OpenSIN-AI · dependabot · May 3, 2026 · Jun 4, 2026 · Jun 8, 2026
diff --git a/.github/workflows/ceo-audit.yml b/.github/workflows/ceo-audit.yml
@@ -0,0 +1,226 @@
+# Purpose: CEO Audit — SOTA repository review (47 gates, 8 axes)
+# Docs: https://github.com/OpenSIN-Code/SIN-Code-Bundle/tree/main/src/sin_code_bundle/skills/ceo-audit
+#
+# Runs the full CEO Audit on every push and PR. Posts a Markdown
+# comment on the PR with the grade, top 3 risks, and a link to the
+# full report. Fails if grade < B (configurable via --grade flag).
+#
+# Required secrets: none (uses built-in GITHUB_TOKEN)
+# Optional inputs: profile (default: QUICK), grade (default: B)
+
+name: ceo-audit
+
+on:
+  # NUR main/master (Branches sind verboten — siehe globale AGENTS.md).
+  # PRs sind weiterhin willkommen (last line of defense wenn doch einer entsteht).
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: 'Audit profile: QUICK | RELEASE | SECURITY | FULL'
+        required: false
+        default: 'QUICK'
+      grade:
+        description: 'Minimum grade to pass: A | B | C'
+        required: false
+        default: 'B'
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+
+jobs:
+  ceo-audit:
+    name: CEO Audit (${{ inputs.profile || 'QUICK' }}, grade≥${{ inputs.grade || 'B' }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      AUDIT_PROFILE: ${{ inputs.profile || 'QUICK' }}
+      AUDIT_GRADE: ${{ inputs.grade || 'B' }}
+      AUDIT_REPO: ${{ github.workspace }}
+      AUDIT_RUN_ID: ${{ github.run_id }}
+      AUDIT_SHA: ${{ github.sha }}
+      CEO_AUDIT_OUTPUT: ${{ github.workspace }}/ceo-audit-output
+      # The bundle's audit.sh defaults to $HOME/ceo-audits; we override to
+      # match the workflow's expected ceo-audit-output/ path so score.json
+      # lands where the next steps (upload-sarif, comment) expect it.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0  # full history for regression detection
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Install SIN-Code Bundle (with ceo-audit skill)
+        # Try PyPI first, fall back to GitHub (bundle is not yet on PyPI).
+        # Once published: pip install "sin-code-bundle[ceo-audit,dev]"
+        run: |
+          pip install "sin-code-bundle[ceo-audit,dev]" || \
+            pip install "sin-code-bundle[ceo-audit,dev] @ git+https://github.com/OpenSIN-Code/SIN-Code-Bundle.git@v0.4.4"
+
+      - name: Install ceo-audit skill
+        run: |
+          # sin-code-bundle does not yet ship the skill scripts.
+          # Clone the SSOT (Infra-SIN-OpenCode-Stack) to get audit.sh + axis scripts.
+          git clone --depth 1 --branch main https://github.com/OpenSIN-Code/Infra-SIN-OpenCode-Stack.git ${{ github.workspace }}/infra
+          mkdir -p ~/.config/opencode/skills/ceo-audit
+          cp -r ${{ github.workspace }}/infra/skills/ceo-audit/scripts ~/.config/opencode/skills/ceo-audit/
+          cp -r ${{ github.workspace }}/infra/skills/ceo-audit/lib ~/.config/opencode/skills/ceo-audit/
+          chmod +x ~/.config/opencode/skills/ceo-audit/scripts/audit.sh
+          ls ~/.config/opencode/skills/ceo-audit/scripts/audit.sh
+
+      - name: Locate audit.sh on PATH
+        id: locate
+        run: |
+          # After 'pip install sin-code-bundle[ceo-audit,dev]', audit.sh is
+          # shipped at <site-packages>/sin_code_bundle/resources/ceo-audit/scripts/audit.sh.
+          # We also accept a git-clone of the skill to ~/.config/opencode/skills/.
+          SITE_PKG_SCRIPT=$(python3 -c "import sin_code_bundle, os; root=os.path.dirname(sin_code_bundle.__file__); p=os.path.join(root,'resources','ceo-audit','scripts','audit.sh'); print(p if os.path.isfile(p) else '')" 2>/dev/null)
+          if [ -n "$SITE_PKG_SCRIPT" ] && [ -f "$SITE_PKG_SCRIPT" ]; then
+            echo "script=$SITE_PKG_SCRIPT" >> $GITHUB_OUTPUT
+          elif [ -f ~/.config/opencode/skills/ceo-audit/scripts/audit.sh ]; then
+            echo "script=~/.config/opencode/skills/ceo-audit/scripts/audit.sh" >> $GITHUB_OUTPUT
+          else
+            echo '::error::Could not locate audit.sh (not in site-packages, not on disk)'
+            exit 1
+          fi
+          echo "Located audit script: $SITE_PKG_SCRIPT"
+
+      - name: Run CEO Audit
+        id: audit
+        run: |
+          mkdir -p ceo-audit-output
+          # Run audit; capture exit code (allow failure so we can still post the report)
+          set +e
+          ${{ steps.locate.outputs.script }} \
+            "$AUDIT_REPO" \
+            --profile="$AUDIT_PROFILE" \
+            --grade="$AUDIT_GRADE" \
+            --output="$AUDIT_REPO/ceo-audit-output" \
+            --json 2>&1 | tee ceo-audit-output/console.log
+          AUDIT_EXIT=$?
