@jeger-ai/opengantry 2.2.2 → 2.2.3

package/README.md

@@ -60,14 +60,15 @@ Developing this repository from source: `npm ci && npm run build` — see [gapma
 | **Regulated / ISO-aligned workflows** | SOD, mission authorization, and Git-native trace — see [`docs/COMPLIANCE-ISO.md`](docs/COMPLIANCE-ISO.md) (27001 change control, 42001 AI governance) |
 | **Faster recovery from failure** | Stable `GXT_*` error codes, `gapman verify --fix`, role output via `--audience worker\|teacher\|verifier` |
 
-**Protocol maturity:** substrate law **v0.5.0**; **`gapman` v2.2.2** — Time-to-Scaffold public benchmark, measured LOC matrix. Current npm publish: **v2.2.2**. See [.gitagent/teacher/RUNTIME.md](.gitagent/teacher/RUNTIME.md).
+**Protocol maturity:** substrate law **v0.5.0**; **`gapman` v2.2.3** — declarative trusted automation policy for low-risk bot maintenance. Current npm publish: **v2.2.3**. See [.gitagent/teacher/RUNTIME.md](.gitagent/teacher/RUNTIME.md).
 
 ## Release timeline (latest first)
 
-Current npm release in this repository: **`gapman` v2.2.2**. Use [`docs/ADOPTION.md`](docs/ADOPTION.md) for the ordered runbook.
+Current npm release in this repository: **`gapman` v2.2.3**. Use [`docs/ADOPTION.md`](docs/ADOPTION.md) for the ordered runbook.
 
 | Release | Highlights |
 |---------|------------|
+| **v2.2.3** | Declarative `trusted_automation` policy in `.gitagent/config.json` — repository-legislated bot maintenance bypass with `max_net_loc <= 5` ([#92](https://github.com/jeger-ai/opengantry/issues/92)) |
 | **v2.2.2** | Time-to-Scaffold benchmark — `npm run examples:benchmark`, measured LOC matrix, adoption discovery ([#79](https://github.com/jeger-ai/opengantry/issues/79)) |
 | **v2.2.1** | Thermo remediation — unified `NormalizedVerifyFailure` contract across JSON/human/context-feed; race-safe remediation snapshot writes; canonical `verify-presentation` entrypoint |
 | **v2.2.0** | `gapman context-feed`, `gapman audit-rigor`, `virtual_capture` ephemeral virtualization ([#68](https://github.com/jeger-ai/opengantry/issues/68)), product positioning, docs quality ([#66](https://github.com/jeger-ai/opengantry/issues/66)–[#69](https://github.com/jeger-ai/opengantry/issues/69), [#76](https://github.com/jeger-ai/opengantry/issues/76)) |

package/dist/cli/lib/version.gen.d.ts

@@ -1,4 +1,4 @@
 /** Generated by scripts/gen-version.mjs — do not edit */
-export declare const CLI_VERSION = "2.2.2";
+export declare const CLI_VERSION = "2.2.3";
 export declare const NPM_PACKAGE_NAME = "@jeger-ai/opengantry";
 //# sourceMappingURL=version.gen.d.ts.map

package/dist/cli/lib/version.gen.js

@@ -1,4 +1,4 @@
 /** Generated by scripts/gen-version.mjs — do not edit */
-export const CLI_VERSION = "2.2.2";
+export const CLI_VERSION = "2.2.3";
 export const NPM_PACKAGE_NAME = "@jeger-ai/opengantry";
 //# sourceMappingURL=version.gen.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeger-ai/opengantry",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "OpenGantry GXT substrate + gapman CLI",
   "type": "module",
   "bin": {

package/templates/.gitagent/config.json

@@ -0,0 +1,15 @@
+{
+  "trusted_automation": {
+    "rules": [
+      {
+        "id": "workflow-dependency-bumps",
+        "allowed_actors": [
+          "dependabot[bot]@users.noreply.github.com"
+        ],
+        "allowed_paths": [".github/workflows/**"],
+        "allowed_structural_changes": ["workflow_version_pin"],
+        "max_net_loc": 5
+      }
+    ]
+  }
+}

