🏭 Integrate GitHub Actions and prove the factory end to end

[minkimcello]

Parent: #633

Architecture ancestry: PR #630

Planning base: 0479b3b1e6a3de08fb7d9de515a3efde80e7fe91; implementation base is the exact accepted L10 feedback commit containing C0–L10

Stack position: E11, final integration and delivery story; completion permits #633 to close

Readiness: static workflow work is blocked until accepted F1/F2 contracts are recorded; integration feedback is blocked until exact L10 and current origin/main SHAs are recorded; no workflow authority, supply-chain, reconciliation, or acceptance choice is delegated

Purpose and observable outcome

A least-privilege GitHub Actions invocation composes the immutable authored factory and accepted providers, the complete stack is reconciled explicitly with then-current main, and end-to-end evidence proves one issue can iterate, invalidate, suspend, resume, merge or abandon, and replay one durable run without widened authority or a second controller.

Authoritative behavior

• The workflow responds only to repository_dispatch, receives one retained intake identity, authenticates to F1 with OIDC, and invokes the settled XMD start/answer/resume path.
• Every action is pinned by full commit SHA. Job permissions are only Contents read and id-token: write; GITHUB_TOKEN performs no factory mutation.
• The workflow checks out the immutable factory definition SHA separately from authorized implementation repository state and obtains the trusted xmd binary through one documented supply-chain path.
• Actions concurrency reduces duplicates but is not correctness or executor authority. YAML contains no role output parsing, transition, handoff, evidence command, PR/Project mutation, merge, or closure logic.
• The stack preserves 🏭 Specify the GitHub Actions-hosted AI software factory #630 ancestry and every accepted feedback commit. Reconciliation with main is one explicit integration merge/restack event with reported overlap and affected-evidence reruns, not silent drift imported into children.
• 🏭 Build the GitHub Actions-hosted AI software factory #633 closes only after this story's frozen end-to-end matrix passes at one exact feedback commit; CI remains the separate delivery gate.

Current state

The accepted L10 ancestry supplies all provider capabilities and authored lifecycle components. The repository has CI workflow invariants and immutable bundle/build machinery, but no factory dispatch workflow, deployment configuration, trusted binary path for this automation, whole-factory fixture, or stack-to-main reconciliation. At planning time the stack root merge base was 0e88e910a19e5acb2f1e43839efc382c5b11880a and origin/main was 1721c0672334f23c93290de35b7a5548e260fa98, already 33 commits ahead; E11 must recompute this state rather than trust those numbers.

Affected modules and public contracts

• Add the factory operational workflow under .github/workflows/ with static regression coverage in scripts/tests/ci-workflow.test.ts or a dedicated scripts/tests/software-factory-workflow.test.ts.
• Add deployment/configuration templates for the Cloudflare host and GitHub App with no secrets, plus operator documentation for App installation, organization Project/field/options, target ruleset, OIDC trust, target/implementation branches, and immutable definition/binary identities.
• Complete workflows/github-actions-software-factory/Factory.md bundle integration and add whole-system fixtures under explicit packages/workflow/tests/ and packages/cli/tests/ files.
• Update architecture.md, factory/workflow specifications, and construct inventory only to reflect the delivered integrated behavior; no new structural decision is introduced here.
• Reconcile stack code/specs/tests with then-current origin/main, preserving accepted feedback heads as ancestors and adopting current public seams rather than reviving superseded interfaces.

Ordered implementation plan

1. Record exact L10 base, fetch current origin/main, compute merge base and overlapping paths/contracts, and publish the reconciliation list in the issue/PR before changing code.
2. Merge current origin/main into the E11 integration branch without rewriting accepted feedback commits; resolve overlaps according to C0 and rerun every affected story's focused matrix.
3. Add the pinned least-privilege dispatch workflow and static assertions for trigger, permissions, action SHAs, immutable definition checkout, bounded inputs, concurrency, and absence of factory logic.
4. Add secret-free Cloudflare/GitHub App/Project/ruleset configuration templates and actionable operator documentation; runtime startup validates exact configured identities/ceilings.
5. Compose the complete immutable factory bundle and provider assembly, then add a deterministic local/Workers/GitHub-fixture harness covering the real runtime and subprocess boundaries.
6. Execute the end-to-end scenarios below, render normalized operator output, and capture the exact feedback commit/evidence.
7. Run delivery verification separately; update green.needs only if repository policy makes this operational workflow a required CI job, otherwise document why it is not a PR check.

