@n12r/jarvis-control 0.2.3

package/README.md

@@ -0,0 +1,61 @@
+# Jarvis Control Plane
+
+Deterministic workflow gates for AI-assisted software delivery.
+
+## Commands
+
+- `jarvis-control init` - scaffold workflow files into the current project.
+- `jarvis-control status` - show current stage and gate status.
+- `jarvis-control check [stage]` - run gate checks for current or specified stage.
+- `jarvis-control promote <target-stage>` - move to next stage if current stage passes.
+- `jarvis-control repo [owner repo-name --public|--private --template owner/repo]` - create and clone a new repo (prompts interactively if args are omitted).
+
+## Local usage
+
+```bash
+npm install
+npm run cp:init
+npm run cp:status
+npm run cp:check
+```
+
+## Stage model
+
+`discovery -> contract -> plan -> build -> harden -> release -> operate`
+
+Gate requirements are defined in `workflow/gates.yaml`.
+Workflow state is tracked in `workflow/state.yaml`.
+Transition history is tracked in `workflow/history.yaml`.
+Note: `workflow/` is runtime state and is intentionally not committed in this template repo.
+Run `jarvis-control init` in each new repo to scaffold it.
+
+## How this controls AI-assisted work
+
+1. AI can generate code and docs.
+2. Promotion between stages is blocked until deterministic checks pass.
+3. Stage transitions are chain-validated from history to block stage jumps.
+4. CI runs the same checks to prevent bypass.
+
+## Reuse Across New Repos
+
+1. Mark this repo as a GitHub Template Repository.
+2. Create a new repo from template:
+   - `jarvis-control repo <owner> <new-repo-name> --private`
+   - From any directory: `jarvis-control repo <owner> <new-repo-name> --private --template <owner/repo>`
+   - Optional env default: `export JARVIS_TEMPLATE_REPO=<owner/repo>`
+3. Apply branch and environment protections:
+   - `scripts/apply-github-protections.sh <owner> <repo> main`
+4. Follow the full checklist:
+   - `docs/REPO_BOOTSTRAP_CHECKLIST.md`
+
+## Scripts
+
+- `scripts/create-repo-from-template.sh` - create/clone repos from this template.
+- `scripts/apply-github-protections.sh` - enforce branch/environment protection via GitHub API.
+- `scripts/guard-state-change.js` - CI guard to block invalid `state.yaml` edits.
+
+## Next steps
+
+1. Publish this package to npm.
+2. Use `npx jarvis-control@<version> init` in any project.
+3. Customize `workflow/gates.yaml` per project domain.

