amsd-pipeline-shared 0.5.1 → 0.5.2

package/docs/gateway-baseline-2.0.80.md5

@@ -86,3 +86,5 @@ ac166207d8a1d93a4c50a88568ef6e5c  scripts/lib/handlers/write-missing-plans.js
 8a1bb4df2d1b6e7fd135f757423fb2f2  config/repo-artifacts.json
 91cec3c50040ebc9050c3d95f037bce2  config/run-modes.json
 ee4366721c38cbc8cd72ee0f779d22a8  scripts/lib/plan-scope.js
+aab7063cf68a9ecd54f6ef735adf895e  scripts/lib/engine-paths.sh
+1d0346da09c13150e511809034396949  scripts/lib/pipeline-commit.sh

package/docs/gateway-files.txt

@@ -32,6 +32,7 @@ scripts/lib/doctor/repair.js
 scripts/lib/doctor/restarter.js
 scripts/lib/doctor/state.js
 scripts/lib/ecosystem-registry.js
+scripts/lib/engine-paths.sh
 scripts/lib/engine-prompt.js
 scripts/lib/env-file.sh
 scripts/lib/evidence-windows.js
@@ -73,6 +74,7 @@ scripts/lib/model-ladder.sh
 scripts/lib/model-ladders.sh
 scripts/lib/orchestration-resume.sh
 scripts/lib/phase-exit.sh
+scripts/lib/pipeline-commit.sh
 scripts/lib/pipeline-tools.js
 scripts/lib/plan-hash.js
 scripts/lib/plan-scope.js

package/orchestrations/scripts/lib/engine-paths.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# What the ENGINE owns — the bash half of src/config/enginePaths.ts.
+#
+# These directories hold epam-cli's own state: knowledge base, agent profiles, run logs,
+# code indexes, telemetry, contracts. None of it is client content, none of it is writer
+# output, and none of it may be committed into a client codeline.
+#
+# ONE definition, because this rule has already drifted three ways. lib/git-ops.sh carried
+# the full list, worktree-health-check.sh excluded only orchestrations/logs/* (so
+# orchestrations/agents/KB.md passed straight through), Step 9's auto-commit excluded
+# nothing, and lib/story-outputs.sh had its own separate regex covering only two of the
+# five. Live metrolinx 20260804T225443Z: the engine's KB.md was written into the upexpress
+# client repo and recorded as writer output in that lane's manifest.
+#
+# The real perimeter is the WRITE seam (src/config/enginePaths.ts, enforced in
+# WriteFileTool). Everything here is defence in depth.
+
+_ENGINE_OWNED_DIRS=( 'orchestrations' '.epam' '.codegraph' '.deepeval' '.contracts' )
+
+# engine_paths_filter — stdin: repo-relative paths. stdout: those that are NOT engine-owned.
+#
+# Matches whole path SEGMENTS, never a substring: `src/orchestrations-ui/App.tsx` is client
+# code and must survive, while `orchestrations/agents/KB.md` and
+# `packages/web/.epam/settings.json` must both be dropped.
+engine_paths_filter() {
+    local _line
+    local _owned_list
+    _owned_list=$(printf '%s\n' "${_ENGINE_OWNED_DIRS[@]}")
+    while IFS= read -r _line; do
+        [ -n "$_line" ] || continue
+        # -x -F: exact, literal, whole-segment. No pattern matching.
+        if printf '%s\n' "$_line" | tr '/' '\n' | grep -qxF "$_owned_list" 2>/dev/null; then
+            continue
+        fi
+        printf '%s\n' "$_line"
+    done
+}
+
+# engine_paths_pathspec — the same owned set, as git pathspec exclusions.
+#
+# engine_paths_filter above filters a LIST of paths. Some callers need the exclusion applied by
+# git itself, because their output is a patch rather than a list and there are no paths to filter.
+# Both read _ENGINE_OWNED_DIRS, so the set is defined once: restating it in pathspec form at a
+# call site is how this rule has already drifted three ways.
+#
+# Usage:  mapfile -t _ex < <(engine_paths_pathspec); git diff <ref> -- . "${_ex[@]}"
+engine_paths_pathspec() {
+    local _d
+    for _d in "${_ENGINE_OWNED_DIRS[@]}"; do
+        printf ':!%s/*\n:!*/%s/*\n' "$_d" "$_d"
+    done
+}

