feat(inter-agent): delta-3 envelope standard — XML task dispatch prot… #480
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ═══════════════════════════════════════════════════════════════════════════ | |
| # AGENTIC CI — Dual-Lane Constitutional Gate (AAA — TypeScript/React) | |
| # DITEMPA BUKAN DIBERI | |
| # ═══════════════════════════════════════════════════════════════════════════ | |
| # | |
| # Lane 1 — STANDARD CI: install → lint → build → test (BLOCKING) | |
| # Lane 2 — BIJAKSANA: advisory metrics (ΔS, Φ, Ψ, Ω) | |
| # Lane 3 — REPORT: aggregate evidence (if: always()) | |
| # Lane 4 — FINAL GATE: pass/fail from real job outcomes | |
| # | |
| # Verdict: CI_PASS | CI_FAIL | ADVISORY_WARN | RUNTIME_UNVERIFIED | |
| # CI supplies evidence; arifOS judges. CI never impersonates the kernel. | |
| # On push to main → ALL lanes → Agentic CI Report as Check Run | |
| name: "🧠 Agentic CI" | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| checks: write | |
| statuses: write | |
| concurrency: | |
| group: agentic-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ───────────────────────────────────────────────────────────── | |
| # F11 — Gitleaks (parity with GEOX/WEALTH/WELL/A-FORGE/HERMES) | |
| # ───────────────────────────────────────────────────────────── | |
| secrets: | |
| if: github.actor != 'dependabot[bot]' && github.actor != 'app/dependabot' | |
| name: 🔐 Secrets Scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: gitleaks/gitleaks-action@v3 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # ───────────────────────────────────────────────────────────── | |
| # LANE 1: STANDARD CI — lint + build + test | |
| # ───────────────────────────────────────────────────────────── | |
| standard: | |
| if: github.actor != 'dependabot[bot]' && github.actor != 'app/dependabot' | |
| name: "Lane 1 — Standard CI" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [secrets] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| - name: Install | |
| run: npm ci --legacy-peer-deps | |
| - name: Lint | |
| run: npm run lint | |
| - name: Build | |
| run: npm run build | |
| - name: Test | |
| id: test | |
| run: | | |
| mkdir -p reports | |
| set -o pipefail; npm test 2>&1 | tee reports/test-output.txt | |
| echo "exit_code=$?" >> $GITHUB_OUTPUT | |
| - name: Upload diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: standard-ci-evidence | |
| path: reports/ | |
| retention-days: 7 | |
| # ───────────────────────────────────────────────────────────── | |
| # LANE 2: BIJAKSANA — TypeScript-native entropy metrics | |
| # ───────────────────────────────────────────────────────────── | |
| bijaksana: | |
| if: github.actor != 'dependabot[bot]' && github.actor != 'app/dependabot' | |
| name: "Lane 2 — BIJAKSANA ΔS Φ Ψ Ω" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| outputs: | |
| ds-value: ${{ steps.ds.outputs.value }} | |
| phi-value: ${{ steps.phi.outputs.value }} | |
| psi-value: ${{ steps.psi.outputs.value }} | |
| omega-value: ${{ steps.omega.outputs.value }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| - name: Install | |
| run: npm ci --legacy-peer-deps | |
| - name: "ΔS — Entropy (unused code + TODO count)" | |
| id: ds | |
| run: | | |
| DEAD=$(npx eslint . --ext .ts,.tsx --format stylish 2>/dev/null | grep -cE 'no-unused-vars|unused-import|no-unused' || true) | |
| TODO=$(grep -r "TODO\|FIXME\|HACK" --include="*.ts" --include="*.tsx" src/ a2a-server/ 2>/dev/null | wc -l) | |
| DS=$((DEAD + TODO)) | |
| echo "value=$DS" >> $GITHUB_OUTPUT | |
| echo "dead_imports=$DEAD todo=$TODO" >> $GITHUB_OUTPUT | |
