@jeger-ai/opengantry 3.0.1 → 3.1.0

package/LICENSE

@@ -203,33 +203,16 @@
 
    END OF TERMS AND CONDITIONS
 
+Copyright 2026 Juergen Eger
 
-   APPENDIX: How to apply the Apache License to your work.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
 
+    http://www.apache.org/licenses/LICENSE-2.0
 
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-
-   Copyright [yyyy] [name of copyright owner]
-
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -6,11 +6,56 @@
 
 ## The one-line pitch
 
-**OpenGantry is a local-first, Git-native governance layer for autonomous agents.** It does not write your code or content for you. It negotiates the contract before work starts, enforces deterministic boundaries during execution, and emits machine-readable verdicts when something fails.
+**OpenGantry is the deterministic runtime and governance engine for AI agents.** It is a local-first CLI that scopes agent edits, runs your shell gates, and returns structured failure JSON so agents can retry without a human watching the terminal. It does not write your code or content for you. It replaces humans babysitting AI coding assistants — not your tests, not your CI, not your code review.
 
-Think of it as a **court of law** for agentic work: binary rules, reproducible checks, audit trail in Git.
+> **Not [Gantry.io](https://gantry.io)?** OpenGantry is the open-source **`gantry` CLI** for local-first, Git-native agent enforcement in your repository, not a hosted observability dashboard. Product home: [opengantry.ai](https://opengantry.ai).
 
-> **Not [Gantry.io](https://gantry.io)?** OpenGantry is the open-source **`gantry` CLI** for local-first, Git-native governance in your repository, not a hosted observability dashboard. Product home: [opengantry.ai](https://opengantry.ai).
+### Local control, unmonitored loops, tamper-evident proof
+
+Three engineering problems show up today, calendar or no calendar:
+
+| Problem | What goes wrong | OpenGantry answer |
+|---------|-----------------|-------------------|
+| **Local developer control** | Source and credentials leave the machine for a vendor console to "govern" agents | Execution stays on-machine; verify is offline; optional future hub is digests only |
+| **Unmonitored agent loops** | Agents thrash on unstructured stderr, wander outside declared paths, or keep retrying without a structured verdict | Mission YAML + TMVC + `findings[]` so the loop is scoped and machine-readable |
+| **Tamper-evident auditability** | "It passed locally" with no citeable trail | Planner stamps, `EXECUTOR_LOG.md` quotes, optional SSH/GPG attestation receipts |
+
+**Hybrid model:** free local CLI (spoke) for developers; optional metadata plane (hub) later for team-wide audit aggregation. Source trees and gate stdout never leave via GXT export paths.
+
+Deep dive: [`docs/SECURITY.md`](docs/SECURITY.md) · [`docs/FEATURES.md`](docs/FEATURES.md) · [opengantry.ai](https://opengantry.ai)
+
+---
+
+## In plain English
+
+OpenGantry uses product terms that sound abstract. Here is what the CLI actually runs:
+
+| Term you will see | What it actually is |
+|-------------------|---------------------|
+| **Contract** | Mission YAML under `.gitagent/missions/` — allowed paths, forbidden paths, and a required `gate_command` (shell) |
+| **Legislate** | `gantry legislate` / Mission Architect writes that YAML; a Planner commit locks it in Git before work |
+| **Governance** | Hooks + `gantry verify` that fail closed if scope or gates are violated — not a process committee |
+| **Verdict** | Deterministic pass/fail from shell gates + trace checks; on fail, a `findings[]` JSON envelope |
+
+**"Contract" is not design-by-contract (DbC).** It is not pre/post conditions in source code. It is the Git-locked work order that tells the agent where it may edit and which shell command must pass before merge.
+
+---
+
+## Why not just TDD and CI?
+
+You already have `npm test` and GitHub Actions. OpenGantry does not replace them — it makes them usable when an **AI agent** runs the loop.
+
+| Who runs the loop | What happens on failure |
+|-------------------|-------------------------|
+| **Human developer** | Reads stderr, parses the stack trace, rewrites code |
+| **AI agent + raw TDD/CI** | Chokes on unstructured stderr, hallucinates fixes, spins in retry loops — a senior still babysits |
+| **AI agent + OpenGantry** | Same gates you already trust; `gantry verify --json` returns `findings[]` with file, line, and hint so the agent can self-correct |
+
+| Already have | Still missing for autonomous agents | OpenGantry adds |
+|--------------|-------------------------------------|-----------------|
+| `npm test` / GH Actions | Structured failure for model retry | `findings[]` envelope |
+| PR CI | Declared edit blast radius | TMVC + forbidden zones in mission YAML |
+| Code review | Proof the agent stayed in scope | Git mission + `EXECUTOR_LOG.md` quotes |
 
