@juangcarmona/lighthouse 0.8.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juangcarmona/lighthouse",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "Lighthouse adoption and verification CLI",
   "repository": {
@@ -20,10 +20,10 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@arcshape/cli": "0.1.4",
+    "@arcshape/cli": "0.1.6",
     "@juangcarmona/lighthouse-ui": "0.2.0",
-    "@prodshape/cli": "0.22.0",
-    "@juangcarmona/lighthouse-sdlc": "0.7.0"
+    "@prodshape/cli": "0.23.0",
+    "@juangcarmona/lighthouse-sdlc": "0.8.0"
   },
   "files": [
     "src/lighthouse.mjs",

package/src/create-dotnet.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, rmdir, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
@@ -9,6 +10,23 @@ const templateRoot = resolve(packageRoot, 'assets/dotnet-template');
 const cliPackage = JSON.parse(await readFile(resolve(packageRoot, 'package.json'), 'utf8'));
 const require = createRequire(import.meta.url);
 const sdlcContract = JSON.parse(await readFile(require.resolve('@juangcarmona/lighthouse-sdlc/contract.json'), 'utf8'));
+const sdlcPackageRoot = dirname(require.resolve('@juangcarmona/lighthouse-sdlc/contract.json'));
+const sdlcWorkflowPaths = [
+  '.github/workflows/lighthouse-sdlc-router.yml',
+  '.github/workflows/lighthouse-sdlc-triage.md',
+  '.github/workflows/lighthouse-sdlc-triage.lock.yml',
+  '.github/workflows/lighthouse-sdlc-refine.md',
+  '.github/workflows/lighthouse-sdlc-refine.lock.yml',
+  '.github/workflows/lighthouse-sdlc-propose.md',
+  '.github/workflows/lighthouse-sdlc-propose.lock.yml',
+  '.github/workflows/lighthouse-sdlc-implement.md',
+  '.github/workflows/lighthouse-sdlc-implement.lock.yml',
+  '.github/workflows/lighthouse-sdlc-integrate.md',
+  '.github/workflows/lighthouse-sdlc-integrate.lock.yml',
+  '.github/workflows/lighthouse-sdlc-review.md',
+  '.github/workflows/lighthouse-sdlc-review.lock.yml',
+  '.github/workflows/shared/lighthouse-sdlc-stage.md',
+];
 const args = process.argv.slice(2);
 const target = args[0] ? resolve(args[0]) : null;
 const name = args.includes('--name') ? args[args.indexOf('--name') + 1] : null;
@@ -90,7 +108,7 @@ try {
     product: name, application: { shape: 'backend', stacks: ['dotnet'] }, profiles: ['dotnet-backend'],
     integrations: { productShape: null, arcShape: null },
     packages: { sdlc: { name: '@juangcarmona/lighthouse-sdlc', version: sdlcContract.version } },
-    managed: ['LIGHTHOUSE.md', 'scripts/lighthouse-guard.mjs', '.husky/commit-msg', '.husky/pre-push', '.github/workflows/lighthouse.yml', '.lighthouse/sdlc.json', '.agents/skills/lighthouse-init/SKILL.md', '.lighthouse/upgrade.json', '.lighthouse/commands.json', 'docs/profiles/dotnet/README.md', 'docs/profiles/dotnet/adoption.md', 'docs/profiles/dotnet/architecture.md', 'docs/profiles/dotnet/guardrails.md', 'docs/profiles/dotnet/practices.md', 'docs/profiles/dotnet/testing-and-development.md', 'docs/profiles/dotnet/use-cases.md', '.agents/skills/lighthouse-dotnet/SKILL.md'],
+    managed: ['LIGHTHOUSE.md', 'scripts/lighthouse-guard.mjs', '.husky/commit-msg', '.husky/pre-push', '.github/workflows/lighthouse.yml', '.lighthouse/sdlc.json', ...sdlcWorkflowPaths, '.agents/skills/lighthouse-init/SKILL.md', '.lighthouse/upgrade.json', '.lighthouse/commands.json', 'docs/profiles/dotnet/README.md', 'docs/profiles/dotnet/adoption.md', 'docs/profiles/dotnet/architecture.md', 'docs/profiles/dotnet/guardrails.md', 'docs/profiles/dotnet/practices.md', 'docs/profiles/dotnet/testing-and-development.md', 'docs/profiles/dotnet/use-cases.md', '.agents/skills/lighthouse-dotnet/SKILL.md'],
     repository: {
       layout: ['src', 'docs', 'infra', 'scripts'], publicSite: { enabled: true },
       conventions: { commits: 'conventional', branchPattern: '^(feat|fix|docs|refactor|test|chore|build|ci|perf|revert)/[1-9]\\d*-[a-z0-9]+(?:-[a-z0-9]+)*$' },
@@ -107,6 +125,14 @@ try {
 
