@delorenj/pjangler 1.4.6 → 1.5.3

package/templates/hermes-agent/template/.scripts/sentinel/bin/emit-event.py

@@ -1,106 +0,0 @@
-#!/usr/bin/env python3
-"""Emit a local BloodBank-style CloudEvents envelope (provider-agnostic).
-
-Dependency-free. Appends JSONL locally so the sentinel engine records an
-event trail even when NATS/BloodBank is offline. Identical envelope shape to the
-Hermes gateway; see .scripts/sentinel/docs/bloodbank-events.md.
-"""
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import pathlib
-import sys
-import uuid
-from datetime import datetime, timezone
-
-
-def now_iso() -> str:
-    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def parse_field(raw: str) -> tuple[str, str]:
-    if "=" not in raw:
-        raise argparse.ArgumentTypeError("--field values must use key=value")
-    key, value = raw.split("=", 1)
-    if not key:
-        raise argparse.ArgumentTypeError("--field key cannot be empty")
-    return key, value
-
-
-def load_data(args: argparse.Namespace) -> dict:
-    data: dict[str, object] = {}
-    for key, value in args.field or []:
-        data[key] = value
-    if args.data_json:
-        loaded = json.loads(args.data_json)
-        if not isinstance(loaded, dict):
-            raise SystemExit("--data-json must be a JSON object")
-        data.update(loaded)
-    elif not sys.stdin.isatty():
-        raw = sys.stdin.read().strip()
-        if raw:
-            loaded = json.loads(raw)
-            if not isinstance(loaded, dict):
-                raise SystemExit("stdin JSON must be an object")
-            data.update(loaded)
-    return data
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("event_type")
-    parser.add_argument("--root", default=os.getcwd())
-    parser.add_argument("--field", action="append", type=parse_field, default=[])
-    parser.add_argument("--data-json")
-    parser.add_argument("--source")
-    parser.add_argument("--producer", default=os.environ.get("BLOODBANK_PRODUCER", "local-script:sentinel"))
-    parser.add_argument("--service", default=os.environ.get("BLOODBANK_SERVICE", "hermes-sentinel"))
-    parser.add_argument("--actor-id", default=os.environ.get("BLOODBANK_ACTOR_ID", os.environ.get("USER", "local-agent")))
-    parser.add_argument("--actor-cli", default=os.environ.get("BLOODBANK_ACTOR_CLI", "script"))
-    parser.add_argument("--correlation-id", default=os.environ.get("BLOODBANK_CORRELATION_ID"))
-    parser.add_argument("--causation-id", default=os.environ.get("BLOODBANK_CAUSATION_ID"))
-    parser.add_argument("--kind", default="event")
-    parser.add_argument("--quiet", action="store_true")
-    args = parser.parse_args()
-
-    root = pathlib.Path(args.root).resolve()
-    log_path = pathlib.Path(
-        os.environ.get(
-            "BLOODBANK_EVENTS_LOG",
-            root / "_bmad-output" / "implementation-artifacts" / "bloodbank-events.jsonl",
-        )
-    )
-    if not log_path.is_absolute():
-        log_path = root / log_path
-
-    source = args.source or "repo://sentinel/bin/emit-event.py"
-    event = {
-        "specversion": "1.0",
-        "type": args.event_type,
-        "id": str(uuid.uuid4()),
-        "source": source,
-        "time": now_iso(),
-        "datacontenttype": "application/json",
-        "kind": args.kind,
-        "producer": args.producer,
-        "service": args.service,
-        "actor": {"type": "agent", "agent_id": args.actor_id, "cli": args.actor_cli},
-        "data": load_data(args),
-        "correlation_id": args.correlation_id or str(uuid.uuid4()),
-        "causation_id": args.causation_id,
-    }
-
-    log_path.parent.mkdir(parents=True, exist_ok=True)
-    with log_path.open("a", encoding="utf-8") as handle:
-        handle.write(json.dumps(event, sort_keys=True) + "\n")
-
-    if not args.quiet:
-        print(json.dumps(event, indent=2, sort_keys=True))
-        print(f"Appended: {log_path}", file=sys.stderr)
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

package/templates/hermes-agent/template/.scripts/sentinel/bin/issue-autonomous-review.sh

@@ -1,339 +0,0 @@
-#!/usr/bin/env bash
-# Provider-agnostic autonomous adversarial-review decision gate (act, don't wait).
