org/SDLC.md

SDLC & Source Control

GitHub Authentication

Invoke the github-app-token skill before any GitHub operation. It generates a short-lived installation token and sets GH_TOKEN.

Never run gh auth login directly. It hangs headless agents. Use the skill.

Token expires after ~1 hour. Re-invoke the skill to regenerate if needed.

Branch Strategy

All plugin repositories use a single long-lived branch:

Branch	Environment	Who merges
main	Production	CEO (Countess von Containerheim) after triple approval

Engineers always target main via feature branches — never push directly.

Feature branches follow the convention: <agent-name>/<short-description> (e.g., gandalf/add-sealed-secrets-list).

Pull Requests

All changes must happen via pull request. Always include cc @cpfarhood at the bottom of the PR body for visibility — not as a reviewer.

gh pr create --title "..." --body "... cc @cpfarhood"

PR Review & Merge Policy

Requires 3 approving GitHub reviews before the CEO merges:

1. UAT (Pixel Patty) — E2E browser testing against privilegedescalation-dev
2. QA (Regression Regina) — code-level review: test coverage, regressions, edge cases
3. CTO (Null Pointer Nancy) — architecture alignment, code quality, security

Review order is mandatory: CI → UAT → QA → CTO → CEO merge. Each stage gates the next. No agent merges their own PRs.

Pipeline

CI:    Engineer opens PR → CI runs (lint, types, unit tests)
UAT:   Pixel Patty validates E2E in privilegedescalation-dev
QA:    Regression Regina reviews code quality and test coverage
CTO:   Null Pointer Nancy reviews architecture and security
Merge: Countess von Containerheim merges after all approvals

Stage 1 — Engineer Opens PR

1. Engineer (Gandalf the Greybeard) creates a feature branch and opens a PR targeting main.
2. CI runs automatically: lint, type checks, unit tests.
3. CI must pass before any reviewer spends tokens. If CI fails, the engineer fixes it.

Stage 2 — UAT Review

1. Pixel Patty picks up PRs with passing CI.
2. Patty runs E2E browser testing against the deployed build in privilegedescalation-dev.
3. Pass → hands off to QA. Fail → reports back; CTO cascades to engineer.

Stage 3 — QA Review

1. Regression Regina picks up PRs that have passed both CI and UAT.
2. Regina reviews: test coverage, regressions, edge cases, code quality.
3. Pass → hands off to CTO. Fail → reports back; CTO cascades to engineer.

Stage 4 — CTO Review

1. Null Pointer Nancy picks up PRs that have passed CI, UAT, and QA.
2. Nancy reviews: architecture alignment, code quality, security.
3. Approve → PR is ready for merge. Request changes → cascades to engineer.

Stage 5 — CEO Merge

1. Countess von Containerheim merges the PR after all three approvals (UAT + QA + CTO) and CI passing.
2. Reject → returns to CTO → engineer.

Hierarchy Rules

• CTO rejections go directly to engineer (not through QA or UAT).
• UAT failures go to CTO, who cascades to engineer.
• QA failures go to CTO, who cascades to engineer.
• CEO rejections go to CTO, who cascades to engineer.
• The CTO is the single routing point for all failures and rejections.

Agent Roster

Role	Agent	Paperclip UUID
CEO	Countess von Containerheim	0e1a21f5-ccb2-4303-8e81-5b7072a17eaf
CTO	Null Pointer Nancy	553af4ab-7054-40f5-994e-e5bdd79b5b7a
Staff Engineer	Gandalf the Greybeard	bbb16aac-bb15-4daf-b1a8-727235aefcd7
QA Engineer	Regression Regina	c5f88b39-e563-4409-9221-6379800dceec
UAT Engineer	Pixel Patty	8f3ce8fa-16cc-4f56-a79c-5dda208d6b4a
VP Engineering Ops	Hugh Hackman	210a68f2-ad1f-45af-88e3-4271e208f836
CMO	Kubectl Karen	71ba858e-e52b-4550-a51d-2a5afc6e1ce5

Handoff Protocol — Mandatory

Every handoff to another agent requires ALL THREE steps:

Step 1 — Explicit Assignment

PATCH the issue with assigneeAgentId: "<target-agent-uuid>". @mentioning is NOT a handoff — the agent won't wake without explicit assignment.

Step 2 — Status = todo

Every handoff sets status: "todo". Never in_review — it doesn't appear in inbox-lite and the target agent won't wake.

Step 3 — Release Checkout

POST /api/issues/{issueId}/release
Headers: Authorization: Bearer $PAPERCLIP_API_KEY, X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID

Without this release, the receiving agent cannot checkout the issue.

Status Semantics

Status	Meaning
backlog	Not ready; parked or unscheduled
todo	Ready and actionable; not checked out
in_progress	Actively owned; enter by checkout only
in_review	Self-held only; awaiting external feedback
blocked	Cannot proceed; state blocker and who must act
done	Complete, no follow-up remains
cancelled	Intentionally abandoned

Status Transition Rules

Handoff	Correct Status
Engineer → UAT (Patty)	todo
UAT (Patty) → QA (Regina)	todo
QA (Regina) → CTO (Nancy)	todo
CTO (Nancy) → CEO (Countess)	todo
Any failure → CTO (Nancy)	todo
CTO (Nancy) → Engineer (fix)	todo

Never use in_review for handoffs. It does not trigger inbox-lite and the receiving agent will not wake.

CI/CD

• CI runs on self-hosted ARC runners: runs-on: runners-privilegedescalation
• Only Hugh Hackman has write access to .github/workflows/ files
• All CI/CD workflow changes must be delegated to Hugh
• Runners scale to zero when idle and start automatically when a workflow triggers

Security Review

Security review is handled as part of the CTO review stage. Null Pointer Nancy evaluates security concerns during her architecture and code quality review. There is no separate dedicated security review agent.

Work Distribution

• All engineering and devops work is broken down and distributed by the CTO (Nancy).
• Engineers do not self-assign — the CTO triages, scopes, and assigns all implementation tasks.
• Hugh Hackman owns CI/CD, infrastructure, and pipeline work.
• Gandalf the Greybeard owns plugin implementation.
• Regression Regina owns QA review and test coverage.
• Pixel Patty owns UAT/E2E browser testing.