@gcunharodrigues/wrxn 0.10.0 → 0.12.0

package/bin/wrxn.cjs

@@ -12,11 +12,15 @@ const worktree = require('../lib/worktree.cjs');
 const executor = require('../lib/executor.cjs');
 const onboard = require('../lib/onboard.cjs');
 const connect = require('../lib/connect.cjs');
+const ship = require('../lib/ship.cjs');
+const protect = require('../lib/protect.cjs');
+const release = require('../lib/release.cjs');
 const brain = require('../lib/brain.cjs');
 const statusline = require('../lib/statusline.cjs');
 const { convert } = require('../lib/convert.cjs');
 const { ingest } = require('../lib/ingest.cjs');
 const { flowStatus } = require('../lib/flow-status.cjs');
+const ciChecks = require('../lib/ci-checks.cjs');
 
 const PKG_ROOT = path.join(__dirname, '..');
 
@@ -47,6 +51,14 @@ function parseArgs(argv) {
       args.flags.root = argv[++i];
     } else if (a === '--base') {
       args.flags.base = argv[++i];
+    } else if (a === '--range') {
+      args.flags.range = argv[++i];
+    } else if (a === '--branch') {
+      args.flags.branch = argv[++i];
+    } else if (a === '--title') {
+      args.flags.title = argv[++i];
+    } else if (a === '--body') {
+      args.flags.body = argv[++i];
     } else if (a === '--path') {
       args.flags.path = argv[++i];
     } else if (a === '--executor') {
@@ -122,6 +134,22 @@ Usage:
       list                       print all registered connections (agent-readable JSON)
       get <name>                 print one connection by name
 
+  wrxn ship --title "<pr title>" [--branch <name>] [--base <main>] [--body <text>] [--dry-run] [--root <dir>]
+                                 the autonomous promote path: push the reviewed branch, open a PR,
+                                 and arm auto-merge (gh pr merge --auto --squash) — GitHub merges the
+                                 instant the server-enforced CI gate is green. --branch defaults to
+                                 the repo's current branch. --dry-run prints the promote plan without
+                                 running it (a non-destructive preview). Stops at the first failing
+                                 step (a failed push never opens a PR).
+
+  wrxn protect [--root <dir>]    apply the wrxn-main-gate server-side ruleset to this repo's origin —
+                                 the hard gate that replaces the settings.local.json env-flag dance:
+                                 block direct push to the default branch, require a PR + the wrxn-ci
+                                 check, require the branch up to date, no bypass actor. Idempotent
+                                 (create-or-update by name) and fail-soft (no gh / not admin / no remote
+                                 → a clear message, exit 0). Repo-agnostic: the slug is read from origin,
+                                 so the SAME command protects the kernel, any install, and recon-wrxn.
+
   wrxn brain query "<q>" [--json] [--limit <n>] [--type <prose|code|NodeType>] [--neighbors] [--root <dir>]
                                  ask the warm Brain (recon-wrxn's code+prose graph) from the terminal.
                                  WHOLE-BRAIN by default. Discovers the live serve door via
@@ -158,6 +186,23 @@ Usage:
                                  aios-intake.md (the deterministic half of the onboard skill;
                                  workspace installs only). Idempotent.
 
