@rungs/cli 0.1.0

package/modules/doc-authority/gates/authority.toml

@@ -0,0 +1,127 @@
+# Gate table for the `doc-authority` module.
+#
+# Every gate here is vocabulary-based, which is a real ceiling: it catches a surface that dropped
+# the current phrasing, not one that kept the phrasing and changed meaning. That limit is pinned in
+# each message rather than hidden, so green never reads as "verified".
+
+# ── docauth-ownership-respected ───────────────────────────────────────────────
+
+[term_ownership]
+registry     = "{{registry_path}}"
+columns      = { topic = "Topic", owner = "Owner", forbidden = "Must NOT appear in" }
+# A topic is "engaged" by a document that carries several of its terms in one section — not by a
+# passing mention. Under-detection is the correct bias: a false refusal on a cross-reference is a
+# gate people delete.
+engage_min_terms = 3
+engage_window    = "section"
+exempt_marker    = "ownership-ok:"       # ignored unless it states a reason
+message = """
+{file} restates the topic "{topic}", which is owned by {owner}. Reference it with a link instead —
+a paraphrase looks maintained while it decays, and when {owner} changes this becomes wrong while
+still reading as deliberate.
+"""
+
+[term_ownership.pins]
+note = "Detects restatement by vocabulary. It cannot detect a restatement that uses different words, nor one that is subtly wrong while using the right words."
+
+# ── docauth-scope-headers ─────────────────────────────────────────────────────
+
+[[sections]]
+id       = "scope-headers"
+scan     = ["docs/**/*.md"]
+# A template is not a document. A scope header inside `TEMPLATE.md` would be
+# copied into every item made from it, which is both wrong and self-defeating —
+# the copies would each claim authority over the same topic. The root README is
+# exempt for axiom-mesh's original reason: it is a navigation page, and a scope
+# header there makes a worse landing page for no gain.
+exclude  = ["README.md", "docs/**/archive/**", "**/TEMPLATE.md", "**/*-TEMPLATE.md"]
+requires_opening = ["**Authoritative for:**", "**Not authoritative for:**"]
+enabled_by = "{{scope_headers}}"
+message  = "{file} does not open with both scope blocks. A reader who opened the wrong document should learn it in one line."
+
+# The stub rule: a file carrying only scope headers may hold nothing but cross-references.
+[sections.stub_rule]
+when        = "only_scope_headers"
+allows_only = ["links", "headings"]
+message     = "{file} is a stub and has grown content. Promote it deliberately or move the content to its owner — this is how a placeholder quietly acquires a topic it does not own."
+
+# ── docauth-working-rules ─────────────────────────────────────────────────────
+
+[rule_propagation]
+registry = "{{rules_path}}"
+columns  = { rule = "Rule", authority = "Authority", surfaces = "Surfaces that restate it", retired = "Retired wording" }
+# Read the negation before the token: a `retired` phrase inside "do NOT <retired>" is the fix, not
+# the violation. A guard that also refuses its own fix is one people disable.
+negation_window = 60
+exempt_marker   = "working-rule-ok:"     # ignored unless it states a reason
+message = """
+{surface} engages "{rule}" but carries the retired wording, or is missing the current vocabulary.
+Fix the authority first, then the citers — a citer corrected against a stale authority is a second
+wrong statement, and the next reader cannot tell which one won.
+"""
+
+# ── docauth-no-redirect-stubs ─────────────────────────────────────────────────
+
+[file_population]
+id       = "redirect-stubs"
+scan     = ["docs/**/*.md"]
+detect   = "body_is_only_a_pointer"
+max_body_words = 40
+fail_at  = 1
+message  = """
+{file} exists only to point elsewhere. It will be cited, and the citation will look authoritative.
+Delete it and repoint the citers — one repo needed four separate warnings in its instruction file
+because it kept one of these.
+"""
+
+# ── self-tests ────────────────────────────────────────────────────────────────
+
+[[self_test]]
+gate   = "docauth-working-rules"
+expect = "fail"
+input  = "Claim the id on the integration branch before starting."
+
+[[self_test]]
+gate   = "docauth-working-rules"
+expect = "pass"
+input  = "Do not claim the id on the integration branch; claim it on your own."
+
+[[self_test]]
+gate   = "docauth-working-rules"
+expect = "pass"
+input  = "We used to claim on the integration branch. <!-- working-rule-ok: id-claiming — quotes the retired wording to explain the change -->"
+
+[[self_test]]
+gate   = "docauth-working-rules"
+expect = "fail"
+input  = "We used to claim on the integration branch. <!-- working-rule-ok: -->"
+
+[[self_test]]
+gate    = "docauth-scope-headers"
+expect  = "fail"
+fixture = { file = "docs/a.md", opening = "# A" }
+
+[[self_test]]
+gate    = "docauth-scope-headers"
+expect  = "pass"
+fixture = { file = "README.md", opening = "# Project" }
+
+[[self_test]]
+gate    = "docauth-ownership-respected"
+expect  = "pass"
+fixture = { terms_matched = 1 }
+
+[[self_test]]
+gate    = "docauth-ownership-respected"
+expect  = "fail"
+fixture = { terms_matched = 5, file = "docs/other.md", owner = "AGENTS.md" }
+
+[[self_test]]
+gate    = "docauth-no-redirect-stubs"
+expect  = "fail"
+fixture = { body_words = 12, links = 1 }
+
+[[self_test]]
+gate    = "docauth-no-redirect-stubs"
+expect  = "pass"
+fixture = { body_words = 300, links = 4 }