 ---
 
@@ -21,9 +66,9 @@ Most AI agent tooling optimizes for *speed of generation*. OpenGantry optimizes
 - **Scope before execution:** no silent edits to governance files, no wandering outside approved paths
 - **Deterministic verification:** gates are shell commands with pass/fail outcomes, not LLM opinions
 - **Forensic trace:** every mission ties to `[MSN-XXXX]` commits and verbatim quotes in `EXECUTOR_LOG.md`
-- **Domain-agnostic** (v3.0.0): the same loop governs TypeScript imports *and* brand/compliance copy
+- **Domain-agnostic:** the same loop governs TypeScript imports *and* brand/compliance copy
 
-The long-term bet: external executors (Cursor agents, Hermes, CI bots) do the work; **OpenGantry owns the contract and the verdict**. That separation is what makes agentic delivery auditable in regulated or security-sensitive environments.
+The long-term bet: external executors (Cursor agents, Hermes, CI bots) do the work; **OpenGantry owns the mission YAML and the verify output**. That separation is what makes agentic delivery auditable in regulated or security-sensitive environments.
 
 ---
 
@@ -47,7 +92,7 @@ Everything revolves around a **mission**:
 
 ```mermaid
 flowchart LR
-    A[Planner legislates MSN-XXXX] --> B[Executor works in TMVC scope]
+    A[Planner commits mission YAML] --> B[Executor works in TMVC scope]
     B --> C[Trace in EXECUTOR_LOG.md]
     C --> D[gantry verify]
     D -->|fail| E[findings JSON → agent retries]
@@ -56,7 +101,7 @@ flowchart LR
 
 **Roles:**
 
-- **Planner:** human (or Mission Architect in chat) approves mission YAML before execution
+- **Planner:** human (or Mission Architect in chat) commits mission YAML via `gantry legislate` before execution
 - **Executor:** agent or developer edits within TMVC roots; forbidden zones respected
 - **Verifier:** `gantry verify` checks gate output and trace mapping
 
@@ -72,9 +117,9 @@ flowchart LR
 
 ---
 
-## v3.0.0: Three phases, any domain
+## Three phases, any domain
 
-v3.0.0 reframes the product as a **universal governance layer**, not just a TypeScript linter:
+OpenGantry is a **domain-neutral verify loop**, not just a TypeScript linter:
 
 | Phase | Command | Output |
 |-------|---------|--------|
@@ -91,7 +136,7 @@ v3.0.0 reframes the product as a **universal governance layer**, not just a Type
 
 List them: `gantry domains`
 
-**Court-of-law principle:** enforcement is always binary. Content discovery uses exact-match boilerplate only; it does not infer "dominant terminology" from statistics that would flip on unrelated edits.
+**Binary enforcement:** pass/fail only — no LLM opinions at the gate. Content discovery uses exact-match boilerplate only; it does not infer "dominant terminology" from statistics that would flip on unrelated edits.
 
 See [`docs/DOMAINS.md`](docs/DOMAINS.md) for adapter details and [`docs/AGENT-LOOP.md`](docs/AGENT-LOOP.md) for external executor integration.
 
@@ -119,7 +164,7 @@ Emits a proposal with evidence-anchored conventions and anomalies (`file:line` s
 
 **Speed:** the discovery scanner uses streaming regex per file, not a whole-repo AST. It is budgeted to finish a **5,000-file monorepo in under five seconds** (pinned in CI). OpenGantry ingests repository context in seconds without loading the tree into a heavy compiler graph or spiking RAM. Enterprise teams do not have to wait minutes for a governance tool to "understand" the repo before the agent loop starts.
 
-### 3. Blueprint: negotiate the contract
+### 3. Blueprint: lock rules and gate commands
 
 ```bash
 gantry blueprint --domain content --yes
@@ -189,14 +234,14 @@ See [`examples/content-governance/`](examples/content-governance/). Ad copy with
 
 - **Not an agent:** it does not chat, plan features, or generate PRs by itself
 - **Not Gantry.io:** no hosted observability dashboard; everything runs in your repo
-- **Not an LLM judge** (yet): AI performance judge is deferred to v3.1; gates stay deterministic
+- **Not an LLM judge for merge:** gates stay deterministic; optional LLM evidence is committed separately via `gantry scan`
 
