@jeger-ai/opengantry 1.1.2 → 2.1.0

package/dist/cli/program-mission.js

@@ -1,6 +1,8 @@
+import { runContextRequest } from "./commands/context-request.js";
 import { runMissionSnapshot, runMissionValidate } from "./commands/mission.js";
 import { runRuntimeEnv, runRuntimeExecCommand } from "./commands/runtime.js";
-import { parseOptionalTimeoutMs } from "./lib/cli-timeout.js";
+import { runTmvcGuard } from "./commands/tmvc-guard.js";
+import { parseOptionalTimeoutMs } from "./lib/cli-io.js";
 import { logError, setExitCode } from "./lib/cli-io.js";
 function attachRuntimeExec(cmd) {
     cmd
@@ -73,5 +75,40 @@ export function registerMissionCommands(program) {
         runRuntimeEnv({ mission: opts.mission, format });
     });
     attachRuntimeExec(runtime);
+    program
+        .command("context-request")
+        .description("Append a PENDING Context Request to WORKER_LOG.md (RULES §4 TMVC expansion)")
+        .requiredOption("--reason <text>", "Why access outside TMVC is needed")
+        .option("--mission <path>", "Mission path (.md or .yaml); defaults to pinned mission")
+        .option("--path <paths...>", "Repo-relative path(s) requiring expansion")
+        .option("--proposed <files...>", "Proposed file(s) to touch after approval")
+        .option("--stage-worker-log", "Stage WORKER_LOG.md after append (opt-in)")
+        .option("--worker-log <path>", "Override WORKER_LOG.md path")
+        .option("--json", "Emit result as JSON on stdout")
+        .action((opts) => {
+        runContextRequest({
+            mission: opts.mission,
+            paths: opts.path ?? [],
+            reason: opts.reason,
+            proposed: opts.proposed,
+            stageWorkerLog: opts.stageWorkerLog,
+            workerLog: opts.workerLog,
+            json: opts.json,
+        });
+    });
+    const tmvc = program.command("tmvc").description("TMVC boundary checks (staged index)");
+    tmvc
+        .command("guard")
+        .description("Pre-commit TMVC path guard — advisory by default; --strict to block")
+        .option("--mission <path>", "Mission path; defaults to pinned mission")
+        .option("--strict", "Block commit when staged paths drift outside TMVC")
+        .option("--json", "Emit result as JSON on stdout")
+        .action((opts) => {
+        runTmvcGuard({
+            mission: opts.mission,
+            strict: opts.strict,
+            json: opts.json,
+        });
+    });
 }
 //# sourceMappingURL=program-mission.js.map

