Phase 0: reconcile baseline, add AG-002, and establish Backend CI

.env.example

@@ -30,8 +30,6 @@ POST_LOGIN_REDIRECT_PATH=/dashboard
 
 CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:8000
 LOG_LEVEL=INFO
-WORKER_ID=local-worker-1
-QUEUE_NAME=default
 
 # Connected Accounts Module
 # GitHub provider integration uses GitHub App installation flow.
@@ -40,6 +38,7 @@ GITHUB_APP_NAME=YGIT
 GITHUB_APP_SLUG=
 GITHUB_APP_ID=
 GITHUB_APP_PRIVATE_KEY=
+GITHUB_APP_WEBHOOK_ENABLED=false
 GITHUB_APP_WEBHOOK_SECRET=
 GITHUB_APP_INSTALL_URL=https://github.com/apps/ygit/installations/new
 GITHUB_API_BASE_URL=https://api.github.com
@@ -56,5 +55,6 @@ CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4
 # Worker Runtime
 WORKER_ID=local-worker-1
 QUEUE_NAME=default
+WORKER_PROVIDER_EXECUTION_MODE=disabled
 WORKER_POLL_INTERVAL_SECONDS=5
 WORKER_MAX_ATTEMPTS=3

.github/workflows/backend-ci.yml

@@ -0,0 +1,164 @@
+name: Backend CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: backend-ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  PYTHONUTF8: "1"
+  PYTHONDONTWRITEBYTECODE: "1"
+  PYTHONUNBUFFERED: "1"
+  APP_ENV: test
+  GITHUB_APP_WEBHOOK_ENABLED: "false"
+  WORKER_PROVIDER_EXECUTION_MODE: disabled
+
+jobs:
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Upgrade pip
+        run: python -m pip install --upgrade pip
+
+      - name: Install project dependencies
+        run: python -m pip install -e ".[dev]"
+
+      - name: Compile Python sources
+        run: python -m compileall -q backend scripts
+
+      - name: Verify MyPy deferral
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+
+          workflow_text = Path(".github/workflows/backend-ci.yml").read_text(
+              encoding="utf-8"
+          )
+          forbidden_command = "python -m " + "mypy backend"
+          if forbidden_command in workflow_text:
+              raise SystemExit("Full-backend MyPy must remain deferred.")
+
+          print("MYPY_REQUIRED_GATE: DEFERRED")
+          PY
+
+      - name: Run baseline-aware Ruff
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          set -euo pipefail
+
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            base_sha="$PR_BASE_SHA"
+          else
+            base_sha="$PUSH_BEFORE_SHA"
+          fi
+
+          head_sha="$GITHUB_SHA"
+
+          if [[ -z "$base_sha" || "$base_sha" =~ ^0+$ ]]; then
+            base_sha="$(git rev-parse HEAD^)"
+          fi
+
+          git cat-file -e "${base_sha}^{commit}"
+          git cat-file -e "${head_sha}^{commit}"
+
+          changed_file_list="$(mktemp)"
+          trap 'rm -f "$changed_file_list"' EXIT
+
+          git diff \
+            --name-only \
+            -z \
+            --find-renames \
+            --diff-filter=ACMR \
+            "$base_sha" \
+            "$head_sha" \
+            -- \
+            backend \
+            scripts |
+            sort -zu > "$changed_file_list"
+
+          all_changed_files=()
+          mapfile -d '' -t all_changed_files < "$changed_file_list"
+
+          changed_files=()
+          for file in "${all_changed_files[@]}"; do
+            case "$file" in
+              *.py)
+                changed_files+=("$file")
+                ;;
+            esac
+          done
+
+          general_files=()
+          config_changed=false
+          release_gate_changed=false
+
+          for file in "${changed_files[@]}"; do
+            case "$file" in
+              backend/core/config.py)
+                config_changed=true
+                ;;
+              scripts/release_gate.py)
+                release_gate_changed=true
+                ;;
+              *)
+                general_files+=("$file")
+                ;;
+            esac
+          done
+
+          if (( ${#general_files[@]} > 0 )); then
+            python -m ruff check "${general_files[@]}"
+          fi
+
+          if [[ "$config_changed" == "true" ]]; then
+            python -m ruff check --ignore S105 backend/core/config.py
+          fi
+
+          if [[ "$release_gate_changed" == "true" ]]; then
+            python -m ruff check \
+              --ignore E501,I001,UP035 \
+              scripts/release_gate.py
+          fi
+
+          if (( ${#changed_files[@]} == 0 )); then
+            echo "No eligible changed Python files."
+          fi
+
+      - name: Run full test suite
+        run: python -m pytest -q
+
+      - name: Run smoke test
+        run: python scripts/smoke_test.py --skip-db
+
+      - name: Run release gate
+        run: python scripts/release_gate.py --skip-db

