feat(workflows): wire TaskUnit/Orchestrator activities, add k8s deploy manifests

Implements real activity-calling logic in OrchestratorWorkflow and
TaskUnitWorkflow (previously stubs), adds GitDiffActivity, and expands
PlanningActivity's I/O to carry repo path and prior task results.

Adds k8s/ deployment manifests (worker Deployment, orchestrator Job,
Kustomize base) for the poimen-workflows Temporal worker, using a
dedicated Kubernetes namespace `poimen` and Temporal namespace
`poimen-harness` rather than sharing the Temporal server's own
`temporal`/`production` namespaces.

k8s/configmap.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: poimen-config
+  namespace: poimen
+data:
+  TEMPORAL_NAMESPACE: "poimen-harness"
+  TEMPORAL_HOSTPORT: "temporal-frontend.temporal:7233"
+  # ANTHROPIC_API_KEY is handled via Secret

k8s/deploy.sh

@@ -0,0 +1,90 @@
+#!/bin/bash
+
+set -e
+
+echo "╔════════════════════════════════════════════════════════════════════════╗"
+echo "║               DEPLOYING POIMEN ORCHESTRATOR TO KUBERNETES              ║"
+echo "╚════════════════════════════════════════════════════════════════════════╝"
+echo ""
+
+# Check if kubectl is available
+if ! command -v kubectl &> /dev/null; then
+    echo "❌ kubectl not found. Please install kubectl."
+    exit 1
+fi
+
+# Check if temporal namespace exists
+if ! kubectl get namespace temporal &> /dev/null; then
+    echo "❌ Temporal namespace not found. Please deploy Temporal first."
+    exit 1
+fi
+
+echo "✅ Temporal namespace found"
+echo ""
+
+# Get API key from user
+echo "Step 1: Set up secrets"
+echo ""
+read -sp "Enter ANTHROPIC_API_KEY: " API_KEY
+echo ""
+
+# Update secret with actual API key
+kubectl create secret generic poimen-secrets \
+  --namespace poimen \
+  --from-literal=ANTHROPIC_API_KEY="$API_KEY" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+echo "✅ Secrets configured"
+echo ""
+
+# Apply ConfigMap
+echo "Step 2: Apply ConfigMap"
+kubectl apply -f k8s/configmap.yaml
+echo "✅ ConfigMap deployed"
+echo ""
+
+# Apply Worker Deployment
+echo "Step 3: Deploy Worker"
+kubectl apply -f k8s/worker-deployment.yaml
+echo "✅ Worker deployment created"
+echo ""
+
+# Wait for worker to start
+echo "Waiting for worker to be ready..."
+kubectl wait --for=condition=available --timeout=120s \
+  -n poimen deployment/poimen-worker 2>/dev/null || true
+echo ""
+
+# Check worker status
+echo "Worker Status:"
+kubectl get pods -n poimen -l app=poimen-worker
+echo ""
+
+# Submit orchestrator job
+echo "Step 4: Submit Orchestrator Workflow"
+kubectl apply -f k8s/orchestrator-job.yaml
+echo "✅ Orchestrator job submitted"
+echo ""
+
+# Monitor job
+echo "Monitoring orchestrator job..."
+kubectl logs -n poimen -f job/poimen-orchestrator 2>/dev/null || true
+
+echo ""
+echo "════════════════════════════════════════════════════════════════════════"
+echo "DEPLOYMENT COMPLETE"
+echo "════════════════════════════════════════════════════════════════════════"
+echo ""
+echo "Monitor workflow:"
+echo "  temporal workflow list --address temporal-frontend.temporal:7233 --namespace poimen-harness"
+echo ""
+echo "View worker logs:"
+echo "  kubectl logs -n poimen -l app=poimen-worker -f"
+echo ""
+echo "View orchestrator job logs:"
+echo "  kubectl logs -n poimen job/poimen-orchestrator -f"
+echo ""
+echo "Access Temporal Web UI:"
+echo "  kubectl port-forward -n temporal svc/temporal-web 8080:8080"
+echo "  Then open: http://localhost:8080"
+echo ""

k8s/kustomization.yaml

@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: poimen
+
+resources:
+  - configmap.yaml
+  - worker-deployment.yaml
+  - orchestrator-job.yaml
+  # secret.yaml is auto-generated from secrets.env below
+
+commonLabels:
+  app.kubernetes.io/name: poimen
+  app.kubernetes.io/component: orchestrator
+
+secretGenerator:
+  - name: poimen-secrets
+    envs:
+      - secrets.env
+    behavior: merge
+
+configMapGenerator:
+  - name: poimen-config
+    behavior: merge

k8s/orchestrator-job.yaml

@@ -0,0 +1,54 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: poimen-orchestrator
+  namespace: poimen
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app: poimen-orchestrator
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: orchestrator
+        image: golang:1.22-alpine
+        workingDir: /app
+        command: ["/bin/sh", "-c"]
+        args:
+          - |
+            apk add --no-cache git gcc musl-dev
+            git clone https://forgejo.riotpiao.com/rock/poimen.git /app
+            cd /app/workflows
+            go mod download
+            go run ./cmd/starter \
+              --repo https://forgejo.riotpiao.com/rock/poimen \
+              --remote file:///tmp/poimen-output \
+              --milestone T0 \
+              --planner-model ornith \
+              --judge-model ornith \
+              --implementer-model claude-sonnet-5
+        env:
+        - name: TEMPORAL_NAMESPACE
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: TEMPORAL_NAMESPACE
+        - name: TEMPORAL_HOSTPORT
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: TEMPORAL_HOSTPORT
+        - name: ANTHROPIC_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: poimen-secrets
+              key: ANTHROPIC_API_KEY
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "500m"
+          limits:
+            memory: "2Gi"
+            cpu: "2000m"

k8s/secret.yaml

@@ -0,0 +1,12 @@
+# NOTE: This file is for reference only.
+# Kustomize will auto-generate secrets from secrets.env
+# See kustomization.yaml for details
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: poimen-secrets
+  namespace: poimen
+type: Opaque
+stringData:
+  ANTHROPIC_API_KEY: "" # Generated from secrets.env by Kustomize

k8s/secrets.env

@@ -0,0 +1 @@
+ANTHROPIC_API_KEY=YOUR_ANTHROPIC_API_KEY_HERE

k8s/worker-deployment.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: poimen-worker
+  namespace: poimen
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: poimen-worker
+  template:
+    metadata:
+      labels:
+        app: poimen-worker
+    spec:
+      containers:
+      - name: worker
+        image: golang:1.22-alpine
+        workingDir: /app
+        command: ["/bin/sh", "-c"]
+        args:
+          - |
+            apk add --no-cache git gcc musl-dev
+            git clone https://forgejo.riotpiao.com/rock/poimen.git /app
+            cd /app/workflows
+            go mod download
+            go run ./cmd/worker
+        env:
+        - name: TEMPORAL_NAMESPACE
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: TEMPORAL_NAMESPACE
+        - name: TEMPORAL_HOSTPORT
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: TEMPORAL_HOSTPORT
+        - name: ANTHROPIC_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: poimen-secrets
+              key: ANTHROPIC_API_KEY
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "500m"
+          limits:
+            memory: "2Gi"
+            cpu: "2000m"
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - ps aux | grep -q "go run ./cmd/worker" && echo ok || exit 1
+          initialDelaySeconds: 30
+          periodSeconds: 10