 ---
 
 ## Mental model for adopters
 
 ```
-OpenGantry = contract negotiator + court + audit log
+OpenGantry = scoped work order + shell gates + structured verify output
 Executor agent = worker (Cursor, Hermes, human dev)
 ```
 
@@ -206,15 +251,18 @@ You adopt OpenGantry when agent velocity is valuable but **unreviewed scope cree
 
 ## Documentation map {#documentation-map-start-here}
 
-Full doc index: [`docs/index.md`](docs/index.md) — adopters, contributors, ADRs, and planning.
+Full doc index: [`docs/index.md`](docs/index.md) — organized by **how**, **what**, and **why**.
 
 ## Where to go next
 
 | Goal | Doc |
 |------|-----|
 | All documentation | [`docs/index.md`](docs/index.md) |
-| 5-minute adoption | [`docs/ADOPTION.md`](docs/ADOPTION.md) |
-| Domain adapters deep dive | [`docs/DOMAINS.md`](docs/DOMAINS.md) |
+| What it helps with | [`docs/USE-CASES.md`](docs/USE-CASES.md) |
+| Why features exist | [`docs/FEATURES.md`](docs/FEATURES.md) |
+| Adoption runbook | [`docs/ADOPTION.md`](docs/ADOPTION.md) |
+| Release history | [`docs/CHANGELOG.md`](docs/CHANGELOG.md) |
+| Domain adapters | [`docs/DOMAINS.md`](docs/DOMAINS.md) |
 | External agent integration | [`docs/AGENT-LOOP.md`](docs/AGENT-LOOP.md) |
 | Contributing / dogfooding this repo | [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md) |
 | Content walkthrough | [`examples/content-governance/`](examples/content-governance/) |

package/dist/cli/commands/attest.d.ts

@@ -0,0 +1,8 @@
+export interface AttestOptions {
+    mission: string;
+    out?: string;
+    sign?: boolean;
+    json?: boolean;
+}
+export declare function runAttest(options: AttestOptions): void;
+//# sourceMappingURL=attest.d.ts.map

package/dist/cli/commands/attest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/attest.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAYtD"}

package/dist/cli/commands/attest.js

@@ -0,0 +1,19 @@
+import { logInfo, setExitCode } from "../lib/cli-io.js";
+import { attestMission } from "../lib/attest-mission.js";
+import { GantryUserError, reportUserFacingError } from "../lib/errors.js";
+export function runAttest(options) {
+    try {
+        const result = attestMission(options);
+        if (options.json) {
+            logInfo(JSON.stringify(result, null, 2));
+        }
+        else {
+            logInfo(`gantry attest: wrote ${result.receipt_path}`);
+        }
+    }
+    catch (e) {
+        reportUserFacingError(e);
+        setExitCode(e instanceof GantryUserError ? e.exitCode : 2);
+    }
+}
+//# sourceMappingURL=attest.js.map

package/dist/cli/commands/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../../src/cli/commands/attest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAS1E,MAAM,UAAU,SAAS,CAAC,OAAsB;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,wBAAwB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzB,WAAW,CAAC,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC"}

package/dist/cli/commands/doctor.d.ts

@@ -5,8 +5,10 @@ export interface DoctorReport {
     next_step: string | null;
     exit_code: number;
 }
-export declare function runDoctor(options?: {
+export interface DoctorOptions {
     json?: boolean;
     audience?: OutputAudience;
-}): void;
+    policy?: string;
+}
+export declare function runDoctor(options?: DoctorOptions): void;
 //# sourceMappingURL=doctor.d.ts.map

package/dist/cli/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG5F,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AA+BD,wBAAgB,SAAS,CAAC,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAO,GAAG,IAAI,CAe3F"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG5F,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA+BD,wBAAgB,SAAS,CAAC,OAAO,GAAE,aAAkB,GAAG,IAAI,CAe3D"}

package/dist/cli/commands/doctor.js

@@ -28,7 +28,7 @@ function emitDoctor(lines, nextStep, hasFail, json, audience) {
 export function runDoctor(options = {}) {
     try {
         const { root, manifest } = loadWorkspace();
-        const report = collectDoctorReport(root, manifest);
+        const report = collectDoctorReport(root, manifest, undefined, options.policy);
         emitDoctor(report.lines, report.nextStep, doctorLinesHasFail(report.lines), options.json, options.audience);
     }
     catch (e) {

