@synovitec/trellis 0.0.0-stage → 0.6.0-rc.3

package/CHANGELOG.md

@@ -0,0 +1,406 @@
+# Changelog
+
+All notable changes to this package. The format follows Keep a Changelog; versions follow SemVer.
+
+## [Unreleased]
+
+## [0.6.0-rc.3] - 2026-10-31
+
+### Fixed
+
+- **The commit checkpoint is installed without gitleaks.** `init --agents` wrote the git hooks only
+  where gitleaks was on, so a machine without it got no `trellis verify` on commit and no
+  attestation at all, and said nothing. The hooks are now always written, and init says the secret
+  scan is off and how to add it.
+- **A secret scan that could not run warns on this machine where the team did not switch gitleaks
+  on**, rather than refusing every commit; where `"gitleaks": true` is set, or the team set
+  `secrets-scanned` itself, it still blocks. CI, which brings its own pinned gitleaks, blocks as
+  before, and a leak found is never softened.
+
+## [0.6.0-rc.2] - 2026-10-30
+
+The tenth review, on the code the ninth round added, found the secret scan's own reading of team
+allowlists unsound, and three false refusals. All fixed.
+
+### Security
+
+- **The team's gitleaks allowlist is read by gitleaks itself.** Trellis parsed it, and a pattern
+  with a character class (`[^/]+\.lock$`) became an empty pattern that allowed every path: a
+  secret passed CI. Files are now scanned at their real paths with the team's `.gitleaks.toml`
+  and `.gitleaksignore` as gitleaks reads them (`condition = "AND"`, `targetRules`, rule
+  allowlists, `[extend] path`), and only gitleaks's built-in global path allowlist is dropped:
+  Trellis ships gitleaks 8.30.1's default rules without it (`src/verify/gitleaks-default.toml`,
+  MIT, regenerated and checksum-checked by `scripts/gitleaks-rules.mjs`).
+- **A test run's environment.** `COMSPEC` is pinned to the system's cmd.exe, and Cargo, Go, Yarn,
+  Python, shell (`BASH_ENV`) and JVM settings that steer a runner are cleared; a test command with
+  a line break never counts, and the gateway's `run_tests` runs the accepted command, never the
+  raw text; an ignored `.pytest.ini`, `.yarnrc` or `.cargo/config` refuses the record.
+
+### Fixed
+
+- **The net change is what lands**: what merging the head into the base gives (`git merge-tree`,
+  git 2.38 or later), so criss-cross history no longer reads a change the base made again as the
+  pull request reverting it.
+- **A person's test edit is judged as a person's**, file by file: one commit with no attestation
+  (the host's "Update branch", a bot) no longer makes every file of the pull request an agent's.
+
+## [0.6.0-rc.1] - 2026-10-30
+
+A release candidate: nine independent reviews, the last four adversarial, each fixed in full; the
+tenth is under way. Verify it on a repository of your own before you rely on it.
+
+Evidence v2 (design: docs/design/0001-evidence-v2.md). Five independent reviews kept finding the
+same weak point, deciding what a session did from git history; and only Claude Code was held.
+Trellis now holds any agent, and any person, at the commit, and has CI verify every commit again.
+
+### Added
+
+- **The commit checkpoint.** `trellis verify` (the pre-commit hook) judges the staged change by
+  content: Trellis's own secret scan, each added or moved dependency checked on its registry and
+  against OSV at its exact version, and the rules, in two presets (`recommended`, `strict`) grounded
+  in published evidence. Blocking rules are the deterministic ones: secrets, dependencies,
+  protected tests (an agent may add tests, not change existing ones without a person's approval),
+  an unanswered escalation. The rest warn.
+- **The evidence log v2.** One append-only log per repository, each line signed and chained; content
+  checks hold the git blob of every file they ran on.
+- **`trellis check tests -- <cmd>`, `trellis escalate`, `trellis approve`** (refused without a
+  terminal), **`trellis checkpoint`**.
+- **Attestations.** The post-commit signs an in-toto Statement v1 about each commit and its tree
+  (DSSE, ed25519), carried in `refs/notes/trellis` and pushed by the pre-push hook. Format:
+  docs/attestation/v0.1.md. **`trellis key [--add]`** commits a developer's public key.