package/dist/cli/program-mission.js.map

@@ -1 +1 @@
-{"version":3,"file":"program-mission.js","sourceRoot":"","sources":["../../src/cli/program-mission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAExD,SAAS,iBAAiB,CAAC,GAAY;IACrC,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yDAAyD,CAAC;SACtE,cAAc,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC;SAC7D,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,UAAU,EAAE,8CAA8C,CAAC;SAClE,MAAM,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;SAC9D,MAAM,CAAC,aAAa,EAAE,8CAA8C,CAAC;SACrE,MAAM,CAAC,QAAQ,EAAE,2BAA2B,CAAC;SAC7C,kBAAkB,CAAC,IAAI,CAAC;SACxB,kBAAkB,EAAE;SACpB,QAAQ,CAAC,oBAAoB,EAAE,oCAAoC,CAAC;SACpE,MAAM,CACL,KAAK,EACH,aAAuB,EACvB,IAQC,EACD,EAAE;QACF,MAAM,UAAU,GACd,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI;YACnD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YACxB,CAAC,CAAC,aAAa,CAAC;QAEpB,MAAM,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACX,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YACrB,WAAW,CAAC,CAAC,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QAED,MAAM,qBAAqB,CAAC;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,UAAU;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,EAAE,CAAC,EAAE;YAChB,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACN,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAElG,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,mDAAmD,CAAC;SAChE,cAAc,CAAC,eAAe,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,CAAC,IAAsB,EAAE,EAAE;QACjC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,sDAAsD,CAAC;SACnE,cAAc,CAAC,eAAe,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;SACjD,MAAM,CAAC,CAAC,IAAoC,EAAE,EAAE;QAC/C,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,oEAAoE,CAAC,CAAC;IAErF,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,sEAAsE,CAAC;SACnF,cAAc,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACjE,MAAM,CAAC,QAAQ,EAAE,4CAA4C,CAAC;SAC9D,MAAM,CAAC,iBAAiB,EAAE,2DAA2D,EAAE,OAAO,CAAC;SAC/F,MAAM,CAAC,CAAC,IAA0D,EAAE,EAAE;QACrE,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEL,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"program-mission.js","sourceRoot":"","sources":["../../src/cli/program-mission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAExD,SAAS,iBAAiB,CAAC,GAAY;IACrC,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yDAAyD,CAAC;SACtE,cAAc,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC;SAC7D,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,UAAU,EAAE,8CAA8C,CAAC;SAClE,MAAM,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;SAC9D,MAAM,CAAC,aAAa,EAAE,8CAA8C,CAAC;SACrE,MAAM,CAAC,QAAQ,EAAE,2BAA2B,CAAC;SAC7C,kBAAkB,CAAC,IAAI,CAAC;SACxB,kBAAkB,EAAE;SACpB,QAAQ,CAAC,oBAAoB,EAAE,oCAAoC,CAAC;SACpE,MAAM,CACL,KAAK,EACH,aAAuB,EACvB,IAQC,EACD,EAAE;QACF,MAAM,UAAU,GACd,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI;YACnD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YACxB,CAAC,CAAC,aAAa,CAAC;QAEpB,MAAM,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACX,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YACrB,WAAW,CAAC,CAAC,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QAED,MAAM,qBAAqB,CAAC;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,UAAU;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,EAAE,CAAC,EAAE;YAChB,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACN,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAElG,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,mDAAmD,CAAC;SAChE,cAAc,CAAC,eAAe,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,CAAC,IAAsB,EAAE,EAAE;QACjC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,sDAAsD,CAAC;SACnE,cAAc,CAAC,eAAe,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;SACjD,MAAM,CAAC,CAAC,IAAoC,EAAE,EAAE;QAC/C,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,oEAAoE,CAAC,CAAC;IAErF,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,sEAAsE,CAAC;SACnF,cAAc,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACjE,MAAM,CAAC,QAAQ,EAAE,4CAA4C,CAAC;SAC9D,MAAM,CAAC,iBAAiB,EAAE,2DAA2D,EAAE,OAAO,CAAC;SAC/F,MAAM,CAAC,CAAC,IAA0D,EAAE,EAAE;QACrE,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEL,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE3B,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,6EAA6E,CAAC;SAC1F,cAAc,CAAC,iBAAiB,EAAE,mCAAmC,CAAC;SACtE,MAAM,CAAC,kBAAkB,EAAE,yDAAyD,CAAC;SACrF,MAAM,CAAC,mBAAmB,EAAE,2CAA2C,CAAC;SACxE,MAAM,CAAC,uBAAuB,EAAE,0CAA0C,CAAC;SAC3E,MAAM,CAAC,oBAAoB,EAAE,2CAA2C,CAAC;SACzE,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;SACjD,MAAM,CACL,CAAC,IAQA,EAAE,EAAE;QACH,iBAAiB,CAAC;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEJ,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAExF,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qEAAqE,CAAC;SAClF,MAAM,CAAC,kBAAkB,EAAE,0CAA0C,CAAC;SACtE,MAAM,CAAC,UAAU,EAAE,mDAAmD,CAAC;SACvE,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;SACjD,MAAM,CAAC,CAAC,IAA4D,EAAE,EAAE;QACvE,YAAY,CAAC;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/program-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"program-workflow.d.ts","sourceRoot":"","sources":["../../src/cli/program-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+G/D"}
+{"version":3,"file":"program-workflow.d.ts","sourceRoot":"","sources":["../../src/cli/program-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiEzC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8G/D"}