package/dist/cli/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAE7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAmB,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,SAAS,UAAU,CACjB,KAAmB,EACnB,QAAuB,EACvB,OAAgB,EAChB,IAAyB,EACzB,QAAyB;IAEzB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,4BAA4B,CACxC,QAAQ,EACR,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAC;QACF,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,OAAO;QAAE,WAAW,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAAyD,EAAE;IACnF,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,UAAU,CACR,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,QAAQ,EACf,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAChC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,QAAQ,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAE7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAmB,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAcpD,SAAS,UAAU,CACjB,KAAmB,EACnB,QAAuB,EACvB,OAAgB,EAChB,IAAyB,EACzB,QAAyB;IAEzB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,4BAA4B,CACxC,QAAQ,EACR,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAC;QACF,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,OAAO;QAAE,WAAW,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAAyB,EAAE;IACnD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9E,UAAU,CACR,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,QAAQ,EACf,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAChC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,QAAQ,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}

package/dist/cli/lib/attest-mission.d.ts

@@ -0,0 +1,13 @@
+import { type AttestationReceipt } from "./attestation-receipt.js";
+export interface AttestMissionOptions {
+    mission: string;
+    out?: string;
+    sign?: boolean;
+}
+export interface AttestMissionResult {
+    repo_root: string;
+    receipt: AttestationReceipt;
+    receipt_path: string;
+}
+export declare function attestMission(options: AttestMissionOptions): AttestMissionResult;
+//# sourceMappingURL=attest-mission.d.ts.map

package/dist/cli/lib/attest-mission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest-mission.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/attest-mission.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAKlC,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAgBhF"}

package/dist/cli/lib/attest-mission.js

@@ -0,0 +1,22 @@
+import { buildAttestationReceipt, writeAttestationReceipt, } from "./attestation-receipt.js";
+import { GantryUserError } from "./errors.js";
+import { assertMissionGatePresent, parseMissionFile } from "./missions/parser.js";
+import { loadWorkspace } from "./workspace.js";
+export function attestMission(options) {
+    if (!options.mission?.trim()) {
+        throw new GantryUserError("INVALID_ARGUMENT", "gantry attest: --mission is required", undefined, 2);
+    }
+    const { root } = loadWorkspace();
+    const mission = parseMissionFile(root, options.mission);
+    assertMissionGatePresent(mission);
+    const receipt = buildAttestationReceipt({
+        root,
+        mission,
+        missionArg: options.mission,
+        verifyStatus: "attest_only",
+        sign: options.sign === true,
+    });
+    const receipt_path = writeAttestationReceipt(root, receipt, options.out);
+    return { repo_root: root, receipt, receipt_path };
+}
+//# sourceMappingURL=attest-mission.js.map

package/dist/cli/lib/attest-mission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest-mission.js","sourceRoot":"","sources":["../../../src/cli/lib/attest-mission.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GAExB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAc/C,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,sCAAsC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,uBAAuB,CAAC;QACtC,IAAI;QACJ,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,OAAO;QAC3B,YAAY,EAAE,aAAa;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AACpD,CAAC"}

package/dist/cli/lib/attestation-receipt.d.ts

@@ -0,0 +1,40 @@
+import { type ReceiptSignature, type ReceiptSignatureVerifyStatus } from "./receipt-signing.js";
+import type { ParsedMission } from "./types.js";
+export declare const ATTESTATION_RECEIPT_SCHEMA_VERSION: "0.1.0";
+export type AttestationVerifyStatus = "passed" | "failed" | "attest_only";
+export interface PlannerStampReceipt {
+    commit: string;
+    subject: string;
+    author_email: string;
+}
+export interface AttestationReceipt {
+    schema_version: typeof ATTESTATION_RECEIPT_SCHEMA_VERSION;
+    msn_id: string;
+    mission_rel: string;
+    mission_sha256: string;
+    manifest_sha256: string | null;
+    target_architecture_sha256: string | null;
+    config_sha256: string | null;
+    git_head: string;
+    planner_stamp: PlannerStampReceipt | null;
+    verify_status: AttestationVerifyStatus;
+    error_code?: string;
+    issued_at: string;
+    receipt_sha256: string;
+    signature?: ReceiptSignature;
+}
+export interface BuildAttestationReceiptInput {
+    root: string;
+    mission: ParsedMission;
+    missionArg: string;
+    verifyStatus: AttestationVerifyStatus;
+    errorCode?: string;
+    sign?: boolean;
+}
+export declare function resolvePlannerStampForReceipt(root: string, msnId: string): PlannerStampReceipt | null;
+export declare function computeReceiptSha256(payload: Omit<AttestationReceipt, "receipt_sha256" | "signature">): string;
+export declare function buildAttestationReceipt(input: BuildAttestationReceiptInput): AttestationReceipt;
+export declare function defaultReceiptPath(root: string, msnId: string, receiptSha256: string): string;
+export declare function writeAttestationReceipt(root: string, receipt: AttestationReceipt, outPath?: string): string;
+export type { ReceiptSignatureVerifyStatus };
+//# sourceMappingURL=attestation-receipt.d.ts.map

