@mc-and-his-agents/loom-installer 0.1.25 → 0.1.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "b3b72c7a74674319f0a7432487fc0e3cbf012b4f",
+  "source_commit": "72c484aa09e0c62361ba56aeeec319851468d5e8",
   "source_ref": "main",
-  "built_at": "2026-04-26T23:56:30+08:00",
+  "built_at": "2026-04-27T00:39:19+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -623,23 +623,23 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_status.py",
@@ -1208,23 +1208,23 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_status.py",
@@ -1823,23 +1823,23 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_status.py",
@@ -2438,23 +2438,23 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_status.py",
@@ -3058,23 +3058,23 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_status.py",
@@ -3673,23 +3673,23 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_status.py",
@@ -4288,23 +4288,23 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_status.py",
@@ -4903,23 +4903,23 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_status.py",
@@ -5518,23 +5518,23 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_status.py",
@@ -6133,23 +6133,23 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 53833,
-      "sha256": "d12f21d009a5127a4b0aba70bc23e111a51a490017879ee59d51c22db65b5f0a"
+      "bytes": 56137,
+      "sha256": "2f873ee4ddd170af4a835da24bafa59f6e5561ee74360faf71e98e8480100a72"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 287428,
-      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
+      "bytes": 296087,
+      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296151,
-      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
+      "bytes": 296657,
+      "sha256": "7d4f476d8117a6b9d264a71f8300f229bf511dd9e1fb2b29636990c16c6d197d"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 85225,
-      "sha256": "fc819d8172a1525c4fb86cbee680110c655101b6d6db7471a4d6c50d5c0bc1fc"
+      "bytes": 85311,
+      "sha256": "8fc0f350f55fa068b4b69854fb81f3b45fbace5bf384f900a63aeb9adfd87c1b"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_status.py",

package/payload/plugin/loom/skills/shared/scripts/governance_surface.py

@@ -252,6 +252,58 @@ MATURITY_REQUIRED_FIELDS = {
         },
     ],
 }
+ADOPTION_GATE_ROLLOUT_MODES = {
+    "advisory": {
+        "summary": "Default mode for newly adopted repositories; Loom reports gate signals without becoming the blocking authority.",
+        "blocking": False,
+    },
+    "blocking": {
+        "summary": "Explicit opt-in mode for strong governance repositories after adversarial adoption checks pass.",
+        "blocking": True,
+    },
+    "rollback": {
+        "summary": "Emergency switch back to advisory consumption when runtime, evidence, or host bindings drift.",
+        "blocking": False,
+    },
+}
+
+
+def adoption_gate_rollout_status(*, maturity_current: str) -> dict[str, Any]:
+    blocking_preconditions = [
+        {
+            "id": "strong_maturity",
+            "status": "pass" if maturity_current == "strong" else "missing",
+            "layer": "github-profile",
+            "recommended_action": "upgrade the repository to strong maturity before enabling blocking gates",
+        },
+        {
+            "id": "adversarial_adoption_checks",
+            "status": "missing",
+            "layer": "core",
+            "recommended_action": "run the Loom-owned Syvert-style adversarial adoption fixture and record the validation evidence",
+        },
+        {
+            "id": "rollback_switch",
+            "status": "pass",
+            "layer": "core",
+            "recommended_action": "keep rollback available by switching gate mode back to advisory and rerunning governance-profile status",
+        },
+    ]
+    blocking_allowed = all(entry["status"] == "pass" for entry in blocking_preconditions)
+    return {
+        "schema_version": "loom-adoption-gate-rollout/v1",
+        "default_mode": "advisory",
+        "current_mode": "advisory",
+        "recommended_mode": "blocking" if blocking_allowed else "advisory",
+        "allowed_modes": ADOPTION_GATE_ROLLOUT_MODES,
+        "blocking_allowed": blocking_allowed,
+        "blocking_preconditions": blocking_preconditions,
+        "rollback": {
+            "mode": "rollback",
+            "switch_to": "advisory",
+            "recommended_action": "disable blocking consumption, preserve evidence, repair drift, then rerun adversarial adoption checks before re-enabling blocking",
+        },
+    }
 
 
 def run_process(args: list[str], cwd: Path) -> subprocess.CompletedProcess[str]:
@@ -1209,6 +1261,7 @@ def maturity_status(
         "required_fields": MATURITY_REQUIRED_FIELDS,
         "missing_by_level": missing_by_level,
         "missing_details_by_level": missing_details_by_level,
+        "gate_rollout": adoption_gate_rollout_status(maturity_current=current),
     }
 
 

package/payload/plugin/loom/skills/shared/scripts/loom_check.py

@@ -18,7 +18,7 @@ from pathlib import Path
 
 from fact_chain_support import inspect_fact_chain
 from governance_surface import build_governance_surface
-from loom_flow import repo_specific_requirements_payload
+from loom_flow import repo_specific_requirements_payload, review_head_binding
 from runtime_paths import repo_local_root
 
