feat: full pipeline fixes - CI status branch lookup, review webhook routing, auto-advance, plane sync

- handle_ci_status: fallback git branch -r --contains when branches[] empty
- webhook router: handle pull_request_approved event type
- handle_pr: map review.type to review.state for new Gitea format
- launcher: auto-advance stage after agent completion (_try_advance_stage)
- plane_sync: notify Plane on stage changes
- stages.py: stage machine with QG definitions
- notifications.py: stage change notifications
- safe.directory fix for container git operations

src/qg/checks.py

@@ -1,26 +1,147 @@
-# Quality Gate checks placeholder
-# Will be expanded as pipeline matures
+"""Quality Gate checks — real implementations using Gitea/Plane API and filesystem."""
+
+import os
+import logging
+import httpx
+from ..config import settings
+
+logger = logging.getLogger("orchestrator.qg")
+
+# Shared httpx client config
+GITEA_HEADERS = {"Authorization": f"token {settings.gitea_token}"}
+GITEA_BASE = f"{settings.gitea_url}/api/v1"
 
 
-def check_analysis_complete(task_id: int) -> bool:
-    """Check if analysis artifacts exist."""
-    # TODO: verify .task-arch.md exists in repo
-    return True
+def check_analysis_complete(repo: str, work_item_id: str) -> tuple[bool, str]:
+    """
+    Check if analysis artifacts exist in the repo branch.
+    Required files:
+      - docs/work-items/<work_item_id>/01-brd.md
+      - docs/work-items/<work_item_id>/02-trz.md
+      - docs/work-items/<work_item_id>/03-acceptance-criteria.md
+      - docs/work-items/<work_item_id>/04-test-plan.yaml
+    """
+    required_files = [
+        f"docs/work-items/{work_item_id}/01-brd.md",
+        f"docs/work-items/{work_item_id}/02-trz.md",
+        f"docs/work-items/{work_item_id}/03-acceptance-criteria.md",
+        f"docs/work-items/{work_item_id}/04-test-plan.yaml",
+    ]
+
+    repo_path = os.path.join(settings.repos_dir, repo)
+    missing = []
+
+    for f in required_files:
+        full_path = os.path.join(repo_path, f)
+        if not os.path.isfile(full_path):
+            missing.append(f)
+
+    if missing:
+        return False, f"Missing files: {', '.join(missing)}"
+    return True, "All analysis artifacts present"
 
 
-def check_architecture_approved(task_id: int) -> bool:
-    """Check if architecture was approved in Plane."""
-    # TODO: check Plane comment for :approved:
-    return False
+def check_architecture_done(repo: str, work_item_id: str) -> tuple[bool, str]:
+    """
+    Check if architecture artifacts exist.
+    Required: docs/work-items/<work_item_id>/06-adr/ (at least 1 file)
+    OR: docs/work-items/<work_item_id>/07-infra-requirements.md
+    """
+    repo_path = os.path.join(settings.repos_dir, repo)
+
+    adr_dir = os.path.join(repo_path, f"docs/work-items/{work_item_id}/06-adr")
+    infra_file = os.path.join(repo_path, f"docs/work-items/{work_item_id}/07-infra-requirements.md")
+
+    if os.path.isdir(adr_dir) and len(os.listdir(adr_dir)) > 0:
+        return True, "ADR directory exists with files"
+
+    if os.path.isfile(infra_file):
+        return True, "Infra requirements file exists"
+
+    return False, "No ADR directory or infra-requirements.md found"
 
 
-def check_ci_green(repo: str, branch: str) -> bool:
-    """Check if CI status is green for branch."""
-    # TODO: query Gitea commit status API
-    return False
+def check_ci_green(repo: str, branch: str) -> tuple[bool, str]:
+    """
+    Check if CI status is green for branch via Gitea API.
+    GET /repos/{owner}/{repo}/commits/{branch}/status
+    """
+    owner = settings.gitea_owner
+    url = f"{GITEA_BASE}/repos/{owner}/{repo}/commits/{branch}/status"
+
+    try:
+        resp = httpx.get(url, headers=GITEA_HEADERS, timeout=10)
+        if resp.status_code == 404:
+            return False, f"Branch '{branch}' not found or no status"
+        resp.raise_for_status()
+        data = resp.json()
+        state = data.get("state", "unknown")
+        if state == "success":
+            return True, "CI green"
+        return False, f"CI state: {state}"
+    except httpx.HTTPError as e:
+        logger.error(f"Gitea API error checking CI: {e}")
+        return False, f"API error: {e}"
 
 
-def check_review_approved(repo: str, pr_number: int) -> bool:
-    """Check if PR has approved review."""
-    # TODO: query Gitea PR reviews API
-    return False
+def check_review_approved(repo: str, pr_number: int) -> tuple[bool, str]:
+    """
+    Check if PR has at least one approved review and no request_changes.
+    GET /repos/{owner}/{repo}/pulls/{pr_number}/reviews
+    """
+    owner = settings.gitea_owner
+    url = f"{GITEA_BASE}/repos/{owner}/{repo}/pulls/{pr_number}/reviews"
+
+    try:
+        resp = httpx.get(url, headers=GITEA_HEADERS, timeout=10)
+        resp.raise_for_status()
+        reviews = resp.json()
+
+        approved = 0
+        changes_requested = 0
+        for review in reviews:
+            state = review.get("state", "").upper()
+            if state == "APPROVED":
+                approved += 1
+            elif state == "REQUEST_CHANGES":
+                changes_requested += 1
+
+        if changes_requested > 0:
+            return False, f"Changes requested ({changes_requested} reviews)"
+        if approved > 0:
+            return True, f"Approved ({approved} reviews)"
+        return False, "No reviews yet"
+    except httpx.HTTPError as e:
+        logger.error(f"Gitea API error checking reviews: {e}")
+        return False, f"API error: {e}"
+
+
+def check_tests_passed(repo: str, work_item_id: str) -> tuple[bool, str]:
+    """
+    Check if test report exists and contains PASS indicator.
+    File: docs/work-items/<work_item_id>/13-test-report.md
+    """
+    repo_path = os.path.join(settings.repos_dir, repo)
+    report_path = os.path.join(repo_path, f"docs/work-items/{work_item_id}/13-test-report.md")
+
+    if not os.path.isfile(report_path):
+        return False, "Test report not found"
+
+    try:
+        with open(report_path, "r") as f:
+            content = f.read()
+        if "PASS" in content or "All tests passed" in content:
+            return True, "Test report indicates PASS"
+        return False, "Test report exists but no PASS indicator found"
+    except OSError as e:
+        return False, f"Error reading test report: {e}"
+
+
+# Registry for dynamic lookup by name
+QG_CHECKS = {
+    "check_analysis_complete": check_analysis_complete,
+    "check_architecture_done": check_architecture_done,
+    "check_ci_green": check_ci_green,
+    "check_review_approved": check_review_approved,
+    "check_tests_passed": check_tests_passed,
+}