Keep controller checks and demo evidence in the canonical repository

.github/workflows/dead-code.yml

@@ -0,0 +1,19 @@
+name: Dead code
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  dead-code:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: astral-sh/setup-uv@v7
+      - run: bash scripts/check-dead-code.sh

.github/workflows/product-validation.yml

@@ -0,0 +1,41 @@
+name: Product validation
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - run: python3 scripts/validate-poc.py
+      - name: Preserve exact-commit validation receipt
+        if: always()
+        run: |
+          python3 - <<'PY'
+          import json, os
+          from pathlib import Path
+          result = Path('.evidence/result.json')
+          if not result.is_file():
+              raise SystemExit('Required exact-commit receipt is missing')
+          data = json.loads(result.read_text())
+          text = '## Product validation\n\n```json\n' + json.dumps(data, indent=2) + '\n```\n'
+          with open(os.environ['GITHUB_STEP_SUMMARY'], 'a') as summary:
+              summary.write(text)
+          print(text)
+          for validator in data['validators']:
+              if validator['status'] != 'passed':
+                  print(Path(validator['log']).read_text())
+          PY

.gitignore

@@ -2,3 +2,4 @@ __pycache__/
 *.pyc
 .env
 .alpha/
+.evidence/

CONTRIBUTING.md

@@ -4,4 +4,4 @@ Start with the user outcome, a reproducible example, and acceptance checks. Keep
 
 Open an issue or draft PR with expected and actual behavior, source revision, runtime, a minimal reproduction, and redacted check results. Never include account caches, private tickets, customer data, or credentials. Native integration checks require your own documented host prerequisites and account; simulations must be labeled.
 
-For source changes, run Python compilation and the relevant synthetic demo checks. Add a focused regression test for changed behavior. The maintainer decides merges and releases. This experimental alpha has no production-support commitment.
+For source changes, run `python3 scripts/validate-poc.py` and `bash scripts/check-dead-code.sh` (the latter uses pinned Vulture 2.16 through `uvx`). Validation covers controller regression tests, Python compilation, and the preserved synthetic demo, with a receipt under `.evidence`. A dirty checkout is labeled blocked for exact-commit validation; commit the reviewed change and rerun before publication. Add a focused regression test for changed behavior. The maintainer decides merges and releases. This experimental alpha has no production-support commitment.

README.md

@@ -47,6 +47,8 @@ Pi's full profile uses its existing extensions. Other agents keep their own tool
 
 ## Support and license
 
+This is the canonical development repository for Autonomous Development. Controller tests, source packaging, operating services, and the preserved synthetic demo are maintained here. Run `python3 scripts/validate-poc.py` and `bash scripts/check-dead-code.sh` before opening a pull request; GitHub runs these checks on pull requests and on `main`.
+
 Maintained by Hudson Aikins / IntelIP. Use [issues](https://github.com/IntelIP/autonomous-development/issues) for redacted bugs and reproducible examples. No response-time or production-support commitment is made. See [SECURITY.md](SECURITY.md) for sensitive reports.
 
 Project source and the five explicitly identified bundled worker files use [Apache License 2.0](LICENSE). The export contains no private ticket records, account caches, or private repository history.

controller/autonomous-development-pilot@.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Autonomous Development supervised approved packet %i
+After=network-online.target docker.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=oneshot
+User=root
+SetLoginEnvironment=yes
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+WorkingDirectory=/opt/AutonomousDevelopment
+ExecStartPre=/usr/bin/python3 /opt/AutonomousDevelopment/controller/control.py recover
+ExecStart=/usr/bin/python3 /opt/AutonomousDevelopment/controller/engineering.py run --pilot --packet /var/lib/autonomous-development/queue/%i.json
+ExecStopPost=/usr/bin/python3 /opt/AutonomousDevelopment/controller/control.py recover
+TimeoutStartSec=3670
+KillMode=control-group
+UMask=0077

controller/autonomous-development.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Autonomous Development approved story runner
+After=network-online.target docker.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=oneshot
+User=root
+SetLoginEnvironment=yes
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+WorkingDirectory=/opt/AutonomousDevelopment
+ExecStartPre=/usr/bin/python3 /opt/AutonomousDevelopment/controller/control.py recover
+ExecStart=/usr/bin/python3 /opt/AutonomousDevelopment/controller/control.py scheduled
+ExecStopPost=/usr/bin/python3 /opt/AutonomousDevelopment/controller/control.py recover
+TimeoutStartSec=3670
+KillMode=control-group
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

controller/autonomous-development.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Check approved Autonomous Development queue
+
+[Timer]
+OnBootSec=2min
+OnCalendar=*-*-* *:0/15:00 America/New_York
+Persistent=true
+Unit=autonomous-development.service
+
+[Install]
+WantedBy=timers.target

docs/published-source-demo.md

@@ -8,7 +8,7 @@ The published alpha.3 controller and a freshly built generic Codex worker comple
 - Run: `bdb59c6b615c63bf`, September 30, 02:01:20–02:02:22 UTC.
 - Independent check: `python3 checks.py`, exit 0. Empty, positive, and mixed-sign examples passed.
 - Lead review: approved commit `4e77b8d42fe474c0a83e84e25f4c5eea8f776add`, no findings.
-- Result: [draft PR #1](https://github.com/IntelIP/autonomous-development-alpha-demo/pull/1), one line changed in `sample.py`. Human merge authority retained.
+- Result: a draft PR with one line changed in `sample.py`, subsequently merged by the operator on September 29 at 10:40 PM Eastern. The [fixture, repair diff, and historical receipt](../tests/fixtures/published-demo/receipt.json) preserve the result in this repository. Human merge authority retained.
 
