agent-master-devsecops 3.9.0 → 5.1.0

package/scripts/integrations/jira_manager.js

@@ -0,0 +1,722 @@
+#!/usr/bin/env node
+/**
+ * scripts/integrations/jira_manager.js
+ * 
+ * Gerenciador Unificado do Jira: Padronização de Kanban, WIP Limits, Sprints, Backlog Offline-First e Time-Tracking.
+ * Consolida o controle de fluxo ágil dos 3 Kanbans canônicos ("A fazer", "Em andamento", "Concluído")
+ * com o registro automatizado de worklogs e timetracking durante o ciclo de desenvolvimento em CI/CD.
+ * 
+ * Versão: 5.1.0 Enterprise
+ * Governança: Tríade Git + Jira + Confluence (Regra 11 e AGENT_SCRUM).
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const {
+  getAtlassianCredentials,
+  requestAtlassian,
+  getGitMetadata
+} = require('./atlassian_client.js');
+
+const { createSarifReport } = require('../core/sarif_engine.js');
+
+// ==========================================
+// 1. KANBAN CANÔNICO & PADRONIZAÇÃO DE QUADRO
+// ==========================================
+
+const CANONICAL_KANBANS = Object.freeze({
+  TODO: 'A fazer',
+  IN_PROGRESS: 'Em andamento',
+  DONE: 'Concluído'
+});
+
+const CANONICAL_COLUMNS_LIST = Object.freeze([
+  CANONICAL_KANBANS.TODO,
+  CANONICAL_KANBANS.IN_PROGRESS,
+  CANONICAL_KANBANS.DONE
+]);
+
+/**
+ * Sanitiza o summary de um card do Jira, removendo chaves redundantes do título.
+ * Exemplo: "[PROJ-123] Deploy de Produção" -> "Deploy de Produção"
+ * @param {string} [summary='']
+ * @returns {string}
+ */
+function sanitizeIssueSummary(summary = '') {
+  if (!summary || typeof summary !== 'string') return '';
+  return summary.replace(/^\s*\[[A-Z0-9_-]{2,15}\]\s*[:-]?\s*/i, '').trim();
+}
+
+/**
+ * Valida o limite de trabalho em progresso (WIP Limit).
+ * @param {number} [inProgressCount=0]
+ * @param {number} [maxWip=2]
+ * @returns {object}
+ */
+function checkWipLimit(inProgressCount = 0, maxWip = 2) {
+  const safeInProgress = Math.max(0, Number(inProgressCount) || 0);
+  const safeMax = Math.max(1, Number(maxWip) || 2);
+  const isSaturated = safeInProgress >= safeMax;
+
+  return {
+    inProgressCount: safeInProgress,
+    maxWip: safeMax,
+    isSaturated,
+    canPullNewTask: !isSaturated,
+    alertMessage: isSaturated
+      ? `WIP SATURADO: ${safeInProgress} tarefas ativas em andamento (limite máximo: ${safeMax}). Conclua tarefas antes de puxar novas.`
+      : null
+  };
+}
+
+/**
+ * Mapeia qualquer status ou nome de coluna legado do Jira para uma das 3 colunas canônicas.
+ * @param {string} [statusName='']
+ * @param {string} [statusCategory='']
+ * @returns {string}
+ */
+function resolveCanonicalColumn(statusName = '', statusCategory = '') {
+  const normName = String(statusName || '').trim().toLowerCase();
+  const normCat = String(statusCategory || '').trim().toLowerCase();
+
+  // 1. Concluído / Done
+  if (
+    normName.includes('concl') ||
+    normName.includes('done') ||
+    normName.includes('finaliz') ||
+    normName.includes('resolv') ||
+    normCat.includes('conclu') ||
+    normCat.includes('done') ||
+    normCat.includes('complete')
+  ) {
+    return CANONICAL_KANBANS.DONE;
+  }
+
+  // 2. Em andamento / In Progress
+  if (
+    normName.includes('andamento') ||
+    normName.includes('progress') ||
+    normName.includes('desenvolv') ||
+    normName.includes('análise') ||
+    normName.includes('analise') ||
+    normCat.includes('andamento') ||
+    normCat.includes('progress') ||
+    normCat.includes('indeterminate')
+  ) {
+    return CANONICAL_KANBANS.IN_PROGRESS;
+  }
+
+  // 3. A fazer / To Do / Backlog
+  return CANONICAL_KANBANS.TODO;
+}
+
+/**
+ * Normaliza e consolida as colunas de uma configuração de Board do Jira para os 3 Kanbans padrão.