package/bin/jarvis.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+const { init, status, check, promote, repo } = require('../lib/control-plane');
+const readline = require('readline');
+const CLI_NAME = 'jarvis-control';
+
+const RESET = '\x1b[0m';
+const BOLD = '\x1b[1m';
+const CYAN = '\x1b[36m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+
+function printHelp() {
+  console.log(`${BOLD}${CYAN}Jarvis Control Plane${RESET}`);
+  console.log(`${YELLOW}Deterministic workflow gates for AI-assisted delivery${RESET}\n`);
+
+  console.log(`${BOLD}Quick Start${RESET}`);
+  console.log(`  ${GREEN}1)${RESET} ${CLI_NAME} init`);
+  console.log(`  ${GREEN}2)${RESET} ${CLI_NAME} status`);
+  console.log(`  ${GREEN}3)${RESET} ${CLI_NAME} check`);
+  console.log(`  ${GREEN}4)${RESET} ${CLI_NAME} promote <stage>\n`);
+
+  console.log(`${BOLD}Commands${RESET}`);
+  console.log(`  ${BOLD}init${RESET}                 Scaffold ./workflow files`);
+  console.log(`  ${BOLD}status${RESET}               Show current stage + gate status`);
+  console.log(`  ${BOLD}check [stage]${RESET}        Run gate checks for current or provided stage`);
+  console.log(`  ${BOLD}promote <stage>${RESET}      Move to next stage if current stage passes`);
+  console.log(`  ${BOLD}repo [owner name]${RESET}   Create and clone a repo from template (wizard if omitted)`);
+  console.log(`  ${BOLD}help${RESET}                 Show this menu\n`);
+
+  console.log(`${BOLD}Stage Flow${RESET}`);
+  console.log('  discovery -> contract -> plan -> build -> harden -> release -> operate\n');
+
+  console.log(`${BOLD}Examples${RESET}`);
+  console.log(`  ${CLI_NAME} check`);
+  console.log(`  ${CLI_NAME} check build`);
+  console.log(`  ${CLI_NAME} promote contract`);
+  console.log(`  ${CLI_NAME} repo`);
+  console.log(`  ${CLI_NAME} repo schradermade my-new-service --private --template schradermade/jarvis`);
+  console.log('\nRepo flags:');
+  console.log('  --template <owner/repo>   Explicit template repo (works from any directory)');
+  console.log('  --private | --public      Visibility');
+  console.log('  Env fallback: JARVIS_TEMPLATE_REPO=<owner/repo>');
+}
+
+function prompt(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve((answer || '').trim());
+    });
+  });
+}
+
+async function resolveRepoArgs(args) {
+  const positional = [];
+  let visibility = '';
+  let template = '';
+
+  for (let i = 0; i < args.length; i += 1) {
+    const token = args[i];
+    if (token === '--template') {
+      template = args[i + 1] || '';
+      i += 1;
+      continue;
+    }
+    if (token === '--private' || token === '--public' || token === '1' || token === '2') {
+      visibility = token;
+      continue;
+    }
+    positional.push(token);
+  }
+
+  let owner = positional[0];
+  let repoName = positional[1];
+  template = template || process.env.JARVIS_TEMPLATE_REPO || '';
+
+  if (owner && repoName) {
+    return { owner, repoName, visibility: visibility || '--private', template };
+  }
+
+  if (!process.stdin.isTTY) {
+    throw new Error('repo command requires args in non-interactive mode: <owner> <repo-name> [--public|--private]');
+  }
+
+  console.log(`${BOLD}${CYAN}Repo Setup Wizard${RESET}`);
+  console.log(`${YELLOW}Create and clone a new repo from this template${RESET}\n`);
+
+  owner = owner || (await prompt('GitHub owner/org: '));
+  repoName = repoName || (await prompt('New repository name: '));
+  template = template || (await prompt('Template repo (owner/repo) [auto-detect from current repo]: '));
+  const visibilityInput =
+    visibility ||
+    (await prompt('Visibility (1=private, 2=public) [1]: ')) ||
+    '1';
+
+  if (visibilityInput === '1') {
+    visibility = '--private';
+  } else if (visibilityInput === '2') {
+    visibility = '--public';
+  } else if (visibilityInput === '--private' || visibilityInput === '--public') {
+    visibility = visibilityInput;
+  } else {
+    throw new Error("Visibility must be '1' (private), '2' (public), '--private', or '--public'");
+  }
+
+  return { owner, repoName, visibility, template };
+}
+
+async function main() {
+  const [, , command, ...args] = process.argv;
+
+  try {
+    switch (command) {
+      case 'init':
+        process.exitCode = init();
+        break;
+      case 'status':
+        process.exitCode = status();
+        break;
+      case 'check':
+        process.exitCode = check(args[0]);
+        break;
+      case 'promote':
+        process.exitCode = promote(args[0]);
+        break;
+      case 'repo':
+        {
+          const repoArgs = await resolveRepoArgs(args);
+          process.exitCode = repo(
+            repoArgs.owner,
+            repoArgs.repoName,
+            repoArgs.visibility,
+            repoArgs.template,
+          );
+        }
+        break;
+      case 'help':
+      case '--help':
+      case '-h':
+        printHelp();
+        process.exitCode = 0;
+        break;
+      default:
+        if (!command) {
+          printHelp();
+          process.exitCode = 0;
+        } else {
+          console.error(`Unknown command: ${command}\n`);
+          printHelp();
+          process.exitCode = 1;
+        }
+    }
+  } catch (error) {
+    console.error(error.message);
+    console.log('');
+    console.log(`${YELLOW}Run '${CLI_NAME} help' for command usage.${RESET}`);
+    process.exitCode = 1;
+  }
+}
+
+main();