 ## Operator repairs before success
 

scripts/check-dead-code.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/.."
+py_files=()
+while IFS= read -r -d '' file; do py_files+=("$file"); done < <(git ls-files --cached --others --exclude-standard -z -- '*.py')
+if ((${#py_files[@]})); then uvx --from vulture==2.16 vulture "${py_files[@]}" --min-confidence 90; fi

scripts/package-alpha.py

@@ -19,6 +19,15 @@
     'README.md', 'CONTRIBUTING.md', 'SECURITY.md', 'docs/releases.md',
     'docs/executable-tickets.md', 'docs/engineering.md', 'docs/overnight-pilot.md',
     'controller/overnight.py', 'controller/autonomous-development-overnight@.service',
+    'controller/autonomous-development.service', 'controller/autonomous-development.timer',
+    'controller/autonomous-development-pilot@.service',
+    'scripts/validate-poc.py', 'scripts/check-dead-code.sh', 'tabellio.validation.json',
+    '.github/workflows/product-validation.yml', '.github/workflows/dead-code.yml',
+    'tests/test_control.py', 'tests/test_engineering.py', 'tests/test_overnight.py',
+    'tests/test_package.py', 'tests/test_pi_inference.py', 'tests/test_portable_runtime.py',
+    'tests/test_recovery.py', 'tests/lead_gateway.test.mjs',
+    'tests/fixtures/published-demo/sample.py', 'tests/fixtures/published-demo/checks.py',
+    'tests/fixtures/published-demo/repair.patch', 'tests/fixtures/published-demo/receipt.json',
 )
 WORKER = (
     'agent/run-worker.py', 'agent/worker_protocol.py', 'agent/Dockerfile.runtime',

scripts/validate-poc.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+"""Persist each static validator invocation, including failed commands."""
+import json
+from pathlib import Path
+import subprocess
+import time
+
+root=Path(__file__).resolve().parents[1]
+head=subprocess.check_output(['git','rev-parse','HEAD'],cwd=root,text=True).strip()
+dirty=bool(subprocess.check_output(['git','status','--porcelain'],cwd=root,text=True).strip())
+manifest=json.loads((root/'tabellio.validation.json').read_text())
+results=[]
+for validator in manifest['validators']:
+    start=time.time()
+    path=root/validator['evidence']['path'];path.parent.mkdir(parents=True,exist_ok=True)
+    try:
+        result=subprocess.run(validator['argv'],cwd=root/validator['cwd'],capture_output=True,text=True,timeout=validator['timeoutMs']/1000)
+        log=result.stdout+'\n'+result.stderr;status='passed' if result.returncode==0 else 'failed'
+    except Exception as error:log=str(error);status='blocked'
+    path.with_suffix('.log').write_text(log)
+    evidence={'validatorId':validator['id'],'headSha':head,'sourceDirty':dirty,'status':status,'elapsedSeconds':time.time()-start,'log':str(path.with_suffix('.log').relative_to(root))}
+    path.write_text(json.dumps(evidence,indent=2)+'\n');results.append(evidence)
+    print(validator['id'],status)
+status='failed' if any(r['status']=='failed' for r in results) else 'blocked' if dirty or any(r['status']=='blocked' for r in results) else 'passed'
+(root/'.evidence/result.json').write_text(json.dumps({'headSha':head,'sourceDirty':dirty,'status':status,'reason':'Uncommitted source changes; exact-commit validation requires a clean checkout' if dirty and status=='blocked' else None,'validators':results},indent=2)+'\n')
+raise SystemExit(0 if status=='passed' else 1)