package/dist/cli/lib/attestation-receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-receipt.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/attestation-receipt.ts"],"names":[],"mappings":"AAgBA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EAClC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,eAAO,MAAM,kCAAkC,EAAG,OAAgB,CAAC;AAEnE,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE1E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,OAAO,kCAAkC,CAAC;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,aAAa,EAAE,uBAAuB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,uBAAuB,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,mBAAmB,GAAG,IAAI,CAW5B;AASD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,GAAG,WAAW,CAAC,GAChE,MAAM,CAER;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,kBAAkB,CAwE/F;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAG7F;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAOR;AAED,YAAY,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/cli/lib/attestation-receipt.js

@@ -0,0 +1,110 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { canonicalJson } from "./canonical-json.js";
+import { logWarn } from "./cli-io.js";
+import { CLI_NAME, REL_RECEIPTS_DIR } from "./constants.js";
+import { GantryUserError } from "./errors.js";
+import { listMsnSubjectCommits, missionPathRepoRelative, } from "./git-proof.js";
+import { gitRevParse } from "./git.js";
+import { loadGxtConfig, resolveReceiptSignatureTier } from "./gxt-config.js";
+import { resolvePlannerEmails } from "./planner-identity.js";
+import { signReceiptHash, verifyReceiptSignature, } from "./receipt-signing.js";
+import { computeWorkingDigests } from "./working-digests.js";
+export const ATTESTATION_RECEIPT_SCHEMA_VERSION = "0.1.0";
+function sha256Bytes(buf) {
+    return crypto.createHash("sha256").update(buf).digest("hex");
+}
+function isPlannerStamp(row, plannerEmails) {
+    return plannerEmails.includes(row.authorEmail.trim().toLowerCase());
+}
+export function resolvePlannerStampForReceipt(root, msnId) {
+    const plannerEmails = resolvePlannerEmails(root).emails;
+    if (plannerEmails.length === 0)
+        return null;
+    const rows = listMsnSubjectCommits(root, msnId);
+    const stamp = rows.find((row) => isPlannerStamp(row, plannerEmails));
+    if (!stamp)
+        return null;
+    return {
+        commit: stamp.hash,
+        subject: stamp.subject,
+        author_email: stamp.authorEmail,
+    };
+}
+function unsignedReceiptPayload(input) {
+    const { receipt_sha256: _receiptSha, signature: _signature, ...rest } = input;
+    return { ...rest };
+}
+export function computeReceiptSha256(payload) {
+    return crypto.createHash("sha256").update(canonicalJson(unsignedReceiptPayload(payload)), "utf8").digest("hex");
+}
+export function buildAttestationReceipt(input) {
+    const missionAbs = path.resolve(input.root, input.missionArg);
+    const missionRel = missionPathRepoRelative(input.root, missionAbs);
+    const msnId = input.mission.msnId;
+    if (!msnId) {
+        throw new GantryUserError("INVALID_ARGUMENT", "mission is missing msn_id", undefined, 2);
+    }
+    const digests = computeWorkingDigests(input.root);
+    if (digests.manifest_sha256 === null) {
+        throw new GantryUserError("MANIFEST_MISSING", "attestation receipt requires .gitagent/foreman/MANIFEST.json", "run gantry init or restore MANIFEST.json", 2);
+    }
+    const base = {
+        schema_version: ATTESTATION_RECEIPT_SCHEMA_VERSION,
+        msn_id: msnId,
+        mission_rel: missionRel,
+        mission_sha256: sha256Bytes(fs.readFileSync(missionAbs)),
+        manifest_sha256: digests.manifest_sha256,
+        target_architecture_sha256: digests.target_architecture_sha256,
+        config_sha256: digests.config_sha256,
+        git_head: gitRevParse(input.root, "HEAD") ?? "no-head",
+        planner_stamp: resolvePlannerStampForReceipt(input.root, msnId),
+        verify_status: input.verifyStatus,
+        issued_at: new Date().toISOString(),
+    };
+    if (input.errorCode) {
+        base.error_code = input.errorCode;
+    }
+    const receipt_sha256 = computeReceiptSha256(base);
+    const receipt = { ...base, receipt_sha256 };
+    const config = loadGxtConfig(input.root);
+    const tier = resolveReceiptSignatureTier(config);
+    const shouldSign = input.sign === true || tier === "require" || tier === "warn";
+    if (!shouldSign)
+        return receipt;
+    const signature = signReceiptHash(input.root, receipt_sha256);
+    if (!signature) {
+        if (tier === "require") {
+            throw new GantryUserError("RECEIPT_SIGNATURE_REQUIRED", "receipt_signature=require but no local SSH/GPG signing key is configured", "configure user.signingkey and gpg.format, or pass receipt_signature off", 2);
+        }
+        if (tier === "warn") {
+            logWarn(`${CLI_NAME} attest: receipt unsigned — no local SSH/GPG signing key is configured`);
+        }
+        return receipt;
+    }
+    const verifyStatus = verifyReceiptSignature(input.root, receipt_sha256, signature);
+    if (tier === "warn" && verifyStatus !== "good") {
+        logWarn(`${CLI_NAME} attest: receipt signature verify_status=${verifyStatus}`);
+    }
+    return {
+        ...receipt,
+        signature: {
+            ...signature,
+            verify_status: verifyStatus,
+        },
+    };
+}
+export function defaultReceiptPath(root, msnId, receiptSha256) {
+    const suffix = receiptSha256.slice(0, 12);
+    return path.join(root, REL_RECEIPTS_DIR, `${msnId}-${suffix}.json`);
+}
+export function writeAttestationReceipt(root, receipt, outPath) {
+    const target = outPath
+        ? path.resolve(root, outPath)
+        : defaultReceiptPath(root, receipt.msn_id, receipt.receipt_sha256);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, `${JSON.stringify(receipt, null, 2)}\n`, "utf8");
+    return target;
+}
+//# sourceMappingURL=attestation-receipt.js.map

