Program health refresh (run 7)

.env.example

@@ -0,0 +1,50 @@
+# Anthropic
+ANTHROPIC_API_KEY=
+
+# Jira
+JIRA_SERVER=https://epartsmse.atlassian.net/
+JIRA_EMAIL=
+JIRA_API_TOKEN=
+JIRA_PROJECT_KEY=EPARTS
+
+# Slack
+SLACK_BOT_TOKEN=
+SLACK_TEAM_CHANNEL=
+SLACK_ALERT_CHANNEL=
+
+# Bitbucket / GitHub
+# --- Product repo the SES acts on -------------------------------------------
+# The SES is a harness that operates on the product repo from the outside; it
+# does not live inside it (see docs/ses_product_repo_integration.md). These
+# point the Bitbucket MCP client (mcp/bitbucket.py) at the eParts ML repo.
+BITBUCKET_WORKSPACE=epartsservices
+BITBUCKET_REPO=intelligent-attribute-prediction
+# Token scope: start with PR read + PR comment ONLY.
+# Do NOT grant repository:write until SES005 is fixed — commit_file() currently
+# defaults to branch="main" (mcp/bitbucket.py:52), so a write-scoped token would
+# let an agent commit to the team's main branch with no PR and no human gate.
+# `python3 tools/lint_ses.py --strict` reports every affected call site.
+BITBUCKET_TOKEN=
+
+# Confluence
+CONFLUENCE_URL=
+CONFLUENCE_TOKEN=
+CONFLUENCE_SPACE_KEY=
+
+# Google Drive
+GOOGLE_DRIVE_SERVICE_ACCOUNT_JSON=
+GOOGLE_DRIVE_TRANSCRIPT_FOLDER_ID=
+
+# Vector store
+CHROMA_PERSIST_DIR=./memory/chroma
+
+# Database
+SQLITE_DB_PATH=./memory/
+
+# Agent config
+CLAUDE_MODEL=claude-sonnet-4-5-20250514
+CRON_POLL_INTERVAL_MIN=15
+STALE_REQ_THRESHOLD_DAYS=14
+P0_APPROVAL_REQUIRED=true
+CONFIDENCE_THRESHOLD_READINESS=200
+ALPHA_CALIBRATION_READINESS=100

.github/workflows/program-health.yml

@@ -0,0 +1,71 @@
+# Program Health auto-refresh — the scheduled measurement process.
+#
+# Every Monday morning (and on demand from the Actions tab) this workflow:
+#   1. exports all EPARTS issues from Jira (dashboard/fetch_jira.py, REST API,
+#      credentials from repo secrets — never in code),
+#   2. regenerates dashboard/program_health.html (seeded, reproducible),
+#   3. opens a PULL REQUEST with the refreshed numbers.
+# Human review of the PR stays in the loop before the new numbers land on
+# main — same gate pattern as the transcript pipeline.
+#
+# Metamodel: Process (weekly measurement), Artifacts (jira_issues.json +
+# program_health.html), Resources (CI runner + Jira API), Measurements are
+# the artifact itself.
+
+name: Program health refresh
+
+on:
+  schedule:
+    - cron: "0 12 * * 1"   # Mondays 12:00 UTC (8am ET)
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: program-health
+  cancel-in-progress: false
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Both scripts are stdlib-only — no pip install.
+      - name: Export Jira issues
+        env:
+          JIRA_EMAIL: ${{ secrets.JIRA_EMAIL }}
+          JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+        run: python3 dashboard/fetch_jira.py
+
+      - name: Regenerate dashboard
+        run: |
+          python3 dashboard/generate_program_health.py | tee /tmp/summary.txt
+          {
+            echo "## Program health refresh"
+            echo ""
+            echo '```'
+            cat /tmp/summary.txt
+            echo '```'
+            echo ""
+            echo "Provenance: data exported by \`dashboard/fetch_jira.py\` this run;"
+            echo "every figure recomputes from \`dashboard/data/jira_issues.json\`."
+            echo "Review the numbers, then merge — merging publishes the refresh."
+          } > /tmp/pr_body.md
+          cat /tmp/pr_body.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Open pull request with refreshed dashboard
+        uses: peter-evans/create-pull-request@v6
+        with:
+          branch: pipeline/program-health-${{ github.run_number }}
+          commit-message: "[agent:dashboard] Weekly program health refresh (run ${{ github.run_number }})"
+          title: "Program health refresh (run ${{ github.run_number }})"
+          body-path: /tmp/pr_body.md
+          labels: agent-generated, needs-human-review
+          delete-branch: true

