feat(pipeline): order active stages by the WSJF judgement Facility already records

[vicente-debug]

Closes #109.

What this does

The board no longer sorts active stages by gh_updated_at. It sorts them by the WSJF judgement Facility already records — and then threw away. The issue's own framing ("Facility forms an opinion about priority, and then throws it away") is the design: this PR adds no new opinion, it consumes the existing one.

• assemblePipelineStories reads the ## Value section back out of the mirrored issue body (gh_issues.body_md) and scores it with the existing wsjfScore — the first caller either exported function has had outside its unit test.
• Active stages sort scored stories first, highest score on top. Unscored stories sit below, in GitHub's own newest-created-first order. Shipped keeps recency: it is a log of what left the pipeline, not a queue, and "most recently shipped on top" is the honest order there.
• The score and its components ride PipelineStorySchema and StoryDetailSchema, and the board renders a wsjf 3.75 chip whose tooltip is the breakdown (value 8 · time 5 · risk 2 · effort 4) — the position is inspectable, not merely asserted.
• The serialisation the PO-task executor used to build inline moves into @facility/harness (wsjfValueSection) next to its new inverse (parseWsjfValueSection), so the round trip through the GitHub mirror is pinned by one pair of functions and one pair of tests.

Where the score lives — the first open question, answered

In the issue body on GitHub, where executeTaskCreation already writes it. That choice does the most work per line of code:

• No second source of truth. #101's reasoning about assignees applies verbatim: a Facility-native priority field would have no writer, no sync path and no reconciliation story. The body block has all three today — written on task acceptance, mirrored on every webhook and sync, echoed back within seconds of an edit.
• The human override falls out for free, with a record. Editing the JSON block on GitHub is an attributed, timestamped issue edit — it lands in the issue history and in Facility's mirror without any new machinery. That is "an override is a decision with a reason, in the record", minus a bespoke approvals flow.
• Hand-opened issues can opt in by adding the same ## Value block the PO agent writes. Without one they are simply unscored, which is handled explicitly, not accidentally: always below scored stories, in stable creation order, with the chip's absence marking the boundary.

Malformed blocks (bad JSON, missing components, effort <= 0, a fence that actually belongs to the next section) parse to unscored, never to an error — the majority of issues are hand-written, and a parser that can be angered by prose would be a liability.

What good looks like, checked against the issue

• "Priority survives an issue being touched." Nothing in the active-stage comparator reads gh_updated_at any more. Triggering an agent — the acknowledgement comment plus the Show the signed-in GitHub user, and assign them on the issue and the PR #70 self-assignment that made the board reorder in response to your own actions — now moves nothing.
• "The judgement is inspectable." The chip and its breakdown, plus the block itself in the story body.
• "Unscored stories are handled explicitly." Deliberately below scored ones, newest-created first; tested.
• "Re-scoring is visible when it happens." A re-score is an issue edit: it shows up in the issue history, the timeline's issue_updated, and the mirror — not as a silent overnight rearrangement.

Deliberately left open

The issue's larger questions — PO re-scoring cadence, decay, whether a re-prioritisation must pass through Approvals, effort informed by measured run cost, the #110 dependency graph — are policy, and the issue itself says the design belongs to whoever implements it. This PR keeps the mechanism small enough that any of those answers can be built on top of it: they all reduce to "who is allowed to edit the ## Value block, and when", because after this change the block is finally load-bearing.

Tests

• packages/harness: round-trip through wsjfValueSection/parseWsjfValueSection, plus the malformed-body taxonomy.
• services/api: a pipeline test where a stale scored story outranks a freshly-commented scored one, unscored stories keep creation order despite activity bumps, and a malformed block lands unscored — end-to-end through assemblePipelineStories → classifyPipeline.
• OpenAPI + SDK regenerated (pnpm --filter @facility/api openapi); full typecheck and the harness/api/web suites pass locally. The one local failure, ai-identity.test.ts's vendor-asset hash, fails identically on a pristine main under a Windows CRLF checkout and is what fix: several Windows-checkout issues found while running the platform's own checks locally #173 is about.

🤖 Generated with Claude Code

https://claude.ai/code/session_018XarNuJCzYsJupYqMDUvaG

[adrian-lorenzo]

Thanks for the contribution!

The ## Value block is untrusted GitHub content, but the parser currently treats any finite numbers as authoritative. It accepts values the canonical WSJF schema rejects, and values such as 1e308 produce an infinite score that the response schema rejects, allowing one issue to make the Stories endpoint return 500. Any issue author can also promote their own story by editing its body. Please share the canonical validation, ensure the computed score remains finite, bind ranked scores to trusted provenance, and add unit and API-level regressions for negative values, overflow or tiny effort, and forged blocks.

The score breakdown is only exposed through a title on a non-focusable element, so it cannot be inspected reliably with a keyboard or touch device. Please make that detail accessible and cover the interaction.

[vicente-debug]

Thanks for the thorough review. The overflow-to-500 path and the self-promotion vector were both real.

Addressed in 6e24dcd:

• Canonical validation is now shared. WsjfSchema moved into wsjf.ts and is the same schema task frontmatter uses; the parser and the new validateWsjf reject anything non-canonical.
• Scores are guaranteed finite. wsjfScore refuses non-finite results (a subnormal effort still divides to Infinity even with canonical components), and untrusted paths turn that into "unscored", never an error.
• Ranks bind to trusted provenance. Assembly no longer reads the issue body at all: each story's judgement comes from the po_tasks row Facility wrote when it mirrored the issue, located through that row's own gh reference. Editing the body can neither promote a story nor break the endpoint.
• The chip is now a native details/summary disclosure, reachable by keyboard, touch, and screen reader, with tests replacing the hover-only title.

Regressions cover negative and fractional components, overflow and subnormal effort, and forged blocks at unit and API level, including an issue whose forged block claims 1e308 leaving /pipeline at 200.

[adrian-lorenzo]

Thanks for the contribution! Thoughtful work throughout.