package/templates/.github/workflows/gxt-validate.yml

@@ -3,7 +3,8 @@
 # PR governance (pull_request only): mission PRs must target the repo default branch
 # (override: repository variable GXT_INTEGRATION_BRANCH when integration branch differs).
 # MSN policy (pull_request only): commits touching MSN-enforced paths must have
-# subject [MSN-NNNN] (four digits) or a valid gxt-bypass git note.
+# subject [MSN-NNNN] (four digits), a valid gxt-bypass git note, or satisfy
+# repository-declared trusted_automation policy (.gitagent/config.json).
 # Mission purity: scripts/verify-pr-missions.sh — one [MSN-NNNN] per PR commit range.
 # Paths = fixed substrate (.gitagent/, WORKER_LOG.md, .githooks/, gxt-validate.yml)
 #       + all MANIFEST skills[].tmvc_roots (Node via scripts/gxt-manifest-lib.mjs).
@@ -36,7 +37,7 @@ jobs:
   manifest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -74,7 +75,7 @@ jobs:
     needs: pr_governance
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
@@ -99,7 +100,7 @@ jobs:
   npm_pack:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -117,7 +118,7 @@ jobs:
     needs: pr_governance
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
@@ -136,7 +137,7 @@ jobs:
     needs: pr_governance
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}

package/templates/integrations/asset-catalog.json

@@ -10,6 +10,7 @@
     { "targetPath": ".cursor/hooks/gxt-session-start.sh", "mode": "managed_strict", "executable": true, "tags": ["cursor"] },
     { "targetPath": ".cursor/mcp.json", "mode": "managed_strict", "tags": ["cursor"] },
     { "targetPath": ".cursor/rules/opengantry-gxt-substrate.mdc", "mode": "managed_strict", "tags": ["cursor"] },
+    { "targetPath": ".gitagent/config.json", "mode": "scaffold_only", "tags": ["core"] },
     { "targetPath": ".gitagent/foreman/BYPASS.sha256", "mode": "scaffold_only", "tags": ["core"] },
     { "targetPath": ".gitagent/foreman/MANIFEST.json", "mode": "scaffold_only", "tags": ["core"] },
     { "targetPath": ".gitagent/foreman/SUBSTRATE.version.json", "mode": "scaffold_only", "tags": ["core"] },

package/templates/integrations/compatibility.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1",
-  "opengantry_version": "2.2.2",
+  "opengantry_version": "2.2.3",
   "asset_catalog": "integrations/asset-catalog.json",
   "integrations": {
     "cursor": {

package/templates/scripts/gxt-manifest-lib.mjs

@@ -1,13 +1,18 @@
 #!/usr/bin/env node
 /**
- * Node-only MANIFEST helpers for validate-gxt.sh (no jq dependency).
+ * Node-only MANIFEST + trusted automation policy helpers for validate-gxt.sh (no jq).
  * Usage:
  *   node scripts/gxt-manifest-lib.mjs prefixes [repoRoot]
  *   node scripts/gxt-manifest-lib.mjs validate-manifest [repoRoot]
  *   node scripts/gxt-manifest-lib.mjs validate-bypass-note  (JSON on stdin)
+ *   node scripts/gxt-manifest-lib.mjs eval-commit <repoRoot> <commitSha>
+ *   node scripts/gxt-manifest-lib.mjs eval-range <repoRoot> <baseSha> <headSha>
  */
 import fs from "node:fs";
 import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
 
 const FIXED_MSN_PREFIXES = [
   ".gitagent/",
@@ -16,11 +21,38 @@ const FIXED_MSN_PREFIXES = [
   ".github/workflows/gxt-validate.yml",
 ];
 
+const HARD_MAX_NET_LOC = 5;
+const ALLOWED_STRUCTURAL_CHANGES = new Set(["workflow_version_pin"]);
+const CONFIG_REL = ".gitagent/config.json";
+
 export function repoRootFromArg(arg) {
   if (arg?.trim()) return path.resolve(arg.trim());
   return process.cwd();
 }
 
