@nerviq/cli 0.0.1 → 0.9.0-beta.1

package/src/copilot/domain-packs.js

@@ -0,0 +1,350 @@
+/**
+ * Copilot Domain Packs — 16 domain packs with Copilot detection.
+ *
+ * Adapted from Gemini/Codex pattern with Copilot-specific surfaces:
+ * - copilot-instructions.md (not GEMINI.md/CLAUDE.md)
+ * - .vscode/settings.json (not .gemini/settings.json)
+ * - .github/prompts/ (Copilot-unique)
+ * - copilot-setup-steps.yml (Copilot-unique)
+ */
+
+const COPILOT_DOMAIN_PACKS = [
+  {
+    key: 'baseline-general',
+    label: 'Baseline General',
+    useWhen: 'General repos that need a safe, reviewable baseline before deeper specialization.',
+    adoption: 'Safe default when no stronger domain signal dominates the repo.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline', 'Prompt templates starter'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json'],
+    benchmarkFocus: ['starter-safe improvement', 'reviewable trust posture'],
+  },
+  {
+    key: 'backend-api',
+    label: 'Backend API',
+    useWhen: 'Service, API, or backend-heavy repos with routes, services, jobs, schemas, or data access.',
+    adoption: 'Recommended when Copilot needs stronger verification and review structure around backend changes.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline', 'Backend verification guide', 'CI / review workflow starter'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings', 'copilot-ci-review'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json', '.github/workflows/'],
+    benchmarkFocus: ['test + build verification', 'reviewable API changes', 'safe rollout posture'],
+  },
+  {
+    key: 'frontend-ui',
+    label: 'Frontend UI',
+    useWhen: 'React, Next.js, Vue, Angular, or Svelte repos with UI-heavy workflows and component work.',
+    adoption: 'Recommended when Copilot needs better component, build, and review guidance.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline', 'Frontend review workflow', 'CI / review workflow starter'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings', 'copilot-ci-review'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json', '.github/workflows/'],
+    benchmarkFocus: ['build verification', 'component-safe edits', 'reviewable UI changes'],
+  },
+  {
+    key: 'data-pipeline',
+    label: 'Data Pipeline',
+    useWhen: 'Repos with workers, DAGs, ETL jobs, migrations, or analytics-heavy workflows.',
+    adoption: 'Recommended when Copilot needs pipeline-safe verification and state-aware review.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline', 'Pipeline verification guide'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json'],
+    benchmarkFocus: ['pipeline safety', 'repeatable task flows', 'state-aware review'],
+  },
+  {
+    key: 'infra-platform',
+    label: 'Infra Platform',
+    useWhen: 'Terraform, Docker, Kubernetes, serverless, or deployment-oriented repos with operational blast radius.',
+    adoption: 'Recommended when Copilot changes need stronger guardrails and infra-aware verification.',
+    recommendedModules: ['.vscode/settings.json baseline', 'Infra review workflow', 'CI / review workflow starter'],
+    recommendedProposalFamilies: ['copilot-vscode-settings', 'copilot-ci-review', 'copilot-prompts'],
+    recommendedSurfaces: ['.vscode/settings.json', '.github/workflows/', '.github/prompts/'],
+    benchmarkFocus: ['release safety', 'infra verification', 'reviewable operational changes'],
+  },
+  {
+    key: 'oss-library',
+    label: 'OSS Library',
+    useWhen: 'Public packages or contributor-heavy repos that need lighter governance.',
+    adoption: 'Recommended for open-source repos where Copilot should suggest, not auto-apply.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json'],