-#
-# The rigorous, INDEPENDENT ADVERSARIAL review is the normal per-pass path: an
-# adversarial microscope that couples the close gate with an independent-reviewer
-# drift attestation. A clean adversarial
-# verdict is acted on AUTONOMOUSLY -- the loop treats the ticket as done and
-# moves on; it never parks the ticket waiting on the operator for approval or
-# sign-off. Every adversarial check stays at full strength (locked-intent
-# baseline, drift none|minor|significant with significant -> hold, any unresolved
-# critical/high finding -> hold, independence, and the close gate as a hard
-# automated lock). The ONLY thing removed is the human-approval stall.
-#
-# A default clean run (no --close) means the loop autonomously treats the ticket
-# as done and leaves it in the review lane (the operator's deferred-QA queue).
-# --close is OPTIONAL (operator QA sweep): closure goes through the
-# ticket-provider adapter (tp transition <id> completed), so the same logic works
-# on Linear | Plane | Trello.
-#
-# Protocol: .scripts/sentinel/docs/autonomous-delegated-review.md
-#
-# Usage: issue-autonomous-review.sh ISSUE_ID REPORT_FILE [--close]
-#
-# Exit codes: 0 accepted (treat as done; with --close, transitioned to completed)
-#             3 held    2 usage/missing inputs
-set -euo pipefail
-
-if [[ "${1:-}" == "" || "${2:-}" == "" ]]; then
-  printf 'Usage: %s ISSUE_ID REPORT_FILE [--close]\n' "$0" >&2; exit 2
-fi
-ISSUE="$1"; REPORT="$2"; CLOSE=0
-[[ "${3:-}" == "--close" ]] && CLOSE=1
-case "$ISSUE" in *[!A-Za-z0-9_-]*) printf 'Invalid issue id: %s\n' "$ISSUE" >&2; exit 2 ;; esac
-
-BIN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENGINE_DIR="$(cd "$BIN_DIR/.." && pwd)"          # .scripts/sentinel
-SCRIPTS_DIR="$(cd "$ENGINE_DIR/.." && pwd)"      # .scripts
-ROLE_DIR="$(cd "$SCRIPTS_DIR/.." && pwd)"
-ROLE_YAML="$ROLE_DIR/role.yaml"
-ROOT="$(git -C "$ROLE_DIR" rev-parse --show-toplevel 2>/dev/null || pwd)"
-cd "$ROOT"
-
-CLOSE_GATE="$BIN_DIR/issue-close-gate.sh"
-EVIDENCE="_bmad-output/implementation-artifacts/issue-evidence/$ISSUE.md"
-
-role_mapping_value() {
-  python3 - "$ROLE_YAML" "$1" "$2" <<'PY'
-import pathlib
-import re
-import sys
-
-path = pathlib.Path(sys.argv[1])
-section = sys.argv[2]
-key = sys.argv[3]
-text = path.read_text(encoding="utf-8") if path.is_file() else ""
-lines = text.splitlines()
-headers = [
-    index
-    for index, line in enumerate(lines)
-    if re.fullmatch(rf"{re.escape(section)}:\s*(?:#.*)?", line)
-]
-if not headers:
-    print("")
-    raise SystemExit(0)
-if len(headers) != 1:
-    raise SystemExit(f"role config has duplicate top-level {section!r} mappings")
-block = []
-for line in lines[headers[0] + 1 :]:
-    if line.strip() and not line[0].isspace() and not line.lstrip().startswith("#"):
-        break
-    block.append(line)
-content = [
-    line
-    for line in block
-    if line.strip() and not line.lstrip().startswith("#") and line[0].isspace()
-]
-if not content:
-    print("")
-    raise SystemExit(0)
-direct_indent = min(len(line) - len(line.lstrip()) for line in content)
-matches = []
-for line in content:
-    if len(line) - len(line.lstrip()) != direct_indent:
-        continue
-    match = re.fullmatch(rf"\s{{{direct_indent}}}{re.escape(key)}:\s*(.*?)\s*", line)
-    if match:
-        matches.append(match.group(1))
-if len(matches) > 1:
-    raise SystemExit(f"role config has duplicate {section}.{key} values")
-value = matches[0] if matches else ""
-value = re.sub(r"\s+#.*$", "", value).strip()
-if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
-    value = value[1:-1]
-print(value.strip())
-PY
-}
-# Informational only: recorded in the ticket comment, never a blocking wait.