package/modules/doc-authority/module.toml

@@ -0,0 +1,111 @@
+[module]
+name    = "doc-authority"
+version = "1.0.0"
+rung    = 4
+summary = "One owner per topic, declared in a registry and checked — plus a propagation gate for rules that live in more surfaces than their authority."
+
+[requires]
+modules = ["gates"]
+
+[conflicts]
+modules = []
+
+# Rung 4: for repos where several documentation surfaces make claims about the
+# same things. Below that it is ceremony — a repo with six docs does not need an
+# ownership registry, it needs six good docs.
+#
+# This module is the corpus's most valuable combination and no source repo has
+# it: axiom-mesh wrote the best ownership model and checked none of it;
+# rift-forge built the propagation gate and has no registry.
+
+[params.registry_path]
+description = "The ownership registry — topic, owner, and where the topic must not appear"
+default     = "docs/doc-ownership.md"
+
+[params.rules_path]
+description = "Cross-cutting working rules and the surfaces that restate each one"
+default     = "docs/working-rules.md"
+
+[params.scope_headers]
+description = """
+Require every document to open with `Authoritative for:` / `Not authoritative for:`. The root
+README is always exempt — it is a navigation page, and demanding a scope header there produces a
+worse landing page for no gain.
+"""
+default     = true
+
+[[gates]]
+id     = "docauth-ownership-respected"
+kind   = "declared"
+engine = "term-ownership"
+table  = "gates/authority.toml"
+tier   = "fast"
+why    = """
+The registry's third column — where a topic must NOT appear — is what turns "one source of truth"
+from a principle into a lookup. Checked by term, which is approximate; approximate is enough,
+because the failure it catches is a whole section restated in the wrong file, not a passing mention.
+"""
+
+[[gates]]
+id     = "docauth-scope-headers"
+kind   = "declared"
+engine = "sections"
+table  = "gates/authority.toml"
+tier   = "fast"
+why    = "A mandatory rule with a zero-cost check has no excuse to be manual, and this one was manual in the repo that called it non-negotiable."
+
+[[gates]]
+id     = "docauth-working-rules"
+kind   = "declared"
+engine = "rule-propagation"
+table  = "gates/authority.toml"
+tier   = "fast"
+why    = """
+A working rule lives in more places than its authority: the authority document, the always-on
+document, the skills that execute it, the tool that automates it. Fixing the authority does not
+reach the rest, and a citation is not propagation — "see §3" ages into a false claim the moment §3
+changes, and reads as verified precisely because it names a source.
+"""
+
+[[gates]]
+id     = "docauth-no-redirect-stubs"
+kind   = "declared"
+engine = "file-population"
+table  = "gates/authority.toml"
+tier   = "fast"
+why    = "A file that exists only to say 'go elsewhere' is a bug: it will be cited, and the citation will look authoritative."
+
+[detect]
+paths   = ["**/doc-ownership.md", ".ai/context/doc_ownership.md", "docs/**/working-rules.md", ".github/scripts/check-working-rules.*"]
+markers = ["rungs:begin doc-authority"]
+
+[[detect.adopt_as]]
+kind = "registry-without-gates"
+paths = [".ai/context/doc_ownership.md", "**/doc-ownership.md"]
+note = """
+A registry with no checker is the axiom-mesh case exactly, and it is the highest-value adoption in
+the catalogue: the hard part — deciding who owns what — is already done, and what is missing is the
+enforcement. Adopt the registry as authored, install only the gates, and report how many rows the
+first run finds violated.
+"""
+
+[provenance]
+sources  = ["axiom-mesh", "rift-forge"]
+patterns = [
+  "doc-ownership-registry",
+  "scope-headers",
+  "stub-rule",
+  "no-paraphrase",
+  "no-redirect-stubs",
+  "working-rule-propagation",
+  "defect-register-split",
+  "inline-gap-callout",
+]
+incident = """
+axiom-mesh declared "no fact is ever stated in two docs" and "drift is a bug" as non-negotiable,
+enforced by review only — and its own 350-line instruction file had to warn four times that one of
+its routing targets was a dead redirect stub. hexguard-templates forbids restating scope and its
+entry document's repo map grew five duplicated entries. rift-forge measured the other half:
+five repo-level rules had changed and none had reached the files that teach them, with four skills
+citing as authority the very section that had reversed them.
+"""

