# Components that `stone render` writes for this harness: one template and one target path each.
# A role is rendered only if a selected profile uses it. A component with `when` is rendered only if
# a selected profile has that gate (not `skip`) or that check. Other components are always rendered.
# ci_step: a step template for the G3 workflow. The workflow has it at `$ci_step_<id>` (dots become
# underscores) only if the component is rendered. Otherwise render removes that placeholder line.
# A ci-job can have `steps`: each step with the same `when` rule goes into the `$check_steps` block of
# the job template. A step with `command` needs that key in `commands` of the repo config. If the key
# has no value, render skips the step and warns (D29). A step is part of its ci-job component.
# A step with `needs: specialists` renders only if the repo config has `specialists` (D66).
# A component with `trigger` is rendered once for each selected profile with that trigger type, as
# `<id>.<profile>` (D31). `parts` are fragments that render puts in the template at a `$name` line.
# `values` are template values of the entry. A value that another trigger entry sets is "" here.
# eval: the planned eval folder (lifecycle.md).
# protected_dirs: the folders of the harness that hold its settings, role files, and hook entry. The hook
# and K6 protect them for every role, with `.cornerstone/` (D76). The core names no harness folder (P12).

protected_dirs:
  - .claude/

components:
  - id: role.shaper
    kind: role
    role: shaper
    purpose: Interview the human until the ticket meets the Definition of Ready.
    principle: [P3]
    template: agents/shaper.md
    target: .claude/agents/shaper.md
    eval: evals/role-shaper/

  - id: role.planner
    kind: role
    role: planner
    purpose: Write the plan artifact and the progress file. A human approves them at G2.
    principle: [P3, P7]
    template: agents/planner.md
    target: .claude/agents/planner.md
    eval: evals/role-planner/

  - id: role.implementer
    kind: role
    role: implementer
    purpose: Change the code to meet the ticket. Write the decision log.
    principle: [P2, P8]
    template: agents/implementer.md
    target: .claude/agents/implementer.md
    eval: evals/role-implementer/

  - id: role.tester
    kind: role
    role: tester
    purpose: Write independent tests from the ticket and the diff.
    principle: [P2]
    template: agents/tester.md
    target: .claude/agents/tester.md
    eval: evals/role-tester/

  - id: role.reviewer
    kind: role
    role: reviewer
    purpose: Find defects and scope drift in a fresh session.
    principle: [P2, P11]
    template: agents/reviewer.md
    target: .claude/agents/reviewer.md
    eval: evals/role-reviewer/

  - id: role.investigator
    kind: role
    role: investigator
    purpose: Read, run, and report. Write only in the reports path, or anywhere on a spike branch.
    principle: [P2, P11]
    template: agents/investigator.md
    target: .claude/agents/investigator.md
    eval: evals/role-investigator/

  - id: hook.path-match
    kind: hook
    purpose: Match a path against paths.tests and paths.checks. The hook and K6 import it.
    principle: [P2, P6]
    provides: path_match                     # stone check tests each glob with this module
    template: lib/path_match.py
    target: .cornerstone/lib/path_match.py
    eval: evals/hook-protect-paths/

  - id: hook.protect-paths
    kind: hook
    purpose: Block an edit to a path that the current role must not change.
    principle: [P2, P6]
    template: hooks/protect-paths.py
    target: .cornerstone/hooks/protect-paths.py
    eval: evals/hook-protect-paths/

  - id: hook.settings
    kind: hook
    purpose: Register the protected-path hook in the harness settings. Other keys stay as they are.
    principle: [P6]
    template: hooks/settings.json
    target: .claude/settings.json
    merge: json
    eval: evals/hook-protect-paths/

  - id: check.k6
    kind: check
    purpose: K6. Fail if an implementer commit changes a protected path.
    principle: [P2, P6]
    when: {check: K6}
    needs_trailers: true                     # not rendered if commits.trailers is none
    ci_step: workflows/steps/k6.yml
    template: checks/protected_paths.py
    target: .cornerstone/checks/protected_paths.py
    eval: ""

  - id: check.k7
    kind: check
    purpose: K7. Fail if the diff is over the size limit of the PR profile and has no waiver.
    principle: [P10]
    when: {check: K7}
    template: checks/change_size.py
    target: .cornerstone/checks/change_size.py
    eval: evals/check-k7/