+ * @param {object} [boardConfig={}]
+ * @returns {object}
+ */
+function standardizeBoardColumns(boardConfig = {}) {
+  const rawColumns = (boardConfig && boardConfig.columnConfig && Array.isArray(boardConfig.columnConfig.columns))
+    ? boardConfig.columnConfig.columns
+    : [];
+  
+  const standardized = {
+    canonicalColumns: [...CANONICAL_COLUMNS_LIST],
+    columns: [
+      { name: CANONICAL_KANBANS.TODO, statuses: [] },
+      { name: CANONICAL_KANBANS.IN_PROGRESS, statuses: [] },
+      { name: CANONICAL_KANBANS.DONE, statuses: [] }
+    ],
+    remappedCount: 0
+  };
+
+  const todoCol = standardized.columns[0];
+  const inProgCol = standardized.columns[1];
+  const doneCol = standardized.columns[2];
+
+  for (const col of rawColumns) {
+    if (!col || typeof col !== 'object') continue;
+    const canonicalTarget = resolveCanonicalColumn(col.name);
+    const statuses = Array.isArray(col.statuses) ? col.statuses : [];
+
+    if (canonicalTarget === CANONICAL_KANBANS.DONE) {
+      doneCol.statuses.push(...statuses);
+    } else if (canonicalTarget === CANONICAL_KANBANS.IN_PROGRESS) {
+      inProgCol.statuses.push(...statuses);
+    } else {
+      todoCol.statuses.push(...statuses);
+    }
+
+    if (col.name !== canonicalTarget) {
+      standardized.remappedCount++;
+    }
+  }
+
+  return standardized;
+}
+
+/**
+ * Constrói a consulta JQL padronizada para uma das 3 colunas canônicas no Jira.
+ * @param {string} projectKey
+ * @param {string} canonicalColumn
+ * @returns {string}
+ */
+function buildCanonicalJql(projectKey, canonicalColumn) {
+  if (!projectKey || typeof projectKey !== 'string') {
+    throw new Error('projectKey é obrigatório para construir JQL.');
+  }
+
+  switch (canonicalColumn) {
+    case CANONICAL_KANBANS.TODO:
+      return `project = "${projectKey}" AND statusCategory in ("To Do", "Undefined") ORDER BY rank ASC, created ASC`;
+    case CANONICAL_KANBANS.IN_PROGRESS:
+      return `project = "${projectKey}" AND statusCategory in ("In Progress") ORDER BY rank ASC, updated DESC`;
+    case CANONICAL_KANBANS.DONE:
+      return `project = "${projectKey}" AND statusCategory in ("Done") ORDER BY updated DESC`;
+    default:
+      throw new Error(`Coluna desconhecida: "${canonicalColumn}". Use: ${CANONICAL_COLUMNS_LIST.join(', ')}`);
+  }
+}
+
+/**
+ * Valida se há pelo menos um sprint ativo na esteira para evitar "quadro de sprints ativo vazio".
