@juangcarmona/lighthouse-sdlc 0.17.1 → 0.18.0

package/workflows/lighthouse-sdlc-product-change.md

@@ -1,7 +1,7 @@
 ---
 # Owned by lighthouse-sdlc. Regenerate the lock with gh aw v0.93.2.
 name: product-change
-description: Prepare and publish an authenticated Product Change candidate for an authorized issue idea.
+description: Prepare and publish an authenticated Product Change candidate for an idea or issue prerequisite.
 run-name: "product change #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
 concurrency:
   group: lighthouse-issue-${{ inputs.issue }}
@@ -73,6 +73,11 @@ steps:
     with:
       name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
       path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+  - name: Load ProductShape inspection evidence
+    uses: actions/download-artifact@v8
+    with:
+      name: lighthouse-product-evidence-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/product-evidence
 post-steps:
   - name: Validate the Lighthouse result
     run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs validate
@@ -97,6 +102,7 @@ jobs:
       actions: read
       contents: read
       issues: write
+      pull-requests: read
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
       LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: "true"
@@ -106,6 +112,12 @@ jobs:
           repository: juangcarmona/lighthouse
           ref: __LIGHTHOUSE_REF__
           persist-credentials: false
+      - name: Check out the adopter's current product source
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          path: .lighthouse-product-source
+          persist-credentials: false
       - uses: actions/setup-node@v5
         with:
           node-version: 24
@@ -117,26 +129,42 @@ jobs:
         id: prepare
         env:
           GH_TOKEN: ${{ github.token }}
-        run: node src/packages/sdlc/src/issue-actions.mjs prepare
+        working-directory: .lighthouse-product-source
+        run: node "$GITHUB_WORKSPACE/src/packages/sdlc/src/issue-actions.mjs" prepare
       - name: Preserve the execution request
         if: steps.prepare.outputs.eligible == 'true'
         uses: actions/upload-artifact@v7
         with:
           name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/
+          path: |
+            ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/admission.json
+            ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/request.json
+            ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/issue.json
+            ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/context.json
+            ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/reserved
+          if-no-files-found: error
+          retention-days: 14
+      - name: Preserve ProductShape inspection evidence
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-product-evidence-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/product-evidence/
           if-no-files-found: error
           retention-days: 14
       - name: Release reservation if preparation failed
         if: failure()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
   publish:
     name: Validate and publish the product candidate
-    needs: [prepare, agent]
+    needs: [prepare, pre_activation, activation, agent]
     if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     permissions:
+      actions: read
       contents: write
       issues: write
       pull-requests: write
@@ -157,6 +185,7 @@ jobs:
         with:
           node-version: 24
       - name: Install the repository and optional product provider
+        working-directory: .lighthouse-harness
         run: |
           npm ci --ignore-scripts
           npm install --no-save --package-lock=false --ignore-scripts @prodshape/integration-openspec@0.6.6
@@ -183,6 +212,10 @@ jobs:
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PRE_ACTIVATION_RESULT: ${{ needs.pre_activation.result }}
+          LIGHTHOUSE_ACTIVATION_RESULT: ${{ needs.activation.result }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
         run: node .lighthouse-harness/src/packages/sdlc/src/issue-actions.mjs cleanup
 ---
 
@@ -190,6 +223,6 @@ jobs:
 
 Read the authenticated context and follow `/harness/skills/product-change/SKILL.md`. Use the installed ProductShape schema instructions included in `context.productChange`. The issue title and body define the idea and the host's `context.productChange.parent` defines the scope and authorization. Compare it with the accepted product model, then return one of `aligned`, `candidate` or `blocked` in `result.output.productChange`.
 
