Commit9e18483unknown_key

docs(bible): lock new files from this session (additive only)

docs(bible): lock new files from this session (additive only)

Adds to §4 LOCKED:
- drizzle/0038_deployment_ready_after.sql (wait-timer enforcement)
- src/lib/cron.ts (5-field UNIX cron parser/matcher)
- src/lib/scheduled-workflows.ts (autopilot scheduled-workflows task)
- src/lib/push-policy.ts (pre-receive enforcement)
- src/lib/git-push-auth.ts (push Authorization resolver)

Updates existing locked entries to reflect the new wiring:
- src/lib/environments.ts now exports latestApprovalAt /
  computeReadyAfter / releaseExpiredWaitTimers; computeApprovalState
  returns readyAfter alongside approved/rejected.
- src/lib/spec-to-pr.ts entry documents the new issue-driven entry
  point (Build with AI button) and the auto-Closes #N pre-fill.
- src/lib/pr-triage.ts entry switched from "placeholder" to the
  fully-wired triage hook with idempotency marker.
- src/lib/ai-review.ts entry switched from stub note to real review
  pipeline with idempotency marker.

Test count bumped from 1033 to 1143 — verified locally with bun
install on this branch (1143 pass / 8 skip / 0 fail).

Strictly additive — no locked entry deleted or renamed. Per agent
policy this is the §6 step-8 update we owe after every block.

https://claude.ai/code/session_0163vJChUuZqqtBBznUW6xBU

Claude committed on April 30, 2026Parent: cb6fd59

1 file changed+10−49e18483f15eedce17740ad439c83b36e75bb345b

1 changed file+10−4

ModifiedBUILD_BIBLE.md+10−4View fileUnified Split

@@ -366,6 +366,7 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

366366- `drizzle/0035_repo_collaborators.sql` — migration, never edited in place. Adds `repo_collaborators` (unique on `(repository_id, user_id)`, role enum read/write/admin, `invited_by` nullable, `accepted_at` nullable).

367367- `drizzle/0036_invite_token_hash.sql` — migration, never edited in place. Adds `invite_token_hash` column (sha256 of plaintext) to `repo_collaborators` for email-flow invites; NULL on legacy auto-accepted rows.

368368- `drizzle/0037_workflow_engine_v2.sql` — migration, never edited in place. Strictly additive to Block C1 (`drizzle/0008_workflows.sql` stays locked). Adds `workflow_secrets` (AES-256-GCM, `(repo, name)` unique), `workflow_dispatch_inputs` (per-workflow input schema), `workflow_run_cache` (content-addressable cache, repo/branch/tag scoped), `workflow_runner_pool` (warm-runner registry).

369- `drizzle/0038_deployment_ready_after.sql` — migration, never edited in place. Adds `deployments.ready_after` (timestamptz, NULL = no wait) + partial index. Backs the wait-timer enforcement for environment approvals (was previously a stub per Block C4 v1).

369370

370371### 4.2 Git layer (locked)

371372- `src/git/repository.ts` — tree / blob / commits / diff / branches / blame / search / raw / tags / commitsBetween

@@ -386,7 +387,7 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

386387- `src/lib/workflow-runner.ts` (Block C1) — shell executor. Exports `executeRun`, `drainOneRun`, `enqueueRun`, `startWorker`. Clones repo to tmpdir, runs each job via `Bun.spawn(["bash","-c",step.run])` with SIGTERM→SIGKILL timeouts, size-capped stdout/stderr, cleans up in `finally`.

387388- `src/lib/packages.ts` (Block C2) — npm protocol helpers: `parsePackageName`, `computeShasum` (sha1), `computeIntegrity` (sha512 base64), `buildPackument`, `resolveRepoFromPackageJson`, `parseRepoUrl`, `tarballFilename`. Pure functions.

388389- `src/lib/pages.ts` (Block C3) — `onPagesPush` (never throws), `resolvePagesPath` (probe list including pretty URLs + traversal strip), `contentTypeFor` (MIME).

389- `src/lib/environments.ts` (Block C4) — `matchGlob`, `listEnvironments`, `getOrCreateEnvironment`, `getEnvironmentByName`, `isReviewer`, `reviewerIdsOf`, `allowedBranchesOf`, `computeApprovalState`, `reduceApprovalState`, `recordApproval`, `requiresApprovalFor`. Empty reviewers list → repo owner approves. Any rejection hard-stops.

390- `src/lib/environments.ts` (Block C4) — `matchGlob`, `listEnvironments`, `getOrCreateEnvironment`, `getEnvironmentByName`, `isReviewer`, `reviewerIdsOf`, `allowedBranchesOf`, `computeApprovalState` (now also returns `readyAfter`), `reduceApprovalState`, `recordApproval`, `requiresApprovalFor`. Wait-timer enforcement: `latestApprovalAt(decided)`, `computeReadyAfter(env, decided)`, `releaseExpiredWaitTimers(now)` flip `status="waiting_timer"` → `"pending"` once `ready_after` elapses. Wired into autopilot as the `wait-timer-release` task. Empty reviewers list → repo owner approves. Any rejection hard-stops.

390391

391392### 4.3.1 Permissions + collaborators (locked)

392393- `src/middleware/repo-access.ts` — centralised permission check applied to all repo-write routes. Resolves owner / collaborator-role / org-team-role and rejects unauthorised mutations.

@@ -413,9 +414,10 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

413414- `src/lib/timetravel.ts` — time-travel code explorer (historical snapshot navigation).

414415- `src/lib/depimpact.ts` — dependency impact analyzer (cross-reference of who breaks if X bumps).

415416- `src/lib/rollback.ts` — one-click rollback helper for failed deploys.

416- `src/lib/spec-to-pr.ts` + `src/lib/spec-ai.ts` + `src/lib/spec-context.ts` + `src/lib/spec-git.ts` — Spec-to-PR v2 pipeline (NL feature spec → Claude → branch via git plumbing → PR row). Graceful fallback when no `ANTHROPIC_API_KEY`.

417- `src/lib/spec-to-pr.ts` + `src/lib/spec-ai.ts` + `src/lib/spec-context.ts` + `src/lib/spec-git.ts` — Spec-to-PR v2 pipeline (NL feature spec → Claude → branch via git plumbing → PR row). Graceful fallback when no `ANTHROPIC_API_KEY`. Issue-driven entry: the issue detail page renders a "Build with AI" button for owners on open issues, linking to `/spec?fromIssue=N`; spec is pre-filled with `Implement: <title>\n\n<body>\n\nCloses #N` so J7 close-keywords auto-close the issue on merge. Pure helper `buildSpecFromIssue` exported from `src/routes/specs.tsx`.

417418- `src/lib/autorepair.ts` — `autoRepair(...)` invoked from `src/hooks/post-receive.ts` and exercised by `src/__tests__/intelligence.test.ts`. **Distinct from `src/lib/auto-repair.ts`** (gate-time `repairSecrets`/`repairSecurityIssues` used by `src/lib/gate.ts`). Both are load-bearing — do not dedupe.

418- `src/lib/pr-triage.ts` — placeholder for a future post-create PR-triage hook (logs only, no AI call). Distinct from `triagePullRequest` in `src/lib/ai-generators.ts` which is the live D3 path.

419- `src/lib/pr-triage.ts` — `triggerPrTriage(input)` post-PR-create hook. Builds a tiny diff summary (numstat only), loads available labels + candidate reviewers (owner + recent PR authors, capped at 12), calls `triagePullRequest()` from `ai-generators.ts`, then inserts a "## AI Triage" comment. Idempotent via `PR_TRIAGE_MARKER` (HTML comment in body). Pure helper `renderTriageComment(triage)` exported. Suggestions only — never applies.

420- `src/lib/ai-review.ts` — `triggerAiReview(...)` PR-create hook now actually runs Claude review. Computes `git diff base...head`, caps at 100KB, calls `reviewDiff()`, posts a summary comment + N inline file/line comments. Idempotent via `AI_REVIEW_MARKER`; degrades to a single "AI review unavailable" comment on Anthropic API failure. Never throws.

419421

420422### 4.5 Platform (locked)

421423- `src/lib/notify.ts` — notification creation + audit log (swallow-failures pattern). Also fans out email to opted-in recipients for `mention|review_requested|assigned|gate_failed`. Exports `__internal` for tests.

@@ -439,6 +441,10 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

439441- `src/lib/workflow-matrix.ts` — matrix expansion for workflow jobs.

440442- `src/lib/workflow-artifacts.ts` — artifact persistence helpers backing `workflow_run_cache`-style storage.

441443- `src/lib/workflow-secrets.ts` + `src/lib/workflow-secrets-crypto.ts` — AES-256-GCM secret storage. Crypto lib stays separate from DB lib so the DB layer holds opaque bytes only.

444- `src/lib/cron.ts` — pure 5-field UNIX cron parser + matcher. Supports literals, ranges, steps (`a-b/n`, `*/n`), comma-lists, full POSIX OR semantics for dom + dow. Rejects @aliases and L/W/#/? with clear errors. Exports `parseCron`, `cronMatches`, `cronFiredBetween` (caps lookback at 1 day). Zero side effects.

445- `src/lib/scheduled-workflows.ts` — `runScheduledWorkflowsTick(now)` scans non-disabled workflows whose parsed JSON includes `schedules`, computes `since` from the latest schedule-triggered run (fallback now-6min), enqueues at most one schedule run per workflow per tick. `MAX_RUNS_PER_TICK=50` safety cap. Pure helpers `schedulesFromParsedJson` + `firstCronToFire` exported. Wired into `src/lib/autopilot.ts` as the `scheduled-workflows` task.

446- `src/lib/push-policy.ts` — pre-receive enforcement at the HTTP layer. Exports `evaluatePushPolicy({repositoryId, refs, pusherUserId})` returning `{allowed, violations}`; combines `matchProtectedTag` + `canBypassProtectedTag` (E7) and `evaluatePush` (J6) over the ref list. Only "active" enforcement blocks; "evaluate" enforcement remains dry-run. `formatPolicyError(violations)` builds the 403 body. Fail-open on any DB hiccup so a Postgres blip cannot wedge legitimate pushes. `ZERO_SHA` exported.

447- `src/lib/git-push-auth.ts` — Authorization-header → User resolver for `git-receive-pack`. Accepts Basic (user:secret) and Bearer schemes; secrets matching `glc_` (PAT) or `glct_` (OAuth) prefixes are looked up. Decoders `decodeBasicAuth` / `decodeBearerAuth` exported. Returns `null` on any failure → caller treats as anonymous.

442448

443449### 4.6 Routes (locked endpoints — behaviour must be preserved)

444450- `src/routes/git.ts` — Smart HTTP (clone/push)

@@ -579,7 +585,7 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

579585```bash

580586bun install

581587bun dev # hot reload

582bun test # 1033 tests currently pass (8 skipped, 0 failed) as of 2026-04-29 — run `bun install` first

588bun test # 1143 tests currently pass (8 skipped, 0 failed) as of 2026-04-30 — run `bun install` first

583589bun run db:migrate

584590```

585591

586592