oxe-cc 1.2.1 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (281) hide show
  1. package/.cursor/commands/oxe-ask.md +2 -2
  2. package/.cursor/commands/oxe-capabilities.md +2 -2
  3. package/.cursor/commands/oxe-checkpoint.md +2 -2
  4. package/.cursor/commands/oxe-compact.md +2 -2
  5. package/.cursor/commands/oxe-dashboard.md +2 -2
  6. package/.cursor/commands/oxe-debug.md +2 -2
  7. package/.cursor/commands/oxe-discuss.md +2 -2
  8. package/.cursor/commands/oxe-execute.md +5 -2
  9. package/.cursor/commands/oxe-forensics.md +2 -2
  10. package/.cursor/commands/oxe-help.md +2 -2
  11. package/.cursor/commands/oxe-loop.md +2 -2
  12. package/.cursor/commands/oxe-milestone.md +2 -2
  13. package/.cursor/commands/oxe-next.md +2 -2
  14. package/.cursor/commands/oxe-obs.md +2 -2
  15. package/.cursor/commands/oxe-plan-agent.md +2 -2
  16. package/.cursor/commands/oxe-plan.md +2 -2
  17. package/.cursor/commands/oxe-project.md +2 -2
  18. package/.cursor/commands/oxe-quick.md +2 -2
  19. package/.cursor/commands/oxe-research.md +2 -2
  20. package/.cursor/commands/oxe-retro.md +2 -2
  21. package/.cursor/commands/oxe-review-pr.md +2 -2
  22. package/.cursor/commands/oxe-route.md +2 -2
  23. package/.cursor/commands/oxe-scan.md +2 -2
  24. package/.cursor/commands/oxe-security.md +2 -2
  25. package/.cursor/commands/oxe-session.md +2 -2
  26. package/.cursor/commands/oxe-ship.md +2 -2
  27. package/.cursor/commands/oxe-skill.md +2 -2
  28. package/.cursor/commands/oxe-spec.md +2 -2
  29. package/.cursor/commands/oxe-ui-review.md +2 -2
  30. package/.cursor/commands/oxe-ui-spec.md +2 -2
  31. package/.cursor/commands/oxe-update.md +2 -2
  32. package/.cursor/commands/oxe-validate-gaps.md +2 -2
  33. package/.cursor/commands/oxe-verify.md +5 -2
  34. package/.cursor/commands/oxe-workstream.md +2 -2
  35. package/.cursor/commands/oxe.md +2 -2
  36. package/.github/copilot-instructions.md +13 -13
  37. package/.github/prompts/oxe-ask.prompt.md +2 -2
  38. package/.github/prompts/oxe-capabilities.prompt.md +2 -2
  39. package/.github/prompts/oxe-checkpoint.prompt.md +2 -2
  40. package/.github/prompts/oxe-compact.prompt.md +2 -2
  41. package/.github/prompts/oxe-dashboard.prompt.md +2 -2
  42. package/.github/prompts/oxe-debug.prompt.md +2 -2
  43. package/.github/prompts/oxe-discuss.prompt.md +2 -2
  44. package/.github/prompts/oxe-execute.prompt.md +5 -2
  45. package/.github/prompts/oxe-forensics.prompt.md +2 -2
  46. package/.github/prompts/oxe-help.prompt.md +2 -2
  47. package/.github/prompts/oxe-loop.prompt.md +2 -2
  48. package/.github/prompts/oxe-milestone.prompt.md +2 -2
  49. package/.github/prompts/oxe-next.prompt.md +2 -2
  50. package/.github/prompts/oxe-obs.prompt.md +2 -2
  51. package/.github/prompts/oxe-plan-agent.prompt.md +2 -2
  52. package/.github/prompts/oxe-plan.prompt.md +2 -2
  53. package/.github/prompts/oxe-project.prompt.md +2 -2
  54. package/.github/prompts/oxe-quick.prompt.md +2 -2
  55. package/.github/prompts/oxe-research.prompt.md +2 -2
  56. package/.github/prompts/oxe-retro.prompt.md +2 -2
  57. package/.github/prompts/oxe-review-pr.prompt.md +2 -2
  58. package/.github/prompts/oxe-route.prompt.md +2 -2
  59. package/.github/prompts/oxe-scan.prompt.md +2 -2
  60. package/.github/prompts/oxe-security.prompt.md +2 -2
  61. package/.github/prompts/oxe-session.prompt.md +2 -2
  62. package/.github/prompts/oxe-ship.prompt.md +2 -2
  63. package/.github/prompts/oxe-skill.prompt.md +2 -2
  64. package/.github/prompts/oxe-spec.prompt.md +2 -2
  65. package/.github/prompts/oxe-ui-review.prompt.md +2 -2
  66. package/.github/prompts/oxe-ui-spec.prompt.md +2 -2
  67. package/.github/prompts/oxe-update.prompt.md +2 -2
  68. package/.github/prompts/oxe-validate-gaps.prompt.md +2 -2
  69. package/.github/prompts/oxe-verify.prompt.md +5 -2
  70. package/.github/prompts/oxe-workstream.prompt.md +2 -2
  71. package/.github/prompts/oxe.prompt.md +2 -2
  72. package/AGENTS.md +5 -3
  73. package/CHANGELOG.md +72 -10
  74. package/LICENSE +21 -674
  75. package/README.md +631 -535
  76. package/bin/banner.txt +6 -6
  77. package/bin/lib/oxe-agent-install.cjs +69 -69
  78. package/bin/lib/oxe-azure.cjs +1445 -1445
  79. package/bin/lib/oxe-context-engine.cjs +867 -867
  80. package/bin/lib/oxe-dashboard.cjs +76 -28
  81. package/bin/lib/oxe-operational.cjs +2144 -1340
  82. package/bin/lib/oxe-project-health.cjs +483 -1
  83. package/bin/lib/oxe-runtime-semantics.cjs +12 -0
  84. package/bin/oxe-cc.js +554 -152
  85. package/commands/oxe/ask.md +2 -2
  86. package/commands/oxe/capabilities.md +2 -2
  87. package/commands/oxe/checkpoint.md +2 -2
  88. package/commands/oxe/compact.md +2 -2
  89. package/commands/oxe/dashboard.md +2 -2
  90. package/commands/oxe/debug.md +2 -2
  91. package/commands/oxe/discuss.md +2 -2
  92. package/commands/oxe/execute.md +5 -2
  93. package/commands/oxe/forensics.md +2 -2
  94. package/commands/oxe/help.md +2 -2
  95. package/commands/oxe/loop.md +2 -2
  96. package/commands/oxe/milestone.md +2 -2
