@jeger-ai/opengantry 2.2.2 → 2.2.4

package/templates/integrations/recipes/cursor.md

@@ -1,9 +1,9 @@
 ### Cursor
 
-- **Context injection:** `.cursor/rules/opengantry-gxt-substrate.mdc` (`alwaysApply: true`); `.cursor/hooks.json` — `sessionStart` mission scope + `beforeShellExecution` fallback guard; `.cursor/mcp.json` — `gapman mcp serve`.
+- **Context injection:** `.cursor/rules/opengantry-gxt-substrate.mdc` (`alwaysApply: true`); `.cursor/hooks.json` — `sessionStart` mission scope + `beforeShellExecution` fallback guard; `.cursor/mcp.json` — `gantry mcp serve`.
 - **Mission Architect:** `/gantry` macro (do not use `/plan` — Cursor native Plan Mode); implicit activation when user asks to **write/edit code** with no pinned mission. Follow `.gitagent/teacher/MISSION-ARCHITECT.md`.
 - **MCP legislation:** `gxt_draft_legislation` → semantic chat approval → `gxt_execute_legislation` → Teacher commit → `gxt_check_signature` → `gxt_pin_mission`. Or **`gxt_start_orchestration`** for goal-first CLI parity.
-- **Verify remediation:** `gxt_verify` returns `error_code`, `fix_hints`, `next_actions` on failure; CLI equivalent: `gapman verify --mission … --fix`.
+- **Verify remediation:** `gxt_verify` returns `error_code`, `fix_hints`, `next_actions` on failure; CLI equivalent: `gantry verify --mission … --fix`.
 - **Session bootstrap:**
 
 ```bash
@@ -14,6 +14,6 @@ source scripts/gxt-runtime-env.sh
 - **Enforcement:** Advisory for Agent edits; MCP two-step gate for legislation; shell hook fallback for non-MCP paths; use `runtime exec` for headless CLI/SDK runs.
 - **Gotcha:** Enable hooks **and** MCP in Cursor Settings; restart if they do not load (**Output → Hooks**).
 
-Headless: `gapman runtime exec --mission .gitagent/missions/MSN-0001.<slug>.yaml -- cursor agent "<task>"`
+Headless: `gantry runtime exec --mission .gitagent/missions/MSN-0001.<slug>.yaml -- cursor agent "<task>"`
 
 Vendor docs: https://cursor.com/docs/agent/hooks

package/templates/scripts/dev-validate.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# OpenGantry dogfood: run the full local GXT + gapman stack before push/PR.
+# OpenGantry dogfood: run the full local GXT + gantry stack before push/PR.
 # Usage: ./scripts/dev-validate.sh [base-ref] [head-ref]
 #   base-ref defaults to origin/main (falls back to HEAD~1)
 #   head-ref defaults to HEAD

package/templates/scripts/gxt-manifest-lib.mjs

@@ -1,13 +1,18 @@
 #!/usr/bin/env node
 /**
- * Node-only MANIFEST helpers for validate-gxt.sh (no jq dependency).
+ * Node-only MANIFEST + trusted automation policy helpers for validate-gxt.sh (no jq).
