@vibecontrols/vibe-plugin-security-release-gate 2026.528.1

package/LICENSE

@@ -0,0 +1,5 @@
+Proprietary License
+
+Copyright (c) 2026 Burdenoff Consultancy Services Pvt. Ltd. All rights reserved.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.

package/README.md

@@ -0,0 +1,25 @@
+# @vibecontrols/vibe-plugin-security-release-gate
+
+OPA-backed release gate for the `promote.prod` lifecycle stage in [VibeControls](https://vibecontrols.com). Does **not** shell out — it calls the backend's `securityPolicyDecision(scanRunId)` GraphQL resolver, which in turn POSTs to the existing `opa-wspace:8181` ACA sidecar with the appropriate Rego bundle.
+
+Registers as a `security.release` provider (name `opa-release-gate`) with the [`@vibecontrols/vibe-plugin-security`](https://www.npmjs.com/package/@vibecontrols/vibe-plugin-security) meta plugin.
+
+## Decision input
+
+The backend resolver loads:
+
+- the scan run's `summary` (severity counts)
+- open `SecurityFinding[]` (joined to active `SecurityException[]`)
+- the workspace + per-vibe `SecurityPolicy` (level: `advisory` / `warn` / `block`)
+- artifact metadata (signed? SBOM present? pinned by digest?)
+
+It POSTs the document to `POST {OPA_URL}/v1/data/vibecontrols/security/release/allow` and caches the decision in Valkey for 5 minutes keyed by `(scanRunId, policyVersion)`.
+
+## Provider output
+
+- `NormalizedFinding[]` — one row per `deny[]` entry with `category: "policy"` and severity derived from the policy expression
+- Evidence: a single `opa-decision` JSON document containing the input + decision (uploaded to S3 for the audit trail)
+
+## License
+
+Proprietary — Burdenoff Consultancy Services Pvt. Ltd.

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+import type { VibePluginFactory } from "@vibecontrols/plugin-sdk/contract";
+export declare const createPlugin: VibePluginFactory;
+export default createPlugin;
+export { ReleaseGateProvider } from "./provider.js";

package/dist/index.js

@@ -0,0 +1,2 @@
+// @bun
+import{ProviderRegistry,TelemetryEmitter,createLifecycleHooks}from"@vibecontrols/plugin-sdk";import{createHash}from"crypto";import{promises as fs}from"fs";import*as path from"path";import{normalizeOpaDecision}from"@vibecontrols/vibe-plugin-security/normalizer";var POLICY_VERSION=2,POLICY_ID="vibecontrols.security.release";class ReleaseGateProvider{name="opa-release-gate";stage="promote.prod";toolVersion=`agent-local-policy@${POLICY_ID}/v${POLICY_VERSION}`;host;async init(host){this.host=host}async ensureToolInstalled(){}async run(input){let startedAt=Date.now(),cfg=input.config??{};input.onProgress?.({pct:10,message:"Loading upstream scan data"});let upstreamFindings=cfg.upstreamFindings??[],upstreamSummary=cfg.upstreamSummary??{critical:0,high:0,medium:0,low:0,info:0};input.onProgress?.({pct:40,message:"Evaluating release gate policy"});let decision=evaluatePolicy(upstreamFindings,upstreamSummary,cfg);input.onProgress?.({pct:70,message:"Building deny[] -> findings"});let opaResultDoc=JSON.stringify({result:{allow:decision.allow,deny:decision.denyReasons}}),findings=normalizeOpaDecision(opaResultDoc,this.name),evidencePath=path.join(input.workdir,"opa-decision.json"),evidenceJson=JSON.stringify(decision,null,2);await fs.writeFile(evidencePath,evidenceJson,"utf-8");let stat=await fs.stat(evidencePath),sha256=createHash("sha256").update(evidenceJson).digest("hex"),evidence=[{type:"opa-decision",localPath:evidencePath,sha256,sizeBytes:stat.size}];return input.onProgress?.({pct:100,message:"Release gate evaluated"}),{runId:input.runId,status:"succeeded",findings,evidence,durationMs:Date.now()-startedAt,summary:summarize(findings)}}async cancel(_runId){}metadata(){return{stage:this.stage,supportedProfiles:["backend","frontend","cli","sdk","mcp","mobile","container","iac"],toolVersion:this.toolVersion,description:"Agent-local release-gate policy for the promote.prod stage. No backend."}}}function evaluatePolicy(upstreamFindings,summary,cfg){let denyReasons=[],openCriticals=upstreamFindings.filter((f)=>f.severity==="critical"&&f.status==="open"),openHighs=upstreamFindings.filter((f)=>f.severity==="high"&&f.status==="open");if(openCriticals.length>0)denyReasons.push(`${openCriticals.length} critical finding(s) open: ${openCriticals.slice(0,3).map((f)=>f.ruleId).join(", ")}${openCriticals.length>3?"...":""}`);if(!cfg.upstreamScanRunId&&summary.critical===0&&summary.high===0&&summary.medium===0&&summary.low===0&&summary.info===0)denyReasons.push("No upstream scan recorded \u2014 build stage must run before promote.prod");if(cfg.requireSignedArtifact&&!cfg.signature?.verified)denyReasons.push("Required signature is missing or not verified");if(typeof cfg.maxHighOpen==="number"&&openHighs.length>cfg.maxHighOpen)denyReasons.push(`${openHighs.length} open high-severity finding(s) exceeds maxHighOpen=${cfg.maxHighOpen}`);return{allow:denyReasons.length===0,denyReasons,evaluatedAt:new Date().toISOString(),policyVersion:POLICY_VERSION,policyId:POLICY_ID,input:{summary,openCriticalCount:openCriticals.length,openHighCount:openHighs.length,upstreamScanRunId:cfg.upstreamScanRunId}}}function summarize(findings){let s={critical:0,high:0,medium:0,low:0,info:0};for(let f of findings)s[f.severity]++;return s}var PLUGIN_NAME="security-release-gate",PLUGIN_VERSION="2026.527.1",createPlugin=(_ctx)=>{let provider=new ReleaseGateProvider,telemetry=new TelemetryEmitter(PLUGIN_NAME,PLUGIN_VERSION),lifecycle=createLifecycleHooks({name:PLUGIN_NAME,telemetryEventName:"security.release-gate.ready",onInit:async(host)=>{await provider.init(host),new ProviderRegistry(host).registerProvider("security.release","opa-release-gate",provider),telemetry.emit("security.release-gate.registered",{provider:"opa-release-gate",toolVersion:provider.toolVersion})}});return{name:PLUGIN_NAME,version:PLUGIN_VERSION,description:"OPA Rego release-gate provider for the promote.prod stage.",tags:["backend","provider","integration"],capabilities:{storage:"rw",audit:!0,telemetry:!0,gateway:!0},onServerStart:lifecycle.onServerStart,onServerStop:lifecycle.onServerStop}},src_default=createPlugin;export{src_default as default,createPlugin,ReleaseGateProvider};

