feat(autonomy): deterministic prerequisite resolver (#2724)

plugins/autonomy/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "autonomy",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Governed autonomous agent operation: role-topology, binding-seam, wiring-vs-advisor, telemetry, return-accounting, trigger-dispatch, per-work-class guardrail-matrix, standing-routine-catalog, and design-only runner-charter contracts for climbing the AI-adoption ladder, plus a guided-setup skill that discovers an adopting org's state, writes its schema-versioned binding, wires standards-pinned OTLP emission with a zero-cost file-artifact default, wires human-attested return capture at the task boundary, wires signal adapters with one governed dispatch entrypoint, binds the five-class guardrail matrix to an org's isolation substrates with an in-boundary live-validation probe before recording each fail-closed binding, and stands up standing-routine-catalog classes as scheduled temporal signal adapters behind the one governed queue with free scheduling defaults wired as reviewable changes and each routine's work-class mapping homed on the security surface.",
   "author": {
     "name": "Melodic Software",

plugins/autonomy/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to the `autonomy` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.21.0]
+
+### Added
+
+- **Deterministic prerequisite resolver** (#2724).
+  `skills/setup/scripts/resolve-prerequisites.mjs` resolves the verdict set for every
+  `v1` identity on a named scheduling surface, reading
+  `generated/identity-prerequisites.json` (never leaf prose). Repo-file and
+  harness-context probes compose `.claude/autonomy/binding.json` declarations,
+  `.claude/ecosystems/*.yaml` (resolved / `enabled: false` not configured),
+  `.work-item-tracker.json` + adapter `capabilities.json`, and `.mcp.json`
+  (presence vs enablement). Precedence follows ADR 0011 Decision 2: declaration
+  narrows; a ran-negative probe caps declarations (contradiction finding);
+  unprobeable stays distinct from absent. Output is wall-clock-free (byte-identical
+  consecutive runs). Liveness: engine health-check taxonomy row, fail-loud.
+  Seven graded fixtures under `skills/setup/scripts/fixtures/prerequisite-resolution/` with
+  co-located `*.test.sh` + manifest.
+
 ## [0.20.0]
 
 ### Added

plugins/autonomy/README.md

@@ -50,7 +50,8 @@ state and records that binding.
   which catalog identities can run against a repository, composing owning seams rather than a new
   prober — with `deferred-class` marking `join:` rows that have no identities yet. Per-identity
   facts live in each `v1` leaf; `generated/identity-prerequisites.json` is the drift-gated
-  emission derived from those leaves (generator under `skills/setup/scripts/`).
+  emission derived from those leaves (generator under `skills/setup/scripts/`);
+  `skills/setup/scripts/resolve-prerequisites.mjs` is the deterministic per-surface resolver.
 - **Runner design pack** (`reference/runner.md`): the architect-ready design contract for the
   autonomous-drain runner — the composition spine and its eight seams, the lifecycle state
   model, the two-family stop-criteria taxonomy with terminal-handoff escalation and

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/declared-absent-narrows/repo/.claude/autonomy/binding.json

@@ -0,0 +1,15 @@
+{
+  "schema_version": "1.0",
+  "prerequisite_resolution": {
+    "schema_version": "1.0",
+    "declarations": [
+      {
+        "surface": "ci-cron",
+        "identity": "issue-triage-sweep",
+        "need": "tracker",
+        "state": "absent",
+        "rung": "repo-local"
+      }
+    ]
+  }
+}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/declared-absent-narrows/repo/.work-item-tracker.json

@@ -0,0 +1 @@
+{"provider":"github"}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/declared-absent-narrows/repo/tools/work-item-tracker/adapters/github/capabilities.json

@@ -0,0 +1 @@
+{"verbs":["create-item"]}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/fail-closed/repo/src/index.js

@@ -0,0 +1 @@
+console.log(1)

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/positive-verdict/repo/.claude/autonomy/binding.json

@@ -0,0 +1,31 @@
+{
+  "schema_version": "1.0",
+  "triggers": {
+    "surfaces": {
+      "ci-cron": {
+        "class": "temporal",
+        "transport": "poll",
+        "scheduler_class": "ci-cron",
+        "execution_surface": "github-actions",
+        "merge_policy_capable": true
+      }
+    }
+  },
+  "prerequisite_resolution": {
+    "schema_version": "1.0",
+    "declarations": [
+      {
+        "surface": "ci-cron",
+        "need": "advisory_database",
+        "state": "present",
+        "rung": "repo-local"
+      },
+      {
+        "surface": "ci-cron",
+        "need": "upstream_changelog",
+        "state": "present",
+        "rung": "repo-local"
+      }
+    ]
+  }
+}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/positive-verdict/repo/.claude/ecosystems/typescript.yaml