  * Usage:
  *   node scripts/gxt-manifest-lib.mjs prefixes [repoRoot]
  *   node scripts/gxt-manifest-lib.mjs validate-manifest [repoRoot]
  *   node scripts/gxt-manifest-lib.mjs validate-bypass-note  (JSON on stdin)
+ *   node scripts/gxt-manifest-lib.mjs eval-commit <repoRoot> <commitSha>
+ *   node scripts/gxt-manifest-lib.mjs eval-range <repoRoot> <baseSha> <headSha>
  */
 import fs from "node:fs";
 import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
 
 const FIXED_MSN_PREFIXES = [
   ".gitagent/",
@@ -16,11 +21,38 @@ const FIXED_MSN_PREFIXES = [
   ".github/workflows/gxt-validate.yml",
 ];
 
+const HARD_MAX_NET_LOC = 5;
+const ALLOWED_STRUCTURAL_CHANGES = new Set(["workflow_version_pin"]);
+const CONFIG_REL = ".gitagent/config.json";
+
 export function repoRootFromArg(arg) {
   if (arg?.trim()) return path.resolve(arg.trim());
   return process.cwd();
 }
 
+function git(repoRoot, args) {
+  return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8" }).trimEnd();
+}
+
+function normalizePath(p) {
+  return p.replace(/\\/g, "/");
+}
+
+function resolveYamlParser(repoRoot) {
+  const candidates = [
+    path.join(repoRoot, "node_modules/yaml"),
+    path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "node_modules/yaml"),
+  ];
+  for (const dir of candidates) {
+    const pkg = path.join(dir, "package.json");
+    if (fs.existsSync(pkg)) {
+      const req = createRequire(pkg);
+      return req("yaml");
+    }
+  }
+  throw new Error("gxt-manifest-lib: yaml package not found (run npm ci)");
+}
+
 export function readManifest(repoRoot) {
   const rel = ".gitagent/foreman/MANIFEST.json";
   const abs = path.join(repoRoot, rel);
@@ -36,6 +68,81 @@ export function readManifest(repoRoot) {
   return parsed;
 }
 
+export function loadTrustedAutomationRules(repoRoot) {
+  const abs = path.join(repoRoot, CONFIG_REL);
+  if (!fs.existsSync(abs)) {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(abs, "utf8"));
+  } catch (e) {
+    throw new Error(
+      `gxt-manifest-lib: invalid JSON in ${CONFIG_REL}: ${e instanceof Error ? e.message : String(e)}`,
+    );
+  }
+  const block = parsed?.trusted_automation;
+  if (!block) {
+    return [];
+  }
+  if (!Array.isArray(block.rules) || block.rules.length === 0) {
+    return [];
+  }
+  const rules = [];
+  for (const [i, rule] of block.rules.entries()) {
+    if (!rule || typeof rule !== "object") {
+      throw new Error(`gxt-manifest-lib: trusted_automation.rules[${i}] must be an object`);
+    }
+    if (typeof rule.id !== "string" || !rule.id.trim()) {
+      throw new Error(`gxt-manifest-lib: trusted_automation.rules[${i}] missing id`);
+    }
+    if (!Array.isArray(rule.allowed_actors) || rule.allowed_actors.length === 0) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} requires non-empty allowed_actors`);
+    }
+    if (!Array.isArray(rule.allowed_paths) || rule.allowed_paths.length === 0) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} requires non-empty allowed_paths`);
+    }
+    if (!Array.isArray(rule.allowed_structural_changes) || rule.allowed_structural_changes.length === 0) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} requires allowed_structural_changes`);
+    }
+    for (const change of rule.allowed_structural_changes) {
+      if (!ALLOWED_STRUCTURAL_CHANGES.has(change)) {
+        throw new Error(`gxt-manifest-lib: rule ${rule.id} has unsupported structural change: ${change}`);
+      }
+    }
+    if (typeof rule.max_net_loc !== "number" || !Number.isInteger(rule.max_net_loc) || rule.max_net_loc < 1) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} max_net_loc must be a positive integer`);
+    }
+    if (rule.max_net_loc > HARD_MAX_NET_LOC) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} max_net_loc exceeds hard cap ${HARD_MAX_NET_LOC}`);
+    }
+    rules.push({
+      id: rule.id,
+      allowed_actors: rule.allowed_actors.map((a) => String(a).trim().toLowerCase()),
+      allowed_paths: rule.allowed_paths.map((p) => normalizePath(String(p))),
+      allowed_structural_changes: new Set(rule.allowed_structural_changes),
