@jeger-ai/opengantry 1.0.0 → 1.1.0

package/templates/.github/workflows/gxt-validate.yml

@@ -1,7 +1,10 @@
 # Validates OpenGantry substrate: Foreman MANIFEST + path-scoped [MSN-NNNN] on PRs.
 #
+# PR governance (pull_request only): mission PRs must target the repo default branch
+# (override: repository variable GXT_INTEGRATION_BRANCH when integration branch differs).
 # MSN policy (pull_request only): commits touching MSN-enforced paths must have
 # subject [MSN-NNNN] (four digits) or a valid gxt-bypass git note.
+# Mission purity: scripts/verify-pr-missions.sh — one [MSN-NNNN] per PR commit range.
 # Paths = fixed substrate (.gitagent/, WORKER_LOG.md, .githooks/, gxt-validate.yml)
 #       + all MANIFEST skills[].tmvc_roots (Node via scripts/gxt-manifest-lib.mjs).
 # Logic: scripts/validate-gxt.sh — keep workflow header and script in sync.
@@ -17,6 +20,19 @@ permissions:
   contents: read
 
 jobs:
+  pr_governance:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Enforce base branch isolation
+        run: |
+          base="${{ github.event.pull_request.base.ref }}"
+          expected="${{ vars.GXT_INTEGRATION_BRANCH || github.event.repository.default_branch }}"
+          if [ "$base" != "$expected" ]; then
+            echo "::error::Governance Violation: Mission PR targets '$base' instead of '$expected'. Stacking missions violates blast-radius isolation. Re-target the PR to '$expected'."
+            exit 1
+          fi
+
   manifest:
     runs-on: ubuntu-latest
     steps:
@@ -47,6 +63,7 @@ jobs:
 
   code_quality:
     if: github.event_name == 'pull_request'
+    needs: pr_governance
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -86,6 +103,7 @@ jobs:
 
   msn_commits:
     if: github.event_name == 'pull_request'
+    needs: pr_governance
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -104,6 +122,7 @@ jobs:
 
   mission_verify:
     if: github.event_name == 'pull_request'
+    needs: pr_governance
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6

package/templates/.gitignore.gxt

@@ -1,4 +1,3 @@
-# OpenGantry local forensic paths (merged by gapman init)
 .gitagent/.upgrade-tmp/
 .gitagent/foreman/TEACHER.allowlist.local
 .gitagent/history/

package/templates/.prettierignore.gxt

@@ -0,0 +1 @@
+WORKER_LOG.md

package/templates/integrations/compatibility.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1",
-  "opengantry_version": "1.0.0",
+  "opengantry_version": "1.1.0",
   "integrations": {
     "cursor": {
       "display_name": "Cursor",