 TOP_LEVEL_DIRS = (
@@ -97,6 +97,7 @@ CORE_DOCS = (
     "docs/evidence/validations/validation-adoption-maturity-upgrade-automation.md",
     "docs/evidence/validations/validation-adoption-maturity-required-fields.md",
     "docs/evidence/validations/validation-skills-consume-maturity-upgrade-path.md",
+    "docs/evidence/validations/validation-adoption-gate-rollout.md",
     "docs/evidence/validations/validation-github-profile-binding-orchestration.md",
     "docs/evidence/validations/validation-github-profile-drift-reconciliation.md",
     "docs/evidence/validations/validation-github-profile-graphql-budget-guard.md",
@@ -857,6 +858,71 @@ def require_governance_control_plane(
         missing_details = maturity.get("missing_details_by_level")
         if not isinstance(missing_details, dict) or set(missing_details) != {"light", "standard", "strong"}:
             failures.append(Failure(category, f"{context}.maturity missing_details_by_level must define light, standard, and strong"))
+        require_adoption_gate_rollout_payload(
+            failures,
+            category=category,
+            context=f"{context}.maturity.gate_rollout",
+            payload=maturity.get("gate_rollout"),
+        )
+
+
+def require_adoption_gate_rollout_payload(
+    failures: list[Failure],
+    *,
+    category: str,
+    context: str,
+    payload: object,
+) -> None:
+    if not isinstance(payload, dict):
+        failures.append(Failure(category, f"{context} must be an object"))
+        return
+    if payload.get("schema_version") != "loom-adoption-gate-rollout/v1":
+        failures.append(Failure(category, f"{context} schema_version must be `loom-adoption-gate-rollout/v1`"))
+    if payload.get("default_mode") != "advisory":
+        failures.append(Failure(category, f"{context} default_mode must remain advisory"))
+    if payload.get("current_mode") not in {"advisory", "blocking", "rollback"}:
+        failures.append(Failure(category, f"{context} current_mode must stay within advisory/blocking/rollback"))
+    if payload.get("recommended_mode") not in {"advisory", "blocking", "rollback"}:
+        failures.append(Failure(category, f"{context} recommended_mode must stay within advisory/blocking/rollback"))
+    if not isinstance(payload.get("blocking_allowed"), bool):
+        failures.append(Failure(category, f"{context} blocking_allowed must be boolean"))
+    modes = payload.get("allowed_modes")
+    if not isinstance(modes, dict) or set(modes) != {"advisory", "blocking", "rollback"}:
+        failures.append(Failure(category, f"{context} allowed_modes must define advisory, blocking, and rollback"))
+    else:
+        for mode, entry in modes.items():
+            if not isinstance(entry, dict):
+                failures.append(Failure(category, f"{context}.allowed_modes.{mode} must be an object"))
+                continue
+            if not isinstance(entry.get("summary"), str) or not entry.get("summary"):
+                failures.append(Failure(category, f"{context}.allowed_modes.{mode} must include summary"))
+            if not isinstance(entry.get("blocking"), bool):
+                failures.append(Failure(category, f"{context}.allowed_modes.{mode} must include boolean blocking"))
+    preconditions = payload.get("blocking_preconditions")
+    if not isinstance(preconditions, list) or not preconditions:
+        failures.append(Failure(category, f"{context} blocking_preconditions must be non-empty"))
+    else:
+        ids = {entry.get("id") for entry in preconditions if isinstance(entry, dict)}
+        if not {"strong_maturity", "adversarial_adoption_checks", "rollback_switch"}.issubset(ids):
+            failures.append(Failure(category, f"{context} blocking_preconditions must include strong maturity, adversarial checks, and rollback switch"))
+        for entry in preconditions:
+            if not isinstance(entry, dict):
+                failures.append(Failure(category, f"{context} blocking_preconditions entries must be objects"))
+                continue
+            if entry.get("status") not in {"pass", "missing", "block"}:
+                failures.append(Failure(category, f"{context} blocking precondition status must be stable"))
+            if entry.get("layer") not in {"core", "github-profile", "repo-owned-residue"}:
+                failures.append(Failure(category, f"{context} blocking precondition layer must be stable"))
+            if not isinstance(entry.get("recommended_action"), str) or not entry.get("recommended_action"):
+                failures.append(Failure(category, f"{context} blocking preconditions must include recommended_action"))
+    rollback = payload.get("rollback")
+    if not isinstance(rollback, dict):
+        failures.append(Failure(category, f"{context} rollback must be an object"))
+    else:
+        if rollback.get("mode") != "rollback" or rollback.get("switch_to") != "advisory":
+            failures.append(Failure(category, f"{context} rollback must switch back to advisory"))
+        if not isinstance(rollback.get("recommended_action"), str) or not rollback.get("recommended_action"):
+            failures.append(Failure(category, f"{context} rollback must include recommended_action"))
 