  97. package/commands/oxe/next.md +2 -2
  98. package/commands/oxe/obs.md +2 -2
  99. package/commands/oxe/oxe.md +2 -2
  100. package/commands/oxe/plan-agent.md +2 -2
  101. package/commands/oxe/plan.md +2 -2
  102. package/commands/oxe/project.md +2 -2
  103. package/commands/oxe/quick.md +2 -2
  104. package/commands/oxe/research.md +2 -2
  105. package/commands/oxe/retro.md +2 -2
  106. package/commands/oxe/review-pr.md +2 -2
  107. package/commands/oxe/route.md +2 -2
  108. package/commands/oxe/scan.md +2 -2
  109. package/commands/oxe/security.md +2 -2
  110. package/commands/oxe/session.md +2 -2
  111. package/commands/oxe/ship.md +2 -2
  112. package/commands/oxe/skill.md +2 -2
  113. package/commands/oxe/spec.md +2 -2
  114. package/commands/oxe/ui-review.md +2 -2
  115. package/commands/oxe/ui-spec.md +2 -2
  116. package/commands/oxe/update.md +2 -2
  117. package/commands/oxe/validate-gaps.md +2 -2
  118. package/commands/oxe/verify.md +5 -2
  119. package/commands/oxe/workstream.md +2 -2
  120. package/lib/runtime/delivery/branch-manager.d.ts +1 -0
  121. package/lib/runtime/delivery/branch-manager.js +7 -0
  122. package/lib/runtime/delivery/ci-checks.js +34 -1
  123. package/lib/runtime/delivery/delivery-records.d.ts +34 -0
  124. package/lib/runtime/delivery/delivery-records.js +48 -0
  125. package/lib/runtime/delivery/index.d.ts +1 -0
  126. package/lib/runtime/delivery/index.js +1 -0
  127. package/lib/runtime/delivery/promotion-pipeline.d.ts +26 -2
  128. package/lib/runtime/delivery/promotion-pipeline.js +111 -14
  129. package/lib/runtime/gate/gate-manager.d.ts +41 -0
  130. package/lib/runtime/gate/gate-manager.js +108 -1
  131. package/lib/runtime/index.d.ts +2 -2
  132. package/lib/runtime/index.js +3 -1
  133. package/lib/runtime/models/gate-decision.d.ts +4 -1
  134. package/lib/runtime/models/workspace.d.ts +3 -0
  135. package/lib/runtime/plugins/capability-adapter.d.ts +12 -0
  136. package/lib/runtime/plugins/capability-adapter.js +204 -0
  137. package/lib/runtime/plugins/capability-matrix.d.ts +5 -0
  138. package/lib/runtime/plugins/capability-matrix.js +48 -17
  139. package/lib/runtime/plugins/index.d.ts +1 -0
  140. package/lib/runtime/plugins/index.js +1 -0
  141. package/lib/runtime/plugins/plugin-abi.d.ts +2 -0
  142. package/lib/runtime/plugins/plugin-manifest.d.ts +1 -1
  143. package/lib/runtime/plugins/plugin-manifest.js +6 -2
  144. package/lib/runtime/plugins/plugin-registry.d.ts +46 -0
  145. package/lib/runtime/plugins/plugin-registry.js +79 -2
  146. package/lib/runtime/policy/policy-engine.d.ts +19 -0
  147. package/lib/runtime/policy/policy-engine.js +76 -4
  148. package/lib/runtime/projection/projection-engine.d.ts +9 -1
  149. package/lib/runtime/projection/projection-engine.js +73 -3
  150. package/lib/runtime/scheduler/multi-agent-coordinator.d.ts +43 -1
  151. package/lib/runtime/scheduler/multi-agent-coordinator.js +151 -39
  152. package/lib/runtime/scheduler/run-journal.d.ts +1 -1
  153. package/lib/runtime/scheduler/scheduler.d.ts +19 -1
  154. package/lib/runtime/scheduler/scheduler.js +258 -13
  155. package/lib/runtime/verification/verification-compiler.d.ts +43 -0
  156. package/lib/runtime/verification/verification-compiler.js +137 -0
  157. package/lib/runtime/verification/verification-manifest.d.ts +9 -0
  158. package/lib/runtime/verification/verification-manifest.js +56 -6
  159. package/lib/runtime/workspace/strategies/ephemeral-container.d.ts +1 -0
  160. package/lib/runtime/workspace/strategies/ephemeral-container.js +4 -0
  161. package/lib/runtime/workspace/strategies/git-worktree.d.ts +1 -0
  162. package/lib/runtime/workspace/strategies/git-worktree.js +2 -0
  163. package/lib/runtime/workspace/strategies/inplace.d.ts +1 -0
  164. package/lib/runtime/workspace/strategies/inplace.js +2 -0
  165. package/lib/runtime/workspace/workspace-manager.d.ts +2 -1
  166. package/lib/sdk/README.md +20 -8
  167. package/lib/sdk/index.cjs +33 -24
  168. package/lib/sdk/index.d.ts +149 -14
  169. package/oxe/templates/ACTIVE-RUN.template.json +32 -32
  170. package/oxe/templates/CAPABILITIES.template.md +7 -7
  171. package/oxe/templates/CAPABILITY.template.md +45 -45
  172. package/oxe/templates/CHECKPOINTS.template.md +7 -7
  173. package/oxe/templates/EXECUTION-RUNTIME.template.md +68 -68
  174. package/oxe/templates/HYPOTHESES.template.md +33 -33
  175. package/oxe/templates/LESSONS-METRICS.template.json +13 -13
  176. package/oxe/templates/NOTES.template.md +16 -16
  177. package/oxe/templates/PLAN-REVIEW.template.md +31 -31
  178. package/oxe/templates/SESSION.template.md +34 -34
  179. package/oxe/templates/SKILL.template.md +26 -26
  180. package/oxe/templates/STATE.md +55 -55
  181. package/oxe/templates/WORKFLOW_AUTHORING.md +18 -18
  182. package/oxe/workflows/ask.md +96 -96
  183. package/oxe/workflows/capabilities.md +25 -25
  184. package/oxe/workflows/dashboard.md +33 -33
  185. package/oxe/workflows/discuss.md +12 -12