package/templates/scripts/verify-pr-missions.sh

@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+# PR / branch mission verify: mission purity, triple-dot file diff, full gapman verify on changed missions.
+# Usage:
+#   BASE_SHA=<base> HEAD_SHA=<head> ./scripts/verify-pr-missions.sh
+#   ./scripts/verify-pr-missions.sh <base-ref> <head-ref>   # rev-parse refs to SHAs
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || {
+  echo "verify-pr-missions: not inside a git repository" >&2
+  exit 1
+}
+cd "$ROOT"
+
+GXT_MANIFEST_LIB="scripts/gxt-manifest-lib.mjs"
+MISSIONS_PREFIX=".gitagent/missions/"
+
+resolve_sha() {
+  git rev-parse --verify "${1}^{commit}" 2>/dev/null
+}
+
+if [[ -n "${1:-}" && -n "${2:-}" ]]; then
+  BASE_SHA="$(resolve_sha "$1")" || {
+    echo "verify-pr-missions: invalid base ref: $1" >&2
+    exit 2
+  }
+  HEAD_SHA="$(resolve_sha "$2")" || {
+    echo "verify-pr-missions: invalid head ref: $2" >&2
+    exit 2
+  }
+elif [[ -n "${BASE_SHA:-}" && -n "${HEAD_SHA:-}" ]]; then
+  BASE_SHA="$(resolve_sha "$BASE_SHA")" || {
+    echo "verify-pr-missions: invalid BASE_SHA" >&2
+    exit 2
+  }
+  HEAD_SHA="$(resolve_sha "$HEAD_SHA")" || {
+    echo "verify-pr-missions: invalid HEAD_SHA" >&2
+    exit 2
+  }
+else
+  echo "verify-pr-missions: set BASE_SHA and HEAD_SHA, or pass <base-ref> <head-ref>" >&2
+  echo "  CI: BASE_SHA=\${{ github.event.pull_request.base.sha }} HEAD_SHA=\${{ github.event.pull_request.head.sha }}" >&2
+  exit 2
+fi
+
+mapfile -t UNIQUE_MSNS < <(
+  git log --no-merges --format=%s "${BASE_SHA}..${HEAD_SHA}" \
+    | grep -Eo '\[MSN-[0-9]{4}\]' | sort -u || true
+)
+
+if [[ ${#UNIQUE_MSNS[@]} -gt 1 ]]; then
+  echo "verify-pr-missions FAILED: mission contamination detected" >&2
+  echo "  This PR contains commits from multiple missions:" >&2
+  printf '    %s\n' "${UNIQUE_MSNS[@]}" >&2
+  echo "  OpenGantry requires strict blast-radius isolation. Rebase this branch onto the integration branch (e.g. origin/main)." >&2
+  exit 1
+fi
+
+if [[ -f dist/cli/index.js ]]; then
+  GAPMAN=(node dist/cli/index.js)
+elif command -v gapman >/dev/null 2>&1; then
+  GAPMAN=(gapman)
+else
+  echo "verify-pr-missions: build gapman first (npm run build)" >&2
+  exit 1
+fi
+
+is_verifiable_mission() {
+  local p="$1"
+  [[ "$p" == "${MISSIONS_PREFIX}"* ]] || return 1
+  [[ "$p" =~ \.(ya?ml|md)$ ]] || return 1
+  [[ "$(basename "$p")" == "README.md" ]] && return 1
+  return 0
+}
+
+is_msn_enforced_path() {
+  local p="$1"
+  local prefix
+  for prefix in "${MSN_PREFIXES[@]}"; do
+    [[ -z "$prefix" ]] && continue
+    if [[ "$p" == "$prefix" ]]; then return 0; fi
+    if [[ "$prefix" == */ ]] && [[ "$p" == "$prefix"* ]]; then return 0; fi
+    if [[ "$prefix" != */ ]] && [[ "$p" == "$prefix"/* ]]; then return 0; fi
+  done
+  return 1
+}
+
+mapfile -t MSN_PREFIXES < <(node "$GXT_MANIFEST_LIB" prefixes "$ROOT")
+
+mapfile -t DIFF_FILES < <(
+  git diff --name-only --diff-filter=ACMRT "${BASE_SHA}...${HEAD_SHA}" || true
+)
+
+needs_mission=0
+for f in "${DIFF_FILES[@]}"; do
+  [[ -n "$f" ]] || continue
+  if is_msn_enforced_path "$f"; then
+    needs_mission=1
+    break
+  fi
+done
+
+mapfile -t CHANGED_MISSIONS < <(
+  for f in "${DIFF_FILES[@]}"; do
+    [[ -n "$f" ]] || continue
+    if is_verifiable_mission "$f" && [[ -f "$f" ]]; then
+      echo "$f"
+    fi
+  done | sort -u
+)
+
+if [[ "$needs_mission" -eq 1 && ${#CHANGED_MISSIONS[@]} -eq 0 ]]; then
+  echo "verify-pr-missions FAILED: diff touches MSN-enforced paths but no mission file under ${MISSIONS_PREFIX}" >&2
+  echo "  Fix: gapman legislate \"<intent>\" --msn MSN-NNNN --skill-key gapman && include mission YAML in this PR" >&2
+  exit 1
+fi
+
+if [[ ${#CHANGED_MISSIONS[@]} -eq 0 ]]; then
+  echo "verify-pr-missions: no changed mission files (${BASE_SHA}...${HEAD_SHA})"
+  exit 0
+fi
+
+if [[ ${#UNIQUE_MSNS[@]} -eq 1 ]]; then
+  purity_msn="${UNIQUE_MSNS[0]}"
+  purity_msn="${purity_msn#[}"
+  purity_msn="${purity_msn%]}"
+  for mission in "${CHANGED_MISSIONS[@]}"; do
+    base="$(basename "$mission")"
+    if [[ "$base" != "${purity_msn}."* ]]; then
+      echo "verify-pr-missions FAILED: changed mission file does not match commit MSN tag" >&2
+      echo "  commits: [${purity_msn}]  mission file: ${mission}" >&2
+      exit 1
+    fi
+  done
+fi
+
+for mission in "${CHANGED_MISSIONS[@]}"; do
+  echo "verify-pr-missions: gapman verify --mission ${mission}" >&2
+  "${GAPMAN[@]}" verify --mission "$mission" --audience verifier || exit 1
+done
+
+echo "verify-pr-missions OK (${#CHANGED_MISSIONS[@]} mission(s))"

package/dist/cli/lib/gitignore-gxt.d.ts

@@ -1,2 +0,0 @@
-export declare function mergeGitignoreFromTemplate(repoRoot: string, templatesRoot: string): void;
-//# sourceMappingURL=gitignore-gxt.d.ts.map

package/dist/cli/lib/gitignore-gxt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gitignore-gxt.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/gitignore-gxt.ts"],"names":[],"mappings":"AAKA,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAmBxF"}

package/dist/cli/lib/gitignore-gxt.js

@@ -1,24 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { CLI_NAME } from "./constants.js";
-import { logInfo } from "./cli-io.js";
-export function mergeGitignoreFromTemplate(repoRoot, templatesRoot) {
-    const fragmentPath = path.join(templatesRoot, ".gitignore.gxt");
-    if (!fs.existsSync(fragmentPath))
-        return;
-    const lines = fs
-        .readFileSync(fragmentPath, "utf8")
-        .split(/\r?\n/)
-        .map((l) => l.trim())
-        .filter((l) => l.length > 0 && !l.startsWith("#"));
-    const gitignorePath = path.join(repoRoot, ".gitignore");
-    const existing = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
-    const missing = lines.filter((line) => !existing.includes(line));
-    if (missing.length === 0)
-        return;
-    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : existing.length > 0 ? "" : "";
-    const block = `${prefix}\n# OpenGantry (gapman init)\n${missing.join("\n")}\n`;
-    fs.writeFileSync(gitignorePath, existing + block, "utf8");
-    logInfo(`${CLI_NAME}: appended ${missing.length} line(s) to .gitignore`);
-}
-//# sourceMappingURL=gitignore-gxt.js.map

package/dist/cli/lib/gitignore-gxt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gitignore-gxt.js","sourceRoot":"","sources":["../../../src/cli/lib/gitignore-gxt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,aAAqB;IAChF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO;IAEzC,MAAM,KAAK,GAAG,EAAE;SACb,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC;SAClC,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAErD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,KAAK,GAAG,GAAG,MAAM,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAC/E,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,QAAQ,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,QAAQ,cAAc,OAAO,CAAC,MAAM,wBAAwB,CAAC,CAAC;AAC3E,CAAC"}