diff --git a/profile/README.md b/profile/README.md index c696198..e3d4ea9 100644 --- a/profile/README.md +++ b/profile/README.md @@ -1,136 +1,68 @@ # Coding-Autopilot-System -> [!TIP] -> Are you an enterprise engineering leader? Read our pitch on **[Why Enterprises Need CAS](ENTERPRISE.md)**. - -AI-native engineering portfolio focused on autonomous workflows, prompt governance, -multi-agent execution, and enterprise operating models. - -This organization is structured as a small platform, not a random set of demos. -The core story is: - -1. install a governed workstation, -2. exchange work through versioned lifecycle contracts, -3. run prompt-aware and agent-aware engineering workflows, -4. deploy through a managed-identity Azure platform, -5. evaluate, observe, validate, and audit what happened. - -## Start Here - -- **End-to-end reference product**: [cas-reference-product](https://github.com/Coding-Autopilot-System/cas-reference-product) -- **Verified case study**: [immutable golden-path evidence](https://github.com/Coding-Autopilot-System/cas-reference-product/blob/main/docs/case-study-evidence.md) -- **Workstation bootstrap**: [cas-workstation](https://github.com/Coding-Autopilot-System/cas-workstation) -- **Lifecycle contracts**: [cas-contracts](https://github.com/Coding-Autopilot-System/cas-contracts) -- **Azure platform foundation**: [cas-platform](https://github.com/Coding-Autopilot-System/cas-platform) -- **Evaluation evidence**: [cas-evals](https://github.com/Coding-Autopilot-System/cas-evals) -- **Autonomous execution**: [gsd-orchestrator](https://github.com/Coding-Autopilot-System/gsd-orchestrator) -- **Prompt governance**: [Promptimprover](https://github.com/Coding-Autopilot-System/Promptimprover) -- **Multi-agent workbench**: [autogen](https://github.com/Coding-Autopilot-System/autogen) -- **Enterprise architecture depth**: [cloud-security-service-model](https://github.com/Coding-Autopilot-System/cloud-security-service-model) - -## Portfolio Map - -### End-to-End Proof - -#### [cas-reference-product](https://github.com/Coding-Autopilot-System/cas-reference-product) - -Production-oriented reference workload that connects the CAS platform story. - -- Demonstrates Foundry Next Gen agent integration through a bounded application - interface -- Uses managed identity, canonical lifecycle events, health checks, and - OpenTelemetry boundaries -- Provides the workload contract implemented by `cas-platform` and an executable - local HTTP golden path evaluated by `cas-evals` -- Publishes a [verified case study](https://github.com/Coding-Autopilot-System/cas-reference-product/blob/main/docs/case-study-evidence.md) - backed by an [immutable evidence bundle](https://github.com/Coding-Autopilot-System/cas-reference-product/tree/main/evidence/verified-local-golden-path-v0.1) - -### Platform Foundations - -#### [cas-contracts](https://github.com/Coding-Autopilot-System/cas-contracts) - -Authoritative, versioned lifecycle contracts for the complete CAS workflow. - -- Standardizes prompts, policy decisions, work requests, run events, artifacts, - verification, and evaluation -- Requires correlation identifiers and W3C trace context -- Provides executable schemas and compatibility rules - -#### [cas-platform](https://github.com/Coding-Autopilot-System/cas-platform) - -Secure Azure deployment and observability foundation. - -- Uses Bicep, isolated environments, and system-assigned managed identity -- Provides Container Apps hosting, Application Insights, budgets, and safe - non-deploying validation -- Keeps public ingress disabled by default - -#### [cas-evals](https://github.com/Coding-Autopilot-System/cas-evals) - -Reproducible evaluation and benchmark evidence. - -- Runs deterministic golden-task and adversarial-prompt suites -- Measures quality, safety, cost, and latency independently -- Produces machine-readable evidence suitable for regression gates - -### Flagship Repos - -#### [cas-workstation](https://github.com/Coding-Autopilot-System/cas-workstation) - -Windows-first AI-native developer workstation bootstrap. +> **Speed without governance creates risk. Governance without speed creates irrelevance.