@macedon-technologies/batman 1.17.2 → 1.18.0

package/models/@swamp/software-factory/platform-common-factory.yaml

@@ -0,0 +1,240 @@
+type: '@swamp/software-factory'
+typeVersion: 2026.06.24.1
+id: 7e207e5d-7067-4286-9a84-ca8330a26f53
+name: platform-common-factory
+version: 1
+tags: {}
+reports:
+  require:
+    - name: "@swamp/software-factory/work-item-summary"
+      methods: [summary]
+globalArguments:
+  stages:
+    - id: intake
+      initial: true
+      description: >-
+        Fetch the GitHub issue for this work item (workItem is the bare
+        issue number) and record its context.
+      work:
+        mode: interactive
+        systemPrompt: >-
+          Fetch the GitHub issue numbered ${{ self.workItem }} for
+          macedon-technologies/platform-common using the platform-common-issues model
+          (list_issues, then swamp data query filtered by number — see the
+          platform-common-issues data), and record the issue-context artifact.
+      artifacts:
+        - name: issue-context
+          schema:
+            type: object
+            required: [number, title, url]
+            properties:
+              number: { type: integer }
+              title: { type: string, minLength: 1 }
+              body: { type: string }
+              url: { type: string, minLength: 1 }
+              labels: { type: array, items: { type: string } }
+      transitions:
+        - name: submit
+          to: planning
+          gates:
+            - type: artifact-exists
+              config: { artifact: issue-context }
+
+    - id: planning
+      description: >-
+        Turn the issue into a real OpenSpec change (proposal, design,
+        specs, tasks) — OpenSpec's task list is the plan, not a
+        freeform artifact.
+      work:
+        mode: interactive
+        systemPrompt: >-
+          Using the recorded issue-context artifact, use the
+          openspec-propose skill to create a complete OpenSpec change
+          (proposal.md, design.md, specs with deltas, tasks.md) for this
+          work item under openspec/changes/<changeSlug>/ — do not write a
+          freeform plan instead of this. Then record the plan artifact
+          with the change's slug and a one-line summary.
+      artifacts:
+        - name: plan
+          schema:
+            type: object
+            required: [changeSlug, summary]
+            properties:
+              changeSlug: { type: string, minLength: 1 }
+              summary: { type: string, minLength: 1 }
+      transitions:
+        - name: submit
+          to: openspec-plan-verify
+          gates:
+            - type: artifact-exists
+              config: { artifact: plan }
+
+    - id: openspec-plan-verify
+      description: >-
+        Verify the OpenSpec change is real and well-formed (not just an
+        artifact claiming one exists) before implementation starts.
+      work:
+        mode: workflow
+        workflow:
+          name: openspec-plan-verify
+          inputs:
+            changeSlug: '${{ data.latest(self.name, "artifact-plan").payload.changeSlug }}'
+        resultEvidence: plan-verify-run
+      transitions:
+        - name: pass
+          to: implementing
+          gates:
+            - type: workflow-succeeded
+              config: { workflow: openspec-plan-verify }
+        - name: fail
+          to: planning
+          gates:
+            - type: evidence-recorded
+              config: { name: plan-verify-run, requireField: { status: failed } }
+
+    - id: implementing
+      description: Implement the OpenSpec change's tasks on a branch.
+      work:
+        mode: interactive
+        systemPrompt: >-
+          Use the openspec-apply-change skill against the change recorded
+          in the plan artifact's changeSlug — work through its tasks.md
+          one task at a time, checking each off (`- [ ]` -> `- [x]`) as
+          you complete it, until every task is done. Commit the work on a
+          feature branch. Record the change-summary artifact and the
+          change-request evidence (branch name and head commit sha — no
+          PR yet, that happens after pre-PR verification passes).
+      artifacts:
+        - name: change-summary
+          schema:
+            type: object
+            required: [summary, headSha]
+            properties:
+              summary: { type: string, minLength: 1 }
+              headSha: { type: string, minLength: 7 }
+      evidence:
+        - name: change-request
+          schema:
+            type: object
+            required: [branch, headSha]
+            properties:
+              branch: { type: string, minLength: 1 }
+              headSha: { type: string, minLength: 7 }
+              url: { type: string }