-For a candidate, return the complete provider-owned change files under `context.productChange.root`, the host-assigned `changeName`, CHG ID, proposal digest, baseline digest and successful provider validation summary. Keep the manifest in draft status. Do not approve, apply, alter the accepted model, publish a branch or continue implementation. The trusted publisher rechecks the exact candidate, validates it against the current accepted model, publishes the PR and requests an explicit product decision. Product approval, apply, implementation, merge and release are separate effects.
+For a candidate, return the complete provider-owned change files under `context.productChange.root`, the host-assigned `changeName`, CHG ID, baseline digest and pending provider validation. Copy `context.productChange.schemaPin` into `.openspec.yaml` and omit the proposal digest; the host calculates it after validation. Keep the manifest in draft status. Do not approve, apply, alter the accepted model, publish a branch or continue implementation. The trusted publisher rechecks the exact candidate, validates it against the current accepted model, publishes the PR and requests an explicit product decision. Product approval, apply, implementation, merge and release are separate effects.
 
-Return the supplied stage result identity and keep the enclosing lifecycle stage as `propose`. A product idea does not grant implementation authority. The host owns all GitHub effects and releases execution resources when the decision request is durable.
+Return the supplied stage result identity and retain its enclosing lifecycle stage. An idea or parent prerequisite grants no new implementation authority. The host owns all GitHub effects and releases execution resources when the decision request is durable.

package/workflows/lighthouse-sdlc-propose.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"c27655e49e0c2a6bbcc2f99a4a861c3bcc504599303ed34da08fd0fa7020b692","body_hash":"837f36195c7a0bf8859d78018be1060568e04a8743c44b1f3fd89c7344bc4752","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"e2cc0df8da555f8f423902c0c5a3b1610f56f3923a51c02b1821231b20e86a66","body_hash":"837f36195c7a0bf8859d78018be1060568e04a8743c44b1f3fd89c7344bc4752","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -1263,16 +1263,20 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
 
   publish:
     name: Validate, publish and release
     needs:
+      - activation
       - agent
+      - pre_activation
       - prepare
     if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     # Permissions for the publish job (workflow permissions default to none).
     permissions:
+      actions: write
       contents: write
       issues: write
       pull-requests: write
@@ -1322,3 +1326,11 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_ACTIVATION_RESULT: ${{ needs.activation.result }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PRE_ACTIVATION_RESULT: ${{ needs.pre_activation.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
+      - name: Request the verified product prerequisite
+        run: node src/packages/sdlc/src/issue-actions.mjs continue-product-gap
+        env:
+          GH_TOKEN: ${{ github.token }}

package/workflows/lighthouse-sdlc-propose.md

@@ -136,13 +136,15 @@ jobs:
         if: failure()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
   publish:
     name: Validate, publish and release
-    needs: [prepare, agent]
+    needs: [prepare, pre_activation, activation, agent]
     if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     permissions:
+      actions: write
       contents: write
       issues: write
       pull-requests: write
@@ -182,7 +184,15 @@ jobs:
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PRE_ACTIVATION_RESULT: ${{ needs.pre_activation.result }}
+          LIGHTHOUSE_ACTIVATION_RESULT: ${{ needs.activation.result }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
+      - name: Request the verified product prerequisite
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs continue-product-gap
 ---
 
 # Propose the authorized change

package/workflows/lighthouse-sdlc-refine.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a5265cd1fefec15589c48dd95878589ed94bf99e08e50b1ee574951bd90e175c","body_hash":"00aaac0798637a281758028c249e7c1086c7ca9e32ea9cb2ef51af769c3e2586","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"75a6e72b471b0702be6cca0331d37ac405d8fa53e8dd552e50b1f6493da4ca7e","body_hash":"00aaac0798637a281758028c249e7c1086c7ca9e32ea9cb2ef51af769c3e2586","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -69,6 +69,10 @@ on:
         description: Authenticated router receipt comment ID
         required: true
         type: string
+      epic-parent:
+        description: Authenticated parent issue for shared epic serialization
+        required: false
+        type: string
       issue:
         description: Source issue
         required: true
@@ -79,7 +83,7 @@ permissions: {}
 
 concurrency:
   cancel-in-progress: false
-  group: lighthouse-issue-${{ inputs.issue }}
+  group: ${{ inputs.epic-parent && format('lighthouse-epic-child-{0}', inputs.issue) || format('lighthouse-issue-{0}', inputs.issue) }}
   queue: max
 