** +> Read the full thesis in **[our Vision](VISION.md)**. -- Establishes a repeatable engineering baseline -- Validates installed tools and configuration -- Reduces setup drift before autonomous workflows run +AI-native engineering portfolio: autonomous multi-agent execution, prompt governance, versioned +lifecycle contracts, and Azure-ready platform foundations — every gate machine-executable and +evidence-producing, not a meeting. -#### [gsd-orchestrator](https://github.com/Coding-Autopilot-System/gsd-orchestrator) - -C#/.NET 10 autonomous issue-to-PR engine. - -- Reads GitHub issues -- Plans and edits through a state machine -- Uses MCP tooling for GitHub operations -- Preserves checkpointed workflow state for retry and recovery - -#### [Promptimprover](https://github.com/Coding-Autopilot-System/Promptimprover) - -TypeScript MCP-first prompt governance layer. - -- Refines prompts before execution -- Injects repo-aware context and reusable rules -- Builds traceability between prompt intent and engineering output - -#### [autogen](https://github.com/Coding-Autopilot-System/autogen) - -Python local-first multi-agent engineering workbench. - -- Coordinates manager-led agent workflows -- Supports provider routing and fallback -- Keeps operator approvals and run artifacts visible - -#### [cloud-security-service-model](https://github.com/Coding-Autopilot-System/cloud-security-service-model) - -Enterprise cloud security operating model for Azure and hybrid environments. - -- Service architecture and governance -- Controls-as-code posture -- Auditability, metrics, and runbooks - -### Supporting Repos - -#### [autopilot-core](https://github.com/Coding-Autopilot-System/autopilot-core) - -Control plane for org-level CI repair automation. - -#### [ci-autopilot](https://github.com/Coding-Autopilot-System/ci-autopilot) - -Worker/runtime pattern for queued repair execution on self-hosted runners. - -#### [autopilot-demo](https://github.com/Coding-Autopilot-System/autopilot-demo) - -Bounded demo target for the full failure-to-fix loop. - -## What This Portfolio Demonstrates +> [!TIP] +> Are you an enterprise engineering leader? Read **[Why Enterprises Need CAS](ENTERPRISE.md)**. + +## Governed autonomy, in one diagram + +```mermaid +flowchart LR + subgraph Control["Control plane - gsd-orchestrator"] + G[Goal admission
typed, bounded, budgeted] --> S[Dependency-aware
scheduling] + end + subgraph Execution["Execution plane - autogen"] + S --> W1[Worker fan-out
isolated mutation scope] + W1 --> T[Typed failure states
structured telemetry] + end + subgraph Governance["Governance plane"] + P[Promptimprover] -.gates.-> W1 + C[cas-contracts] -.validates.-> T + E[cas-evals] --> V{Evidence
gate} + end + T --> E + V -->|proven| M[Merge via PR] + V -->|failed| R[Bounded repair
or halt] + R --> S +``` + +Full narrative, proof points, and every gate's falsifiable check: **[profile/VISION.md](VISION.md)**. + +## Repo map + +| Repo | Plane / category | What it does | +|---|---|---| +| [gsd-orchestrator](https://github.com/Coding-Autopilot-System/gsd-orchestrator) | Control | Autonomous issue-to-PR engine (.NET 10); goal admission and scheduling | +| [autogen](https://github.com/Coding-Autopilot-System/autogen) | Execution | Multi-agent worker fan-out on Microsoft Agent Framework (Python) | +| [Promptimprover](https://github.com/Coding-Autopilot-System/Promptimprover) | Governance | MCP-first prompt governance and traceability | +| [cas-contracts](https://github.com/Coding-Autopilot-System/cas-contracts) | Governance | Versioned lifecycle schemas — prompts, events, artifacts, `FailureState` | +| [cas-evals](https://github.com/Coding-Autopilot-System/cas-evals) | Governance | Deterministic evaluation and evidence-gate verification | +| [cas-reference-product](https://github.com/Coding-Autopilot-System/cas-reference-product) | Proof | End-to-end reference workload with a [verified case study](https://github.com/Coding-Autopilot-System/cas-reference-product/blob/main/docs/case-study-evidence.md) | +| [cas-platform](https://github.com/Coding-Autopilot-System/cas-platform) | Platform | Azure hosting/observability foundation — bicep-ready, deploy-locked | +| [cloud-security-service-model](https://github.com/Coding-Autopilot-System/cloud-security-service-model) | Platform | Enterprise cloud security operating model | +| [cas-workstation](https://github.com/Coding-Autopilot-System/cas-workstation) | Workstation | Windows-first AI-native developer workstation bootstrap | +| [autopilot-core](https://github.com/Coding-Autopilot-System/autopilot-core) | CI Automation | Control plane for org-level CI repair automation | +| [ci-autopilot](https://github.com/Coding-Autopilot-System/ci-autopilot) | CI Automation | Worker/runtime for queued repair execution on self-hosted runners | +| [autopilot-demo](https://github.com/Coding-Autopilot-System/autopilot-demo) | CI Automation | Bounded demo target for the full failure-to-fix loop | +| [.github (this repo)](https://github.com/Coding-Autopilot-System/.github) | Org | Governance, community health files, and this profile | + +## Review path + +Evaluating this portfolio quickly? Read in this order: + +1. **[Vision](VISION.md)** — the governance-with-speed thesis and proof points. +2. **[Verified case study](https://github.com/Coding-Autopilot-System/cas-reference-product/blob/main/docs/case-study-evidence.md)** — real evidence, not a demo script. +3. **[cas-workstation](https://github.com/Coding-Autopilot-System/cas-workstation)** — the reproducible developer baseline. +4. **[cas-contracts](https://github.com/Coding-Autopilot-System/cas-contracts)** — shared lifecycle and traceability model. +5. **[gsd-orchestrator](https://github.com/Coding-Autopilot-System/gsd-orchestrator)** — autonomous execution design. + +## What this portfolio demonstrates - C#/.NET, TypeScript, Python, PowerShell, and Bicep across one coherent platform story - Versioned cross-repository contracts and reproducible evaluation evidence @@ -139,25 +71,12 @@ Bounded demo target for the full failure-to-fix loop. - Enterprise-oriented concerns: auditability, resilience, boundaries, rollout, and documentation - Azure managed identity, infrastructure-as-code, observability, and hybrid architecture -## Review Path - -If you are evaluating this portfolio quickly: +## Organization standards -1. Read the [verified case study](https://github.com/Coding-Autopilot-System/cas-reference-product/blob/main/docs/case-study-evidence.md) and inspect its [immutable evidence bundle](https://github.com/Coding-Autopilot-System/cas-reference-product/tree/main/evidence/verified-local-golden-path-v0.1). -2. Read [cas-workstation](https://github.com/Coding-Autopilot-System/cas-workstation) for the reproducible developer baseline. -3. Read [cas-contracts](https://github.com/Coding-Autopilot-System/cas-contracts) for the shared lifecycle and traceability model. -4. Read [cas-platform](https://github.com/Coding-Autopilot-System/cas-platform) for secure Azure hosting and observability. -5. Read [cas-evals](https://github.com/Coding-Autopilot-System/cas-evals) for measurable quality and safety evidence. -6. Read [gsd-orchestrator](https://github.com/Coding-Autopilot-System/gsd-orchestrator) for autonomous execution design. -7. Read [Promptimprover](https://github.com/Coding-Autopilot-System/Promptimprover) for prompt governance and MCP thinking. -8. Read [autogen](https://github.com/Coding-Autopilot-System/autogen) for operator-facing multi-agent runtime design. -9. Read [cloud-security-service-model](https://github.com/Coding-Autopilot-System/cloud-security-service-model) for enterprise architecture depth. - -## Organization Standards - -Shared contribution, security, support, governance, intake, dependency, and release -policies are maintained in the -[organization `.github` repository](https://github.com/Coding-Autopilot-System/.github). +Shared contribution, security, support, governance, intake, dependency, and release policies are +maintained in this [organization `.github` repository](https://github.com/Coding-Autopilot-System/.github). Repository-specific standards may be stricter. Built by [@OgeonX-Ai](https://github.com/OgeonX-Ai). + + diff --git a/profile/VISION.md b/profile/VISION.md new file mode 100644 index 0000000..f8d7683 --- /dev/null +++ b/profile/VISION.md @@ -0,0 +1,133 @@ +# CAS — Governed Autonomy for Software Delivery + +> **Speed without governance creates risk. Governance without speed creates irrelevance.