@juangcarmona/lighthouse-sdlc 0.17.1 → 0.18.1

package/workflows/lighthouse-sdlc-apply-product-change.md

@@ -29,7 +29,7 @@ on:
         required: true
         type: string
   needs: [prepare]
-if: needs.prepare.outputs.eligible == 'true'
+if: "false"
 runs-on: [self-hosted, linux, lighthouse-workflow]
 runs-on-slim: ubuntu-24.04
 timeout-minutes: 30
@@ -62,7 +62,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-      issues: read
+      issues: write
       pull-requests: read
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
@@ -92,6 +92,30 @@ jobs:
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/product-apply.json
           if-no-files-found: error
           retention-days: 14
+      - name: Check out the approved private source without persisted credentials
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ steps.prepare.outputs.head }}
+          path: product-source
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Preserve the approved source for the credential-free provider
+        if: steps.prepare.outputs.eligible == 'true'
+        env:
+          APPROVED_HEAD: ${{ steps.prepare.outputs.head }}
+        run: |
+          test "$(git -C product-source rev-parse HEAD)" = "$APPROVED_HEAD"
+          if git -C product-source config --local --name-only --get-regexp '^http\..*\.extraheader$' >/dev/null; then exit 1; fi
+          tar -czf "$RUNNER_TEMP/lighthouse-product-source.tar.gz" -C product-source .
+      - name: Upload the approved source
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-product-apply-source-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-product-source.tar.gz
+          if-no-files-found: error
+          retention-days: 14
   apply:
     name: Apply with the pinned ProductShape provider
     needs: [prepare]
@@ -99,10 +123,13 @@ jobs:
     runs-on: ubuntu-24.04
     permissions: {}
     steps:
-      - uses: actions/checkout@v5
+      - name: Load the approved source without credentials
+        uses: actions/download-artifact@v8
         with:
-          persist-credentials: false
-          ref: ${{ needs.prepare.outputs.head }}
+          name: lighthouse-product-apply-source-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/product-source
+      - name: Restore the approved source
+        run: tar -xzf "$RUNNER_TEMP/product-source/lighthouse-product-source.tar.gz" -C "$GITHUB_WORKSPACE"
       - uses: actions/checkout@v5
         with:
           repository: juangcarmona/lighthouse
@@ -113,6 +140,7 @@ jobs:
         with:
           node-version: 24
       - name: Install provider packages without credentials
+        working-directory: .lighthouse-harness
         run: |
           npm ci --ignore-scripts
           npm install --no-save --package-lock=false --ignore-scripts @prodshape/integration-openspec@0.6.6
@@ -133,13 +161,20 @@ jobs:
             ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/affected-citations.json
           if-no-files-found: error
           retention-days: 30
+      - name: Preserve the bounded apply proof
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-product-apply-proof-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/apply-proof.json
+          if-no-files-found: error
+          retention-days: 30
   publish:
     name: Recheck and publish provider output
     needs: [prepare, apply]
     if: always() && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     permissions:
-      actions: read
+      actions: write
       contents: write
       issues: write
       pull-requests: write
@@ -169,6 +204,12 @@ jobs:
         with:
           name: lighthouse-product-apply-result-${{ inputs.issue }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Load the bounded apply proof
+        if: needs.apply.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-product-apply-proof-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Stop when the provider apply did not complete
         if: needs.apply.result != 'success'
         run: exit 1
@@ -176,6 +217,34 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: node src/packages/sdlc/src/issue-actions.mjs product-apply-publish
+  finalize:
+    name: Report an interrupted product apply
+    needs: [prepare, apply, publish]
+    if: always()
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+      LIGHTHOUSE_PREPARE_RESULT: ${{ needs.prepare.result }}
+      LIGHTHOUSE_APPLY_RESULT: ${{ needs.apply.result }}
+      LIGHTHOUSE_PUBLISH_RESULT: ${{ needs.publish.result }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Publish the authenticated outcome
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs product-apply-cleanup
 ---
 