package/dist/cli/program-workflow.js

@@ -1,9 +1,37 @@
 import { runLegislate } from "./commands/legislate.js";
 import { runMetrics } from "./commands/metrics.js";
 import { runVerify } from "./commands/verify.js";
-import { readStdinIfEmpty } from "./commands/triage.js";
+import { runScan } from "./commands/scan.js";
+import { runRegister } from "./commands/register.js";
+import { runCheckImports } from "./commands/check-imports.js";
+import { runPerimeter } from "./commands/perimeter.js";
+import { readStdinIfEmpty } from "./lib/program-stdin.js";
 import { getOutputAudience } from "./lib/output-context.js";
 import { logError, setExitCode } from "./lib/cli-io.js";
+function verifyOptionsFromCli(opts) {
+    const scanDepth = opts.scanDepth !== undefined ? Number.parseInt(opts.scanDepth, 10) : undefined;
+    return {
+        mission: opts.mission,
+        changedMissions: opts.changedMissions,
+        baseRef: opts.baseRef,
+        workerLog: opts.workerLog,
+        cwd: opts.cwd,
+        fuzzyTrace: opts.fuzzyTrace,
+        strictTrace: opts.strictTrace,
+        skipStaleEvidence: opts.skipStaleEvidence,
+        ci: opts.ci,
+        prePush: opts.prePush,
+        breakGlass: opts.breakGlass,
+        auditCommit: opts.auditCommit,
+        fix: opts.fix,
+        json: opts.json,
+        scanDepth: Number.isFinite(scanDepth) && scanDepth > 0 ? scanDepth : undefined,
+        breakGlassReason: opts.reason,
+        breakGlassCommit: opts.commit,
+        fixNonInteractive: opts.nonInteractive,
+        audience: getOutputAudience(),
+    };
+}
 export function registerWorkflowCommands(program) {
     program
         .command("legislate")
@@ -15,8 +43,7 @@ export function registerWorkflowCommands(program) {
         .option("--out <file>", "Output path (.gitagent/missions/…); defaults to MSN.slug.yaml")
         .option("--gate-command <cmd>", "Deterministic gate command (quote the full shell string if it contains spaces)")
         .option("--gate-success-substring <text>", "Optional substring required in combined gate stdout/stderr")
-        .action(async function (intentParts) {
-        const opts = this.opts();
+        .action(async (intentParts, options, _cmd) => {
         let text = intentParts.join(" ").trim();
         text = await readStdinIfEmpty(text);
         if (!text) {
@@ -24,27 +51,22 @@ export function registerWorkflowCommands(program) {
             setExitCode(2);
             return;
         }
-        const result = runLegislate({
-            intent: text,
-            msn: opts.msn,
-            skillKey: opts.skillKey,
-            out: opts.out,
-            allowDuplicate: opts.allowDuplicate,
-            gateCommand: opts.gateCommand,
-            gateSuccessSubstring: opts.gateSuccessSubstring,
-        });
+        const result = runLegislate({ ...options, intent: text });
         if (!result.ok)
             setExitCode(result.exitCode);
     });
     program
         .command("verify")
         .description("Git-proof (Teacher + MSN) + deterministic gate + hard-stop trace mapping vs WORKER_LOG.md")
-        .requiredOption("--mission <path>", "Mission file (.md or .yaml)")
+        .option("--mission <path>", "Mission file (.md or .yaml)")
+        .option("--changed-missions", "Verify all mission files changed vs base ref on current branch")
+        .option("--base-ref <ref>", "Base ref for --changed-missions (default: origin/main or main)")
         .option("--worker-log <path>", "Override WORKER_LOG.md path")
         .option("--cwd <dir>", "Working directory for gate command")
         .option("--fuzzy-trace", "Force content-based anchor matching for all numeric anchors")
         .option("--strict-trace", "Disable auto line-drift resolution (strict line numbers only)")
         .option("--skip-stale-evidence", "Skip TMVC stale-evidence binding for committed PASS trace lines")
+        .option("--ci", "Authoritative mode: fail-closed on KPI report stale evidence (use in CI)")