package/modules/findings/files/docs/{{backlog.root}}/FINDINGS.md

@@ -0,0 +1,56 @@
+**Authoritative for:** what has been noticed and not yet decided, and the disposition of everything closed.
+**Not authoritative for:** what to do about any of it — a finding becomes a work item before it becomes work.
+
+# Findings
+
+Things noticed while doing something else. **A finding is the observation; a work item is the
+decision.** Recording one must cost almost nothing, or it will not happen — so a finding is a
+**row**, not a file. Items are files; findings are rows. The asymmetry is deliberate.
+
+<!-- NEXT-ID: {{id_prefix}}-001 -->
+
+## Open
+
+| Id | Sev | Pri | What | Evidence | When to act | How to fix |
+| --- | --- | --- | --- | --- | --- | --- |
+| — | | | *nothing open* | | | |
+
+## Closed
+
+| Id | What | Disposition | Reason |
+| --- | --- | --- | --- |
+| — | | | |
+
+---
+
+## Recording one
+
+Use `/record-finding`, or add a row directly. Required:
+
+- **Sev** — `high` (wrong output, data loss, security) · `medium` (wrong behaviour, contained) ·
+  `low` (cost, clarity, tidiness)
+- **Pri** — `now` · `next` · `someday`. Severity is about the problem; priority is about us.
+- **Evidence** — a path, a command, a count. **A finding with no evidence is a hunch**, and the
+  next reader cannot tell the difference. If you cannot produce evidence, say so in the row.
+- **When to act** — the trigger, not a date. *"Before the next release"*, *"if this recurs"*.
+- **How to fix** — enough that someone else could, or an explicit "unknown".
+
+## Closing one
+
+Every finding leaves the Open table by one of three dispositions, and **each carries a written
+reason**:
+
+| Disposition | Means | Reason must say |
+| --- | --- | --- |
+| **promoted** | It became a work item | Which item, and what scope it took |
+| **fixed** | It was resolved directly | What changed, and where |
+| **dismissed** | It is not a problem, or not one worth solving | *Why not* — this is the one people skip, and it is the one that stops the same observation being recorded again next month |
+
+`rungs check` refuses a closed finding with no reason.
+
+## What this register does not do
+
+- It does not prioritise. A `now` priority is a claim by whoever typed it.
+- It does not prove anything is fixed. `fixed` means someone said so.
+- It counts what was **recorded**, not what was noticed. A quiet register and an unobserved repo
+  look identical from here.

package/modules/findings/fragments/AGENTS.md

@@ -0,0 +1,7 @@
+<!-- rungs:begin findings@1.0.0 -->
+## Findings
+
+Noticed something out of scope? Record it in [`{{path}}`]({{path}}) via **`/record-finding`** —
+rows, not files, because recording one must cost almost nothing. A finding is the observation; a
+work item is the decision. Closing one always carries a written reason, dismissals included.
+<!-- rungs:end findings -->