| echo "ΔS = dead_code($DEAD) + TODO($TODO) = $DS" | |
| # TODO/FIXME/HACK patterns | |
| TODO=$(grep -r "TODO\|FIXME\|HACK" --include="*.ts" --include="*.tsx" src/ a2a-server/ 2>/dev/null | wc -l) | |
| DS=$((DEAD + TODO)) | |
| echo "value=$DS" >> $GITHUB_OUTPUT | |
| echo "dead_imports=$DEAD todo=$TODO" >> $GITHUB_OUTPUT | |
| echo "ΔS = dead_code($DEAD) + TODO($TODO) = $DS" | |
| - name: "Φ — Clarity (lint density per 1K source lines)" | |
| id: phi | |
| run: | | |
| # Count TypeScript source lines (non-blank, non-comment) | |
| SRC_LINES=$(find src/ a2a-server/ -name "*.ts" -o -name "*.tsx" 2>/dev/null | xargs cat 2>/dev/null | grep -cve '^\s*$' -e '^\s*//' -e '^\s*\*' || echo 0) | |
| # Count ESLint violations | |
| VIOLATIONS=$(npx eslint . --ext .ts,.tsx --format json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(sum(len(f.get('messages',[])) for f in d))" 2>/dev/null || echo 0) | |
| # Lint density per 1K source lines | |
| if [ "$SRC_LINES" -gt 0 ]; then | |
| DENSITY=$(python3 -c "print(round($VIOLATIONS / ($SRC_LINES / 1000.0), 2))") | |
| else | |
| DENSITY="0" | |
| fi | |
| echo "value=$DENSITY" >> $GITHUB_OUTPUT | |
| echo "violations=$VIOLATIONS source_lines=$SRC_LINES" >> $GITHUB_OUTPUT | |
| echo "Φ = ${DENSITY} violations/1KLoC ($VIOLATIONS violations, $SRC_LINES source lines)" | |
| - name: "Ψ — Truth (agent registry integrity)" | |
| id: psi | |
| run: | | |
| if [ -f "registries/agents.yaml" ]; then | |
| # Count registered agents | |
| AGENTS=$(python3 -c "import yaml; d=yaml.safe_load(open('registries/agents.yaml')); print(len([a for a in d['agents'] if isinstance(a,dict)]))" 2>/dev/null || echo 0) | |
| echo "value=$AGENTS" >> $GITHUB_OUTPUT | |
| echo "Ψ = $AGENTS agents in canonical registry" | |
| else | |
| echo "value=NO_REGISTRY" >> $GITHUB_OUTPUT | |
| echo "Ψ = NO_REGISTRY" | |
| fi | |
| - name: "Ω — Governance (no self-auth + constitutional sanity)" | |
| id: omega | |
| run: | | |
| # Self-authorization patterns in source | |
| SELF_AUTH=$(grep -r "self.*authorize\|self.*grant\|self.*approve\|bypass.*floor\|skip.*constitutional" --include="*.ts" --include="*.tsx" src/ a2a-server/ 2>/dev/null | grep -v "node_modules\|\.git\|FORGE\|DEPRECATED\|comment\|// " | wc -l) | |
| # Deprecated agent references still active (A-AUDIT, A-ARCHIVE, apex-prime) | |
| ZOMBIE=$(grep -rn "A-AUDIT\|A-ARCHIVE\|apex-prime" src/ a2a-server/ --include="*.ts" --include="*.tsx" 2>/dev/null | grep -v "DEPRECATED\|collapsed\|//\|README\|node_modules" | wc -l) | |
| echo "value=$SELF_AUTH" >> $GITHUB_OUTPUT | |
| echo "zombie_agents=$ZOMBIE" >> $GITHUB_OUTPUT | |
| if [ "$SELF_AUTH" -gt 0 ] || [ "$ZOMBIE" -gt 0 ]; then | |
| echo "Ω = VIOLATION (self_auth=$SELF_AUTH, zombie_agents=$ZOMBIE)" | |
| else | |
| echo "Ω = CLEAN" | |
| fi | |
| # ───────────────────────────────────────────────────────────── | |
| # REPORT: Aggregate + Post Agentic CI Check Run | |
| # ───────────────────────────────────────────────────────────── | |
| report: | |
| if: (always()) && (github.actor != 'dependabot[bot]' && github.actor != | |
| 'app/dependabot') | |
| name: "📊 Agentic CI Report" | |
| runs-on: ubuntu-latest | |
| needs: [standard, bijaksana] | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Generate Agentic CI Report | |
| id: report | |
| run: | | |
| echo "=== AGENTIC CI REPORT ===" | |
| echo "Organ: AAA (TypeScript/React — Cockpit + A2A Gateway)" | |
| echo "SHA: ${{ github.sha }}" | |
| echo "Ref: ${{ github.ref_name }}" | |
| echo "Time: $(date -u '+%Y-%m-%dT%H:%M:%SZ')" | |
| echo "" | |