  186. package/oxe/workflows/execute.md +14 -0
  187. package/oxe/workflows/help.md +352 -352
  188. package/oxe/workflows/next.md +22 -22
  189. package/oxe/workflows/oxe.md +6 -6
  190. package/oxe/workflows/plan-agent.md +9 -9
  191. package/oxe/workflows/plan.md +51 -20
  192. package/oxe/workflows/quick.md +10 -10
  193. package/oxe/workflows/references/reasoning-discovery.md +28 -28
  194. package/oxe/workflows/references/reasoning-execution.md +29 -29
  195. package/oxe/workflows/references/reasoning-planning.md +32 -32
  196. package/oxe/workflows/references/reasoning-review.md +29 -29
  197. package/oxe/workflows/references/reasoning-status.md +24 -24
  198. package/oxe/workflows/references/robustness-elevation.md +295 -295
  199. package/oxe/workflows/references/workflow-runtime-contracts.json +952 -930
  200. package/oxe/workflows/route.md +16 -16
  201. package/oxe/workflows/session.md +213 -213
  202. package/oxe/workflows/ship.md +142 -142
  203. package/oxe/workflows/skill.md +44 -44
  204. package/oxe/workflows/ui-review.md +36 -36
  205. package/oxe/workflows/verify-audit.md +73 -73
  206. package/oxe/workflows/verify.md +10 -0
  207. package/package.json +92 -92
  208. package/packages/runtime/package.json +16 -15
  209. package/packages/runtime/src/audit/audit-trail.ts +243 -243
  210. package/packages/runtime/src/audit/index.ts +2 -2
  211. package/packages/runtime/src/audit/policy-pack.ts +62 -62
  212. package/packages/runtime/src/compiler/graph-compiler.ts +245 -245
  213. package/packages/runtime/src/compiler/index.ts +1 -1
  214. package/packages/runtime/src/context/context-pack-builder.ts +259 -259
  215. package/packages/runtime/src/context/context-pack-store.ts +197 -197
  216. package/packages/runtime/src/context/context-profiles.ts +60 -60
  217. package/packages/runtime/src/context/index.ts +3 -3
  218. package/packages/runtime/src/decision/decision-engine.ts +174 -174
  219. package/packages/runtime/src/decision/decision-memo.ts +211 -211
  220. package/packages/runtime/src/decision/index.ts +2 -2
  221. package/packages/runtime/src/delivery/branch-manager.ts +91 -84
  222. package/packages/runtime/src/delivery/ci-checks.ts +285 -252
  223. package/packages/runtime/src/delivery/delivery-records.ts +75 -0
  224. package/packages/runtime/src/delivery/index.ts +5 -4
  225. package/packages/runtime/src/delivery/pr-manager.ts +112 -112
  226. package/packages/runtime/src/delivery/promotion-pipeline.ts +334 -180
  227. package/packages/runtime/src/events/bus.ts +92 -92
  228. package/packages/runtime/src/events/catalog.ts +29 -29
  229. package/packages/runtime/src/events/envelope.ts +14 -14
  230. package/packages/runtime/src/events/index.ts +3 -3
  231. package/packages/runtime/src/evidence/evidence-store.ts +130 -130
  232. package/packages/runtime/src/evidence/index.ts +1 -1
  233. package/packages/runtime/src/gate/gate-manager.ts +289 -137
  234. package/packages/runtime/src/gate/index.ts +1 -1
  235. package/packages/runtime/src/index.ts +41 -37
  236. package/packages/runtime/src/models/attempt.ts +19 -19
  237. package/packages/runtime/src/models/evidence.ts +21 -21
  238. package/packages/runtime/src/models/gate-decision.ts +25 -21
  239. package/packages/runtime/src/models/index.ts +8 -8
  240. package/packages/runtime/src/models/run.ts +24 -24
  241. package/packages/runtime/src/models/session.ts +11 -11
  242. package/packages/runtime/src/models/verification-result.ts +10 -10
  243. package/packages/runtime/src/models/work-item.ts +25 -25
  244. package/packages/runtime/src/models/workspace.ts +31 -28
  245. package/packages/runtime/src/plugins/capability-adapter.ts +206 -0
  246. package/packages/runtime/src/plugins/capability-matrix.ts +126 -83
  247. package/packages/runtime/src/plugins/index.ts +5 -4
  248. package/packages/runtime/src/plugins/plugin-abi.ts +97 -95
  249. package/packages/runtime/src/plugins/plugin-manifest.ts +118 -113
  250. package/packages/runtime/src/plugins/plugin-registry.ts +232 -124
  251. package/packages/runtime/src/policy/index.ts +1 -1
  252. package/packages/runtime/src/policy/policy-engine.ts +330 -244
  253. package/packages/runtime/src/projection/index.ts +1 -1
  254. package/packages/runtime/src/projection/projection-engine.ts +328 -249
  255. package/packages/runtime/src/reducers/debug-reducer.ts +36 -36
  256. package/packages/runtime/src/reducers/index.ts +2 -2
  257. package/packages/runtime/src/reducers/run-state-reducer.ts +269 -269
  258. package/packages/runtime/src/scheduler/agent-registry.ts +132 -132
  259. package/packages/runtime/src/scheduler/agent-roles.ts +109 -109
  260. package/packages/runtime/src/scheduler/index.ts +4 -4
  261. package/packages/runtime/src/scheduler/multi-agent-coordinator.ts +521 -333
  262. package/packages/runtime/src/scheduler/run-journal.ts +62 -62
  263. package/packages/runtime/src/scheduler/scheduler.ts +722 -441
  264. package/packages/runtime/src/verification/index.ts +2 -2
  265. package/packages/runtime/src/verification/verification-compiler.ts +436 -225