package/lib/control-plane.js

@@ -0,0 +1,422 @@
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const yaml = require('js-yaml');
+
+const WORKFLOW_DIR = path.join(process.cwd(), 'workflow');
+const STATE_PATH = path.join(WORKFLOW_DIR, 'state.yaml');
+const GATES_PATH = path.join(WORKFLOW_DIR, 'gates.yaml');
+const HISTORY_PATH = path.join(WORKFLOW_DIR, 'history.yaml');
+const RESET = '\x1b[0m';
+const BOLD = '\x1b[1m';
+const DIM = '\x1b[2m';
+const GREEN = '\x1b[32m';
+const CYAN = '\x1b[36m';
+const YELLOW = '\x1b[33m';
+
+function fileExists(filePath) {
+  return fs.existsSync(filePath);
+}
+
+function ensureWorkflowFiles() {
+  if (!fileExists(STATE_PATH) || !fileExists(GATES_PATH) || !fileExists(HISTORY_PATH)) {
+    throw new Error('Missing workflow files. Run `jarvis-control init` first.');
+  }
+}
+
+function loadYaml(filePath) {
+  return yaml.load(fs.readFileSync(filePath, 'utf8'));
+}
+
+function saveYaml(filePath, data) {
+  const content = yaml.dump(data, { lineWidth: 120, noRefs: true });
+  fs.writeFileSync(filePath, content, 'utf8');
+}
+
+function validateHistory(state, gates, history) {
+  if (!history || !Array.isArray(history.transitions)) {
+    throw new Error('Invalid workflow/history.yaml: missing transitions array');
+  }
+
+  const transitions = history.transitions;
+  if (transitions.length === 0) {
+    throw new Error('Invalid workflow/history.yaml: transitions must contain at least one entry');
+  }
+
+  let previousStage = null;
+  for (let i = 0; i < transitions.length; i += 1) {
+    const transition = transitions[i];
+    const from = transition.from ?? null;
+    const to = transition.to;
+
+    if (!to || !gates.stages[to]) {
+      throw new Error(`Invalid transition at index ${i}: unknown target stage '${to}'`);
+    }
+
+    if (i === 0) {
+      if (from !== null) {
+        throw new Error('Invalid transition history: first transition must have from: null');
+      }
+      previousStage = to;
+      continue;
+    }
+
+    if (from !== previousStage) {
+      throw new Error(`Invalid transition history at index ${i}: from '${from}' does not match previous stage '${previousStage}'`);
+    }
+
+    const allowedNext = gates.stages[from].allowed_next || [];
+    if (!allowedNext.includes(to)) {
+      throw new Error(`Invalid transition history at index ${i}: '${from}' cannot transition to '${to}'`);
+    }
+
+    previousStage = to;
+  }
+
+  const historyCurrent = transitions[transitions.length - 1].to;
+  if (historyCurrent !== state.current_stage) {
+    throw new Error(
+      `State/history mismatch: state current_stage is '${state.current_stage}' but history ends at '${historyCurrent}'`,
+    );
+  }
+}
+
+function getStateAndGates() {
+  ensureWorkflowFiles();
+  const state = loadYaml(STATE_PATH);
+  const gates = loadYaml(GATES_PATH);
+  const history = loadYaml(HISTORY_PATH);
+  if (!state || !state.current_stage) {
+    throw new Error('Invalid workflow/state.yaml: missing current_stage');
+  }
+  if (!gates || !gates.stages || typeof gates.stages !== 'object') {
+    throw new Error('Invalid workflow/gates.yaml: missing stages');
+  }
+  validateHistory(state, gates, history);
+  return { state, gates, history };
+}
+
+function missingFiles(requiredFiles) {
+  return requiredFiles.filter((f) => !fileExists(path.join(process.cwd(), f)));
+}
+
+function runCommands(requiredCommands) {
+  const failures = [];
+  for (const cmd of requiredCommands) {
+    const result = spawnSync(cmd, {
+      shell: true,
+      stdio: 'inherit',
+      cwd: process.cwd(),
+    });
+    if (result.status !== 0) {
+      failures.push(cmd);
+    }
+  }
+  return failures;
+}
+
+function checkStage(stageName) {
+  const { gates } = getStateAndGates();
+  const stage = gates.stages[stageName];
+  if (!stage) {
+    throw new Error(`Unknown stage: ${stageName}`);
+  }
+
+  const requiredFiles = stage.required_files || [];
+  const requiredCommands = stage.required_commands || [];
+
+  const filesMissing = missingFiles(requiredFiles);
+  const commandFailures = runCommands(requiredCommands);
+
+  const ok = filesMissing.length === 0 && commandFailures.length === 0;
+  return {
