delimit-cli 3.13.3 → 3.14.0

package/bin/delimit-cli.js

@@ -1067,9 +1067,43 @@ program
             return;
         }
 
+        // Step 2b: Compliance template selection (LED-258)
+        let complianceTemplate = null;
+        if (!options.yes) {
+            try {
+                const templateAns = await inquirer.prompt([{
+                    type: 'list',
+                    name: 'template',
+                    message: 'Compliance template (optional):',
+                    choices: [
+                        { name: 'none     — Standard governance only', value: 'none' },
+                        { name: 'SOC2     — Service Organization Control evidence', value: 'soc2' },
+                        { name: 'PCI-DSS  — Payment card data protection', value: 'pci-dss' },
+                        { name: 'HIPAA    — Healthcare data safeguards', value: 'hipaa' },
+                        { name: 'startup  — Fast-moving team defaults', value: 'startup' },
+                    ],
+                    default: 'none',
+                }]);
+                if (templateAns.template !== 'none') complianceTemplate = templateAns.template;
+            } catch {}
+        }
+
         // Step 3: Create policy file
         fs.mkdirSync(configDir, { recursive: true });
         fs.writeFileSync(policyFile, POLICY_PRESETS[preset]);
+
+        // Write compliance template config if selected
+        if (complianceTemplate) {
+            const templateConfig = {
+                soc2: { evidence_required: true, audit_trail: true, change_approval: true, retention_days: 365 },
+                'pci-dss': { evidence_required: true, audit_trail: true, change_approval: true, secret_scanning: true, retention_days: 365 },
+                hipaa: { evidence_required: true, audit_trail: true, change_approval: true, phi_detection: true, retention_days: 2190 },
+                startup: { evidence_required: false, audit_trail: true, change_approval: false, retention_days: 90 },
+            };
+            const tmplFile = path.join(configDir, 'compliance.json');
+            fs.writeFileSync(tmplFile, JSON.stringify({ template: complianceTemplate, ...templateConfig[complianceTemplate] }, null, 2));
+            console.log(chalk.green(`  Created .delimit/compliance.json (${complianceTemplate})`));
+        }
         console.log(chalk.green(`  Created .delimit/policies.yml (${preset})`));
 
         // Step 4: Add GitHub Action workflow if spec found + GitHub CI
@@ -1130,6 +1164,69 @@ jobs:
             }
         }
 
+        // Step 4b: Add scheduled drift monitoring workflow (LED-260)
+        if (specPath && ciProvider === 'github') {
+            const driftWorkflowFile = path.join(projectDir, '.github', 'workflows', 'api-drift-monitor.yml');
+            if (!fs.existsSync(driftWorkflowFile)) {
+                let writeDrift = false;
+                if (!options.yes) {
+                    try {
+                        const driftAns = await inquirer.prompt([{
+                            type: 'confirm',
+                            name: 'addDrift',
+                            message: 'Add weekly drift monitoring workflow?',
+                            default: true,
+                        }]);
+                        writeDrift = driftAns.addDrift;
+                    } catch {}
+                }
+                if (writeDrift) {
+                    try {
+                        const driftContent = `name: API Drift Monitor
+on:
+  schedule:
+    - cron: '17 9 * * 1'  # Weekly on Monday at 9:17 AM UTC
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  drift-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - run: pip install pyyaml 2>/dev/null
+      - name: Check for API drift
+        run: |
+          npx delimit-cli lint ${specPath} ${specPath} --baseline
+          echo "Drift check complete"
+      - name: Create issue on drift
+        if: failure()
+        uses: actions/github-script@v6
+        with:
+          script: |
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: 'API Drift Detected — Governance Review Needed',
+              body: 'The weekly drift monitor detected changes to the API spec that have not been reviewed through governance. Run delimit lint to review.',
+              labels: ['api-governance', 'drift'],
+            });
+`;
+                        fs.writeFileSync(driftWorkflowFile, driftContent);
+                        console.log(chalk.green('  Created .github/workflows/api-drift-monitor.yml'));
+                    } catch (err) {
+                        console.log(chalk.yellow(`  Could not write drift workflow: ${err.message}`));
+                    }
+                }
+            }
+        }
+
         // Step 5: Run first lint to show immediate value
         console.log('');
         if (specPath) {
@@ -1182,9 +1279,50 @@ jobs:
             }
         }
 