 # Apply an approved Product Change

package/workflows/lighthouse-sdlc-apply-review.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"336bd2322457ccac362ef352c4c943c30fbec9436dc66f6068236e5581def067","body_hash":"8151890e19043f86541decb00d0dc86741daec051c004feb7beab27b025e3621","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2e0f36cc4374427b7e70b9fb667e4317a4e885f86a5d3416a8e6a9bdc78ef855","body_hash":"8151890e19043f86541decb00d0dc86741daec051c004feb7beab27b025e3621","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -31,6 +31,7 @@
 #
 # Frontmatter env variables:
 #   - LIGHTHOUSE_DISPATCH_REQUIRED: (main workflow)
+#   - LIGHTHOUSE_EPIC_CAPACITY: (main workflow)
 #   - LIGHTHOUSE_RECOVERY_ENABLED: (main workflow)
 #   - LIGHTHOUSE_WORKER: (main workflow)
 #
@@ -69,6 +70,10 @@ on:
         description: Authenticated router receipt comment ID
         required: true
         type: string
+      epic-parent:
+        description: Authenticated parent issue for shared epic serialization
+        required: false
+        type: string
       issue:
         description: Source issue
         required: true
@@ -79,13 +84,14 @@ permissions: {}
 
 concurrency:
   cancel-in-progress: false
-  group: lighthouse-issue-${{ inputs.issue }}
+  group: ${{ inputs.epic-parent && format('lighthouse-epic-child-{0}', inputs.issue) || format('lighthouse-issue-{0}', inputs.issue) }}
   queue: max
 
 run-name: "apply-review #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
 
 env:
   LIGHTHOUSE_DISPATCH_REQUIRED: "true"
+  LIGHTHOUSE_EPIC_CAPACITY: ${{ vars.LIGHTHOUSE_EPIC_CAPACITY }}
   LIGHTHOUSE_RECOVERY_ENABLED: ${{ vars.LIGHTHOUSE_RECOVERY_ENABLED }}
   LIGHTHOUSE_WORKER: apply-review
   OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.GH_AW_DEFAULT_OTLP_ENDPOINT || vars.GH_AW_DEFAULT_OTLP_ENDPOINT }}
@@ -1232,6 +1238,11 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
+    concurrency:
+      cancel-in-progress: false
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-prepare-{0}', github.run_id) }}
+      queue: max
+
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     outputs:
@@ -1274,6 +1285,7 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
 
   publish:
     name: Validate, publish and release
@@ -1288,6 +1300,11 @@ jobs:
       contents: write
       issues: write
       pull-requests: write
+    concurrency:
+      cancel-in-progress: false
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-publish-{0}', github.run_id) }}
+      queue: max
+
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     steps:
@@ -1329,8 +1346,22 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs publish
         env:
           GH_TOKEN: ${{ github.token }}
+      - name: Preserve the publication receipt
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          if-no-files-found: ignore
+          name: lighthouse-implement-publication-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/published-pr.json
+          retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '14' }}
       - name: Release the issue reservation
         if: always()
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
+      - name: Request the verified product prerequisite
+        run: node src/packages/sdlc/src/issue-actions.mjs continue-product-gap
+        env:
+          GH_TOKEN: ${{ github.token }}

