feat(autonomy): generated identity-and-prerequisite emission with drift gate (#2723)

[kyle-sexton]

Closes #2723

Summary

Phase 3 of the routine-capability-detection plan (ADR 0011): a machine-readable identity-and-prerequisite emission derived from the ten v1 leaves, with a --check drift gate matching the catalog generator pattern.

Fix

• Generator skills/setup/scripts/generate-identity-prerequisites.mjs — parses each leaf ## Prerequisites section into structured records (Access class, isolation floor, connector entitlements + rung, probe-classed needs).
• Emission generated/identity-prerequisites.json — 13 identities; leaves stay the authored single home.
• --check drift gate wired through scripts/validate-plugins.sh.
• Co-located test + manifest — clean check, hand-edited drift fixture, leaf↔emission parity, posture divergence (dependency-update-wave L2 vs L3).
• Version bump to 0.20.0 with CHANGELOG + README pointer.

Verification

$ node plugins/autonomy/skills/setup/scripts/generate-identity-prerequisites.mjs --check
$ bash plugins/autonomy/skills/setup/scripts/generate-identity-prerequisites.test.sh
$ bash scripts/check-changelog-parity.sh --check-bump origin/main
$ bash scripts/check-orphaned-fixtures.sh --check

Related

• ADR 0011; Refs spike: per-repo routine capability detection — promote to its own topic #2685; depends on feat(autonomy): per-identity prerequisite sections in the ten v1 routine leaves #2718 (merged)

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 1m 2s —— View job

---

Security review

Task list

• Gather context (PR diff, changed files)
• Run /review:security-review per custom instructions
• Post findings

Reviewed the full diff (git diff origin/main...HEAD) against the criteria in plugins/review/skills/security-review/SKILL.md.

Skip gate hit: no security-relevant surface.

This PR adds a build-time code generator (generate-identity-prerequisites.mjs) that:

• Reads markdown leaves from the repo's own reference/routines/ tree (trusted, repo-authored content — not user/PR input).
• Parses them with regex into structured JSON, writes to generated/identity-prerequisites.json.
• Has no child_process/exec/shell-out calls, no network I/O, no secrets/credentials handling, and no auth/access-control logic.
• Wires a --check drift gate into scripts/validate-plugins.sh (a local shell script, not a GitHub Actions workflow — no .github/workflows/* files changed, no permissions: widening, no pull_request_target/workflow_run involved).

The co-located test harness (generate-identity-prerequisites.test.sh) only operates on mktemp -d throwaway trees with static heredoc fixtures — no untrusted input reaches it.

Remaining changes (plugin.json version bump, CHANGELOG.md, README.md) are docs/metadata only.

No CRITICAL/IMPORTANT/SUGGESTION security findings to report.

[github-actions]

Last security-reviewed head: 9641be9abe0ce3cb5b5f486dc393a0cf8dd9552e. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9641be9abe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 31s —— View job

---

Code Review Complete

• Gather context (PR diff, CLAUDE.md, REVIEW.md)
• Review skip-gate checks — PR is open, not draft, has real review surface
• Review generator script (generate-identity-prerequisites.mjs)
• Review generated emission (identity-prerequisites.json)
• Review test + manifest
• Review scripts/validate-plugins.sh wiring
• Review CHANGELOG/README/version bump
• Post findings

Scope note: .github/workflows/claude-security-review.yml exists in this repo, so this lane (code-review) stays out of security scope per REVIEW.md; no security findings are reported here.

Verification note: this lane's Bash access is restricted to gh pr diff/view/comment/review, Read, Glob, Grep — I could not execute node generate-identity-prerequisites.mjs --check or the .test.sh harness myself. The PR description's verification commands/output are author-claimed and unverified by me.

What I checked

I cross-checked the generator's NEED_PATTERNS regex table and axis-extraction logic (plugins/autonomy/skills/setup/scripts/generate-identity-prerequisites.mjs) against the ## Prerequisites prose in all 10 v1 leaves under plugins/autonomy/reference/routines/, and diffed the derived fields against every one of the 13 records in generated/identity-prerequisites.json:

• Access class / isolation floor / connector entitlements / connector entitlement rung / executor_class merge cap — all match the cited leaf axis-table values, including the two-posture divergence cases (ci-health-review, doc-freshness-sweep, dependency-update-wave).
• needs derivation, including inheritance (everything \X` requires) for ci-health-review/ci-config-change, doc-freshness-sweep/docs-change, and dependency-update-wave/changelog-informed` — correctly unions parent + own needs and dedupes by id.
• The dependency-update-wave L2 (mechanical) vs L3 (changelog-informed) posture divergence called out in the test manifest checks out against the leaf's isolation-floor citations.
• owner: "resolution-contract" on the ci_config need is consistent leaf vocabulary ("ownerless … probe owned by the resolution contract"), not a generator inconsistency.
• scripts/validate-plugins.sh wiring (generate-identity-prerequisites.mjs --check) is placed correctly alongside the other --check gates and runs from repo root, which the script tolerates since it locates its own root via import.meta.url rather than cwd.
• Version bump (0.19.0 → 0.20.0), CHANGELOG entry, and README pointer are consistent with the change.

No correctness, maintainability, or drift-gate issues found — the regex-based extraction is a reasonable, testable approach for this narrow parsing problem, and the derived output for every leaf I checked was accurate against current leaf prose.

One low-value observation not rising to a blocking finding: the --check error-path emissionLabel computed in main() (generate-identity-prerequisites.mjs#L730-L735) assumes the plugin root sits exactly two directories below the repo root for the no---root path — cosmetic only (affects the printed path in an error message, not the actual file read/write path or exit code), so not flagged as a finding.

[github-actions]

Claude has reviewed this PR 2 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @cursor[bot]'s task in 51s —— View job

---

Code Review — Skipped

• Gather context (PR diff, changed files)
• Invoke /review:code-review per custom instructions
• Post findings

Skip gate hit: PR is closed/merged.

Per plugins/review/skills/code-review/SKILL.md's skip gate ("PR is closed or not open" → stop early, post nothing else): PR #2793 is already MERGED. Confirmed locally — git diff origin/main...HEAD is empty (this branch's changes are already in main as of 058ef19), so there is no outstanding diff for this lane to review. No inline comments posted.

For reference, this PR already received both a security review (no findings — no security-relevant surface) and a full code-review pass (no correctness/maintainability findings; two P2 hardening suggestions from Codex on the generator's regex-based needs parsing were acknowledged by the author as intentional follow-up work, not blockers) prior to merge — see the earlier comments and reviews on this thread.