-# Default 0 (no grace); an operator may set grace_hours>0 to reintroduce one.
-ROLE_GRACE_HOURS="$(role_mapping_value reconcile grace_hours)"
-GRACE_HOURS="${RECONCILE_GRACE_HOURS:-$ROLE_GRACE_HOURS}"
-GRACE_HOURS="$(printf '%s' "${GRACE_HOURS:-0}" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
-case "$GRACE_HOURS" in
-  ''|*[!0-9]*)
-    printf "AUTONOMOUS REVIEW: CONFIG INVALID - reconcile.grace_hours must be a nonnegative integer (got '%s').\n" "$GRACE_HOURS" >&2
-    exit 3
-    ;;
-esac
-GRACE_HOURS="$(python3 -c 'import sys; print(int(sys.argv[1]))' "$GRACE_HOURS")"
-
-ROLE_AUTO="$(role_mapping_value reconcile auto_review)"
-AUTO="${RECONCILE_AUTO_REVIEW:-$ROLE_AUTO}"
-AUTO="$(printf '%s' "${AUTO:-true}" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//' | tr '[:upper:]' '[:lower:]')"
-case "$AUTO" in
-  true|on) : ;;
-  false|off)
-    printf 'Autonomous review is disabled (reconcile.auto_review=%s).\n' "$AUTO" >&2
-    exit 3
-    ;;
-  *)
-    printf "AUTONOMOUS REVIEW: CONFIG INVALID - reconcile.auto_review must be true|on|false|off (got '%s').\n" "$AUTO" >&2
-    exit 3
-    ;;
-esac
-[[ -f "$REPORT" ]]   || { printf 'Missing review report file: %s\n' "$REPORT" >&2; exit 2; }
-[[ -f "$EVIDENCE" ]] || { printf 'Missing issue evidence file: %s\n' "$EVIDENCE" >&2; exit 2; }
-
-HOLD=""
-hold() { HOLD="${HOLD}${HOLD:+; }$1"; }
-
-# Structural parse of the review report (and the evidence's implementer
-# identity): every required H2 exactly once, each authoritative field read
-# only as a direct field of its own section. Lookalike bullets or examples in
-# other sections can never stand in for -- or override -- the authoritative
-# value, and duplicate/missing/blank sections or fields are rejected here,
-# before any provider call.