+ * @param {Array<object>} [sprints=[]]
+ * @returns {object}
+ */
+function validateSprintHealth(sprints = []) {
+  const safeSprints = Array.isArray(sprints) ? sprints : [];
+  const activeSprints = safeSprints.filter(s => s && s.state === 'active');
+  const futureSprints = safeSprints.filter(s => s && s.state === 'future');
+  const closedSprints = safeSprints.filter(s => s && s.state === 'closed');
+
+  return {
+    totalSprints: safeSprints.length,
+    activeCount: activeSprints.length,
+    futureCount: futureSprints.length,
+    closedCount: closedSprints.length,
+    hasActiveSprint: activeSprints.length > 0,
+    warning: activeSprints.length === 0
+      ? 'ALERTA DE FLUXO: Nenhuma sprint está ativa no Jira. A tela de Sprints Ativos ficará em branco até que uma sprint seja iniciada.'
+      : null
+  };
+}
+
+/**
+ * Avalia candidato do backlog com base no contexto do projeto e filtro de sanidade (Regra 14).
+ * @param {object} candidate
+ * @param {object} [projectContext={}]
+ * @returns {object}
+ */
+function evaluateFullDevCandidate(candidate = {}, projectContext = {}) {
+  const safeCandidate = candidate && typeof candidate === 'object' ? candidate : {};
+  const { title = '', description = '' } = safeCandidate;
+  const { stack = 'generic', domain = 'general' } = projectContext || {};
+
+  const text = `${title} ${description}`.toLowerCase();
+  const evaluation = {
+    valid: true,
+    candidateTitle: sanitizeIssueSummary(title),
+    reasons: [],
+    recommendedAction: 'PROCEED_TO_IN_PROGRESS'
+  };
+
+  const overengineeringKeywords = ['blockchain', 'smart contract', 'quantum computing', 'microservices mesh'];
+  const matchedOver = overengineeringKeywords.filter(k => text.includes(k));
+  if (matchedOver.length > 0 && !String(domain).toLowerCase().includes('crypto')) {
+    evaluation.valid = false;
+    evaluation.reasons.push(`Overengineering ou desconexão com domínio (${domain}): detectado [${matchedOver.join(', ')}]`);
+    evaluation.recommendedAction = 'DROP_OR_REJECT';
+  }
+
+  if (text.includes('kubernetes') && (String(stack).includes('cli') || String(stack).includes('desktop'))) {
+    evaluation.valid = false;
+    evaluation.reasons.push(`Incompatibilidade com stack (${stack}): infraestrutura desproporcional`);
+    evaluation.recommendedAction = 'DROP_OR_REJECT';
+  }
+
+  return evaluation;
+}
+
+/**
+ * Orquestra o ciclo do Modo Full Developer baseado nos 3 Kanbans canônicos.
+ * @param {Array<object>} [tasks=[]]
+ * @param {object} [projectContext={}]
+ * @param {number} [maxWip=2]
+ * @returns {object}
+ */
+function processFullDevPipeline(tasks = [], projectContext = {}, maxWip = 2) {
+  const safeTasks = Array.isArray(tasks) ? tasks : [];
+  const todoTasks = safeTasks.filter(t => t && resolveCanonicalColumn(t.status || t.statusName, t.statusCategory) === CANONICAL_KANBANS.TODO);
+  const inProgressTasks = safeTasks.filter(t => t && resolveCanonicalColumn(t.status || t.statusName, t.statusCategory) === CANONICAL_KANBANS.IN_PROGRESS);
+  const doneTasks = safeTasks.filter(t => t && resolveCanonicalColumn(t.status || t.statusName, t.statusCategory) === CANONICAL_KANBANS.DONE);
+
+  const wipStatus = checkWipLimit(inProgressTasks.length, maxWip);
+
+  const results = {
+    totalTasks: safeTasks.length,
+    counts: {
+      todo: todoTasks.length,
+      inProgress: inProgressTasks.length,
+      done: doneTasks.length
+    },
+    wipStatus,
+    activeTask: inProgressTasks[0] || null,
+    activeTasks: inProgressTasks,
+    nextApprovedTask: null,
+    rejectedTasks: [],
+    lifecyclePlan: []
+  };
+
+  if (wipStatus.isSaturated) {
+    results.lifecyclePlan.push({
+      step: 'CONCLUDE_ACTIVE_TASKS',
+      message: wipStatus.alertMessage
+    });
+    return results;
+  }
+
+  for (const candidate of todoTasks) {
+    const evalRes = evaluateFullDevCandidate(candidate, projectContext);
+    if (evalRes.valid && !results.nextApprovedTask) {
+      results.nextApprovedTask = candidate;
+      results.lifecyclePlan.push({
+        step: 'TRANSITION_AND_START',
+        taskKey: candidate.key || candidate.id,
+        cleanSummary: evalRes.candidateTitle,
+        from: CANONICAL_KANBANS.TODO,
+        to: CANONICAL_KANBANS.IN_PROGRESS,
+        message: 'Ideia/tarefa aprovada pelo filtro de sanidade (Regra 14). Transicionar para "Em andamento" e iniciar ciclo.'