   const initialized = (await import('node:child_process')).spawnSync(process.execPath, [resolve(stage, 'scripts/lighthouse.mjs'), 'init'], { cwd: stage, encoding: 'utf8' });
   if (initialized.status !== 0) throw new Error(initialized.stderr || 'Projection generation failed.');
+  await copy(resolve(sdlcPackageRoot, 'workflows'), resolve(stage, '.github/workflows'));
+  const upgradePath = resolve(stage, '.lighthouse/upgrade.json');
+  const upgrade = JSON.parse(await readFile(upgradePath, 'utf8'));
+  for (const path of sdlcWorkflowPaths) {
+    const content = await readFile(resolve(stage, path), 'utf8');
+    upgrade.files[path] = { hash: createHash('sha256').update(content).digest('hex'), scope: 'sdlc' };
+  }
+  await writeFile(upgradePath, `${JSON.stringify(upgrade, null, 2)}\n`);
   if (existing) await rmdir(target);
   await rename(stage, target);
   process.stdout.write(`Created ${name} in ${target}. Run dotnet restore ${name}.slnx, then npm run verify.\n`);

package/src/lighthouse.mjs

@@ -13,6 +13,7 @@ let sdlcCapabilities;
 let sdlcReconcile;
 let sdlcGithub;
 let sdlcAliases;
+let sdlcEvidence;
 try {
   [sdlcCapabilities, sdlcReconcile, sdlcGithub] = await Promise.all([
     import('@juangcarmona/lighthouse-sdlc/capabilities'),
@@ -21,6 +22,7 @@ try {
   ]);
 } catch { /* Standalone generated starters can run without the optional SDLC package. */ }
 try { sdlcAliases = await import('@juangcarmona/lighthouse-sdlc/aliases'); } catch { /* Older standalone installations may not publish aliases. */ }
+try { sdlcEvidence = await import('@juangcarmona/lighthouse-sdlc/evidence'); } catch { /* Older standalone installations may not publish evidence. */ }
 