+    ok,
+    stage: stageName,
+    filesMissing,
+    commandFailures,
+  };
+}
+
+function findStartStage(gates) {
+  const stageNames = Object.keys(gates.stages);
+  const hasIncoming = new Set();
+  for (const name of stageNames) {
+    const next = gates.stages[name].allowed_next || [];
+    next.forEach((n) => hasIncoming.add(n));
+  }
+  return stageNames.find((name) => !hasIncoming.has(name));
+}
+
+function buildStagePath(gates) {
+  const start = findStartStage(gates);
+  if (!start) {
+    return Object.keys(gates.stages);
+  }
+  const path = [];
+  const seen = new Set();
+  let current = start;
+  while (current && !seen.has(current)) {
+    path.push(current);
+    seen.add(current);
+    const next = gates.stages[current].allowed_next || [];
+    current = next[0];
+  }
+  return path.length ? path : Object.keys(gates.stages);
+}
+
+function renderStageProgress(currentStage, gates) {
+  const path = buildStagePath(gates);
+  const currentIdx = path.indexOf(currentStage);
+  const parts = path.map((stage, idx) => {
+    if (idx < currentIdx) {
+      return `${GREEN}✔ ${stage}${RESET}`;
+    }
+    if (idx === currentIdx) {
+      return `${BOLD}${CYAN}➤ ${stage}${RESET}`;
+    }
+    return `${DIM}• ${stage}${RESET}`;
+  });
+
+  const flow = parts.join(`${DIM}  →  ${RESET}`);
+  console.log(`${BOLD}Stage Pipeline${RESET}`);
+  console.log(flow);
+  console.log('');
+}
+
+function status() {
+  const { state, gates } = getStateAndGates();
+  const result = checkStage(state.current_stage);
+
+  renderStageProgress(state.current_stage, gates);
+  console.log(`Current stage: ${state.current_stage}`);
+  if (state.owner) {
+    console.log(`Owner: ${state.owner}`);
+  }
+  if (state.last_updated) {
+    console.log(`Last updated: ${state.last_updated}`);
+  }
+
+  if (result.ok) {
+    console.log(`${GREEN}Gate status: PASS${RESET}`);
+    return 0;
+  }
+
+  console.log(`${YELLOW}Gate status: FAIL${RESET}`);
+  if (result.filesMissing.length) {
+    console.log('Missing files:');
+    result.filesMissing.forEach((f) => console.log(`- ${f}`));
+  }
+  if (result.commandFailures.length) {
+    console.log('Failed commands:');
+    result.commandFailures.forEach((c) => console.log(`- ${c}`));
+  }
+
+  return 1;
+}
+
+function check(optionalStage) {
+  const { state } = getStateAndGates();
+  const stage = optionalStage || state.current_stage;
+  const result = checkStage(stage);
+
+  console.log(`Checking stage: ${stage}`);
+  if (result.ok) {
+    console.log('PASS');
+    return 0;
+  }
+
+  console.log('FAIL');
+  if (result.filesMissing.length) {
+    console.log('Missing files:');
+    result.filesMissing.forEach((f) => console.log(`- ${f}`));
+  }
+  if (result.commandFailures.length) {
+    console.log('Failed commands:');
+    result.commandFailures.forEach((c) => console.log(`- ${c}`));
+  }
+
+  return 1;
+}
+
+function promote(targetStage) {
+  if (!targetStage) {
+    throw new Error('Usage: jarvis-control promote <target-stage>');
+  }
+
+  const { state, gates, history } = getStateAndGates();
+  const current = state.current_stage;
+  const currentConfig = gates.stages[current];
+  const targetConfig = gates.stages[targetStage];
+
+  if (!currentConfig) {
+    throw new Error(`Current stage '${current}' is not defined in gates.yaml`);
+  }
+  if (!targetConfig) {
+    throw new Error(`Target stage '${targetStage}' is not defined in gates.yaml`);
+  }
+
+  const allowedNext = currentConfig.allowed_next || [];
+  if (!allowedNext.includes(targetStage)) {
+    throw new Error(`Cannot promote from '${current}' to '${targetStage}'. Allowed next: ${allowedNext.join(', ') || '(none)'}`);
+  }
+
+  const gate = checkStage(current);
+  if (!gate.ok) {
+    console.log(`Cannot promote: current stage '${current}' has failing checks.`);
+    if (gate.filesMissing.length) {
+      console.log('Missing files:');
+      gate.filesMissing.forEach((f) => console.log(`- ${f}`));
+    }
+    if (gate.commandFailures.length) {
+      console.log('Failed commands:');
+      gate.commandFailures.forEach((c) => console.log(`- ${c}`));
+    }
+    return 1;
+  }
+
+  state.current_stage = targetStage;