+    benchmarkFocus: ['low-footprint adoption', 'contributor-safe defaults', 'manual review friendliness'],
+  },
+  {
+    key: 'enterprise-governed',
+    label: 'Enterprise Governed',
+    useWhen: 'Repos with CI, policy files, security posture, or auditable team workflows.',
+    adoption: 'Recommended for teams that need explicit approvals, review expectations, and governance evidence.',
+    recommendedModules: ['.vscode/settings.json baseline', 'Review workflow starter', 'Governance rollout kit'],
+    recommendedProposalFamilies: ['copilot-vscode-settings', 'copilot-ci-review', 'copilot-content-exclusions'],
+    recommendedSurfaces: ['.vscode/settings.json', '.github/workflows/', '.github/copilot-instructions.md'],
+    benchmarkFocus: ['policy-aware rollout', 'approval posture', 'repeatable governance evidence'],
+  },
+  {
+    key: 'monorepo',
+    label: 'Monorepo',
+    useWhen: 'Workspace-based repos with multiple packages sharing a root and a need for scoped behavior.',
+    adoption: 'Recommended when path-aware scoped instructions and workspace review boundaries matter.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline', 'Scoped instructions', 'Prompt templates'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-scoped-instructions', 'copilot-vscode-settings'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.github/instructions/', '.vscode/settings.json'],
+    benchmarkFocus: ['workspace-safe edits', 'package-scoped review', 'cross-package drift control'],
+  },
+  {
+    key: 'mobile',
+    label: 'Mobile',
+    useWhen: 'React Native, Flutter, Swift, or Kotlin repos with mobile-specific build and test workflows.',
+    adoption: 'Recommended when Copilot needs mobile build awareness and platform-specific verification.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline', 'Mobile verification guide'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json'],
+    benchmarkFocus: ['mobile build safety', 'platform-specific verification', 'reviewable native changes'],
+  },
+  {
+    key: 'regulated-lite',
+    label: 'Regulated Lite',
+    useWhen: 'Repos with basic compliance needs — activity artifacts, rollback manifests, and audit trail.',
+    adoption: 'Recommended for regulated-adjacent repos that need governance without full enterprise overhead.',
+    recommendedModules: ['.vscode/settings.json baseline', 'Governance rollout kit'],
+    recommendedProposalFamilies: ['copilot-vscode-settings', 'copilot-content-exclusions'],
+    recommendedSurfaces: ['.vscode/settings.json', '.github/copilot-instructions.md'],
+    benchmarkFocus: ['compliance posture', 'activity artifact coverage', 'rollback readiness'],
+  },
+  {
+    key: 'ecommerce',
+    label: 'E-commerce',
+    useWhen: 'Shopify, Stripe, or payment-heavy repos with transaction safety needs.',
+    adoption: 'Recommended when Copilot changes touch payment flows, cart logic, or sensitive data.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline', 'Security review workflow'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings', 'copilot-ci-review'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json', '.github/workflows/'],
+    benchmarkFocus: ['transaction safety', 'payment flow review', 'PII-safe changes'],
+  },
+  {
+    key: 'ai-ml',
+    label: 'AI / ML',
+    useWhen: 'Repos with ML pipelines, model training, RAG, or LLM integration workflows.',
+    adoption: 'Recommended when Copilot needs model-aware verification and experiment tracking.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline', 'ML verification guide'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json'],