+          set -e
+          echo "audit_exit_code=$AUDIT_EXIT" >> $GITHUB_OUTPUT
+          # Don't fail the step yet — we want to always upload the report + post the comment
+
+      - name: Upload audit artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ceo-audit-${{ github.run_id }}
+          path: ceo-audit-output/
+          retention-days: 30
+          if-no-files-found: warn
+
+      - name: Extract grade from score.json
+        id: grade
+        if: always()
+        run: |
+          SCORE_FILE=$(find ceo-audit-output -name 'score.json' | head -1)
+          if [ -z "$SCORE_FILE" ]; then
+            echo "::error::CEO Audit did not produce score.json"
+            echo "grade=unknown" >> $GITHUB_OUTPUT
+            echo "score=0" >> $GITHUB_OUTPUT
+            echo "verdict=Audit failed" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          GRADE=$(jq -r '.grade // "?"' "$SCORE_FILE")
+          SCORE=$(jq -r '.score // 0' "$SCORE_FILE")
+          CRITICAL=$(jq -r '.critical // 0' "$SCORE_FILE")
+          HIGH=$(jq -r '.high // 0' "$SCORE_FILE")
+          echo "grade=$GRADE" >> $GITHUB_OUTPUT
+          echo "score=$SCORE" >> $GITHUB_OUTPUT
+          echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
+          echo "high=$HIGH" >> $GITHUB_OUTPUT
+          echo "::notice::CEO Audit: $GRADE ($SCORE/100) | critical=$CRITICAL high=$HIGH"
+
+      - name: Post PR comment
+        if: github.event_name == 'pull_request' && always()
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          header: ceo-audit
+          message: |
+            ## 🏆 CEO Audit — ${{ steps.grade.outputs.grade || '?' }} (${{ steps.grade.outputs.score || '0' }}/100)
+
+            | Metric | Value |
+            |--------|-------|
+            | **Grade** | **${{ steps.grade.outputs.grade || '?' }}** |
+            | **Score** | **${{ steps.grade.outputs.score || '0' }}/100** |
+            | **Critical findings** | ${{ steps.grade.outputs.critical || '0' }} |
+            | **High findings** | ${{ steps.grade.outputs.high || '0' }} |
+            | **Profile** | `${{ env.AUDIT_PROFILE }}` |
+            | **Min grade gate** | ${{ env.AUDIT_GRADE }} |
+
+            📥 [Download full report (Markdown)](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}#artifacts)
+            📊 [Download SARIF (for Code Scanning)](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}#artifacts)
+
+            > Run `${{ env.AUDIT_PROFILE == 'FULL' && '~/.config/opencode/skills/ceo-audit/scripts/audit.sh . --profile=FULL' || '~/.config/opencode/skills/ceo-audit/scripts/audit.sh . --profile=QUICK' }}` locally to reproduce.
+
+      - name: Post official audit comment (SIN-GitHub-Issues App)
+        if: github.event_name == 'pull_request' && always()
+        # Token resolution chain (highest priority first):
+        #   1. SIN_GITHUB_INSTALLATION_TOKEN (org secret, App identity, public repos only)
+        #   2. SIN_GITHUB_FALLBACK_TOKEN (repo secret, PAT — works on ALL repos incl. private)
+        #   3. GITHUB_TOKEN (built-in, Action identity, always present)
+        # Resolution happens inside post_audit_pr.py via github_app.get_token().
+        # If ALL tokens are missing, the step fails but continue-on-error prevents
+        # the workflow from blocking on App issues.
+        continue-on-error: true
+        env:
+          PYTHONPATH: ${{ github.workspace }}/infra/skills/ceo-audit/lib
+          SIN_GITHUB_APP_CLIENT_ID: Iv23livllaHIBTdQdyhY
+          # Chain of GitHub tokens (post_audit_pr.py picks the first available).