AUDIT_REPORT.md

@@ -1,8 +1,8 @@
 # YGIT Current Engineering Audit Report
 
-Version: 1.6
+Version: 1.8
 Status: Verified Foundation / Pre-Live Integration
-Updated: 2026-07-21
+Updated: 2026-07-24
 
 ## Audit Scope
 
@@ -22,13 +22,17 @@ This report covers the current YGIT MVP source through:
 - GitHub App architecture lock and fail-closed rejection of legacy GitHub OAuth environment variables.
 - Default-disabled GitHub App webhook capability with conditional secret readiness validation.
 - AG-001 Deploy Provider Gate standalone foundation.
+- AG-002 Repository Provider Gate standalone foundation with GitHub default and no runtime wiring.
+- Immutable running baseline lock at `b9019b79d1af3fe73d1a74769792ebb6958c4f4c`.
+- Backend CI documentation contract, implementation workflow, read-only security boundary, and successful Draft PR validation.
 - Connected Accounts metadata and repository-reuse UI.
 
 ## Verified Results
 
 | Check | Result |
 |---|---:|
 | Expected source base and remote alignment | PASS |
+| Running baseline lock | PASS — `b9019b79d1af3fe73d1a74769792ebb6958c4f4c` |
 | Worker architecture regression | PASS |
 | Credential acquisition boundary tests | PASS |
 | Cloudflare provider gateway tests | PASS |
@@ -40,11 +44,12 @@ This report covers the current YGIT MVP source through:
 | Worker Runtime architecture tests | 4 passed |
 | Deploy/redeploy architecture tests | 2 passed |
 | AG-001 regression | 15 passed |
+| AG-002 regression | 9 passed |
 | Deployment History runtime tests | 8 passed |
 | Deployment History idempotency tests | 4 passed |
 | Live-readiness tooling tests | 18 passed |
 | Runtime image packaging tests | 4 passed |
-| Full test suite | 514 passed |
+| Full test suite | 579 passed, 1 warning |
 | Smoke test with database skipped | PASS |
 | Release gate with database skipped | PASS |
 | Basic secret scan | PASS |
@@ -53,6 +58,7 @@ This report covers the current YGIT MVP source through:
 | Deploy/redeploy provider binding | WIRED, DEFAULT DISABLED |
 | Trusted provider execution policy | RUNTIME WIRED, DEFAULT DISABLED |
 | AG-001 runtime integration | NOT WIRED |
+| AG-002 runtime integration | NOT WIRED; GITHUB DEFAULT UNCHANGED |
 | YGIT App Engine | NOT CREATED |
 | Deployment History runtime persistence | WIRED, NOT LIVE-VERIFIED |
 | Retry-safe history intent replay | IMPLEMENTED |
@@ -62,6 +68,15 @@ This report covers the current YGIT MVP source through:
 | GitHub OAuth client credentials | FORBIDDEN |
 | GitHub App webhook capability | DEFAULT DISABLED |
 | GitHub App webhook secret | CONDITIONAL WHEN ENABLED |
+| Backend CI workflow | IMPLEMENTED — `.github/workflows/backend-ci.yml` |
+| Backend CI required status | `Backend CI / Validate` |
+| Backend CI pull-request run | PASS — `30061513976` |
+| Backend CI Validate job | PASS — `89383928195` |
+| Backend CI permissions | CONTENTS READ ONLY |
+| Backend CI provider execution | DISABLED |
+| Backend CI production secrets | NOT USED |
+| Backend CI post-merge push verification | PENDING |
+| Backend CI branch protection | NOT ENABLED / NOT AUTHORIZED |
 | Runtime readiness artifacts in image | PACKAGED, REDEPLOY PENDING |
 | Coolify redeploy | NOT EXECUTED |
 | Live provider execution | NOT EXECUTED |
@@ -79,13 +94,16 @@ One non-blocking `StarletteDeprecationWarning` remains in the existing test-clie
 - Deploy/redeploy handlers validate the policy and pass only the resulting boolean to the neutral binding.
 - The default `disabled` policy preserves the non-provider path; explicit `cloudflare` remains unverified against live credentials and APIs.
 - AG-001 is a pure Deploy Engine decision contract and does not import providers, pipelines, workers, settings, or database infrastructure.
+- AG-002 is a pure Repository Engine decision contract; the current Repository Engine service does not import it, and existing GitHub parsing, metadata, persistence, and analysis-input behavior remain unchanged.
 - Provider credentials remain secret-wrapped during gateway construction.
 - The global/default Deploy Pipeline remains the contract-skeleton path.
 - Provider-enabled context is created only inside the trusted runtime binding function.
 - Job payload `execution_mode` does not activate provider execution.
 - Deployment History Engine remains the persistence owner and now consumes pipeline history intents through its public boundary.
 - Deterministic intent keys prevent duplicate log writes during sequential retries.
 - Completed history records short-circuit duplicate deploy/redeploy execution.
+- Backend CI runs with `contents: read`, checkout credentials are not persisted, provider execution remains disabled, and no production secret or deployment action is present.
+- Pull-request run `30061513976` completed successfully at workflow commit `7f383ba6b0c17b92de9a27e0abe4cbeb8adbbac2`; post-merge push validation remains pending.
 