+    benchmarkFocus: ['model safety', 'experiment reproducibility', 'data pipeline review'],
+  },
+  {
+    key: 'devops-cicd',
+    label: 'DevOps / CI-CD',
+    useWhen: 'Repos focused on CI/CD pipelines, deployment automation, and infrastructure-as-code.',
+    adoption: 'Recommended when Copilot manages CI workflows, deployment scripts, or release processes.',
+    recommendedModules: ['.vscode/settings.json baseline', 'CI / review workflow starter'],
+    recommendedProposalFamilies: ['copilot-vscode-settings', 'copilot-ci-review', 'copilot-prompts'],
+    recommendedSurfaces: ['.vscode/settings.json', '.github/workflows/', '.github/prompts/'],
+    benchmarkFocus: ['deployment safety', 'CI pipeline review', 'release gate coverage'],
+  },
+  {
+    key: 'design-system',
+    label: 'Design System',
+    useWhen: 'Component libraries, Storybook repos, or design token systems.',
+    adoption: 'Recommended when Copilot edits shared UI components with downstream consumers.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline', 'Component review workflow'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json'],
+    benchmarkFocus: ['component safety', 'visual regression awareness', 'cross-consumer impact'],
+  },
+  {
+    key: 'docs-content',
+    label: 'Docs / Content',
+    useWhen: 'Documentation repos, blogs, or content-heavy sites with editorial workflows.',
+    adoption: 'Recommended when Copilot edits prose, docs, or content with editorial review needs.',
+    recommendedModules: ['copilot-instructions.md baseline', '.vscode/settings.json baseline'],
+    recommendedProposalFamilies: ['copilot-instructions', 'copilot-vscode-settings'],
+    recommendedSurfaces: ['.github/copilot-instructions.md', '.vscode/settings.json'],
+    benchmarkFocus: ['content quality', 'editorial review', 'link and reference integrity'],
+  },
+  {
+    key: 'security-focused',
+    label: 'Security Focused',
+    useWhen: 'Repos with strong security posture needs — secret management, auth, encryption.',
+    adoption: 'Recommended for security-critical repos where every Copilot change needs security review.',
+    recommendedModules: ['.vscode/settings.json baseline', 'Security review workflow', 'Content exclusions guide'],
+    recommendedProposalFamilies: ['copilot-vscode-settings', 'copilot-content-exclusions', 'copilot-ci-review'],
+    recommendedSurfaces: ['.vscode/settings.json', '.github/copilot-instructions.md', '.github/workflows/'],
+    benchmarkFocus: ['secret protection', 'auth flow safety', 'security review coverage'],
+  },
+];
+
+function uniqueByKey(items) {
+  const seen = new Set();
+  const result = [];
+  for (const item of items) {
+    if (seen.has(item.key)) continue;
+    seen.add(item.key);
+    result.push(item);
+  }
+  return result;
+}
+
+function detectCopilotDomainPacks(ctx, stacks = [], assets = {}) {
+  const stackKeys = new Set((stacks || []).map((stack) => stack.key));
+  const pkg = ctx.jsonFile ? (ctx.jsonFile('package.json') || {}) : {};
+  const deps = ctx.projectDependencies ? ctx.projectDependencies() : {
+    ...(pkg.dependencies || {}),
+    ...(pkg.devDependencies || {}),
+  };
+  const matches = [];
+
+  function addMatch(key, reasons) {
+    const pack = COPILOT_DOMAIN_PACKS.find((item) => item.key === key);
+    if (!pack) return;
+    matches.push({
+      ...pack,
+      matchReasons: reasons.filter(Boolean).slice(0, 3),
+    });
+  }
+
+  const hasFrontend = stackKeys.has('react') || stackKeys.has('nextjs') || stackKeys.has('vue') ||
+    stackKeys.has('angular') || stackKeys.has('svelte') ||
+    ctx.hasDir('components') || ctx.hasDir('pages') ||