+- **`trellis verify --ci`**, the authority: every commit after a base, its attestation checked, the
+  deterministic checks run again, the rules judged again from the change and the recorded
+  evidence; a SLSA `verification_summary/v1` and commit checksums for signing. **A GitHub Action**
+  (`action.yml`) runs it, and can sign the summary with GitHub artifact attestations.
+- **`trellis mcp`**, the MCP gateway: the checks as tools for any agent (graph_query, run_tests,
+  escalate, check_change), and every stdio server in `.mcp.json` relayed through it, with Trellis
+  recording each check itself. Dual-era: MCP 2026-07-28 stateless requests and the `initialize`
+  handshake of earlier versions. Declared by init in `.mcp.json`, `.cursor/mcp.json`,
+  `.codex/config.toml` and `.vscode/mcp.json`.
+- **Cursor, Codex and Copilot hooks**, on the same guard, gates and evidence as Claude Code, each
+  in its own format, failing closed.
+
+### Changed
+
+- **doctor** shows the checkpoint first; before init, one diagnosis and one command; a tool with
+  one known step left warns with that step. init leaves OSV-Scanner off (the checkpoint checks each
+  added dependency against OSV).
+- README and SECURITY.md describe v2: the machine is a seatbelt, CI is the authority.
+
+### Security
+
+- A commit the session pushed is the session's again. 0.5 left out every commit a remote had,
+  so committing and pushing made the work invisible to every rule, a pushed secret included.
+  Now only what the remotes held at the start, and what arrived since by a fetch or a pull (read
+  from the remote-tracking refs' reflogs), is left out. The guard refuses moving a
+  remote-tracking ref by hand, a fetch into one, and rewriting a reflog, which would forge that.
+- AgentShield scans the repository. Without `--path` it scanned the user's `~/.claude`, so
+  `agent-setup-scanned` judged plugin caches (never passing on a busy machine) and never looked
+  at the repository's changed setup. The Stop hook now runs `scan --path <repo> --format json`,
+  reads the report from a file (it can run to megabytes), counts only critical and high findings
+  on the setup files the session changed, and treats a report it cannot read, or one about
+  another folder, as not scanned rather than clean. `trellis scan` passes `--path .` too.
+- With Trellis gone, a hook blocks instead of crashing. After `git clean -fdx` or
+  `npm ci --omit=dev`, the hook's `node` failed with exit 1, which Claude Code ignores, so the
+  session ended unchecked. The hook command now checks that Trellis is there and exits 2 (which
+  blocks) when it is not. The guard refuses those commands in the first place: `git clean -x`
+  or `-X`, an install or prune without devDependencies, and installing `@synovitec/trellis`
+  mid-session (another version, or another package, in its place). Existing installs show the
+  hooks as outdated; `trellis init --agents` updates them.
+- A graph query counts only when graphify is all that ran (beside a `cd` before it or a
+  `| head` after it). `graphify query x; echo NODE fake` printed what an answer looks like and
+  unlocked every edit.
+- The agent cannot allowlist its own secret. The Stop hook's gitleaks run ignores inline
+  `gitleaks:allow` comments, and when the session touched `.gitleaks.toml` or `.gitleaksignore`
+  it scans with gitleaks's default rules instead of them; `GITLEAKS_CONFIG` is not passed on. A
+  team allowlist committed before the session still applies.
+- Quotes and escapes no longer hide a path from the guard. `cat $HOME/.trel''lis/key` read the
+  signing key: the key, evidence and index-flag checks ran on the raw command text. They now run
+  on the words as the shell reads them too.
+- A deleted session record stays missing. A resume or a compaction after
+  `find .git/trellis/sessions -delete` started a fresh record, which made everything done before
+  it the baseline. The record is now created only when a session starts (`startup`, `clear`), and
+  `find` with `-delete`, `-exec` and the like counts as a write on the evidence; the guard now
+  covers the whole transcripts folder, not only paths ending in `.jsonl`.
+- A file hidden from git by an ignore rule is a finding. Pointing `core.excludesFile` at a list,
+  or writing a `.gitignore` that ignores itself, hid a new file from every rule. The session
+  records a fingerprint of the ignore rules at the start; when they changed, every newly ignored
+  file under the code, UI, schema or agent-setup paths is reported. A build output the rules
+  already ignored is not.
+- `trellis uninstall` and `trellis init` are refused mid-session, by any spelling
+  (`npx @synovitec/trellis@x uninstall` included): the first took the hooks out at once, the
+  second could rewrite them. Only `trellis hook` was refused before.