+  wrxn ci [--root <dir>]         run the universal CI checks over an install (the kernel-universal
+                                 half of the wrxn-ci gate): managed-file integrity (managed files not
+                                 drifted from kernel source), wiki-lint, synapse-manifest lint, JSON
+                                 validity, and node --check syntax over the shipped .cjs. Exits non-zero
+                                 on any failure. The wrxn-ci workflow runs this after the project's own
+                                 WRXN_TEST_CMD, so CI is never a vacuous pass — even a no-suite repo is
+                                 really gated.
+
+  wrxn release-check [--range <before>..<head>] [--root <dir>]
+                                 the CD type-gate: read the merged commit messages from the git range
+                                 (default: the HEAD commit) and decide by conventional-commit type
+                                 whether the merge publishes — feat→minor, fix/perf→patch, breaking
+                                 (type! / BREAKING CHANGE:)→major; chore/docs/refactor/test → no release.
+                                 Prints {"release":bool,"bump":...} and, in CI, appends release/bump to
+                                 $GITHUB_OUTPUT. The release-on-merge workflow gates the OIDC publish on
+                                 it. Fail-safe: a non-repo / bad range → no release.
+
   wrxn flow status <prd> [--root <dir>]
                                  print the flow-status board for a PRD's issue set. Reads issues
                                  from .scratch/<prd>/issues/, detects gate artifacts (green commit
@@ -243,6 +288,14 @@ async function main(argv) {
     if (report.migrationsRan && report.migrationsRan.length) {
       process.stdout.write(`migrations applied: ${report.migrationsRan.join(', ')}\n`);
     }
+    // Surface the server-side gate outcome (gate-02 MED-1). A soft-skip on the PRIMARY delivery path
+    // must NOT be silent — a silent skip is the very "no-op gate believed active" defect this epic kills.
+    // Mirrors `wrxn protect`; fail-soft is preserved (this only prints, never throws, still exit 0).
+    if (report.protection) {
+      process.stdout.write(report.protection.ok
+        ? `protection: ${report.protection.detail}\n`
+        : `protection skipped: ${report.protection.reason}\n`);
+    }
     return 0;
   }
 
@@ -440,6 +493,61 @@ async function main(argv) {
     }
   }
 
+  if (cmd === 'ship') {
+    // The autonomous promote path: push the reviewed branch, open a PR, arm auto-merge — GitHub
+    // merges the instant the server-enforced CI gate is green — no env flag, no GitHub clicks. Real
+    // git/gh run via the
+    // real spawnSync invoker (ship.defaultInvoke) — that is what makes the promote "validated by
+    // invocation". --dry-run prints the plan without running it (a non-destructive preview).
+    const root = path.resolve(args.flags.root || process.cwd());
+    let branch = args.flags.branch;
+    if (!branch) {
+      // Default to the repo's current branch — the reviewed branch the devops executor stands on.
+      try {
+        branch = execFileSync('git', ['-C', root, 'branch', '--show-current'], { encoding: 'utf8' }).trim();
+      } catch { branch = ''; }
+    }
+    const title = args.flags.title;
+    const base = args.flags.base || ship.DEFAULT_BASE;
+    const body = args.flags.body || '';
+    if (!branch) { process.stderr.write('wrxn: ship requires a branch — pass --branch <name>, or run inside the git repo on the branch to promote\n'); return 2; }
+    if (!title) { process.stderr.write('wrxn: ship requires --title "<pr title>"\n'); return 2; }
+    let plan;
+    try {
+      plan = ship.buildShipPlan({ branch, title, base, body });
+    } catch (err) {
+      process.stderr.write(`wrxn: ${err.message}\n`);
+      return 2;
+    }
+    if (args.flags['dry-run']) {
+      process.stdout.write(JSON.stringify(plan, null, 2) + '\n');
+      return 0;
+    }
+    const res = ship.ship({ branch, title, base, body }); // real defaultInvoke (git + gh)
+    for (const s of res.steps) {
+      process.stdout.write(`  ${s.ok ? '✓' : '✗'} ${s.step} — ${s.detail}\n`);
+    }
+    if (res.ok) {
+      process.stdout.write(`shipped ${branch} → PR opened on ${base} with auto-merge armed (GitHub merges when CI is green)\n`);
+      return 0;
+    }
+    process.stderr.write(`wrxn: ship failed at "${res.failed}" — promote halted (no PR/auto-merge past the failure)\n`);
+    return 2;
+  }
+
+  if (cmd === 'protect') {
+    // Apply the wrxn-main-gate server-side ruleset to this repo's origin — the hard gate that replaces
+    // the disarmable settings.local.json env-flag dance (ADR 0007). Repo-agnostic: the slug is read from
+    // origin (protect.protectOrigin), so the SAME command protects the kernel, any install, and the
+    // recon-wrxn sibling. Real git/gh run via protect's defaultInvoke (no injected invoker) — that is
+    // what makes the application "validated by invocation". Fail-soft: no gh / not admin / no remote → a
+    // clear message and exit 0, so it never breaks a remote-less checkout.
+    const root = path.resolve(args.flags.root || process.cwd());
+    const res = protect.protectOrigin(root);
+    process.stdout.write(res.ok ? `wrxn protect → ${res.detail}\n` : `wrxn protect → skipped: ${res.reason}\n`);
+    return 0;
+  }
+
   if (cmd === 'brain') {
     const sub = args._[1];
     if (sub !== 'query') {
@@ -635,6 +743,53 @@ async function main(argv) {
     return 2;
   }
 