package/modules/findings/gates/findings.toml

@@ -0,0 +1,68 @@
+# Gate table for the `findings` module.
+
+# ── findings-ids ──────────────────────────────────────────────────────────────
+
+[kinds.finding]
+format  = "{{id_prefix}}-\\d{1,4}"
+marker  = { file = "{{path}}", pattern = "NEXT-ID: ({{id_prefix}}-\\d{1,4})" }
+sources = ["{{path}}"]
+
+[citations]
+roots      = ["docs", "AGENTS.md", "CLAUDE.md", ".ai"]
+extensions = [".md", ".toml"]
+
+# ── findings-disposition-has-reason ───────────────────────────────────────────
+
+[register_schema]
+file          = "{{path}}"
+table         = "Closed"
+required_cols = ["Id", "What", "Disposition", "Reason"]
+enum          = { Disposition = ["promoted", "fixed", "dismissed"] }
+non_empty     = ["Reason"]
+min_words     = { Reason = 4 }
+message       = """
+Finding {id} is closed as `{disposition}` with no reason. A dismissal without a reason is the
+observation being recorded again next month by someone who cannot tell it was already considered.
+"""
+
+# The Open table's evidence column is checked for presence, not for quality — a gate cannot judge
+# whether evidence is good, and one that tried would be the confidently-wrong probe.
+[register_schema.open]
+table     = "Open"
+non_empty = ["Sev", "Pri", "What", "Evidence"]
+enum      = { Sev = ["high", "medium", "low"], Pri = ["now", "next", "someday"] }
+placeholder_ok = ["none — hunch", "unknown"]
+
+# ── self-tests ────────────────────────────────────────────────────────────────
+
+[[self_test]]
+gate    = "findings-disposition-has-reason"
+expect  = "fail"
+fixture = { table = "Closed", row = { Id = "{{id_prefix}}-001", What = "x", Disposition = "dismissed", Reason = "" } }
+
+[[self_test]]
+gate    = "findings-disposition-has-reason"
+expect  = "pass"
+fixture = { table = "Closed", row = { Id = "{{id_prefix}}-001", What = "x", Disposition = "dismissed", Reason = "the mapper already handles this case" } }
+
+[[self_test]]
+gate    = "findings-disposition-has-reason"
+expect  = "fail"
+fixture = { table = "Open", row = { Id = "{{id_prefix}}-002", Sev = "critical", Pri = "now", What = "x", Evidence = "y" } }
+
+[[self_test]]
+gate    = "findings-disposition-has-reason"
+expect  = "pass"
+fixture = { table = "Open", row = { Id = "{{id_prefix}}-002", Sev = "high", Pri = "now", What = "x", Evidence = "none — hunch" } }
+
+# ── findings-ids self-tests ───────────────────────────────────────────────────
+
+[[self_test]]
+gate    = "findings-ids"
+expect  = "fail"
+fixture = { register_rows = ["{{id_prefix}}-001", "{{id_prefix}}-001"] }
+
+[[self_test]]
+gate    = "findings-ids"
+expect  = "pass"
+fixture = { register_rows = ["{{id_prefix}}-001", "{{id_prefix}}-002"] }

