Configurable package development and reuse pipeline — review proposal
Status: proposed implementation plan, reviewed 2026-09-13 against commit
8ceaecb26ae4a2666459ad843f77deff8b4fd748. Existing hook work was present during
the read-only audit. A fresh development MCP probe passed 35 checks. The two
bounded reproductions below ran in private temporary fixtures; their logs and
source bindings are retained outside the public repository. Pipeline completion
and fleet promotion are not established by this audit.
Implementation update: BUG-720 readiness and fail-closed builder dispatch are now integrated. The builder reports unavailable runtimes without fabricating output; real backend execution, issue-action evidence and knowledge-page status remain open. The inventory below records the original audit baseline. The related upstream contribution plan extends the same evidence and policy services.
Intended behavior
Build the reusable orchestration inside Praetor. Treat organization, forge, module namespace, catalogs, package destination, release channels, workstation roots and policy bindings as explicit deployment inputs. A private deployment binds these inputs to its own identities; the public app must work identically with synthetic identities such as the acme organisation and the example.com/acme/* module namespace. Default to read-only inventory and candidate plans until a stage is admitted. No blocking user question is needed to begin the stages below.
The missing piece is a source-bound link from evidence to reviewed capability demand, implementation, consumer verification and promotion. Existing modules provide many ingredients, but neither the accepted ADR text nor a green Praetor unit suite establishes a working global development loop.
Source-backed inventory
| Existing surface | What actually exists | Boundary/gap for this pipeline |
|---|---|---|
| Research and planning | internal/notebook/notebook.go:18,29,54 bounds imported source snapshots, checks hashes and produces templates. result.go:24,65 checks quote/source links and three document bodies. cmd/standardsctl/notebook.go:21 prepare/validate; MCP tools_notebook.go:17 preparation metadata. |
No automatic NotebookLM generation or semantic approval; no shared requirements-to-code/test relation. Reuse the source envelope, not a second research store. |
| Recorded observations | internal/harvester/transcript_types.go:23,58 explicitly models immutable observed events, source hash and line. transcript_ingest.go:31 supports replay/cursors; current formats are Antigravity and Claude (transcript_types.go:15). |
Observation is not verified fact. Other workstation globals, IDEs and languages need explicit adapters/coverage rather than inferred completeness. |
| Knowledge pages | None. SynthesizeKnowledgePages (formerly in internal/hindsight) was deleted in #457 (BUG-454): it had no caller and returned fixed prose with hardcoded "100% complete" claims. internal/hindsight/distiller.go distills facts only. |
No page generator exists to reuse. A future status page must be generated from evidence/ledger and retain unknown/partial rather than claim completion. |
| Demand extraction | internal/needs/analyzer.go:11,64 provides a registry for Go, Node, Python, Rust and Native. aggregate.go:44-75 analyzes selected framework and folds harvested consumers. |
No CSharp analyzer; consumers require explicit unsupported coverage. Catalog matches/source declarations do not prove compatible working APIs. |
| Demand dedupe | internal/needs/requests.go:30-48 deterministic gap aggregation/order, then:65 hardcoded owner;:76-87 capability-prefix destination;:91-98 consumer count presented as ROI;:116 mandates zero-dependency implementation. |
Add configurable destination/catalog and evidence-backed reuse decisions. A shared dependency used by3 consumers is not3 duplicate implementations or proof3:1 savings. |
| Code dedupe | internal/dedupe/dedupe.go:59-87,106-124 repository Go function-body hashing with size thresholds; scope excludes ignored worktrees. |
Useful exact-clone signal, not cross-language semantic equivalence, license clearance or safe automatic extraction. Preserve common-code versus unrelated-similarity distinction. |
| Templates and adoption | Profiles .config/archetypes/{framework,library-client,template-seed}.yaml; internal/adopt/adopt.go:119,197 state-aware adoption; internal/compiler/framework_assets.go:34,125 docs/rules/build-YAML starter generation. |
Generic starter files are not functional runtime projects. Framework profile currently declares Go; polyglot label alone does not supply correct gates. Asset family ownership remains duplicated with literal generators/templates per ADR0009. |
| Policy | internal/config/effective_load.go:23-37,55-87 selected fleet/org/deployment/workstation paths, pinned catalog snapshots, digest. |
This vertical slice enforces complexity, not all package/release/routing policy. Extend typed settings with actual consumers; never publish inert knobs. |
| Builder/optimizer | internal/builder/builder.go:125-166 returns Success:true and generated artifact paths/logs with no build. optimizer.go:108-125 writes option strings; it does not prune dependencies or measure performance. |
Immediate false-success blocker. Fail closed until real adapter and artifact readback exist. Separate planning flags from executed optimization. |