+function git(repoRoot, args) {
+  return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8" }).trimEnd();
+}
+
+function normalizePath(p) {
+  return p.replace(/\\/g, "/");
+}
+
+function resolveYamlParser(repoRoot) {
+  const candidates = [
+    path.join(repoRoot, "node_modules/yaml"),
+    path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "node_modules/yaml"),
+  ];
+  for (const dir of candidates) {
+    const pkg = path.join(dir, "package.json");
+    if (fs.existsSync(pkg)) {
+      const req = createRequire(pkg);
+      return req("yaml");
+    }
+  }
+  throw new Error("gxt-manifest-lib: yaml package not found (run npm ci)");
+}
+
 export function readManifest(repoRoot) {
   const rel = ".gitagent/foreman/MANIFEST.json";
   const abs = path.join(repoRoot, rel);
@@ -36,6 +68,81 @@ export function readManifest(repoRoot) {
   return parsed;
 }
 
+export function loadTrustedAutomationRules(repoRoot) {
+  const abs = path.join(repoRoot, CONFIG_REL);
+  if (!fs.existsSync(abs)) {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(abs, "utf8"));
+  } catch (e) {
+    throw new Error(
+      `gxt-manifest-lib: invalid JSON in ${CONFIG_REL}: ${e instanceof Error ? e.message : String(e)}`,
+    );
+  }
+  const block = parsed?.trusted_automation;
+  if (!block) {
+    return [];
+  }
+  if (!Array.isArray(block.rules) || block.rules.length === 0) {
+    return [];
+  }
+  const rules = [];
+  for (const [i, rule] of block.rules.entries()) {
+    if (!rule || typeof rule !== "object") {
+      throw new Error(`gxt-manifest-lib: trusted_automation.rules[${i}] must be an object`);
+    }
+    if (typeof rule.id !== "string" || !rule.id.trim()) {
+      throw new Error(`gxt-manifest-lib: trusted_automation.rules[${i}] missing id`);
+    }
+    if (!Array.isArray(rule.allowed_actors) || rule.allowed_actors.length === 0) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} requires non-empty allowed_actors`);
+    }
+    if (!Array.isArray(rule.allowed_paths) || rule.allowed_paths.length === 0) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} requires non-empty allowed_paths`);
+    }
+    if (!Array.isArray(rule.allowed_structural_changes) || rule.allowed_structural_changes.length === 0) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} requires allowed_structural_changes`);
+    }
+    for (const change of rule.allowed_structural_changes) {
+      if (!ALLOWED_STRUCTURAL_CHANGES.has(change)) {
+        throw new Error(`gxt-manifest-lib: rule ${rule.id} has unsupported structural change: ${change}`);
+      }
+    }
+    if (typeof rule.max_net_loc !== "number" || !Number.isInteger(rule.max_net_loc) || rule.max_net_loc < 1) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} max_net_loc must be a positive integer`);
+    }
+    if (rule.max_net_loc > HARD_MAX_NET_LOC) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} max_net_loc exceeds hard cap ${HARD_MAX_NET_LOC}`);
+    }
+    rules.push({
+      id: rule.id,
+      allowed_actors: rule.allowed_actors.map((a) => String(a).trim().toLowerCase()),
+      allowed_paths: rule.allowed_paths.map((p) => normalizePath(String(p))),
+      allowed_structural_changes: new Set(rule.allowed_structural_changes),
+      max_net_loc: rule.max_net_loc,
+    });
+  }
+  return rules;
+}
+
+export function matchGlob(pattern, filePath) {
+  const normalized = normalizePath(filePath);
+  const re = new RegExp(
+    `^${normalizePath(pattern)
+      .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+      .replace(/\*\*/g, "<<<GLOBSTAR>>>")
+      .replace(/\*/g, "[^/]*")
+      .replace(/<<<GLOBSTAR>>>/g, ".*")}$`,
+  );
+  return re.test(normalized);
+}
+
+export function pathMatchesAllowed(filePath, allowedPaths) {
+  return allowedPaths.some((pattern) => matchGlob(pattern, filePath));
+}
+
 export function listMsnEnforcedPrefixes(repoRoot) {
   const manifest = readManifest(repoRoot);
   const skills = manifest.skills;
@@ -49,11 +156,22 @@ export function listMsnEnforcedPrefixes(repoRoot) {
   const out = new Set();
   for (const p of [...FIXED_MSN_PREFIXES, ...roots]) {
     if (typeof p !== "string" || !p.trim()) continue;
-    out.add(p.replace(/\\/g, "/"));
+    out.add(normalizePath(p));
   }
   return [...out];
 }
 