package/dist/cli/lib/attestation-receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-receipt.js","sourceRoot":"","sources":["../../../src/cli/lib/attestation-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,eAAe,EACf,sBAAsB,GAGvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,kCAAkC,GAAG,OAAgB,CAAC;AAoCnE,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,GAAiB,EAAE,aAAuB;IAChE,OAAO,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAAY,EACZ,KAAa;IAEb,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAoF;IAEpF,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAA2B,CAAC;IACpG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAiE;IAEjE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAmC;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,2BAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,8DAA8D,EAC9D,0CAA0C,EAC1C,CAAC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAA6D;QACrE,cAAc,EAAE,kCAAkC;QAClD,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,UAAU;QACvB,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACxD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS;QACtD,aAAa,EAAE,6BAA6B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/D,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACpC,CAAC;IAED,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAuB,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,CAAC;IAEhE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,CAAC;IAChF,IAAI,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IAEhC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,eAAe,CACvB,4BAA4B,EAC5B,0EAA0E,EAC1E,yEAAyE,EACzE,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,CACL,GAAG,QAAQ,wEAAwE,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACnF,IAAI,IAAI,KAAK,MAAM,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,QAAQ,4CAA4C,YAAY,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO;QACL,GAAG,OAAO;QACV,SAAS,EAAE;YACT,GAAG,SAAS;YACZ,aAAa,EAAE,YAAY;SAC5B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa,EAAE,aAAqB;IACnF,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,KAAK,IAAI,MAAM,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,OAA2B,EAC3B,OAAgB;IAEhB,MAAM,MAAM,GAAG,OAAO;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;QAC7B,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/lib/canonical-json.d.ts