+  if (cmd === 'ci') {
+    const root = path.resolve(args.flags.root || process.cwd());
+    const { ok, results } = ciChecks.runChecks(root, { pkgRoot: PKG_ROOT });
+    process.stdout.write(`wrxn-ci (${root})\n`);
+    for (const c of results) {
+      process.stdout.write(`  ${c.ok ? '✓' : '✗'} ${c.name} — ${c.detail}\n`);
+      for (const f of c.failures) process.stdout.write(`      - ${f}\n`);
+    }
+    process.stdout.write(ok ? 'wrxn-ci PASS\n' : 'wrxn-ci FAIL\n');
+    return ok ? 0 : 2;
+  }
+
+  if (cmd === 'release-check') {
+    // The CD type-gate bridge (gate-05): read the merged commit messages from a git range, decide by
+    // conventional-commit type whether the merge publishes, and emit the decision. release.yml gates the
+    // OIDC publish on it; recon-wrxn (gate-06) reuses the same gate via `npx @gcunharodrigues/wrxn`.
+    // The git read lives here (CLI layer); the pure classifier (shouldRelease) is unit-tested.
+    const root = path.resolve(args.flags.root || process.cwd());
+    const range = args.flags.range;
+    let logArgs;
+    if (range && range.includes('..')) {
+      const [before, head] = range.split('..');
+      const headRef = head || 'HEAD';
+      // A zero before-sha is GitHub's "new branch" sentinel — there is no prior tip, so the range is
+      // meaningless; read only the head commit.
+      logArgs = /^0+$/.test(before)
+        ? ['-C', root, 'log', '-1', '--format=%B%x00', headRef]
+        : ['-C', root, 'log', '--format=%B%x00', range];
+    } else {
+      logArgs = ['-C', root, 'log', '-1', '--format=%B%x00', range || 'HEAD'];
+    }
+    let raw = '';
+    try {
+      raw = execFileSync('git', logArgs, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    } catch {
+      // Not a git repo / bad range — fail SAFE: never publish on uncertainty.
+      raw = '';
+    }
+    const decision = release.shouldRelease(release.parseLog(raw));
+    // Expose the decision to the workflow's conditional publish step.
+    if (process.env.GITHUB_OUTPUT) {
+      fs.appendFileSync(process.env.GITHUB_OUTPUT, `release=${decision.release}\nbump=${decision.bump || ''}\n`);
+    }
+    process.stdout.write(JSON.stringify(decision) + '\n');
+    return 0;
+  }
+
   process.stderr.write(`wrxn: unknown command "${cmd}"\n\n${USAGE}\n`);
   return 2;
 }