         .option("--pre-push", "Pre-push handoff: git-proof only for legislative stubs; full verify otherwise")
         .option("--break-glass", "Skip all verify gates when GXT_BYPASS_SECRET is authorized")
         .option("--reason <text>", "Mandatory break-glass reason (min 10 characters)")
@@ -53,30 +75,51 @@ export function registerWorkflowCommands(program) {
         .option("--fix", "Interactive remediation on failure (human output only; cannot combine with --json)")
         .option("--non-interactive", "With --fix: print structured hints without prompts")
         .option("--json", "Emit structured JSON (failures include fix_hints and next_actions). Incompatible with --fix.")
+        .option("--scan-depth <number>", "Max commits to scan for Teacher [MSN-XXXX] stamp (default: 200, env: GXT_MSN_SCAN_DEPTH)")
         .option("--audience <role>", "Tailor output: worker|teacher|verifier|platform")
         .action(async (opts) => {
-        await runVerify({
-            mission: opts.mission,
-            workerLog: opts.workerLog,
-            cwd: opts.cwd,
-            fuzzyTrace: opts.fuzzyTrace,
-            strictTrace: opts.strictTrace,
-            skipStaleEvidence: opts.skipStaleEvidence,
-            prePush: opts.prePush,
-            breakGlass: opts.breakGlass,
-            breakGlassReason: opts.reason,
-            breakGlassCommit: opts.commit,
-            auditCommit: opts.auditCommit,
-            fix: opts.fix,
-            fixNonInteractive: opts.nonInteractive,
-            json: opts.json,
-            audience: getOutputAudience(),
-        });
+        await runVerify(verifyOptionsFromCli(opts));
+    });
+    program
+        .command("scan")
+        .description("Run llm_verifiers and write committed KPI report JSON for verify kpi_gate")
+        .requiredOption("--mission <path>", "Mission file with llm_verifiers configured")
+        .option("--cwd <dir>", "Working directory for verifier commands")
+        .option("--json", "Emit structured JSON")
+        .action((opts) => {
+        runScan(opts);
+    });
+    program
+        .command("register")
+        .description("AST discovery: propose skill scope from folder imports/exports (does not mutate MANIFEST)")
+        .argument("<dir>", "Repo-relative directory to analyze")
+        .option("--skill-key <key>", "Override suggested skill_key")
+        .option("--json", "Emit proposal JSON")
+        .action((dir, opts) => {
+        runRegister({ dir, skillKey: opts.skillKey, json: opts.json });
+    });
+    program
+        .command("check-imports")
+        .description("Deterministic AST import ban check for a folder (usable as gate_command)")
+        .argument("<dir>", "Repo-relative directory to scan")
+        .requiredOption("--ban <specifier...>", "Banned import specifier (repeatable)")
+        .option("--json", "Emit structured JSON")
+        .action((dir, opts) => {
+        runCheckImports({ dir, ban: opts.ban, json: opts.json });
+    });
+    program
+        .command("perimeter")
+        .description("Check protected governance files; local advisory, --ci requires verified signatures")
+        .option("--base-ref <ref>", "Base ref for change detection (default: origin/main or main)")
+        .option("--ci", "Authoritative CI mode: fail on unsigned protected-file commits")
+        .option("--json", "Emit structured JSON")
+        .action((opts) => {
+        runPerimeter(opts);
     });
     program
         .command("metrics")
-        .description("Git-native governance metrics (no local event ledger)")
-        .option("--json", "Emit stable JSON summary")
+        .description("Git-native governance metrics (path-touch proxy classification; no local event ledger)")
+        .option("--json", "Emit stable JSON summary (includes gxt_extension_metadata)")
         .option("--ref <name>", "Git ref to analyze (default HEAD)", "HEAD")
         .action((opts) => {
         runMetrics({ json: opts.json, ref: opts.ref });

