@ryuenn3123/agentic-senior-core 5.6.0 → 5.8.0

package/README.md

@@ -7,6 +7,8 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md)
 
+**Minimalism plugins cut the code. This plugin makes sure what remains is production-safe.**
+
 **Install once. Works across all projects. Supports 23+ AI coding agents.**
 
 </div>
@@ -99,7 +101,7 @@ This copies one file to `.devin/rules/agentic-senior-core.md`. For legacy Windsu
 asc adapter --windsurf
 ```
 
-Repeat per project.
+Repeat per project — or install once globally with `asc global --windsurf` (writes `~/.codeium/windsurf/memories/global_rules.md`, applies to all workspaces; skipped if you already have your own global rules file).
 
 </details>
 
@@ -110,7 +112,7 @@ Repeat per project.
 asc adapter --cline
 ```
 
-Copies one file to `.clinerules/agentic-senior-core.md`. Repeat per project.
+Copies one file to `.clinerules/agentic-senior-core.md`. Repeat per project — or install once globally with `asc global --cline` (rules land in `~/Documents/Cline/Rules/`, apply to all projects).
 
 </details>
 
@@ -121,7 +123,7 @@ Copies one file to `.clinerules/agentic-senior-core.md`. Repeat per project.
 asc adapter --copilot
 ```
 
-Copies one file to `.github/copilot-instructions.md`. Repeat per project.
+Copies one file to `.github/copilot-instructions.md`. Repeat per project — or install once globally with `asc global --copilot` (user-level instructions file in your VS Code profile, applies to all workspaces).
 
 </details>
 
@@ -132,7 +134,7 @@ Copies one file to `.github/copilot-instructions.md`. Repeat per project.
 asc adapter --kiro
 ```
 
-Copies one file to `.kiro/steering/agentic-senior-core.md`. Repeat per project.
+Copies one file to `.kiro/steering/agentic-senior-core.md`. Repeat per project. A global option exists (`asc global --kiro` → `~/.kiro/steering/`), but some Kiro builds have known bugs loading global steering — prefer the per-project adapter if rules are not picked up.
 
 </details>
 
@@ -165,7 +167,7 @@ Copies one file to `.zed/rules/agentic-senior-core.md`. Zed also reads `AGENTS.m
 asc adapter --aider
 ```
 
-Copies one file to `CONVENTIONS.md` at project root. Aider reads this automatically. Repeat per project.
+Copies one file to `CONVENTIONS.md` at project root. Aider reads this automatically. Repeat per project — or set it once globally in `~/.aider.conf.yml` with an absolute path into the npm package (`read: <npm root -g>/@ryuenn3123/agentic-senior-core/CONVENTIONS.md`). That pointer auto-updates with `npm update -g`.
 
 </details>
 
@@ -176,7 +178,7 @@ Copies one file to `CONVENTIONS.md` at project root. Aider reads this automatica
 asc adapter --kilocode
 ```
 
-Copies one file to `.kilocode/rules/agentic-senior-core.md`. Repeat per project.
+Copies one file to `.kilocode/rules/agentic-senior-core.md`. Repeat per project — or install once globally with `asc global --kilocode`. On Kilo v7+, the zero-maintenance option is pointing the `instructions:` array in `~/.config/kilo/kilo.jsonc` at the rules file inside the npm package (auto-updates with `npm update -g`).
 
 </details>
 
@@ -187,7 +189,7 @@ Copies one file to `.kilocode/rules/agentic-senior-core.md`. Repeat per project.
 asc adapter --roo
 ```
 
-Copies one file to `.roo/rules/agentic-senior-core.md`. Repeat per project.
+Copies one file to `.roo/rules/agentic-senior-core.md`. Repeat per project — or install once globally with `asc global --roo` (`~/.roo/rules/`). Note: Roo Code was discontinued in May 2026; support is kept for existing installs.
 
 </details>
 
@@ -198,7 +200,7 @@ Copies one file to `.roo/rules/agentic-senior-core.md`. Repeat per project.
 asc adapter --openhands
 ```
 
-Copies one file to `.openhands/microagents/agentic-senior-core.md`. Repeat per project.
+Copies one file to `.openhands/microagents/agentic-senior-core.md`. Repeat per project — or install once globally with `asc global --openhands` (`~/.openhands/microagents/`, loaded in all conversations for CLI/headless/dev modes; Docker runs need the directory mounted).
 