+      });
+    } else if (!evalRes.valid) {
+      results.rejectedTasks.push({
+        taskKey: candidate.key || candidate.id,
+        reasons: evalRes.reasons
+      });
+    }
+  }
+
+  return results;
+}
+
+// ==========================================
+// 2. TIME TRACKING & WORKLOGS
+// ==========================================
+
+function extractIssueKeys(text) {
+  if (!text || typeof text !== 'string') return [];
+  const matches = text.match(/\b[A-Z0-9_-]{2,15}-\d+\b/g) || [];
+  return [...new Set(matches.map(k => k.toUpperCase()))];
+}
+
+async function getExistingWorklogs(credentials, issueKey) {
+  try {
+    const res = await requestAtlassian(credentials, 'GET', `/rest/api/3/issue/${issueKey}/worklog`);
+    if (res.status === 200 && res.body?.worklogs) {
+      return res.body.worklogs;
+    }
+  } catch (err) {
+    void err;
+  }
+  return [];
+}
+
+async function logWorkTime(credentials, issueKey, timeSpentSeconds, commentText) {
+  const startedTime = new Date().toISOString().replace('Z', '+0000');
+  const payload = {
+    timeSpentSeconds,
+    started: startedTime,
+    comment: {
+      type: 'doc',
+      version: 1,
+      content: [
+        {
+          type: 'paragraph',
+          content: [{ type: 'text', text: commentText }]
+        }
+      ]
+    }
+  };
+
+  return requestAtlassian(credentials, 'POST', `/rest/api/3/issue/${issueKey}/worklog`, payload);
+}
+
+async function ensureInProgress(credentials, issueKey) {
+  try {
+    const issueRes = await requestAtlassian(credentials, 'GET', `/rest/api/3/issue/${issueKey}?fields=status`);
+    if (issueRes.status === 200 && issueRes.body?.fields?.status) {
+      const currentStatus = issueRes.body.fields.status.name || '';
+      const currentCat = issueRes.body.fields.status.statusCategory?.name || '';
+      if (resolveCanonicalColumn(currentStatus, currentCat) === CANONICAL_KANBANS.TODO) {
+        const transRes = await requestAtlassian(credentials, 'GET', `/rest/api/3/issue/${issueKey}/transitions`);
+        const transitions = transRes.body?.transitions || [];
+        const inProgTransition = transitions.find(t =>
+          resolveCanonicalColumn(t.name, t.to?.statusCategory?.name) === CANONICAL_KANBANS.IN_PROGRESS
+        );
+        if (inProgTransition) {
+          await requestAtlassian(credentials, 'POST', `/rest/api/3/issue/${issueKey}/transitions`, {
+            transition: { id: inProgTransition.id }
+          });
+          console.log(`[Jira Manager] 🔄 Card ${issueKey} transicionado para "Em andamento".`);
+        }
+      }
+    }
+  } catch (err) {
+    console.warn(`[Jira Manager] Aviso ao checar status de ${issueKey}:`, err.message);
+  }
+}
+
+async function trackIssueTime(credentials, key, gitMeta = {}) {
+  await ensureInProgress(credentials, key);
+
+  const shortSha = gitMeta.shortSha || (gitMeta.sha ? gitMeta.sha.slice(0, 7) : 'unknown');
+  const rawMessage = gitMeta.commitMessage || gitMeta.message || '';
+  const existing = await getExistingWorklogs(credentials, key);
+  const tag = `[commit:${shortSha}]`;
+  const alreadyLogged = existing.some(wl => {