  266. package/packages/runtime/src/verification/verification-manifest.ts +252 -192
  267. package/packages/runtime/src/workspace/index.ts +5 -5
  268. package/packages/runtime/src/workspace/strategies/ephemeral-container.ts +126 -121
  269. package/packages/runtime/src/workspace/strategies/git-worktree.ts +79 -77
  270. package/packages/runtime/src/workspace/strategies/inplace.ts +38 -35
  271. package/packages/runtime/src/workspace/workspace-manager.ts +16 -15
  272. package/packages/runtime/tsconfig.json +17 -17
  273. package/vscode-extension/.vscodeignore +7 -7
  274. package/vscode-extension/LICENSE +21 -0
  275. package/vscode-extension/oxe-agents-1.0.0.vsix +0 -0
  276. package/vscode-extension/oxe-agents-1.4.0.vsix +0 -0
  277. package/vscode-extension/package.json +184 -184
  278. package/vscode-extension/src/extension.js +310 -310
  279. package/vscode-extension/src/shared/contextLoader.js +137 -137
  280. package/vscode-extension/src/shared/contractBuilder.js +159 -159
  281. package/vscode-extension/src/shared/stateReader.js +101 -101
@@ -1,252 +1,285 @@
1
- import fs from 'fs';
2
- import path from 'path';
3
- import type { EvidenceStore } from '../evidence/evidence-store';
4
-
5
- export type CICheckStatus = 'pass' | 'fail' | 'skip' | 'error';
6
-
7
- export interface CICheckContext {
8
- projectRoot: string;
9
- sessionId: string | null;
10
- runId?: string;
11
- evidenceStore?: EvidenceStore;
12
- }
13
-
14
- export interface CICheckResult {
15
- check: string;
16
- status: CICheckStatus;
17
- message: string;
18
- details?: unknown;
19
- }
20
-
21
- export interface CICheck {
22
- name: string;
23
- description: string;
24
- run(ctx: CICheckContext): Promise<CICheckResult>;
25
- }
26
-
27
- // ─── Check: plan-consistency ─────────────────────────────────────────────────
28
-
29
- export const planConsistencyCheck: CICheck = {
30
- name: 'oxe-plan-consistency',
31
- description: 'Verifies ACTIVE-RUN.json exists and has a compiled ExecutionGraph',
32
- async run(ctx) {
33
- const activeRunPath = ctx.sessionId
34
- ? path.join(ctx.projectRoot, '.oxe', ctx.sessionId, 'execution', 'ACTIVE-RUN.json')
35
- : path.join(ctx.projectRoot, '.oxe', 'ACTIVE-RUN.json');
36
-
37
- if (!fs.existsSync(activeRunPath)) {
38
- return { check: this.name, status: 'skip', message: 'No ACTIVE-RUN.json found' };
39
- }
40
-
41
- try {
42
- const raw = JSON.parse(fs.readFileSync(activeRunPath, 'utf8')) as Record<string, unknown>;
43
- const hasGraph = raw.compiled_graph && typeof raw.compiled_graph === 'object';
44
- const hasRunId = typeof raw.run_id === 'string';
45
-
46
- if (!hasRunId) {
47
- return { check: this.name, status: 'fail', message: 'ACTIVE-RUN.json missing run_id', details: raw };
48
- }
49
- if (!hasGraph) {
50
- return { check: this.name, status: 'fail', message: 'No compiled ExecutionGraph found in ACTIVE-RUN.json', details: { run_id: raw.run_id } };
51
- }
52
- return { check: this.name, status: 'pass', message: `Run ${String(raw.run_id)} has compiled graph` };
53
- } catch (err) {
54
- return { check: this.name, status: 'error', message: `Failed to parse ACTIVE-RUN.json: ${String(err)}` };
55
- }
56
- },
57
- };
58
-
59
- // ─── Check: verify-acceptance ────────────────────────────────────────────────
60
-
61
- export const verifyAcceptanceCheck: CICheck = {
62
- name: 'oxe-verify-acceptance',
63
- description: 'Checks that VERIFY.md exists and contains no failed criteria',
64
- async run(ctx) {
65
- const verifyPath = ctx.sessionId
66
- ? path.join(ctx.projectRoot, '.oxe', ctx.sessionId, 'verification', 'VERIFY.md')
67
- : path.join(ctx.projectRoot, '.oxe', 'VERIFY.md');
68
-
69
- if (!fs.existsSync(verifyPath)) {
70
- return { check: this.name, status: 'skip', message: 'No VERIFY.md found — run /oxe-verify first' };
71
- }
72
-
73
- const content = fs.readFileSync(verifyPath, 'utf8');
74
- const failLines = content.split('\n').filter((l) => l.includes('✗ FAIL'));
75
- const passLines = content.split('\n').filter((l) => l.includes('✓ PASS'));
76
-
77
- if (failLines.length > 0) {
78
- return {
79
- check: this.name,
80
- status: 'fail',
81
- message: `${failLines.length} acceptance criteria failed`,
82
- details: { failed: failLines, passed: passLines.length },
83
- };
84
- }
85
- if (passLines.length === 0) {
86
- return { check: this.name, status: 'skip', message: 'VERIFY.md has no pass/fail markers' };
87
- }
88
- return { check: this.name, status: 'pass', message: `${passLines.length} acceptance criteria passed` };
89
- },
90
- };
91
-
92
- // ─── Check: policy ───────────────────────────────────────────────────────────
93
-
94
- export const policyCheck: CICheck = {
95
- name: 'oxe-policy',
96
- description: 'Checks that no gates are pending (unresolved human approval)',
97
- async run(ctx) {
98
- const gatesPath = ctx.sessionId
99
- ? path.join(ctx.projectRoot, '.oxe', ctx.sessionId, 'execution', 'GATES.json')
100
- : path.join(ctx.projectRoot, '.oxe', 'execution', 'GATES.json');