package/lib/ci-checks.cjs

@@ -0,0 +1,296 @@
+'use strict';
+
+// WRXN universal CI checks — the pure-node predicates the `wrxn-ci` workflow runs on every PR so CI
+// is never a vacuous `true`, even on a repo with no project suite. Each predicate is a deterministic
+// function over the install tree returning { name, ok, failures: string[], detail }. The thin
+// `wrxn ci` CLI (bin/wrxn.cjs) runs them in the install cwd and exits non-zero on any failure, so the
+// SAME tested logic runs in the kernel and in every install. No side effects, node stdlib only.
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { isDeepStrictEqual } = require('util');
+
+const { RECEIPT, MCP_PATH } = require('./install.cjs');
+const { loadManifest, inProfile } = require('./manifest.cjs');
+
+function result(name, failures, detail) {
+  return { name, ok: failures.length === 0, failures, detail };
+}
+
+function readReceipt(root) {
+  return JSON.parse(fs.readFileSync(path.join(root, RECEIPT), 'utf8'));
+}
+
+// ── managed-integrity ────────────────────────────────────────────────────────
+//
+// The server-side replacement for the demoted local managed-guard hook: every kernel-managed file must
+// byte-match its canonical source in the kernel package payload — i.e. it has not drifted from
+// kernel-owned content. The managed SET is anchored to the kernel `manifest.json` (the source of
+// truth), NOT to the install's `wrxn.install.json` receipt (CF-2): the receipt is itself unprotected
+// and never integrity-checked, so deriving the set from it let an attacker edit a managed file and
+// drop/reclassify its receipt entry to pass the check (security MED-1; HIGH if an install ever takes
+// untrusted fork PRs). The receipt is trusted only for the install PROFILE (project|workspace), which
+// selects which managed files were laid. `.mcp.json` is the one file that is byte-DIVERGENT yet still
+// checked: it is managed but operator-MERGED (init/update fold the recon-wrxn server into the
+// operator's other servers rather than overwrite), so a blanket byte-equality is wrong AND a blanket
+// skip is a hole — an injected/swapped MCP `command` auto-executes on session open (security MED-2 /
+// SEC-MED-1, issue 10). Instead it is validated merge-aware (`mcpServerFailures`): every KERNEL-MANAGED
+// server entry (the keys in payload/.mcp.json, e.g. recon-wrxn) must deep-equal the payload — the exact
+// post-condition of install.cjs `mergeMcpServer` — while operator-ADDED servers (keys not in the
+// payload) are the operator's own repo content and pass. A repo with no receipt is not a wrxn install
+// (nothing managed to verify) → passes; an UNREADABLE receipt is a real defect → fails.
+function managedIntegrity(root, opts) {
+  const pkgRoot = (opts && opts.pkgRoot) || path.join(__dirname, '..');
+  const receiptPath = path.join(root, RECEIPT);
+  if (!fs.existsSync(receiptPath)) {
+    return result('managed-integrity', [], 'no wrxn.install.json — not a wrxn install, nothing to verify');
+  }
+  let receipt;
+  try {
+    receipt = readReceipt(root);
+  } catch (err) {
+    return result('managed-integrity', [`${RECEIPT} is unreadable: ${err.message}`], 'receipt corrupt');
+  }
+  let manifest;
+  try {
+    manifest = loadManifest(path.join(pkgRoot, 'manifest.json'));
+  } catch (err) {
+    return result('managed-integrity', [`kernel manifest is unreadable: ${err.message}`], 'manifest missing');
+  }
+
+  const profile = receipt.profile || 'project';
+  const managed = manifest.files.filter((f) => f.class === 'managed');
+  const failures = [];
+  let checked = 0;
+  for (const f of managed) {
+    const installed = path.join(root, f.path);
+    const canonical = path.join(pkgRoot, 'payload', f.path);
+    if (!fs.existsSync(canonical)) continue; // no kernel source to compare against → cannot be drift
+    if (!fs.existsSync(installed)) {
+      // An in-profile managed file MUST be present; an out-of-profile one is legitimately absent (a
+      // project install does not lay workspace files). The profile comes from the receipt, but it can
+      // only EXCLUDE a missing-file check — it can never suppress a present, drifted file (below).
+      if (inProfile(f.profile, profile)) {
+        failures.push(`${f.path} — managed file is missing from the install`);
+      }
+      continue;
+    }
+    // Present on disk → it must match the kernel source REGARDLESS of the claimed profile, so a flipped
+    // receipt profile cannot hide a tampered workspace-managed file (CF-2 defense-in-depth). `.mcp.json`
+    // is operator-MERGED so byte-equality is wrong → validate its kernel-managed server entries instead.