+    const text = JSON.stringify(wl.comment || {});
+    return text.includes(tag);
+  });
+
+  if (alreadyLogged) {
+    console.log(`[Jira Manager] ℹ Tempo já registrado anteriormente para o commit ${shortSha} no card ${key}.`);
+    return { key, status: 'already_logged' };
+  }
+
+  const timeSpentSeconds = 900;
+  const comment = `Tempo de andamento registrado automaticamente via esteira de CI/CD.\nAutor: ${gitMeta.authorName || 'DevSecOps Bot'}\nCommit: ${shortSha} (${rawMessage.split('\n')[0]})\n${tag}`;
+
+  const res = await logWorkTime(credentials, key, timeSpentSeconds, comment);
+  if (res.status === 201) {
+    console.log(`[Jira Manager] ✅ 15m de andamento registrados no Jira para ${key} (Commit ${shortSha}).`);
+    return { key, status: 'logged', timeSpentSeconds };
+  } else {
+    console.warn(`[Jira Manager] ⚠️ Falha ao registrar tempo para ${key}: HTTP ${res.status}`);
+    return { key, status: 'failed', code: res.status };
+  }
+}
+
+async function runTimeTracking() {
+  console.log('--- Início da Execução do Jira Time Tracking Automático ---');
+  const credentials = getAtlassianCredentials();
+  if (!credentials.isConfigured) {
+    console.log('[Jira Manager] ℹ Credenciais Atlassian não configuradas. Pulando registro de tempo.');
+    return;
+  }
+
+  const gitMeta = getGitMetadata();
+  const keys = [
+    ...extractIssueKeys(gitMeta.branch),
+    ...extractIssueKeys(gitMeta.commitMessage)
+  ];
+
+  const uniqueKeys = [...new Set(keys)];
+  if (uniqueKeys.length === 0) {
+    console.log('[Jira Manager] ℹ Nenhuma chave Jira identificada na branch ou mensagem de commit.');
+    return;
+  }
+
+  console.log(`[Jira Manager] Chaves detectadas: ${uniqueKeys.join(', ')}`);
+  for (const key of uniqueKeys) {
+    try {
+      await trackIssueTime(credentials, key, gitMeta);
+    } catch (err) {
+      console.error(`[Jira Manager] ❌ Erro ao processar tempo para ${key}:`, err.message);
+    }
+  }
+}
+
+// ==========================================
+// 3. BACKLOG LOCAL & OFFLINE-FIRST (GIT-NATIVE)
+// ==========================================
+
+function getLocalBacklogPath() {
+  return path.resolve(process.cwd(), 'docs/LOCAL_BACKLOG.md');
+}
+
+function readLocalBacklog(customPath) {
+  const filePath = customPath || getLocalBacklogPath();
+  if (!fs.existsSync(filePath)) {
+    return [];
+  }
+
+  const content = fs.readFileSync(filePath, 'utf8');
+  const lines = content.split(/\r?\n/);
+  const tasks = [];
+  let currentSection = CANONICAL_KANBANS.TODO;
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith('## A fazer')) {
+      currentSection = CANONICAL_KANBANS.TODO;
+    } else if (trimmed.startsWith('## Em andamento')) {
+      currentSection = CANONICAL_KANBANS.IN_PROGRESS;
+    } else if (trimmed.startsWith('## Concluído')) {
+      currentSection = CANONICAL_KANBANS.DONE;
+    } else if (trimmed.startsWith('- [ ]') || trimmed.startsWith('- [x]') || trimmed.startsWith('- [X]')) {
+      const isChecked = trimmed.startsWith('- [x]') || trimmed.startsWith('- [X]');
+      const taskText = trimmed.replace(/^-\s*\[[ xX]\]\s*/, '');