package/dist/cli/program-workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"program-workflow.js","sourceRoot":"","sources":["../../src/cli/program-workflow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,4FAA4F,CAAC;SACzG,QAAQ,CAAC,aAAa,EAAE,iCAAiC,CAAC;SAC1D,cAAc,CAAC,YAAY,EAAE,2CAA2C,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,0DAA0D,CAAC;SACvF,MAAM,CAAC,mBAAmB,EAAE,+DAA+D,CAAC;SAC5F,MAAM,CAAC,cAAc,EAAE,+DAA+D,CAAC;SACvF,MAAM,CACL,sBAAsB,EACtB,gFAAgF,CACjF;SACA,MAAM,CACL,iCAAiC,EACjC,4DAA4D,CAC7D;SACA,MAAM,CAAC,KAAK,WAA0B,WAAqB;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAOlB,CAAC;QACL,IAAI,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YACzD,WAAW,CAAC,CAAC,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,2FAA2F,CAC5F;SACA,cAAc,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACjE,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,eAAe,EAAE,6DAA6D,CAAC;SACtF,MAAM,CAAC,gBAAgB,EAAE,+DAA+D,CAAC;SACzF,MAAM,CAAC,uBAAuB,EAAE,iEAAiE,CAAC;SAClG,MAAM,CAAC,YAAY,EAAE,+EAA+E,CAAC;SACrG,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;SAC7E,MAAM,CAAC,gBAAgB,EAAE,sDAAsD,CAAC;SAChF,MAAM,CAAC,gBAAgB,EAAE,6DAA6D,CAAC;SACvF,MAAM,CAAC,OAAO,EAAE,oFAAoF,CAAC;SACrG,MAAM,CAAC,mBAAmB,EAAE,oDAAoD,CAAC;SACjF,MAAM,CAAC,QAAQ,EAAE,8FAA8F,CAAC;SAChH,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CACL,KAAK,EAAE,IAgBN,EAAE,EAAE;QACH,MAAM,SAAS,CAAC;YACd,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,gBAAgB,EAAE,IAAI,CAAC,MAAM;YAC7B,gBAAgB,EAAE,IAAI,CAAC,MAAM;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,iBAAiB,EAAE,IAAI,CAAC,cAAc;YACtC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,iBAAiB,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,QAAQ,EAAE,0BAA0B,CAAC;SAC5C,MAAM,CAAC,cAAc,EAAE,mCAAmC,EAAE,MAAM,CAAC;SACnE,MAAM,CAAC,CAAC,IAAsC,EAAE,EAAE;QACjD,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"program-workflow.js","sourceRoot":"","sources":["../../src/cli/program-workflow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAyB,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA4BxD,SAAS,oBAAoB,CAAC,IAAsB;IAClD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAU,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC/E,gBAAgB,EAAE,IAAI,CAAC,MAAM;QAC7B,gBAAgB,EAAE,IAAI,CAAC,MAAM;QAC7B,iBAAiB,EAAE,IAAI,CAAC,cAAc;QACtC,QAAQ,EAAE,iBAAiB,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,4FAA4F,CAAC;SACzG,QAAQ,CAAC,aAAa,EAAE,iCAAiC,CAAC;SAC1D,cAAc,CAAC,YAAY,EAAE,2CAA2C,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,0DAA0D,CAAC;SACvF,MAAM,CAAC,mBAAmB,EAAE,+DAA+D,CAAC;SAC5F,MAAM,CAAC,cAAc,EAAE,+DAA+D,CAAC;SACvF,MAAM,CACL,sBAAsB,EACtB,gFAAgF,CACjF;SACA,MAAM,CACL,iCAAiC,EACjC,4DAA4D,CAC7D;SACA,MAAM,CAAC,KAAK,EAAE,WAAqB,EAAE,OAA4B,EAAE,IAAa,EAAE,EAAE;QACnF,IAAI,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YACzD,WAAW,CAAC,CAAC,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,2FAA2F,CAC5F;SACA,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACzD,MAAM,CAAC,oBAAoB,EAAE,gEAAgE,CAAC;SAC9F,MAAM,CAAC,kBAAkB,EAAE,gEAAgE,CAAC;SAC5F,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,eAAe,EAAE,6DAA6D,CAAC;SACtF,MAAM,CAAC,gBAAgB,EAAE,+DAA+D,CAAC;SACzF,MAAM,CAAC,uBAAuB,EAAE,iEAAiE,CAAC;SAClG,MAAM,CAAC,MAAM,EAAE,0EAA0E,CAAC;SAC1F,MAAM,CAAC,YAAY,EAAE,+EAA+E,CAAC;SACrG,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;SAC7E,MAAM,CAAC,gBAAgB,EAAE,sDAAsD,CAAC;SAChF,MAAM,CAAC,gBAAgB,EAAE,6DAA6D,CAAC;SACvF,MAAM,CAAC,OAAO,EAAE,oFAAoF,CAAC;SACrG,MAAM,CAAC,mBAAmB,EAAE,oDAAoD,CAAC;SACjF,MAAM,CAAC,QAAQ,EAAE,8FAA8F,CAAC;SAChH,MAAM,CACL,uBAAuB,EACvB,0FAA0F,CAC3F;SACA,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAAsB,EAAE,EAAE;QACvC,MAAM,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2EAA2E,CAAC;SACxF,cAAc,CAAC,kBAAkB,EAAE,4CAA4C,CAAC;SAChF,MAAM,CAAC,aAAa,EAAE,yCAAyC,CAAC;SAChE,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC;SACxC,MAAM,CAAC,CAAC,IAAuD,EAAE,EAAE;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,2FAA2F,CAAC;SACxG,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,CAAC,GAAW,EAAE,IAA2C,EAAE,EAAE;QACnE,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,0EAA0E,CAAC;SACvF,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC;SACpD,cAAc,CAAC,sBAAsB,EAAE,sCAAsC,CAAC;SAC9E,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC;SACxC,MAAM,CAAC,CAAC,GAAW,EAAE,IAAuC,EAAE,EAAE;QAC/D,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,qFAAqF,CAAC;SAClG,MAAM,CAAC,kBAAkB,EAAE,8DAA8D,CAAC;SAC1F,MAAM,CAAC,MAAM,EAAE,gEAAgE,CAAC;SAChF,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC;SACxC,MAAM,CAAC,CAAC,IAAwD,EAAE,EAAE;QACnE,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,wFAAwF,CACzF;SACA,MAAM,CAAC,QAAQ,EAAE,4DAA4D,CAAC;SAC9E,MAAM,CAAC,cAAc,EAAE,mCAAmC,EAAE,MAAM,CAAC;SACnE,MAAM,CAAC,CAAC,IAAsC,EAAE,EAAE;QACjD,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeger-ai/opengantry",
-  "version": "1.1.2",
+  "version": "2.1.0",
   "description": "OpenGantry GXT substrate + gapman CLI",
   "type": "module",
   "bin": {
@@ -16,7 +16,8 @@
   ],
   "scripts": {
     "gen:version": "node scripts/gen-version.mjs",
-    "build": "npm run gen:version && tsc",
+    "gen:catalog": "node scripts/gen-asset-catalog.mjs",
+    "build": "npm run gen:version && npm run gen:catalog && tsc",
     "gapman": "node dist/cli/index.js",
     "lint": "eslint src/cli/**/*.ts",
     "check:changed": "./scripts/check-changed-code.sh",
@@ -49,6 +50,8 @@
   "dependencies": {
     "@clack/prompts": "^0.10.1",
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "commander": "^12.1.0",
     "yaml": "^2.6.1",
     "zod": "^3.25.76"