package/modules/findings/module.toml

@@ -0,0 +1,100 @@
+[module]
+name    = "findings"
+version = "1.0.0"
+rung    = 1
+summary = "A register for what is noticed before it is decided, with a triage path into work items."
+
+[requires]
+modules = ["backlog"]
+
+[conflicts]
+modules = []
+
+# ── parameters ────────────────────────────────────────────────────────────────
+
+[params.id_prefix]
+description = "Prefix for finding ids, e.g. F-012"
+default     = "F"
+pattern     = "^[A-Z]{1,6}$"
+
+[params.path]
+description = """
+Where the register lives. Defaults next to the backlog it feeds — a module may reference a
+declared dependency's parameters as {{<module>.<param>}}.
+"""
+default     = "docs/{{backlog.root}}/FINDINGS.md"
+
+# ── gates ─────────────────────────────────────────────────────────────────────
+
+[[gates]]
+id     = "findings-ids"
+kind   = "declared"
+engine = "id-integrity"
+table  = "gates/findings.toml"
+tier   = "fast"
+why    = "Two findings sharing an id are one finding as far as every citation is concerned."
+
+[[gates]]
+id     = "findings-disposition-has-reason"
+kind   = "declared"
+engine = "register-schema"
+table  = "gates/findings.toml"
+tier   = "fast"
+why    = """
+A finding closed without a written reason is indistinguishable from one nobody looked at, and it
+is the same observation the next session will record again. The reason is what the register is for.
+"""
+
+# ── skills ────────────────────────────────────────────────────────────────────
+
+[skills.record-finding]
+# No extensions. Recording an out-of-scope observation mid-task is exactly what a
+# model should reach for on its own — the whole value is that it costs nothing.
+
+# ── detection (ADR-0004) ──────────────────────────────────────────────────────
+
+[detect]
+paths = [
+  "docs/**/FINDINGS.md",
+  "docs/**/findings/**/*.md",
+  "docs/governance/implementation_defects.md",
+  "docs/governance/design_flaws.md",
+]
+markers = ["rungs:begin findings"]
+
+# Two registers split by kind, rather than one with a `kind` column. Not a
+# different paradigm — the same function, more ceremony — so it adopts, and
+# `add` says which register it mapped to what.
+[[detect.adopt_as]]
+kind = "split-registers"
+note = """
+axiom-mesh separates AD-### (code diverges from the standard) from DF-### (the standard itself is
+missing or contradictory). Different resolvers, and the split is defensible at scale. Adopt both;
+do not merge them, and do not add a third.
+"""
+
+[[detect.infer]]
+param       = "id_prefix"
+# The register's own marker settles this. Counting raw ids proposed the
+# *backlog's* prefix on a real repo, because a findings register cites work
+# items far more often than it defines its own ids — 787 to 722 in one case.
+# Matches both `NEXT-ID: F-303` and the per-kind form `NEXT-F: F-303` that a
+# real repo turned out to use — assuming one marker spelling is how an anchor
+# silently falls back to the frequency count it was written to override.
+anchor      = "NEXT-(?:ID|[A-Z]{1,6}):\\s*([A-Z]{1,6})-\\d"
+anchor_name = "the register's NEXT-* marker"
+pattern     = "^\\|\\s*\\[?([A-Z]{1,6})-\\d{1,4}"
+min         = 10
+scope       = ["docs/**/FINDINGS.md", "docs/governance/*.md"]
+
+# ── provenance (required, validated) ──────────────────────────────────────────
+
+[provenance]
+sources  = ["rift-forge", "axiom-mesh"]
+patterns = ["findings-log", "record-without-derailing", "finding-promotion", "audit-to-register", "inline-gap-callout"]
+incident = """
+hexguard ran a good audit prompt 268 times and produced 268 documents, because no register existed
+to hold rows and no work-item object existed to close them into. There is still no way to say which
+of those findings are open. rift-forge, which has the register, reached 91 findings precisely
+because recording one costs almost nothing — that cost is the design, not a side effect.
+"""

package/modules/findings/skills/record-finding/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: record-finding
+description: >-
+  Record something noticed while doing other work into the findings register — classified by
+  severity and priority, with evidence, when to act, and how to fix — so it is not lost and does
+  not derail the current task. Use when asked to "record / log / note a finding", "capture this for
+  later", "don't lose this", "add that to the findings", or whenever work surfaces a real problem
+  that is out of scope right now. Also use to triage the register: promote a finding to a work
+  item, mark it fixed, or dismiss it with a reason. Executing tracked work is /work-item; changing
+  an instruction so a mistake cannot recur is /harden-rule.
+---
+
+# Record a finding
+
+**A finding is the observation; a work item is the decision.** This must cost almost nothing, or
+you will keep working instead of recording — which is how the observation is lost.
+
+## Recording
+
+Add a row to the **Open** table in the register. Then **return to what you were doing.** Do not fix
+it, do not scope it, do not open an item. Those are separate decisions made later, deliberately.
+
+Fill every column:
+
+- **Sev** — `high` (wrong output, data loss, security) · `medium` (wrong behaviour, contained) ·
+  `low` (cost, clarity, tidiness). Severity is about the problem.
+- **Pri** — `now` · `next` · `someday`. Priority is about us. They are independent: a high-severity
+  problem in code nobody runs can be `someday`.
+- **What** — one sentence, specific enough to act on without this conversation.
+- **Evidence** — a path, a command, a count. **If you have none, write `none — hunch`.** A finding
+  that looks evidenced and is not is worse than one that admits it, because the next reader spends
+  an hour looking for the evidence.
+- **When to act** — a trigger, not a date. *"Before the next release"*, *"if this recurs"*.
+- **How to fix** — enough that someone else could, or `unknown`.
+
+## What is not a finding
+
+- **Something you are about to fix** — just fix it.
+- **A rule that was broken** — that is `/harden-rule`. Recording it and leaving the instruction
+  unchanged is how the same lesson gets re-learned by the next session.
+- **Scope you decided against** — that belongs in the item's `Out of scope`.
+- **A vague unease.** If you cannot say what is wrong specifically enough for someone else to
+  check it, you have a feeling. Say so in the row or leave it out.
+
+## Triaging
+
+Every finding leaves **Open** by exactly one disposition, each with a written reason:
+
+| Disposition | Do |
+| --- | --- |
+| **promoted** | Open a work item, link both ways, move the row to Closed naming the item and the scope it took |
+| **fixed** | Resolve it, move the row naming what changed and where |
+| **dismissed** | Move the row saying **why not** |
+
+**Dismissal is the one that matters.** It is the disposition people skip, and its reason is what
+stops the same observation being recorded again next month by someone who cannot tell it was
+already considered. `rungs check` refuses a closed finding with no reason.
+
+## Before triaging, re-check
+
+A finding has a shelf life. Re-derive it against the repo as it is now — a register row is a claim
+about the past, and work has landed since. Findings that dissolve on contact get dismissed with
+"already resolved by …", which is a perfectly good reason and a useful record.

