@ -0,0 +1,67 @@
+# Owned by lighthouse-sdlc. Both routes reuse canonical lifecycle stages.
+name: unattended
+run-name: "${{ inputs.route }} #${{ inputs.issue }} · ${{ github.actor }}"
+on:
+  workflow_dispatch:
+    inputs:
+      issue:
+        description: Owner-authorized issue
+        required: true
+        type: string
+      route:
+        description: Bounded delivery route
+        required: true
+        type: choice
+        options: [ff, hotfix]
+permissions: {}
+concurrency:
+  group: lighthouse-issue-${{ inputs.issue }}
+  cancel-in-progress: false
+  queue: max
+jobs:
+  deliver:
+    if: vars.LIGHTHOUSE_AUTOMATION_ENABLED == 'true' && github.actor == github.repository_owner
+    runs-on: [self-hosted, linux, lighthouse-workflow]
+    timeout-minutes: 125
+    permissions:
+      actions: write
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Load the pinned trusted harness
+        uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          path: .lighthouse-harness
+          persist-credentials: false
+      - name: Load current product source
+        uses: actions/checkout@v5
+        with:
+          path: product
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Execute the authorized bounded composition
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node .lighthouse-harness/src/packages/sdlc/src/unattended-actions.mjs
+      - name: Retain candidate and execution evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-unattended-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/report.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/candidate.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/request.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/envelope.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/checks.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/changes.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/runtime.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/engine-error.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/evidence/**
+          if-no-files-found: warn
+          retention-days: 14

package/workflows/shared/lighthouse-opencode.md

@@ -10,7 +10,7 @@ engine:
       tools-allowlist: true
     execution:
       command-name: node
-      args: [tools/src/packages/sdlc/src/opencode-execute.mjs]
+      args: [.lighthouse-harness/src/packages/sdlc/src/opencode-execute.mjs]
       step-name: OpenCode progress and result
       write-timestamp: true
     log-parser: |