101
-
102
- if (!fs.existsSync(gatesPath)) {
103
- return { check: this.name, status: 'pass', message: 'No pending gates' };
104
- }
105
-
106
- try {
107
- const gates = JSON.parse(fs.readFileSync(gatesPath, 'utf8')) as Array<{ status: string; scope: string; gate_id: string }>;
108
- const pending = gates.filter((g) => g.status === 'pending');
109
- if (pending.length > 0) {
110
- return {
111
- check: this.name,
112
- status: 'fail',
113
- message: `${pending.length} unresolved gate(s)`,
114
- details: pending.map((g) => ({ gate_id: g.gate_id, scope: g.scope })),
115
- };
116
- }
117
- return { check: this.name, status: 'pass', message: 'All gates resolved' };
118
- } catch (err) {
119
- return { check: this.name, status: 'error', message: `Failed to read GATES.json: ${String(err)}` };
120
- }
121
- },
122
- };
123
-
124
- // ─── Check: security-baseline ────────────────────────────────────────────────
125
-
126
- const SECRET_PATTERNS = [
127
- /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)\s*[:=]\s*['"]?\S{8,}/i,
128
- /(?:AKIA|ASIA)[A-Z0-9]{16}/,
129
- /-----BEGIN (?:RSA|EC|OPENSSH) PRIVATE KEY-----/,
130
- ];
131
-
132
- export const securityBaselineCheck: CICheck = {
133
- name: 'oxe-security-baseline',
134
- description: 'Scans evidence artifacts for common secret patterns',
135
- async run(ctx) {
136
- if (!ctx.evidenceStore || !ctx.runId) {
137
- return { check: this.name, status: 'skip', message: 'No evidence store or run ID provided' };
138
- }
139
-
140
- const evidenceDir = path.join(ctx.projectRoot, '.oxe', 'evidence', 'runs', ctx.runId);
141
- if (!fs.existsSync(evidenceDir)) {
142
- return { check: this.name, status: 'skip', message: 'No evidence found for this run' };
143
- }
144
-
145
- const findings: string[] = [];
146
- walkDir(evidenceDir, (filePath) => {
147
- if (filePath.endsWith('.json') || filePath.endsWith('.patch') || filePath.endsWith('.txt')) {
148
- try {
149
- const content = fs.readFileSync(filePath, 'utf8');
150
- for (const pattern of SECRET_PATTERNS) {
151
- if (pattern.test(content)) {
152
- findings.push(`${path.basename(filePath)}: matches pattern ${pattern.source.slice(0, 40)}`);
153
- break;
154
- }
155
- }
156
- } catch { /* skip unreadable */ }
157
- }
158
- });
159
-
160
- if (findings.length > 0) {
161
- return { check: this.name, status: 'fail', message: `Secret patterns detected in ${findings.length} evidence file(s)`, details: findings };
162
- }
163
- return { check: this.name, status: 'pass', message: 'No secret patterns detected in evidence' };
164
- },
165
- };
166
-
167
- // ─── Check: runtime-evidence-integrity ───────────────────────────────────────
168
-
169
- export const runtimeEvidenceIntegrityCheck: CICheck = {
170
- name: 'oxe-runtime-evidence-integrity',
171
- description: 'Validates that all evidence index files are valid JSON and files exist on disk',
172
- async run(ctx) {
173
- if (!ctx.runId) {
174
- return { check: this.name, status: 'skip', message: 'No run ID provided' };
175
- }
176
-
177
- const runEvidenceDir = path.join(ctx.projectRoot, '.oxe', 'evidence', 'runs', ctx.runId);
178
- if (!fs.existsSync(runEvidenceDir)) {
179
- return { check: this.name, status: 'skip', message: 'No evidence directory for this run' };
180
- }
181
-
182
- const errors: string[] = [];
183
- let indexCount = 0;
184
- let evidenceCount = 0;
185
-
186
- walkDir(runEvidenceDir, (filePath) => {
187
- if (path.basename(filePath) !== 'index.json') return;
188
- indexCount++;
189
- try {
190
- const items = JSON.parse(fs.readFileSync(filePath, 'utf8')) as Array<{ path: string; evidence_id: string }>;
191
- for (const item of items) {
192
- evidenceCount++;
193
- const absPath = path.join(ctx.projectRoot, item.path);
194
- if (!fs.existsSync(absPath)) {
195
- errors.push(`Missing file for ${item.evidence_id}: ${item.path}`);
196
- }
197
- }
198
- } catch (err) {
199
- errors.push(`Corrupt index at ${filePath}: ${String(err)}`);
200
- }
201
- });
202
-
203
- if (errors.length > 0) {
204
- return { check: this.name, status: 'fail', message: `${errors.length} integrity error(s)`, details: errors };
205
- }
206
- return {
207
- check: this.name,
208
- status: indexCount === 0 ? 'skip' : 'pass',
209
- message: `${evidenceCount} evidence artifact(s) across ${indexCount} index(es) — all valid`,
210
- };
211
- },
212
- };
213
-
214
- // ─── Suite ───────────────────────────────────────────────────────────────────
215
-
216
- export const OXE_CI_CHECKS: CICheck[] = [
217
- planConsistencyCheck,
218
- verifyAcceptanceCheck,
219
- policyCheck,
220
- securityBaselineCheck,
221
- runtimeEvidenceIntegrityCheck,
222
- ];
223
-
224
- export async function runCIChecks(
225
- ctx: CICheckContext,
226
- checks: CICheck[] = OXE_CI_CHECKS
227
- ): Promise<CICheckResult[]> {
228
- const results: CICheckResult[] = [];
229
- for (const check of checks) {
230
- results.push(await check.run(ctx));
231
- }
232
- return results;
233
- }
234
-
235
- export function summarizeCIResults(results: CICheckResult[]): {