package/templates/.cursor/rules/opengantry-gxt-substrate.mdc

@@ -39,5 +39,6 @@ Treat these as the **law + routing contract** for agent work. For orientation an
 - **Terminal bootstrap:** `source scripts/gxt-runtime-env.sh` (uses pinned mission or explicit path).
 - **Code architecture:** `.gitagent/ARCHITECTURE.pointer.json` — if `kind=unset` or stub, read `.gitagent/teacher/ARCHITECTURE-DISCOVERY.md` and ask user before coding.
 - **Human IDE setup:** `docs/INTEGRATIONS.md` (adopter reference — not agent context).
+- **External IDE skills:** local only — copy `.cursor/external-skills.local.example.mdc` → `.cursor/external-skills.local.mdc` (gitignored). Never commit third-party skill packs into GXT substrate.
 
 If the user clearly scopes work to something that cannot affect OpenGantry (e.g. a typo in unrelated docs), still skim **RULES** and **MANIFEST** when the change could touch skills, missions, routing, or manifest sync.

package/templates/.gitagent/foreman/MANIFEST.json

@@ -33,5 +33,10 @@
     "src/auth/": "Tier-3",
     "src/db/schema/": "Tier-3"
   },
-  "risk_keywords": ["refactor", "migrate", "delete", "security", "schema"]
+  "risk_keywords": ["refactor", "migrate", "delete", "security", "schema"],
+  "perimeter_protected": [
+    "**/.gxt-skill.yaml",
+    ".gitagent/foreman/MANIFEST.json",
+    ".gitagent/teacher/RULES.md"
+  ]
 }

package/templates/.gitagent/teacher/KPI-REPORT.schema.yaml

@@ -0,0 +1,48 @@
+# KPI-REPORT.schema — JSON Schema for committed LLM/scan evidence reports
+# Consumed by gapman verify kpi phase (Ajv). Version label for docs only.
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: https://opengantry.local/schemas/kpi-report.v2_0.json
+title: OpenGantryKpiReport
+type: object
+additionalProperties: false
+required:
+  - msn_id
+  - generated_at
+  - exit_code
+  - metrics
+properties:
+  msn_id:
+    type: string
+    pattern: "^MSN-[0-9]{4}$"
+  generated_at:
+    type: string
+    format: date-time
+  exit_code:
+    type: integer
+  metrics:
+    type: object
+    additionalProperties:
+      oneOf:
+        - type: number
+        - type: boolean
+  findings:
+    type: array
+    default: []
+    items:
+      type: object
+      additionalProperties: false
+      required:
+        - severity
+        - path
+        - message
+      properties:
+        severity:
+          type: string
+          enum: [info, warn, error]
+        path:
+          type: string
+        line:
+          type: integer
+          minimum: 1
+        message:
+          type: string

package/templates/.gitagent/teacher/MISSION.schema.yaml

@@ -78,3 +78,73 @@ properties:
         status:
           type: string
           pattern: "^(PASS|FAIL|PENDING|pass|fail|pending)$"
+  kpi_gate:
+    type: object
+    additionalProperties: false
+    required:
+      - thresholds
+    properties:
+      report_path:
+        type: string
+        minLength: 1
+      thresholds:
+        type: array
+        minItems: 1
+        items:
+          type: object
+          additionalProperties: false
+          required:
+            - metric
+            - op
+            - value
+          properties:
+            metric:
+              type: string
+              minLength: 1
+            op:
+              type: string
+              enum: ["<=", ">=", "==", "<", ">"]
+            value:
+              type: number
+  llm_verifiers:
+    type: array
+    items:
+      type: object
+      additionalProperties: false
+      required:
+        - id
+        - command
+      properties:
+        id:
+          type: string
+          minLength: 1
+        command:
+          type: string
+          minLength: 1
+        provider:
+          type: string
+        required:
+          type: boolean
+          default: false
+  aggregators:
+    type: array
+    items:
+      type: object
+      additionalProperties: false
+      required:
+        - key
+        - op
+        - sources
+      properties:
+        key:
+          type: string
+          minLength: 1
+        op:
+          type: string
+          enum: [max, min, sum]
+        sources:
+          type: array
+          minItems: 1
+          items:
+            type: string
+            minLength: 1