package/modules/gates/files/.ai/gates.toml

@@ -0,0 +1,49 @@
+# Gate registry.
+#
+# Every gate this repo runs is declared here, and `rungs check` runs them. Modules add their own
+# entries on install — those live inside marked blocks and are regenerated; anything outside a
+# block is yours and is never touched.
+
+[runner]
+tiers          = {{tiers}}
+ledger         = {{ledger}}          # .ai/.gate-ledger.jsonl — gitignored, local, no network
+fast_budget_ms = {{fast_budget_ms}}
+
+# ── your gates ────────────────────────────────────────────────────────────────
+#
+# A `command` gate is any shell string. The runner records its exit status and wall-clock the same
+# way it records a declared gate's, whatever language it is written in — which is how an existing
+# validator gets the ledger without being rewritten.
+#
+# [[gates]]
+# id      = "build"
+# kind    = "command"
+# tier    = "full"
+# command = "dotnet build MySolution.slnx -c Release"
+# why     = "One sentence. `doctor` quotes this back when the gate has never fired."
+#
+# [[gates]]
+# id      = "doc-links"
+# kind    = "command"
+# tier    = "fast"
+# command = "pwsh ./scripts/validate-doc-links.ps1"
+# why     = "Adopted 2026-01-01; predates rungs and is owned by this repo."
+
+# ── module gates ──────────────────────────────────────────────────────────────
+# Generated. Edit the owning module's parameters, not these entries.
+
+# rungs:begin gates
+# rungs:end gates
+
+# ── notes on writing a gate ───────────────────────────────────────────────────
+#
+# 1. A gate exits 0 or 1 and prints why. It does not write to the ledger — the runner does.
+#    A gate that records its own runs can lie about them.
+# 2. Every declared gate needs self-tests asserting BOTH directions. A gate whose rules are
+#    currently satisfied looks exactly like a gate that matches nothing.
+# 3. An exemption marker is ignored unless it states a reason. An escape hatch nobody has to
+#    justify is not an escape hatch, it is an off switch.
+# 4. Match against a preceding-context negation window before refusing a phrase, or the gate will
+#    refuse the sentence that documents the fix. A guard that refuses its own fix gets disabled.
+# 5. Prefer a gate that recomputes a number over one that compares a typed number. A probe
+#    encoding a guess is a gate that is confidently wrong, which is worse than the typed value.

package/modules/gates/fragments/AGENTS.md

@@ -0,0 +1,8 @@
+<!-- rungs:begin gates@1.0.0 -->
+## Gates
+
+`rungs check` runs everything in [`.ai/gates.toml`](.ai/gates.toml) — fast tier constantly, full
+tier at a boundary. **Never weaken a gate to make a change pass**; if a gate is wrong that is its
+own work. Every rule you add declares `gated` or `review-only` — there is no third option. Broke a
+rule that already existed? Do not restate it, make it mechanical: **`/harden-rule`**.
+<!-- rungs:end gates -->

package/modules/gates/fragments/gitignore

@@ -0,0 +1,4 @@
+# rungs:begin gates@1.0.0
+# Gate run ledger — local, machine-specific, never transmitted (ADR-0005).
+.ai/.gate-ledger.jsonl
+# rungs:end gates