** +> CAS (Coding-Autopilot-System) is built on the position that this is a false trade-off: when governance is executable — schemas, gates, and evidence instead of meeting minutes — it *is* the speed. + + + +This page is the organization-facing version of the flagship vision document. It exists so +anyone landing on [github.com/Coding-Autopilot-System](https://github.com/Coding-Autopilot-System) +can read the thesis and reach every repository behind it without cloning anything first. + +## The problem + +Every enterprise is discovering the same thing: AI agents can produce code far faster than humans can review it. The standard responses both fail — + +- **Ship it** (speed without governance): untracked artifacts, untruthful commit messages, unreviewed merges, silent drift. We have measured versions of each of these failure classes in our own workspace — including a commit that *claimed* to add test suites while its diff contained none. +- **Board it** (governance without speed): review queues, manual sign-off, documentation that decays the day it's written. The agents idle; the advantage evaporates. + +CAS is a working system — 13 repositories in this organization plus a workstation control plane — that resolves the tension by making every governance control **machine-executable and evidence-producing**. + +## The answer: governed autonomy + +```mermaid +flowchart LR + subgraph Control["Control plane - gsd-orchestrator (.NET 10)"] + G[Goal admission
typed, bounded, budgeted] --> S[Dependency-aware
scheduling] + end + subgraph Execution["Execution plane - autogen / Microsoft Agent Framework (Python 3.12)"] + S --> W1[Worker fan-out
isolated mutation scope] + W1 --> T[Typed failure states
structured JSON telemetry] + end + subgraph Governance["Governance plane"] + P[Promptimprover
prompt & learning governance] -.gates.-> W1 + C[cas-contracts
versioned JSON schemas] -.validates.-> T + E[cas-evals
deterministic verification] --> V{Evidence
gate} + end + T --> E + V -->|proven| M[Merge via PR
branch-protected, two-party] + V -->|failed| R[Bounded repair
or deterministic halt] + R --> S +``` + + + +Three planes, strictly separated, each owned by a repository in this organization: + +| Plane | Owner | What it enforces | +|---|---|---| +| **Control** | [`gsd-orchestrator`](https://github.com/Coding-Autopilot-System/gsd-orchestrator) | Goals are typed, measurable, bounded. Nothing runs without a budget and a stop rule. | +| **Execution** | [`autogen`](https://github.com/Coding-Autopilot-System/autogen) (MAF workers) | Every worker owns its mutation scope exclusively. Failures are *typed states*, never stack-trace soup. | +| **Governance** | [`Promptimprover`](https://github.com/Coding-Autopilot-System/Promptimprover), [`cas-contracts`](https://github.com/Coding-Autopilot-System/cas-contracts), [`cas-evals`](https://github.com/Coding-Autopilot-System/cas-evals) | Prompts, schemas, and verification are versioned artifacts. Completion requires deterministic evidence — an agent saying "done" is not evidence. | + +## Every change runs the same SDLC loop + +```mermaid +flowchart TD + A[Plan
phase contract with threat model] --> B[Execute
agent fan-out, one owner per repo] + B --> C[Test
ratcheted branch-coverage gates] + C --> D[Verify
goal-backward evidence check] + D --> E[Review
PR, branch protection, two-party approval] + E --> F[Audit
milestone verification vs falsifiable requirements] + F -->|drift found| A + C -.->|coverage regression| B + D -.->|gaps| B +``` + + + +The loop is not aspirational — each gate is a running control with a falsifiable check: + +- **Truthful history**: a commit-integrity check flags any `test:`-typed commit whose diff contains no test files (built after catching a real one). +- **Ratcheted coverage**: CI gates fail on branch-coverage regression and only ratchet upward with real tests — never a hardcoded aspirational 100%. +- **Typed failures**: a versioned `FailureState` schema in `cas-contracts`; orchestrator and workers map every boundary failure to it, proven by fault injection (process kills, corrupted checkpoints, simulated API outages). +- **Supply-chain pinning**: every third-party GitHub Action pinned to a commit SHA with least-privilege token scopes, verified by an org-wide lint that runs in CI. +- **Drift detection**: a daily workspace-health sweep runs 11 checks (unpushed work, orphaned artifacts, stale PRs, encoding hazards, broken worktrees) and exits non-zero on any finding. +- **Deploy lock as policy**: infrastructure is maintained "bicep-ready" — linted, parameterized, pinned — while an operator hard lock prevents any cloud deployment until it is deliberately lifted. Governance includes what you *don't* ship. + +## Modular agents, priced to the task + +```mermaid +flowchart TD + O[Orchestrator