+  state.last_updated = new Date().toISOString();
+  saveYaml(STATE_PATH, state);
+
+  history.transitions.push({
+    from: current,
+    to: targetStage,
+    at: state.last_updated,
+    actor: process.env.USER || process.env.USERNAME || 'unknown',
+  });
+  saveYaml(HISTORY_PATH, history);
+
+  console.log(`Promoted workflow: ${current} -> ${targetStage}`);
+  return 0;
+}
+
+function copyDirectory(src, dest) {
+  fs.mkdirSync(dest, { recursive: true });
+  const entries = fs.readdirSync(src, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const srcPath = path.join(src, entry.name);
+    const destPath = path.join(dest, entry.name);
+
+    if (entry.isDirectory()) {
+      copyDirectory(srcPath, destPath);
+    } else if (!fileExists(destPath)) {
+      fs.copyFileSync(srcPath, destPath);
+    }
+  }
+}
+
+function init() {
+  const srcWorkflow = path.join(__dirname, '..', 'templates', 'workflow');
+  const destWorkflow = path.join(process.cwd(), 'workflow');
+
+  copyDirectory(srcWorkflow, destWorkflow);
+
+  let needsHistoryBootstrap = !fileExists(HISTORY_PATH);
+  if (!needsHistoryBootstrap) {
+    try {
+      const existingHistory = loadYaml(HISTORY_PATH);
+      needsHistoryBootstrap = !existingHistory || !Array.isArray(existingHistory.transitions) || existingHistory.transitions.length === 0;
+    } catch (error) {
+      needsHistoryBootstrap = true;
+    }
+  }
+
+  if (needsHistoryBootstrap) {
+    const currentState = loadYaml(STATE_PATH);
+    const initializedAt = new Date().toISOString();
+    saveYaml(HISTORY_PATH, {
+      transitions: [
+        {
+          from: null,
+          to: currentState.current_stage,
+          at: initializedAt,
+          actor: process.env.USER || process.env.USERNAME || 'unknown',
+        },
+      ],
+    });
+    currentState.last_updated = initializedAt;
+    saveYaml(STATE_PATH, currentState);
+  }
+
+  console.log('Initialized workflow files in ./workflow');
+  return 0;
+}
+
+function gh(args) {
+  const result = spawnSync('gh', args, {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+  });
+  return result.status === null ? 1 : result.status;
+}
+
+function ghCapture(args) {
+  const result = spawnSync('gh', args, {
+    stdio: ['ignore', 'pipe', 'pipe'],
+    cwd: process.cwd(),
+    encoding: 'utf8',
+  });
+  if (result.status !== 0) {
+    return null;
+  }
+  return (result.stdout || '').trim();
+}
+
+function normalizeVisibilityFlag(input) {
+  if (input === '1') {
+    return '--private';
+  }
+  if (input === '2') {
+    return '--public';
+  }
+  return input;
+}
+
+function repo(owner, repoName, visibilityFlag = '--private', explicitTemplateRepo = '') {
+  if (!owner || !repoName) {
+    throw new Error('Usage: jarvis-control repo <owner> <repo-name> [--public|--private] [--template owner/repo]');
+  }
+  visibilityFlag = normalizeVisibilityFlag(visibilityFlag);
+  if (visibilityFlag !== '--private' && visibilityFlag !== '--public') {
+    throw new Error("Visibility must be '--private' or '--public'");
+  }
+
+  const ghVersion = ghCapture(['--version']);
+  if (!ghVersion) {
+    throw new Error('GitHub CLI (gh) is required. Install: https://cli.github.com/');
+  }
+
+  const templateRepo =
+    explicitTemplateRepo ||
+    ghCapture(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);
+  if (!templateRepo) {
+    throw new Error(
+      'Unable to detect template repo. Run inside a template repo clone or pass --template <owner/repo> (or set JARVIS_TEMPLATE_REPO).',
+    );
+  }
+
+  console.log(`${BOLD}${CYAN}Creating repo from template${RESET}`);
+  console.log(`Template: ${templateRepo}`);
+  console.log(`Target:   ${owner}/${repoName}`);
+  console.log(`Visibility: ${visibilityFlag.replace('--', '')}`);
+  console.log('');
+
+  const status = gh(['repo', 'create', `${owner}/${repoName}`, visibilityFlag, '--template', templateRepo, '--clone']);
+  if (status !== 0) {
+    return status;
+  }
+
+  console.log('');
+  console.log(`${GREEN}Repository created and cloned successfully.${RESET}`);
+  console.log(`Next: cd ${repoName}`);
+  return 0;
+}
+
+module.exports = {
+  init,
+  status,
+  check,
+  promote,
+  repo,
+};