-PARSED=""
-if ! PARSED="$(python3 - "$REPORT" "$EVIDENCE" <<'PY'
-import re
-import sys
-
-report_path, evidence_path = sys.argv[1], sys.argv[2]
-
-heading = re.compile(r"^(#{1,6})\s+(.*?)\s*$")
-
-
-def parse_sections(path):
-    with open(path, encoding="utf-8") as stream:
-        lines = stream.read().splitlines()
-    sections = {}
-    order = []
-    current = None
-    for line in lines:
-        match = heading.match(line)
-        if match and len(match.group(1)) <= 2:
-            current = match.group(2) if len(match.group(1)) == 2 else None
-            if current is not None:
-                sections.setdefault(current, [])
-                order.append(current)
-            continue
-        if current is not None:
-            sections[current].append(line)
-    return sections, order
-
-
-def direct_fields(sections, section, *names):
-    found = []
-    for line in sections.get(section, []):
-        for name in names:
-            match = re.fullmatch(
-                r"\s*(?:[-*+]\s+)?" + re.escape(name) + r"\s*:\s*(.*?)\s*", line
-            )
-            if match:
-                found.append(match.group(1))
-                break
-    return found
-
-
-errors = []
-out = {}
-
-sections, order = parse_sections(report_path)
-for name in (
-    "Reviewer",
-    "Locked Intent Baseline",
-    "Drift Assessment",
-    "Adversarial Findings",
-    "Decision",
-):
-    count = order.count(name)
-    if count == 0:
-        errors.append(f"report missing section {name}")
-    elif count > 1:
-        errors.append(f"report has duplicate {name} sections")
-
-
-def report_field(section, name):
-    if order.count(section) != 1:
-        return ""
-    found = direct_fields(sections, section, name)
-    if len(found) != 1:
-        errors.append(
-            f"report section {section} must contain exactly one"
-            f" '{name}:' field (found {len(found)})"
-        )
-        return ""
-    if not found[0]:
-        errors.append(f"report field '{name}:' in section {section} is blank")
-        return ""
-    return found[0]
-
-
-def first_token(value):
-    tokens = value.split()
-    return tokens[0].lower() if tokens else ""
-
-
-out["reviewer"] = report_field("Reviewer", "Reviewer agent")
-out["independent"] = first_token(report_field("Reviewer", "Independent of implementer"))
-out["drift"] = first_token(report_field("Drift Assessment", "Drift assessment"))
-out["findings"] = first_token(report_field("Adversarial Findings", "Critical/high findings"))
-out["decision"] = first_token(report_field("Decision", "Decision"))
-
-evidence_sections, evidence_order = parse_sections(evidence_path)
-implementer = ""
-if evidence_order.count("Issue") != 1:
-    errors.append(
-        "evidence must contain exactly one Issue section carrying the"
-        " implementer identity"
-    )
-else:
-    found = direct_fields(evidence_sections, "Issue", "Worker", "Implemented by")
-    if len(found) != 1:
-        errors.append(
-            "evidence section Issue must contain exactly one implementer"
-            " identity ('Worker:' / 'Implemented by:') field"
-            f" (found {len(found)})"
-        )
-    elif not found[0]:
-        errors.append("evidence implementer identity in section Issue is blank")
-    else:
-        implementer = found[0]
-out["implementer"] = implementer
-
-for key, value in out.items():
-    print("F\t{}\t{}".format(key, value.replace("\t", " ").replace("\n", " ")))
-for error in errors:
-    print(f"E\t{error}")
-PY
-)"; then
-  hold "review report could not be parsed"
-fi
-
-REVIEWER=""; INDEP=""; DRIFT=""; FINDINGS=""; DEC=""; IMPL=""
-while IFS="$(printf '\t')" read -r kind key value; do
-  case "$kind" in
-    E) hold "$key" ;;
-    F)
-      case "$key" in
-        reviewer) REVIEWER="$value" ;;
-        independent) INDEP="$value" ;;
-        drift) DRIFT="$value" ;;
-        findings) FINDINGS="$value" ;;
-        decision) DEC="$value" ;;
-        implementer) IMPL="$value" ;;
-      esac
-      ;;
-  esac
-done <<EOF
-$PARSED
-EOF
-REVIEWER="${REVIEWER:-unknown}"
-
-[[ "$INDEP" == "yes" ]] || hold "reviewer did not attest independence"
-[[ -n "$IMPL" && "$IMPL" == "$REVIEWER" ]] && hold "reviewer ($REVIEWER) is the implementer"
-
-case "$DRIFT" in
-  none|minor) : ;;
-  significant) hold "significant drift from locked intent" ;;
-  *) hold "drift assessment missing/invalid ('${DRIFT:-none-found}')"; DRIFT="${DRIFT:-unknown}" ;;
-esac
-[[ "$FINDINGS" == "none" ]] || hold "unresolved critical/high findings (or field missing)"
-# Accept the keyword `accept` as clearing; tolerate the legacy `close`.