  - id: check.k15
    kind: check
    purpose: K15. Fail if the instruction file is over the line limit of the model profile.
    principle: [P4, P6]
    when: {check: K15}
    template: checks/instruction_size.py
    target: .cornerstone/checks/instruction_size.py
    ci_step: workflows/steps/instruction-size.yml
    eval: evals/check-k15/

  - id: ci-job.checks
    kind: ci-job
    purpose: G3. Run K6, K7, K14, and the repo checks on each pull request.
    principle: [P1, P6]
    when: {gate: G3}
    template: workflows/cornerstone-checks.yml
    target: .github/workflows/cornerstone-checks.yml
    eval: evals/ci-job-checks/
    steps:                                   # the "by profile" checks that run a repo command
      - id: k20
        name: K20 specialist findings
        when: {check: K20}
        needs: specialists
        template: workflows/steps/k20-specialists.yml
      - id: k4
        name: K4 integration tests
        when: {check: K4}
        command: test_integration
        template: workflows/steps/repo-command.yml
      - id: k5
        name: K5 acceptance tests
        when: {check: K5}
        command: test_acceptance
        template: workflows/steps/repo-command.yml
      - id: k8
        name: K8 architecture fitness
        when: {check: K8}
        command: architecture
        template: workflows/steps/repo-command.yml
      - id: k11
        name: K11 property and fuzz tests
        when: {check: K11}
        command: property
        template: workflows/steps/repo-command.yml
      - id: k12
        name: K12 differential tests
        when: {check: K12}
        command: differential
        template: workflows/steps/repo-command.yml
      - id: k10                              # last: mutation testing is the slowest check
        name: K10 mutation score
        when: {check: K10}
        command: mutation
        template: workflows/steps/k10-mutation.yml

  - id: trigger.label
    kind: ci-job
    trigger: label
    purpose: Start the first role of the profile when a human adds the trigger label to an issue.
    principle: [P6, P9]
    template: workflows/trigger-label.yml
    parts: {run_role: workflows/parts/run-role.yml, frame_report: workflows/parts/frame-report.yml}
    target: .github/workflows/cornerstone-$profile-label.yml
    eval: evals/trigger-label/

  - id: trigger.schedule
    kind: ci-job
    trigger: schedule
    purpose: Start the first role of the profile on its schedule. Post its report as an issue.
    principle: [P6, P9]
    template: workflows/trigger-schedule.yml
    parts: {run_role: workflows/parts/run-role.yml, frame_report: workflows/parts/frame-report.yml}
    target: .github/workflows/cornerstone-$profile-schedule.yml
    eval: evals/trigger-schedule/

  - id: trigger.issue-opened
    kind: ci-job
    trigger: ci:issue-opened
    purpose: Start the first role of the profile on each new issue. Post its report on the issue.
    principle: [P6, P9]
    template: workflows/trigger-issue-opened.yml
    parts: {run_role: workflows/parts/run-role.yml, frame_report: workflows/parts/frame-report.yml}
    target: .github/workflows/cornerstone-$profile-issue-opened.yml
    # Anyone can open an issue. The run job has no write token, so the action may start for them.
    values: {allowed_non_write_users: "*"}
    eval: evals/trigger-issue-opened/

  - id: trigger.dependency-pr
    kind: ci-job
    trigger: ci:dependency-pr
    purpose: Start the first role of the profile when a dependency bot opens a PR. Post its report on the PR.
    principle: [P6, P9]
    template: workflows/trigger-dependency-pr.yml
    parts: {run_role: workflows/parts/run-role.yml, frame_report: workflows/parts/frame-report.yml}
    target: .github/workflows/cornerstone-$profile-dependency-pr.yml
    values: {allowed_bots: "dependabot[bot],renovate[bot]"}
    eval: evals/trigger-dependency-pr/

  - id: check.k16
    kind: ci-job
    purpose: K16. Fail a pull request from a spike branch into the main or integration branch (D30, D33).
    principle: [P2, P6]
    when: {check: K16}
    template: workflows/cornerstone-k16.yml
    target: .github/workflows/cornerstone-k16.yml
    eval: evals/check-k16/