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@n12r/jarvis-control",
+  "version": "0.2.3",
+  "description": "Deterministic workflow gates for AI-assisted delivery",
+  "bin": {
+    "jarvis-control": "bin/jarvis.js"
+  },
+  "type": "commonjs",
+  "scripts": {
+    "cp:init": "node bin/jarvis.js init",
+    "cp:status": "node bin/jarvis.js status",
+    "cp:check": "node bin/jarvis.js check",
+    "cp:promote": "node bin/jarvis.js promote",
+    "cp:guard-state": "node scripts/guard-state-change.js",
+    "cp:apply-protections": "bash scripts/apply-github-protections.sh",
+    "cp:create-repo": "bash scripts/create-repo-from-template.sh"
+  },
+  "keywords": [
+    "control-plane",
+    "workflow",
+    "gates",
+    "ai"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "js-yaml": "^4.1.0"
+  }
+}

package/templates/workflow/artifacts/change-note.md

@@ -0,0 +1,6 @@
+# change-note
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/constraints.md

@@ -0,0 +1,6 @@
+# constraints
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/contracts.md

@@ -0,0 +1,6 @@
+# contracts
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/error-model.md

@@ -0,0 +1,6 @@
+# error-model
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/implementation-plan.md

@@ -0,0 +1,6 @@
+# implementation-plan
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/observability.md

@@ -0,0 +1,6 @@
+# observability
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/post-release-review.md

@@ -0,0 +1,6 @@
+# post-release-review
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/release-checklist.md

@@ -0,0 +1,6 @@
+# release-checklist
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/risks.md

@@ -0,0 +1,6 @@
+# risks
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/rollback.md

@@ -0,0 +1,6 @@
+# rollback
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/scope.md

@@ -0,0 +1,6 @@
+# scope
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/security-review.md

@@ -0,0 +1,6 @@
+# security-review
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/artifacts/test-plan.md

@@ -0,0 +1,6 @@
+# test-plan
+
+Status: draft
+Owner: 
+Last updated: 
+

package/templates/workflow/gates.yaml

@@ -0,0 +1,57 @@
+stages:
+  discovery:
+    allowed_next:
+      - contract
+    required_files:
+      - workflow/artifacts/scope.md
+      - workflow/artifacts/constraints.md
+    required_commands: []
+
+  contract:
+    allowed_next:
+      - plan
+    required_files:
+      - workflow/artifacts/contracts.md
+      - workflow/artifacts/error-model.md
+    required_commands: []
+
+  plan:
+    allowed_next:
+      - build
+    required_files:
+      - workflow/artifacts/implementation-plan.md
+      - workflow/artifacts/test-plan.md
+      - workflow/artifacts/risks.md
+    required_commands: []
+
+  build:
+    allowed_next:
+      - harden
+    required_files:
+      - workflow/artifacts/change-note.md
+    required_commands:
+      - npm test
+
+  harden:
+    allowed_next:
+      - release
+    required_files:
+      - workflow/artifacts/observability.md
+      - workflow/artifacts/security-review.md
+    required_commands:
+      - npm test
+
+  release:
+    allowed_next:
+      - operate
+    required_files:
+      - workflow/artifacts/rollback.md
+      - workflow/artifacts/release-checklist.md
+    required_commands:
+      - npm test
+
+  operate:
+    allowed_next: []
+    required_files:
+      - workflow/artifacts/post-release-review.md
+    required_commands: []

package/templates/workflow/state.yaml

@@ -0,0 +1,3 @@
+current_stage: discovery
+owner: ""
+last_updated: ""