+      transitions:
+        - name: submit
+          to: openspec-tasks-verify
+          gates:
+            - type: artifact-exists
+              config: { artifact: change-summary }
+            - type: evidence-recorded
+              config: { name: change-request }
+
+    - id: openspec-tasks-verify
+      description: >-
+        Verify every task in the OpenSpec change is actually checked off
+        before pre-PR verification runs.
+      work:
+        mode: workflow
+        workflow:
+          name: openspec-tasks-verify
+          inputs:
+            changeSlug: '${{ data.latest(self.name, "artifact-plan").payload.changeSlug }}'
+        resultEvidence: tasks-verify-run
+      transitions:
+        - name: pass
+          to: pre-pr-verify
+          gates:
+            - type: workflow-succeeded
+              config: { workflow: openspec-tasks-verify }
+        - name: fail
+          to: implementing
+          gates:
+            - type: evidence-recorded
+              config: { name: tasks-verify-run, requireField: { status: failed } }
+
+    - id: pre-pr-verify
+      description: >-
+        Pre-PR verification: build/synth/test/lint plus the architecture
+        rule registry, run before the PR is opened rather than relying on
+        CI after the fact.
+      work:
+        mode: workflow
+        workflow:
+          name: pre-pr-verify
+          inputs:
+            commit: '${{ data.latest(self.name, "evidence-change-request").payload.headSha }}'
+            branch: '${{ data.latest(self.name, "evidence-change-request").payload.branch }}'
+        resultEvidence: verify-run
+      transitions:
+        - name: pass
+          to: open-pr
+          gates:
+            - type: workflow-succeeded
+              config: { workflow: pre-pr-verify }
+        - name: fail
+          to: implementing
+          gates:
+            - type: evidence-recorded
+              config: { name: verify-run, requireField: { status: failed } }
+
+    - id: open-pr
+      description: Open the pull request now that pre-PR verification has passed.
+      work:
+        mode: interactive
+        systemPrompt: >-
+          Before opening the PR, fetch the real pre-pr-verify attestation
+          with `swamp data get --workflow pre-pr-verify
+          report-swamp-verification-attestation --json` and include its
+          `content` verbatim (as a markdown block, e.g. under a "Pre-PR
+          verification" heading) in the PR body — never just assert in
+          prose that checks passed. Also fetch this same run's manifest step
+          output (`swamp data query 'modelName == "platform-common-shell-manifest" &&
+          name == "result"' --select attributes.stdout --json`, take the
+          latest) and append it to the PR body as
+          `<!-- attestation-manifest {"commit": "<headSha>", "status":
+          "succeeded", ...the manifest step's JSON, spread in...} -->` — an
+          HTML comment so it's invisible when rendered but still present in
+          the raw body text verify-attestation.yml reads via the GitHub API.
+          Also fetch the plan artifact's changeSlug and include an explicit
+          "OpenSpec change" line in the PR body naming it and its path
+          (`openspec/changes/<changeSlug>/`) — every PR the factory opens
+          must call out which OpenSpec change(s) drove the session, not
+          just imply it. If planning cycled through more than one change
+          (a rework loop produced a new changeSlug), list every distinct
+          changeSlug recorded across the run's plan artifact versions, not
+          only the latest. Then call platform-common-pr's openPr method
+          (repo=macedon-technologies/platform-common, head=<the branch recorded in
+          change-request evidence>, base=main, dryRun=false), with
+          title/body referencing the intake stage's issue number, the
+          OpenSpec change(s), the attestation block, and the manifest
+          comment, then record the pr-opened evidence with the returned PR
+          url and number.
+      evidence:
+        - name: pr-opened
+          schema:
+            type: object
+            required: [url, number]
+            properties:
+              url: { type: string, minLength: 1 }
+              number: { type: integer }
+      transitions:
+        - name: submit
+          to: done
+          gates:
+            - type: evidence-recorded
+              config: { name: pr-opened }
+
+    - id: done
+      terminal: true
+
+    - id: aborted
+      terminal: true
+
+  globalTransitions:
+    - name: abort
+      to: aborted
+      gates:
+        - type: human-approval
+          config: { id: abort-confirmation }
+methods: {}