package/workflows/lighthouse-sdlc-apply-review.md

@@ -4,7 +4,7 @@ name: apply review
 description: Apply authorized feedback to the existing proposal or implementation PR.
 run-name: "apply-review #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
 concurrency:
-  group: lighthouse-issue-${{ inputs.issue }}
+  group: ${{ inputs.epic-parent && format('lighthouse-epic-child-{0}', inputs.issue) || format('lighthouse-issue-{0}', inputs.issue) }}
   cancel-in-progress: false
   queue: max
   job-discriminator: ${{ github.run_id }}
@@ -21,6 +21,10 @@ on:
         description: Authenticated router receipt comment ID
         required: true
         type: string
+      epic-parent:
+        description: Authenticated parent issue for shared epic serialization
+        required: false
+        type: string
   needs: [prepare]
 if: needs.prepare.outputs.eligible == 'true'
 runs-on: [self-hosted, linux, lighthouse-workflow]
@@ -28,6 +32,7 @@ runs-on-slim: ubuntu-24.04
 timeout-minutes: 55
 env:
   LIGHTHOUSE_RECOVERY_ENABLED: ${{ vars.LIGHTHOUSE_RECOVERY_ENABLED }}
+  LIGHTHOUSE_EPIC_CAPACITY: ${{ vars.LIGHTHOUSE_EPIC_CAPACITY }}
   LIGHTHOUSE_WORKER: apply-review
   LIGHTHOUSE_DISPATCH_REQUIRED: "true"
 permissions:
@@ -108,6 +113,10 @@ post-steps:
       retention-days: 14
 jobs:
   prepare:
+    concurrency:
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-prepare-{0}', github.run_id) }}
+      cancel-in-progress: false
+      queue: max
     outputs:
       eligible: ${{ steps.prepare.outputs.eligible }}
       source_revision: ${{ steps.prepare.outputs.source_revision }}
@@ -147,8 +156,13 @@ jobs:
         if: failure()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
   publish:
+    concurrency:
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-publish-{0}', github.run_id) }}
+      cancel-in-progress: false
+      queue: max
     name: Validate, publish and release
     needs: [prepare, agent]
     if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
@@ -190,11 +204,25 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: node src/packages/sdlc/src/issue-actions.mjs publish
+      - name: Preserve the publication receipt
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-implement-publication-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/published-pr.json
+          if-no-files-found: ignore
+          retention-days: 14
       - name: Release the issue reservation
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
+      - name: Request the verified product prerequisite
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs continue-product-gap
 ---
 
 # Apply the owner feedback

package/workflows/lighthouse-sdlc-epic.yml

@@ -0,0 +1,79 @@
+# Not installed until child delivery and aggregate publication are connected.
+name: Lighthouse epic reconciliation
+on:
+  workflow_dispatch:
+    inputs:
+      issue:
+        description: Parent issue with an authenticated decomposition plan
+        required: true
+        type: string
+      action:
+        description: Reconcile children, register or review a child PR, or publish the aggregate
+        required: true
+        default: reconcile
+        type: choice
+        options: [reconcile, register-pr, ready-child, accept-child, publish-aggregate, ready-aggregate]
+      child:
+        description: Child issue number for PR registration or acceptance
+        required: false
+        type: string
+      run:
+        description: Child implementation run ID for PR registration
+        required: false
+        type: string
+      pull-request:
+        description: Child PR number for acceptance
+        required: false
+        type: string
+      review:
+        description: Owner approval review ID for acceptance
+        required: false
+        type: string
+      head:
+        description: Approved child PR head SHA
+        required: false
+        type: string
+      base:
+        description: Approved current epic branch SHA
+        required: false
+        type: string
+concurrency:
+  group: lighthouse-issue-${{ inputs.issue }}
+  cancel-in-progress: false
+  queue: max
+permissions:
+  contents: write
+  actions: read
+  issues: write
+  pull-requests: write
+  checks: read
+  statuses: read
+jobs:
+  reconcile:
+    if: vars.LIGHTHOUSE_AUTOMATION_ENABLED == 'true' && vars.LIGHTHOUSE_EPIC_ENABLED == 'true' && github.actor == github.repository_owner
+    runs-on: ubuntu-24.04
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Install the pinned harness
+        run: npm ci --ignore-scripts
+      - name: Reconcile native child issues
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/epic-native.mjs
+      - name: Preserve the epic journal
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-epic-journal-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-epic-${{ github.run_id }}-${{ inputs.issue }}/journal.json
+          if-no-files-found: error
+          retention-days: 14

