@rafinery/cli 0.13.0 → 0.15.0

package/lib/ci-setup.mjs

@@ -1,172 +0,0 @@
-// rafa ci-setup — install the reconciliation workflow (working-set
-// architecture, ratified 2026-07-10, rules 6–7): the org's own CI folds
-// branch→branch merges mechanically and DISTILLS merge-to-main with the org's
-// own LLM key. Writes .github/workflows/rafa-reconcile.yml and names the
-// secrets to configure — it configures nothing itself (secrets are the org's;
-// nothing sensitive ever transits rafinery).
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-
-const WORKFLOW_PATH = ".github/workflows/rafa-reconcile.yml";
-
-const WORKFLOW = `# rafa reconcile — knowledge propagates exactly like the code it describes.
-#
-#   branch → parent branch merge   = MECHANICAL FOLD (no LLM, no prism)
-#   branch → default branch merge  = DISTILLATION (prism-validated vs merged main,
-#                                    compile-gated, pushed to the brain repo)
-#
-# Secrets (Settings → Secrets and variables → Actions):
-#   RAFA_MCP_KEY        an agent key for this repo (platform → repo → Agent access)
-#   ANTHROPIC_API_KEY   the ORG'S OWN LLM key — used only inside this CI for
-#                       distillation; never stored on the rafinery platform
-#   RAFA_BRAIN_TOKEN    a token with push access to the BRAIN repo (distill only)
-#
-# Fires on the merge EVENT itself (PR closed+merged), so squash/rebase merges are
-# detected correctly. The distill job ALSO runs an ancestry sweep: any still-active
-# working-set row (any branch) whose capturedAtSha is reachable from merged main is
-# provably-merged backlog — an earlier merge whose distill never ran, or a direct
-# push — and folds into the same run. The sweep needs full history (fetch-depth: 0).
-# If distillation cannot run (missing secret, failed gate) it fails LOUD and the
-# branch's working set stays intact — the next dev session gets the standard
-# distill offer (fallback chain).
-
-name: rafa reconcile
-
-on:
-  pull_request:
-    types: [closed]
-
-jobs:
-  fold:
-    name: fold working set (branch → parent)
-    if: github.event.pull_request.merged == true && github.event.pull_request.base.ref != github.event.repository.default_branch
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - name: Mechanical fold (no LLM — rigor lives at main)
-        env:
-          RAFA_MCP_KEY: \${{ secrets.RAFA_MCP_KEY }}
-          RAFA_MCP_URL: \${{ secrets.RAFA_MCP_URL }} # deployed platform /api/mcp — localhost never works from CI
-          RAFA_HOOKS_DISABLED: "1" # headless — the M5 sensors are session instruments
-        run: npx -y @rafinery/cli fold --from "\${{ github.event.pull_request.head.ref }}" --to "\${{ github.event.pull_request.base.ref }}"
-
-  distill:
-    name: distill working set (merge to main)
-    if: github.event.pull_request.merged == true && github.event.pull_request.base.ref == github.event.repository.default_branch
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: \${{ github.event.repository.default_branch }} # merged main = the validation target
-          fetch-depth: 0 # full history — the ancestry sweep proves prior merges
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      # ISOLATED install — never \`npm i\` inside the client checkout: a pnpm
-      # workspace repo has "workspace:*" deps npm cannot parse (EUNSUPPORTEDPROTOCOL).
-      - name: Install the Agent SDK (isolated dir; runs on the org's own key)
-        run: |
-          mkdir -p "\$RUNNER_TEMP/rafa-sdk" && cd "\$RUNNER_TEMP/rafa-sdk"
-          npm init -y > /dev/null
-          npm i @anthropic-ai/claude-agent-sdk
-      - name: Distill into the org brain (prism-validated, compile-gated)
-        env:
-          ANTHROPIC_API_KEY: \${{ secrets.ANTHROPIC_API_KEY }}
-          RAFA_MCP_KEY: \${{ secrets.RAFA_MCP_KEY }}
-          RAFA_MCP_URL: \${{ secrets.RAFA_MCP_URL }} # deployed platform /api/mcp — localhost never works from CI
-          RAFA_BRAIN_TOKEN: \${{ secrets.RAFA_BRAIN_TOKEN }}
-          RAFA_AGENT_SDK_DIR: \${{ runner.temp }}/rafa-sdk
-          RAFA_HOOKS_DISABLED: "1" # headless — the M5 sensors are session instruments
-          RAFA_MERGE_SHA: \${{ github.event.pull_request.merge_commit_sha }} # keys the run record
-          RAFA_TARGET_BRANCH: \${{ github.event.pull_request.base.ref }}
-        run: npx -y @rafinery/cli distill --headless "\${{ github.event.pull_request.head.ref }}"
-`;
-
-// Pristine-detection for upgrades: a byte-diff alone cannot tell "user tuned
-// this" from "our template moved on" — and mislabeling a stale pristine
-// install as tuned strands it on old behavior forever (the ancestry sweep is
-// inert without fetch-depth: 0). Comparison ignores comments/blank lines;
-// PREVIOUS_NORMALIZED holds every historical pristine body, so a file that
-// matches one is upgraded in place and only a genuinely tuned file is left
-// alone. (Comment-only tuning is knowingly not preserved.)