+- The test overrides `TRELLIS_STATE_DIR`, `TRELLIS_KEY_FILE` and `TRELLIS_AGENTSHIELD` hold only
+  under Node's test runner and outside Claude Code's project, and the guard refuses a command
+  that sets one. A session could set them and point the next one at its own key, record or
+  scanner.
+- The Stop hook runs AgentShield's npx from an empty temporary folder. Run from the repository,
+  npx would take a `node_modules/ecc-agentshield` the session planted there over the pinned
+  version; it now fetches that exact version, with npm's integrity check, and still scans the
+  repository by its absolute path.
+- A config broken at the start of a session stays the judge. Stop fell back to the current
+  config, so an agent could write a permissive one and be judged by it. It now fails closed
+  (`config-invalid`) until the person fixes the config.
+
+### Security (reviews six to nine)
+
+- **CI judges what lands.** The keys, the rules, the gitleaks allowlist and the test commands are
+  read at the base, so a pull request cannot change what judges it. Every file of the net change
+  must be what a commit of the range made it, read against every merge base, and the net change
+  is judged again as one change against the base: an old ancestor merged in, a criss-cross merge
+  keeping an older test, a branch that "adds" a test the base already has or keeps a dependency
+  the base upgraded, are all refused. A pull request is judged at its head, never at the merge
+  commit a checkout builds; only a checkpoint that passed vouches (`fail` and `unverified` are
+  refused).
+- **The workflow is the base's.** The README's workflow runs on `pull_request_target`, so a pull
+  request cannot edit the check away; the action runs its own pinned code and a gitleaks checked
+  by SHA-256, reads the attestations with the workflow's token (private repositories), fetches a
+  fork's, and fails when origin cannot be read. doctor warns about a Trellis step a pull request
+  can edit.
+- **The secret scan reads content, not diffs.** Each changed blob is scanned under a neutral name,
+  so neither a `.gitattributes` `-diff` line nor gitleaks's built-in path allowlist (`*.pdf`,
+  `package-lock.json`, `node_modules/`) hides a secret; a `.gitleaksignore` the change writes is
+  never loaded; the team's committed allowlist is applied by Trellis on the real paths; UTF-16 is
+  read as text and gzip unpacked; a merge is scanned too.
+- **Dependencies.** Lockfile v1 to v3, aliases by their real name, a `resolved` URL that is not the
+  package's own tarball, an integrity that is not npm's, a spec moved to git, pip index, VCS and
+  `name @ url` lines, go `replace`, a byte-order mark, and a manifest that does not parse: each is
+  checked, or named by the new rule `deps-registry` (warn, block in strict), with registry
+  settings, overrides, included requirements files and the manifests and lockfiles Trellis does
+  not read yet.
+- **A test run proves a test run.** Only an exact project test command counts (`verify.tests`, or
+  read from the project, at the base in CI), run as written, never through the tokens that
+  matched it; it counts only for the exact tree it ran on, with an environment cleared of what
+  steers a runner and no ignored runner setting present.
+- **tests-protected covers what bends the tests**: runner configs (new ones too), the scripts a
+  test script runs, pytest's settings, CI files, the checkpoint's own settings, the agents' hook
+  and MCP configs, RSpec specs and test setup files.
+- **Who made a commit is evidence.** Every agent's hooks record its first call of a window; the
+  guard refuses clearing `CLAUDECODE` and the person's steps run inside another command.
+- **Merges, rebases and colleagues.** Merge commits are checked and attested; a rebased commit
+  keeps its attestation when its change is the same; a commit no pre-commit saw (cherry-pick,
+  revert, conflicted rebase) is judged by the post-commit; notes merge line by line on push, so a
+  colleague's attestations are never lost.
+- **The MCP gateway starts only what a person trusted** (`trellis mcp trust`, an exact entry and
+  the repository files it runs), reads a call's kind from what the server runs, and passes
+  arguments intact on Windows.
+- **Hooks fail closed** on every agent when Trellis is missing or crashes; Codex blocks by its
+  JSON deny, which survives Windows PowerShell; Codex hooks run on Windows.
+- **Contributors without Trellis**: `verify.unattested: "judge"` judges their commits on their own,
+  as an agent's, instead of refusing them.
+
+### Fixed
+
+- `init --agents` never writes its pre-commit hook outside the repository. With a machine-wide
+  `core.hooksPath`, it wrote there, and every other repository on the machine then failed its
+  commits on a path that only exists in this one. It now says so and writes nothing.