package/orchestrations/scripts/lib/git-ops.sh

@@ -370,22 +370,66 @@ git_add_client_outputs() {
     return $_rc
 }
 
-# _story_branch_carries_own_work <root> <branch> <story_id> — true when <branch> exists and this run recorded a commit of
-# <story_id> (LOG_DIR/story-changes.jsonl) that is in the branch's history; never on a resume sent back to an earlier stage.
+# story_branch_name <story_id> [suffix] — THE ONE RULE for a story's branch name, for every pipeline that works a story branch (B75, RS-10): the project's
+# prefix (EPAM_BRANCH_PREFIX), "AI-<story_id>", and a release line's suffix (the argument, else EPAM_BRANCH_SUFFIX; an explicit empty suffix means none).
+story_branch_name() { printf '%s' "${EPAM_BRANCH_PREFIX:-}AI-${1}${2-${EPAM_BRANCH_SUFFIX:-}}"; }
+
+# _story_local_base_ref <root> <baseline> — the baseline as the checkout already has it, WITHOUT the network: the tag, then origin's branch, then the local
+# branch. Empty when none resolves.
+_story_local_base_ref() {
+    local _root="$1" _b="${2#refs/tags/}" _ref
+    _b="${_b#refs/heads/}"
+    [ -n "$_b" ] || return 0
+    for _ref in "refs/tags/${_b}" "refs/remotes/origin/${_b}" "refs/heads/${_b}"; do
+        git -C "$_root" rev-parse -q --verify "${_ref}^{commit}" >/dev/null 2>&1 && { printf '%s' "$_ref"; return 0; }
+    done
+    return 0
+}
+
+# _story_branch_carries_own_work <root> <branch> <story_id> [baseline] — true when <branch> exists and carries the story's own work. B75 (RS-1): the evidence
+# is GIT — a commit of the story ("<story_id>: …", the convention every commit of the story follows) between the baseline and the branch — so it holds for
+# any pipeline, wherever it keeps its records; a client's own history using the same ticket prefix does not count (only commits since the baseline). The bash
+# pipeline's own record (LOG_DIR/story-changes.jsonl) is evidence too, as before. Never on a resume sent back to an earlier stage.
 _story_branch_carries_own_work() {
-    local _root="$1" _br="$2" _id="$3" _f="${LOG_DIR:-}/story-changes.jsonl" _sha
-    [ -n "$_id" ] && [ -f "$_f" ] || return 1
+    local _root="$1" _br="$2" _id="$3" _base_name="${4:-}" _f="${LOG_DIR:-}/story-changes.jsonl" _sha _base _re
+    [ -n "$_id" ] || return 1
     git -C "$_root" rev-parse -q --verify "refs/heads/${_br}" >/dev/null 2>&1 || return 1
     if [ -n "${EPAM_RESUME_FROM_STAGE:-}" ] && declare -F _stage_rank >/dev/null 2>&1 \
         && [ "$(_stage_rank "$EPAM_RESUME_FROM_STAGE")" -lt "$(_stage_rank pre-writer)" ]; then
         return 1
     fi
+    _base=$(_story_local_base_ref "$_root" "$_base_name")
+    if [ -n "$_base" ]; then
+        _re=$(printf '%s' "$_id" | sed 's/[][\.*^$/]/\\&/g')
+        [ -n "$(git -C "$_root" log -1 --format=%h --grep="^${_re}:" "${_base}..refs/heads/${_br}" 2>/dev/null)" ] && return 0
+    fi
+    [ -f "$_f" ] || return 1
     while IFS= read -r _sha; do
         [ -n "$_sha" ] && git -C "$_root" merge-base --is-ancestor "$_sha" "refs/heads/${_br}" 2>/dev/null && return 0
     done < <(jq -r --arg id "$_id" 'select(.storyId == $id) | .sha // empty' "$_f" 2>/dev/null)
     return 1
 }
 