+      max_net_loc: rule.max_net_loc,
+    });
+  }
+  return rules;
+}
+
+export function matchGlob(pattern, filePath) {
+  const normalized = normalizePath(filePath);
+  const re = new RegExp(
+    `^${normalizePath(pattern)
+      .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+      .replace(/\*\*/g, "<<<GLOBSTAR>>>")
+      .replace(/\*/g, "[^/]*")
+      .replace(/<<<GLOBSTAR>>>/g, ".*")}$`,
+  );
+  return re.test(normalized);
+}
+
+export function pathMatchesAllowed(filePath, allowedPaths) {
+  return allowedPaths.some((pattern) => matchGlob(pattern, filePath));
+}
+
 export function listMsnEnforcedPrefixes(repoRoot) {
   const manifest = readManifest(repoRoot);
   const skills = manifest.skills;
@@ -49,11 +156,22 @@ export function listMsnEnforcedPrefixes(repoRoot) {
   const out = new Set();
   for (const p of [...FIXED_MSN_PREFIXES, ...roots]) {
     if (typeof p !== "string" || !p.trim()) continue;
-    out.add(p.replace(/\\/g, "/"));
+    out.add(normalizePath(p));
   }
   return [...out];
 }
 
+export function isMsnEnforcedPath(filePath, prefixes) {
+  const p = normalizePath(filePath);
+  for (const prefix of prefixes) {
+    if (!prefix) continue;
+    if (p === prefix) return true;
+    if (prefix.endsWith("/") && p.startsWith(prefix)) return true;
+    if (!prefix.endsWith("/") && p.startsWith(`${prefix}/`)) return true;
+  }
+  return false;
+}
+
 export function validateManifestStructure(repoRoot) {
   const m = readManifest(repoRoot);
   if (typeof m.schema_version !== "string" || m.schema_version.length === 0) {
@@ -101,6 +219,274 @@ export function validateBypassNoteJson(raw) {
   );
 }
 
+function parseNumstat(output) {
+  let total = 0;
+  for (const line of output.split("\n")) {
+    if (!line.trim()) continue;
+    const [adds, dels] = line.split("\t");
+    if (adds === "-" || dels === "-") continue;
+    total += Number(adds) + Number(dels);
+  }
+  return total;
+}
+
+function gitNumstat(repoRoot, args) {
+  try {
+    return parseNumstat(git(repoRoot, args));
+  } catch {
+    return 0;
+  }
+}
+
+function commitChangedFiles(repoRoot, commitSha) {
+  const out = git(repoRoot, ["diff-tree", "--no-commit-id", "--name-only", "-r", commitSha]);
+  return out ? out.split("\n").filter(Boolean).map(normalizePath) : [];
+}
+
+function rangeChangedFiles(repoRoot, baseSha, headSha) {
+  const out = git(repoRoot, ["diff", "--name-only", "--diff-filter=ACMRT", `${baseSha}...${headSha}`]);
+  return out ? out.split("\n").filter(Boolean).map(normalizePath) : [];
+}
+
+function commitAuthorEmail(repoRoot, commitSha) {
+  return git(repoRoot, ["log", "-1", "--format=%ae", commitSha]).toLowerCase();
+}
+
+function objectKeysEqual(a, b) {
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length;
+  }
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") {
+    return typeof a === typeof b;
+  }
+  const keysA = Object.keys(a).sort();
+  const keysB = Object.keys(b).sort();
+  return keysA.length === keysB.length && keysA.every((k, i) => k === keysB[i]);
+}
+
+function collectStructuralDiffs(before, after, keyPath = []) {
+  const diffs = [];
+  if (Array.isArray(before) && Array.isArray(after)) {
+    for (let i = 0; i < before.length; i++) {
+      diffs.push(...collectStructuralDiffs(before[i], after[i], [...keyPath, String(i)]));
+    }
+    return diffs;
+  }
+  if (before !== null && after !== null && typeof before === "object" && typeof after === "object") {
+    const keys = Object.keys(before);
+    for (const key of keys) {
+      const childPath = [...keyPath, key];
+      const bv = before[key];
+      const av = after[key];
+      if (bv !== null && av !== null && typeof bv === "object" && typeof av === "object") {
+        diffs.push(...collectStructuralDiffs(bv, av, childPath));
+      } else if (bv !== av) {
+        diffs.push({ path: childPath, before: bv, after: av });
+      }
+    }
+    return diffs;
+  }
+  if (before !== after) {
+    diffs.push({ path: keyPath, before, after });
+  }
+  return diffs;
+}
+
+function isWorkflowVersionPinChange(before, after) {