@@ -0,0 +1,3 @@
+/** Deterministic JSON with sorted object keys (recursive). */
+export declare function canonicalJson(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/cli/lib/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/canonical-json.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUpD"}

package/dist/cli/lib/canonical-json.js

@@ -0,0 +1,13 @@
+/** Deterministic JSON with sorted object keys (recursive). */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((v) => canonicalJson(v)).join(",")}]`;
+    }
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/cli/lib/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../../src/cli/lib/canonical-json.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC3F,CAAC"}

package/dist/cli/lib/constants.d.ts

@@ -13,6 +13,8 @@ export declare const REL_KPI_REPORT_SCHEMA: ".gitagent/planner/KPI-REPORT.schema
 export declare const DEFAULT_KPI_REPORT_DIR: ".gitagent/kpi";
 export declare const REL_MISSION_TEMPLATE: ".gitagent/planner/MISSION.template.md";
 export declare const REL_HISTORY_DIR: ".gitagent/history";
+/** Git-ignored attestation receipts for optional hub ingestion. */
+export declare const REL_RECEIPTS_DIR: ".gitagent/history/receipts";
 /** Git-ignored machine-readable runtime error (see templates/.gitignore.gxt). */
 export declare const REL_AGENT_ERROR_FILE: ".gitagent/history/.ignored-last-error.json";
 /** Git-ignored verify failure remediation feed for IDE/agent loops (atomic swap writes). */

package/dist/cli/lib/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/constants.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,eAAO,MAAM,YAAY,EAAG,iCAA0C,CAAC;AACvE,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,EAAG,qCAA8C,CAAC;AACvF,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,EAAG,0CAAmD,CAAC;AACjG,mGAAmG;AACnG,eAAO,MAAM,gCAAgC,EAAG,6CAAsD,CAAC;AACvG,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,EAAG,+BAAwC,CAAC;AACzF,eAAO,MAAM,kBAAkB,EAAG,uCAAgD,CAAC;AACnF,eAAO,MAAM,qBAAqB,EAAG,0CAAmD,CAAC;AACzF,eAAO,MAAM,sBAAsB,EAAG,eAAwB,CAAC;AAC/D,eAAO,MAAM,oBAAoB,EAAG,uCAAgD,CAAC;AACrF,eAAO,MAAM,eAAe,EAAG,mBAA4B,CAAC;AAC5D,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,EAAG,4CAAqD,CAAC;AAC1F,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,EAAG,qCAA8C,CAAC;AACnF,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,EAAG,oBAA6B,CAAC;AACjE,sGAAsG;AACtG,eAAO,MAAM,oBAAoB,EAAG,wBAAiC,CAAC;AACtE,eAAO,MAAM,eAAe,EAAG,QAAiB,CAAC;AACjD,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAChE,mFAAmF;AACnF,eAAO,MAAM,2BAA2B,EACtC,+DAAwE,CAAC;AAC3E,+GAA+G;AAC/G,eAAO,MAAM,sBAAsB,EAAG,sCAA+C,CAAC;AAEtF,qDAAqD;AACrD,eAAO,MAAM,cAAc,QAAgB,CAAC;AAE5C,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,eAAe,WAAW,CAAC;AACxC,eAAO,MAAM,sBAAsB,EAAG,uBAAgC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/constants.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,eAAO,MAAM,YAAY,EAAG,iCAA0C,CAAC;AACvE,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,EAAG,qCAA8C,CAAC;AACvF,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,EAAG,0CAAmD,CAAC;AACjG,mGAAmG;AACnG,eAAO,MAAM,gCAAgC,EAAG,6CAAsD,CAAC;AACvG,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,EAAG,+BAAwC,CAAC;AACzF,eAAO,MAAM,kBAAkB,EAAG,uCAAgD,CAAC;AACnF,eAAO,MAAM,qBAAqB,EAAG,0CAAmD,CAAC;AACzF,eAAO,MAAM,sBAAsB,EAAG,eAAwB,CAAC;AAC/D,eAAO,MAAM,oBAAoB,EAAG,uCAAgD,CAAC;AACrF,eAAO,MAAM,eAAe,EAAG,mBAA4B,CAAC;AAC5D,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,EAAG,4BAAqC,CAAC;AACtE,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,EAAG,4CAAqD,CAAC;AAC1F,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,EAAG,qCAA8C,CAAC;AACnF,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,EAAG,oBAA6B,CAAC;AACjE,sGAAsG;AACtG,eAAO,MAAM,oBAAoB,EAAG,wBAAiC,CAAC;AACtE,eAAO,MAAM,eAAe,EAAG,QAAiB,CAAC;AACjD,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAChE,mFAAmF;AACnF,eAAO,MAAM,2BAA2B,EACtC,+DAAwE,CAAC;AAC3E,+GAA+G;AAC/G,eAAO,MAAM,sBAAsB,EAAG,sCAA+C,CAAC;AAEtF,qDAAqD;AACrD,eAAO,MAAM,cAAc,QAAgB,CAAC;AAE5C,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,eAAe,WAAW,CAAC;AACxC,eAAO,MAAM,sBAAsB,EAAG,uBAAgC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/cli/lib/constants.js

