Complete Backend Loop Engineering

.dependency-cruiser.cjs

@@ -18,15 +18,15 @@ module.exports = {
       severity: 'error',
       from: { path: '^libs/features/[^/]+/domain' },
       to: {
-        path: '^(apps/|libs/platform|libs/features/[^/]+/(app|infra))|node_modules/(?:@nestjs|@prisma|fastify|bullmq|ioredis|redis)',
+        path: '^(apps/|libs/platform|libs/features/[^/]+/(?!domain(?:/|$)))|node_modules/(?:@nestjs|@prisma|fastify|bullmq|ioredis|redis)',
       },
     },
     {
       name: 'feature-app-must-not-import-infra-or-framework',
       severity: 'error',
       from: { path: '^libs/features/[^/]+/app' },
       to: {
-        path: '^(apps/|libs/platform|libs/features/[^/]+/infra)|node_modules/(?:@nestjs|@prisma|fastify|bullmq|ioredis|redis)',
+        path: '^(apps/|libs/platform|libs/features/[^/]+/(?!app(?:/|$)|domain(?:/|$)|shared(?:/|$)))|node_modules/(?:@nestjs|@prisma|fastify|bullmq|ioredis|redis)',
       },
     },
     {

.github/workflows/ci.yml

@@ -2,6 +2,9 @@ name: CI
 
 on:
   pull_request:
+  push:
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -12,145 +15,151 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  checks:
-    name: Checks
+  risk:
+    name: CI Risk
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
+    outputs:
+      effective_risk: ${{ steps.classify.outputs.effective_risk }}
+      runtime_required: ${{ steps.classify.outputs.runtime_required }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Dependency review
-        uses: actions/dependency-review-action@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          fail-on-severity: high
-          fail-on-scopes: runtime, development
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.x
           cache: npm
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Runtime dependency vulnerability audit (high+)
-        run: npm run audit:prod
-
-      - name: Prisma schema and generation drift
+      - name: Classify clean base/head diff
+        id: classify
         env:
-          DATABASE_URL: postgresql://postgres@127.0.0.1:54321/backend_core_kit?schema=public
-        run: npm run verify:prisma
-
-      - name: Format check
-        run: npm run format:check
-
-      - name: Lint
-        run: npm run lint
-
-      - name: Typecheck
-        run: npm run typecheck
-
-      - name: Environment example schema
-        run: npm run verify:env
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          if [[ "$BASE_SHA" =~ ^0+$ ]]; then
+            BASE_SHA=$(git rev-parse "$HEAD_SHA^")
+          fi
+          npm run --silent backendkit -- ci classify --base "$BASE_SHA" --head "$HEAD_SHA" >> "$GITHUB_OUTPUT"
 
-      - name: Dependency boundaries
-        run: npm run deps:check
+  full:
+    name: CI Full
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    env:
+      DATABASE_URL: postgresql://postgres@127.0.0.1:54321/backend_core_kit?schema=public
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
-      - name: Scaffold smoke gate (generated feature must pass lint/typecheck/deps)
-        run: npm run scaffold:smoke
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22.x
+          cache: npm
 
-      - name: Architecture smell scan (fail on new high)
-        run: npm run smells:arch:ci
+      - name: Install dependencies
+        run: npm ci
 
-      - name: Unit tests with coverage
-        run: npm run test:coverage
+      - name: Canonical full verification
+        run: npm run verify:ci-local
 
       - name: Upload unit coverage artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: unit-coverage
           path: coverage/
           if-no-files-found: ignore
+          retention-days: 7
 
-      - name: OpenAPI snapshot gate
-        run: npm run openapi:check
-
-      - name: OpenAPI Spectral lint
-        run: npm run openapi:lint
-
-      - name: Gate honesty (expected failures)
-        run: npm run verify:gates
-
-      - name: Start local dependencies (Postgres + Redis + MinIO)
-        run: npm run deps:up
+  runtime:
+    name: CI Runtime
+    needs: risk
+    if: needs.risk.outputs.runtime_required == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    env:
+      DATABASE_URL: postgresql://postgres@127.0.0.1:54321/backend_core_kit?schema=public
+      REDIS_URL: redis://127.0.0.1:63790/0
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
-      - name: Wait for Postgres (docker compose)
-        run: |
-          for i in {1..30}; do
-            if docker compose exec -T postgres pg_isready -U postgres -d backend_core_kit > /dev/null 2>&1; then
-              echo "Postgres is ready"
-              exit 0
-            fi
-            echo "Waiting for Postgres... ($i/30)"
-            sleep 2
-          done
-          echo "Postgres did not become ready in time"
-          docker compose logs postgres
-          exit 1
-
-      - name: Wait for Redis (docker compose)
-        run: |
-          for i in {1..30}; do
-            if docker compose exec -T redis redis-cli ping 2>/dev/null | grep -q PONG; then
-              echo "Redis is ready"
-              exit 0
-            fi
-            echo "Waiting for Redis... ($i/30)"
-            sleep 2
-          done
-          echo "Redis did not become ready in time"
-          docker compose logs redis
-          exit 1
-
-      - name: Wait for MinIO (docker compose)
-        run: |
-          for i in {1..60}; do
-            if curl -fsS http://127.0.0.1:59090/minio/health/ready > /dev/null; then
-              echo "MinIO is ready"
-              exit 0
-            fi
-            echo "Waiting for MinIO... ($i/60)"
-            sleep 1
-          done
-          echo "MinIO did not become ready in time"
-          docker compose logs minio
-          exit 1
-
-      - name: Apply Prisma migrations
-        env:
-          DATABASE_URL: postgresql://postgres@127.0.0.1:54321/backend_core_kit?schema=public
-        run: npm run prisma:migrate:deploy
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22.x
+          cache: npm
 