package/models/@webframp/github/platform-common-issues.yaml

@@ -0,0 +1,8 @@
+type: '@webframp/github'
+typeVersion: 2026.08.28.1
+id: e2014176-817c-4d45-9ca6-67646b1a9500
+name: platform-common-issues
+version: 1
+tags: {}
+globalArguments: {}
+methods: {}

package/models/command/shell/platform-common-shell-architecture.yaml

@@ -0,0 +1,8 @@
+type: command/shell
+typeVersion: 2026.02.09.1
+id: a8146f72-fe38-466c-9216-ea1ecefff400
+name: platform-common-shell-architecture
+version: 1
+tags: {}
+globalArguments: {}
+methods: {}

package/models/command/shell/platform-common-shell-manifest.yaml

@@ -0,0 +1,8 @@
+type: command/shell
+typeVersion: 2026.02.09.1
+id: a17cfd88-712b-4fe6-a146-4a1c3a9b4ca5
+name: platform-common-shell-manifest
+version: 1
+tags: {}
+globalArguments: {}
+methods: {}

package/models/command/shell/platform-common-shell.yaml

@@ -0,0 +1,8 @@
+type: command/shell
+typeVersion: 2026.02.09.1
+id: 656d013d-0cf3-4a99-87c9-fa89fc323cd0
+name: platform-common-shell
+version: 1
+tags: {}
+globalArguments: {}
+methods: {}

package/openspec-gates/check-tasks-complete.ts

@@ -0,0 +1,44 @@
+/**
+ * Gate: fails unless every task in the named OpenSpec change's tasks.md is
+ * checked off. `openspec validate`/`openspec status` don't check this (an
+ * in-progress change is a normal, valid state) — this is the deterministic
+ * check the pre-pr pipeline needs before letting implementation proceed.
+ */
+import { execFileSync } from 'node:child_process';
+
+interface OpenSpecChangeSummary {
+  name: string;
+  completedTasks: number;
+  totalTasks: number;
+  status: string;
+}
+
+function main(): number {
+  // pnpm's `-- <args>` forwarding (and projen's receiveArgs) can pass a
+  // literal "--" through as an argv token ahead of the real argument.
+  const slug = process.argv.slice(2).find((arg) => arg !== '--');
+  if (!slug) {
+    console.error('Usage: check-tasks-complete <change-slug>');
+    return 1;
+  }
+
+  const raw = execFileSync('openspec', ['list', '--json'], { encoding: 'utf8' });
+  const { changes } = JSON.parse(raw) as { changes: OpenSpecChangeSummary[] };
+  const change = changes.find((c) => c.name === slug);
+
+  if (!change) {
+    console.error(`OpenSpec change "${slug}" not found (openspec list --json)`);
+    return 1;
+  }
+  if (change.status !== 'complete') {
+    console.error(
+      `OpenSpec change "${slug}" has incomplete tasks: ${change.completedTasks}/${change.totalTasks}`,
+    );
+    return 1;
+  }
+
+  console.log(`OpenSpec change "${slug}": all ${change.totalTasks} tasks complete`);
+  return 0;
+}
+
+process.exit(main());

package/openspec-gates/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": "."
+  },
+  "include": [
+    "*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/package.json

@@ -49,7 +49,7 @@
   "main": "lib/index.js",
   "license": "Apache-2.0",
   "stability": "stable",
-  "version": "1.17.2",
+  "version": "1.18.0",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [
@@ -104,6 +104,8 @@
   },
   "//": "~~ Generated by projen. To modify, edit .projenrc.ts and run \"pnpm exec projen\".",
   "scripts": {
+    "attestation:manifest": "projen attestation:manifest",
+    "attestation:verify": "projen attestation:verify",
     "build": "projen build",
     "bump": "projen bump",
     "bump:releasable-commits": "projen bump:releasable-commits",
@@ -114,6 +116,7 @@
     "docgen": "projen docgen",
     "eject": "projen eject",
     "eslint": "projen eslint",
+    "openspec:check-tasks-complete": "projen openspec:check-tasks-complete",
     "package": "projen package",
     "package-all": "projen package-all",
     "package:js": "projen package:js",
@@ -121,10 +124,12 @@
     "post-upgrade": "projen post-upgrade",
     "pre-compile": "projen pre-compile",
     "release": "projen release",
+    "swamp:bootstrap": "projen swamp:bootstrap",
     "test": "projen test",
     "test:watch": "projen test:watch",
     "unbump": "projen unbump",
     "upgrade": "projen upgrade",
+    "validate:architecture": "projen validate:architecture",
     "watch": "projen watch",
     "zizmor": "projen zizmor",
     "projen": "projen"