+export function isMsnEnforcedPath(filePath, prefixes) {
+  const p = normalizePath(filePath);
+  for (const prefix of prefixes) {
+    if (!prefix) continue;
+    if (p === prefix) return true;
+    if (prefix.endsWith("/") && p.startsWith(prefix)) return true;
+    if (!prefix.endsWith("/") && p.startsWith(`${prefix}/`)) return true;
+  }
+  return false;
+}
+
 export function validateManifestStructure(repoRoot) {
   const m = readManifest(repoRoot);
   if (typeof m.schema_version !== "string" || m.schema_version.length === 0) {
@@ -101,6 +219,274 @@ export function validateBypassNoteJson(raw) {
   );
 }
 
+function parseNumstat(output) {
+  let total = 0;
+  for (const line of output.split("\n")) {
+    if (!line.trim()) continue;
+    const [adds, dels] = line.split("\t");
+    if (adds === "-" || dels === "-") continue;
+    total += Number(adds) + Number(dels);
+  }
+  return total;
+}
+
+function gitNumstat(repoRoot, args) {
+  try {
+    return parseNumstat(git(repoRoot, args));
+  } catch {
+    return 0;
+  }
+}
+
+function commitChangedFiles(repoRoot, commitSha) {
+  const out = git(repoRoot, ["diff-tree", "--no-commit-id", "--name-only", "-r", commitSha]);
+  return out ? out.split("\n").filter(Boolean).map(normalizePath) : [];
+}
+
+function rangeChangedFiles(repoRoot, baseSha, headSha) {
+  const out = git(repoRoot, ["diff", "--name-only", "--diff-filter=ACMRT", `${baseSha}...${headSha}`]);
+  return out ? out.split("\n").filter(Boolean).map(normalizePath) : [];
+}
+
+function commitAuthorEmail(repoRoot, commitSha) {
+  return git(repoRoot, ["log", "-1", "--format=%ae", commitSha]).toLowerCase();
+}
+
+function objectKeysEqual(a, b) {
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length;
+  }
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") {
+    return typeof a === typeof b;
+  }
+  const keysA = Object.keys(a).sort();
+  const keysB = Object.keys(b).sort();
+  return keysA.length === keysB.length && keysA.every((k, i) => k === keysB[i]);
+}
+
+function collectStructuralDiffs(before, after, keyPath = []) {
+  const diffs = [];
+  if (Array.isArray(before) && Array.isArray(after)) {
+    for (let i = 0; i < before.length; i++) {
+      diffs.push(...collectStructuralDiffs(before[i], after[i], [...keyPath, String(i)]));
+    }
+    return diffs;
+  }
+  if (before !== null && after !== null && typeof before === "object" && typeof after === "object") {
+    const keys = Object.keys(before);
+    for (const key of keys) {
+      const childPath = [...keyPath, key];
+      const bv = before[key];
+      const av = after[key];
+      if (bv !== null && av !== null && typeof bv === "object" && typeof av === "object") {
+        diffs.push(...collectStructuralDiffs(bv, av, childPath));
+      } else if (bv !== av) {
+        diffs.push({ path: childPath, before: bv, after: av });
+      }
+    }
+    return diffs;
+  }
+  if (before !== after) {
+    diffs.push({ path: keyPath, before, after });
+  }
+  return diffs;
+}
+
+function isWorkflowVersionPinChange(before, after) {
+  if (typeof before !== "string" || typeof after !== "string") return false;
+  const usesRe = /^([^@]+@)(.+)$/;
+  const bm = before.match(usesRe);
+  const am = after.match(usesRe);
+  return Boolean(bm && am && bm[1] === am[1] && bm[2] !== am[2]);
+}
+
+function structuresMatch(before, after) {
+  if (Array.isArray(before) && Array.isArray(after)) {
+    if (before.length !== after.length) return false;
+    return before.every((item, i) => structuresMatch(item, after[i]));
+  }
+  if (before !== null && after !== null && typeof before === "object" && typeof after === "object") {
+    if (!objectKeysEqual(before, after)) return false;
+    return Object.keys(before).every((k) => structuresMatch(before[k], after[k]));
+  }
+  return true;
+}
+
+function workflowVersionPinOnly(beforeContent, afterContent, yaml) {
+  let beforeDoc;
+  let afterDoc;
+  try {
+    beforeDoc = yaml.parse(beforeContent);
+    afterDoc = yaml.parse(afterContent);
+  } catch {
+    return false;
+  }
+  if (!structuresMatch(beforeDoc, afterDoc)) {