 const root = process.cwd();
 const packageRequire = createRequire(import.meta.url);
@@ -38,6 +40,22 @@ const upgradeStatePath = resolve(root, upgradeStateRelative);
 const layout = ['src', 'docs', 'infra', 'scripts'];
 const sdlcPackage = { name: '@juangcarmona/lighthouse-sdlc', version: installedPackageVersion('@juangcarmona/lighthouse-sdlc', 'contract.json') ?? '0.1.0' };
 const uiPackage = { name: '@juangcarmona/lighthouse-ui', version: installedPackageVersion('@juangcarmona/lighthouse-ui', 'DESIGN.md') ?? '0.1.0' };
+const sdlcWorkflowPaths = Object.freeze([
+  '.github/workflows/lighthouse-sdlc-router.yml',
+  '.github/workflows/lighthouse-sdlc-triage.md',
+  '.github/workflows/lighthouse-sdlc-triage.lock.yml',
+  '.github/workflows/lighthouse-sdlc-refine.md',
+  '.github/workflows/lighthouse-sdlc-refine.lock.yml',
+  '.github/workflows/lighthouse-sdlc-propose.md',
+  '.github/workflows/lighthouse-sdlc-propose.lock.yml',
+  '.github/workflows/lighthouse-sdlc-implement.md',
+  '.github/workflows/lighthouse-sdlc-implement.lock.yml',
+  '.github/workflows/lighthouse-sdlc-integrate.md',
+  '.github/workflows/lighthouse-sdlc-integrate.lock.yml',
+  '.github/workflows/lighthouse-sdlc-review.md',
+  '.github/workflows/lighthouse-sdlc-review.lock.yml',
+  '.github/workflows/shared/lighthouse-sdlc-stage.md',
+]);
 const managedPaths = [
   projection,
   'scripts/lighthouse-guard.mjs',
@@ -45,6 +63,7 @@ const managedPaths = [
   '.husky/pre-push',
   '.github/workflows/lighthouse.yml',
   '.lighthouse/sdlc.json',
+  ...sdlcWorkflowPaths,
   '.agents/skills/lighthouse-init/SKILL.md',
   upgradeStateRelative,
   '.lighthouse/commands.json',
@@ -58,13 +77,13 @@ const profileManagedPaths = Object.freeze({
   'mobile-expo': ['docs/profiles/mobile-expo/README.md', 'docs/profiles/mobile-expo/adoption.md', 'docs/profiles/mobile-expo/guardrails.md', 'docs/profiles/mobile-expo/testing.md', '.agents/skills/lighthouse-mobile-expo/SKILL.md'],
   'mobile-maui': ['docs/profiles/mobile-maui/README.md', 'docs/profiles/mobile-maui/adoption.md', 'docs/profiles/mobile-maui/guardrails.md', 'docs/profiles/mobile-maui/testing.md', '.agents/skills/lighthouse-mobile-maui/SKILL.md'],
 });
-const previousManagedPaths = managedPaths.slice(0, -1);
+const previousManagedPaths = [projection, 'scripts/lighthouse-guard.mjs', '.husky/commit-msg', '.husky/pre-push', '.github/workflows/lighthouse.yml', '.lighthouse/sdlc.json', '.agents/skills/lighthouse-init/SKILL.md'];
 const legacyManagedPaths = [projection];
 const preSemanticManagedPaths = [projection, 'scripts/lighthouse-guard.mjs', '.husky/commit-msg', '.husky/pre-push', '.github/workflows/lighthouse.yml', '.lighthouse/sdlc.json', upgradeStateRelative];
 const preSemanticWithoutUpgradePaths = preSemanticManagedPaths.slice(0, -1);
 const supportedProfiles = readProfileCatalog().profiles.map(({ id }) => id);
 const branchPattern = '^(feat|fix|docs|refactor|test|chore|build|ci|perf|revert)/[1-9]\\d*-[a-z0-9]+(?:-[a-z0-9]+)*$';
-const authorityVersions = { productShape: '0.22.0', arcShape: '0.1.4' };
+const authorityVersions = { productShape: '0.23.0', arcShape: '0.1.6' };
 const upgradeSchema = './node_modules/@juangcarmona/lighthouse/assets/schemas/lighthouse-upgrade.schema.json';
 const usage = 'Usage: lighthouse <init|aliases|create-dotnet|profiles|authorities|reconcile|upgrade|capabilities|verify> [--name <product>] [--plan-file <path>] [--profile <profile>] [--scope <harness|sdlc|all>] [--format <text|json>] [--adopt-existing] [--dry-run] [--apply]';
 
@@ -82,7 +101,7 @@ function managedPathsFor(manifest) {
 function upgradeScopesFor(manifest) {
   return {
     harness: [projection, 'scripts/lighthouse-guard.mjs', '.husky/commit-msg', '.husky/pre-push', '.github/workflows/lighthouse.yml', '.agents/skills/lighthouse-init/SKILL.md', ...((manifest?.profiles ?? []).flatMap((profile) => profileManagedPaths[profile] ?? []))],
-    sdlc: ['.lighthouse/sdlc.json', '.lighthouse/commands.json'],
+    sdlc: ['.lighthouse/sdlc.json', '.lighthouse/commands.json', ...sdlcWorkflowPaths],
   };
 }
 
@@ -91,6 +110,18 @@ function packageAsset(packageName, entry) {
   return readFileSync(path, 'utf8');
 }
 
+function sdlcWorkflowFiles() {
+  const files = {};
+  for (const target of sdlcWorkflowPaths) {
+    try {
+      files[target] = packageAsset('@juangcarmona/lighthouse-sdlc', `workflows/${target.slice('.github/workflows/'.length)}`);
+    } catch {
+      return {};
+    }
+  }
+  return files;
+}
+
 function profileAssets(manifest) {
   const assets = {};
   if ((manifest?.profiles ?? []).includes('visual-theme')) {
@@ -425,6 +456,7 @@ function managedFiles(manifest) {
     '.agents/skills/lighthouse-init/SKILL.md': readFileSync(new URL('../assets/skills/init/SKILL.md', import.meta.url), 'utf8'),
   };
   Object.assign(files, profileAssets(manifest));
+  Object.assign(files, sdlcWorkflowFiles());
   const controlPlane = sdlcControlPlane(manifest);
   if (controlPlane) files['.lighthouse/sdlc.json'] = controlPlane;
   files['.lighthouse/commands.json'] = commandAliasProjectionText(commandAliasesProjection());
@@ -1396,6 +1428,9 @@ async function verify(manifest, format = 'text') {
     });
     report.summary.unconfigured = (report.summary.unconfigured ?? 0) + (pending.length ? 1 : 0);
   }
+  const evidenceResult = await verifyEvidenceIndex();
+  report.results.push(evidenceResult);
+  report.summary[evidenceResult.status] = (report.summary[evidenceResult.status] ?? 0) + 1;
   if (format === 'json') {
     console.log(JSON.stringify(report, null, 2));
     if (report.problems.length) process.exitCode = 1;
@@ -1405,6 +1440,72 @@ async function verify(manifest, format = 'text') {
   console.log('Lighthouse manifest, repository boundaries and managed projection are valid.');
 }
 