+      const keyMatch = taskText.match(/\[([A-Z0-9_-]+)\]/);
+      const key = keyMatch ? keyMatch[1] : `TASK-${tasks.length + 1}`;
+      const summary = taskText.replace(/\[([A-Z0-9_-]+)\]\s*/, '').trim();
+
+      tasks.push({
+        key,
+        id: key,
+        summary,
+        status: isChecked ? CANONICAL_KANBANS.DONE : currentSection,
+        statusName: isChecked ? CANONICAL_KANBANS.DONE : currentSection,
+        statusCategory: isChecked ? 'DONE' : currentSection === CANONICAL_KANBANS.IN_PROGRESS ? 'IN_PROGRESS' : 'TO_DO'
+      });
+    }
+  }
+
+  return tasks;
+}
+
+function fetchKanbanTasks(credentials = {}, options = {}) {
+  const safeOptions = options && typeof options === 'object' ? options : {};
+  if (safeOptions.offline || !credentials || !credentials.isConfigured) {
+    return readLocalBacklog(safeOptions.localBacklogPath);
+  }
+  return [];
+}
+
+// ==========================================
+// 4. RELATÓRIO EXECUTIVO & AUDITORIA SARIF v2.1.0
+// ==========================================
+
+/**
+ * Formata relatório executivo em Markdown sobre o status do Kanban e pipeline Full Dev.
+ * @param {object} [outcome={}]
+ * @returns {string}
+ */
+function formatReport(outcome = {}) {
+  const safeOutcome = outcome && typeof outcome === 'object' ? outcome : {};
+  let md = '# 📊 Jira Kanban & Flow Management — Status Report\n\n';
+
+  const counts = safeOutcome.counts || {};
+  const wipStatus = safeOutcome.wipStatus || {};
+  const isSaturated = Boolean(wipStatus.isSaturated);
+
+  const statusBadge = isSaturated ? '🔴 **WIP SATURADO**' : '🟢 **FLUXO SAUDÁVEL**';
+  md += `**Status do Fluxo:** ${statusBadge}\n`;
+  md += `**Total de Tarefas:** \`${safeOutcome.totalTasks || 0}\`\n\n`;
+
+  md += '| Coluna Canônica | Contagem | Status |\n';
+  md += '| :--- | :---: | :--- |\n';
+  md += `| **A fazer** (\`TODO\`) | \`${counts.todo || 0}\` | 📥 Aguardando |\n`;
+  md += `| **Em andamento** (\`IN_PROGRESS\`) | \`${counts.inProgress || 0}\` | ${isSaturated ? '⚠️ Limite atingido' : '⚡ Ativo'} |\n`;
+  md += `| **Concluído** (\`DONE\`) | \`${counts.done || 0}\` | ✅ Finalizado |\n\n`;
+
+  if (safeOutcome.activeTask) {
+    const at = safeOutcome.activeTask;
+    md += `### 🚀 Tarefa Ativa em Desenvolvimento\n`;
+    md += `- **Chave:** \`${at.key || at.id || 'N/A'}\`\n`;
+    md += `- **Título:** ${at.title || at.summary || 'Sem título'}\n\n`;
+  }
+
+  if (safeOutcome.nextApprovedTask) {
+    const nt = safeOutcome.nextApprovedTask;
+    md += `### 🎯 Próxima Tarefa Aprovada (Regra 14)\n`;
+    md += `- **Chave:** \`${nt.key || nt.id || 'N/A'}\`\n`;
+    md += `- **Título:** ${nt.title || nt.summary || 'Sem título'}\n\n`;
+  }
+
+  if (Array.isArray(safeOutcome.rejectedTasks) && safeOutcome.rejectedTasks.length > 0) {
+    md += `### 🚫 Tarefas Descartadas / Sanity Filter (Regra 14)\n`;
+    for (const rej of safeOutcome.rejectedTasks) {
+      md += `- **${rej.taskKey}:** ${(rej.reasons || []).join('; ')}\n`;
+    }
+    md += '\n';
+  }
+
+  return md;
+}
+
+/**
+ * Audita a saúde do fluxo de trabalho e conformidade com limites de WIP emitindo relatório OASIS SARIF v2.1.0.
