godpowers 3.0.2 → 3.13.0

package/references/orchestration/GOD-ORCHESTRATOR-RUNBOOK.md

@@ -367,6 +367,46 @@ after tests pass. If a git remote exists and the user passed an explicit push
 flag or the project intent says pushing is allowed, push after the green commit
 and then continue the project run. Pushing is not a terminal state.
 
+## Audit-Remediation Loop
+
+Run a bounded audit-then-remediate loop in three cases: the `full-arc`
+**`code-audit` step** (it runs `god-debt-assessor` after build and before the
+shipping tier, because AI-generated code can miss things a per-slice review and
+the security gate do not); intent like "audit and fix until clean" (the
+`audit-remediate` recipe); and any standalone `/god-tech-debt` follow-up. In
+`full-arc` the loop must drive Confirmed Critical and High findings to closure
+(or pause them as blockers) before `deploy`, `harden`, and `launch` proceed. The
+maker that fixes is never the checker that grades.
+
+1. **Audit (read-only).** Spawn `god-debt-assessor` in a fresh context. It writes
+   the scored, self-contained report to `.godpowers/tech-debt/REPORT.md` with
+   stable finding IDs (SEC-001, etc.), each carrying Severity, Confidence, Effort,
+   `file:line`, and a "Verify the fix" step.
+2. **Select.** Take the "What to fix first" list: Confirmed Critical and High,
+   worst-first, root causes (systemic patterns) before leaves. Re-verify any
+   Suspected finding against the cited code before touching it; never act on an
+   unconfirmed claim.
+3. **Drive each finding to closure** with an outcome loop so the loop is bounded
+   and self-arresting:
+   - `npx godpowers outcome start fix-<ID> --verify "<the finding's verify command>" --substep <tier.substep> --project=.`
+   - Spawn `god-debugger` (or the owning specialist) in a fresh context with only
+     that finding's evidence and touched files to draft the fix.
+   - Spawn an **independent** reviewer (`god-quality-reviewer`, or
+     `god-harden-auditor` for a SEC finding) in a fresh context to verify the fix
+     against the cited evidence and the project's tests. The maker does not grade
+     its own work.
+   - `npx godpowers outcome check fix-<ID> --project=.` runs the finding's verify
+     command and records the iteration. Repeat until the outcome succeeds or the
+     budget is exhausted.
+   - Never mark a finding resolved while `can-close` for its substep is red.
+4. **Re-audit.** Re-run `god-debt-assessor` and confirm findings are resolved,
+   not relocated, and that no Strength regressed. The loop is done when no
+   Confirmed Critical or High remains (or the agreed bucket is empty).
+5. **Pause, do not fake.** Anything that cannot be fixed within budget, or that
+   is `human-only` (scope, credentials, vendor/legal/Critical-security
+   acceptance), lands as a precise paused blocker with the finding ID, not a
+   silent skip. "Clean" is an evidence-backed re-audit, never a claim.
+
 ## Shipping Closure Protocol
 