frontier model, full context] --> PL[Planner agents
mid-tier] + O --> EX[Executor agents
mid-tier, one repo each] + O --> VR[Verifier / critic agents
mid-tier] + O --> DOC[Doc & housekeeping agents
small models] + PL -->|plans as contracts| EX + EX -->|evidence| VR + style O fill:#1f6feb,color:#fff +``` + + + +The orchestrator delegates through **typed sub-agents** (planner, executor, verifier, critic, doc-writer), each with a scoped toolset and an explicitly chosen model tier — frontier reasoning only where it pays, small models for mechanical work. Specialist agents deliberately *cannot* spawn their own sub-agents; delegation depth is a governance decision, not an accident. The result: parallel throughput of a team, token cost of a task queue, and an audit trail for every decision. + +## Proof points (v1.4 hardening milestone, one working week) + +- 25-PR release train merged across 13 repos with branch protection never left disabled. +- 2 orphaned test suites recovered and gated; coverage baselines measured and ratcheted (branch coverage, not vanity line metrics). +- 37 + 16 new tests landed via fault injection and coverage phases; 134-test suites green. +- 4 stranded commits, 11 unmerged agent branches, and 14 broken worktrees detected and recovered — zero work lost. +- Every finding became a permanent automated check the same week it was found. + +## Explore the 13 repositories + +Every plane above is backed by a real, buildable repository in this organization. Start +wherever matches your interest: + +| Repository | Role | Plane / category | +|---|---|---| +| [gsd-orchestrator](https://github.com/Coding-Autopilot-System/gsd-orchestrator) | Autonomous issue-to-PR engine; goal admission and scheduling | Control | +| [autogen](https://github.com/Coding-Autopilot-System/autogen) | Multi-agent worker fan-out on Microsoft Agent Framework | Execution | +| [Promptimprover](https://github.com/Coding-Autopilot-System/Promptimprover) | MCP-first prompt governance and traceability | Governance | +| [cas-contracts](https://github.com/Coding-Autopilot-System/cas-contracts) | Versioned lifecycle schemas (prompts, events, artifacts, `FailureState`) | Governance | +| [cas-evals](https://github.com/Coding-Autopilot-System/cas-evals) | Deterministic evaluation and evidence-gate verification | Governance | +| [cas-reference-product](https://github.com/Coding-Autopilot-System/cas-reference-product) | End-to-end reference workload with a [verified case study](https://github.com/Coding-Autopilot-System/cas-reference-product/blob/main/docs/case-study-evidence.md) | Proof | +| [cas-platform](https://github.com/Coding-Autopilot-System/cas-platform) | Azure hosting/observability foundation — bicep-ready, deploy-locked | Platform | +| [cloud-security-service-model](https://github.com/Coding-Autopilot-System/cloud-security-service-model) | Enterprise cloud security operating model | Platform | +| [cas-workstation](https://github.com/Coding-Autopilot-System/cas-workstation) | Windows-first AI-native developer workstation bootstrap | Workstation | +| [autopilot-core](https://github.com/Coding-Autopilot-System/autopilot-core) | Control plane for org-level CI repair automation | CI Automation | +| [ci-autopilot](https://github.com/Coding-Autopilot-System/ci-autopilot) | Worker/runtime for queued repair execution on self-hosted runners | CI Automation | +| [autopilot-demo](https://github.com/Coding-Autopilot-System/autopilot-demo) | Bounded demo target for the full failure-to-fix loop | CI Automation | +| [.github (this repo)](https://github.com/Coding-Autopilot-System/.github) | Org governance, community health files, and this profile | Org | + +For a shorter front-door version of this page, see the +[organization profile README](https://github.com/Coding-Autopilot-System/.github/blob/main/profile/README.md). + +--- + +*This page is adapted from the canonical `docs/VISION.md`, maintained at the root of the CAS +workstation workspace — the source of truth for this thesis, tone, and diagram style. See each +repository's own `docs/wiki/` for implementation-level detail. Diagrams are Mermaid-first; +`codex:generate-image` placeholders mark where generated visuals will replace them.* +