feat(ksp): implement Knowing-State Prosthesis layer — 7 packages, full loop e2e #370
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| typecheck: | |
| name: Typecheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| # Typecheck all packages. ff-pipeline has strict settings and its own | |
| # code is clean; dependency package errors (gdk-agent, gdk-ai, etc.) | |
| # are excluded from the ff-pipeline pass via grep filter. | |
| - name: Typecheck packages (excluding ff-pipeline) | |
| run: pnpm -r --if-present --filter '!@factory/ff-pipeline' typecheck | |
| - name: Typecheck ff-pipeline (own code only) | |
| run: | | |
| output=$(pnpm --filter @factory/ff-pipeline typecheck 2>&1 || true) | |
| own_errors=$(echo "$output" | grep "error TS" | grep -v "gdk-agent\|gdk-ai\|artifact-validator\|ontology-loader" | wc -l) | |
| if [ "$own_errors" -gt 0 ]; then | |
| echo "$output" | grep "error TS" | grep -v "gdk-agent\|gdk-ai\|artifact-validator\|ontology-loader" | |
| echo "" | |
| echo "FAIL: $own_errors type error(s) in ff-pipeline's own code" | |
| exit 1 | |
| fi | |
| echo "OK: 0 type errors in ff-pipeline's own code (dependency package errors excluded)" | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Run all tests | |
| run: pnpm -r --if-present test | |
| repository-audit: | |
| name: Repository Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Audit documentation references | |
| run: pnpm audit:docs | |
| - name: Audit ontology compatibility | |
| run: pnpm audit:ontology | |
| factory-pr-check: | |
| name: Factory PR Gate | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'factory-generated') | |
| needs: [typecheck, test, repository-audit] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Fidelity VR check (INV-13) | |
| run: pnpm --filter @factory/ff-pipeline fidelity:check | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Guard infra configs from agent mutation | |
| run: | | |
| changed=$(git diff --name-only origin/main...HEAD | \ | |
| grep -E '(wrangler\.jsonc|CLAUDE\.md|AGENTS\.md|\.github/)' || true) | |
| [ -z "$changed" ] || { echo "BLOCKED: agent PR modified protected files:"; echo "$changed"; exit 1; } | |
| singleton-rotation-check: | |
| name: Singleton Rotation Check (INV-11) | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| needs: [typecheck] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check supervisor singleton suffix incremented on image change | |
| run: | | |
| IMAGE_CHANGED=$(git diff --name-only origin/main...HEAD | \ | |
| grep -E '(workers/gascity-supervisor/Dockerfile|workers/gascity-supervisor/gc-linux-amd64)' || true) | |
| if [ -z "$IMAGE_CHANGED" ]; then | |
| echo "No container image change — rotation check skipped." | |
| exit 0 | |
| fi | |
| echo "Image changed: $IMAGE_CHANGED" | |
| NEW_SUFFIX=$(grep -oE 'singleton-v[0-9]+' workers/gascity-supervisor/src/index.ts | head -1) | |
| OLD_SUFFIX=$(git show origin/main:workers/gascity-supervisor/src/index.ts | grep -oE 'singleton-v[0-9]+' | head -1) | |
| echo "main: $OLD_SUFFIX branch: $NEW_SUFFIX" | |
| if [ "$NEW_SUFFIX" = "$OLD_SUFFIX" ]; then | |
| echo "FAIL: image changed but singleton suffix not rotated." | |
| echo "Fix: increment SUPERVISOR_SINGLETON in gascity-supervisor/src/index.ts" | |
| exit 1 | |
| fi | |
| echo "OK: $OLD_SUFFIX → $NEW_SUFFIX" |