+    (ctx.hasDir('app') && (deps.next || deps.react || deps.vue || deps['@angular/core'] || deps.svelte));
+
+  const hasBackend = stackKeys.has('python') || stackKeys.has('django') || stackKeys.has('fastapi') ||
+    stackKeys.has('go') || stackKeys.has('rust') || stackKeys.has('java') ||
+    ctx.hasDir('api') || ctx.hasDir('routes') || ctx.hasDir('services') || ctx.hasDir('controllers') ||
+    ctx.hasDir('workers') || ctx.hasDir('jobs');
+
+  const hasInfra = stackKeys.has('docker') || stackKeys.has('terraform') || stackKeys.has('kubernetes') ||
+    ctx.files.includes('wrangler.toml') || ctx.files.includes('serverless.yml') || ctx.files.includes('serverless.yaml') ||
+    ctx.files.includes('cdk.json') || ctx.hasDir('infra') || ctx.hasDir('deploy') || ctx.hasDir('helm');
+
+  const isMonorepo = ctx.files.includes('nx.json') || ctx.files.includes('turbo.json') ||
+    ctx.files.includes('lerna.json') || ctx.files.includes('pnpm-workspace.yaml') ||
+    ctx.hasDir('packages') ||
+    (pkg.workspaces && (Array.isArray(pkg.workspaces) ? pkg.workspaces.length > 0 : true));
+
+  const hasCi = ctx.hasDir('.github/workflows');
+  const hasPolicyFiles = Boolean(ctx.fileContent('SECURITY.md') || ctx.fileContent('CODEOWNERS')) ||
+    ctx.hasDir('compliance') || ctx.hasDir('policies') || ctx.hasDir('audit');
+  const hasCopilotInstructions = Boolean(ctx.fileContent('.github/copilot-instructions.md'));
+  const hasCopilotSettings = Boolean(ctx.fileContent('.vscode/settings.json'));
+  const isEnterpriseGoverned = (hasCi && hasPolicyFiles) || (hasCopilotInstructions && hasCopilotSettings && hasPolicyFiles);
+
+  if (hasBackend) {
+    addMatch('backend-api', [
+      'Detected backend stack or service-oriented directories for Copilot to navigate.',
+      ctx.hasDir('api') ? 'API-facing structure detected.' : null,
+      ctx.hasDir('services') ? 'Service-layer directories detected.' : null,
+    ]);
+  }
+
+  if (hasFrontend) {
+    addMatch('frontend-ui', [
+      'Detected UI-heavy frontend stack or component directories.',
+      stackKeys.has('nextjs') ? 'Next.js stack detected.' : null,
+      ctx.hasDir('components') ? 'Component directories detected.' : null,
+    ]);
+  }
+
+  if (isEnterpriseGoverned) {
+    addMatch('enterprise-governed', [
+      'Detected team-governed rollout signals such as CI, policies, or explicit trust posture.',
+      hasCi ? 'GitHub workflow automation detected.' : null,
+      hasPolicyFiles ? 'Security/compliance policy files detected.' : null,
+    ]);
+  }
+
+  if (isMonorepo) {
+    addMatch('monorepo', [
+      'Detected workspace or multi-package repository structure.',
+      ctx.files.includes('pnpm-workspace.yaml') ? 'pnpm workspace detected.' : null,
+      ctx.hasDir('packages') ? 'Packages directory detected.' : null,
+    ]);
+  }
+
+  if (hasInfra) {
+    addMatch('infra-platform', [
+      'Detected infrastructure or deployment-oriented repo signals.',
+      ctx.files.includes('wrangler.toml') ? 'Wrangler config detected.' : null,
+      ctx.hasDir('infra') ? 'Infrastructure directory detected.' : null,
+    ]);
+  }
+
+  const hasDataPipeline = ctx.hasDir('dags') || ctx.hasDir('etl') || ctx.hasDir('pipelines') ||
+    ctx.hasDir('marts') || ctx.hasDir('migrations') ||
+    deps.airflow || deps.prefect || deps.dagster || deps.dbt;
+  if (hasDataPipeline) {
+    addMatch('data-pipeline', ['Detected data pipeline or ETL-oriented repo signals.', ctx.hasDir('dags') ? 'DAG directory detected.' : null]);
+  }
+
+  const isOss = ctx.files.includes('LICENSE') && ctx.files.includes('CONTRIBUTING.md');
+  if (isOss && !isEnterpriseGoverned) {