-[[ "$DEC" == "accept" || "$DEC" == "close" ]] || hold "reviewer decision is not 'accept' (got '${DEC:-none}')"
-
-GATE=fail
-if sh "$CLOSE_GATE" "$ISSUE" "$ROOT" >/dev/null 2>&1 </dev/null; then GATE=pass; else hold "close gate failed"; fi
-
-if [[ -n "$HOLD" ]]; then DECISION=held; else DECISION=accepted; fi
-
-if [[ "$DECISION" == "held" ]]; then
-  printf 'AUTONOMOUS REVIEW: HOLD for %s\nReasons: %s\n' "$ISSUE" "$HOLD" >&2
-  exit 3
-fi
-
-PROV="$(role_mapping_value ticket_provider name)"; PROV="${PROV:-}"
-if [[ "$CLOSE" -eq 1 ]]; then
-  # Optional operator QA sweep: close through the ticket-provider adapter.
-  if ! TICKET_PROVIDER="$PROV" bash -c '. "$1"; tp transition "$2" completed' _ "$SCRIPTS_DIR/lib/ticket-provider.sh" "$ISSUE" \
-    >/dev/null 2>&1; then
-    printf 'AUTONOMOUS REVIEW: CLOSE FAILED for %s - adapter transition failed; issue left open.\n' "$ISSUE" >&2
-    exit 1
-  fi
-
-  COMMENT_ID=""
-  if ! COMMENT_ID="$(TICKET_PROVIDER="$PROV" bash -c '. "$1"; tp comment "$2" "$3"' _ "$SCRIPTS_DIR/lib/ticket-provider.sh" "$ISSUE" \
-    "Autonomously accepted by $REVIEWER under the independent adversarial-review protocol (drift: $DRIFT, gate: $GATE, grace ${GRACE_HOURS}h informational). Treated as done; review report: $REPORT." 2>/dev/null)"; then
-    printf 'AUTONOMOUS REVIEW: CLOSE INCOMPLETE for %s - transition succeeded, but acceptance comment failed; issue may already be completed.\n' "$ISSUE" >&2
-    exit 1
-  fi
-  if [[ ! "$COMMENT_ID" =~ [^[:space:]] ]]; then
-    printf 'AUTONOMOUS REVIEW: CLOSE INCOMPLETE for %s - transition succeeded, but acceptance comment returned no id; comment write unproven and issue may already be completed.\n' "$ISSUE" >&2
-    exit 1
-  fi
-
-  # Acceptance is an assertion about both required writes on this path, so no
-  # acceptance-shaped output may escape until transition and comment succeed.
-  printf 'AUTONOMOUS REVIEW: ACCEPTED - treat as done (no human wait) for %s (reviewer: %s | drift: %s | gate: %s)\n' \
-    "$ISSUE" "$REVIEWER" "$DRIFT" "$GATE"
-  printf 'Ticket %s transitioned to completed via adapter.\n' "$ISSUE"
-else
-  # Accepted: the loop autonomously treats the ticket as done and leaves it in
-  # the review lane (deferred-QA queue). Record the autonomous acceptance via the
-  # adapter -- no approval request, no "waiting on the operator".