 
 def require_locator_entry(
@@ -1385,6 +1451,12 @@ def require_governance_upgrade_payload(
         failures.append(Failure(category, f"{context} target_maturity must be standard/strong"))
     if not isinstance(payload.get("dry_run"), bool):
         failures.append(Failure(category, f"{context} dry_run must be boolean"))
+    require_adoption_gate_rollout_payload(
+        failures,
+        category=category,
+        context=f"{context}.gate_rollout",
+        payload=payload.get("gate_rollout"),
+    )
     actions = payload.get("actions")
     if not isinstance(actions, list) or not actions:
         failures.append(Failure(category, f"{context} must include non-empty actions"))
@@ -1428,6 +1500,12 @@ def require_maturity_upgrade_path(
     validation_entries = payload.get("validation_entries")
     if not isinstance(validation_entries, list) or not validation_entries:
         failures.append(Failure(category, f"{context} validation_entries must be non-empty"))
+    require_adoption_gate_rollout_payload(
+        failures,
+        category=category,
+        context=f"{context}.gate_rollout",
+        payload=payload.get("gate_rollout"),
+    )
 
 
 def require_review_record_contract(
@@ -2211,6 +2289,15 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    head_result = run_command(root, ["git", "rev-parse", "HEAD"], timeout_seconds=30)
+    if head_result.returncode == 0:
+        head_binding, head_errors = review_head_binding(
+            root,
+            reviewed_head=head_result.stdout.strip(),
+            allowed_paths=set(),
+        )
+        if head_errors or head_binding.get("status") != "fresh":
+            failures.append(Failure("demo-fact-chain", "review head binding must report `fresh` for the current HEAD"))
     with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
         spoof_target = Path(tmp) / "new-project"
         shutil.copytree(target, spoof_target)
@@ -4421,6 +4508,65 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
                 elif checkpoint_merge_payload.get("result") != "pass":
                     failures.append(Failure("daily-execution-cli", "`installed checkpoint merge` must pass for the positive chain"))
 
+                payload, error = load_command_json(
+                    root,
+                    [
+                        "python3",
+                        str(install_root / "shared" / "scripts" / "loom_flow.py"),
+                        "recovery",
+                        "writeback",
+                        "--target",
+                        str(positive_target),
+                        "--item",
+                        "INIT-0001",
+                        "--current-checkpoint",
+                        "merge checkpoint",
+                        "--current-stop",
+                        "Only Loom carrier status changed after review.",
+                        "--next-step",
+                        "Confirm carrier-only review head binding remains consumable.",
+                        "--latest-validation-summary",
+                        positive_summary,
+                    ],
+                )
+                if error:
+                    failures.append(Failure("daily-execution-cli", f"`installed recovery writeback carrier-only` failed: {error}"))
+                elif payload.get("result") != "pass":
+                    failures.append(Failure("daily-execution-cli", "`installed recovery writeback carrier-only` must pass"))
+                git_add = run_command(root, ["git", "add", "-f", ".loom/progress/INIT-0001.md", ".loom/status/current.md"], cwd=positive_target)
+                if git_add.returncode != 0:
+                    detail = git_add.stderr.strip() or git_add.stdout.strip() or "git add failed"
+                    failures.append(Failure("daily-execution-cli", f"`installed carrier-only commit` add failed: {detail}"))
+                else:
+                    git_commit = run_command(
+                        root,
+                        ["git", "commit", "-m", "refresh carriers after review for #354"],
+                        cwd=positive_target,
+                    )
+                    if git_commit.returncode != 0:
+                        detail = git_commit.stderr.strip() or git_commit.stdout.strip() or "git commit failed"
+                        failures.append(Failure("daily-execution-cli", f"`installed carrier-only commit` failed: {detail}"))
+
+                payload, error = load_command_json(
+                    root,
+                    [
+                        "python3",
+                        str(install_root / "shared" / "scripts" / "loom_flow.py"),
+                        "checkpoint",
+                        "merge",
+                        "--target",
+                        str(positive_target),
+                        "--item",
+                        "INIT-0001",
+                    ],
+                )
+                if error:
+                    failures.append(Failure("daily-execution-cli", f"`installed checkpoint merge` carrier-only failed: {error}"))
+                elif payload.get("result") != "pass":
+                    failures.append(Failure("daily-execution-cli", "`installed checkpoint merge` must pass for carrier-only review head drift"))
+                elif "carrier-only" not in json.dumps(payload, ensure_ascii=False):
+                    failures.append(Failure("daily-execution-cli", "`installed checkpoint merge` must expose carrier-only review head binding"))
+
                 broken_install = tmp_root / "broken-install" / "skills"
                 shutil.copytree(root / "skills", broken_install)
                 (broken_install / "install-layout.json").unlink()
@@ -4601,6 +4747,8 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
                     failures.append(Failure("daily-execution-cli", f"`installed checkpoint merge` drift negative failed: {error}"))
                 elif payload.get("result") != "block":
                     failures.append(Failure("daily-execution-cli", "`installed checkpoint merge` must block when HEAD drifts beyond Loom carriers"))
+                elif "implementation-drift-only" not in json.dumps(payload, ensure_ascii=False):
+                    failures.append(Failure("daily-execution-cli", "`installed checkpoint merge` drift negative must expose implementation-drift-only review head binding"))
 
     gh_auth_probe = None
     if shutil.which("gh") is not None: