feat(autonomous-release): add deterministic governed planner

2026-07-26 04:02:27 +08:00
parent a1e67103ce
commit e36e31ef26
1 changed files with 75 additions and 0 deletions
@@ -0,0 +1,75 @@
+"""Deterministic task planning for autonomous candidate releases."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from .models import ResourceBinding, RiskClass, TaskPlan, WorkflowStep
+
+
+@dataclass(frozen=True, slots=True)
+class PlanningRequest:
+    task_id: str
+    intent: str
+    binding: ResourceBinding
+    risk: RiskClass = RiskClass.MEDIUM
+
+
+class DeterministicPlanner:
+    """Create a fixed governed DAG without granting production capabilities."""
+
+    def build(self, request: PlanningRequest) -> TaskPlan:
+        steps = (
+            WorkflowStep(
+                step_id="architecture-review",
+                worker_role="hermes-review",
+                required_capabilities=("architecture.review", "risk.analysis"),
+                allowed_paths=request.binding.allowed_paths,
+            ),
+            WorkflowStep(
+                step_id="implementation",
+                worker_role="dedicated-writer",
+                required_capabilities=("commit_file.atomic", "git.push.patch_branch"),
+                depends_on=("architecture-review",),
+                max_attempts=2,
+                allowed_paths=request.binding.allowed_paths,
+            ),
+            WorkflowStep(
+                step_id="code-review",
+                worker_role="codex-review",
+                required_capabilities=("code.review", "git.diff.read"),
+                depends_on=("implementation",),
+                allowed_paths=request.binding.allowed_paths,
+            ),
+            WorkflowStep(
+                step_id="validation",
+                worker_role="openclaw-shadow",
+                required_capabilities=("test.execute", "artifact.verify"),
+                depends_on=("code-review",),
+                max_attempts=2,
+                allowed_paths=request.binding.allowed_paths,
+            ),
+            WorkflowStep(
+                step_id="evidence-finalize",
+                worker_role="evidence-controller",
+                required_capabilities=("evidence.finalize",),
+                depends_on=("validation",),
+                allowed_paths=request.binding.allowed_paths,
+            ),
+        )
+        return TaskPlan(
+            task_id=request.task_id,
+            intent=request.intent,
+            binding=request.binding,
+            risk=request.risk,
+            steps=steps,
+            evidence_requirements=(
+                "git-ref-closure",
+                "test-report",
+                "secret-scan",
+                "artifact-manifest",
+                "credential-revocation",
+                "production-invariants",
+            ),
+            production_side_effects_allowed=False,
+        )