-  COMMENT_ID=""
-  if ! COMMENT_ID="$(TICKET_PROVIDER="$PROV" bash -c '. "$1"; tp comment "$2" "$3"' _ "$SCRIPTS_DIR/lib/ticket-provider.sh" "$ISSUE" \
-    "Autonomously accepted by $REVIEWER under the independent adversarial-review protocol (drift: $DRIFT, gate: $GATE, grace ${GRACE_HOURS}h informational). Treated as done; stays in the review lane (deferred-QA queue). Review report: $REPORT." 2>/dev/null)"; then
-    printf 'AUTONOMOUS REVIEW: COMMENT FAILED for %s - acceptance comment was not recorded; issue left in review.\n' "$ISSUE" >&2
-    exit 1
-  fi
-  if [[ ! "$COMMENT_ID" =~ [^[:space:]] ]]; then
-    printf 'AUTONOMOUS REVIEW: COMMENT UNPROVEN for %s - acceptance comment returned no id; issue left in review.\n' "$ISSUE" >&2
-    exit 1
-  fi
-  printf 'AUTONOMOUS REVIEW: ACCEPTED - treat as done (no human wait) for %s (reviewer: %s | drift: %s | gate: %s)\n' \
-    "$ISSUE" "$REVIEWER" "$DRIFT" "$GATE"
-  printf 'Accepted: ticket stays in the review lane (deferred-QA queue); the loop moves on.\n'
-  printf 'Optional operator QA sweep: re-run with --close to transition %s to completed via the adapter.\n' "$ISSUE"
-fi
-exit 0

package/templates/hermes-agent/template/.scripts/sentinel/bin/issue-close-gate.sh

@@ -1,179 +0,0 @@
-#!/usr/bin/env sh
-# Provider-agnostic close gate. Verifies an issue's evidence file is complete
-# before any closure (manual or autonomous). Pure gate: it reports PASS/FAIL on
-# stdout/stderr and via the exit code, and publishes nothing.
-#
-# Usage: issue-close-gate.sh ISSUE_ID [REPO_ROOT]
-set -eu
-
-if [ "${1:-}" = "" ]; then
-  printf 'Usage: %s ISSUE_ID [REPO_ROOT]\n' "$0" >&2
-  exit 2
-fi
-ISSUE="$1"
-case "$ISSUE" in *[!A-Za-z0-9_-]*) printf 'Invalid issue id: %s\n' "$ISSUE" >&2; exit 2 ;; esac
-
-BIN_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
-ROLE_YAML="$BIN_DIR/../../../role.yaml"
-ROLE_REPO="$(sed -n 's/^repo:[[:space:]]*//p' "$ROLE_YAML" 2>/dev/null | head -n1 | tr -d '"' | tr -d '\r')"
-ROOT="${2:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
-cd "$ROOT"
-ROOT="$(pwd -P)"
-PROJECT_MANIFEST="$ROOT/.project.json"
-if [ -e "$PROJECT_MANIFEST" ] || [ -L "$PROJECT_MANIFEST" ]; then
-  [ -f "$PROJECT_MANIFEST" ] || {
-    printf 'Project manifest is not a regular file: %s\n' "$PROJECT_MANIFEST" >&2
-    exit 1
-  }
-  REPO_SLUG="$(python3 - "$PROJECT_MANIFEST" <<'PY'
-import json
-import pathlib
-import sys
-
-path = pathlib.Path(sys.argv[1])
-try:
-    document = json.loads(path.read_text(encoding="utf-8"))
-except (OSError, UnicodeError, json.JSONDecodeError) as exc:
-    raise SystemExit(f"close gate: malformed project manifest {path}: {exc}")
-slug = document.get("project_slug") if isinstance(document, dict) else None
-if not isinstance(slug, str) or not slug.strip():
-    raise SystemExit(f"close gate: project manifest {path} has no non-blank project_slug")
-print(slug.strip())
-PY
-)" || exit 1
-else
-  REPO_SLUG="$(basename "$ROOT")"
-fi
-if [ -n "$ROLE_REPO" ] && [ "$ROLE_REPO" != "$REPO_SLUG" ]; then
-  printf 'Installed role repo %s disagrees with target project slug %s.\n' "$ROLE_REPO" "$REPO_SLUG" >&2
-  exit 1
-fi
-
-FILE="_bmad-output/implementation-artifacts/issue-evidence/$ISSUE.md"
-FAIL=0
-
-if [ ! -f "$FILE" ]; then
-  printf 'Missing issue evidence file: %s\n' "$FILE" >&2
-  exit 1
-fi
-
-# Structural parse: every required H2 exactly once, and each authoritative
-# field read only as a direct field of its own section. Lookalike lines in
-# other sections can never stand in for -- or override -- the authoritative
-# value (an authoritative `no`/`hold` always fails the gate). The implementer
-# identity is defined as exactly one nonblank `Worker:` / `Implemented by:`
-# field in the Issue section; duplicates, blanks, and conflicting spellings
-# are rejected.