+  if (typeof before !== "string" || typeof after !== "string") return false;
+  const usesRe = /^([^@]+@)(.+)$/;
+  const bm = before.match(usesRe);
+  const am = after.match(usesRe);
+  return Boolean(bm && am && bm[1] === am[1] && bm[2] !== am[2]);
+}
+
+function structuresMatch(before, after) {
+  if (Array.isArray(before) && Array.isArray(after)) {
+    if (before.length !== after.length) return false;
+    return before.every((item, i) => structuresMatch(item, after[i]));
+  }
+  if (before !== null && after !== null && typeof before === "object" && typeof after === "object") {
+    if (!objectKeysEqual(before, after)) return false;
+    return Object.keys(before).every((k) => structuresMatch(before[k], after[k]));
+  }
+  return true;
+}
+
+function workflowVersionPinOnly(beforeContent, afterContent, yaml) {
+  let beforeDoc;
+  let afterDoc;
+  try {
+    beforeDoc = yaml.parse(beforeContent);
+    afterDoc = yaml.parse(afterContent);
+  } catch {
+    return false;
+  }
+  if (!structuresMatch(beforeDoc, afterDoc)) {
+    return false;
+  }
+  const diffs = collectStructuralDiffs(beforeDoc, afterDoc);
+  if (diffs.length === 0) return true;
+  return diffs.every((d) => {
+    const lastKey = d.path[d.path.length - 1];
+    return lastKey === "uses" && isWorkflowVersionPinChange(d.before, d.after);
+  });
+}
+
+function readBlobAt(repoRoot, commitSha, filePath) {
+  try {
+    return git(repoRoot, ["show", `${commitSha}:${filePath}`]);
+  } catch {
+    return null;
+  }
+}
+
+function validateStructuralChanges(repoRoot, files, rule, baseSha, headSha, mode) {
+  if (!rule.allowed_structural_changes.has("workflow_version_pin")) {
+    return { ok: false, reason: `rule ${rule.id}: no matching structural change policy` };
+  }
+  const yaml = resolveYamlParser(repoRoot);
+  const workflowFiles = files.filter((f) => /\.ya?ml$/i.test(f));
+  for (const file of workflowFiles) {
+    let beforeContent;
+    let afterContent;
+    if (mode === "commit") {
+      const parent = git(repoRoot, ["rev-parse", `${headSha}^`]);
+      beforeContent = readBlobAt(repoRoot, parent, file);
+      afterContent = readBlobAt(repoRoot, headSha, file);
+    } else {
+      beforeContent = readBlobAt(repoRoot, baseSha, file);
+      afterContent = readBlobAt(repoRoot, headSha, file);
+    }
+    if (afterContent === null) continue;
+    if (beforeContent === null) {
+      return { ok: false, reason: `rule ${rule.id}: new file not allowed (${file})` };
+    }
+    if (!workflowVersionPinOnly(beforeContent, afterContent, yaml)) {
+      return { ok: false, reason: `rule ${rule.id}: structural change outside workflow_version_pin (${file})` };
+    }
+  }
+  return { ok: true, reason: "" };
+}
+
+function findMatchingRule(rules, actorEmail) {
+  const actor = actorEmail.toLowerCase();
+  return rules.filter((rule) => rule.allowed_actors.includes(actor));
+}
+
+function evaluateAgainstRule(repoRoot, rule, files, actorEmail, netLoc, structuralCtx) {
+  if (!rule.allowed_actors.includes(actorEmail.toLowerCase())) {
+    return { eligible: false, reason: `actor ${actorEmail} not in rule ${rule.id} allowed_actors` };
+  }
+  if (files.length === 0) {
+    return { eligible: false, reason: "no changed files" };
+  }
+  for (const file of files) {
+    if (!pathMatchesAllowed(file, rule.allowed_paths)) {
+      return { eligible: false, reason: `path ${file} outside rule ${rule.id} allowed_paths` };
+    }
+  }
+  if (netLoc > rule.max_net_loc) {
+    return {
+      eligible: false,
+      reason: `net_loc ${netLoc} exceeds rule ${rule.id} max_net_loc ${rule.max_net_loc}`,
+    };
+  }
+  const structural = validateStructuralChanges(
+    repoRoot,
+    files,
+    rule,
+    structuralCtx.baseSha,
+    structuralCtx.headSha,
+    structuralCtx.mode,
+  );
+  if (!structural.ok) {
+    return { eligible: false, reason: structural.reason };
+  }
+  return {
+    eligible: true,
+    reason: `TRUSTED-AUTOMATION-OK: rule=${rule.id} actor=${actorEmail} paths=${files.join(",")} net_loc=${netLoc}`,
+  };
+}
+
+/**
+ * Evaluate a single commit for trusted automation eligibility.