| Dogfood | internal/dogfood/suite.go:54-78 finite public adoption plus observed transcript replay. schedule.go:48-58 bounded local ticks/claims. repair.go:16,73 deterministic local repair plans. |
Suite verification excludes upstream app tests, fact verification, provider dispatch and promotion. Add separate evidence stages; do not reinterpret existing Verified boolean. |
| Repair execution | internal/repairrun/config.go:18-33 pins source, allowed Go files/packages and one provider. run.go:54 one eligible attempt. run_execute.go:140-167 scoped test verification, not promotion. |
Reuse admission/attempt/evidence design. Its Go AST constraints and4-package/8-file bounds are not a universal package workflow. Language runners must preserve the current scope guarantees. |
| Routing/context | internal/router/task.go:43 selects by declared model capability/cost/capacity. internal/promptopt/optimizer.go:68-102 selects supplied held-out observations. compiler/agents.go:30 projects personas; clientsetup/registry.go:39 validates MCP registry. |
Selection is not verified backend availability or native launch admission. Thin-expert adapter research remains separate; full default CLI overhead must be measured and charged to task budget. |
| Forge interconnect | internal/forge/reconciler.go:147-188 calculates candidate transitions. CLI issue.go:84-90 actually applies selected GitHub updates and fails mutation errors. |
Engine ActionTaken overclaims; CLI:169 hardcodes GitHub, and:173-176 warns/continues on source-list failures. Require complete observed prerequisite evidence before unblock. Gitea/GitLab methods explicitly unsupported (forge/gitea.go:53-103, analogous gitlab). |
| Release | internal/release/release.go:25-55 SemVer/clean/full-gate checks then changelog. flavors/flavors.go:117 plans ref-to-commit tag moves; CLI flavors.go:160 applies. |
No universal build/package/publish/consumer acceptance receipt. Moving a tag is not a verified package release. Release skip options must not satisfy promotion admission. |
| Owner fork | internal/operationalsync/overlay.go:15 four allowed identity/config overlays; identity.go:11-34 GitHub-only, public source/private same-name owner fork. |
Preserve this bounded contract. It cannot yet carry arbitrary portfolio policy, another forge or renamed package fork. Broader config mounts/versioned data need a separate reviewed extension. |
Verified failures and evidence
- CLI
go run ./cmd/standardsctl build --config <private fixture>returned0 and “Successfully compiled” with a nonexistent entrypoint and absent claimed binary.builder-repro.{log,json}retain command result. No backend ran; output directory is private evidence. - Overlay-only test
TestPlanningProbeReconcileClaimcalls the actual engine with one closed prerequisite and blocked consumer. Report says labels were removed/added, while stored labels remain blocked and a repeat produces the same action. No remote driver was attached.reconcile-repro.log,reconcile_probe_test.go,overlay.jsonretain proof without repository edits. The separate CLI apply path remains real. - Inspection proves static100% knowledge claims and private-owner hardcoding; these are not inferred from missing test names. Library lookup and source-observed APIs must remain candidate evidence. The separately reviewed BUG-720 fix must be integrated before asserting migration/epic safety. Builder dispatch corrections in another repository do not fix this Praetor implementation.
Minimal shared boundaries
Use one orchestration/application service with explicit injected interfaces, consistent with ADR0009. Do not create a framework or service locator for every noun. Keep source scanning, provider transport, runtime execution and CLI/MCP/IDE formatting in existing adapters.
- Package policy and catalog: extend internal/config with typed operational fields for target forge/org/module namespace, package kind (library/framework/module/template), capability namespace, selected catalog, dependency constraints, lifecycle/stage enablement and runtime adapters. Governance combines by tightening; operational destination follows documented precedence. One immutable resolved object and digest goes to demand, generation, dogfood and release consumers. No inferred home-directory configuration.
- Evidence and relations: one versioned manifest relates Source -> Claim/Requirement -> ReuseDecision -> PackageTask -> Change -> Verification -> ReleaseCandidate. Store stable IDs, parent IDs, source commit/content hashes, command/toolchain identities, actual outputs, captured time, coverage, and trust class. Reuse notebook/harvester hashes and existing journal/receipt mechanisms; projection adapters produce Markdown, issues and memory pages. Do not merge their unequal meanings into one generic success boolean.
- Stage executor: pure transition planner plus explicit execution admission. Each transition has prerequisites, scope, expected source, budget, implementation availability and repeat/idempotency key. Reuse repairrun attempts and bounded command wrappers. Typed states: observed, candidate, blocked, ready, running, failed, scoped_verified, consumer_verified, release_ready, published; publication needs remote readback.
- Adapter capability manifest: each language/forge/client declares what it can actually detect, plan, execute, verify and publish. Absence is unsupported. Go-first implementation is compatible with polyglot architecture; it is not universal completion. Keep language-specific import/API compatibility proof inside adapters.