+    checked++;
+    if (f.path === MCP_PATH) {
+      failures.push(...mcpServerFailures(installed, canonical));
+    } else if (!fs.readFileSync(installed).equals(fs.readFileSync(canonical))) {
+      failures.push(`${f.path} — drifted from the kernel-owned source`);
+    }
+  }
+  return result('managed-integrity', failures, `${checked} managed file(s) checked`);
+}
+
+// Merge-aware integrity for the operator-MERGED `.mcp.json`: assert each KERNEL-MANAGED server entry
+// (a key present in the payload `.mcp.json`, e.g. recon-wrxn) is present in the install and deep-equals
+// the payload — the exact post-condition install.cjs `mergeMcpServer` writes — so a swapped/injected
+// launch `command` on a kernel server is caught. Operator-ADDED server keys (absent from the payload)
+// are the operator's own repo content and are intentionally NOT judged (no false positive). Corrupt
+// install JSON fails closed here too (jsonValidity also catches it). The payload is kernel-trusted; a
+// thrown payload parse propagates to the entrypoint (exit non-zero) — fail-closed by design.
+function mcpServerFailures(installed, canonical) {
+  let install;
+  try {
+    install = JSON.parse(fs.readFileSync(installed, 'utf8'));
+  } catch (err) {
+    return [`${MCP_PATH} — invalid JSON: ${err.message}`];
+  }
+  const payloadServers = (JSON.parse(fs.readFileSync(canonical, 'utf8')) || {}).mcpServers || {};
+  const installServers = (install && install.mcpServers) || {};
+  const failures = [];
+  for (const key of Object.keys(payloadServers)) {
+    if (!(key in installServers)) {
+      failures.push(`${MCP_PATH} — kernel-managed MCP server "${key}" is missing`);
+    } else if (!isDeepStrictEqual(installServers[key], payloadServers[key])) {
+      failures.push(`${MCP_PATH} — kernel-managed MCP server "${key}" drifted from the kernel-owned source`);
+    }
+  }
+  return failures;
+}
+
+// ── wiki-lint ─────────────────────────────────────────────────────────────────
+//
+// Every human-prose wiki page must carry a well-formed frontmatter block with the required keys
+// (name / description / tier) — the same contract the session-close wiki-lint hook flags, enforced
+// here server-side. The machine-written `_rules`/`_slots` tiers are deliberately out of scope (they
+// are not human-prose frontmatter). An empty/absent wiki tree passes. Re-implemented inline rather
+// than importing the payload hook so lib stays free of payload dependencies.
+const WIKI_TIERS = ['concepts', 'decisions', 'gotchas', 'sessions'];
+const WIKI_REQUIRED_KEYS = ['name', 'description', 'tier'];
+
+// Return the reason a page is malformed, or null when it is well-formed.
+function lintWikiPage(text) {
+  const src = String(text || '');
+  if (!src.startsWith('---')) return 'no frontmatter';
+  const end = src.indexOf('\n---', 3);
+  if (end < 0) return 'unterminated frontmatter';
+  const fm = src.slice(3, end);
+  const missing = WIKI_REQUIRED_KEYS.filter((k) => !new RegExp(`^${k}\\s*:`, 'm').test(fm));
+  if (missing.length) return `missing ${missing.join('/')}`;
+  return null;
+}
+
+function wikiLint(root) {
+  const failures = [];
+  for (const tier of WIKI_TIERS) {
+    const dir = path.join(root, '.wrxn', 'wiki', tier);
+    let names;
+    try {
+      names = fs.readdirSync(dir).filter((n) => n.endsWith('.md'));
+    } catch {
+      continue; // missing tier → nothing to lint
+    }
+    for (const name of names) {
+      let text;
+      try {
+        text = fs.readFileSync(path.join(dir, name), 'utf8');
+      } catch {
+        continue;
+      }
+      const reason = lintWikiPage(text);
+      if (reason) failures.push(`${tier}/${name} — ${reason}`);
+    }
+  }
+  return result('wiki-lint', failures, failures.length ? `${failures.length} malformed page(s)` : 'wiki frontmatter clean');
+}
+
+// ── synapse-manifest lint ─────────────────────────────────────────────────────
+//
+// The SYNAPSE engine reads `.synapse/manifest` (flat KEY=VALUE) on every prompt and, for each active
+// domain, loads its rules from the sibling file `.synapse/<domain-lowercased>`. A manifest that marks
+// a domain active but ships no domain file is a silent divergence — the engine reads nothing. This
+// lint enforces the contract: the manifest exists and parses, and every active domain (except the
+// special CONSTITUTION, whose body is sourced from .claude/constitution.md) has its domain file.
+function synapseManifestLint(root) {
+  const manifestPath = path.join(root, '.synapse', 'manifest');
+  let text;
+  try {
+    text = fs.readFileSync(manifestPath, 'utf8');
+  } catch {