+    return false;
+  }
+  const diffs = collectStructuralDiffs(beforeDoc, afterDoc);
+  if (diffs.length === 0) return true;
+  return diffs.every((d) => {
+    const lastKey = d.path[d.path.length - 1];
+    return lastKey === "uses" && isWorkflowVersionPinChange(d.before, d.after);
+  });
+}
+
+function readBlobAt(repoRoot, commitSha, filePath) {
+  try {
+    return git(repoRoot, ["show", `${commitSha}:${filePath}`]);
+  } catch {
+    return null;
+  }
+}
+
+function validateStructuralChanges(repoRoot, files, rule, baseSha, headSha, mode) {
+  if (!rule.allowed_structural_changes.has("workflow_version_pin")) {
+    return { ok: false, reason: `rule ${rule.id}: no matching structural change policy` };
+  }
+  const yaml = resolveYamlParser(repoRoot);
+  const workflowFiles = files.filter((f) => /\.ya?ml$/i.test(f));
+  for (const file of workflowFiles) {
+    let beforeContent;
+    let afterContent;
+    if (mode === "commit") {
+      const parent = git(repoRoot, ["rev-parse", `${headSha}^`]);
+      beforeContent = readBlobAt(repoRoot, parent, file);
+      afterContent = readBlobAt(repoRoot, headSha, file);
+    } else {
+      beforeContent = readBlobAt(repoRoot, baseSha, file);
+      afterContent = readBlobAt(repoRoot, headSha, file);
+    }
+    if (afterContent === null) continue;
+    if (beforeContent === null) {
+      return { ok: false, reason: `rule ${rule.id}: new file not allowed (${file})` };
+    }
+    if (!workflowVersionPinOnly(beforeContent, afterContent, yaml)) {
+      return { ok: false, reason: `rule ${rule.id}: structural change outside workflow_version_pin (${file})` };
+    }
+  }
+  return { ok: true, reason: "" };
+}
+
+function findMatchingRule(rules, actorEmail) {
+  const actor = actorEmail.toLowerCase();
+  return rules.filter((rule) => rule.allowed_actors.includes(actor));
+}
+
+function evaluateAgainstRule(repoRoot, rule, files, actorEmail, netLoc, structuralCtx) {
+  if (!rule.allowed_actors.includes(actorEmail.toLowerCase())) {
+    return { eligible: false, reason: `actor ${actorEmail} not in rule ${rule.id} allowed_actors` };
+  }
+  if (files.length === 0) {
+    return { eligible: false, reason: "no changed files" };
+  }
+  for (const file of files) {
+    if (!pathMatchesAllowed(file, rule.allowed_paths)) {
+      return { eligible: false, reason: `path ${file} outside rule ${rule.id} allowed_paths` };
+    }
+  }
+  if (netLoc > rule.max_net_loc) {
+    return {
+      eligible: false,
+      reason: `net_loc ${netLoc} exceeds rule ${rule.id} max_net_loc ${rule.max_net_loc}`,
+    };
+  }
+  const structural = validateStructuralChanges(
+    repoRoot,
+    files,
+    rule,
+    structuralCtx.baseSha,
+    structuralCtx.headSha,
+    structuralCtx.mode,
+  );
+  if (!structural.ok) {
+    return { eligible: false, reason: structural.reason };
+  }
+  return {
+    eligible: true,
+    reason: `TRUSTED-AUTOMATION-OK: rule=${rule.id} actor=${actorEmail} paths=${files.join(",")} net_loc=${netLoc}`,
+  };
+}
+
+/**
+ * Evaluate a single commit for trusted automation eligibility.
+ * @returns {{ eligible: boolean, reason: string }}
+ */
+export function evaluateTrustedAutomationCommit(repoRoot, commitSha) {
+  const rules = loadTrustedAutomationRules(repoRoot);
+  if (rules.length === 0) {
+    return { eligible: false, reason: "no trusted_automation policy configured" };
+  }
+  const prefixes = listMsnEnforcedPrefixes(repoRoot);
+  const files = commitChangedFiles(repoRoot, commitSha).filter((f) => isMsnEnforcedPath(f, prefixes));
+  if (files.length === 0) {
+    return { eligible: false, reason: "commit does not touch MSN-enforced paths" };
+  }
+  const actorEmail = commitAuthorEmail(repoRoot, commitSha);
+  const matchingRules = findMatchingRule(rules, actorEmail);
+  if (matchingRules.length === 0) {
+    return { eligible: false, reason: `actor ${actorEmail} not covered by trusted_automation policy` };
+  }
+  const netLoc = gitNumstat(repoRoot, ["show", "--numstat", "--format=", commitSha]);