package/workflows/lighthouse-sdlc-implement.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"82e278c98bc5542041f7a212403e06f63f11ee41ed07f4bd7a8a08695b1e7255","body_hash":"260db41beef59e0a150c7e0ed9fed84f0f724b5aeba94e5d2576d4b203a9d663","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"ff6e07d7f4c98ca08ec7640d649089b6061e48826d943401058a4403bd94dd0d","body_hash":"260db41beef59e0a150c7e0ed9fed84f0f724b5aeba94e5d2576d4b203a9d663","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -31,6 +31,7 @@
 #
 # Frontmatter env variables:
 #   - LIGHTHOUSE_DISPATCH_REQUIRED: (main workflow)
+#   - LIGHTHOUSE_EPIC_CAPACITY: (main workflow)
 #   - LIGHTHOUSE_RECOVERY_ENABLED: (main workflow)
 #   - LIGHTHOUSE_STAGE: (main workflow)
 #
@@ -69,6 +70,10 @@ on:
         description: Authenticated router receipt comment ID
         required: true
         type: string
+      epic-parent:
+        description: Authenticated parent issue for shared epic serialization
+        required: false
+        type: string
       issue:
         description: Source issue
         required: true
@@ -79,13 +84,14 @@ permissions: {}
 
 concurrency:
   cancel-in-progress: false
-  group: lighthouse-issue-${{ inputs.issue }}
+  group: ${{ inputs.epic-parent && format('lighthouse-epic-child-{0}', inputs.issue) || format('lighthouse-issue-{0}', inputs.issue) }}
   queue: max
 
 run-name: "implement #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
 
 env:
   LIGHTHOUSE_DISPATCH_REQUIRED: "true"
+  LIGHTHOUSE_EPIC_CAPACITY: ${{ vars.LIGHTHOUSE_EPIC_CAPACITY }}
   LIGHTHOUSE_RECOVERY_ENABLED: ${{ vars.LIGHTHOUSE_RECOVERY_ENABLED }}
   LIGHTHOUSE_STAGE: implement
   OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.GH_AW_DEFAULT_OTLP_ENDPOINT || vars.GH_AW_DEFAULT_OTLP_ENDPOINT }}
@@ -1231,6 +1237,12 @@ jobs:
       actions: read
       contents: read
       issues: write
+      pull-requests: read
+    concurrency:
+      cancel-in-progress: false
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-prepare-{0}', github.run_id) }}
+      queue: max
+
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     outputs:
@@ -1272,11 +1284,14 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
 
   publish:
     name: Validate, publish and release
     needs:
+      - activation
       - agent
+      - pre_activation
       - prepare
     if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
@@ -1286,6 +1301,11 @@ jobs:
       contents: write
       issues: write
       pull-requests: write
+    concurrency:
+      cancel-in-progress: false
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-publish-{0}', github.run_id) }}
+      queue: max
+
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     steps:
@@ -1327,8 +1347,24 @@ jobs:
         run: node src/packages/sdlc/src/issue-actions.mjs publish
         env:
           GH_TOKEN: ${{ github.token }}
+      - name: Preserve the publication receipt
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          if-no-files-found: ignore
+          name: lighthouse-implement-publication-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/published-pr.json
+          retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '14' }}
       - name: Release the issue reservation
         if: always()
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_ACTIVATION_RESULT: ${{ needs.activation.result }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PRE_ACTIVATION_RESULT: ${{ needs.pre_activation.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
+      - name: Request the verified product prerequisite
+        run: node src/packages/sdlc/src/issue-actions.mjs continue-product-gap
+        env:
+          GH_TOKEN: ${{ github.token }}