 </details>
 
@@ -227,7 +229,13 @@ Antigravity IDE reads it automatically with `trigger: always_on`.
 
 **Option B -- global plugin (all projects):**
 
-Copy the plugin bundle to Antigravity's global plugin directory:
+One command (works on all platforms):
+
+```bash
+asc global --antigravity
+```
+
+Or copy the plugin bundle manually to Antigravity's global plugin directory:
 
 ```powershell
 # Windows (PowerShell)
@@ -246,7 +254,7 @@ cp -r "$(npm root -g)/@ryuenn3123/agentic-senior-core/.agents/plugins/agentic-se
 
 The plugin bundle includes rules, skills (`/asc-review`, `/asc-audit`, `/asc-refactor`, `/asc-reference`, `/asc-debt`), and `plugin.json`.
 
-> Note: `npm update -g` refreshes the npm package only. The global plugin copy does not auto-update -- re-run the copy command above after each update.
+> Note: `npm update -g` refreshes the npm package only. The global plugin copy does not auto-update -- re-run `asc global --antigravity` after each update.
 
 </details>
 
@@ -280,7 +288,35 @@ Generates adapter files for Cursor, Devin Desktop, Windsurf, Cline, Copilot, Kir
 </details>
 
 **Terminal agents** (Claude Code, Codex, Gemini, Copilot CLI) = install once, always-on, zero per-project files.
-**IDE agents** (Cursor, Devin Desktop, Cline, Copilot VS Code, Kiro, Continue, Zed, Aider, Kilo Code, Roo Code, OpenHands, Antigravity) = one file per project via `asc adapter` or copy.
+**IDE agents** = one file per project via `asc adapter`, or install once globally via `asc global` (below).
+
+### Global install (all projects, zero project files)
+
+Most IDE tools also support user-level rules that apply to **every project** — no files in any repo root. One command installs them all:
+
+```bash
+asc global --all
+```
+
+| Tool | Global location | Notes |
+|------|----------------|-------|
+| Google Antigravity IDE | `~/.gemini/config/plugins/agentic-senior-core/` | Full plugin bundle: rules + skills, always-on |
+| Cline | `~/Documents/Cline/Rules/` | Toggleable in the Cline rules panel |
+| Kilo Code | `~/.kilocode/rules/` | Or point `instructions:` in `~/.config/kilo/kilo.jsonc` at the npm package path — that variant auto-updates |
+| Kiro | `~/.kiro/steering/` | Some builds have global-steering loading bugs; fall back to `asc adapter --kiro` |
+| OpenHands | `~/.openhands/microagents/` | CLI/headless/dev modes; Docker runs need the mount |
+| Windsurf / Devin Desktop | `~/.codeium/windsurf/memories/global_rules.md` | 6,000-char global limit (ASC rules fit); skipped if you already have your own file |
+| GitHub Copilot (VS Code) | VS Code profile `prompts/` folder | Installed as a user `*.instructions.md` with `applyTo: '**'` |
+| Roo Code | `~/.roo/rules/` | Roo Code was discontinued May 2026; kept for existing installs |
+
+Tools without a global rules **file** (manual one-time setup instead):
+
+- **Cursor** — Settings → Rules → User Rules: paste the contents of `AGENTS.md` (plain text field; a global rules directory is still a Cursor feature request).
+- **Zed** — Rules Library in the Agent Panel: create a rule from `AGENTS.md` and mark it as default (paper clip icon).
+- **Continue** — add a rules block to the global `config.yaml`.
+- **Aider** — add `read: <absolute path to npm package>/CONVENTIONS.md` in `~/.aider.conf.yml`. This is a live pointer: it auto-updates with `npm update -g`, no re-copy ever.
+
+Global rules load first; per-project adapter files (if present) take precedence on conflicts in every tool that supports both.
 
 ### Updating
 
@@ -290,13 +326,15 @@ Already installed? Just update the global package:
 npm update -g @ryuenn3123/agentic-senior-core
 ```
 
-Terminal agent plugins pick up the new version automatically on next session. For IDE adapters, re-run `asc adapter --all` in each project to refresh the adapter files.
+Terminal agent plugins pick up the new version automatically on next session. Global installs and IDE adapter files are static copies — after updating, re-run `asc global --all` once and `asc adapter --all` in each project that uses per-project files. (Aider's `read:` pointer and Kilo's `kilo.jsonc` path variant auto-update — nothing to re-run.)
 
