feat(14): Forecasting Engine — BAU Track

.github/workflows/deploy.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Build SvelteKit (adapter-cloudflare)
         run: npm run build
       - name: Deploy to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@9681c2997648301493e78cacbfb790a9f19c833f # v3.9.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

.github/workflows/forecast-refresh.yml

@@ -0,0 +1,56 @@
+name: Forecast Refresh
+on:
+  schedule:
+    - cron: '0 1 * * *'        # 01:00 UTC — C-02, Guard 8 cascade
+  workflow_dispatch:
+    inputs:
+      models:
+        description: 'Comma-separated model list (omit for all enabled)'
+        required: false
+        default: ''
+      run_date:
+        description: 'YYYY-MM-DD run date (omit for today)'
+        required: false
+        default: ''
+
+permissions:
+  contents: read
+
+concurrency:
+  group: forecast-refresh
+  cancel-in-progress: false
+
+jobs:
+  forecast:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      GITHUB_SHA: ${{ github.sha }}
+      FORECAST_ENABLED_MODELS: 'sarimax,prophet,ets,theta,naive_dow'
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+          cache-dependency-path: scripts/forecast/requirements.txt
+      - name: Install deps
+        run: pip install -r scripts/forecast/requirements.txt
+      - name: Run forecast pipeline
+        env:
+          SUPABASE_URL: ${{ secrets.DEV_SUPABASE_URL }}
+          SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.DEV_SUPABASE_SERVICE_ROLE_KEY }}
+          MODELS: ${{ inputs.models }}
+          RUN_DATE: ${{ inputs.run_date }}
+        run: |
+          set -euo pipefail
+          DATE_RE='^[0-9]{4}-[0-9]{2}-[0-9]{2}$'
+          ARGS=()
+          if [ -n "${MODELS:-}" ]; then
+            ARGS+=("--models" "$MODELS")
+          fi
+          if [ -n "${RUN_DATE:-}" ]; then
+            [[ "$RUN_DATE" =~ $DATE_RE ]] || { echo "::error::run_date must match YYYY-MM-DD, got: $RUN_DATE"; exit 1; }
+            ARGS+=("--run-date" "$RUN_DATE")
+          fi
+          python -m scripts.forecast.run_all "${ARGS[@]}"

.github/workflows/migrations.yml

@@ -9,7 +9,7 @@ jobs:
       SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
     steps:
       - uses: actions/checkout@v4
-      - uses: supabase/setup-cli@v1
+      - uses: supabase/setup-cli@b60b5899c73b63a2d2d651b1e90db8d4c9392f51 # v1.6.0
         with:
           version: latest
       - name: Link DEV project

.github/workflows/tests.yml

@@ -18,7 +18,7 @@ jobs:
         with:
           node-version: '20'
           cache: 'npm'
-      - uses: supabase/setup-cli@v1
+      - uses: supabase/setup-cli@b60b5899c73b63a2d2d651b1e90db8d4c9392f51 # v1.6.0
         with:
           version: latest
       - run: npm ci

.gitignore

@@ -15,6 +15,7 @@ playwright-report/
 # symlinks created by `./setup --prefix`. Per-machine; teammates run setup after clone.
 .claude/skills/gstack
 .claude/skills/gstack-*
+.gstack/
 .worktrees/
 __pycache__/
 .pytest_cache/

.planning/STATE.md

@@ -3,8 +3,9 @@ gsd_state_version: 1.0
 milestone: v1.3
 milestone_name: External Data & Forecasting Foundation
 status: "Phase 13 implementation complete on feature/phase-13-external-data-ingestion (24 commits ahead of main, head c5be916) — awaiting review + ship sequence"
-stopped_at: Phase 13 (External Data Ingestion) implementation complete on `feature/phase-13-external-data-ingestion` (24 commits ahead of main, head `c5be916`). Shipped artifacts on the phase branch: 7 migrations `0041_weather_daily.sql` → `0047_shop_calendar.sql` (hybrid-RLS for shared location-keyed tables, tenant-scoped RLS for `pipeline_runs`/`shop_calendar`), all Python fetchers under `scripts/external/` (weather/holidays/school/transit/events/shop_calendar) + `run_all.py` orchestrator + `pipeline_runs_writer.py`, configs (`config/shop_hours.yaml`, `config/recurring_events.yaml` 14-event starter), `.github/workflows/external-data-refresh.yml` (nightly cron `0 0 * * *` UTC + `workflow_dispatch` backfill), `pytest-external` job in `tests.yml`, `tests/external/` (8 unit test files), `tests/integration/tenant-isolation` extended for 7 new tables, ci-guard `scripts/ci-guards/check-cron-schedule.py`, TDD plan `docs/superpowers/plans/2026-04-29-phase-13-external-data-ingestion.md` (3,140 lines). Workflow rows actually executed: 1-3 (STATE), 4 (DESIGN — office-hours + override), 8 (worktree), 9 (writing-plans), 10 (subagent-driven-development). Skipped: row 5 (`/gstack-autoplan`). Outstanding: rows 12 (`/qa-gate` — claimed but no artifact), 15 (`/gstack-review`), 16 (`/gstack-cso` — Tier 3 mandatory: 7 migrations + new RLS), 17 (`/gsd-verify-work`), 18 (`/gsd-ship`), 19 (`/gstack-retro`).
-last_updated: "2026-04-29T00:00:00Z"
+stopped_at: "Phase 14 context gathered"
+resume_file: ".planning/phases/14-forecasting-engine-bau-track/14-CONTEXT.md"
+last_updated: "2026-04-29T01:00:00Z"
 progress:
   total_phases: 17
   completed_phases: 11