 The shipping tier must not end by listing a broad provider checklist. God Mode
@@ -487,12 +527,17 @@ requested or final sign-off begins.
 5. Spawn the appropriate specialist agent in a fresh context
 6. Verify their output exists on disk
 7. Run have-nots check on the artifact and run `standards.gate-command` when configured
-8. If pass: update PROGRESS.md, sync CHECKPOINT.md, run the proactive
+8. For an executable-gated sub-step (build, deploy, harden), record executed
+   evidence with `npx godpowers verify "<cmd>" --substep <tier.substep>` and then
+   confirm `npx godpowers can-close --substep <tier.substep> --project=.` exits
+   zero before closing. Never advance the sub-step to done while can-close is red.
+9. If pass and can-close is green: advance the sub-step to done via
+   `npx godpowers state advance`, sync CHECKPOINT.md, run the proactive
    auto-invoke sweep, print the "Step result" card, then move to next sub-step
-9. If fail and repairable: print the failed result card, then enter the
+10. If fail and repairable: print the failed result card, then enter the
    autonomous repair loop
-10. If fail and human-only: pause with the smallest needed question
-11. Repeat until all tiers complete and verification is green
+11. If fail and human-only: pause with the smallest needed question
+12. Repeat until all tiers complete and verification is green
 ```
 
 ## Specialist Agent Routing

package/routing/recipes/audit-remediate.yaml

@@ -0,0 +1,30 @@
+apiVersion: godpowers/v1
+kind: Recipe
+metadata:
+  name: audit-remediate
+  category: maintaining
+  description: "Audit the codebase, then drive the findings to zero"
+
+triggers:
+  intent-keywords:
+    - "audit and fix"
+    - "fix all the audit findings"
+    - "drive the audit to clean"
+    - "remediate tech debt"
+    - "fix the codebase until clean"
+    - "pay down tech debt"
+    - "address all the findings"
+    - "code audit and fix"
+
+sequences:
+  default:
+    description: "Audit the codebase, then drive the findings to zero"
+    steps:
+      - command: "/god-tech-debt"
+        why: "Score the codebase and write the prioritized, self-contained audit report (god-debt-assessor)"
+      - command: "/god-debug"
+        why: "Fix each Confirmed Critical/High finding worst-first; an independent reviewer verifies each fix against the cited evidence"
+      - command: "/god-tech-debt"
+        why: "Re-audit to confirm findings are resolved not relocated and no strength regressed; the orchestrator loops this under an outcome budget until clean"
+
+default-sequence: default

package/skills/god-harden.md

@@ -21,8 +21,11 @@ Spawn the **god-harden-auditor** agent in a fresh context via the host platform'
 
 After god-harden-auditor returns:
 1. Verify FINDINGS.md exists on disk
-2. Run `npx godpowers gate --tier=harden --project=.` and do not proceed on a non-zero exit
-3. Read findings classification:
+2. Record the executed security check as evidence so the gate has a passing
+   verification record, for example:
+   `npx godpowers verify "npm audit --omit=dev" --substep tier-3.harden --claim "dependency audit clean" --project=.`
+3. Run `npx godpowers gate --tier=harden --project=.` and do not proceed on a non-zero exit
+4. Read findings classification:
    - If any Critical: run `npx godpowers state advance --step=harden --status=failed --project=.` and keep launch BLOCKED
    - If only High/Medium/Low: run `npx godpowers state advance --step=harden --status=done --project=.`
 

package/skills/god-version.md

@@ -16,7 +16,7 @@ Print version and a short capability summary.
 ```
 Godpowers v2.3.1
 Install: /Users/.../.claude/  (matches package.json)
-Surface: 120 skills, 40 agents, 13 workflows, 43 recipes
+Surface: 120 skills, 40 agents, 13 workflows, 44 recipes
 Schema: intent.v1, state.v1, events.v1, workflow.v1, routing.v1, recipe.v1
 External integrations available: impeccable, agent-browser (others lazy)
 Feature awareness: planning-system migration, source-system sync-back, context refresh, dashboard status labels, repo documentation sync, repo surface sync, quick proof, request trace, release hardening, maintenance hardening

package/workflows/full-arc.yaml

@@ -62,9 +62,16 @@ jobs:
     verification:
       required: [test, lint, typecheck-or-check]
 
+  code-audit:
+    tier: 2
+    needs: build
+    uses: god-debt-assessor@^1.0.0
+    with:
+      mode: post-build-audit
+
   deploy:
     tier: 3
-    needs: build
+    needs: code-audit
     uses: god-deploy-engineer@^1.0.0
     closure:
       on-missing-external-access: create-waiting-access-bundle
@@ -84,14 +91,21 @@ jobs:
 
   harden:
     tier: 3
-    needs: build
+    needs: code-audit
     uses: god-harden-auditor@^1.0.0
     blocks-on:
       - critical-finding: pause
 
-  launch:
+  docs:
     tier: 3
     needs: harden
+    uses: god-docs-writer@^1.0.0
+    with:
+      mode: product-docs-verify
+
+  launch:
+    tier: 3
+    needs: docs
     uses: god-launch-strategist@^1.0.0
     with:
       template: HARDEN-FINDINGS.md