 ---
 
 ## What It Does
 
-AI coding agents over-build by default. Ask for a date picker, the agent installs a library, writes a wrapper component, adds a stylesheet, and opens a timezone discussion.
+AI coding agents over-build by default. Ask for a date picker, the agent installs a library, writes a wrapper component, adds a stylesheet, and opens a timezone discussion. Worse — they silently skip input validation, concatenate SQL strings, commit secrets, and return stack traces to clients.
+
+Code reduction plugins solve the first problem. ASC solves both.
 
 This plugin loads universal engineering rules on every session. Before writing any code, the agent runs a decision ladder:
 
@@ -309,6 +347,56 @@ This plugin loads universal engineering rules on every session. Before writing a
 
 The rules also cover security, architecture, testing, error handling, API design, database safety, frontend accessibility, infrastructure, resilience, and async patterns. All universal invariants -- no project-specific configuration needed.
 
+### Before / After
+
+<details>
+<summary><b>Without ASC</b> — AI-generated endpoint (common output)</summary>
+
+```javascript
+app.post('/users', (req, res) => {
+  const { name, email, password } = req.body;
+  // No input validation
+  // SQL injection via string concatenation
+  const query = `INSERT INTO users (name, email, password)
+                 VALUES ('${name}', '${email}', '${password}')`;
+  db.run(query, (err) => {
+    if (err) {
+      // Stack trace leaked to client
+      res.status(500).json({ error: err.message, stack: err.stack });
+    } else {
+      // Password returned in response
+      res.json({ name, email, password, message: 'User created' });
+    }
+  });
+});
+```
+
+Issues: no input validation, SQL injection, plaintext password stored and returned, internal error details leaked, no auth check.
+
+</details>
+
+<details>
+<summary><b>With ASC</b> — same prompt, rules active</summary>
+
+```javascript
+app.post('/users', authenticate, async (req, res) => {
+  const { name, email, password } = req.body;
+  if (!name || !email || !password) {
+    return res.status(400).json({ error: 'Missing required fields' });
+  }
+  const hash = await bcrypt.hash(password, 12);
+  const stmt = db.prepare(
+    'INSERT INTO users (name, email, password) VALUES (?, ?, ?)'
+  );
+  stmt.run(name, email, hash);
+  res.status(201).json({ name, email });
+});
+```
+
+Validated input, parameterized query, hashed password, safe error response, auth middleware, no sensitive data in response.
+
+</details>
+
 ### Not lazy about
 
 Input validation at trust boundaries, parameterized queries, auth checks, error handling that prevents data loss, accessibility, anything explicitly requested. These are never skipped.
@@ -327,20 +415,20 @@ Input validation at trust boundaries, parameterized queries, auth checks, error
 | Hermes | Terminal agent | Plugin registration | No |
 | OpenCode | Terminal agent | Auto-detected | No |
 | OpenClaw | Terminal agent | Auto-detected | No |
-| Antigravity IDE | IDE | Copy rules or plugin bundle | No (global) / Yes (rules) |
+| Antigravity IDE | IDE | `asc global --antigravity` | No (global) |
 | Antigravity CLI | Terminal agent | `agy plugin install` | No |
-| Cursor | IDE | `asc adapter --cursor` | Yes (1 file) |
+| Cursor | IDE | `asc adapter --cursor` | Yes (1 file) — or paste User Rules once |
 | Devin Desktop | IDE | `asc adapter --devin` | Yes (1 file) |
-| Windsurf (legacy) | IDE | `asc adapter --windsurf` | Yes (1 file) |
-| Cline | VS Code ext | `asc adapter --cline` | Yes (1 file) |
-| GitHub Copilot | VS Code ext | `asc adapter --copilot` | Yes (1 file) |
-| Kiro | IDE | `asc adapter --kiro` | Yes (1 file) |
-| Continue | VS Code ext | `asc adapter --continue` | Yes (1 file) |
-| Zed | IDE | `asc adapter --zed` | Yes (1 file) |
-| Aider | Terminal agent | `asc adapter --aider` | Yes (1 file) |
-| Kilo Code | VS Code ext | `asc adapter --kilocode` | Yes (1 file) |
-| Roo Code | VS Code ext | `asc adapter --roo` | Yes (1 file) |
-| OpenHands | Agent | `asc adapter --openhands` | Yes (1 file) |
+| Windsurf (legacy) | IDE | `asc global --windsurf` | No (global) — or `asc adapter --windsurf` |
+| Cline | VS Code ext | `asc global --cline` | No (global) — or `asc adapter --cline` |
+| GitHub Copilot | VS Code ext | `asc global --copilot` | No (global) — or `asc adapter --copilot` |
+| Kiro | IDE | `asc adapter --kiro` | Yes (1 file) — global via `asc global --kiro` (buggy in some builds) |
+| Continue | VS Code ext | `asc adapter --continue` | Yes (1 file) — or global config.yaml rules |
+| Zed | IDE | `asc adapter --zed` | Yes (1 file) — or default rule in Rules Library |
+| Aider | Terminal agent | `asc adapter --aider` | Yes (1 file) — or `read:` pointer in `~/.aider.conf.yml` |
+| Kilo Code | VS Code ext | `asc global --kilocode` | No (global) — or `asc adapter --kilocode` |
+| Roo Code | VS Code ext | `asc global --roo` | No (global) — discontinued May 2026 |
+| OpenHands | Agent | `asc global --openhands` | No (global) — or `asc adapter --openhands` |
 