tabellio.validation.json

@@ -0,0 +1,97 @@
+{
+  "schemaVersion": "tabellio-validation/v0.2",
+  "id": "autonomous-development-consolidation",
+  "requireEntireCheckpoint": false,
+  "failFast": true,
+  "acceptance": {
+    "id": "single-maintained-public-repository",
+    "source": "README.md",
+    "risk": "medium",
+    "outcomes": [
+      "Controller regression and authority checks remain runnable in the public source",
+      "The historical synthetic repair and its checks remain reproducible locally",
+      "Source releases preserve the maintenance tools and checks"
+    ],
+    "invariants": [
+      "Human approval of exact execution packets",
+      "Human merge and deployment authority",
+      "No private ticket or account-cache publication",
+      "No model calls or paid validation runs"
+    ],
+    "forbiddenOutcomes": [
+      "Lost outstanding website work",
+      "Silent approval changes",
+      "Deletion before runtime and hosted checks pass"
+    ],
+    "requiredValidatorTypes": [
+      "static"
+    ]
+  },
+  "validators": [
+    {
+      "id": "controller-contract",
+      "type": "static",
+      "argv": [
+        "python3",
+        "-m",
+        "unittest",
+        "discover",
+        "-s",
+        "tests",
+        "-p",
+        "test_*.py",
+        "-v"
+      ],
+      "cwd": ".",
+      "timeoutMs": 180000,
+      "required": true,
+      "evidence": {
+        "path": ".evidence/controller-contract.json"
+      },
+      "policy": {
+        "metricThresholds": [],
+        "maxCostUsd": null,
+        "requireCostTelemetry": false
+      }
+    },
+    {
+      "id": "source-compilation",
+      "type": "static",
+      "argv": [
+        "python3",
+        "-c",
+        "import pathlib,py_compile; [py_compile.compile(str(p),doraise=True) for name in ('controller','agent','scripts') for p in pathlib.Path(name).rglob('*.py')]"
+      ],
+      "cwd": ".",
+      "timeoutMs": 60000,
+      "required": true,
+      "evidence": {
+        "path": ".evidence/source-compilation.json"
+      },
+      "policy": {
+        "metricThresholds": [],
+        "maxCostUsd": null,
+        "requireCostTelemetry": false
+      }
+    },
+    {
+      "id": "preserved-demo",
+      "type": "static",
+      "argv": [
+        "python3",
+        "tests/fixtures/published-demo/checks.py"
+      ],
+      "cwd": ".",
+      "timeoutMs": 30000,
+      "required": true,
+      "evidence": {
+        "path": ".evidence/preserved-demo.json"
+      },
+      "policy": {
+        "metricThresholds": [],
+        "maxCostUsd": null,
+        "requireCostTelemetry": false
+      }
+    }
+  ]
+}

tests/fixtures/published-demo/checks.py

@@ -0,0 +1,6 @@
+import json
+from pathlib import Path
+from sample import summarize
+assert summarize([]) == {"count": 0, "total": 0}
+assert summarize([1, 2, 3]) == {"count": 3, "total": 6}
+assert summarize([-2, 5]) == {"count": 2, "total": 3}

tests/fixtures/published-demo/receipt.json

@@ -0,0 +1,41 @@
+{
+  "schemaVersion": 1,
+  "classification": "historical supervised synthetic workflow",
+  "sourceRepository": "IntelIP/autonomous-development-alpha-demo",
+  "seedCommit": "27d73c9fbd580df35a2a69aa2fb2044e0563426f",
+  "candidateCommit": "4e77b8d42fe474c0a83e84e25f4c5eea8f776add",
+  "mergedCommit": "5ed0e14fd4e57b6ea63d4026bbe8ffd3a77fc2bc",
+  "createdAt": "2026-09-30T02:02:22Z",
+  "mergedAt": "2026-09-30T02:40:59Z",
+  "originalPullRequestUrl": "https://github.com/IntelIP/autonomous-development-alpha-demo/pull/1",
+  "runId": "bdb59c6b615c63bf",
+  "controllerSource": "8a6c8f029fedb0947c080dbbe3641e0b2411a60b",
+  "worker": {
+    "runtime": "Codex",
+    "version": "0.155.1",
+    "model": "gpt-6-sol",
+    "profile": "minimal"
+  },
+  "leadReview": {
+    "approved": true,
+    "headSha": "4e77b8d42fe474c0a83e84e25f4c5eea8f776add"
+  },
+  "checks": {
+    "command": [
+      "python3",
+      "checks.py"
+    ],
+    "exitCode": 0,
+    "cases": [
+      "empty",
+      "positive integers",
+      "mixed-sign integers"
+    ]
+  },
+  "limitations": [
+    "Existing authenticated Windows WSL host",
+    "Operator setup repairs required",
+    "Synthetic example; not a fresh-host or repeated-reliability claim"
+  ],
+  "recordSource": "Published source demo record and exported GitHub PR metadata"
+}

tests/fixtures/published-demo/repair.patch

@@ -0,0 +1,13 @@
+diff --git a/sample.py b/sample.py
+index d396595..de60d26 100644
+--- a/sample.py
++++ b/sample.py
+@@ -2,7 +2,7 @@
+ import json
+
+ def summarize(values):
+-    return {"count": len(values), "total": len(values)}
++    return {"count": len(values), "total": sum(values)}
+
+ if __name__ == "__main__":
+     print(json.dumps(summarize([1, 2, 3]), sort_keys=True))

tests/fixtures/published-demo/sample.py

@@ -0,0 +1,8 @@
+"""Demonstration data: summarize a list of integers."""
+import json
+
+def summarize(values):
+    return {"count": len(values), "total": sum(values)}
+
+if __name__ == "__main__":
+    print(json.dumps(summarize([1, 2, 3]), sort_keys=True))