+- `graph-before-edit` steps aside when no graph is built, as documented. With graphify installed
+  and no `graphify-out/graph.json`, every code edit was refused and no query could unlock it.
+- `doctor` warns when the Postgres MCP reads its URI from a variable that is not set: it showed
+  "ok" while the server Claude Code starts would have had no database to read.
+- `trellis scan` reports OSV-Scanner's "no package sources found" (exit 128, a repository
+  without a lockfile) as "nothing to scan", not as a failure with no reason given.
+
+## [0.5.0] - 2026-10-27
+
+A third, fresh independent review found that 0.4's evidence could still be produced or
+influenced by the agent: its own hook command could be run from the shell to record a check that
+never happened, a crash or a timeout passed the session, a backdated commit escaped the secret
+scan, and any command that exited 0 counted as a scan. This release ties every piece of evidence
+to something the agent does not control.
+
+### Security
+
+- Evidence is recorded only for a call Claude Code itself logged: the post-tool hook checks the
+  call's id (or, failing that, the same tool and input) in the session's transcript. Running
+  `trellis hook` from the shell is refused, and would record nothing anyway.
+- A crash fails closed: the Stop hook sends the agent back once and says the work was not
+  checked; the pre-tool hook refuses the call. Before, any exception exited 1, which Claude Code
+  treats as a pass.
+- The guard keeps Trellis in place: it refuses uninstalling it, deleting or moving `node_modules`,
+  editing its installed code, reading or moving `~/.trellis`, and writing `.git/logs`; matching
+  deny rules are added. A change to Trellis's installed code during a session is a finding.
+- AgentShield is run by the Stop hook itself when the agent setup changed, and a clean run is
+  recorded with the content it saw; the agent's own `scan || true` proves nothing any more.
+- A graph query counts only when graphify's answer is in the output, and not when the program run
+  is a script inside the repository or one put first on the PATH.
+
+### Changed
+
+- A session's commits are those reachable from local branches and HEAD's new reflog entries but
+  not from where things stood at the start, nor from a remote. Commit dates play no part: a
+  backdated commit is scanned, work committed on another branch is judged, and a teammate's work
+  pulled mid-session is not blamed on the agent.
+- Without gitleaks installed, the session's commits are reported unscanned; a pre-commit hook is
+  no longer trusted on its own (it can be skipped in more ways than a flag shows).
+- The evidence is an append-only log, one signed line per event, so post-tool hooks running in
+  parallel no longer lose each other's evidence; the snapshot is written atomically.
+- "Wired" is decided by parsing commands where commands run (package scripts, hooks, shell
+  scripts, CI steps read by key, Makefile and justfile recipes, Jenkins `sh` steps). A string in a
+  JavaScript file, an `echo`, a step's name or a comment no longer counts.
+- The Stop hook reads a manifest at the start revision only when the file is a manifest, so its
+  cost no longer grows with the number of changed files; its budget is 180 s. The post-tool hook
+  answers calls that cannot be evidence without reading the transcript.
+- Dependency detection: only the dependency tables of `pyproject.toml` are read (not
+  `classifiers`, `keywords` or a linter's `select`); `// indirect` go.mod lines, local paths,
+  URLs, git sources and installer upgrades (`pip install -U pip`) are not new dependencies.
+- Session files older than 30 days are removed when a session starts.
+- The OSV-Scanner install hint no longer suggests `@latest`.
+
+### Fixed
+
+- The docs no longer claim what the code does not do: `graph-before-edit` only warns at Stop for
+  a write made through the shell; one browser check verifies every changed UI file whose current
+  content it was taken over, not only those on the page it showed; `init` enables the tools found
+  on the machine that runs it.
+
+## [0.4.0] - 2026-10-27
+
+A second independent review showed that 0.3's evidence lived where the agent could write it (a
+state file in the temp folder, the transcript, file times, git's index), and that a missing
+record fell back silently to the weak path. This release records evidence as it happens, signs
+it, guards it, and makes the agent look before it writes.
+
+### Added
+
+- **Look before you write.** A PreToolUse hook refuses an edit before it happens:
+  - `graph-before-edit`: a code file cannot change until the code graph has been asked once this
+    session (`graphify query`, `path` or `explain`). One query unlocks every edit. Steps aside
+    when the repository has no graph to ask.