236
- total: number; pass: number; fail: number; skip: number; error: number; allPassed: boolean;
237
- } {
238
- const counts = { total: results.length, pass: 0, fail: 0, skip: 0, error: 0 };
239
- for (const r of results) counts[r.status]++;
240
- return { ...counts, allPassed: counts.fail === 0 && counts.error === 0 };
241
- }
242
-
243
- // ─── Helpers ─────────────────────────────────────────────────────────────────
244
-
245
- function walkDir(dir: string, visitor: (filePath: string) => void): void {
246
- if (!fs.existsSync(dir)) return;
247
- for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
248
- const full = path.join(dir, entry.name);
249
- if (entry.isDirectory()) walkDir(full, visitor);
250
- else visitor(full);
251
- }
252
- }
1
+ import fs from 'fs';
2
+ import path from 'path';
3
+ import type { EvidenceStore } from '../evidence/evidence-store';
4
+
5
+ export type CICheckStatus = 'pass' | 'fail' | 'skip' | 'error';
6
+
7
+ export interface CICheckContext {
8
+ projectRoot: string;
9
+ sessionId: string | null;
10
+ runId?: string;
11
+ evidenceStore?: EvidenceStore;
12
+ }
13
+
14
+ export interface CICheckResult {
15
+ check: string;
16
+ status: CICheckStatus;
17
+ message: string;
18
+ details?: unknown;
19
+ }
20
+
21
+ export interface CICheck {
22
+ name: string;
23
+ description: string;
24
+ run(ctx: CICheckContext): Promise<CICheckResult>;
25
+ }
26
+
27
+ // ─── Check: plan-consistency ─────────────────────────────────────────────────
28
+
29
+ export const planConsistencyCheck: CICheck = {
30
+ name: 'oxe-plan-consistency',
31
+ description: 'Verifies ACTIVE-RUN.json exists and has a compiled ExecutionGraph',
32
+ async run(ctx) {
33
+ const activeRunPath = ctx.sessionId
34
+ ? path.join(ctx.projectRoot, '.oxe', ctx.sessionId, 'execution', 'ACTIVE-RUN.json')
35
+ : path.join(ctx.projectRoot, '.oxe', 'ACTIVE-RUN.json');
36
+
37
+ if (!fs.existsSync(activeRunPath)) {
38
+ return { check: this.name, status: 'skip', message: 'No ACTIVE-RUN.json found' };
39
+ }
40
+
41
+ try {
42
+ const raw = JSON.parse(fs.readFileSync(activeRunPath, 'utf8')) as Record<string, unknown>;
43
+ const hasGraph = raw.compiled_graph && typeof raw.compiled_graph === 'object';
44
+ const hasRunId = typeof raw.run_id === 'string';
45
+
46
+ if (!hasRunId) {
47
+ return { check: this.name, status: 'fail', message: 'ACTIVE-RUN.json missing run_id', details: raw };
48
+ }
49
+ if (!hasGraph) {
50
+ return { check: this.name, status: 'fail', message: 'No compiled ExecutionGraph found in ACTIVE-RUN.json', details: { run_id: raw.run_id } };
51
+ }
52
+ return { check: this.name, status: 'pass', message: `Run ${String(raw.run_id)} has compiled graph` };
53
+ } catch (err) {
54
+ return { check: this.name, status: 'error', message: `Failed to parse ACTIVE-RUN.json: ${String(err)}` };
55
+ }
56
+ },
57
+ };
58
+
59
+ // ─── Check: verify-acceptance ────────────────────────────────────────────────
60
+
61
+ export const verifyAcceptanceCheck: CICheck = {
62
+ name: 'oxe-verify-acceptance',
63
+ description: 'Checks that VERIFY.md exists and contains no failed criteria',
64
+ async run(ctx) {
65
+ const manifestPath = path.join(ctx.projectRoot, '.oxe', 'runs', ctx.runId || '', 'verification-manifest.json');
66
+ if (ctx.runId && fs.existsSync(manifestPath)) {
67
+ try {
68
+ const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
69
+ const failCount = Number(manifest.summary?.fail || 0);
70
+ const errorCount = Number(manifest.summary?.error || 0);
71
+ return failCount === 0 && errorCount === 0
72
+ ? { check: this.name, status: 'pass', message: `Manifest reports ${manifest.summary.total} checks with no failures` }
73
+ : {
74
+ check: this.name,
75
+ status: 'fail',
76
+ message: `Manifest reports ${failCount} failed and ${errorCount} errored checks`,
77
+ details: manifest.summary,
78
+ };
79
+ } catch (err) {
80
+ return { check: this.name, status: 'error', message: `Failed to parse verification manifest: ${String(err)}` };
81
+ }
82
+ }
83
+
84
+ const verifyPath = ctx.sessionId
85
+ ? path.join(ctx.projectRoot, '.oxe', ctx.sessionId, 'verification', 'VERIFY.md')
86
+ : path.join(ctx.projectRoot, '.oxe', 'VERIFY.md');
87
+
88
+ if (!fs.existsSync(verifyPath)) {
89
+ return { check: this.name, status: 'skip', message: 'No VERIFY.md found — run /oxe-verify first' };
90
+ }
91
+
92
+ const content = fs.readFileSync(verifyPath, 'utf8');
93
+ const failLines = content.split('\n').filter((l) => l.includes('✗ FAIL'));
94
+ const passLines = content.split('\n').filter((l) => l.includes('✓ PASS'));
95
+
96
+ if (failLines.length > 0) {
97
+ return {
98
+ check: this.name,
99
+ status: 'fail',
100
+ message: `${failLines.length} acceptance criteria failed`,
101
+ details: { failed: failLines, passed: passLines.length },
102
+ };
103
+ }
104
+ if (passLines.length === 0) {
105
+ return { check: this.name, status: 'skip', message: 'VERIFY.md has no pass/fail markers' };
106
+ }
107
