sdlc-change-manager

# sdlc-change-manager

Consolidates findings from multiple analysis agents into a normalized, prioritized change plan structure. Handles deduplication, severity scoring, effort estimation, and dependency ordering so the Change Management Agent can focus on GitHub issue creation and report writing.

## Responsibility

Normalize raw findings from any combination of: Code Optimization Agent output, Architectural Review Agent output, Dependabot Risk Triage Agent output. Produce a single, deduplicated, dependency-ordered finding set with tier assignments.

## Input

```json
{
  "sources": [
    {
      "agent": "Code Optimization Agent",
      "findings_file": "docs/code-optimization/findings.json"
    },
    {
      "agent": "Architectural Review Agent",
      "findings_file": "docs/architectural-review/assessment.json"
    },
    {
      "agent": "Dependabot Risk Triage Agent",
      "findings_file": "docs/vulnerability-report/findings.json"
    }
  ],
  "repository": "owner/repo",
  "milestone": "optional sprint or release milestone label"
}
```

## Processing Rules

### Normalization

Map each source finding to the canonical finding schema:

```json
{
  "finding_id": "FIND-NNN",
  "source_agent": "",
  "category": "dead_code | duplication | complexity | coupling | anti_pattern | vulnerability | dependency | architecture",
  "severity": "critical | high | medium | low",
  "title": "",
  "detail": "",
  "location": "",
  "recommendation": "",
  "effort_estimate": "xs | s | m | l | xl",
  "story_points": 1,
  "tags": [],
  "dependencies": [],
  "tier": 1
}
```

### Severity Mapping

From source agent categories to canonical severity:

| Source Category | Canonical Severity |
|---|---|
| Active CVE / CVSS 9-10 | critical |
| CVSS 7-8.9 / EOL component / policy block | high |
| CVSS 4-6.9 / architectural anti-pattern / major complexity | medium |
| Minor quality / informational finding | low |

### Effort and Story Point Assignment

| Condition | Effort | Points |
|---|---|---|
| Single line / config value change | xs | 1 |
| Delete file, update 1 dependency | s | 2 |
| Refactor 1 function, update 1 library | m | 3 |
| Refactor a module or subsystem | m | 5 |
| Cross-file refactor, component redesign | l | 8 |
| Multiple components, breaking change | l | 13 |
| Cross-cutting architecture change | xl | 21 |

### Deduplication

If two findings describe the same symptom in the same file/component:
- Retain the higher-severity finding
- Merge the recommendations
- Note merged source agents in `tags`

### Dependency Ordering

A finding B depends on finding A if:
- A and B are in the same component and A must be completed first (e.g., splitting a god class before fixing coupling)
- A is a prerequisite library or framework update that B requires at runtime

Set `finding.dependencies = [finding_id_of_A]` for each such dependency.

### Tier Assignment

- **Tier 1**: severity = critical or high
- **Tier 2**: severity = medium AND (story_points <= 5 OR the find