Failure, cancellation, teardown, and replay

Invalid workflow event/input/OIDC, mutable definition, untrusted binary, unconfigured deployment identity, under-scoped target ruleset, provider unavailability, concurrent runner, process/Agent/Git/GitHub failure, stale revision, moved target, and malformed retained state follow the accepted child contracts and fail without YAML choosing a recovery transition. Job cancellation propagates through XMD scopes and connection ownership. External work already performed reconciles from retained intent. Completed replay contacts no provider. A failed main reconciliation is repaired on E11; it does not rewrite accepted child history.

Frozen end-to-end evidence matrix

• Duplicate authorized admission and multiple Stage 4 revisions retain exactly one run ID/lifecycle.
• Valid execution records all adjacent stages; every skipped stage refuses before projection.
• Same-stage iteration and backward invalidation to Stages 1–6 preserve history and replace exactly the active frontier.
• Issue/PR record boundary and cross-links match the contract across backward/forward crossings.
• Project-behind reconciles; Project-ahead cannot authorize progress.
• Two concurrent jobs overlap, one executor advances, owner death leaves committed state only, and another resumes without a timer.
• Agent/generated-XMD/Actions/App/provider permission ceilings refuse every protected out-of-scope authority.
• Clean synchronization, every-conflict suspension, manual resolution, evidence, non-force Push, exact review, readiness, change, target race, merge, and abandonment follow their accepted contracts.
• Kill after every durable external-effect boundary produces one compatible reconciled result and no duplicate.
• Definition mutation on the implementation branch cannot change the immutable definition used by the existing run.
• Completed replay reproduces output/terminal state with no Workspace, Agent, process, Git, GitHub, or Project attachment.
• Static workflow evidence proves pinned actions, exact permissions, bounded dispatch, no mutation GITHUB_TOKEN, and no second controller/evidence list.
• Main reconciliation preserves C0–L10 accepted heads as ancestors, resolves all overlapping current contracts, and reruns every affected frozen story matrix.
• Normalized output explains completed actions and actionable refusals without exposing machinery, credentials, payloads, or host paths.

Focused feedback evidence

Add explicit files such as packages/workflow/tests/software-factory-e2e.test.ts, software-factory-recovery.test.ts, packages/cli/tests/software-factory-cli.test.ts, and scripts/tests/software-factory-workflow.test.ts. Run these exact files, every child-story focused test affected by the main reconciliation, and deno task test --changed=origin/main. Render and read normalized output. Commit as soon as this matrix passes and report the exact E11 feedback SHA, recorded L10/main SHAs, overlap list, and every command.

Delivery verification

Because the stack adds runtime adapters and cross-boundary test setup, run deno task lint, deno task check, the complete Deno suite with deno task test, and deno task check:jsr. Run the relevant Node/Bun focused tests when public portable surfaces change; required CI owns their exhaustive matrices. Run deno task verify:clean from a committed revision if any child changed dependency layout, release/build inputs, generated artifacts, cache purity, or shared-state interference. Required CI and branch protection remain authoritative for merge and are not part of the feedback verdict.

Exclusions

No new lifecycle/provider/identity/permission/persistence policy, dynamic action tag, mutable factory definition, production secret, PAT, mutation GITHUB_TOKEN, Actions-owned evidence or transition, artifact-backed live state, timed executor lease, automatic conflict mutation, history rewrite, or closure of #633 before the exact feedback matrix passes.

Risks and recovery

Main drift may overlap workflow composition and public APIs. Preserve accepted story commits and resolve the integration in E11; if current main proves a settled structural contract obsolete, stop and return to C0/Architect rather than choosing inside integration. Production deployment also requires an operator-controlled Cloudflare account, GitHub App installation, organization Project configuration, OIDC trust, and target ruleset; missing real credentials block deployment, not deterministic fixture evidence.

Handoff

Record the exact L10 SHA and then-current origin/main SHA before implementation. Complete reconciliation, integration, and the frozen matrix at one feedback commit. Return that exact SHA with all focused commands and normalized-output review. After architecture/planning feedback passes, delivery verification and required CI proceed separately; #633 closes only when the integrated outcome is accepted.