| STANDARD_OK="${{ needs.standard.result }}" | |
| echo "Lane 1 (Standard CI): $STANDARD_OK" | |
| DS="${{ needs.bijaksana.outputs.ds-value }}" | |
| PHI="${{ needs.bijaksana.outputs.phi-value }}" | |
| PSI="${{ needs.bijaksana.outputs.psi-value }}" | |
| OMEGA="${{ needs.bijaksana.outputs.omega-value }}" | |
| echo "ΔS = $DS (dead_code + TODO)" | |
| echo "Φ = $PHI (build health)" | |
| echo "Ψ = $PSI (agent registry)" | |
| echo "Ω = $OMEGA (governance)" | |
| # Verdict: CI evidence, never sovereign language | |
| STANDARD_OK="${{ needs.standard.result }}" | |
| if [ "$STANDARD_OK" = "success" ] && [ "$OMEGA" = "0" ] && [ "$DS" -lt 100 ]; then | |
| VERDICT="CI_PASS" | |
| elif [ "$STANDARD_OK" = "success" ]; then | |
| VERDICT="ADVISORY_WARN" | |
| else | |
| VERDICT="CI_FAIL" | |
| fi | |
| echo "Verdict: $VERDICT" | |
| cat > agentic_ci_report.json << REPORTEOF | |
| { | |
| "organ": "AAA", | |
| "stack": "TypeScript/React/Vite", | |
| "sha": "${{ github.sha }}", | |
| "ref": "${{ github.ref_name }}", | |
| "run_id": "${{ github.run_id }}", | |
| "timestamp": "$(date -u '+%Y-%m-%dT%H:%M:%SZ')", | |
| "lane_1_standard": "$STANDARD_OK", | |
| "lane_2_bijaksana": { | |
| "ds": $DS, | |
| "phi": $PHI, | |
| "psi": "$PSI", | |
| "omega": $OMEGA | |
| }, | |
| "verdict": "$VERDICT" | |
| } | |
| REPORTEOF | |
| cat agentic_ci_report.json | |
| - name: Post Agentic CI Check Run | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const report = JSON.parse(fs.readFileSync('agentic_ci_report.json', 'utf8')); | |
| const conclusion = report.verdict === 'CI_PASS' ? 'success' : | |
| report.verdict === 'ADVISORY_WARN' ? 'neutral' : 'failure'; | |
| await github.rest.checks.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| name: 'Agentic CI', | |
| head_sha: context.sha, | |
| status: 'completed', | |
| conclusion: conclusion, | |
| output: { | |
| title: `Agentic CI — AAA: ${report.verdict}`, | |
| summary: [ | |
| `| Lane | Status | Detail |`, | |
| `|------|--------|--------|`, | |
| `| Standard CI | ${report.lane_1_standard} | lint → build → test |`, | |
| `| ΔS Entropy | ${report.lane_2_bijaksana.ds} | dead code + TODO count |`, | |
| `| Φ Clarity | ${report.lane_2_bijaksana.phi} | violations/1KLoC |`, | |
| `| Ψ Truth | ${report.lane_2_bijaksana.psi} | agents registered |`, | |
| `| Ω Govern | ${report.lane_2_bijaksana.omega} | self-auth + zombies |`, | |
| `| **Verdict** | **${report.verdict}** | |`, | |
| '', | |
| `> DITEMPA BUKAN DIBERI — Agentic CI Report`, | |
| ].join('\n') | |
| } | |
| }); | |
| - name: Upload Agentic CI Report artifact | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: agentic-ci-report-${{ github.sha }} | |
| path: agentic_ci_report.json | |
| retention-days: 90 | |
| # ───────────────────────────────────────────────────────────── | |
| # FINAL GATE: honest pass/fail from real job outcomes | |
| # ───────────────────────────────────────────────────────────── | |
| final-gate: | |
| if: (always()) && (github.actor != 'dependabot[bot]' && github.actor != | |
| 'app/dependabot') | |
| name: "🔒 Final Gate" | |
| runs-on: ubuntu-latest | |
| needs: [standard, bijaksana, report] | |
| timeout-minutes: 2 | |
| steps: | |
| - name: Verdict | |
| run: | | |
| STANDARD="${{ needs.standard.result }}" | |
| echo "Standard CI: $STANDARD" | |
| if [ "$STANDARD" = "success" ]; then | |
| echo "✅ CI_PASS — all required checks passed" | |
| elif [ "$STANDARD" = "skipped" ]; then | |
| echo "⚠️ RUNTIME_UNVERIFIED — standard lane skipped" | |
| else | |
| echo "❌ CI_FAIL — required checks did not pass" | |
| exit 1 | |
| fi |