@jeger-ai/opengantry 3.0.1 → 3.1.0

package/templates/.gitagent/planner/PERFORMANCE_RUBRIC.template.md

@@ -0,0 +1,32 @@
+# PERFORMANCE_RUBRIC (advisory LLM judge)
+
+Use this rubric with a BYO `llm_verifiers` command in mission YAML. Verdicts are **ADVISORY_ONLY** — write `findings[]` to the KPI report; do **not** add blocking `kpi_gate` thresholds on judge metrics.
+
+Judge **structural strategies only** (pooling, blocking I/O, memoization, streaming). Never guess runtime latency or throughput from source inspection.
+
+Anchor each question to a rule `id` and cite `PERFORMANCE.md` via `doc_anchor` when emitting findings:
+
+| Rule ID | Review question |
+|---------|-----------------|
+| `PERF-POOLING` | Did the diff introduce per-iteration client instantiation instead of pooling or injection? |
+| `PERF-NONBLOCKING` | Did the diff add sync file/crypto/I/O inside an async handler critical path? |
+| `PERF-MEMOIZATION` | Did the diff drop memoization or cache for an expensive repeated pure computation? |
+
+Example verifier stdout fragment:
+
+```json
+{
+  "metrics": { "perf_judge::reviewed": 1 },
+  "findings": [
+    {
+      "id": "PERF-POOLING",
+      "severity": "warn",
+      "path": "src/db.ts",
+      "line": 12,
+      "message": "new Pool() inside loop — see PERFORMANCE.md pooling policy",
+      "doc_anchor": "PERFORMANCE.md#connection-pooling"
+    }
+  ],
+  "exit_code": 0
+}
+```

package/templates/.githooks/pre-push

@@ -5,9 +5,9 @@ set -euo pipefail
 cd "$(git rev-parse --show-toplevel)"
 
 if [[ -f dist/cli/index.js ]]; then
-  GAPMAN=(node dist/cli/index.js)
+  GANTRY=(node dist/cli/index.js)
 elif command -v gantry >/dev/null 2>&1; then
-  GAPMAN=(gantry)
+  GANTRY=(gantry)
 else
   echo "pre-push: gantry not found — run: npm run build" >&2
   exit 1
@@ -35,17 +35,17 @@ for mission in "${missions[@]}"; do
   [[ -n "$mission" ]] || continue
   [[ -f "$mission" ]] || continue
   echo "pre-push: gantry verify --mission ${mission} (--pre-push)" >&2
-  "${GAPMAN[@]}" verify --mission "$mission" --pre-push || exit 1
+  "${GANTRY[@]}" verify --mission "$mission" --pre-push || exit 1
 done
 
 if git diff --name-only "${base}..HEAD" | grep -qE '^\.gitagent/foreman/MANIFEST\.json$|^\.gitagent/planner/RULES\.md$|\.gxt-skill\.yaml$'; then
   echo "pre-push: gantry perimeter (advisory)" >&2
-  "${GAPMAN[@]}" perimeter --base-ref "$base" || true
+  "${GANTRY[@]}" perimeter --base-ref "$base" || true
 fi
 
 if git diff --name-only "${base}..HEAD" | grep -qE '^\.gitagent/foreman/MANIFEST\.json$|^skills/'; then
   echo "pre-push: gantry check (manifest / skills changed)" >&2
-  "${GAPMAN[@]}" check || exit 1
+  "${GANTRY[@]}" check || exit 1
 fi
 
 if git diff --name-only "${base}..HEAD" -- 'src/cli/**/*.ts' | grep -q .; then

package/templates/.github/workflows/gxt-validate.yml

@@ -41,7 +41,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: "npm"
@@ -80,7 +80,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: "npm"
@@ -102,7 +102,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -142,7 +142,10 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - uses: actions/setup-node@v6
+      - name: Install ripgrep
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
+
+      - uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm

package/templates/integrations/compatibility.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1",
-  "opengantry_version": "3.0.1",
+  "opengantry_version": "3.1.0",
   "asset_catalog": "integrations/asset-catalog.json",
   "integrations": {
     "cursor": {

package/templates/scripts/lib/trusted-automation.mjs

@@ -3,11 +3,14 @@ import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
-import { pathMatchesAllowed } from "./glob-match.mjs";
-import { isMsnEnforcedPath, listMsnEnforcedPrefixes } from "./manifest-validate.mjs";
+import { matchGlob, pathMatchesAllowed } from "./glob-match.mjs";
+import { isMsnEnforcedPath, listMsnEnforcedPrefixes, readManifest } from "./manifest-validate.mjs";
 