 ---
 
@@ -350,6 +438,8 @@ Available on plugin hosts (Claude Code, Codex, Gemini CLI):
 
 | Command | Purpose |
 |---------|---------|
+| `/asc-new-project` | Greenfield workflow (Define -> Spec -> Implement -> Validate) |
+| `/asc-add-feature` | Brownfield workflow (Research -> Plan -> Implement) |
 | `/asc-refactor` | Structured refactoring workflow |
 | `/asc-review` | Production-risk code review with severity-ordered findings |
 | `/asc-audit` | Security and architecture audit |
@@ -363,6 +453,7 @@ Available on plugin hosts (Claude Code, Codex, Gemini CLI):
 
 ```bash
 asc adapter [--cursor|--devin|--windsurf|--cline|--copilot|--kiro|--continue|--zed|--aider|--kilocode|--roo|--openhands|--all]
+asc global [--antigravity|--cline|--kilocode|--kiro|--openhands|--windsurf|--copilot|--roo|--all]
 asc uninstall [--dry-run]
 asc clean [--dry-run]
 asc status
@@ -377,12 +468,9 @@ asc --help
 
 ## Works With Other Plugins
 
-ASC covers universal engineering standards (security, architecture, testing, API design, database safety). It is complementary to:
-
-- **ponytail** -- YAGNI minimalism and code reduction
-- **awesome-cursorrules** -- Framework-specific context and stack declarations
+ASC covers security, architecture, testing, API design, database safety, accessibility, infrastructure, and resilience — domains that code-reduction and minimalism plugins explicitly leave out of scope. They reduce volume; ASC enforces safety on what remains.
 
-Use them together. No conflicts.
+Use them together. No conflicts — ASC is designed to be complementary.
 
 ---
 
@@ -432,3 +520,24 @@ This removes `.agent-context/`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, and other
 | Commands | 0 | Metadata only |
 
 Total always-on cost: ~1,200 tokens per session.
+
+---
+
+## Grounded In
+
+Every rule and skill workflow is derived from established engineering standards, not invented conventions.
+
+| Domain | Standards |
+|--------|-----------|
+| Security & audit | OWASP Top 10, OWASP ASVS v4, CWE classification, CVSS report structure |
+| Code review | OWASP Risk Rating Methodology, Google Engineering Practices |
+| Architecture | Clean Architecture, Hexagonal Architecture |
+| Workflows | RPI & QRSPI (Dex Horthy/HumanLayer), SDD (GitHub Spec Kit) |
+| Refactoring | Fowler's Refactoring, Rule of Three, YAGNI (XP/Kent Beck) |
+| Database | Fowler's Money Pattern, UTC timestamp convention, migration versioning |
+| Accessibility | WCAG 2.2 AA |
+| Resilience | Nygard's Release It!, AWS Well-Architected Reliability Pillar |
+| Technical debt | Cunningham's debt metaphor (1992) |
+| Instruction design | Low instruction density for higher LLM compliance — supported by IFScale (arXiv:2507.11538) and RECAST (arXiv:2505.19030) |
+
+The decision ladder (check before building) and debt ledger format are ASC-specific implementations grounded in these principles.

package/bin/agentic-senior-core.js

@@ -4,6 +4,7 @@
  *
  * Commands:
  *   adapter     Generate instruction-tier adapter files for IDEs without plugin support
+ *   global      Install rules to user-level (global) locations, applies to all projects
  *   uninstall   Remove ASC adapter files from the current project
  *   clean       Remove v4 per-project artifacts (.agent-context/, bridge files)
  *   status      Show detected IDEs and install hints
@@ -25,10 +26,13 @@ function printUsage() {
   console.log('Plugin install (always-on, no per-project files):');
   console.log('  Claude Code:  /plugin marketplace add fatidaprilian/Agentic-Senior-Core');
   console.log('  Codex CLI:    codex plugins install agentic-senior-core\n');