@@ -0,0 +1,2 @@
+enabled: true
+globs: ["**/*.ts"]

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/positive-verdict/repo/.github/workflows/ci.yml

@@ -0,0 +1 @@
+name: ci

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/positive-verdict/repo/.work-item-tracker.json

@@ -0,0 +1 @@
+{"provider":"github"}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/positive-verdict/repo/docs/README.md

@@ -0,0 +1 @@
+# Docs

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/positive-verdict/repo/package.json

@@ -0,0 +1 @@
+{"name":"app","version":"1.0.0"}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/positive-verdict/repo/src/main.ts

@@ -0,0 +1 @@
+code

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/positive-verdict/repo/tools/work-item-tracker/adapters/github/capabilities.json

@@ -0,0 +1 @@
+{"verbs":["create-item"]}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/posture-divergence/repo/.claude/ecosystems/typescript.yaml

@@ -0,0 +1,2 @@
+enabled: true
+globs: ["**/*"]

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/posture-divergence/repo/.github/workflows/ci.yml

@@ -0,0 +1 @@
+name: ci

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/posture-divergence/repo/.work-item-tracker.json

@@ -0,0 +1 @@
+{"provider":"github"}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/posture-divergence/repo/package.json

@@ -0,0 +1 @@
+{"name":"app"}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/posture-divergence/repo/tools/work-item-tracker/adapters/github/capabilities.json

@@ -0,0 +1 @@
+{"verbs":["create-item"]}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/probe-could-not-run/repo/.claude/autonomy/binding.json

@@ -0,0 +1,15 @@
+{
+  "schema_version": "1.0",
+  "prerequisite_resolution": {
+    "schema_version": "1.0",
+    "declarations": [
+      {
+        "surface": "ci-cron",
+        "identity": "advisory-cve-triage",
+        "need": "advisory_database",
+        "state": "present",
+        "rung": "repo-local"
+      }
+    ]
+  }
+}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/probe-could-not-run/repo/.github/workflows/ci.yml

@@ -0,0 +1 @@
+name: ci

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/probe-could-not-run/repo/.work-item-tracker.json

@@ -0,0 +1 @@
+{"provider":"github"}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/probe-could-not-run/repo/package.json

@@ -0,0 +1 @@
+{"name":"app"}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/probe-could-not-run/repo/tools/work-item-tracker/adapters/github/capabilities.json

@@ -0,0 +1 @@
+{"verbs":["create-item"]}

plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/probe-negative-caps/repo/.claude/autonomy/binding.json

@@ -0,0 +1,15 @@
+{
+  "schema_version": "1.0",
+  "prerequisite_resolution": {
+    "schema_version": "1.0",
+    "declarations": [
+      {
+        "surface": "ci-cron",
+        "identity": "issue-triage-sweep",
+        "need": "tracker",
+        "state": "present",
+        "rung": "repo-local"
+      }
+    ]
+  }
+}

plugins/autonomy/skills/setup/scripts/resolve-prerequisites.fixtures.test.manifest.json

@@ -0,0 +1,33 @@
+{
+  "_comment": "Graded-fixture manifest for resolve-prerequisites.fixtures.test.mjs. Each key is a fixture directory under scripts/fixtures/prerequisite-resolution/. Assertions name identities and expected verdict substrings / finding kinds.",
+  "fixtures": {
+    "bare-repo": {
+      "surface": "ci-cron",
+      "assert": "bare-repo"
+    },
+    "fail-closed": {
+      "surface": "ci-cron",
+      "assert": "fail-closed"
+    },
+    "declared-absent-narrows": {
+      "surface": "ci-cron",
+      "assert": "declared-absent-narrows"
+    },
+    "probe-negative-caps": {
+      "surface": "ci-cron",
+      "assert": "probe-negative-caps"
+    },
+    "probe-could-not-run": {
+      "surface": "ci-cron",
+      "assert": "probe-could-not-run"
+    },
+    "posture-divergence": {
+      "surface": "ci-cron",
+      "assert": "posture-divergence"
+    },
+    "positive-verdict": {
+      "surface": "ci-cron",
+      "assert": "positive-verdict"
+    }
+  }
+}