-const HARD_MAX_NET_LOC = 5;
-const ALLOWED_STRUCTURAL_CHANGES = new Set(["workflow_version_pin"]);
+const STRUCTURAL_KIND_HARD_MAX_NET_LOC = {
+  workflow_version_pin: 5,
+  bounded_content: 100,
+};
+const ALLOWED_STRUCTURAL_CHANGES = new Set(Object.keys(STRUCTURAL_KIND_HARD_MAX_NET_LOC));
 const CONFIG_REL = ".gitagent/config.json";
 
 function normalizePath(p) {
@@ -75,11 +78,18 @@ export function loadTrustedAutomationRules(repoRoot) {
         throw new Error(`gxt-manifest-lib: rule ${rule.id} has unsupported structural change: ${change}`);
       }
     }
+    if (rule.allowed_structural_changes.length !== 1) {
+      throw new Error(
+        `gxt-manifest-lib: rule ${rule.id} must declare exactly one allowed_structural_changes kind`,
+      );
+    }
+    const structuralKind = rule.allowed_structural_changes[0];
+    const hardCap = STRUCTURAL_KIND_HARD_MAX_NET_LOC[structuralKind];
     if (typeof rule.max_net_loc !== "number" || !Number.isInteger(rule.max_net_loc) || rule.max_net_loc < 1) {
       throw new Error(`gxt-manifest-lib: rule ${rule.id} max_net_loc must be a positive integer`);
     }
-    if (rule.max_net_loc > HARD_MAX_NET_LOC) {
-      throw new Error(`gxt-manifest-lib: rule ${rule.id} max_net_loc exceeds hard cap ${HARD_MAX_NET_LOC}`);
+    if (rule.max_net_loc > hardCap) {
+      throw new Error(`gxt-manifest-lib: rule ${rule.id} max_net_loc exceeds hard cap ${hardCap} for ${structuralKind}`);
     }
     rules.push({
       id: rule.id,
@@ -213,10 +223,36 @@ function readBlobAt(repoRoot, commitSha, filePath) {
   }
 }
 
-function validateStructuralChanges(repoRoot, files, rule, baseSha, headSha, mode) {
-  if (!rule.allowed_structural_changes.has("workflow_version_pin")) {
-    return { ok: false, reason: `rule ${rule.id}: no matching structural change policy` };
+function listPerimeterProtectedGlobs(repoRoot) {
+  const manifest = readManifest(repoRoot);
+  if (!Array.isArray(manifest.perimeter_protected)) {
+    return [];
+  }
+  return manifest.perimeter_protected.map((g) => normalizePath(String(g)));
+}
+
+function isSubstrateHardDeniedPath(filePath, perimeterGlobs) {
+  const p = normalizePath(filePath);
+  if (p === ".gitagent" || p.startsWith(".gitagent/")) {
+    return true;
   }
+  return perimeterGlobs.some((g) => matchGlob(g, p));
+}
+
+function validateBoundedContentStructural(repoRoot, files, rule) {
+  const perimeterGlobs = listPerimeterProtectedGlobs(repoRoot);
+  for (const file of files) {
+    if (isSubstrateHardDeniedPath(file, perimeterGlobs)) {
+      return {
+        ok: false,
+        reason: `rule ${rule.id}: substrate hard-deny path not allowed (${file})`,
+      };
+    }
+  }
+  return { ok: true, reason: "" };
+}
+
+function validateWorkflowVersionPinStructural(repoRoot, files, rule, baseSha, headSha, mode) {
   const yaml = resolveYamlParser(repoRoot);
   const workflowFiles = files.filter((f) => /\.ya?ml$/i.test(f));
   for (const file of workflowFiles) {
@@ -241,6 +277,17 @@ function validateStructuralChanges(repoRoot, files, rule, baseSha, headSha, mode
   return { ok: true, reason: "" };
 }
 
+function validateStructuralChanges(repoRoot, files, rule, baseSha, headSha, mode) {
+  const kind = [...rule.allowed_structural_changes][0];
+  if (kind === "bounded_content") {
+    return validateBoundedContentStructural(repoRoot, files, rule);
+  }
+  if (kind === "workflow_version_pin") {
+    return validateWorkflowVersionPinStructural(repoRoot, files, rule, baseSha, headSha, mode);
+  }
+  return { ok: false, reason: `rule ${rule.id}: no matching structural change policy` };
+}
+
 function findMatchingRule(rules, actorEmail) {
   const actor = actorEmail.toLowerCase();
   return rules.filter((rule) => rule.allowed_actors.includes(actor));

package/templates/scripts/verify-pr-missions.sh

@@ -56,9 +56,9 @@ if [[ ${#UNIQUE_MSNS[@]} -gt 1 ]]; then
 fi
 
 if [[ -f dist/cli/index.js ]]; then
-  GAPMAN=(node dist/cli/index.js)
+  GANTRY=(node dist/cli/index.js)
 elif command -v gantry >/dev/null 2>&1; then
-  GAPMAN=(gantry)
+  GANTRY=(gantry)
 else
   echo "verify-pr-missions: build gantry first (npm run build)" >&2
   exit 1
@@ -141,7 +141,7 @@ fi
 
 for mission in "${CHANGED_MISSIONS[@]}"; do
   echo "verify-pr-missions: gantry verify --mission ${mission}" >&2
-  "${GAPMAN[@]}" verify --mission "$mission" --audience verifier || exit 1
+  "${GANTRY[@]}" verify --mission "$mission" --audience verifier || exit 1
 done
 
 echo "verify-pr-missions OK (${#CHANGED_MISSIONS[@]} mission(s))"