+ * @returns {{ eligible: boolean, reason: string }}
+ */
+export function evaluateTrustedAutomationCommit(repoRoot, commitSha) {
+  const rules = loadTrustedAutomationRules(repoRoot);
+  if (rules.length === 0) {
+    return { eligible: false, reason: "no trusted_automation policy configured" };
+  }
+  const prefixes = listMsnEnforcedPrefixes(repoRoot);
+  const files = commitChangedFiles(repoRoot, commitSha).filter((f) => isMsnEnforcedPath(f, prefixes));
+  if (files.length === 0) {
+    return { eligible: false, reason: "commit does not touch MSN-enforced paths" };
+  }
+  const actorEmail = commitAuthorEmail(repoRoot, commitSha);
+  const matchingRules = findMatchingRule(rules, actorEmail);
+  if (matchingRules.length === 0) {
+    return { eligible: false, reason: `actor ${actorEmail} not covered by trusted_automation policy` };
+  }
+  const netLoc = gitNumstat(repoRoot, ["show", "--numstat", "--format=", commitSha]);
+  let lastReason = `commit ${commitSha} failed trusted_automation policy checks`;
+  for (const rule of matchingRules) {
+    const result = evaluateAgainstRule(repoRoot, rule, files, actorEmail, netLoc, {
+      mode: "commit",
+      baseSha: null,
+      headSha: commitSha,
+    });
+    if (result.eligible) return result;
+    lastReason = result.reason;
+  }
+  return { eligible: false, reason: lastReason };
+}
+
+/**
+ * Evaluate a PR commit range for trusted automation eligibility.
+ * @returns {{ eligible: boolean, reason: string }}
+ */
+export function evaluateTrustedAutomationRange(repoRoot, baseSha, headSha) {
+  const rules = loadTrustedAutomationRules(repoRoot);
+  if (rules.length === 0) {
+    return { eligible: false, reason: "no trusted_automation policy configured" };
+  }
+  const prefixes = listMsnEnforcedPrefixes(repoRoot);
+  const allFiles = rangeChangedFiles(repoRoot, baseSha, headSha);
+  const enforcedFiles = allFiles.filter((f) => isMsnEnforcedPath(f, prefixes));
+  if (enforcedFiles.length === 0) {
+    return { eligible: false, reason: "range does not touch MSN-enforced paths" };
+  }
+  const commits = git(repoRoot, ["rev-list", "--no-merges", `${baseSha}..${headSha}`])
+    .split("\n")
+    .filter(Boolean);
+  for (const commit of commits) {
+    const files = commitChangedFiles(repoRoot, commit).filter((f) => isMsnEnforcedPath(f, prefixes));
+    if (files.length === 0) continue;
+    const actorEmail = commitAuthorEmail(repoRoot, commit);
+    const commitResult = evaluateTrustedAutomationCommit(repoRoot, commit);
+    if (!commitResult.eligible) {
+      return {
+        eligible: false,
+        reason: `commit ${commit.slice(0, 7)} failed: ${commitResult.reason}`,
+      };
+    }
+  }
+  const netLoc = gitNumstat(repoRoot, ["diff", "--numstat", `${baseSha}...${headSha}`]);
+  const actorEmail = commits.length > 0 ? commitAuthorEmail(repoRoot, commits[commits.length - 1]) : "";
+  const matchingRules = findMatchingRule(rules, actorEmail);
+  let lastReason = "PR diff failed trusted_automation policy checks";
+  for (const rule of matchingRules) {
+    const result = evaluateAgainstRule(repoRoot, rule, enforcedFiles, actorEmail, netLoc, {
+      mode: "range",
+      baseSha,
+      headSha,
+    });
+    if (result.eligible) return result;
+    lastReason = result.reason;
+  }
+  return { eligible: false, reason: lastReason };
+}
+
 function main() {
   const cmd = process.argv[2];
   const repoRoot = repoRootFromArg(process.argv[3]);
@@ -122,9 +508,38 @@ function main() {
         const stdin = fs.readFileSync(0, "utf8");
         process.exit(validateBypassNoteJson(stdin) ? 0 : 1);
       }
+      case "eval-commit": {