+    return result('synapse-manifest', ['.synapse/manifest is absent or unreadable'], 'no manifest');
+  }
+
+  // Collect the active domains: a line `<NAME>_STATE=active` marks NAME active.
+  const active = new Set();
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const m = trimmed.match(/^(.+)_STATE=(.*)$/);
+    if (m && m[2].trim() === 'active') active.add(m[1]);
+  }
+
+  if (active.size === 0) {
+    return result('synapse-manifest', ['.synapse/manifest declares no active domain'], 'empty manifest');
+  }
+
+  const failures = [];
+  for (const name of active) {
+    if (name === 'CONSTITUTION') continue; // sourced from .claude/constitution.md, not a domain file
+    const domainFile = path.join(root, '.synapse', name.toLowerCase());
+    if (!fs.existsSync(domainFile)) {
+      failures.push(`${name} — active in the manifest but .synapse/${name.toLowerCase()} is missing`);
+    }
+  }
+  return result('synapse-manifest', failures, `${active.size} active domain(s) checked`);
+}
+
+// ── JSON validity ─────────────────────────────────────────────────────────────
+//
+// Every wrxn-owned JSON file in the install must parse. Scope is bounded to the install receipt plus
+// the `.json` paths in the manifest (e.g. .mcp.json, .recon-wrxn.json) — never the whole tree, so it
+// can't false-positive on node_modules or an operator's own fixtures. A corrupt receipt or a
+// hand-broken config is a real defect CI should catch.
+function jsonPaths(pkgRoot) {
+  const paths = [RECEIPT];
+  try {
+    const manifest = loadManifest(path.join(pkgRoot, 'manifest.json'));
+    for (const entry of manifest.files) {
+      if (entry.path.endsWith('.json')) paths.push(entry.path);
+    }
+  } catch {
+    /* no manifest reachable → still validate the receipt */
+  }
+  return paths;
+}
+
+function jsonValidity(root, opts) {
+  const pkgRoot = (opts && opts.pkgRoot) || path.join(__dirname, '..');
+  const failures = [];
+  for (const rel of jsonPaths(pkgRoot)) {
+    const p = path.join(root, rel);
+    if (!fs.existsSync(p)) continue;
+    try {
+      JSON.parse(fs.readFileSync(p, 'utf8'));
+    } catch (err) {
+      failures.push(`${rel} — invalid JSON: ${err.message}`);
+    }
+  }
+  return result('json-validity', failures, `${jsonPaths(pkgRoot).length} json path(s) checked`);
+}
+
+// ── node --check syntax ───────────────────────────────────────────────────────
+//
+// Every wrxn-shipped `.cjs` (the hooks + the .wrxn adapters) must parse — a broken hook fails open
+// silently in production, so a syntax error must never reach an install un-caught. Scope is the
+// manifest's `.cjs` entries present in the install; each is verified with a real `node --check` (parse
+// only, never executed). Returns ok when all parse, else names each offender.
+function checkSyntax(file) {
+  try {
+    execFileSync(process.execPath, ['--check', file], { stdio: 'pipe' });
+    return null;
+  } catch (err) {
+    const detail = String((err && err.stderr) || (err && err.message) || 'parse error').split('\n').find(Boolean) || 'parse error';
+    return detail.trim();
+  }
+}
+
+function cjsPaths(pkgRoot) {
+  try {
+    const manifest = loadManifest(path.join(pkgRoot, 'manifest.json'));
+    return manifest.files.filter((e) => e.path.endsWith('.cjs')).map((e) => e.path);
+  } catch {
+    return [];
+  }
+}
+
+function nodeCheck(root, opts) {
+  const pkgRoot = (opts && opts.pkgRoot) || path.join(__dirname, '..');
+  const failures = [];
+  let checked = 0;
+  for (const rel of cjsPaths(pkgRoot)) {
+    const p = path.join(root, rel);
+    if (!fs.existsSync(p)) continue;
+    checked++;
+    const err = checkSyntax(p);
+    if (err) failures.push(`${rel} — ${err}`);
+  }
+  return result('node-check', failures, `${checked} .cjs file(s) parsed`);
+}
+
+// ── the universal gate ────────────────────────────────────────────────────────
+//
+// Run every universal check over an install root. This is the gate the `wrxn ci` CLI (and thus the
+// wrxn-ci workflow) invokes — independent of any project suite, so even a no-suite repo gets a real,
+// fail-able check. ok is the AND of all checks. The project `WRXN_TEST_CMD` runs as its own workflow
+// step (skipped when `true`/empty), NOT here — these are the kernel-universal checks only.
+function runChecks(root, opts) {
+  const o = opts || {};
+  const results = [
+    managedIntegrity(root, o),
+    wikiLint(root),
+    synapseManifestLint(root),
+    jsonValidity(root, o),
+    nodeCheck(root, o),
+  ];
+  return { ok: results.every((r) => r.ok), results };
+}
+
+module.exports = { managedIntegrity, wikiLint, synapseManifestLint, jsonValidity, nodeCheck, runChecks };