+    addMatch('oss-library', ['Detected open-source library signals (LICENSE + CONTRIBUTING.md).']);
+  }
+
+  const isMobile = stackKeys.has('react-native') || stackKeys.has('flutter') ||
+    stackKeys.has('swift') || stackKeys.has('kotlin') ||
+    deps['react-native'] || deps.flutter || ctx.files.includes('Podfile') ||
+    ctx.files.includes('build.gradle') || ctx.hasDir('ios') || ctx.hasDir('android');
+  if (isMobile) {
+    addMatch('mobile', ['Detected mobile development signals.', ctx.hasDir('ios') ? 'iOS directory detected.' : null, ctx.hasDir('android') ? 'Android directory detected.' : null]);
+  }
+
+  const isRegulated = hasPolicyFiles && !isEnterpriseGoverned;
+  if (isRegulated) {
+    addMatch('regulated-lite', ['Detected compliance-adjacent signals without full enterprise governance.']);
+  }
+
+  const isEcommerce = deps.stripe || deps['@stripe/stripe-js'] ||
+    deps.shopify || deps['@shopify/shopify-api'] ||
+    ctx.hasDir('checkout') || ctx.hasDir('cart') || ctx.hasDir('payments');
+  if (isEcommerce) {
+    addMatch('ecommerce', ['Detected e-commerce or payment-related signals.', deps.stripe ? 'Stripe dependency detected.' : null]);
+  }
+
+  const isAiMl = deps.tensorflow || deps.torch || deps.pytorch || deps.transformers ||
+    deps.langchain || deps['@langchain/core'] || deps.openai || deps.anthropic ||
+    ctx.hasDir('models') || ctx.hasDir('training') || ctx.hasDir('rag') ||
+    ctx.files.includes('model.py') || ctx.files.includes('train.py');
+  if (isAiMl) {
+    addMatch('ai-ml', ['Detected AI/ML or model training signals.', ctx.hasDir('models') ? 'Models directory detected.' : null]);
+  }
+
+  const isDevops = hasCi && hasInfra && !isEnterpriseGoverned;
+  if (isDevops) {
+    addMatch('devops-cicd', ['Detected DevOps/CI-CD focus with both CI workflows and infrastructure.']);
+  }
+
+  const isDesignSystem = ctx.hasDir('stories') || ctx.hasDir('storybook') ||
+    deps['@storybook/react'] || deps['@storybook/vue3'] ||
+    ctx.files.includes('.storybook');
+  if (isDesignSystem) {
+    addMatch('design-system', ['Detected design system or component library signals.', ctx.hasDir('stories') ? 'Storybook stories detected.' : null]);
+  }
+
+  const isDocsContent = ctx.hasDir('docs') && !hasBackend && !hasFrontend &&
+    (ctx.files.includes('mkdocs.yml') || ctx.files.includes('docusaurus.config.js') ||
+     ctx.files.includes('_config.yml') || ctx.files.includes('hugo.toml'));
+  if (isDocsContent) {
+    addMatch('docs-content', ['Detected documentation or content-focused repo.']);
+  }
+
+  const isSecurityFocused = ctx.hasDir('security') ||
+    deps['helmet'] || deps['csurf'] || deps['bcrypt'] ||
+    (hasPolicyFiles && ctx.fileContent('SECURITY.md'));
+  if (isSecurityFocused) {
+    addMatch('security-focused', ['Detected security-focused repo signals.', ctx.fileContent('SECURITY.md') ? 'SECURITY.md present.' : null]);
+  }
+
+  if (matches.length === 0) {
+    addMatch('baseline-general', [
+      'No stronger platform-specific domain dominated, so a safe general Copilot baseline is the best starting point.',
+      hasCopilotInstructions
+        ? 'The repo already has Copilot surfaces, but they are not yet specialized by domain.'
+        : 'The repo needs a first Copilot baseline before specialization.',
+    ]);
+  }
+
+  return uniqueByKey(matches);
+}
+
+module.exports = {
+  COPILOT_DOMAIN_PACKS,
+  detectCopilotDomainPacks,
+};

package/src/copilot/freshness.js

@@ -0,0 +1,197 @@
+/**
+ * Copilot Freshness Operationalization
+ *
+ * Release gates, recurring probes, propagation checklists,
+ * and staleness blocking for Copilot surfaces.
+ *
+ * P0 sources from Copilot docs, propagation checklist.