package/workflows/workflow-openspec-plan-verify.yaml

@@ -0,0 +1,51 @@
+id: 9876c89c-de05-4c3c-9595-cbc7622f5391
+name: openspec-plan-verify
+description: >-
+  Fails unless the named OpenSpec change is well-formed (proposal, design,
+  specs with deltas, tasks all present) via `openspec validate`. Gates the
+  factory's planning stage: a request can't proceed to implementation until
+  it's a real OpenSpec change, not just prose in a swamp artifact.
+tags: {}
+inputs:
+  type: object
+  required: [changeSlug]
+  properties:
+    changeSlug:
+      type: string
+      description: The openspec change name (openspec/changes/<changeSlug>/).
+jobs:
+  - name: verify
+    description: Validate the OpenSpec change is complete and well-formed
+    steps:
+      - name: validate
+        description: openspec validate <changeSlug> --type change
+        task:
+          type: model_method
+          modelIdOrName: platform-common-shell
+          methodName: execute
+          inputs:
+            run: 'openspec validate ${{ inputs.changeSlug }} --type change'
+        dependsOn: []
+        weight: 0
+        allowFailure: false
+      - name: assert-valid
+        description: openspec validate must exit 0
+        task:
+          type: assert
+          expr: >-
+            data.query('modelName == "platform-common-shell" && name == "result" &&
+            workflowRunId == "' + run.id + '"')[0].attributes.exitCode == 0
+          message: >-
+            OpenSpec change is not valid/complete (missing proposal, design,
+            specs with deltas, or tasks) — see the platform-common-shell result data
+            for openspec's own remediation output
+          severity: high
+        dependsOn:
+          - step: validate
+            condition:
+              type: succeeded
+        weight: 0
+        allowFailure: false
+    dependsOn: []
+    weight: 0
+version: 1

package/workflows/workflow-openspec-tasks-verify.yaml

@@ -0,0 +1,51 @@
+id: 57139fa5-bcae-4338-90c0-1f4d2fa05398
+name: openspec-tasks-verify
+description: >-
+  Fails unless every task in the named OpenSpec change's tasks.md is checked
+  off (openspec-gates/check-tasks-complete.ts, via `pnpm run
+  openspec:check-tasks-complete`). Gates the factory's implementing stage:
+  work isn't done until the change's own task list says it's done, not just
+  because an artifact was recorded.
+tags: {}
+inputs:
+  type: object
+  required: [changeSlug]
+  properties:
+    changeSlug:
+      type: string
+      description: The openspec change name (openspec/changes/<changeSlug>/).
+jobs:
+  - name: verify
+    description: Check every task in the change's tasks.md is complete
+    steps:
+      - name: check-tasks
+        description: pnpm run openspec:check-tasks-complete -- <changeSlug>
+        task:
+          type: model_method
+          modelIdOrName: platform-common-shell
+          methodName: execute
+          inputs:
+            run: 'pnpm run openspec:check-tasks-complete -- ${{ inputs.changeSlug }}'
+        dependsOn: []
+        weight: 0
+        allowFailure: false
+      - name: assert-tasks-complete
+        description: openspec:check-tasks-complete must exit 0
+        task:
+          type: assert
+          expr: >-
+            data.query('modelName == "platform-common-shell" && name == "result" &&
+            workflowRunId == "' + run.id + '"')[0].attributes.exitCode == 0
+          message: >-
+            OpenSpec change has incomplete tasks — see the platform-common-shell
+            result data for the completedTasks/totalTasks breakdown
+          severity: high
+        dependsOn:
+          - step: check-tasks
+            condition:
+              type: succeeded
+        weight: 0
+        allowFailure: false
+    dependsOn: []
+    weight: 0
+version: 1