package/workflows/lighthouse-sdlc-implement.md

@@ -4,7 +4,7 @@ name: implement
 description: Plan and implement an authorized issue in an isolated workspace and deliver a reviewable PR.
 run-name: "implement #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
 concurrency:
-  group: lighthouse-issue-${{ inputs.issue }}
+  group: ${{ inputs.epic-parent && format('lighthouse-epic-child-{0}', inputs.issue) || format('lighthouse-issue-{0}', inputs.issue) }}
   cancel-in-progress: false
   queue: max
   job-discriminator: ${{ github.run_id }}
@@ -21,6 +21,10 @@ on:
         description: Authenticated router receipt comment ID
         required: true
         type: string
+      epic-parent:
+        description: Authenticated parent issue for shared epic serialization
+        required: false
+        type: string
   needs: [prepare]
 if: needs.prepare.outputs.eligible == 'true'
 runs-on: [self-hosted, linux, lighthouse-workflow]
@@ -28,6 +32,7 @@ runs-on-slim: ubuntu-24.04
 timeout-minutes: 55
 env:
   LIGHTHOUSE_RECOVERY_ENABLED: ${{ vars.LIGHTHOUSE_RECOVERY_ENABLED }}
+  LIGHTHOUSE_EPIC_CAPACITY: ${{ vars.LIGHTHOUSE_EPIC_CAPACITY }}
   LIGHTHOUSE_STAGE: implement
   LIGHTHOUSE_DISPATCH_REQUIRED: "true"
 permissions:
@@ -108,6 +113,10 @@ post-steps:
       retention-days: 14
 jobs:
   prepare:
+    concurrency:
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-prepare-{0}', github.run_id) }}
+      cancel-in-progress: false
+      queue: max
     outputs:
       eligible: ${{ steps.prepare.outputs.eligible }}
       source_revision: ${{ steps.prepare.outputs.source_revision }}
@@ -117,6 +126,7 @@ jobs:
       actions: read
       contents: read
       issues: write
+      pull-requests: read
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
     steps:
@@ -145,10 +155,15 @@ jobs:
         if: failure()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
   publish:
+    concurrency:
+      group: ${{ inputs.epic-parent && format('lighthouse-issue-{0}', inputs.epic-parent) || format('lighthouse-publish-{0}', github.run_id) }}
+      cancel-in-progress: false
+      queue: max
     name: Validate, publish and release
-    needs: [prepare, agent]
+    needs: [prepare, pre_activation, activation, agent]
     if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     permissions:
@@ -188,11 +203,27 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: node src/packages/sdlc/src/issue-actions.mjs publish
+      - name: Preserve the publication receipt
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-implement-publication-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/published-pr.json
+          if-no-files-found: ignore
+          retention-days: 14
       - name: Release the issue reservation
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PRE_ACTIVATION_RESULT: ${{ needs.pre_activation.result }}
+          LIGHTHOUSE_ACTIVATION_RESULT: ${{ needs.activation.result }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
         run: node src/packages/sdlc/src/issue-actions.mjs cleanup
+      - name: Request the verified product prerequisite
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs continue-product-gap
 ---
 
 # Plan and implement the issue

package/workflows/lighthouse-sdlc-integrate.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"7f49111df8257bd180f3ea15a29176a41b68e160acd597a331c8e32a80f0c5cc","body_hash":"71107231af6c0ea2e2f2880e7bfcf90d02e031b1db4c95a2d5b456e934f6f1ed","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a16ef770ce94e692e43480d8f233a7739697a914dc73b618265e41059d7b5f2b","body_hash":"71107231af6c0ea2e2f2880e7bfcf90d02e031b1db4c95a2d5b456e934f6f1ed","compiler_version":"v0.93.2","agent_id":"opencode","engine_versions":{"opencode":"2.1.0"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"}],"mcp_servers":[{"name":"safeoutputs","tools":["noop"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -1264,6 +1264,7 @@ jobs:
         run: node src/packages/sdlc/src/completion-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
 
   publish:
     name: Validate, publish and release
@@ -1339,3 +1340,5 @@ jobs:
         run: node src/packages/sdlc/src/completion-actions.mjs cleanup
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}

package/workflows/lighthouse-sdlc-integrate.md

@@ -137,6 +137,7 @@ jobs:
         if: failure()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_PREPARE_FAILED: "true"
         run: node src/packages/sdlc/src/completion-actions.mjs cleanup
   publish:
     concurrency:
@@ -198,6 +199,8 @@ jobs:
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
+          LIGHTHOUSE_AGENT_RESULT: ${{ needs.agent.result }}
+          LIGHTHOUSE_PUBLISH_STATUS: ${{ job.status }}
         run: node src/packages/sdlc/src/completion-actions.mjs cleanup
 ---