+# _preserve_uncommitted <root> <story_id> — B75 (RS-3): before ANY reset, whatever the working tree holds that no commit holds (tracked edits and untracked
+# files, the pipeline's own .epam/ aside) is committed to a rescue ref, epam-rescue/<story>-wip-<sha>, without touching the branch, the index or the tree.
+# Nothing to preserve: nothing is done. Fails (non-zero) when it cannot — the caller then refuses to reset, as it does when a commit cannot be pinned.
+_preserve_uncommitted() {
+    local _root="$1" _id="$2" _idx _tree _head _commit _ref
+    [ -n "$(git -C "$_root" status --porcelain --untracked-files=all -- . ':(exclude).epam' 2>/dev/null)" ] || return 0
+    _head=$(git -C "$_root" rev-parse -q --verify HEAD 2>/dev/null) || _head=""
+    _idx=$(mktemp -u "${TMPDIR:-/tmp}/epam-wip-index-XXXXXX") || return 1
+    GIT_INDEX_FILE="$_idx" git -C "$_root" add -A -- . ':(exclude).epam' >/dev/null 2>&1 || { rm -f "$_idx"; return 1; }
+    _tree=$(GIT_INDEX_FILE="$_idx" git -C "$_root" write-tree 2>/dev/null) || { rm -f "$_idx"; return 1; }
+    rm -f "$_idx"
+    _commit=$(git -C "$_root" -c user.name="${GIT_COMMITTER_NAME:-epam-rescue}" -c user.email="${GIT_COMMITTER_EMAIL:-epam-rescue@local}" \
+        commit-tree "$_tree" ${_head:+-p "$_head"} -m "epam-rescue: uncommitted work of ${_id}" 2>/dev/null) || return 1
+    _ref="epam-rescue/${_id}-wip-$(git -C "$_root" rev-parse --short "$_commit" 2>/dev/null || echo unknown)"
+    git -C "$_root" branch -f "$_ref" "$_commit" --quiet 2>/dev/null || return 1
+    warning "  [story-branch] ${_id}: uncommitted work preserved on branch '${_ref}'"
+    warning "  [story-branch]   recover with: git -C '${_root}' checkout ${_ref} -- <path>"
+    return 0   # the work IS preserved; a logger that cannot write (it returns its own status) must not turn that into a failure
+}
+
 ensure_story_branch() {
     local codeline_root="$1"
     local story_id="$2"
@@ -405,15 +449,16 @@ ensure_story_branch() {
     # constraint, so the default preserves today's plain "AI-<story_id>" shape.
     # ONE STORY BRANCH PER RELEASE LINE (lib/release-lines.sh): a line other than the codeline's own carries a
     # suffix, so the codeline's own story branch is never reset by another line's work.
-    local _branch="${EPAM_BRANCH_PREFIX:-}AI-${story_id}${EPAM_BRANCH_SUFFIX:-}"
+    local _branch; _branch=$(story_branch_name "$story_id")
 
     # A STORY THAT ALREADY HAS ITS OWN WORK ON ITS BRANCH CONTINUES FROM IT (AMSD-2974 run 9, 2026-10-14). A self-heal retry
     # sets the story pending again and comes back here; the hard reset below moved the 7.x line's branch to v7.11.0 twice
     # in one run, discarding the approved full port (c25e819), and the writer re-wrote it from nothing — paid twice, weaker.
     # This run's own record of the story's commits (story-changes.jsonl) is what says the work is its own: a fresh run has
     # none, and a resume sent back to an earlier stage (EPAM_RESUME_FROM_STAGE) starts over as asked.
-    if _story_branch_carries_own_work "$codeline_root" "$_branch" "$story_id"; then
+    if _story_branch_carries_own_work "$codeline_root" "$_branch" "$story_id" "$baseline_branch"; then
         if git -C "$codeline_root" checkout -q "$_branch" 2>/dev/null; then
+            _preserve_uncommitted "$codeline_root" "$story_id" || { error "  [story-branch] $story_id: uncommitted work could not be preserved — refusing to reset it away"; return 1; }
             git -C "$codeline_root" reset --hard -q "$_branch" 2>/dev/null || true
             git -C "$codeline_root" clean -fd -e .epam -q 2>/dev/null || true
             _provision_epam_plugin_config "$codeline_root"
@@ -509,6 +554,8 @@ ensure_story_branch() {
         fi
     done
 
+    _preserve_uncommitted "$codeline_root" "$story_id" || { error "  [story-branch] $story_id: uncommitted work could not be preserved — refusing to reset it away"; return 1; }
+
     if git -C "$codeline_root" checkout -B "$_branch" "$_base_ref" --quiet 2>/dev/null; then
         # checkout -B only forces tracked files that DIFFER between the old
         # branch tip and the new start-point — a tracked file whose content

package/orchestrations/scripts/lib/pipeline-commit.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# pipeline_commit_flags — the flags every commit the PIPELINE makes passes to `git commit`, one per line.
+#
+# A codeline's hooks are written for its team's own checkout and machine. Operator decisions,
+# 2026-10-05 (AMSD-2974): the pipeline's commits skip them — first inside worktrees, then in the
+# checkout too. Proven on a copy of next.gotransit.com: its pre-commit hook (husky + lint-staged)
+# type-checks the WHOLE project, which fails on the untouched checkout with 6 errors because the
+# team's node_modules is older than its own develop branch expects (it needs an `npm install`, which
+# the pipeline may not run) — so the hook refused every pipeline commit there, whatever it held, and
+# the reproducing test of a correct fix was never committed. In worktrees the same hook also refused
+# the branch name and sourced a helper git does not track.
+#
+# What the hook checks is still checked by the pipeline: the story's own verification, Step 19/20's
+# type check judged against the phase baseline, the lint gate, review and the QA gates. The Step 17
+# merge onto the story branch still runs the codeline's commit-msg hook (git merge has no --no-verify
+# here), and its message is written to pass it.
+pipeline_commit_flags() {
+    echo "--no-verify"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amsd-pipeline-shared",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "The AMSD pipeline's shared components, one source for the bash pipeline and its Claude workflows: the model-call gateway (llm-handler.sh — retry, ladder, self-heal, cost) and the libraries it runs.",
   "license": "UNLICENSED",
   "bin": {