+  console.log('Global install (all projects, zero project files):');
+  console.log('  asc global --antigravity --cline --kilocode --kiro --openhands --windsurf --copilot --all\n');
   console.log('Adapter install (one file per project):');
   console.log('  asc adapter --cursor --devin --cline --copilot --kiro --continue --zed --aider --kilocode --roo --openhands --windsurf --all\n');
   console.log('Commands:');
   console.log('  adapter       Generate instruction-tier adapter files');
+  console.log('  global        Install rules to user-level (global) locations');
   console.log('  uninstall     Remove ASC adapter files from this project');
   console.log('  clean         Remove v4 per-project artifacts');
   console.log('  status        Show detected IDEs and install hints');
@@ -57,6 +61,12 @@ async function main() {
     return;
   }
 
+  if (commandArgument === 'global') {
+    const { runGlobalCommand } = await import('../lib/cli/commands/global.mjs');
+    await runGlobalCommand(commandArguments);
+    return;
+  }
+
   if (commandArgument === 'uninstall') {
     const { runUninstallCommand } = await import('../lib/cli/commands/uninstall.mjs');
     await runUninstallCommand(commandArguments);

package/commands/asc-add-feature.md

@@ -0,0 +1 @@
+Run the brownfield feature workflow from skills/asc-add-feature/SKILL.md. Follow the Research -> Plan -> Implement phases with explicit human gates to prevent context rot.

package/commands/asc-add-feature.toml

@@ -0,0 +1,6 @@
+name = "asc-add-feature"
+description = "Structured brownfield workflow. Research -> Plan -> Implement with human gates."
+
+[[instructions]]
+type = "context"
+content = "Run the brownfield feature workflow from skills/asc-add-feature/SKILL.md. Stop and wait for user approval at the end of each phase (Research, Plan) before proceeding. Update the gate state as instructed."

package/commands/asc-help.md

@@ -1,6 +1,8 @@
 Show available Agentic Senior Core commands and skills.
 
 Available commands:
+- /asc-new-project -- Greenfield workflow (Define -> Spec -> Implement -> Validate)
+- /asc-add-feature -- Brownfield workflow (Research -> Plan -> Implement)
 - /asc-refactor -- Structured refactoring workflow
 - /asc-review -- Production-risk code review
 - /asc-audit -- Security and architecture audit

package/commands/asc-help.toml

@@ -1,2 +1,12 @@
 description = "Show available Agentic Senior Core commands"
-prompt = "Show the Agentic Senior Core command reference: /asc-refactor (structured refactoring workflow), /asc-review (production-risk code review with severity-ordered findings), /asc-audit (security and architecture audit), /asc-help (this help). ASC loads universal engineering rules covering code quality, architecture, security, error handling, testing, API design, database, frontend, infrastructure, resilience, and async patterns."
+prompt = '''
+Show available Agentic Senior Core commands and skills.
+
+Available commands:
+- /asc-new-project -- Greenfield workflow (Define -> Spec -> Implement -> Validate)
+- /asc-add-feature -- Brownfield workflow (Research -> Plan -> Implement)
+- /asc-refactor -- Structured refactoring workflow
+- /asc-review -- Production-risk code review
+- /asc-audit -- Security and architecture audit
+- /asc-help -- This help. ASC loads universal engineering rules covering code quality, architecture, security, error handling, testing, API design, database, frontend, infrastructure, resilience, and async patterns.
+'''

package/commands/asc-new-project.md

@@ -0,0 +1 @@
+Run the greenfield project workflow from skills/asc-new-project/SKILL.md. Follow the Define -> Spec -> Implement -> Validate phases with explicit human gates before building.

