@lumenflow/cli 4.24.0 → 5.0.1

package/packs/software-delivery/manifest.yaml

@@ -8,9 +8,117 @@ tools:
   - name: wu:block
     entry: tool-impl/wu-lifecycle-tools.ts#wuBlockTool
     permission: write
-    required_scopes:
+    required_scopes: &softwareDeliveryWriteScopes
       - type: path
-        pattern: '**'
+        pattern: .changeset/**
+        access: write
+      - type: path
+        pattern: .claude/**
+        access: write
+      - type: path
+        pattern: .codex/**
+        access: write
+      - type: path
+        pattern: .cursor/**
+        access: write
+      - type: path
+        pattern: .github/**
+        access: write
+      - type: path
+        pattern: .git/**
+        access: write
+      - type: path
+        pattern: .husky/**
+        access: write
+      - type: path
+        pattern: .lumenflow/**
+        access: write
+      - type: path
+        pattern: .vercel/**
+        access: write
+      - type: path
+        pattern: .windsurf/**
+        access: write
+      - type: path
+        pattern: apps/**
+        access: write
+      - type: path
+        pattern: docs/**
+        access: write
+      - type: path
+        pattern: packages/**
+        access: write
+      - type: path
+        pattern: scripts/**
+        access: write
+      - type: path
+        pattern: tools/**
+        access: write
+      - type: path
+        pattern: worktrees/**
+        access: write
+      - type: path
+        pattern: .gitignore
+        access: write
+      - type: path
+        pattern: .npmrc
+        access: write
+      - type: path
+        pattern: LUMENFLOW.md
+        access: write
+      - type: path
+        pattern: README.md
+        access: write
+      - type: path
+        pattern: package.json
+        access: write
+      - type: path
+        pattern: pnpm-lock.yaml
+        access: write
+      - type: path
+        pattern: pnpm-workspace.yaml
+        access: write
+      - type: path
+        pattern: turbo.json
+        access: write
+      - type: path
+        pattern: workspace.yaml
+        access: write
+      - type: path
+        pattern: '*.cjs'
+        access: write
+      - type: path
+        pattern: '*.js'
+        access: write
+      - type: path
+        pattern: '*.json'
+        access: write
+      - type: path
+        pattern: '*.md'
+        access: write
+      - type: path
+        pattern: '*.mjs'
+        access: write
+      - type: path
+        pattern: '*.sh'
+        access: write
+      - type: path
+        pattern: '*.toml'
+        access: write
+      - type: path
+        pattern: '*.ts'
+        access: write
+      - type: path
+        pattern: '*.tsx'
+        access: write
+      - type: path
+        pattern: '*.txt'
+        access: write
+      - type: path
+        pattern: '*.yaml'
+        access: write
+      - type: path
+        pattern: '*.yml'
         access: write
   - name: wu:brief
     entry: tool-impl/wu-lifecycle-tools.ts#wuBriefTool
@@ -22,38 +130,23 @@ tools:
   - name: wu:claim
     entry: tool-impl/wu-lifecycle-tools.ts#wuClaimTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:cleanup
     entry: tool-impl/wu-lifecycle-tools.ts#wuCleanupTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:create
     entry: tool-impl/wu-lifecycle-tools.ts#wuCreateTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:delegate
     entry: tool-impl/wu-lifecycle-tools.ts#wuDelegateTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:delete
     entry: tool-impl/wu-lifecycle-tools.ts#wuDeleteTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:deps
     entry: tool-impl/wu-lifecycle-tools.ts#wuDepsTool
     permission: read
@@ -64,17 +157,11 @@ tools:
   - name: wu:done
     entry: tool-impl/wu-lifecycle-tools.ts#wuDoneTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:edit
     entry: tool-impl/wu-lifecycle-tools.ts#wuEditTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:infer-lane
     entry: tool-impl/runtime-native-tools.ts#wuInferLaneTool
     permission: read
@@ -92,52 +179,31 @@ tools:
   - name: wu:prep
     entry: tool-impl/wu-lifecycle-tools.ts#wuPrepTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:proto
     entry: tool-impl/wu-lifecycle-tools.ts#wuProtoTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:prune
     entry: tool-impl/wu-lifecycle-tools.ts#wuPruneTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:recover
     entry: tool-impl/wu-lifecycle-tools.ts#wuRecoverTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:release
     entry: tool-impl/wu-lifecycle-tools.ts#wuReleaseTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:repair
     entry: tool-impl/wu-lifecycle-tools.ts#wuRepairTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:sandbox
     entry: tool-impl/wu-lifecycle-tools.ts#wuSandboxTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:status
     entry: tool-impl/wu-lifecycle-tools.ts#wuStatusTool
     permission: read
@@ -148,17 +214,11 @@ tools:
   - name: wu:unblock
     entry: tool-impl/wu-lifecycle-tools.ts#wuUnblockTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:unlock-lane