+        const commitSha = process.argv[4];
+        if (!commitSha) {
+          console.error("Usage: gxt-manifest-lib.mjs eval-commit <repoRoot> <commitSha>");
+          process.exit(2);
+        }
+        const result = evaluateTrustedAutomationCommit(repoRoot, commitSha);
+        if (result.eligible) {
+          console.error(result.reason);
+          process.exit(0);
+        }
+        console.error(`TRUSTED-AUTOMATION-DENY: ${result.reason}`);
+        process.exit(1);
+      }
+      case "eval-range": {
+        const baseSha = process.argv[4];
+        const headSha = process.argv[5];
+        if (!baseSha || !headSha) {
+          console.error("Usage: gxt-manifest-lib.mjs eval-range <repoRoot> <baseSha> <headSha>");
+          process.exit(2);
+        }
+        const result = evaluateTrustedAutomationRange(repoRoot, baseSha, headSha);
+        if (result.eligible) {
+          console.error(result.reason);
+          process.exit(0);
+        }
+        console.error(`TRUSTED-AUTOMATION-DENY: ${result.reason}`);
+        process.exit(1);
+      }
       default:
         console.error(
-          "Usage: gxt-manifest-lib.mjs <prefixes|validate-manifest|validate-bypass-note> [repoRoot]",
+          "Usage: gxt-manifest-lib.mjs <prefixes|validate-manifest|validate-bypass-note|eval-commit|eval-range> [args]",
         );
         process.exit(2);
     }

package/templates/scripts/gxt-resolve-mission.sh

@@ -14,8 +14,8 @@ if [ -n "$explicit" ]; then
   exit 0
 fi
 
-if [ -n "${GAPMAN_MISSION:-}" ]; then
-  printf '%s\n' "$GAPMAN_MISSION"
+if [ -n "${GANTRY_MISSION:-}" ]; then
+  printf '%s\n' "$GANTRY_MISSION"
   exit 0
 fi
 

package/templates/scripts/gxt-runtime-env.sh

@@ -15,17 +15,17 @@ if ! MISSION="$(scripts/gxt-resolve-mission.sh "${1:-}" 2>/dev/null)"; then
 gxt-runtime-env: no mission file resolved.
   scripts/gxt-pin-mission.sh .gitagent/missions/<file>.yaml
   source scripts/gxt-runtime-env.sh .gitagent/missions/<file>.yaml
-  export GAPMAN_MISSION=.gitagent/missions/<file>.yaml
+  export GANTRY_MISSION=.gitagent/missions/<file>.yaml
 EOF
   exit 1
 fi
 
-if command -v gapman >/dev/null 2>&1; then
-  eval "$(gapman runtime env --mission "$MISSION")"
+if command -v gantry >/dev/null 2>&1; then
+  eval "$(gantry runtime env --mission "$MISSION")"
 elif [ -f "dist/cli/index.js" ]; then
   eval "$(node dist/cli/index.js runtime env --mission "$MISSION")"
 else
-  echo "gxt-runtime-env: gapman not found (npm ci && npm run build)" >&2
+  echo "gxt-runtime-env: gantry not found (npm ci && npm run build)" >&2
   exit 1
 fi
 

package/templates/scripts/validate-gxt.sh

@@ -120,9 +120,13 @@ cmd_msn() {
     if commit_has_gxt_bypass_note "$commit"; then
       continue
     fi
+    if eval_out="$(node "$GXT_MANIFEST_LIB" eval-commit "$ROOT" "$commit" 2>&1)"; then
+      echo "$eval_out" >&2
+      continue
+    fi
     echo "MSN check FAILED: commit $commit touches MSN-enforced paths but subject does not start with [MSN-NNNN] and has no gxt-bypass git note" >&2
     echo "  subject: $subject" >&2
-    echo "  hint: run gapman verify --break-glass --reason \"...\" with GXT_BYPASS_SECRET, push refs/notes/gxt-bypass" >&2
+    echo "  hint: run gantry verify --break-glass --reason \"...\" with GXT_BYPASS_SECRET, push refs/notes/gxt-bypass" >&2
     echo "  touched paths (sample):" >&2
     git diff-tree --no-commit-id --name-only -r "$commit" | head -20 >&2
     exit 1

package/templates/scripts/verify-pr-missions.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# PR / branch mission verify: mission purity, triple-dot file diff, full gapman verify on changed missions.