+        // Step 6: Save first evidence event (LED-258)
+        const evidenceDir = path.join(configDir, 'evidence');
+        fs.mkdirSync(evidenceDir, { recursive: true });
+        const evidenceEvent = {
+            id: `EVD-${Date.now().toString(36)}`,
+            ts: new Date().toISOString(),
+            type: 'governance_init',
+            tool: 'delimit_init',
+            model: 'cli',
+            status: 'pass',
+            summary: `Governance initialized with ${preset} preset`,
+            detail: [
+                `Project: ${projectName}`,
+                frameworkLabel ? `Framework: ${frameworkLabel}` : null,
+                specPath ? `Spec: ${specPath}` : 'Mode: Zero-Spec',
+                `Preset: ${preset}`,
+                ciProvider !== 'none' ? `CI: ${ciProvider}` : null,
+            ].filter(Boolean).join('\n'),
+            venture: projectName,
+        };
+        try {
+            const evidenceFile = path.join(evidenceDir, 'events.jsonl');
+            fs.appendFileSync(evidenceFile, JSON.stringify(evidenceEvent) + '\n');
+            console.log(chalk.green('  Evidence recorded — first governance event saved'));
+        } catch {}
+
+        // Step 7: Show gate status (LED-258)
+        console.log(chalk.bold('\n  Governance Gates:'));
+        const gates = [
+            { name: 'API Lint', status: specPath || ['fastapi', 'nestjs', 'express'].includes(framework) ? 'active' : 'inactive', chain: 'semver → gov_evaluate' },
+            { name: 'Security Audit', status: 'ready', chain: 'evidence_collect → notify' },
+            { name: 'Deploy Plan', status: 'ready', chain: 'security_audit' },
+            { name: 'Release Validate', status: 'ready', chain: 'evidence_collect → notify → ledger' },
+        ];
+        for (const gate of gates) {
+            const icon = gate.status === 'active' ? chalk.green('●') : gate.status === 'ready' ? chalk.yellow('○') : chalk.gray('○');
+            const statusLabel = gate.status === 'active' ? chalk.green('active') : gate.status === 'ready' ? chalk.yellow('ready') : chalk.gray('inactive');
+            console.log(`    ${icon} ${chalk.bold(gate.name)} ${chalk.gray('→')} ${chalk.gray(gate.chain)} ${chalk.gray('(')}${statusLabel}${chalk.gray(')')}`);
+        }
+
         // Summary
         const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
-        console.log(chalk.bold(`\n  Setup complete in ${elapsed}s\n`));
+        console.log(chalk.bold(`\n  Setup complete in ${elapsed}s`));
+        console.log(chalk.gray(`  Evidence saved to .delimit/evidence/events.jsonl\n`));
         console.log('  Next steps:');
         if (specPath) {
             console.log(`    ${chalk.bold('delimit lint')} ${specPath} ${specPath}  — lint on every PR`);

package/bin/delimit-setup.js

@@ -290,7 +290,7 @@ async function main() {
             }
             // Add governance instructions
             if (!geminiConfig.customInstructions || !geminiConfig.customInstructions.includes('delimit_ledger_context')) {
-                geminiConfig.customInstructions = 'Delimit MCP is installed. On every session start, call delimit_ledger_context to check for open tasks. If new project, call delimit_scan. Track all work via the ledger.';
+                geminiConfig.customInstructions = 'Delimit MCP is installed. On every session start: (1) call delimit_ledger_context for open tasks, (2) call delimit_gov_health, (3) call delimit_inbox_daemon(action="start") to start email polling. If new project, call delimit_scan. Track all work via the ledger.';
                 fs.writeFileSync(GEMINI_CONFIG, JSON.stringify(geminiConfig, null, 2));
             }
         } catch (e) {
@@ -537,7 +537,12 @@ if [ "$DELIMIT_WRAPPED" = "true" ] || [ ! -t 1 ]; then
 fi
 DELIMIT_HOME="\${DELIMIT_HOME:-$HOME/.delimit}"
 TOOL_COUNT="0"
-[ -f "$DELIMIT_HOME/server/ai/server.py" ] && TOOL_COUNT=$(grep -c '@mcp.tool' "$DELIMIT_HOME/server/ai/server.py" 2>/dev/null || echo "0")
+if [ -f "$DELIMIT_HOME/server/ai/server.py" ]; then
+  TOTAL=$(grep -c '@mcp.tool' "$DELIMIT_HOME/server/ai/server.py" 2>/dev/null || echo "0")
+  OPS=$(grep -c '@_ops_pack_tool' "$DELIMIT_HOME/server/ai/server.py" 2>/dev/null || echo "0")
+  INTERNAL=$(grep -c '@_internal_tool' "$DELIMIT_HOME/server/ai/server.py" 2>/dev/null || echo "0")
+  TOOL_COUNT=$((TOTAL - OPS - INTERNAL))
+fi
 echo ""
 printf "  \${PURPLE}\${BOLD}    ____  ________    ______  _____________\${RESET}\\n"
 printf "  \${PURPLE}\${BOLD}   / __ \\\\/ ____/ /   /  _/  |/  /  _/_  __/\${RESET}\\n"
@@ -810,8 +815,9 @@ Unify all AI coding assistants with persistent context, governance, and multi-mo
 ## On every session start:
 1. Call \`delimit_ledger_context\` to check for open tasks
 2. Call \`delimit_gov_health\` to check governance status
-3. If returning user, summarize what's pending
-4. If new project, call \`delimit_scan\` to discover what Delimit can do
+3. Call \`delimit_inbox_daemon(action="start")\` to start email polling — ALL venture inboxes route through this. Owner approves/adjusts/denies via email reply, same as being logged in.
+4. If returning user, summarize what's pending
+5. If new project, call \`delimit_scan\` to discover what Delimit can do
 
 ## After editing code:
 - After editing UI/CSS: call \`delimit_design_validate_responsive\`