+  let lastReason = `commit ${commitSha} failed trusted_automation policy checks`;
+  for (const rule of matchingRules) {
+    const result = evaluateAgainstRule(repoRoot, rule, files, actorEmail, netLoc, {
+      mode: "commit",
+      baseSha: null,
+      headSha: commitSha,
+    });
+    if (result.eligible) return result;
+    lastReason = result.reason;
+  }
+  return { eligible: false, reason: lastReason };
+}
+
+/**
+ * Evaluate a PR commit range for trusted automation eligibility.
+ * @returns {{ eligible: boolean, reason: string }}
+ */
+export function evaluateTrustedAutomationRange(repoRoot, baseSha, headSha) {
+  const rules = loadTrustedAutomationRules(repoRoot);
+  if (rules.length === 0) {
+    return { eligible: false, reason: "no trusted_automation policy configured" };
+  }
+  const prefixes = listMsnEnforcedPrefixes(repoRoot);
+  const allFiles = rangeChangedFiles(repoRoot, baseSha, headSha);
+  const enforcedFiles = allFiles.filter((f) => isMsnEnforcedPath(f, prefixes));
+  if (enforcedFiles.length === 0) {
+    return { eligible: false, reason: "range does not touch MSN-enforced paths" };
+  }
+  const commits = git(repoRoot, ["rev-list", "--no-merges", `${baseSha}..${headSha}`])
+    .split("\n")
+    .filter(Boolean);
+  for (const commit of commits) {
+    const files = commitChangedFiles(repoRoot, commit).filter((f) => isMsnEnforcedPath(f, prefixes));
+    if (files.length === 0) continue;
+    const actorEmail = commitAuthorEmail(repoRoot, commit);
+    const commitResult = evaluateTrustedAutomationCommit(repoRoot, commit);
+    if (!commitResult.eligible) {
+      return {
+        eligible: false,
+        reason: `commit ${commit.slice(0, 7)} failed: ${commitResult.reason}`,
+      };
+    }
+  }
+  const netLoc = gitNumstat(repoRoot, ["diff", "--numstat", `${baseSha}...${headSha}`]);
+  const actorEmail = commits.length > 0 ? commitAuthorEmail(repoRoot, commits[commits.length - 1]) : "";
+  const matchingRules = findMatchingRule(rules, actorEmail);
+  let lastReason = "PR diff failed trusted_automation policy checks";
+  for (const rule of matchingRules) {
+    const result = evaluateAgainstRule(repoRoot, rule, enforcedFiles, actorEmail, netLoc, {
+      mode: "range",
+      baseSha,
+      headSha,
+    });
+    if (result.eligible) return result;
+    lastReason = result.reason;
+  }
+  return { eligible: false, reason: lastReason };
+}
+
 function main() {
   const cmd = process.argv[2];
   const repoRoot = repoRootFromArg(process.argv[3]);
@@ -122,9 +508,38 @@ function main() {
         const stdin = fs.readFileSync(0, "utf8");
         process.exit(validateBypassNoteJson(stdin) ? 0 : 1);
       }
+      case "eval-commit": {
+        const commitSha = process.argv[4];
+        if (!commitSha) {
+          console.error("Usage: gxt-manifest-lib.mjs eval-commit <repoRoot> <commitSha>");
+          process.exit(2);
+        }
+        const result = evaluateTrustedAutomationCommit(repoRoot, commitSha);
+        if (result.eligible) {
+          console.error(result.reason);
+          process.exit(0);
+        }
+        console.error(`TRUSTED-AUTOMATION-DENY: ${result.reason}`);
+        process.exit(1);
+      }
+      case "eval-range": {
+        const baseSha = process.argv[4];
+        const headSha = process.argv[5];
+        if (!baseSha || !headSha) {
+          console.error("Usage: gxt-manifest-lib.mjs eval-range <repoRoot> <baseSha> <headSha>");
+          process.exit(2);
+        }
+        const result = evaluateTrustedAutomationRange(repoRoot, baseSha, headSha);
+        if (result.eligible) {
+          console.error(result.reason);
+          process.exit(0);
+        }
+        console.error(`TRUSTED-AUTOMATION-DENY: ${result.reason}`);
+        process.exit(1);
+      }
       default:
         console.error(
-          "Usage: gxt-manifest-lib.mjs <prefixes|validate-manifest|validate-bypass-note> [repoRoot]",
+          "Usage: gxt-manifest-lib.mjs <prefixes|validate-manifest|validate-bypass-note|eval-commit|eval-range> [args]",
         );
         process.exit(2);
     }