.github/workflows/quality-gates.yml

@@ -0,0 +1,132 @@
+# Quality gates — the deterministic first line of defence, plus agent evals.
+#
+# Design premise (AI-tools coaching session with Cory Gwin, GitHub Copilot,
+# 2026-07-24): "A great deal of quality assurance is deterministic and consumes
+# no tokens." He pushed back on treating types/linters/coverage/security tooling
+# as merely basic checks — they are the first line of defence and should be
+# leaned into hard, because they run continuously at zero marginal cost. Only
+# behaviour that is genuinely non-deterministic needs a model in the loop, and
+# that is what the eval job covers.
+#
+# Three jobs, cheapest first:
+#   1. deterministic  — custom SES linter (tools/lint_ses.py) + ruff
+#   2. security       — Trivy: vulnerabilities, misconfiguration, secrets
+#   3. evals          — agent behaviour regression detection (evals/), offline
+#
+# All three are stdlib-only or action-provided; jobs 1 and 3 need no API key and
+# no network, so they are cheap enough to block every push. The model-dependent
+# eval tier costs tokens and is therefore opt-in via workflow_dispatch.
+#
+# Metamodel: Process (quality gate), Artifacts (violation reports, eval report),
+# Resources (CI runner, Trivy, the eval harness), Measurements (violation counts,
+# eval scores and detected regressions).
+
+name: Quality gates
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      live_evals:
+        description: "Also run the model-dependent eval tier (costs tokens)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: quality-gates-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deterministic:
+    name: Deterministic gates (SES linter + ruff)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # The SES linter is stdlib-only by design — it must run even when the
+      # agent dependencies (anthropic, chromadb, torch...) are not installed.
+      - name: Custom SES linter
+        run: python3 tools/lint_ses.py
+
+      # Advisory rules (currently SES005: commit_file() defaulting to main)
+      # are reported but do not fail the build yet. Flip to --strict once the
+      # affected call sites are fixed; see docs/ses_product_repo_integration.md
+      # §4, where fixing SES005 is a precondition for granting the harness
+      # write access to the product repo.
+      - name: Custom SES linter (strict — advisory findings, non-blocking)
+        continue-on-error: true
+        run: python3 tools/lint_ses.py --strict
+
+      - name: Install ruff
+        run: python -m pip install --upgrade pip ruff
+
+      # ruff is advisory for now: it reports 79 pre-existing violations in code
+      # written before any linting was enforced here. Ratcheting those down is
+      # tracked separately — turning it blocking today would just train the team
+      # to ignore a permanently-red gate. The custom SES linter above IS
+      # blocking, because its rules were introduced clean.
+      - name: ruff (advisory — pre-existing violations being ratcheted down)
+        continue-on-error: true
+        run: ruff check .
+
+  security:
+    name: Security scan (Trivy)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # Repo scan: dependency vulnerabilities, IaC/config misconfiguration, and
+      # hardcoded secrets. Fails the build on HIGH/CRITICAL only — anything
+      # noisier trains the team to ignore the gate, which is worse than no gate.
+      - name: Trivy filesystem scan
+        uses: aquasecurity/trivy-action@0.28.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          scanners: vuln,misconfig,secret
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          exit-code: "1"
+          format: table
+
+  evals:
+    name: Agent evals (offline tier)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Offline tier: routing evals execute the real routing table and the
+      # skill suites validate their controlled vocabularies. No model, no API
+      # key, no network — so this gates every PR. A failure here means an
+      # agent lost an ability it previously had; the report names which.
+      - name: Run offline evals
+        run: python3 -m evals.runner --json eval-report.json
+
+      # Model-dependent tier: runs the skill scenarios against a real model and
+      # scores its tool/label selections. Opt-in because it costs tokens.
+      - name: Run live evals
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.live_evals }}
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: python3 -m evals.runner --live --json eval-report-live.json
+
+      - name: Upload eval report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: eval-report
+          path: eval-report*.json
+          if-no-files-found: ignore

.github/workflows/requirements-extraction.yml

@@ -0,0 +1,70 @@
+# Requirements & ADR extraction — drives the LLM agents over meeting
+# transcripts and opens a PR with the generated requirements + ADR drafts.
+#
+# Closes the gap that the offline minutes pipeline left open: minutes were
+# generated for the summer meetings, but the requirements-extraction and
+# ADR agents were never re-run on that data. This runs them (transcript_parser
+# -> req_extractor -> adr_generator) using the ANTHROPIC_API_KEY repo secret,
+# then opens a PULL REQUEST — the human review of that PR is the approval gate
+# before any requirement/ADR is baselined on main.
+#
+# Manual trigger only (workflow_dispatch): this is a deliberate, reviewed run,
+# not something that should fire on every push.
+
+name: Requirements & ADR extraction
+
+on:
+  workflow_dispatch:
+    inputs:
+      since:
+        description: "Only process transcripts dated on/after this (YYYY-MM-DD)"
+        required: false
+        default: "2026-05-01"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: requirements-extraction
+  cancel-in-progress: false
+
+jobs:
+  extract:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Only the light deps the agents' LLM path needs — not chromadb/torch.
+      - name: Install agent deps
+        run: pip install "anthropic>=0.42" "python-dotenv>=1.0" "pydantic-settings>=2.7" "pydantic>=2.10"
+
+      - name: Run requirements + ADR extraction
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          # base.py's hardcoded default model id is stale and it always sends
+          # temperature; pin a current, temperature-accepting model.
+          CLAUDE_MODEL: claude-sonnet-4-5-20250929
+          LLM_PROVIDER: anthropic
+        run: |
+          python -m pipeline.extract_from_meetings \
+            --since "${{ github.event.inputs.since }}" \
+            --summary-file /tmp/pr_body.md
+          cat /tmp/pr_body.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Open pull request with generated requirements + ADRs
+        uses: peter-evans/create-pull-request@v6
+        with:
+          branch: pipeline/requirements-${{ github.run_number }}
+          commit-message: "[agent:req_extractor+adr_generator] Extract requirements & ADRs from meetings (run ${{ github.run_number }})"
+          title: "Agent-generated requirements & ADRs for review (run ${{ github.run_number }})"
+          body-path: /tmp/pr_body.md
+          labels: agent-generated, needs-human-review
+          add-paths: |
+            requirements/parsed/**
+            docs/adr/**
+          delete-branch: true

.github/workflows/static.yml

@@ -0,0 +1,43 @@
+# Simple workflow for deploying static content to GitHub Pages
+name: Deploy static content to Pages
+
+on:
+  # Runs on pushes targeting the default branch
+  push:
+    branches: ["main"]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
+# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  # Single deploy job since we're just deploying
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Pages
+        uses: actions/configure-pages@v5
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          # Upload entire repository
+          path: '.'
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5