+ return { check: this.name, status: 'pass', message: `${passLines.length} acceptance criteria passed` };
108
+ },
109
+ };
110
+
111
+ // ─── Check: policy ───────────────────────────────────────────────────────────
112
+
113
+ export const policyCheck: CICheck = {
114
+ name: 'oxe-policy',
115
+ description: 'Checks that no gates are pending (unresolved human approval)',
116
+ async run(ctx) {
117
+ const gatesPath = ctx.sessionId
118
+ ? path.join(ctx.projectRoot, '.oxe', ctx.sessionId, 'execution', 'GATES.json')
119
+ : path.join(ctx.projectRoot, '.oxe', 'execution', 'GATES.json');
120
+
121
+ if (!fs.existsSync(gatesPath)) {
122
+ return { check: this.name, status: 'pass', message: 'No pending gates' };
123
+ }
124
+
125
+ try {
126
+ const gates = JSON.parse(fs.readFileSync(gatesPath, 'utf8')) as Array<{ status: string; scope: string; gate_id: string }>;
127
+ const pending = gates.filter((g) => g.status === 'pending');
128
+ if (pending.length > 0) {
129
+ return {
130
+ check: this.name,
131
+ status: 'fail',
132
+ message: `${pending.length} unresolved gate(s)`,
133
+ details: pending.map((g) => ({ gate_id: g.gate_id, scope: g.scope })),
134
+ };
135
+ }
136
+ if (ctx.runId) {
137
+ const policyPath = path.join(ctx.projectRoot, '.oxe', 'runs', ctx.runId, 'policy-decisions.json');
138
+ if (fs.existsSync(policyPath)) {
139
+ const policyDecisions = JSON.parse(fs.readFileSync(policyPath, 'utf8')) as Array<{ override?: boolean; rationale?: string | null }>;
140
+ const withoutRationale = policyDecisions.filter((decision) => decision.override && !decision.rationale);
141
+ if (withoutRationale.length > 0) {
142
+ return {
143
+ check: this.name,
144
+ status: 'fail',
145
+ message: `${withoutRationale.length} policy override(s) without rationale`,
146
+ };
147
+ }
148
+ }
149
+ }
150
+ return { check: this.name, status: 'pass', message: 'All gates resolved and policy overrides are justified' };
151
+ } catch (err) {
152
+ return { check: this.name, status: 'error', message: `Failed to read GATES.json: ${String(err)}` };
153
+ }
154
+ },
155
+ };
156
+
157
+ // ─── Check: security-baseline ────────────────────────────────────────────────
158
+
159
+ const SECRET_PATTERNS = [
160
+ /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)\s*[:=]\s*['"]?\S{8,}/i,
161
+ /(?:AKIA|ASIA)[A-Z0-9]{16}/,
162
+ /-----BEGIN (?:RSA|EC|OPENSSH) PRIVATE KEY-----/,
163
+ ];
164
+
165
+ export const securityBaselineCheck: CICheck = {
166
+ name: 'oxe-security-baseline',
167
+ description: 'Scans evidence artifacts for common secret patterns',
168
+ async run(ctx) {
169
+ if (!ctx.evidenceStore || !ctx.runId) {
170
+ return { check: this.name, status: 'skip', message: 'No evidence store or run ID provided' };
171
+ }
172
+
173
+ const evidenceDir = path.join(ctx.projectRoot, '.oxe', 'evidence', 'runs', ctx.runId);
174
+ if (!fs.existsSync(evidenceDir)) {
175
+ return { check: this.name, status: 'skip', message: 'No evidence found for this run' };
176
+ }
177
+
178
+ const findings: string[] = [];
179
+ walkDir(evidenceDir, (filePath) => {
180
+ if (filePath.endsWith('.json') || filePath.endsWith('.patch') || filePath.endsWith('.txt')) {
181
+ try {
182
+ const content = fs.readFileSync(filePath, 'utf8');
183
+ for (const pattern of SECRET_PATTERNS) {
184
+ if (pattern.test(content)) {
185
+ findings.push(`${path.basename(filePath)}: matches pattern ${pattern.source.slice(0, 40)}`);
186
+ break;
187
+ }
188
+ }
189
+ } catch { /* skip unreadable */ }
190
+ }
191
+ });
192
+
193
+ if (findings.length > 0) {
194
+ return { check: this.name, status: 'fail', message: `Secret patterns detected in ${findings.length} evidence file(s)`, details: findings };
195
+ }
196
+ return { check: this.name, status: 'pass', message: 'No secret patterns detected in evidence' };
197
+ },
198
+ };
199
+
200
+ // ─── Check: runtime-evidence-integrity ───────────────────────────────────────
201
+
202
+ export const runtimeEvidenceIntegrityCheck: CICheck = {
203
+ name: 'oxe-runtime-evidence-integrity',
204
+ description: 'Validates that all evidence index files are valid JSON and files exist on disk',
205
+ async run(ctx) {
206
+ if (!ctx.runId) {
207
+ return { check: this.name, status: 'skip', message: 'No run ID provided' };
208
+ }
209
+
210
+ const runEvidenceDir = path.join(ctx.projectRoot, '.oxe', 'evidence', 'runs', ctx.runId);
211
+ if (!fs.existsSync(runEvidenceDir)) {
212
+ return { check: this.name, status: 'skip', message: 'No evidence directory for this run' };
213
+ }
214
+
215
+ const errors: string[] = [];
216
+ let indexCount = 0;
217
+ let evidenceCount = 0;
218
+
219
+ walkDir(runEvidenceDir, (filePath) => {
220
+ if (path.basename(filePath) !== 'index.json') return;
221
+ indexCount++;
222
+ try {
223
+ const items = JSON.parse(fs.readFileSync(filePath, 'utf8')) as Array<{ path: string; evidence_id: string }>;
224
+ for (const item of items) {
225
+ evidenceCount++;
226
+ const absPath = path.join(ctx.projectRoot, item.path);
227
+ if (!fs.existsSync(absPath)) {
228