-      - name: Prisma migration status
-        env:
-          DATABASE_URL: postgresql://postgres@127.0.0.1:54321/backend_core_kit?schema=public
-        run: npm run prisma:migrate:status
+      - name: Install dependencies
+        run: npm ci
 
-      - name: Integration tests
-        env:
-          DATABASE_URL: postgresql://postgres@127.0.0.1:54321/backend_core_kit?schema=public
-          REDIS_URL: redis://127.0.0.1:63790/0
-        run: npm run test:int
+      - name: Generate Prisma client
+        run: npm run prisma:generate
 
-      - name: E2E tests
-        env:
-          DATABASE_URL: postgresql://postgres@127.0.0.1:54321/backend_core_kit?schema=public
-          REDIS_URL: redis://127.0.0.1:63790/0
-        run: npm run test:e2e
+      - name: Canonical runtime verification
+        run: npm run verify:e2e
 
       - name: Stop local dependencies
         if: always()
         run: npm run deps:down
+
+  governance:
+    name: CI Governance
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Dependency review
+        if: github.event_name == 'pull_request'
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
+        with:
+          fail-on-severity: high
+          fail-on-scopes: runtime, development
+
+      - name: Secret scan
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  required:
+    name: CI Required
+    needs:
+      - risk
+      - full
+      - runtime
+      - governance
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    env:
+      RISK_RESULT: ${{ needs.risk.result }}
+      FULL_RESULT: ${{ needs.full.result }}
+      RUNTIME_RESULT: ${{ needs.runtime.result }}
+      GOVERNANCE_RESULT: ${{ needs.governance.result }}
+    steps:
+      - name: Require every selected lane
+        run: |
+          if [[ "$RISK_RESULT" != "success" || "$FULL_RESULT" != "success" || "$GOVERNANCE_RESULT" != "success" ]]; then
+            exit 1
+          fi
+          if [[ "$RUNTIME_RESULT" != "success" && "$RUNTIME_RESULT" != "skipped" ]]; then
+            exit 1
+          fi

.gitleaksignore

@@ -0,0 +1 @@
+61af6327f68711d75bd55728bc9266a82c98a69d:libs/platform/otel/telemetry.spec.ts:generic-api-key:62

README.md

@@ -12,6 +12,24 @@ Documentation is in `docs/README.md` (source of truth).
   - errors are RFC7807 (`application/problem+json`) with stable `code` + `traceId`
   - generated OpenAPI snapshot committed at `docs/openapi/openapi.yaml` and linted by Spectral
 - Auth + sessions (password + OIDC), RBAC, idempotency keys, email infra, admin control-plane + audits
+- Repository-local loop engineering for scoped agent tasks, isolated worktrees,
+  risk-aware verification, bounded repair, verified handoff, and independent CI
+
+## Agent development loop
+
+`backendkit` is the canonical harness used internally by the current Codex
+conversation. It does not launch another agent. Start with a human-approved V2
+execution plan, let the current agent use the task/workspace/verification
+commands, then separately authorize publication actions after review.
+
+```bash
+npm run backendkit -- doctor
+npm run backendkit -- task begin --plan docs/exec-plans/active/<plan>.md
+npm run backendkit -- task verify --task <task-id>
+```
+
+See `docs/engineering/loop-engineering.md` for the architecture and readiness
+status, and `docs/engineering/agent-pr-loop.md` for the operating workflow.
 
 ## Quickstart (local)
 
@@ -25,6 +43,7 @@ Documentation is in `docs/README.md` (source of truth).
 - `npm run start:dev` (API on `http://127.0.0.1:4000`, Swagger UI at `/docs` in dev)
 - `npm run start:worker:dev` (worker on `http://127.0.0.1:4001`)
 - `npm run verify` (format/lint/typecheck/boundaries/tests/openapi gates)
+- `npm run backendkit -- doctor` (read-only harness prerequisite inspection)
 - Optional: `npm run verify:e2e` (brings up local deps and runs e2e)
 
 ### WSL note (repo on Windows mount)