Jason Woltje
319e21ddc0
Splits the 155-line thin-core AGENTS.md into: - defaults/CONSTITUTION.md (L0): gates + integrity + escalation + block-vs-done + mode + two-axis precedence + hooks-are-the-gate + framework-PR firewall + structured-reasoning capability + tier-aware self-load. Capability-verb authored. - defaults/AGENTS.md gutted to an ~80-line load-order dispatcher + guide table (kills the false "already in context, do not re-read" line). - constitution/LAYER-MODEL.md: source-only governance spec (layers + precedence). Non-regression wiring (fresh-install functional; upgrade-safety is P4): - launch.ts injects CONSTITUTION.md before AGENTS.md (tolerant of un-reseeded installs) - install.sh + file-adapter.ts seed CONSTITUTION.md (+ test fixture updated) Runtime adapters: capability-verb the sequential-thinking binding; claude/codex/ opencode restate the REQUIRED hard-stop, pi binds to native thinking (gate=false) — restores the force the adversarial review flagged as weakened. Gate hardening (dual-engine review): identity denylist now covers examples/ (closes the Codex open-source gap), self-test-first, *.json in scope, ci.yml typecheck depends on sanitization (fail-fast), L0 line-count ceiling (<=120). Adversarial gate-preservation review: every original rule traced to L0, the dispatcher, or a routed guide — nothing lost. Refs #542, closes #574 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
100 lines
2.8 KiB
YAML
100 lines
2.8 KiB
YAML
variables:
|
|
- &node_image 'node:22-alpine'
|
|
- &enable_pnpm 'corepack enable'
|
|
|
|
when:
|
|
- event: [push, pull_request, manual]
|
|
|
|
# Turbo remote cache (turbo.mosaicstack.dev) is configured via Woodpecker
|
|
# repository-level environment variables (TURBO_API, TURBO_TEAM, TURBO_TOKEN).
|
|
# This avoids from_secret which is blocked on pull_request events.
|
|
# If the env vars aren't set, turbo falls back to local cache only.
|
|
|
|
steps:
|
|
install:
|
|
image: *node_image
|
|
commands:
|
|
- corepack enable
|
|
- apk add --no-cache python3 make g++
|
|
- pnpm install --frozen-lockfile
|
|
|
|
# Blocking gate: public framework package must contain no operator-specific
|
|
# personal data or private $HOME defaults. Runs early (no node_modules needed).
|
|
sanitization:
|
|
image: *node_image
|
|
commands:
|
|
- apk add --no-cache bash
|
|
- bash packages/mosaic/framework/tools/quality/scripts/verify-sanitized.sh
|
|
# L0 resident-token budget: keep the Constitution + dispatcher small.
|
|
- |
|
|
for f in CONSTITUTION.md AGENTS.md; do
|
|
n=$(wc -l < "packages/mosaic/framework/defaults/$f")
|
|
if [ "$n" -gt 120 ]; then echo "L0 budget exceeded: defaults/$f is $n lines (max 120)"; exit 1; fi
|
|
done
|
|
|
|
typecheck:
|
|
image: *node_image
|
|
commands:
|
|
- *enable_pnpm
|
|
- pnpm typecheck
|
|
depends_on:
|
|
- install
|
|
- sanitization
|
|
|
|
# lint, format, and test are independent — run in parallel after typecheck
|
|
lint:
|
|
image: *node_image
|
|
commands:
|
|
- *enable_pnpm
|
|
- pnpm lint
|
|
depends_on:
|
|
- typecheck
|
|
|
|
format:
|
|
image: *node_image
|
|
commands:
|
|
- *enable_pnpm
|
|
- pnpm format:check
|
|
depends_on:
|
|
- typecheck
|
|
|
|
test:
|
|
image: *node_image
|
|
environment:
|
|
# Avoid the namespace-level Woodpecker DB service named "postgres".
|
|
# The Kubernetes backend exposes service containers by step name.
|
|
DATABASE_URL: postgresql://mosaic:mosaic@ci-postgres:5432/mosaic
|
|
commands:
|
|
- *enable_pnpm
|
|
# Install postgresql-client for pg_isready
|
|
- apk add --no-cache postgresql-client
|
|
# Wait up to 60s for CI postgres to be ready; fail fast if it never comes up.
|
|
- |
|
|
ready=0
|
|
for i in $(seq 1 60); do
|
|
if pg_isready -h ci-postgres -p 5432 -U mosaic; then
|
|
ready=1
|
|
break
|
|
fi
|
|
echo "Waiting for ci-postgres ($i/60)..."
|
|
sleep 1
|
|
done
|
|
if [ "$ready" -ne 1 ]; then
|
|
echo "ci-postgres did not become ready" >&2
|
|
exit 1
|
|
fi
|
|
# Run migrations (DATABASE_URL is set in environment above)
|
|
- pnpm --filter @mosaicstack/db run db:migrate
|
|
# Run all tests
|
|
- pnpm test
|
|
depends_on:
|
|
- typecheck
|
|
|
|
services:
|
|
ci-postgres:
|
|
image: pgvector/pgvector:pg17
|
|
environment:
|
|
POSTGRES_USER: mosaic
|
|
POSTGRES_PASSWORD: mosaic
|
|
POSTGRES_DB: mosaic
|