+ */
+
+const { version } = require('../../package.json');
+
+/**
+ * P0 sources that must be fresh before any Copilot release claim.
+ */
+const P0_SOURCES = [
+  {
+    key: 'copilot-instructions-docs',
+    label: 'Copilot Instructions Documentation',
+    url: 'https://docs.github.com/en/copilot/customizing-copilot/adding-custom-instructions-for-github-copilot',
+    stalenessThresholdDays: 30,
+    verifiedAt: null,
+  },
+  {
+    key: 'copilot-agent-mode-docs',
+    label: 'Copilot Agent Mode Documentation',
+    url: 'https://docs.github.com/en/copilot/using-github-copilot/using-agent-mode-in-github-copilot',
+    stalenessThresholdDays: 30,
+    verifiedAt: null,
+  },
+  {
+    key: 'copilot-cloud-agent-docs',
+    label: 'Copilot Cloud Agent Documentation',
+    url: 'https://docs.github.com/en/copilot/using-github-copilot/using-copilot-coding-agent',
+    stalenessThresholdDays: 14,
+    verifiedAt: null,
+  },
+  {
+    key: 'copilot-prompt-files-docs',
+    label: 'Copilot Prompt Files Documentation',
+    url: 'https://docs.github.com/en/copilot/customizing-copilot/adding-custom-instructions-for-github-copilot#creating-prompt-files',
+    stalenessThresholdDays: 30,
+    verifiedAt: null,
+  },
+  {
+    key: 'copilot-mcp-docs',
+    label: 'Copilot MCP Documentation',
+    url: 'https://docs.github.com/en/copilot/customizing-copilot/using-model-context-protocol-in-github-copilot',
+    stalenessThresholdDays: 30,
+    verifiedAt: null,
+  },
+  {
+    key: 'copilot-content-exclusions-docs',
+    label: 'Copilot Content Exclusions Documentation',
+    url: 'https://docs.github.com/en/copilot/managing-copilot/managing-copilot-for-your-organization/managing-github-copilot-features-in-your-organization/configuring-content-exclusions-for-github-copilot',
+    stalenessThresholdDays: 30,
+    verifiedAt: null,
+  },
+  {
+    key: 'copilot-vscode-settings-docs',
+    label: 'VS Code Copilot Settings Reference',
+    url: 'https://code.visualstudio.com/docs/copilot/copilot-settings',
+    stalenessThresholdDays: 30,
+    verifiedAt: null,
+  },
+  {
+    key: 'copilot-changelog',
+    label: 'GitHub Copilot Changelog',
+    url: 'https://github.blog/changelog/label/copilot/',
+    stalenessThresholdDays: 14,
+    verifiedAt: null,
+  },
+  {
+    key: 'copilot-trust-security-docs',
+    label: 'Copilot Trust & Security Documentation',
+    url: 'https://docs.github.com/en/copilot/responsible-use-of-github-copilot-features/using-github-copilot-chat-in-your-ide#security-considerations',
+    stalenessThresholdDays: 30,
+    verifiedAt: null,
+  },
+];
+
+/**
+ * Propagation checklist: when a Copilot source changes, these must update.