+ * @param {object} [outcome={}]
+ * @returns {object} SARIF v2.1.0 JSON object
+ */
+function auditToSarif(outcome = {}) {
+  const safeOutcome = outcome && typeof outcome === 'object' ? outcome : {};
+  const rules = [
+    {
+      id: 'RULE-KANBAN-001',
+      name: 'WipLimitExceeded',
+      severity: 'WARNING',
+      message: 'Limite de WIP saturado na coluna "Em andamento". Conclua tarefas antes de puxar novas.'
+    },
+    {
+      id: 'RULE-KANBAN-002',
+      name: 'NoActiveSprint',
+      severity: 'NOTE',
+      message: 'Nenhuma sprint está ativa no Jira, resultando em quadro ativo vazio.'
+    },
+    {
+      id: 'RULE-KANBAN-003',
+      name: 'OverengineeringCandidateRejected',
+      severity: 'WARNING',
+      message: 'Candidato do backlog rejeitado pelo filtro de sanidade (Regra 14).'
+    }
+  ];
+
+  const findings = [];
+
+  // Checagem de saturação de WIP
+  if (safeOutcome.wipStatus && safeOutcome.wipStatus.isSaturated) {
+    findings.push({
+      ruleId: 'RULE-KANBAN-001',
+      message: safeOutcome.wipStatus.alertMessage || 'WIP limit excedido.',
+      filePath: 'docs/LOCAL_BACKLOG.md',
+      line: 1,
+      column: 1
+    });
+  }
+
+  // Checagem de candidatos rejeitados por overengineering
+  if (Array.isArray(safeOutcome.rejectedTasks)) {
+    for (const rej of safeOutcome.rejectedTasks) {
+      findings.push({
+        ruleId: 'RULE-KANBAN-003',
+        message: `Tarefa ${rej.taskKey} vetada por anti-overengineering: ${(rej.reasons || []).join('; ')}`,
+        filePath: 'docs/LOCAL_BACKLOG.md',
+        line: 1,
+        column: 1
+      });
+    }
+  }
+
+  return createSarifReport({
+    toolName: 'agent-jira-manager',
+    toolVersion: '5.1.0',
+    rules,
+    findings,
+    properties: {
+      category: 'Agile Flow & Kanban Governance',
+      rule: 'Regra 11 e Regra 14'
+    }
+  });
+}
+
+// ==========================================
+// 5. CLASSE CANÔNICA JIRAMANAGER
+// ==========================================
+
+class JiraManager {
+  constructor(options = {}) {
+    this.credentials = options.credentials || getAtlassianCredentials();
+    this.targetDir = options.targetDir || process.cwd();
+    this.maxWip = Math.max(1, Number(options.maxWip) || 2);
+    this.logger = options.logger || console;
+  }
+
+  checkWipLimit(inProgressCount, maxWip = this.maxWip) {
+    return JiraManager.checkWipLimit(inProgressCount, maxWip);
+  }
+
+  resolveCanonicalColumn(statusName, statusCategory) {
+    return JiraManager.resolveCanonicalColumn(statusName, statusCategory);
+  }
+
+  standardizeBoardColumns(boardConfig) {
+    return JiraManager.standardizeBoardColumns(boardConfig);
+  }
+
+  buildCanonicalJql(projectKey, canonicalColumn) {
+    return JiraManager.buildCanonicalJql(projectKey, canonicalColumn);
+  }
+
+  evaluateFullDevCandidate(candidate, projectContext) {
+    return JiraManager.evaluateFullDevCandidate(candidate, projectContext);
+  }
+
+  processFullDevPipeline(tasks, projectContext, maxWip = this.maxWip) {