package/templates/.gitagent/teacher/WORKER_LOG.template.md

@@ -1,2 +1,3 @@
 # WORKER_LOG
 
+<!-- Mission trace_rows PASS quotes go here. Optional [SKILL-EXEC] reviewer context: see .gitagent/teacher/RUNTIME.md § Optional skill context stamps. -->

package/templates/.githooks/pre-commit

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# OpenGantry pre-commit: advisory TMVC path guard (staged index vs mission roots).
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+if [[ -f dist/cli/index.js ]]; then
+  GAPMAN=(node dist/cli/index.js)
+elif command -v gapman >/dev/null 2>&1; then
+  GAPMAN=(gapman)
+else
+  echo "pre-commit: gapman not found — run: npm run build" >&2
+  exit 1
+fi
+
+mission=""
+if mission="$(scripts/gxt-resolve-mission.sh 2>/dev/null)"; then
+  :
+else
+  echo "pre-commit: no pinned mission — skipping TMVC guard (advisory)" >&2
+  exit 0
+fi
+
+echo "pre-commit: gapman tmvc guard --mission ${mission} (advisory default)" >&2
+"${GAPMAN[@]}" tmvc guard --mission "$mission"
+exit 0

package/templates/.githooks/pre-push

@@ -38,6 +38,11 @@ for mission in "${missions[@]}"; do
   "${GAPMAN[@]}" verify --mission "$mission" --pre-push || exit 1
 done
 
+if git diff --name-only "${base}..HEAD" | grep -qE '^\.gitagent/foreman/MANIFEST\.json$|^\.gitagent/teacher/RULES\.md$|\.gxt-skill\.yaml$'; then
+  echo "pre-push: gapman perimeter (advisory)" >&2
+  "${GAPMAN[@]}" perimeter --base-ref "$base" || true
+fi
+
 if git diff --name-only "${base}..HEAD" | grep -qE '^\.gitagent/foreman/MANIFEST\.json$|^skills/'; then
   echo "pre-push: gapman check (manifest / skills changed)" >&2
   "${GAPMAN[@]}" check || exit 1

package/templates/.github/workflows/gxt-validate.yml

@@ -37,6 +37,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - uses: actions/setup-node@v6
         with:
@@ -61,6 +63,12 @@ jobs:
       - name: gapman doctor (readiness)
         run: node dist/cli/index.js doctor
 
+      - name: gapman perimeter (CI signature enforcement)
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: node dist/cli/index.js perimeter --ci --base-ref "$BASE_SHA"
+
   code_quality:
     if: github.event_name == 'pull_request'
     needs: pr_governance
@@ -79,6 +87,9 @@ jobs:
       - name: Install Node deps
         run: npm ci
 
+      - name: Build gapman
+        run: npm run build
+
       - name: Changed-code quality gates (complexity + import layers)
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}

package/templates/AGENTS.md

@@ -22,3 +22,7 @@ When the user **explicitly** asks to write, edit, refactor, or implement code an
 - **Fast-path** trivial single-file work; **full interview** for heavy/risky scope.
 - **Cursor MCP handoff (preferred):** `gxt_draft_legislation` → human chat approval → `gxt_execute_legislation` → Teacher commit → `gxt_check_signature` → `gxt_pin_mission`.
 - **CLI fallback:** one copy-paste `gapman legislate …` command — never raw YAML blocks.
+
+## External IDE skills (edge quarantine)
+
+Third-party agent skills are **untrusted edge helpers** — not GXT law. Keep them in local IDE config (gitignored); do not add subjective style guides to this file or `.gitagent/`. Repository safety is deterministic gates only (compile, tests, import layers). Optional `[SKILL-EXEC]` lines in `WORKER_LOG.md` are reviewer context only — see `.gitagent/teacher/RUNTIME.md`.