+  - `schema-before-change`: a migration, model or schema file cannot change until the database
+    schema has been looked at with the Postgres MCP.
+  Both are checked again at Stop from git, so a write through the shell is caught too.
+- **An evidence ledger**, written by the PostToolUse hook the moment a tool call succeeds: the
+  content hash of each changed file when it was seen in the browser or scanned by AgentShield,
+  that the graph or the schema was asked, which libraries Context7 was asked about. A UI file is
+  verified only when its current content is the content the browser check saw: backdating a
+  file or forging a transcript line gains nothing.
+- **`evidence-intact`**, blocking by default: an altered or missing session record, a file
+  hidden from git (`update-index --assume-unchanged`, `--skip-worktree`) or an edited
+  `.git/info/exclude` is a finding. The changes are still counted.
+- An evidence guard: the PreToolUse hook refuses shell commands that would write the session
+  record, the transcripts or `info/exclude`, or set an index flag; `init --agents` adds Claude
+  Code deny rules for the same paths and for the signing key.
+- Dependency detection beyond npm: requirements files, pyproject.toml, Cargo.toml, go.mod,
+  composer.json and Gemfile, at the root and in workspaces (package.json `workspaces`,
+  pnpm-workspace.yaml). A dependency written into any of them counts as added.
+- A global install (`npm i -g @synovitec/trellis`) for repositories without node_modules: the
+  hooks and the pre-commit hook then call `trellis` on PATH. Without either, `init` writes no hook
+  rather than one that fails on every event.
+- SECURITY.md (with the threat model) and CONTRIBUTING.md.
+
+### Changed
+
+- The session record moves into the repository's git folder (`.git/trellis/sessions`) and is
+  signed with a per-user key (`~/.trellis/key`).
+- Changed files are read by content, including files hidden by an index flag, files put away in a
+  stash, and deletions (a deletion seen in the browser is verified).
+- Secret scanning covers every commit created during the session, on any branch or only in the
+  reflog. Without gitleaks, a pre-commit hook is trusted only if no commit skipped it.
+- A tool call counts only when it succeeded; `--help`, `--version`, `command -v`, a heredoc body,
+  a shadowing function or alias, and `false && ...` run nothing. A browser check must be on the
+  configured origin exactly (scheme, host and port).
+- A Context7 lookup must name the package as a whole word.
+- `config-unchanged` now warns by default and never asks the agent to revert the change: the
+  person may have made it, and the session is judged by the start's rules anyway.
+- `init` enables only the tools it finds and proposes the rest with how to install each, so a
+  fresh `doctor` is green. AgentShield counts as wired when the agent hooks demand it.
+- Stop has a 120 s budget and gitleaks 40 s, so a slow scan is reported, not cut into a pass.
+- The session brief declares the evidence off limits and still does not say which rules only warn.
+
+### Fixed
+
+- Trellis did not recognise the pre-commit hook it writes itself (0.3): `doctor` reported Gitleaks
+  unwired right after `init --agents`. The hook now names its script literally.
+- A missing session record, session id or git repository no longer degrades silently: the first
+  two block once and say why, the third is reported.
+
+## [0.3.0] - 2026-10-27
+
+An independent review showed that 0.2's enforcement could be made inert while looking active.
+This release makes the rules judge evidence and fail closed.
+
+### Security
+
+- Every command now names the scoped package (`npx @synovitec/trellis`). The bare `npx trellis`
+  that 0.2's README, AGENTS.md block and rule messages printed resolves to an unrelated package
+  on the registry when this one is not installed, and npx would have downloaded and run it.
+- The hooks call the installed script with node (`node "$CLAUDE_PROJECT_DIR/node_modules/..."`),
+  never through npx. The generated pre-commit hook does the same, and says how to remove itself
+  when the package is gone instead of failing with an npx error.
+- `trellis scan` runs AgentShield pinned (`ecc-agentshield@1.6.0`), not whatever is newest.
+
+### Changed
+
+- Changed files are read from git, not from the transcript: a snapshot at session start (HEAD
+  and the dirty files, by content), compared at stop. A write through the shell, an MCP editor or
+  a subagent counts like one through the Edit tool.
+- Subagent transcripts (`<session>/subagents/*.jsonl`) are read: their checks and their edits
+  are the session's.
+- A rule is met by a real run, parsed as commands, after the change, by time: `echo gitleaks`,
+  a comment, `gitleaks version`, `browser_close` and a scan run before the change no longer count.