 run-name: "refine #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
@@ -1221,6 +1225,12 @@ jobs:
       actions: read
       contents: read
       issues: write
+      pull-requests: read
+    concurrency:
+      cancel-in-progress: false
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-prepare-{0}', github.run_id) }}
+      queue: max
+
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     outputs:
@@ -1262,11 +1272,14 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
 
   publish:
     name: Validate, publish and release
     needs:
+      - activation
       - agent
+      - pre_activation
       - prepare
     if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
@@ -1275,6 +1288,12 @@ jobs:
       actions: write
       contents: read
       issues: write
+      pull-requests: read
+    concurrency:
+      cancel-in-progress: false
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-publish-{0}', github.run_id) }}
+      queue: max
+
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     steps:
@@ -1322,7 +1341,15 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_ACTIVATION_RESULT: ${{ needs.activation.result }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PRE_ACTIVATION_RESULT: ${{ needs.pre_activation.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
       - name: Request the verified implementation continuation
         run: node src/packages/sdlc/src/issue-actions.mjs continue-refinement
         env:
           GH_TOKEN: ${{ github.token }}
+      - name: Request the verified product prerequisite
+        run: node src/packages/sdlc/src/issue-actions.mjs continue-product-gap
+        env:
+          GH_TOKEN: ${{ github.token }}

package/workflows/lighthouse-sdlc-refine.md

@@ -4,7 +4,7 @@ name: refine
 description: Refine an authorized issue through OpenCode with execution logs and validated evidence.
 run-name: "refine #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
 concurrency:
-  group: lighthouse-issue-${{ inputs.issue }}
+  group: ${{ inputs.epic-parent && format('lighthouse-epic-child-{0}', inputs.issue) || format('lighthouse-issue-{0}', inputs.issue) }}
   cancel-in-progress: false
   queue: max
   job-discriminator: ${{ github.run_id }}
@@ -21,6 +21,10 @@ on:
         description: Authenticated router receipt comment ID
         required: true
         type: string
+      epic-parent:
+        description: Authenticated parent issue for shared epic serialization
+        required: false
+        type: string
   needs: [prepare]
 if: needs.prepare.outputs.eligible == 'true'
 runs-on: [self-hosted, linux, lighthouse-workflow]
@@ -98,6 +102,10 @@ post-steps:
       retention-days: 14
 jobs:
   prepare:
+    concurrency:
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-prepare-{0}', github.run_id) }}
+      cancel-in-progress: false
+      queue: max
     outputs:
       eligible: ${{ steps.prepare.outputs.eligible }}
       source_revision: ${{ steps.prepare.outputs.source_revision }}
@@ -107,6 +115,7 @@ jobs:
       actions: read
       contents: read
       issues: write
+      pull-requests: read
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     steps:
@@ -135,16 +144,22 @@ jobs:
         if: failure()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
   publish:
+    concurrency:
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-publish-{0}', github.run_id) }}
+      cancel-in-progress: false
+      queue: max
     name: Validate, publish and release
-    needs: [prepare, agent]
+    needs: [prepare, pre_activation, activation, agent]
     if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     permissions:
       actions: write
       contents: read
       issues: write
+      pull-requests: read
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     steps:
@@ -182,11 +197,19 @@ jobs:
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PRE_ACTIVATION_RESULT: ${{ needs.pre_activation.result }}
+          LIGHTHOUSE_ACTIVATION_RESULT: ${{ needs.activation.result }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
       - name: Request the verified implementation continuation
         env:
           GH_TOKEN: ${{ github.token }}
         run: node src/packages/sdlc/src/issue-actions.mjs continue-refinement
+      - name: Request the verified product prerequisite
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs continue-product-gap
 ---
 