+ */
+const PROPAGATION_CHECKLIST = [
+  {
+    trigger: 'New Copilot VS Code settings key added or deprecated',
+    targets: [
+      'src/copilot/techniques.js — update config checks and deprecated patterns',
+      'src/copilot/config-parser.js — update KNOWN_COPILOT_SETTINGS_KEYS and DEPRECATED_COPILOT_KEYS',
+      'src/copilot/setup.js — update settings template',
+      'src/copilot/governance.js — update hook registry if new auto-approval pattern',
+    ],
+  },
+  {
+    trigger: 'Cloud agent behavior change (setup-steps format, signed commits, etc.)',
+    targets: [
+      'src/copilot/techniques.js — update cloud agent checks (CP-E01..CP-E05)',
+      'src/copilot/setup.js — update copilot-setup-steps.yml template',
+      'src/copilot/governance.js — update cloud-agent permission profile',
+    ],
+  },
+  {
+    trigger: 'New instruction file format or frontmatter field',
+    targets: [
+      'src/copilot/config-parser.js — update frontmatter validation',
+      'src/copilot/techniques.js — update instruction checks (CP-A06, CP-B05)',
+      'src/copilot/context.js — update scopedInstructions() or promptFiles() parsing',
+    ],
+  },
+  {
+    trigger: 'MCP configuration format change in .vscode/mcp.json',
+    targets: [
+      'src/copilot/mcp-packs.js — update pack JSON projections and merge logic',
+      'src/copilot/techniques.js — update MCP checks (CP-D01..CP-D05)',
+      'src/copilot/context.js — update mcpConfig() parsing',
+    ],
+  },
+  {
+    trigger: 'Content exclusion enforcement change (especially cloud agent)',
+    targets: [
+      'src/copilot/techniques.js — update CP-C01, CP-C02 checks',
+      'src/copilot/governance.js — update caveats and policy packs',
+      'src/copilot/setup.js — update content exclusions guide',
+    ],
+  },
+  {
+    trigger: 'Organization policy change or new policy type',
+    targets: [
+      'src/copilot/techniques.js — update organization checks (CP-F01..CP-F05)',
+      'src/copilot/governance.js — update enterprise-managed profile',
+    ],
+  },
+];
+
+/**
+ * Release gate: check if all P0 sources are within staleness threshold.
+ */
+function checkReleaseGate(sourceVerifications = {}) {
+  const now = new Date();
+  const results = P0_SOURCES.map(source => {
+    const verifiedAt = sourceVerifications[source.key]
+      ? new Date(sourceVerifications[source.key])
+      : source.verifiedAt ? new Date(source.verifiedAt) : null;
+
+    if (!verifiedAt) {
+      return { ...source, status: 'unverified', daysStale: null };
+    }
+
+    const daysSince = Math.floor((now - verifiedAt) / (1000 * 60 * 60 * 24));
+    const isStale = daysSince > source.stalenessThresholdDays;
+
+    return { ...source, verifiedAt: verifiedAt.toISOString(), daysStale: daysSince, status: isStale ? 'stale' : 'fresh' };
+  });
+
+  return {
+    ready: results.every(r => r.status === 'fresh'),
+    stale: results.filter(r => r.status === 'stale' || r.status === 'unverified'),
+    fresh: results.filter(r => r.status === 'fresh'),
+    results,
+  };
+}
+
+function formatReleaseGate(gateResult) {
+  const lines = [
+    `Copilot Freshness Gate (nerviq v${version})`,
+    '═══════════════════════════════════════',
+    '',
+    `Status: ${gateResult.ready ? 'READY' : 'BLOCKED'}`,
+    `Fresh: ${gateResult.fresh.length}/${gateResult.results.length}`,
+    '',
+  ];
+
+  for (const result of gateResult.results) {
+    const icon = result.status === 'fresh' ? '✓' : result.status === 'stale' ? '✗' : '?';
+    const age = result.daysStale !== null ? ` (${result.daysStale}d ago)` : ' (unverified)';
+    lines.push(`  ${icon} ${result.label}${age} — threshold: ${result.stalenessThresholdDays}d`);
+  }
+
+  if (!gateResult.ready) {
+    lines.push('', 'Action required: verify stale/unverified sources before claiming release freshness.');
+  }
+
+  return lines.join('\n');
+}
+
+function getPropagationTargets(triggerKeyword) {
+  const keyword = triggerKeyword.toLowerCase();
+  return PROPAGATION_CHECKLIST.filter(item => item.trigger.toLowerCase().includes(keyword));
+}
+
+module.exports = {
+  P0_SOURCES,
+  PROPAGATION_CHECKLIST,
+  checkReleaseGate,
+  formatReleaseGate,
+  getPropagationTargets,
+};