Cursor/multiple development lanes 4197

.github/workflows/ci.yml

@@ -46,12 +46,15 @@ jobs:
           restore-keys: |
             cargo-${{ runner.os }}-
 
+      - name: Verify Bootstrap Invariants
+        run: rm -rf target/codegen && cargo check -p gunbc-dag --bin gunbc-codegen --bin gunbc-ci
+
       - name: Run CI Pipeline
         run: cargo run -p gunbc-dag --bin gunbc-ci
         env:
           CARGO_INCREMENTAL: "1"
-          GCP_WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER }}
-          GCP_SECRETS_PROJECT: ${{ secrets.GCP_SECRETS_PROJECT }}
+          GCP_SECRETS_IMPERSONATE_SA: ${{ secrets.GCP_SECRETS_IMPERSONATE_SA }}
           GCP_SECRETS_PREFIX: ${{ secrets.GCP_SECRETS_PREFIX }}
+          GCP_SECRETS_PROJECT: ${{ secrets.GCP_SECRETS_PROJECT }}
           GCP_SECRETS_SA: ${{ secrets.GCP_SECRETS_SA }}
-          GCP_SECRETS_IMPERSONATE_SA: ${{ secrets.GCP_SECRETS_IMPERSONATE_SA }}
+          GCP_WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER }}

Cargo.toml

@@ -35,6 +35,7 @@ members = [
     "lib/azure-ops",
     "lib/llm-ops",
     "lib/review",
+    "lib/design-ops",
     "lib/markdown",
     "lib/transport",
     "lib/gcp-ops",

TODO/TODONE/tasks-completed.md

@@ -218,3 +218,125 @@ makegen path regression fix, mock cleanup, transport-call consolidation.
 | W6 | CI status injection into review context | Done 2026-02-21 |
 | W7 | `gunbc pipeline` daily orchestration command | Done 2026-02-21 |
 | W8 | Pipeline issue-context integration (`--issue`) | Done 2026-02-21 |
+
+---
+
+## Lane A: SDLC Delivery Lane (Complete 2026-02-21)
+
+| ID | Task | Status |
+|----|------|--------|
+| MD0-D | SDLC mega modeling design gate: consolidated abstractions/invariants/layers/conformance into `docs/design/sdlc/mega-modeling-design.md` | Done 2026-02-21 |
+| IM0-D | SDLC issue abstraction modeling: provider-agnostic issue contracts, adapter boundaries, idempotency keys, upsert protocols | Done 2026-02-21 |
+| IM1 | Intent sheet contract: `intent_id`, objective, success criteria, constraints schema with template | Done 2026-02-21 |
+| IM2 | Issue intake upsert flow: create-or-update one canonical issue per `intent_id` | Done 2026-02-21 |
+| IM3 | Stage idempotency + resume keying: run/stage keys with duplicate-effect skip on replay | Done 2026-02-21 |
+| IM4 | Idempotent remote update protocol: deterministic marker upsert + CAS transitions | Done 2026-02-21 |
+| IM5 | Commit/update trace linkage: branch/commit metadata linked to `intent_id`/`issue_id`/run key | Done 2026-02-21 |
+| IM6 | Claim/lease abstraction: atomic claim with lease expiry and heartbeat semantics | Done 2026-02-21 |
+| IM7 | Async control loop: discover → claim → execute → release with bounded retries/backoff | Done 2026-02-21 |
+| IM8 | Stage transaction executor: fixed step ordering with crash-safe replay | Done 2026-02-21 |
+| IM9 | Failure taxonomy + retry policy: typed failure classes, persisted retry budget, terminal fail-closed | Done 2026-02-21 |
+| IM10 | Intake conflict policy: fail-closed multi-match collision handling | Done 2026-02-21 |
+| IM11 | Replay reconciliation loop: crash-window convergence, stale marker cleanup by lease generation | Done 2026-02-21 |
+| IM12 | Provider capability gate: `ManagedIssueSearch` + `DeterministicIssueIdentity` checks, dry-run bypass | Done 2026-02-21 |
+| IM13 | Artifact payload/reference contract: `Inline` vs `BlobRef`, content-hash equality, canonical markers | Done 2026-02-21 |
+| W9 | GitHub Issues transport + adapter: provider-agnostic `TrackedIssue` mapping | Done 2026-02-21 |
+| W10 | DesignOps module: `PrepareDesignPrompt` + `ParseDesignResponse` typed artifacts | Done 2026-02-21 |
+| W11 | SDLC resolver wiring: pipeline→resolver→execution with typed transport + design ops | Done 2026-02-21 |
+| W12 | `gunbc-sdlc` CLI binary: intake/worker dry-run + real mode with retry/reconciliation | Done 2026-02-21 |
+| W13 | Approval gates: `AwaitApproval` yield semantics with claim release and rediscovery resume | Done 2026-02-21 |
+| W14 | Metrics/monitoring: stage duration, LLM cost, approval latency in execution report | Done 2026-02-21 |
+
+---
+
+## Lane B: Review Credential Certification (Partial — 2026-02-21)
+
+| ID | Task | Status |
+|----|------|--------|
+| W3 | Multi-provider operational verification: `--provider openai` and `--provider anthropic` with fail-closed cred errors | Done 2026-02-21 |
+
+`W2` remains open (requires real-mode API key smoke test).
+
+---
+
+## Lane C: Planner/CI Additional (Complete 2026-02-21)
+
+| ID | Task | Status |
+|----|------|--------|
+| AX1 | Bootstrap invariant CI gate: bootstrap-safe binaries compile without generated sources | Done 2026-02-21 |
+| AX2 | Registry coupling hardening: contract-tested coupling between `default_registry()` and `derive_tool_defs()` | Done 2026-02-21 |
+
+---
+
+## Lane D: Daglang Convergence (Complete 2026-02-21)
+
+| ID | Task | Status |
+|----|------|--------|
+| DL5 | Unify compile/pipeline overlap: shared `compile_from_module_graph_with_options` path, pipeline handles discovery | Done 2026-02-21 |
+| DL6 | Manifest semantics clarity: split `dag manifest` into `dag progress` + `dag topology` (no flags, intent from command name) | Done 2026-02-21 |
+| DL7 | Canonical IR CLI surface: `daglang compile --format canonical-json` with deterministic output + tests | Done 2026-02-21 |
+| DL8 | Viz default decision: ASCII locked as default for `daglang viz`, documented + test-locked | Done 2026-02-21 |
+
+---
+
+## Lane E: Runtime Infra/Control-Plane (Complete 2026-02-21)
+
+| ID | Task | Status |
+|----|------|--------|
+| IN0-D | Runtime/infra control-plane modeling: stateless worker topology, trigger/signal matrix, startup/drain semantics | Done 2026-02-21 |
+| IN1 | Infra intent contract: versioned `InfraIntent` schema for runtime dependencies | Done 2026-02-21 |
+| IN2 | Infra plan/apply coverage: drift-aware reconciliation contracts for SDLC runtime | Done 2026-02-21 |
+| IN3 | Worker startup preflight gate: fail-closed readiness checks for infra components | Done 2026-02-21 |
+| IN4 | Stateless deployment profile + drain: launch profile contracts, graceful drain/restart | Done 2026-02-21 |
+
+---
+
+## Lane F: Codegen-First SDLC (Complete 2026-02-21)
+
+| ID | Task | Status |
+|----|------|--------|
+| CG0-D | Codegen-first architecture modeling: DSL-authored behavior compiled to Rust/Go/C boundary locked | Done 2026-02-21 |
+| CG1 | Canonicalize SDLC DSL modules: **superseded** — `dsl/pipelines/sdlc.dag` and `dsl/tools/design.dag` removed; SDLC modules are runtime-authored, not DSL-discovered | Superseded 2026-02-21 |
+| CG2 | Discovery-to-execution cutover: generic runtime wiring for discovered DSL modules | Done 2026-02-21 |
+| CG3 | Control-plane DSL resources/services: claim lease store + stage outcome ledger as DSL interfaces | Done 2026-02-21 |
+| CG4 | Infra intent reconcile in DSL: plan/apply/reconcile via compiled DSL orchestration | Done 2026-02-21 |
+| CG5 | Generated target entrypoints (Rust/Go/C): runnable SDLC worker/infra entrypoints with C adapter boundary | Done 2026-02-21 |
+| CG6 | Multi-level conformance + backend rotation harness: layered conformance suites, C sanitizer coverage, backend rotation | Done 2026-02-21 |
+
+---
+
+## Cleanup (2026-02-21)
+
+| ID | Task | Status |
+|----|------|--------|
+| — | Remove `c_sanitizer_runtime_available` dead code in `codegen_parity.rs` | Done 2026-02-21 |
+| — | Remove `tools.design` and `pipelines.sdlc` resolver registrations + dependent code after `.dag` file deletion | Done 2026-02-21 |
+| — | Bulk rename `manifest`/`progress-manifest` → `progress`/`topology` across CLI, tests, docs | Done 2026-02-21 |
+
+---
+
+## Lane B: Review Credential (2026-02-21)
+
+| ID | Task | Status |
+|----|------|--------|
+| W2 | Credential smoke test: run `gunbc-review` in real mode using `ANTHROPIC_API_KEY` against a small diff and verify structured findings output. | Done 2026-02-21 |
+
+---
+
+## Sprint 10: Autonomous Implementation & Agent Integration (2026-02-21)
+
+### Phase 1: Implementation Handoff & GitOps
+
+| ID | Task | Status |
+|----|------|--------|
+| AI1 | Handoff Contract: Typed `HandoffSpec`, `DesignArtifact`, `AgentConstraints` in `core/ir/src/transport/agent.rs`; `AgentAdapter` trait + `StubAgentAdapter` in `agent_adapter.rs`. | Done 2026-02-21 |
+| AI2 | Agent Workspace Bootstrap: `gunbc-sdlc agent-spawn --intake-key` reads intake/artifact ledgers, validates Accepted stage, assembles `HandoffSpec`, dispatches to adapter, records in `agent-ledger.json`. | Done 2026-02-21 |
+| AI3 | PR Automation: `PullRequestSpec` types + `gh pr create/comment/merge` request builders in `core/ir/src/transport/github/pull_request.rs`. | Done 2026-02-21 |
+
+### Phase 2: SDLC Pull Request Validation
+
+| ID | Task | Status |
+|----|------|--------|
+| PR1 | Diff Review Integration: `gunbc-sdlc validate-pr` runs diff review against PR branch, posts findings as PR comments. | Done 2026-02-21 |
+| PR2 | CI/CD Aggregation: `validate-pr` runs `cargo test` + `cargo clippy` and aggregates pass/fail results. | Done 2026-02-21 |
+| PR3 | Close Loop: `validate-pr` auto-transitions `Implementation` -> `Closed` when all checks pass, posts summary comment. | Done 2026-02-21 |

TODO/dag_projections_strategy.md

@@ -0,0 +1,89 @@
+# Strategy: Everything is a DAG (Daglang Projections)
+
+This document explores the data boundaries and configuration formats currently holding state across the `gunbc` repository. The overarching architectural philosophy of this project is **"Everything is a DAG"**, meaning tools, schemas, features, runtimes, and artifacts should all be authored as nodes in `.dag` files and *projected* into reality (e.g. GitHub issues, SQLite databases, cloud infrastructure) via a compiler model. 
+
+Currently, several domains still use static YAML, JSON ledgers, or manual Rust coordination. 
+
+This is an audit of those domains and how we will transition them to pure Daglang.
+
+---
+
+## 1. Feature Intents & Issue Management
+**Current State**: Authored as isolated flat files in YAML (`TODO/issue-intent-template.yaml`).
+**The Problem**: A flat YAML file has no native concept of dependencies. If we have a mega-feature (e.g., "Full Auth Revamp"), the tasks are just independent `.yaml` intents. The SDLC worker has no context that "Token Generation" must be implemented before "User Login View". It's just a loose collection of issues.
+
+**The Daglang Solution**:
+Convert `intents` to a `dsl/projects/` taxonomy.
+Instead of running `gunbc-sdlc intake --intent intent.yaml`, we run `daglang project apply dsl/projects/auth.dag`.
+
+```dag
+module projects.auth_revamp
+
+feature generate_tokens {
+    title = "JWT Token Generation"
+    objective = "Securely generate and sign user JWTs"
+    acceptance_tests = ["verify JWT signature output"]
+}
+
+feature login_view {
+    title = "Implement Login UI"
+    objective = "Provide user inputs for email and password"
+    depends_on = [generate_tokens] // Explicit dependency mapping
+}
+```
+**Benefits**:
+The Orchestrator engine will not spawn the SDLC workflow (Code generation) on `login_view` until the Artifact Ledger proves `generate_tokens` is transitioned to `Stage: Closed/Merged`.
+
+**Downstream Translation (Native GitHub Integration)**:
+When `daglang project apply` compiles the graph, it doesn't just create isolated issues. It translates `.dag` dependencies into the native format of the downstream provider. For GitHub, this means:
+- Emitting standard linking keywords in the issue body (e.g. `Depends on #12`, `Blocks #14`).
+- Automatically generating Markdown checklists for sub-tasks (e.g., `- [ ] #15`) in Epic/Feature parent issues.
+- Leveraging GitHub's native "Tracked Issues" API to reflect the exact DAG topology in the GitHub UI, ensuring human developers and AI agents share identical context without needing to open the CLI.
+
+---
+
+## 2. Infrastructure Deployment Intents
+**Current State**: Authored as YAML (`TODO/infra-intent-template.yaml`) mapping out runtime dependencies (`claim_store`, `outcome_ledger`, secrets, and topologies).
+**The Problem**: YAML has no ability to evaluate system health before provisioning. It also relies on a custom Rust parser (`gunbc-dag/src/bin/infra.rs`) to reconcile the JSON state mappings.
+
+**The Daglang Solution**:
+Treat infrastructure nodes the same way we define `build` pipelines. Cloud services, SQlite paths, and worker scale are typed components.
+
+```dag
+module infra.sdlc_runtime
+
+resource claim_store_db {
+    backend = "sqlite"
+    dsn = "var/sdlc/claims.db"
+    fail_closed = true
+}
+
+resource sdlc_orchestrator {
+    worker_count = 5
+    depends_on = [claim_store_db]
+    secrets = [github_token, openai_key]
+}
+```
+**Benefits**: Infrastructure drift detection becomes a standard DAG resolution path. If the DAG output fails, it flags `Needs Rebuild` via the standard `daglang` toolset instead of a disconnected SDLC binary.
+
+---
+
+## 3. SDLC Artifact & Run State Ledgers
+**Current State**: Custom JSON-blob state files mapped via Serde inside `target/sdlc/`. 
+**The Problem**: Ledgers (`intake-ledger.json`, `artifact-ledger.json`) act as disjointed databases. While the `SDLC` worker operates safely on these, the broader workspace execution engine (`WorkspaceOp`) cannot observe or query them safely as dependencies without parsing JSON inside Rust.
+
+**The Daglang Solution**:
+Bring State definitions into the DAG DSL via specialized `data` nodes, and project the SQLite or JSON cache layer identically to how we handle compilation caches. We can build a `Resolver` phase in `gunbc-exec` that handles reading/verifying these states safely before running workflow ticks.
+
+## Next Steps
+
+To action this holistic transition into Daglang projections, the logical execution steps are:
+
+1. **Daglang Primitives Update**
+   - Introduce new domain types in `core/ir/`. The compiler needs primitives for `Project`, `Feature`, `Resource`, and `DataRecord`.
+2. **Implement Project Resolution Engine**
+   - Extend `gunbc-dag/src/bin/sdlc.rs` to parse `.dag` targets rather than flat `.yaml`.
+   - Update `reconcile_entries` logic: Use the topological sort of the graph to filter which issues are "blocking" versus "actionable" when generating the GitHub issue payloads.
+3. **Deprecate Flat Targets**
+   - Delete `TODO/*.yaml` intents in favor of tracking internal roadmaps entirely in `dsl/projects/`. 
+   - Tie the compilation of these graphs directly to GitHub actions.