-const normalize = (s) =>
-  s
-    .split("\n")
-    .map((l) => l.trimEnd())
-    .filter((l) => {
-      const t = l.trim();
-      return t !== "" && !t.startsWith("#");
-    })
-    .join("\n");
-const PREVIOUS_NORMALIZED = [
-  // v1 (pre ancestry-sweep, pre run-record): identical body minus the lines
-  // those two features added. Derived, not duplicated — v1 never shipped a
-  // byte that differs otherwise.
-  normalize(WORKFLOW)
-    .split("\n")
-    .filter(
-      (l) =>
-        !l.includes("fetch-depth: 0") &&
-        !l.includes("RAFA_MERGE_SHA") &&
-        !l.includes("RAFA_TARGET_BRANCH"),
-    )
-    .join("\n"),
-];
-
-export default async function ciSetup(args = []) {
-  const ROOT = process.cwd();
-  const target = join(ROOT, WORKFLOW_PATH);
-
-  console.log(
-    "OPTIONAL — the platform reconciles merges automatically (no CI, no repo secrets).\n" +
-      "This wires the org-CI ADAPTER instead: reconciliation compute runs in YOUR\n" +
-      "GitHub Actions on YOUR secrets. Most teams should skip this.\n",
-  );
-
-  if (existsSync(target)) {
-    const current = readFileSync(target, "utf8");
-    if (current === WORKFLOW) {
-      console.log(`✓ ${WORKFLOW_PATH} is already current`);
-    } else if (args.includes("--overwrite")) {
-      writeFileSync(target, WORKFLOW);
-      console.log(`✓ ${WORKFLOW_PATH} updated (--overwrite)`);
-    } else if (PREVIOUS_NORMALIZED.includes(normalize(current))) {
-      writeFileSync(target, WORKFLOW);
-      console.log(
-        `✓ ${WORKFLOW_PATH} upgraded from an older pristine template (no local tuning detected)`,
-      );
-    } else {
-      console.log(
-        `! ${WORKFLOW_PATH} exists and differs — left untouched (yours may be tuned).\n` +
-          "  Re-run with --overwrite to replace it.",
-      );
-    }
-  } else {
-    mkdirSync(dirname(target), { recursive: true });
-    writeFileSync(target, WORKFLOW);
-    console.log(`✓ wrote ${WORKFLOW_PATH}`);
-  }
-
-  console.log(`
-Next steps (repo Settings → Secrets and variables → Actions):
-  1. RAFA_MCP_KEY       — mint on the platform (repo → Agent access); scope: this repo.
-  2. RAFA_MCP_URL       — your DEPLOYED platform's MCP endpoint (https://<host>/api/mcp).
-                          A localhost dev URL can never work from a CI runner.
-  3. ANTHROPIC_API_KEY  — the ORG'S OWN LLM key. Used only inside YOUR CI for
-                          merge-to-main distillation; never stored on the rafinery
-                          platform (hard rule).
-  4. RAFA_BRAIN_TOKEN   — a token with push access to the BRAIN repo (the distill
-                          job pushes validated knowledge there).
-  5. Commit the workflow via your normal MR flow.
-  6. Verify the whole capture chain:  npx @rafinery/cli doctor  (sensors, scripts,
-     platform round-trip — exit 1 names any fix).
-
-The rigor gradient this wires: dev↔dev = CAS + session prompt · branch↔branch =
-free mechanical fold · branch→main = full distillation + gates. Cost tracks
-consequence. Without CI, nothing is lost — the next dev session's bootstrap
-digest offers the same reconciliation (/rafa distill).`);
-}