Phase 0 — Autonomous Engineering Bootstrap

Create the GitHub-native engineering foundation for Web Components 2.0 / shell-web-components, without implementing any Web Component.

Product charter

• Organization: The AI WC Factory (The-AI-WC-Factory).
• Public repository: shell-web-components; MIT license.
• Purpose: standards-based Web Components library for modern evergreen browsers.
• Distribution: npm; tentative package @ai-factored/shell-web-components. Scope ownership must be verified before publication.
• Humans provide product goals, priorities, acceptance criteria, and organizational/account consent only. AI performs all engineering architecture, design, implementation, testing, security, documentation, review, and release work.
• Git Flow is mandatory: main, develop, feature/*, release/*, hotfix/*.

Acceptance criteria

• Organization Project links this Issue and bootstrap PR, with status and phase tracking.
• Product charter, agent instructions, contribution/security policies, issue forms and PR template exist.
• main and develop exist; bootstrap changes are proposed through an Issue-linked feature PR.
• Active rulesets require PRs, deterministic CI and independent AI review; forbid force pushes and deletion.
• Actions use minimal token permissions, immutable action pins and bounded artifact retention.
• CI validates governance and branch routing and records reproducible evidence artifacts.
• Independent AI reviewer is connected and produces evidence for the current PR head; humans do not review code.
• Security scanning and dependency maintenance are configured where supported.
• Release policy defines stabilization/back-merges, versioning, npm trusted publication, SBOM and attestations. No package or release is published in Phase 0.
• Bootstrap checks pass and AI review passes; governance is merged into develop, then promoted to main through a bootstrap-only PR exception.
• No component source code, demo, package implementation or feature architecture was added.

Execution

AI agents own every technical task. Keep this Issue open until all criteria are verified. Report blocked platform permissions, reviewer provisioning and npm scope ownership explicitly. Do not substitute human engineering approval or fabricate checks.

Verified bootstrap progress (2026-10-05)

• Public MIT repository created; main and develop seeded.
• Organization Project: public, default repository linked, Status and Phase fields configured, Issue Bootstrap the autonomous AI-DLC engineering system #1 and PR chore: bootstrap AI-operated engineering governance #2 both In Progress / Phase 0.
• Governance PR #2: feature/1-ai-dlc-bootstrap → develop, AI-authored, ready for independent review.
• Deterministic CI: PASS, evidence artifact uploaded. This validates scaffold policies, not component behavior.
• Active rulesets: protected Git Flow branches (24470179) and immutable v* release tags (24470182). No bypass actors; merge commits only; one approval plus governance and independent-ai-review checks required.
• Copilot review requested; automatic review on new pushes/drafts configured.
• Secret scanning, push protection, Dependabot security updates, private vulnerability reporting, and read-only default Actions tokens enabled.
• Governance files and future release/SBOM/OIDC/attestation requirements are proposed in PR chore: bootstrap AI-operated engineering governance #2. No components, tags, releases or npm publication.

Ownership and consistency audit (2026-10-06)

Repository transferred to glyad with identical original branch hashes and Issue/PR identities. MIT, milestone #1 assignments, active branch/tag rulesets, read-only Actions permissions, security scanning/push protection, Dependabot updates, private reporting and evidence artifacts verified. No secrets, webhooks, environments or deploy keys exist.

Personal Project: Web Components 2.0 — AI-DLC — copied views/fields/insights and six workflows; restored both items, In Progress status, Phase 0 values, charter, default repository and public visibility. Original organization Project retained to preserve original activity history; copy cannot preserve Project identity or activity history.

PR #2 has a verified native Development link to this Issue. Ownership/security URL corrections and the mandatory native Issue-link rule are in commit 1cea685.

Remaining blocker: Copilot Pro and approval permission are now available. Copilot completed a Balanced review of PR #2 and reported six findings (review 5427351853). Fixes/handoff documentation are in commit 630db08; re-review requested. Native approval trust still requires an independent verifier App: PR-controlled Actions may impersonate the required check. The bootstrap must remain blocked until the trusted verifier and App-bound ruleset check are installed and verified. No engineering approval may be replaced by a human, and no ruleset bypass is permitted.