Staged implementation and acceptance
| Stage | Smallest deliverable | Exit evidence / no-go condition |
|---|---|---|
| 0 Truthful status | Fail-closed builder, planned optimizer, candidate issue actions, evidence-derived knowledge status; integrate reviewed BUG720. | Red->green missing entrypoint/artifact and unavailable backend tests; CLI/MCP parity; no100%/published claim from declaration, exit0 or closed issue. Full normal gates. |
| 1 Shared package policy | One typed destination/catalog and package-kind config slice consumed by needs synthesis and starter planning. Default external destination unset. | A synthetic acme deployment and a private deployment yield the same behavior with distinct bindings; missing selected config errors; no credential/home path leaks; changing org requires no source edit; all effective hashes stable after relocation. |
| 2 Evidence interconnect | Import bounded research sources and relations; reuse decision taxonomy: reuse existing, adapter, upstream contribution, new implementation, defer. | Two consumers with same compatible need create one stable request; incompatible API/license/runtime constraints stay separate. Uncited claims/conflicting requirements cannot advance. No LLM required for IDs/dedupe/index. |
| 3 One real package slice | One Go library/adapter with two actual consumer fixtures; use existing native tooling and selected template family. | Clean build, existing tests, API compatibility tests, benchmark when performance claimed, actual artifact hashes; second-generation no drift; source-bound downstream red->green. No fabricated release/version. |
| 4 Dogfood and expert admission | Connect package tasks to existing bounded repair executor and native expert adapter. Keep source manifests private and provide minimum task context. | Positive/negative/boundary; time/output/attempt budgets; identical task token baseline comparison; forbidden tools unavailable; hooks still enforce; failure retained and no repeat spend on consumed task. Original-corpus replay remains explicit after scoped tests. |
| 5 Catalog/template promotion | Versioned signed catalog assets, compatibility floors, consumer enrollment by lifecycle state, rollback. | Every generated file belongs to one asset family; exact pins; user config preservation; unsupported-language template fails plan rather than defaults toGo; previous pinned artifact remains replayable. |
| 6 Forge/package release | Implement required provider methods behind Forge, then exact-source staged package publication. Owner deployment may choose Gitea-first/GitHub promotion; publicengine has no personaldefault. | Required CI planes on exact head, package install/import smoke in consumer, version/tag/artifact/signature/readback bound to same source, immutable idempotency, crash recovery. Failed/missing CI or API compatibility blocks promotion. No force/default-branch shortcut. |
Run each stage first on temporary synthetic local roots, then selected owned candidate branches, then one private deployment, then an explicitly enrolled non-owned public fixture. Public fixtures establish Praetor behavior; running their application/build code requires the separate allowed execution contract. Do not activate blanket fleet schedules or deploy the owner fork as proof the pipeline works.
Hardcoded bindings and public/private boundary
The audit baseline named concrete source migrations: needs/requests.go:65,76; needs/harvester.go:165-191; needs/framework.go:16; language analyzers and catalog.go replacement imports; cmd/standardsctl/issue.go:56-57. ADR-0014 (Accepted 2026-09-27) superseded ADR-0007's hardcoded deployment designation and moved each binding into operator settings: demand-request routing reads framework.targets.<lang>.builder_kits (createDemandRequest in internal/needs/requests.go); the language analyzers take each framework module and routing kit from framework.targets (FrameworkSettings in internal/config/operator_sections.go, read in internal/needs/targets.go), and the engine ships none; issue reconcile resolves its owner and repository set through resolveForgeOwner (cmd/standardsctl/forge_owner.go), forge.default_owner and forge.reconcile_repos, failing with config.ErrOwnerUnknown when none resolves. The framework-specific replacement wire field became the generic framework_replacement (internal/needs/types.go), with the former key read as a deprecated alias in internal/needs/demand_alias.go. Stage 1's remaining exit evidence (stable effective hashes after relocation, a private deployment run beside the synthetic one) is not established by this note. ADR0009's separation of archetypes and release flavors remains valid.
Targeted source search found no /home/ or /Users/ literal in production internal/cmd Go, archetype YAML or template files. Absolute home paths seen in local evidence are resolved runtime/workstation bindings, not proof a production literal exists. Public docs should use <workspace-root>, <catalog-root>, <state-root>, <owner-config> and logical source IDs. Private config binds them to actual directories; diagnostics may show a confined path but exported/public artifacts must redact it while retaining content hashes. Never copy personal config into public templates.
Prior knowledge and limits
No dependency/framework shopping is needed to start. Use existing Go module, config, bounded I/O, native Git and adapters. Prior package research remains candidate research, not adopted runtime capability. A shared library extraction follows demonstrated second-consumer reuse, compatibility and publication evidence. This plan makes no claim of full pipeline completion or savings before those measurements.