 ## Documentation Findings
 
@@ -100,6 +118,8 @@ Before this update:
 
 This update separates the historical release baseline from the current engineering snapshot.
 
+This closure update also records the implemented Backend CI workflow and its successful Draft PR validation. It does not claim post-merge validation, branch-protection enforcement, Phase 0 completion, or production readiness.
+
 ## Not Executed
 
 ```text
@@ -111,8 +131,11 @@ Live Cloudflare Pages project/deployment execution
 Production HTTPS authenticated user flow
 Production admin operations flow
 Deployment history persistence from a real provider result
+Backend CI push-triggered validation on merged main
+Branch-protection enforcement using Backend CI / Validate
 ```
 
+
 No production-readiness claim is made for these areas.
 
 ## Remaining Risk
@@ -122,12 +145,15 @@ Primary remaining risks are integration risks rather than missing core provider
 - Controlled activation and validation of the explicit `cloudflare` policy in the live environment.
 - Live PostgreSQL transaction behavior and provider-result persistence evidence.
 - Reviewed future AG-001 runtime integration without changing the current Cloudflare default.
+- Reviewed future AG-002 runtime integration without changing the current GitHub default.
 - Transaction boundaries between worker state and deployment history.
 - Provider timeout and retry behavior.
 - Idempotency and duplicate deployment prevention.
 - Partial asset-upload recovery.
 - External account and permission misconfiguration.
 - Production observability.
+- Successful `push`-triggered Backend CI verification after an approved merge.
+- Separately approved branch-protection enforcement using the stable CI check.
 
 ## Verification Commands
 

CHANGELOG.md

@@ -2,6 +2,66 @@
 
 All notable YGIT MVP implementation releases and active engineering foundations are tracked here.
 
+## Unreleased — Phase 0 Backend CI Documentation and Status Closure — 2026-07-24
+
+### Added
+
+- Backend CI workflow status and evidence across the authoritative current-state documents.
+- Machine-readable Backend CI quality-gate and contract records.
+- Successful Draft PR workflow evidence for `Backend CI / Validate`.
+
+### Changed
+
+- Transitioned Backend CI specification, implementation, and testing documents from draft/pre-implementation language to implemented and PR-verified states.
+- Updated the Phase 0 critical path to require documentation closure, PR metadata reconciliation, explicit Ready/merge approval, and post-merge `main` validation before Phase 0 completion.
+
+### Verified
+
+- Workflow: `Backend CI`.
+- Job: `Validate`.
+- Stable status: `Backend CI / Validate`.
+- Workflow implementation commit: `7f383ba6b0c17b92de9a27e0abe4cbeb8adbbac2`.
+- Pull-request run `30061513976`: SUCCESS.
+- Job `89383928195`: SUCCESS.
+- Full suite: 579 passed.
+- Smoke test with database skipped: PASS.
+- Release gate with database skipped: PASS.
+
+### Boundaries
+
+- Provider execution remains disabled.
+- No production secret, database service, Redis service, provider API, deployment action, or Coolify action is used by Backend CI.
+- Post-merge push validation, branch protection, Ready transition, merge, deployment, and Phase 0 completion remain pending separate approval.
+
+## Unreleased — Phase 0 Baseline Reconciliation and AG-002 — 2026-07-23
+
+### Added
+
+- Immutable running baseline lock at commit `b9019b79d1af3fe73d1a74769792ebb6958c4f4c`.
+- AG-002 Repository Provider Gate as a standalone Repository Engine decision contract.
+- AG-002 architecture documentation and regression coverage.
+- Explicit `.env.example` entries for the default-disabled GitHub webhook and worker provider-execution mode.
+
+### Changed
+
+- Reconciled `README.md`, `PROJECT_STATUS.md`, `VERSION.json`, `CONTRACT_MANIFEST.json`, and `AUDIT_REPORT.md` with the current authoritative engineering state.
+- Removed duplicate Worker Runtime identity/queue entries from `.env.example`.
+- Aligned the immediate critical path around real GitHub App repository acquisition, real analysis evidence, and one controlled Cloudflare deployment.
+
+### Verified
+
+- AG-002 regression: 9 passed.
+- Full suite: 579 passed, 1 warning.
+- Smoke test with database skipped: PASS.
+- Release gate with database skipped: PASS.
+
+### Runtime Boundary
+
+- GitHub remains the Repository Engine default.
+- AG-002 is not imported by the current Repository Engine service.
+- No provider adapter, API route, database model, migration, worker behavior, deployment behavior, or production configuration is changed.
+- No Coolify redeploy is required for this isolated foundation and documentation reconciliation patch.
+
 ## Unreleased — Provider Orchestration and Runtime Binding Foundations — 2026-07-21
 
 ### Added