@@ -13,6 +13,8 @@ export const REL_KPI_REPORT_SCHEMA = ".gitagent/planner/KPI-REPORT.schema.yaml";
 export const DEFAULT_KPI_REPORT_DIR = ".gitagent/kpi";
 export const REL_MISSION_TEMPLATE = ".gitagent/planner/MISSION.template.md";
 export const REL_HISTORY_DIR = ".gitagent/history";
+/** Git-ignored attestation receipts for optional hub ingestion. */
+export const REL_RECEIPTS_DIR = ".gitagent/history/receipts";
 /** Git-ignored machine-readable runtime error (see templates/.gitignore.gxt). */
 export const REL_AGENT_ERROR_FILE = ".gitagent/history/.ignored-last-error.json";
 /** Git-ignored verify failure remediation feed for IDE/agent loops (atomic swap writes). */

package/dist/cli/lib/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/cli/lib/constants.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,iCAA0C,CAAC;AACvE,sEAAsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qCAA8C,CAAC;AACvF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,0CAAmD,CAAC;AACjG,mGAAmG;AACnG,MAAM,CAAC,MAAM,gCAAgC,GAAG,6CAAsD,CAAC;AACvG,oFAAoF;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAAwC,CAAC;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,uCAAgD,CAAC;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,0CAAmD,CAAC;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAwB,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,uCAAgD,CAAC;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAA4B,CAAC;AAC5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,4CAAqD,CAAC;AAC1F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,oBAAoB,GAAG,qCAA8C,CAAC;AACnF,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAA6B,CAAC;AACjE,sGAAsG;AACtG,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAiC,CAAC;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAiB,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAA0B,CAAC;AAChE,mFAAmF;AACnF,MAAM,CAAC,MAAM,2BAA2B,GACtC,+DAAwE,CAAC;AAC3E,+GAA+G;AAC/G,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAA+C,CAAC;AAEtF,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAgC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/cli/lib/constants.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,iCAA0C,CAAC;AACvE,sEAAsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qCAA8C,CAAC;AACvF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,0CAAmD,CAAC;AACjG,mGAAmG;AACnG,MAAM,CAAC,MAAM,gCAAgC,GAAG,6CAAsD,CAAC;AACvG,oFAAoF;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAAwC,CAAC;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,uCAAgD,CAAC;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,0CAAmD,CAAC;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAwB,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,uCAAgD,CAAC;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAA4B,CAAC;AAC5D,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAAqC,CAAC;AACtE,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,4CAAqD,CAAC;AAC1F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,oBAAoB,GAAG,qCAA8C,CAAC;AACnF,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAA6B,CAAC;AACjE,sGAAsG;AACtG,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAiC,CAAC;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAiB,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAA0B,CAAC;AAChE,mFAAmF;AACnF,MAAM,CAAC,MAAM,2BAA2B,GACtC,+DAAwE,CAAC;AAC3E,+GAA+G;AAC/G,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAA+C,CAAC;AAEtF,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAgC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/cli/lib/doctor-core.d.ts

@@ -1,5 +1,5 @@
 import type { Manifest } from "./types.js";
 import { type DoctorCheckResult, type DoctorReport } from "./doctor-types.js";
 export declare function runDoctorChecks(root: string, manifest: Manifest): DoctorCheckResult;
-export declare function collectDoctorReport(root: string, manifest: Manifest, templatesRoot?: string): DoctorReport;
+export declare function collectDoctorReport(root: string, manifest: Manifest, templatesRoot?: string, policyPath?: string): DoctorReport;
 //# sourceMappingURL=doctor-core.d.ts.map

package/dist/cli/lib/doctor-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-core.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/doctor-core.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAGL,KAAK,iBAAiB,EAEtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAsI3B,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,iBAAiB,CA8BnF;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,aAAa,CAAC,EAAE,MAAM,GACrB,YAAY,CA2Bd"}
+{"version":3,"file":"doctor-core.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/doctor-core.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAGL,KAAK,iBAAiB,EAEtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AA6I3B,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,iBAAiB,CA+BnF;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,aAAa,CAAC,EAAE,MAAM,EACtB,UAAU,CAAC,EAAE,MAAM,GAClB,YAAY,CAyCd"}