+async function verifyEvidenceIndex() {
+  const evidencePath = '.lighthouse/evidence/index.json';
+  const result = {
+    id: 'foundation.evidence',
+    owner: '@juangcarmona/lighthouse-sdlc',
+    level: 'recommended',
+    kind: 'hard',
+    verification: 'deterministic',
+    status: 'unconfigured',
+    evidence: [],
+    problems: [],
+    nextAction: `lighthouse-sdlc evidence --build --input <records.json> --output ${evidencePath}`,
+  };
+  if (!(await exists(resolve(root, evidencePath)))) return result;
+  if (!sdlcEvidence) {
+    result.status = 'unavailable';
+    result.problems.push('The installed SDLC package does not expose the evidence contract.');
+    result.nextAction = 'Install a Lighthouse SDLC package that exports the evidence contract.';
+    return result;
+  }
+  let index;
+  try { index = JSON.parse(await readFile(resolve(root, evidencePath), 'utf8')); }
+  catch (error) {
+    result.status = 'failed';
+    result.problems.push(`Cannot read ${evidencePath}: ${error.message}`);
+    result.nextAction = `Repair ${evidencePath} and run lighthouse verify again.`;
+    return result;
+  }
+  const errors = sdlcEvidence.validateEvidenceIndex(index);
+  for (const error of errors) result.problems.push(`${error.field ?? 'index'}: ${error.message}`);
+  const records = [];
+  for (const reference of Array.isArray(index.records) ? index.records : []) {
+    if (!reference || typeof reference !== 'object' || typeof reference.path !== 'string') continue;
+    const path = resolve(root, '.lighthouse/evidence', reference.path);
+    if (!(await exists(path))) {
+      result.problems.push(`Missing evidence record ${reference.path}.`);
+      continue;
+    }
+    try {
+      const content = await readFile(path, 'utf8');
+      const record = JSON.parse(content);
+      for (const error of sdlcEvidence.validateEvidenceRecord(record)) result.problems.push(`${reference.path}: ${error.message}`);
+      const observedHash = createHash('sha256').update(JSON.stringify(record)).digest('hex');
+      if (observedHash !== reference.sha256) result.problems.push(`${reference.path}: SHA-256 does not match the index.`);
+      result.evidence.push({ id: reference.id, path: reference.path, status: record.status, sha256: observedHash });
+      records.push(record);
+    } catch (error) {
+      result.problems.push(`${reference.path}: ${error.message}`);
+    }
+  }
+  if (!errors.length && records.length === (index.records ?? []).length) {
+    const rebuilt = sdlcEvidence.buildEvidenceIndex(records, {
+      indexId: index.indexId,
+      runId: index.runId,
+      repository: index.repository,
+      revision: index.revision,
+      subjects: (index.coverage ?? []).map((item) => item.subject),
+      recordPaths: Object.fromEntries((index.records ?? []).map((item) => [item.id, item.path])),
+    });
+    if (rebuilt.errors.length || JSON.stringify(rebuilt.index?.coverage) !== JSON.stringify(index.coverage)) result.problems.push('Evidence coverage does not match the referenced records; rebuild the index.');
+  }
+  result.status = result.problems.length ? 'failed' : 'passed';
+  result.nextAction = result.problems.length ? `Repair ${evidencePath} or its records, then run lighthouse verify again.` : null;
+  return result;
+}
+
 async function profiles(manifest, format = 'text') {
   const composition = composeProfiles(readProfileCatalog(), manifest);
   if (format === 'json') {