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SIN_GITHUB_FALLBACK_TOKEN: ${{ secrets.SIN_GITHUB_FALLBACK_TOKEN }}
+        run: |
+          # post_audit_pr.py lives in the cloned Infra repo (see 'Install ceo-audit skill' step)
+          # score.json is written by audit.sh to ~/ceo-audits/<repo>-ceo-audit-<runid>/score.json
+          # We search both ceo-audit-output/ and ~/ceo-audits/ to be robust.
+          SCORE_FILE=$(find $HOME/ceo-audits ceo-audit-output -name 'score.json' 2>/dev/null | head -1)
+          if [ -z "$SCORE_FILE" ]; then
+            echo "::warning::No score.json found — skipping App commenter (Action comment above still posts)"
+            exit 0
+          fi
+          echo "Using score.json: $SCORE_FILE"
+          python3 ${{ github.workspace }}/infra/skills/ceo-audit/scripts/post_audit_pr.py \
+            --repo ${{ github.repository }} \
+            --pr ${{ github.event.pull_request.number }} \
+            --score-json "$SCORE_FILE" \
+            --artifact-url ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} \
+            --run-id ${{ github.run_id }}
+
+      - name: Fail if grade below gate
+        if: github.event_name == 'pull_request'
+        run: |
+          GRADE="${{ steps.grade.outputs.grade }}"
+          GRADE_NUM="${{ steps.grade.outputs.score }}"
+          GATE="${{ env.AUDIT_GRADE }}"
+          case "$GATE" in
+            A) MIN=85 ;;
+            B) MIN=70 ;;
+            C) MIN=55 ;;
+            *) MIN=0 ;;
+          esac
+          # Allow only A and B by default
+          if (( $(echo "$GRADE_NUM < $MIN" | bc -l) )); then
+            echo "::error::Grade $GRADE ($GRADE_NUM) below gate $GATE (need ≥$MIN)"
+            exit 1
+          fi
+          echo "::notice::Grade gate passed: $GRADE ($GRADE_NUM) ≥ $GATE ($MIN)"
+
+      - name: Upload SARIF to Code Scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: ${{ github.workspace }}/ceo-audit-output/report.sarif
+          category: ceo-audit
+        continue-on-error: true
diff --git a/docs/03_ops/recursive-mas-integration.md b/docs/03_ops/recursive-mas-integration.md
@@ -0,0 +1,41 @@
+# RecursiveMAS Integration Plan
+
+## Decision
+
+Integrate RecursiveMAS as an **optional, feature-flagged recursive reasoning layer** across the OpenSIN-AI multi-agent stack. It should augment the existing agent loop, not replace it.
+
+## Why this fits
+
+- OpenSIN already has A2A orchestration, subagents, MCP, memory, and a control plane.
+- RecursiveMAS adds inner/outer latent recursion and improves agent-to-agent refinement.
+- The right rollout shape is opt-in, so current behavior stays stable.
+
+## Repo map
+
+- **OpenSIN** — core engine primitives and reusable recursion hooks: https://github.com/OpenSIN-AI/OpenSIN/issues/1726
+- **OpenSIN-backend** — rollout flags, telemetry, and operator controls: https://github.com/OpenSIN-AI/OpenSIN-backend/issues/1179
+- **OpenSIN-Neural-Bus** — event subjects, trace replay, durable handoffs: https://github.com/OpenSIN-AI/OpenSIN-Neural-Bus/issues/14
+- **Infra-SIN-OpenCode-Stack** — canonical config and sync surface: https://github.com/OpenSIN-AI/Infra-SIN-OpenCode-Stack/issues/65
+- **OpenSIN-overview** — SSOT, decision record, and rollout coordination: https://github.com/OpenSIN-AI/OpenSIN-overview/issues/57
+- **Upstream dependency (outside OpenSIN-AI)** — OpenSIN-Code runtime issue: https://github.com/OpenSIN-Code/OpenSIN-Code/issues/1122
+
+## Rollout phases
+
+1. **SSOT and config** — record the decision, map the repos, define the opt-in flag.
+2. **Core integration** — wire RecursiveMAS into the reusable engine/runtime.
+3. **Control plane + bus** — add telemetry, rollout gating, and durable recursion events.
+4. **Validation** — tests, benchmarks, and docs before default-on is ever considered.
+
+## Acceptance criteria
+
+- Default behavior is unchanged when RecursiveMAS is disabled.
+- Recursive mode can be enabled from a single canonical config surface.
+- Recursion traces are visible in logs/metrics and can be replayed.
+- Each repo has tests that cover the new path.
+- The rollout is documented and cross-linked from the org SSOT.
+
+## Guardrails
+
+- Keep RecursiveMAS opt-in until measurements show a real win.
+- Do not remove or break the existing agent loop.
+- Treat the plan as a phased migration, not a rewrite.