package/workflows/workflow-pre-pr-verify.yaml

@@ -0,0 +1,118 @@
+id: a3b4b6f9-cb73-460a-8a5a-c464250c7d03
+name: pre-pr-verify
+description: >-
+  Pre-PR verification: run the same checks CI would run, before the factory
+  opens a PR rather than after — build/synth/test/lint (pnpm build) and the
+  architecture rule registry (pnpm validate:architecture). Both must pass.
+tags: {}
+inputs:
+  type: object
+  properties:
+    commit:
+      type: string
+      description: >-
+        The commit sha being verified. Read by the built-in
+        @swamp/verification-attestation report's subject.commit — pass the
+        real HEAD sha or the attestation renders "unknown".
+    branch:
+      type: string
+      description: Same as commit, but for @swamp/verification-attestation's subject.branch.
+jobs:
+  - name: verify
+    description: Build/test/lint plus architecture-rule checks, gating PR creation
+    steps:
+      - name: build
+        description: compile -> cdk synth -> jest -> eslint (existing projen build task)
+        task:
+          type: model_method
+          modelIdOrName: platform-common-shell
+          methodName: execute
+          inputs:
+            run: pnpm build
+        dependsOn: []
+        weight: 0
+        allowFailure: false
+      - name: assert-build
+        description: pnpm build must exit 0
+        task:
+          type: assert
+          expr: >-
+            data.query('modelName == "platform-common-shell" && name == "result" &&
+            workflowRunId == "' + run.id + '"')[0].attributes.exitCode == 0
+          message: >-
+            pnpm build failed (compile/synth/test/lint) — see the platform-common-shell
+            result data for stdout/stderr
+          severity: high
+        dependsOn:
+          - step: build
+            condition:
+              type: succeeded
+        weight: 0
+        allowFailure: false
+      - name: architecture
+        description: run the architecture rule registry (architecture-rules/rules.json)
+        task:
+          type: model_method
+          modelIdOrName: platform-common-shell-architecture
+          methodName: execute
+          inputs:
+            run: pnpm run validate:architecture
+        dependsOn:
+          - step: assert-build
+            condition:
+              type: succeeded
+        weight: 0
+        allowFailure: false
+      - name: assert-architecture
+        description: architecture rule registry must exit 0 (no enabled-rule violations)
+        task:
+          type: assert
+          expr: >-
+            data.query('modelName == "platform-common-shell-architecture" && name == "result" &&
+            workflowRunId == "' + run.id + '"')[0].attributes.exitCode == 0
+          message: >-
+            architecture rule violation(s) found — see the platform-common-shell result
+            data for details
+          severity: high
+        dependsOn:
+          - step: architecture
+            condition:
+              type: succeeded
+        weight: 0
+        allowFailure: false
+      - name: manifest
+        description: >-
+          compute the attestation-manifest checksums (attestation/manifest.ts)
+          that verify-attestation.yml re-checks at merge time
+        task:
+          type: model_method
+          modelIdOrName: platform-common-shell-manifest
+          methodName: execute
+          inputs:
+            run: pnpm run attestation:manifest
+        dependsOn:
+          - step: assert-architecture
+            condition:
+              type: succeeded
+        weight: 0
+        allowFailure: false
+      - name: assert-manifest
+        description: attestation:manifest must exit 0
+        task:
+          type: assert
+          expr: >-
+            data.query('modelName == "platform-common-shell-manifest" && name == "result" &&
+            workflowRunId == "' + run.id + '"')[0].attributes.exitCode == 0
+          message: >-
+            failed to compute the attestation manifest — see the
+            platform-common-shell-manifest result data for stdout/stderr
+          severity: high
+        dependsOn:
+          - step: manifest
+            condition:
+              type: succeeded
+        weight: 0
+        allowFailure: false
+    dependsOn: []
+    weight: 0
+version: 1