+  A browser check is a navigation to the configured origin followed by a snapshot or screenshot.
+  A Context7 lookup must name the added package; a dependency written into package.json by hand
+  counts as added. MCP tools are recognised under plugin and connector names too.
+- `secrets-scanned`: the Stop hook runs gitleaks itself over the session's commits.
+- `graph-first` can only warn: sending an agent back after the work is done cannot fix it, and
+  a grep over a command's output (`npm test | grep fail`) is no longer a file search.
+- Blocks are counted per session (`maxBlocks`, default 2), then the person decides. Claude
+  Code's `stop_hook_active` is no longer trusted, since any other Stop hook sets it.
+- The session brief lists what will be checked, not which rules only warn.
+- `doctor` matches runs, not mentions (comments are ignored), reads Makefile, justfile,
+  Jenkinsfile and more CI files, and reports a hook whose script is not installed as broken.
+- The default UI paths cover any folder (monorepos) and leave out tests, stories and build output.
+- abatty is an optional peer dependency: Trellis runs the project's own copy.
+
+### Added
+
+- `config-unchanged`: trellis.config.json edited during a session is a finding, and the session
+  is judged against the rules as they were when it started. It blocks unless set otherwise.
+- A broken config, or a transcript that cannot be read, is reported, never a silent pass.
+- The hook finds the project from `CLAUDE_PROJECT_DIR`, else the nearest folder holding the config.
+- `trellis uninstall`: the hooks, Trellis's pre-commit hook and the AGENTS.md block come out; the
+  config and MCP servers stay.
+- `init` upgrades hook entries written by an older version, and uses the hooks folder git really
+  runs (core.hooksPath, worktrees).
+
+## [0.2.0] - 2026-10-27
+
+### Added
+
+- Agent hooks, so a coding agent uses the tools systematically rather than when it remembers to.
+  `trellis init --agents` adds three Claude Code hooks to `.claude/settings.json` (beside the
+  team's own, never replacing one) and, when there is none, a pre-commit hook that runs the
+  secret scan for every agent and every person.
+  - `trellis hook session-start` hands the agent the routing, what is broken here, and the rules
+    it will be held to.
+  - `trellis hook post-tool` reminds it once, at the third file search with no graph query, to
+    ask the code graph.
+  - `trellis hook stop` reads the session transcript and judges what was done, not what was
+    claimed. Five rules, each active only when its tool is enabled: `ui-verified` (a UI edit is
+    followed by a browser check), `agent-setup-scanned` (an agent config edit by an AgentShield
+    run), `docs-looked-up` (a new dependency by a Context7 lookup), `graph-first` (many searches
+    by a graph query), `secrets-scanned` (a commit by a secret scan, unless a git hook runs one).
+- `agents` in `trellis.config.json`: `mode` (`block` sends the agent back with the reason,
+  `warn` tells the person, `off`), per-rule overrides, and the UI and agent-setup path globs.
+  `init --agents` starts in `warn`. A stop already sent back once is never blocked again, so a
+  session cannot loop.
+- `trellis doctor` reports agent rules that are configured but have no hook to run them.
+
+## [0.1.0] - 2026-10-27
+
+### Added
+
+- `trellis init`: writes `trellis.config.json` from the stack it finds, adds the MCP servers
+  (Context7, Playwright MCP, Postgres MCP) to `.mcp.json` without touching existing entries, puts
+  the tool routing in a managed block of `AGENTS.md`, and git-ignores the tools' output. Run
+  twice, it changes nothing. `--dry-run` writes nothing.
+- `trellis doctor`: every enabled tool as ok, warn, unwired (installed, but nothing calls it) or
+  missing, with the command that fixes each. `--json` for machines, `--strict` fails on warnings.
+- `trellis guide [tool|role]`: which tool answers which question, its rule, and its state here.
+- `trellis scan`: runs Gitleaks, OSV-Scanner and AgentShield. A scanner that could not run fails
+  the scan unless `--allow-missing`; `--history` scans the whole git history.
+- `trellis gate|explain|prove|ratchet|status|rules`: abatty's commands, run as they are.
+- Twelve tools across four roles: AgentShield (frame); graphify, Context7, Postgres MCP, Find
+  Skills (guide); ECC, Playwright MCP (help); abatty, Playwright E2E, Gitleaks, OSV-Scanner,
+  Lighthouse (guard).

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Synovitec
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.