 # Refine the authorized issue

package/workflows/lighthouse-sdlc-review.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"51e11118c2e24416a675a933e087c252883092fb009eebf147578c58b5a535f7","body_hash":"13d2a6e093a7dc59f842bf0e8e8ea2a1c5a2879c8608b026dac1197b022baebe","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"d4a17ac1ac76bdf5b1e27cc7b63dc889d70b7d4521e0cfa9a8d4a126031ab10f","body_hash":"13d2a6e093a7dc59f842bf0e8e8ea2a1c5a2879c8608b026dac1197b022baebe","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -1264,6 +1264,7 @@ jobs:
         run: node src/packages/sdlc/src/completion-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
 
   publish:
     name: Validate, publish and release
@@ -1339,3 +1340,5 @@ jobs:
         run: node src/packages/sdlc/src/completion-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}

package/workflows/lighthouse-sdlc-review.md

@@ -137,6 +137,7 @@ jobs:
         if: failure()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
         run: node src/packages/sdlc/src/completion-actions.mjs cleanup
   publish:
     concurrency:
@@ -198,6 +199,8 @@ jobs:
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
         run: node src/packages/sdlc/src/completion-actions.mjs cleanup
 ---
 

package/workflows/lighthouse-sdlc-router.yml

@@ -34,7 +34,7 @@ on:
         required: true
         default: stage
         type: choice
-        options: [stage, product-change]
+        options: [stage, product-change, resume-product]
       model_selection:
         description: Optional JSON model selection for this execution
         required: false
@@ -43,6 +43,14 @@ on:
         description: Recheck a completed execution through the same continuation rules
         required: false
         type: string
+      epic_parent:
+        description: Authenticated parent issue for epic triage
+        required: false
+        type: string
+      epic_run:
+        description: Completed epic execution for child triage
+        required: false
+        type: string
       pull_request:
         description: PR number for integrate or review
         required: false
@@ -92,14 +100,45 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: node src/packages/sdlc/src/pr-state-actions.mjs
+  epic-triage:
+    if: >-
+      vars.LIGHTHOUSE_AUTOMATION_ENABLED == 'true' && vars.LIGHTHOUSE_EPIC_ENABLED == 'true' &&
+      github.event_name == 'workflow_run' && github.event.action == 'completed' &&
+      github.event.workflow_run.path == '.github/workflows/lighthouse-sdlc-epic.yml' && github.event.workflow_run.conclusion == 'success'
+    concurrency:
+      group: lighthouse-epic-triage-${{ github.event.workflow_run.id }}
+      cancel-in-progress: false
+      queue: max
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: write
+      contents: read
+      issues: read
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Dispatch authenticated epic child triage
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/epic-dispatch.mjs
   route:
     if: >-
       vars.LIGHTHOUSE_AUTOMATION_ENABLED == 'true' &&
       (github.actor == github.repository_owner || github.event_name == 'workflow_run' ||
-       (github.event_name == 'workflow_dispatch' && github.actor == 'github-actions[bot]' && inputs.stage == 'implement' && inputs.after_run != '')) &&
+       (github.event_name == 'workflow_dispatch' && github.actor == 'github-actions[bot]' && ((inputs.after_run != '' && ((inputs.stage == 'implement' && inputs.workflow != 'product-change') || inputs.workflow == 'product-change' || inputs.workflow == 'resume-product')) || (inputs.stage == 'triage' && inputs.epic_parent != '' && inputs.epic_run != '')))) &&
       (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_run' ||
         (github.event_name == 'issues' && (github.event.label.name == 'triage' || github.event.label.name == 'refine' || github.event.label.name == 'propose' || github.event.label.name == 'implement' || (github.event.action == 'unlabeled' && github.event.label.name == 'future'))) ||
        github.event_name == 'issue_comment' || github.event_name == 'pull_request_review' || github.event_name == 'pull_request_review_comment')
+    concurrency:
+      group: lighthouse-route-${{ github.event_name }}-${{ github.event.comment.id || github.event.review.id || github.run_id }}
+      cancel-in-progress: false
+      queue: max
     runs-on: ubuntu-24.04
     permissions:
       actions: read
@@ -109,6 +148,7 @@ jobs:
     outputs:
       run: ${{ steps.route.outputs.run }}
       issue: ${{ steps.route.outputs.issue }}
+      epic_parent: ${{ steps.route.outputs.epic_parent }}
       stage: ${{ steps.route.outputs.stage }}
       worker: ${{ steps.route.outputs.worker }}
     steps:
@@ -125,6 +165,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           LIGHTHOUSE_COMPLETION_ENABLED: true
+          LIGHTHOUSE_EPIC_ENABLED: ${{ vars.LIGHTHOUSE_EPIC_ENABLED }}
           LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: ${{ env.LIGHTHOUSE_PRODUCT_CHANGE_ENABLED }}
         run: node src/packages/sdlc/src/issue-actions.mjs route
   dispatch:
@@ -132,7 +173,7 @@ jobs:
     needs: route
     if: needs.route.outputs.run == 'true'
     concurrency:
-      group: lighthouse-dispatch-${{ needs.route.outputs.issue }}
+      group: lighthouse-issue-${{ needs.route.outputs.epic_parent || needs.route.outputs.issue }}
       cancel-in-progress: false
       queue: max
     runs-on: ubuntu-24.04
@@ -143,6 +184,9 @@ jobs:
       pull-requests: read
     env:
       LIGHTHOUSE_ISSUE: ${{ needs.route.outputs.issue }}
+      LIGHTHOUSE_EPIC_PARENT: ${{ needs.route.outputs.epic_parent }}
+      LIGHTHOUSE_EPIC_ENABLED: ${{ vars.LIGHTHOUSE_EPIC_ENABLED }}
+      LIGHTHOUSE_EPIC_CAPACITY: ${{ vars.LIGHTHOUSE_EPIC_CAPACITY }}
       LIGHTHOUSE_STAGE: ${{ needs.route.outputs.stage }}
       LIGHTHOUSE_WORKER: ${{ needs.route.outputs.worker }}
     steps:

package/workflows/lighthouse-sdlc-triage.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2ef374e6036e86ca382e1352ebbbe6367c0836d172b705f4fe450d24ad7921f7","body_hash":"b6819b09222b408b8140fdc320e7270d45149ccb70442e528ef4f0ffa86e985c","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"00b2d57d1b7519c4eeb8f10176673c2f626856b7050d2c6f41377d67866ba7b0","body_hash":"b6819b09222b408b8140fdc320e7270d45149ccb70442e528ef4f0ffa86e985c","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -69,6 +69,10 @@ on:
         description: Authenticated owner admission receipt
         required: true
         type: string
+      epic-parent:
+        description: Authenticated parent issue for shared epic serialization
+        required: false
+        type: string
       issue:
         description: Source issue
         required: true
@@ -79,7 +83,7 @@ permissions: {}
 
 concurrency:
   cancel-in-progress: false
-  group: lighthouse-issue-${{ inputs.issue }}
+  group: ${{ inputs.epic-parent && format('lighthouse-epic-child-{0}', inputs.issue) || format('lighthouse-issue-{0}', inputs.issue) }}
   queue: max
 
 run-name: "triage #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
@@ -1221,6 +1225,12 @@ jobs:
       actions: read
       contents: read
       issues: write
+      pull-requests: read
+    concurrency:
+      cancel-in-progress: false
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-prepare-{0}', github.run_id) }}
+      queue: max
+
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     outputs:
@@ -1262,19 +1272,28 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
 
   publish:
     name: Validate, publish and release
     needs:
+      - activation
       - agent
+      - pre_activation
       - prepare
     if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     # Permissions for the publish job (workflow permissions default to none).
     permissions:
-      actions: read
+      actions: write
       contents: read
       issues: write
+      pull-requests: read
+    concurrency:
+      cancel-in-progress: false
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-publish-{0}', github.run_id) }}
+      queue: max
+
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     steps:
@@ -1319,3 +1338,11 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_ACTIVATION_RESULT: ${{ needs.activation.result }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PRE_ACTIVATION_RESULT: ${{ needs.pre_activation.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
+      - name: Request the verified product prerequisite
+        run: node src/packages/sdlc/src/issue-actions.mjs continue-product-gap
+        env:
+          GH_TOKEN: ${{ github.token }}