Initial commit: Agent Governance System Phase 8

Phase 8 Production Hardening with complete governance infrastructure:

- Vault integration with tiered policies (T0-T4)
- DragonflyDB state management
- SQLite audit ledger
- Pipeline DSL and templates
- Promotion/revocation engine
- Checkpoint system for session persistence
- Health manager and circuit breaker for fault tolerance
- GitHub/Slack integrations
- Architectural test pipeline with bug watcher, suggestion engine, council review
- Multi-agent chaos testing framework

Test Results:
- Governance tests: 68/68 passing
- E2E workflow: 16/16 passing
- Phase 2 Vault: 14/14 passing
- Integration tests: 27/27 passing

Coverage: 57.6% average across 12 phases

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

pipeline/templates/README.md

@@ -0,0 +1,35 @@
+# Templates
+
+> Configuration and pipeline templates
+
+## Overview
+
+This directory contains configuration and pipeline templates.
+
+## Key Files
+
+| File | Description |
+|------|-------------|
+| `code-review.yaml` | Configuration |
+| `ansible.yaml` | Configuration |
+| `default.yaml` | Configuration |
+| `terraform.yaml` | Configuration |
+
+## Interfaces / APIs
+
+*Document any APIs, CLI commands, or interfaces here.*
+
+## Status
+
+** Not Started**
+
+See [STATUS.md](./STATUS.md) for detailed progress tracking.
+
+## Architecture Reference
+
+Part of the [Agent Governance System](/opt/agent-governance/docs/ARCHITECTURE.md).
+
+Parent: [Pipeline](..)
+
+---
+*Last updated: 2026-01-23 23:25:09 UTC*

pipeline/templates/STATUS.md

@@ -0,0 +1,30 @@
+# Status: Templates
+
+## Current Phase
+
+** NOT STARTED**
+
+## Tasks
+
+| Status | Task | Updated |
+|--------|------|---------|
+| ☐ | *No tasks defined* | - |
+
+## Dependencies
+
+*No external dependencies.*
+
+## Issues / Blockers
+
+*No current issues or blockers.*
+
+## Activity Log
+
+### 2026-01-23 23:25:09 UTC
+- **Phase**: NOT STARTED
+- **Action**: Initialized
+- **Details**: Status tracking initialized for this directory.
+
+
+---
+*Last updated: 2026-01-23 23:25:09 UTC*

pipeline/templates/ansible.yaml

@@ -0,0 +1,41 @@
+name: ansible
+description: Ansible configuration management specialist agent
+version: "1.0.0"
+
+tier: 1
+role: operator
+
+allowed_actions:
+  - read_docs
+  - read_inventory
+  - generate_plan
+  - ansible_check
+  - ansible_run_sandbox
+  - ansible_vault_view
+
+forbidden_actions:
+  - ansible_run_prod
+  - ansible_vault_edit
+  - direct_shell_access
+
+default_config:
+  inventory: /opt/agent-governance/inventory/sandbox.yml
+  playbook_dir: /opt/agent-governance/sandbox/ansible
+  check_mode_first: true
+  diff_mode: true
+  timeout: 300
+
+preflight_checks:
+  - ansible_installed
+  - inventory_accessible
+  - ssh_keys_valid
+
+evidence_collection:
+  - check_output
+  - diff_output
+  - task_results
+
+error_budget:
+  max_total_errors: 5
+  max_same_error_repeats: 2
+  max_procedure_violations: 1

pipeline/templates/code-review.yaml

@@ -0,0 +1,58 @@
+name: code-review
+description: Code review specialist agent
+version: "1.0.0"
+
+tier: 0
+role: observer
+
+allowed_actions:
+  - read_docs
+  - read_code
+  - analyze_code
+  - generate_review
+  - suggest_improvements
+
+forbidden_actions:
+  - modify_code
+  - commit_changes
+  - push_changes
+
+default_config:
+  languages:
+    - python
+    - typescript
+    - go
+    - bash
+  review_focus:
+    - security
+    - performance
+    - maintainability
+    - governance_compliance
+  max_files: 50
+  max_lines_per_file: 2000
+
+review_criteria:
+  security:
+    - sql_injection
+    - command_injection
+    - xss_vulnerability
+    - hardcoded_secrets
+    - insecure_dependencies
+  governance:
+    - audit_logging
+    - error_handling
+    - input_validation
+    - confidence_reporting
+
+output_format:
+  type: structured
+  sections:
+    - summary
+    - findings
+    - recommendations
+    - governance_compliance_score
+
+error_budget:
+  max_total_errors: 8
+  max_same_error_repeats: 3
+  max_procedure_violations: 1

pipeline/templates/default.yaml

@@ -0,0 +1,28 @@
+name: default
+description: Default generic agent template
+version: "1.0.0"
+
+tier: 0
+role: observer
+
+allowed_actions:
+  - read_docs
+  - read_inventory
+  - read_logs
+  - generate_plan
+
+forbidden_actions:
+  - execute_shell
+  - ssh_connect
+  - modify_files
+  - terraform_apply
+  - ansible_run
+
+default_config:
+  timeout: 300
+  max_iterations: 10
+
+error_budget:
+  max_total_errors: 8
+  max_same_error_repeats: 2
+  max_procedure_violations: 1

pipeline/templates/terraform.yaml

@@ -0,0 +1,41 @@
+name: terraform
+description: Terraform infrastructure specialist agent
+version: "1.0.0"
+
+tier: 1
+role: operator
+
+allowed_actions:
+  - read_docs
+  - read_inventory
+  - generate_plan
+  - terraform_init
+  - terraform_plan
+  - terraform_apply_sandbox
+
+forbidden_actions:
+  - terraform_apply_prod
+  - terraform_destroy
+  - direct_shell_access
+
+default_config:
+  working_dir: /opt/agent-governance/sandbox/terraform
+  state_backend: local
+  auto_approve: false
+  plan_timeout: 300
+  apply_timeout: 600
+
+preflight_checks:
+  - terraform_installed
+  - backend_accessible
+  - credentials_valid
+
+evidence_collection:
+  - plan_output
+  - state_diff
+  - resource_changes
+
+error_budget:
+  max_total_errors: 5
+  max_same_error_repeats: 2
+  max_procedure_violations: 1