package/templates/scripts/validate-gxt.sh

@@ -120,6 +120,10 @@ cmd_msn() {
     if commit_has_gxt_bypass_note "$commit"; then
       continue
     fi
+    if eval_out="$(node "$GXT_MANIFEST_LIB" eval-commit "$ROOT" "$commit" 2>&1)"; then
+      echo "$eval_out" >&2
+      continue
+    fi
     echo "MSN check FAILED: commit $commit touches MSN-enforced paths but subject does not start with [MSN-NNNN] and has no gxt-bypass git note" >&2
     echo "  subject: $subject" >&2
     echo "  hint: run gapman verify --break-glass --reason \"...\" with GXT_BYPASS_SECRET, push refs/notes/gxt-bypass" >&2

package/templates/scripts/verify-pr-missions.sh

@@ -109,8 +109,14 @@ mapfile -t CHANGED_MISSIONS < <(
 )
 
 if [[ "$needs_mission" -eq 1 && ${#CHANGED_MISSIONS[@]} -eq 0 ]]; then
+  if eval_out="$(node "$GXT_MANIFEST_LIB" eval-range "$ROOT" "$BASE_SHA" "$HEAD_SHA" 2>&1)"; then
+    echo "$eval_out" >&2
+    echo "verify-pr-missions: trusted automation policy satisfied — mission file not required"
+    exit 0
+  fi
   echo "verify-pr-missions FAILED: diff touches MSN-enforced paths but no mission file under ${MISSIONS_PREFIX}" >&2
   echo "  Fix: gapman legislate \"<intent>\" --msn MSN-NNNN --skill-key gapman && include mission YAML in this PR" >&2
+  echo "  Or: declare eligible automation in .gitagent/config.json trusted_automation (fail-closed by default)" >&2
   exit 1
 fi