package/templates/integrations/asset-catalog.json

@@ -0,0 +1,46 @@
+{
+  "schema_version": "1",
+  "assets": [
+    { "targetPath": ".agent/rules/gxt.md", "templatePath": "integrations/antigravity/.agent/rules/gxt.md", "mode": "scaffold_only", "tags": ["antigravity"] },
+    { "targetPath": ".aider.conf.yml", "templatePath": "integrations/aider/.aider.conf.yml", "mode": "scaffold_only", "tags": ["aider"] },
+    { "targetPath": ".clinerules/gxt.md", "templatePath": "integrations/cline/.clinerules/gxt.md", "mode": "scaffold_only", "tags": ["cline"] },
+    { "targetPath": ".codex/config.toml", "templatePath": "integrations/codex-cli/.codex/config.toml", "mode": "scaffold_only", "tags": ["codex-cli"] },
+    { "targetPath": ".cursor/hooks.json", "mode": "managed_strict", "tags": ["cursor"] },
+    { "targetPath": ".cursor/hooks/gxt-before-shell.sh", "mode": "managed_strict", "executable": true, "tags": ["cursor"] },
+    { "targetPath": ".cursor/hooks/gxt-session-start.sh", "mode": "managed_strict", "executable": true, "tags": ["cursor"] },
+    { "targetPath": ".cursor/mcp.json", "mode": "managed_strict", "tags": ["cursor"] },
+    { "targetPath": ".cursor/rules/opengantry-gxt-substrate.mdc", "mode": "managed_strict", "tags": ["cursor"] },
+    { "targetPath": ".gitagent/foreman/BYPASS.sha256", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": ".gitagent/foreman/MANIFEST.json", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": ".gitagent/foreman/SUBSTRATE.version.json", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": ".gitagent/missions/README.md", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": ".gitagent/teacher/ARCHITECTURE-ACCESS.md", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": ".gitagent/teacher/ARCHITECTURE-DISCOVERY.md", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": ".gitagent/teacher/KPI-REPORT.schema.yaml", "mode": "managed_strict", "tags": ["core"] },
+    { "targetPath": ".gitagent/teacher/MISSION-ARCHITECT.md", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": ".gitagent/teacher/MISSION.schema.yaml", "mode": "managed_strict", "tags": ["core"] },
+    { "targetPath": ".gitagent/teacher/RULES.md", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": ".gitagent/teacher/WORKER_LOG.template.md", "mode": "managed_strict", "tags": ["core"] },
+    { "targetPath": ".githooks/post-checkout", "mode": "managed_strict", "executable": true, "tags": ["hooks"] },
+    { "targetPath": ".githooks/pre-commit", "mode": "managed_strict", "executable": true, "tags": ["hooks"] },
+    { "targetPath": ".githooks/pre-push", "mode": "managed_strict", "executable": true, "tags": ["hooks"] },
+    { "targetPath": ".github/workflows/gxt-validate.yml", "mode": "managed_strict", "tags": ["ci"] },
+    { "targetPath": ".junie/guidelines.md", "templatePath": "integrations/junie/.junie/guidelines.md", "mode": "scaffold_only", "tags": ["junie"] },
+    { "targetPath": ".openhands/microagents/gxt.md", "templatePath": "integrations/openhands/.openhands/microagents/gxt.md", "mode": "scaffold_only", "tags": ["openhands"] },
+    { "targetPath": "AGENTS.md", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": "CLAUDE.md", "templatePath": "integrations/claude-code/CLAUDE.md", "mode": "scaffold_only", "tags": ["claude-code"] },
+    { "targetPath": "docs/ARCHITECTURE.md", "mode": "scaffold_only", "tags": ["core"] },
+    { "targetPath": "opencode.json", "templatePath": "integrations/opencode/opencode.json", "mode": "scaffold_only", "tags": ["opencode"] },
+    { "targetPath": "scripts/gxt-cursor-env.sh", "mode": "managed_strict", "executable": true, "tags": ["runtime"] },
+    { "targetPath": "scripts/gxt-manifest-lib.mjs", "mode": "managed_strict", "executable": true, "tags": ["core"] },
+    { "targetPath": "scripts/gxt-pin-mission.sh", "mode": "managed_strict", "executable": true, "tags": ["runtime"] },
+    { "targetPath": "scripts/gxt-resolve-mission.sh", "mode": "managed_strict", "executable": true, "tags": ["runtime"] },
+    { "targetPath": "scripts/gxt-runtime-env.sh", "mode": "managed_strict", "executable": true, "tags": ["runtime"] },
+    { "targetPath": "scripts/validate-gxt.sh", "mode": "managed_strict", "executable": true, "tags": ["core"] },
+    { "targetPath": "scripts/verify-pr-missions.sh", "mode": "managed_strict", "executable": true, "tags": ["ci"] },
+    { "targetPath": "skills/gapman.md", "mode": "scaffold_only", "tags": ["skill-specimen"] },
+    { "targetPath": "skills/logic.md", "mode": "scaffold_only", "tags": ["skill-minimal", "skill-specimen"] },
+    { "targetPath": "skills/substrate.md", "mode": "scaffold_only", "tags": ["skill-specimen"] },
+    { "targetPath": "skills/ui.md", "mode": "scaffold_only", "tags": ["skill-minimal", "skill-specimen"] }
+  ]
+}