Phase 0: reconcile baseline, add AG-002, and establish Backend CI

[vib-tools]

Summary

This Phase 0 pull request reconciles the locked YGIT engineering baseline, adds AG-002 — Repository Provider Gate as an isolated Repository Engine decision contract, establishes the initial Backend CI workflow, and closes the related documentation/status evidence.

The change preserves the current architecture and default-disabled provider-execution boundary. The final read-only audit, explicit Ready-for-review authorization, and Draft-to-Ready transition are complete. This state does not authorize merge, branch protection, deployment, or the next MVP implementation area.

Repository state

Repository: vibtools/ygit
Base branch: main
Locked base SHA: b9019b79d1af3fe73d1a74769792ebb6958c4f4c
Head branch: phase0/baseline-reconciliation-ag002
Final head SHA: 06071e5f41c5b727edc620469a1c0504b7a1676b
Feature commits: 7
Changed files: 15
PR state: OPEN / READY / UNMERGED

Commit history

1. 2fca99ad18994a72c32939e7affd35ea6d3fbd5a — Add AG-002 repository provider gate and reconcile baseline
2. d89e0d8101acf4ba05dccfd4083bdc8f6915897f — Fix Phase 0 manifest evidence formatting
3. 9ea20663f990fe924f5b4933c7ca8a4450e0fdbb — Add backend CI documentation set
4. eb9dd93a19cf28d9453afe2d5646ba7826dd517a — Correct backend CI resolver contract
5. f55de64d198df64d9f1fce5ea32590ab4b4c4a99 — Stabilize backend CI head precondition
6. 7f383ba6b0c17b92de9a27e0abe4cbeb8adbbac2 — Add backend CI validation workflow
7. 06071e5f41c5b727edc620469a1c0504b7a1676b — Record Backend CI implementation and verification

Exact changed-file scope

.env.example
.github/workflows/backend-ci.yml
AUDIT_REPORT.md
CHANGELOG.md
CONTRACT_MANIFEST.json
PROJECT_STATUS.md
README.md
VERSION.json
backend/engines/repository_engine/repository_provider_gate.py
backend/tests/test_ag_002_repository_provider_gate.py
backend/tests/test_repository_analysis_current_state_audit.py
docs/architecture/AG_002_REPOSITORY_PROVIDER_GATE.md
docs/ci/BACKEND_CI_IMPLEMENTATION_PLAN.md
docs/ci/BACKEND_CI_SPECIFICATION.md
docs/ci/BACKEND_CI_TESTING_AND_ROLLBACK_SPECIFICATION.md

Baseline reconciliation

• Records the immutable running baseline at b9019b79d1af3fe73d1a74769792ebb6958c4f4c.
• Reconciles the authoritative current-state documents and machine-readable manifests.
• Updates .env.example with explicit default-disabled GitHub webhook and worker provider-execution settings.
• Replaces a stale exact historical test-count assertion with current-evidence validation.
• Records the current suite identifier as 579_passed_1_warning.

AG-002 boundary

AG-002 is a pure Repository Engine provider-selection contract:

Missing / empty / whitespace provider → github
Explicit provider → selected provider

AG-002 is foundation-ready and not runtime-wired. The current Repository Engine service continues to use the existing GitHub path.

This PR does not:

• add a provider adapter;
• change repository URL parsing, metadata acquisition, persistence, or analysis input;
• add API routes, database models, or migrations;
• change Worker Runtime, Deploy Engine, Deploy Pipeline, or Cloudflare execution;
• enable GitLab, Bitbucket, Azure DevOps, or another repository provider;
• execute provider operations.

Backend CI contract

Workflow file: .github/workflows/backend-ci.yml
Workflow: Backend CI
Job ID: validate
Job name: Validate
Stable status: Backend CI / Validate
Triggers: pull_request to main; push to main
Permissions: contents read
Runner: GitHub-hosted Ubuntu
Python: 3.12
MyPy required gate: DEFERRED
Provider execution: DISABLED
Production secrets: NOT USED
Deployment action: ABSENT

The required validation path is:

Checkout
→ Python setup
→ Dependency installation
→ Compilation
→ MyPy deferral audit
→ Baseline-aware changed-file Ruff
→ Full pytest suite
→ Smoke --skip-db
→ Release gate --skip-db

Validation evidence

Initial workflow implementation

Workflow commit: 7f383ba6b0c17b92de9a27e0abe4cbeb8adbbac2
Run ID: 30061513976
Validate job ID: 89383928195
Event: pull_request
Conclusion: success

Documentation/status closure

Final head: 06071e5f41c5b727edc620469a1c0504b7a1676b
Run ID: 30096212556
Validate job ID: 89490793519
Event: pull_request
Required status: Backend CI / Validate
Conclusion: success

Local controlled validation

• Python compilation: PASS
• Approved scoped Ruff: PASS
• AG-002 regression: 9 passed
• Full suite: 579 passed, 1 warning
• Smoke test with database skipped: PASS
• Release gate with database skipped: PASS
• Architecture boundaries: PASS
• Basic secret scan: PASS

The remaining warning is the existing non-blocking Starlette TestClient deprecation warning.

Security and deployment impact

API change: NO
Database change: NO
Migration: NO
Provider execution: NO
Production secrets used: NO
Deployment performed: NO
Main updated: NO
Branch protection changed: NO
Auto-merge enabled: NO
Merge performed: NO
Coolify redeploy required: NO

Completed controlled gates

1. Final read-only Phase 0 PR forensic audit — COMPLETE / PASS.
2. Explicit Ready-for-review authorization — COMPLETE.
3. Draft-to-Ready transition — COMPLETE.
4. Post-Ready PR metadata reconciliation — COMPLETE.

Remaining controlled gates

1. Perform a final pre-merge read-only gate.
2. Obtain explicit merge authorization.
3. Perform a controlled merge without automatic merge behavior.
4. Verify the push-triggered Backend CI / Validate result on the resulting main commit.
5. Record Phase 0 completion.
6. Consider branch-protection enforcement only through a separate approved specification and change.

Review gate

Keep this pull request open, Ready for review, and unmerged until explicit merge authorization is received. Do not enable auto-merge and do not merge automatically.