-GATE_PROBLEMS=""
-if ! GATE_PROBLEMS="$(python3 - "$FILE" <<'PY'
-import re
-import sys
-
-with open(sys.argv[1], encoding="utf-8") as stream:
-    lines = stream.read().splitlines()
-
-REQUIRED = [
-    "Issue",
-    "Acceptance Criteria",
-    "Repo Changes",
-    "Verification",
-    "Ledger Update",
-    "Known Gaps",
-    "Close Recommendation",
-]
-
-heading = re.compile(r"^(#{1,6})\s+(.*?)\s*$")
-sections = {}
-order = []
-current = None
-for line in lines:
-    match = heading.match(line)
-    if match and len(match.group(1)) <= 2:
-        current = match.group(2) if len(match.group(1)) == 2 else None
-        if current is not None:
-            sections.setdefault(current, [])
-            order.append(current)
-        continue
-    if current is not None:
-        sections[current].append(line)
-
-problems = []
-for name in REQUIRED:
-    count = order.count(name)
-    if count == 0:
-        problems.append(f"Missing required evidence: {name}")
-    elif count > 1:
-        problems.append(f"Duplicate required evidence section: {name}")
-
-
-def direct_fields(section, *names):
-    found = []
-    for line in sections.get(section, []):
-        for name in names:
-            match = re.fullmatch(
-                r"\s*(?:[-*+]\s+)?" + re.escape(name) + r"\s*:\s*(.*?)\s*", line
-            )
-            if match:
-                found.append(match.group(1))
-                break
-    return found
-
-
-def first_token(value):
-    tokens = value.split()
-    return tokens[0].lower() if tokens else ""
-
-
-if order.count("Ledger Update") == 1:
-    found = direct_fields("Ledger Update", "Ledger updated")
-    if len(found) != 1:
-        problems.append(
-            "Expected exactly one 'Ledger updated:' field in '## Ledger Update'"
-            f" (found {len(found)})."
-        )
-    elif first_token(found[0]) != "yes":
-        problems.append("Ledger update is not marked yes.")
-
-if order.count("Close Recommendation") == 1:
-    found = direct_fields("Close Recommendation", "Close recommendation")
-    if len(found) != 1:
-        problems.append(
-            "Expected exactly one 'Close recommendation:' field in"
-            f" '## Close Recommendation' (found {len(found)})."
-        )
-    elif first_token(found[0]) != "ready":
-        problems.append("Close recommendation is not ready.")
-
-if order.count("Issue") == 1:
-    found = direct_fields("Issue", "Worker", "Implemented by")
-    if len(found) != 1:
-        problems.append(
-            "Expected exactly one implementer identity ('Worker:' /"
-            f" 'Implemented by:') in '## Issue' (found {len(found)})."
-        )
-    elif not found[0]:
-        problems.append("The implementer identity in '## Issue' is blank.")
-
-for problem in problems:
-    print(problem)
-PY
-)"; then
-  printf 'Evidence file could not be parsed: %s\n' "$FILE" >&2
-  exit 1
-fi
-if [ -n "$GATE_PROBLEMS" ]; then
-  printf '%s\n' "$GATE_PROBLEMS" >&2
-  FAIL=1
-fi
-
-if grep -Eiq 'TBD|TODO|not run|pending|unknown' "$FILE"; then
-  printf 'Evidence file still contains unresolved placeholders or unverified work.\n' >&2
-  FAIL=1
-fi
-
-if [ "$FAIL" -ne 0 ]; then
-  printf '\nCLOSE GATE: FAIL for %s\n' "$ISSUE" >&2
-  exit 1
-fi
-
-printf 'CLOSE GATE: PASS for %s (repo: %s)\n' "$ISSUE" "$REPO_SLUG"