     entry: tool-impl/wu-lifecycle-tools.ts#wuUnlockLaneTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: wu:validate
     entry: tool-impl/wu-lifecycle-tools.ts#wuValidateTool
     permission: read
@@ -170,17 +230,11 @@ tools:
   - name: mem:checkpoint
     entry: tool-impl/memory-tools.ts#memCheckpointTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: mem:cleanup
     entry: tool-impl/memory-tools.ts#memCleanupTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: mem:context
     entry: tool-impl/memory-tools.ts#memContextTool
     permission: read
@@ -191,17 +245,11 @@ tools:
   - name: mem:create
     entry: tool-impl/memory-tools.ts#memCreateTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: mem:delete
     entry: tool-impl/memory-tools.ts#memDeleteTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: mem:export
     entry: tool-impl/memory-tools.ts#memExportTool
     permission: read
@@ -219,10 +267,7 @@ tools:
   - name: mem:init
     entry: tool-impl/memory-tools.ts#memInitTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: mem:ready
     entry: tool-impl/memory-tools.ts#memReadyTool
     permission: read
@@ -233,24 +278,15 @@ tools:
   - name: mem:recover
     entry: tool-impl/memory-tools.ts#memRecoverTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: mem:signal
     entry: tool-impl/memory-tools.ts#memSignalTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: mem:start
     entry: tool-impl/memory-tools.ts#memStartTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: mem:summarize
     entry: tool-impl/memory-tools.ts#memSummarizeTool
     permission: read
@@ -261,39 +297,28 @@ tools:
   - name: mem:triage
     entry: tool-impl/memory-tools.ts#memTriageTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   # initiative:*
   - name: initiative:add-wu
     entry: tool-impl/initiative-orchestration-tools.ts#initiativeAddWuTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
+    required_approvals:
+      - software-delivery:remote_mutation
   - name: initiative:bulk-assign
     entry: tool-impl/initiative-orchestration-tools.ts#initiativeBulkAssignTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: initiative:create
     entry: tool-impl/initiative-orchestration-tools.ts#initiativeCreateTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
+    required_approvals:
+      - software-delivery:remote_mutation
   - name: initiative:edit
     entry: tool-impl/initiative-orchestration-tools.ts#initiativeEditTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: initiative:list
     entry: tool-impl/initiative-orchestration-tools.ts#initiativeListTool
     permission: read
@@ -311,10 +336,7 @@ tools:
   - name: initiative:remove-wu
     entry: tool-impl/initiative-orchestration-tools.ts#initiativeRemoveWuTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: initiative:status
     entry: tool-impl/initiative-orchestration-tools.ts#initiativeStatusTool
     permission: read
@@ -322,6 +344,7 @@ tools:
       - type: path
         pattern: '**'
         access: read
+    required_approvals: []
   # lane:*
   - name: lane:health
     entry: tool-impl/runtime-native-tools.ts#laneHealthTool
@@ -330,13 +353,13 @@ tools:
       - type: path
         pattern: '**'
         access: read
+    required_approvals: []
   - name: lane:suggest
     entry: tool-impl/runtime-native-tools.ts#laneSuggestTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
+    required_approvals:
+      - software-delivery:remote_mutation
   # flow:*
   - name: flow:bottlenecks
     entry: tool-impl/flow-metrics-tools.ts#flowBottlenecksTool
@@ -352,29 +375,27 @@ tools:
       - type: path
         pattern: '**'
         access: read
+    required_approvals: []
   # gate:*
   - name: gates
     entry: tool-impl/wu-lifecycle-tools.ts#gatesTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
+    required_approvals: []
+  - name: gates:docs
+    entry: tool-impl/wu-lifecycle-tools.ts#gatesDocsTool
+    permission: write
+    required_scopes: *softwareDeliveryWriteScopes
+    required_approvals: []
   # file:*
   - name: file:delete
     entry: tool-impl/runtime-native-tools.ts#fileDeleteTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: file:edit
     entry: tool-impl/runtime-native-tools.ts#fileEditTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: file:read
     entry: tool-impl/runtime-native-tools.ts#fileReadTool
     permission: read
@@ -385,18 +406,12 @@ tools:
   - name: file:write
     entry: tool-impl/runtime-native-tools.ts#fileWriteTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   # git:*
   - name: git:branch
     entry: tool-impl/runtime-native-tools.ts#gitBranchTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: git:diff
     entry: tool-impl/runtime-native-tools.ts#gitDiffTool
     permission: read
@@ -429,24 +444,15 @@ tools:
   - name: agent:log-issue
     entry: tool-impl/agent-tools.ts#agentLogIssueTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: agent:session
     entry: tool-impl/agent-tools.ts#agentSessionTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: agent:session-end
     entry: tool-impl/agent-tools.ts#agentSessionEndTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   # orchestrate:*