package/dist/provider.d.ts

@@ -0,0 +1,13 @@
+import type { HostServices } from "@vibecontrols/plugin-sdk/contract";
+import type { SecurityProvider, SecurityProviderMetadata, SecurityScanInput, SecurityScanResult, SecurityStage } from "@vibecontrols/vibe-plugin-security/types";
+export declare class ReleaseGateProvider implements SecurityProvider {
+    readonly name = "opa-release-gate";
+    readonly stage: SecurityStage;
+    readonly toolVersion = "agent-local-policy@vibecontrols.security.release/v2";
+    private host?;
+    init(host: HostServices): Promise<void>;
+    ensureToolInstalled(): Promise<void>;
+    run(input: SecurityScanInput): Promise<SecurityScanResult>;
+    cancel(_runId: string): Promise<void>;
+    metadata(): SecurityProviderMetadata;
+}

package/package.json

@@ -0,0 +1,83 @@
+{
+  "name": "@vibecontrols/vibe-plugin-security-release-gate",
+  "version": "2026.528.1",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "description": "OPA-backed release-gate provider for the promote.prod lifecycle stage. Calls the backend policy decision resolver and maps deny[] to NormalizedFinding[]. Registers as a security.release provider with @vibecontrols/vibe-plugin-security.",
+  "engines": {
+    "bun": ">=1.3.14"
+  },
+  "author": {
+    "name": "Vignesh T.V",
+    "email": "vignesh@burdenoff.com",
+    "url": "https://github.com/tvvignesh"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "scripts": {
+    "build": "bun build ./src/index.ts --outdir ./dist --target bun --minify-syntax --minify-whitespace --external elysia --external @vibecontrols/vibe-plugin-security --external @vibecontrols/plugin-sdk && tsc --emitDeclarationOnly --declaration --outDir ./dist",
+    "dev": "tsc --watch",
+    "lint": "eslint ./src ./tests",
+    "format": "bunx prettier . --write",
+    "format:check": "bunx prettier . --check",
+    "type:check": "tsc --noEmit",
+    "test": "bun test ./tests",
+    "clean": "rimraf dist",
+    "prebuild": "bun run clean",
+    "prepublishOnly": "bun run build",
+    "sanity": "bun run format:check && bun run lint && bun run type:check && bun run test && bun run build"
+  },
+  "dependencies": {
+    "@vibecontrols/plugin-sdk": "2026.527.1",
+    "@vibecontrols/vibe-plugin-security": "2026.528.1"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.0.0",
+    "bun-types": "^1.3.9",
+    "eslint": "^9.30.1",
+    "globals": "^17.3.0",
+    "prettier": "^3.6.2",
+    "rimraf": "^6.0.1",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.56.0"
+  },
+  "peerDependencies": {
+    "@vibecontrols/agent": ">=2026.428.0"
+  },
+  "peerDependenciesMeta": {
+    "@vibecontrols/agent": {
+      "optional": true
+    }
+  },
+  "keywords": [
+    "vibecontrols",
+    "vibe",
+    "vibe-plugin",
+    "security",
+    "opa",
+    "rego",
+    "release-gate",
+    "promote-prod",
+    "policy",
+    "bun"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/algoshred/vibe-plugin-security-release-gate.git"
+  },
+  "bugs": {
+    "url": "https://github.com/algoshred/vibe-plugin-security-release-gate/issues"
+  },
+  "homepage": "https://vibecontrols.com",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "files": [
+    "dist/**/*",
+    "!dist/**/*.map",
+    "README.md",
+    "LICENSE"
+  ]
+}