+    return JiraManager.processFullDevPipeline(tasks, projectContext, maxWip);
+  }
+
+  readLocalBacklog(customPath) {
+    return JiraManager.readLocalBacklog(customPath);
+  }
+
+  fetchKanbanTasks(options) {
+    return JiraManager.fetchKanbanTasks(this.credentials, options);
+  }
+
+  formatReport(outcome) {
+    return JiraManager.formatReport(outcome);
+  }
+
+  auditToSarif(outcome) {
+    return JiraManager.auditToSarif(outcome);
+  }
+
+  async trackIssueTime(key, gitMeta) {
+    return JiraManager.trackIssueTime(this.credentials, key, gitMeta);
+  }
+
+  // Métodos estáticos canônicos
+  static get CANONICAL_KANBANS() { return CANONICAL_KANBANS; }
+  static get CANONICAL_COLUMNS_LIST() { return CANONICAL_COLUMNS_LIST; }
+  static sanitizeIssueSummary(s) { return sanitizeIssueSummary(s); }
+  static checkWipLimit(c, m) { return checkWipLimit(c, m); }
+  static resolveCanonicalColumn(name, cat) { return resolveCanonicalColumn(name, cat); }
+  static standardizeBoardColumns(cfg) { return standardizeBoardColumns(cfg); }
+  static buildCanonicalJql(key, col) { return buildCanonicalJql(key, col); }
+  static validateSprintHealth(sprints) { return validateSprintHealth(sprints); }
+  static evaluateFullDevCandidate(c, ctx) { return evaluateFullDevCandidate(c, ctx); }
+  static processFullDevPipeline(tasks, ctx, maxWip) { return processFullDevPipeline(tasks, ctx, maxWip); }
+  static getLocalBacklogPath() { return getLocalBacklogPath(); }
+  static readLocalBacklog(p) { return readLocalBacklog(p); }
+  static fetchKanbanTasks(creds, opts) { return fetchKanbanTasks(creds, opts); }
+  static formatReport(o) { return formatReport(o); }
+  static auditToSarif(o) { return auditToSarif(o); }
+  static extractIssueKeys(t) { return extractIssueKeys(t); }
+  static getExistingWorklogs(creds, k) { return getExistingWorklogs(creds, k); }
+  static logWorkTime(creds, k, s, c) { return logWorkTime(creds, k, s, c); }
+  static ensureInProgress(creds, k) { return ensureInProgress(creds, k); }
+  static trackIssueTime(creds, k, meta) { return trackIssueTime(creds, k, meta); }
+  static runTimeTracking() { return runTimeTracking(); }
+}
+
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  if (args.includes('--track')) {
+    runTimeTracking().catch(console.error);
+  } else {
+    console.log('Jira Manager operacional. Use --track para executar apontamento de horas.');
+  }
+}
+
+module.exports = {
+  JiraManager,
+  // Kanban
+  CANONICAL_KANBANS,
+  CANONICAL_COLUMNS_LIST,
+  sanitizeIssueSummary,
+  checkWipLimit,
+  resolveCanonicalColumn,
+  standardizeBoardColumns,
+  buildCanonicalJql,
+  validateSprintHealth,
+  evaluateFullDevCandidate,
+  processFullDevPipeline,
+  // Backlog Local & Offline-First
+  getLocalBacklogPath,
+  readLocalBacklog,
+  fetchKanbanTasks,
+  // Relatórios & SARIF v2.1.0
+  formatReport,
+  auditToSarif,
+  auditKanbanToSarif: auditToSarif,
+  // Time Tracking
+  extractIssueKeys,
+  getExistingWorklogs,
+  logWorkTime,
+  ensureInProgress,
+  trackIssueTime,
+  runTimeTracking
+};