   - name: orchestrate:init-status
     entry: tool-impl/initiative-orchestration-tools.ts#orchestrateInitStatusTool
@@ -458,10 +464,7 @@ tools:
   - name: orchestrate:initiative
     entry: tool-impl/initiative-orchestration-tools.ts#orchestrateInitiativeTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: orchestrate:monitor
     entry: tool-impl/initiative-orchestration-tools.ts#orchestrateMonitorTool
     permission: read
@@ -473,17 +476,11 @@ tools:
   - name: state:bootstrap
     entry: tool-impl/runtime-native-tools.ts#stateBootstrapTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: state:cleanup
     entry: tool-impl/runtime-native-tools.ts#stateCleanupTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: state:doctor
     entry: tool-impl/runtime-native-tools.ts#stateDoctorTool
     permission: read
@@ -495,46 +492,32 @@ tools:
   - name: plan:create
     entry: tool-impl/initiative-orchestration-tools.ts#planCreateTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
+    required_approvals:
+      - software-delivery:remote_mutation
   - name: plan:edit
     entry: tool-impl/initiative-orchestration-tools.ts#planEditTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: plan:link
     entry: tool-impl/initiative-orchestration-tools.ts#planLinkTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: plan:promote
     entry: tool-impl/initiative-orchestration-tools.ts#planPromoteTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
+    required_approvals:
+      - software-delivery:remote_mutation
   # setup:*
   - name: backlog:prune
     entry: tool-impl/runtime-native-tools.ts#backlogPruneTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: cloud:connect
     entry: tool-impl/initiative-orchestration-tools.ts#cloudConnectTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: config:get
     entry: tool-impl/runtime-native-tools.ts#configGetTool
     permission: read
@@ -545,10 +528,7 @@ tools:
   - name: config:set
     entry: tool-impl/runtime-native-tools.ts#configSetTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: delegation:list
     entry: tool-impl/initiative-orchestration-tools.ts#delegationListTool
     permission: read
@@ -559,10 +539,7 @@ tools:
   - name: docs:sync
     entry: tool-impl/initiative-orchestration-tools.ts#docsSyncTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: init:plan
     entry: tool-impl/initiative-orchestration-tools.ts#initPlanTool
     permission: read
@@ -573,10 +550,7 @@ tools:
   - name: lumenflow
     entry: tool-impl/initiative-orchestration-tools.ts#lumenflowTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: lumenflow:doctor
     entry: tool-impl/initiative-orchestration-tools.ts#lumenflowDoctorTool
     permission: read
@@ -587,24 +561,15 @@ tools:
   - name: lumenflow:integrate
     entry: tool-impl/initiative-orchestration-tools.ts#lumenflowIntegrateTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: lumenflow:release
     entry: tool-impl/initiative-orchestration-tools.ts#lumenflowReleaseTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: lumenflow:upgrade
     entry: tool-impl/initiative-orchestration-tools.ts#lumenflowUpgradeTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: metrics
     entry: tool-impl/flow-metrics-tools.ts#metricsTool
     permission: read
@@ -629,17 +594,11 @@ tools:
   - name: signal:cleanup
     entry: tool-impl/runtime-native-tools.ts#signalCleanupTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: sync:templates
     entry: tool-impl/initiative-orchestration-tools.ts#syncTemplatesTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
   - name: validate
     entry: tool-impl/runtime-native-tools.ts#validateTool
     permission: read
@@ -685,10 +644,7 @@ tools:
   - name: workspace:init
     entry: tool-impl/initiative-orchestration-tools.ts#workspaceInitTool
     permission: write
-    required_scopes:
-      - type: path
-        pattern: '**'
-        access: write
+    required_scopes: *softwareDeliveryWriteScopes
 policies:
   - id: software-delivery.gate.format
     trigger: on_completion
@@ -710,3 +666,27 @@ evidence_types:
 state_aliases:
   active: in_progress
 lane_templates: []
+# WU-2728 (INIT-060, ADR-013): software-delivery pack emits 15 namespaced
+# event kinds on a single channel (software-delivery). All kinds are
+# ephemeral per ADR-013 §4 backpressure split; fail-silent when
+# control_plane.org_id is unset (WU-2643 precedent).
+emitted_event_kinds:
+  - software-delivery:gate_started
+  - software-delivery:gate_passed
+  - software-delivery:gate_failed
+  - software-delivery:co_change_rule_fired
+  - software-delivery:conditional_command_fired
+  - software-delivery:lane_wip_breached
+  - software-delivery:lane_locked
+  - software-delivery:lane_unlocked
+  - software-delivery:lane_suggestion_emitted
+  - software-delivery:initiative_created
+  - software-delivery:initiative_closed
+  - software-delivery:initiative_phase_advanced
+  - software-delivery:plan_created
+  - software-delivery:plan_linked
+  - software-delivery:plan_promoted
+subscribed_event_kinds: []
+required_approvals: []
+surfaces_required:
+  - http