+# PR / branch mission verify: mission purity, triple-dot file diff, full gantry verify on changed missions.
 # Usage:
 #   BASE_SHA=<base> HEAD_SHA=<head> ./scripts/verify-pr-missions.sh
 #   ./scripts/verify-pr-missions.sh <base-ref> <head-ref>   # rev-parse refs to SHAs
@@ -57,10 +57,10 @@ fi
 
 if [[ -f dist/cli/index.js ]]; then
   GAPMAN=(node dist/cli/index.js)
-elif command -v gapman >/dev/null 2>&1; then
-  GAPMAN=(gapman)
+elif command -v gantry >/dev/null 2>&1; then
+  GAPMAN=(gantry)
 else
-  echo "verify-pr-missions: build gapman first (npm run build)" >&2
+  echo "verify-pr-missions: build gantry first (npm run build)" >&2
   exit 1
 fi
 
@@ -109,8 +109,14 @@ mapfile -t CHANGED_MISSIONS < <(
 )
 
 if [[ "$needs_mission" -eq 1 && ${#CHANGED_MISSIONS[@]} -eq 0 ]]; then
+  if eval_out="$(node "$GXT_MANIFEST_LIB" eval-range "$ROOT" "$BASE_SHA" "$HEAD_SHA" 2>&1)"; then
+    echo "$eval_out" >&2
+    echo "verify-pr-missions: trusted automation policy satisfied — mission file not required"
+    exit 0
+  fi
   echo "verify-pr-missions FAILED: diff touches MSN-enforced paths but no mission file under ${MISSIONS_PREFIX}" >&2
-  echo "  Fix: gapman legislate \"<intent>\" --msn MSN-NNNN --skill-key gapman && include mission YAML in this PR" >&2
+  echo "  Fix: gantry legislate \"<intent>\" --msn MSN-NNNN --skill-key gantry && include mission YAML in this PR" >&2
+  echo "  Or: declare eligible automation in .gitagent/config.json trusted_automation (fail-closed by default)" >&2
   exit 1
 fi
 
@@ -134,7 +140,7 @@ if [[ ${#UNIQUE_MSNS[@]} -eq 1 ]]; then
 fi
 
 for mission in "${CHANGED_MISSIONS[@]}"; do
-  echo "verify-pr-missions: gapman verify --mission ${mission}" >&2
+  echo "verify-pr-missions: gantry verify --mission ${mission}" >&2
   "${GAPMAN[@]}" verify --mission "$mission" --audience verifier || exit 1
 done
 

package/templates/skills/{gapman.md → gantry.md}

@@ -1,5 +1,5 @@
-# Skill: gapman
+# Skill: gantry
 
-Manifest key `gapman`. **gapman** CLI and tests under `src/cli/` per [`.gitagent/foreman/MANIFEST.json`](../.gitagent/foreman/MANIFEST.json).
+Manifest key `gantry`. **gantry** CLI and tests under `src/cli/` per [`.gitagent/foreman/MANIFEST.json`](../.gitagent/foreman/MANIFEST.json).
 
 Substrate paths (`.gitagent/`, hooks, workflows) require Teacher legislation and **`substrate`** or explicit mission scope — do not edit Foreman law without a mission.