package/commands/asc-new-project.toml

@@ -0,0 +1,6 @@
+name = "asc-new-project"
+description = "Structured greenfield workflow. Define -> Spec -> Implement -> Validate with human gates."
+
+[[instructions]]
+type = "context"
+content = "Run the greenfield project workflow from skills/asc-new-project/SKILL.md. Stop and wait for user approval at the end of each phase (Define, Spec) before proceeding. Update the gate state as instructed."

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.6.0",
+  "version": "5.8.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": "fatidaprilian",
   "license": "MIT",

package/hooks/path-util.cjs

@@ -0,0 +1,23 @@
+const crypto = require('crypto');
+const path = require('path');
+const os = require('os');
+
+/**
+ * Computes a stable path for the workflow gate file based on the project path.
+ * Normalizes the path (resolves absolute, lowercase, forward slashes, no trailing slash)
+ * to ensure identical hashes regardless of OS path separator or drive letter casing.
+ * Note: .toLowerCase() deliberately treats Linux/Mac paths case-insensitively, 
+ * accepting the negligible risk of collisions for the benefit of Windows stability.
+ * 
+ * @param {string} projectPath - The root path of the project.
+ * @returns {string} Absolute path to the global workflow gate JSON file.
+ */
+function getWorkflowGatePath(projectPath) {
+  const normalizedPath = path.resolve(projectPath).replace(/\\/g, '/').toLowerCase().replace(/\/$/, '');
+  const projectHash = crypto.createHash('sha256').update(normalizedPath).digest('hex').substring(0, 16);
+  return path.join(os.homedir(), '.config', 'agentic-senior-core', 'gates', `${projectHash}.json`);
+}
+
+module.exports = {
+  getWorkflowGatePath
+};

package/hooks/post-edit-enforce.js

@@ -3,6 +3,7 @@
 // Fires after Edit/Write. Checks for ladder violations and injects a nudge.
 // Supports Claude Code, Codex CLI, and GitHub Copilot CLI.
 
+const fs = require('fs');
 const path = require('path');
 
 const STDLIB_DUPLICATES = new Set([
@@ -50,6 +51,10 @@ process.stdin.on('end', function () {
       }
     }
 
+    if (ext !== 'md') {
+      checkWorkflowGate(toolName, filePath, ext, findings);
+    }
+
     if (findings.length === 0) return;
 
     const nudge = '[ASC enforcement] ' + findings.join(' ') + ' Review the decision ladder before continuing.';
@@ -115,6 +120,35 @@ function checkNewFileSize(toolInput, filePath, findings) {
   }
 }
 
+function checkWorkflowGate(toolName, filePath, ext, findings) {
+  try {
+    var pathUtil = require('./path-util.cjs');
+    var gatePath = pathUtil.getWorkflowGatePath(process.cwd());
+    if (!fs.existsSync(gatePath)) return;
+    
+    var gateStr = fs.readFileSync(gatePath, 'utf8');
+    var gate = JSON.parse(gateStr);
+    
+    if (gate.updatedAt) {
+      var ageHours = (Date.now() - new Date(gate.updatedAt).getTime()) / (1000 * 60 * 60);
+      if (ageHours > 4) {
+        fs.unlinkSync(gatePath);
+        findings.push('Cleared stale workflow gate (' + gate.workflow + ').');
+        return;
+      }
+    }
+    
+    if (gate.phase === 'research' || gate.phase === 'plan') {
+      findings.push(
+        'Workflow gate bypass: ' + gate.workflow + ' is in ' + gate.phase + ' phase but source code was edited. '
+        + 'Stop and wait for phase approval. If you must proceed, log this bypass to the debt ledger.'
+      );
+    }
+  } catch (_) {
+    // Silent fail
+  }
+}
+
 function emit(nudge) {
   try {
     var isCopilot = Boolean(process.env.COPILOT_PLUGIN_DATA);