+ errors.push(`Missing file for ${item.evidence_id}: ${item.path}`);
229
+ }
230
+ }
231
+ } catch (err) {
232
+ errors.push(`Corrupt index at ${filePath}: ${String(err)}`);
233
+ }
234
+ });
235
+
236
+ if (errors.length > 0) {
237
+ return { check: this.name, status: 'fail', message: `${errors.length} integrity error(s)`, details: errors };
238
+ }
239
+ return {
240
+ check: this.name,
241
+ status: indexCount === 0 ? 'skip' : 'pass',
242
+ message: `${evidenceCount} evidence artifact(s) across ${indexCount} index(es) — all valid`,
243
+ };
244
+ },
245
+ };
246
+
247
+ // ─── Suite ───────────────────────────────────────────────────────────────────
248
+
249
+ export const OXE_CI_CHECKS: CICheck[] = [
250
+ planConsistencyCheck,
251
+ verifyAcceptanceCheck,
252
+ policyCheck,
253
+ securityBaselineCheck,
254
+ runtimeEvidenceIntegrityCheck,
255
+ ];
256
+
257
+ export async function runCIChecks(
258
+ ctx: CICheckContext,
259
+ checks: CICheck[] = OXE_CI_CHECKS
260
+ ): Promise<CICheckResult[]> {
261
+ const results: CICheckResult[] = [];
262
+ for (const check of checks) {
263
+ results.push(await check.run(ctx));
264
+ }
265
+ return results;
266
+ }
267
+
268
+ export function summarizeCIResults(results: CICheckResult[]): {
269
+ total: number; pass: number; fail: number; skip: number; error: number; allPassed: boolean;
270
+ } {
271
+ const counts = { total: results.length, pass: 0, fail: 0, skip: 0, error: 0 };
272
+ for (const r of results) counts[r.status]++;
273
+ return { ...counts, allPassed: counts.fail === 0 && counts.error === 0 };
274
+ }
275
+
276
+ // ─── Helpers ─────────────────────────────────────────────────────────────────
277
+
278
+ function walkDir(dir: string, visitor: (filePath: string) => void): void {
279
+ if (!fs.existsSync(dir)) return;
280
+ for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
281
+ const full = path.join(dir, entry.name);
282
+ if (entry.isDirectory()) walkDir(full, visitor);
283
+ else visitor(full);
284
+ }
285
+ }
@@ -0,0 +1,75 @@
1
+ import fs from 'fs';
2
+ import path from 'path';
3
+
4
+ export type PromotionTarget = 'local_commit' | 'remote_promotion';
5
+ export type PromotionRemoteTarget = 'pr_draft' | 'branch_push';
6
+
7
+ export interface CommitRecord {
8
+ run_id: string;
9
+ branch: string;
10
+ commit_sha: string | null;
11
+ status: 'pending' | 'committed' | 'blocked';
12
+ created_at: string;
13
+ committed_at: string | null;
14
+ message: string | null;
15
+ summary_path: string | null;
16
+ }
17
+
18
+ export interface PromotionRecord {
19
+ run_id: string;
20
+ target: PromotionTarget;
21
+ target_kind: PromotionRemoteTarget;
22
+ branch: string;
23
+ status: 'pending' | 'open' | 'merged' | 'closed' | 'blocked' | 'promoted';
24
+ created_at: string;
25
+ promoted_at: string | null;
26
+ summary_path: string | null;
27
+ remote: string | null;
28
+ target_ref: string | null;
29
+ pr_url: string | null;
30
+ pr_number: number | null;
31
+ reasons?: string[];
32
+ coverage_percent?: number | null;
33
+ }
34
+
35
+ function runDir(projectRoot: string, runId: string): string {
36
+ return path.join(projectRoot, '.oxe', 'runs', runId);
37
+ }
38
+
39
+ function saveJson(filePath: string, payload: unknown): void {
40
+ fs.mkdirSync(path.dirname(filePath), { recursive: true });
41
+ fs.writeFileSync(filePath, JSON.stringify(payload, null, 2), 'utf8');
42
+ }
43
+
44
+ function loadJson<T>(filePath: string): T | null {
45
+ if (!fs.existsSync(filePath)) return null;
46
+ try {
47
+ return JSON.parse(fs.readFileSync(filePath, 'utf8')) as T;
48
+ } catch {
49
+ return null;
50
+ }
51
+ }
52
+
53
+ export function commitRecordPath(projectRoot: string, runId: string): string {
54
+ return path.join(runDir(projectRoot, runId), 'commit-record.json');
55
+ }
56
+
57
+ export function promotionRecordPath(projectRoot: string, runId: string): string {
58
+ return path.join(runDir(projectRoot, runId), 'promotion-record.json');
59
+ }
60
+
61
+ export function saveCommitRecord(projectRoot: string, runId: string, record: CommitRecord): void {
62
+ saveJson(commitRecordPath(projectRoot, runId), record);
63
+ }
64
+
65
+ export function loadCommitRecord(projectRoot: string, runId: string): CommitRecord | null {
66
+ return loadJson<CommitRecord>(commitRecordPath(projectRoot, runId));
67
+ }
68
+
69
+ export function savePromotionRecord(projectRoot: string, runId: string, record: PromotionRecord): void {
70
+ saveJson(promotionRecordPath(projectRoot, runId), record);
71
+ }
72
+
73
+ export function loadPromotionRecord(projectRoot: string, runId: string): PromotionRecord | null {
74
+ return loadJson<PromotionRecord>(promotionRecordPath(projectRoot, runId));
75
+ }
@@ -1,4 +1,5 @@
1
- export * from './branch-manager';
2
- export * from './pr-manager';
3
- export * from './ci-checks';
4
- export * from './promotion-pipeline';
1
+ export * from './branch-manager';
2
+ export * from './pr-manager';
3
+ export * from './ci-checks';
4
+ export * from './delivery-records';
5
+ export * from './promotion-pipeline';