package/lib/executor.cjs

@@ -76,11 +76,14 @@ const EXECUTORS = {
     required: GENERIC_REQUIRED,
   },
   devops: {
-    skill: null, // the integration / push executor — instructions; the ONLY type that may push
+    skill: null, // the integration / promote executor — instructions; the ONLY type that may push
     instructions: [
-      'You are the devops integration executor — the ONLY executor authorized to push. Integrate the',
-      'reviewed + security-passed + qa-walked track to the trunk: verify the review marker (review-<id>.md)',
-      '+ a green suite exist, then authorize the push by setting WRXN_ACTIVE_AGENT to devops under the `env` key of .claude/settings.local.json (an inline command-scoped assignment never reaches the gate hook), push, then REMOVE WRXN_ACTIVE_AGENT from .claude/settings.local.json — a persistent flag defeats the anti-accidental-push gate. This is the single path through the push gate.',
+      'You are the devops integration executor — the ONLY executor authorized to promote a track to the',
+      'trunk. Verify the track is reviewed + security-passed + qa-walked and you are on the reviewed branch,',
+      'then promote with ONE command: `wrxn ship --title "<conventional PR title>"` — it pushes the branch,',
+      'opens a PR, and arms auto-merge (`gh pr merge --auto --squash`). No env flag, no settings file, no',
+      'GitHub clicks. Confirm auto-merge is armed; the server-enforced CI ruleset then merges to the trunk',
+      'the instant CI is green. This is the single promote path through the push gate.',
     ],
     artifact: 'authorized-push',
     canPush: true,

package/lib/install.cjs

@@ -86,6 +86,9 @@ function init(opts) {
   ensureGitignoreLine(target, '.recon-wrxn/');
   // the recall-surface hook writes per-install access-recency state here (harvest-08) — runtime, not committed.
   ensureGitignoreLine(target, '.wrxn/reinforce.json');
+  // the memory-synth gemini fallback reads GEMINI_API_KEY from `.env` — ignore it so the secret is
+  // never committed (the synth's doc-comment calls it the install's gitignored `.env`).
+  ensureGitignoreLine(target, '.env');
 
   writeReceipt(target, { version, profile, laid, skipped, merged, brownfield });