@vibekiln/cutline-mcp-cli 0.5.0 → 0.7.0

package/README.md

@@ -135,6 +135,19 @@ cutline-mcp serve output         # Export and rendering
 cutline-mcp serve integrations   # External integrations
 ```
 
+HTTP bridge mode (for registries/hosts that require an HTTPS MCP URL):
+
+```bash
+cutline-mcp serve constraints --http --host 0.0.0.0 --port 8080 --path /mcp
+# Health: GET /health
+# MCP endpoint: POST /mcp
+```
+
+Bridge notes:
+- Default mode remains stdio (no behavior change for Cursor/Claude Desktop local configs).
+- The bridge forwards JSON-RPC requests to the bundled stdio server process.
+- Batch JSON-RPC payloads are not supported by the bridge.
+
 ### `upgrade`
 
 Open the upgrade page and refresh your session.
@@ -206,6 +219,10 @@ Config: [`server.json`](./server.json)
 
 Config: [`smithery.yaml`](./smithery.yaml) with [`Dockerfile`](./Dockerfile)
 
+If the publish UI requires an MCP Server URL, deploy the bridge and provide your public HTTPS endpoint, for example:
+
+`https://mcp.thecutline.ai/mcp`
+
 ### Claude Desktop Extension
 
 ```bash

package/dist/commands/serve.d.ts

@@ -1 +1,8 @@
-export declare function serveCommand(serverName: string): void;
+interface ServeOptions {
+    http?: boolean;
+    host?: string;
+    port?: string;
+    path?: string;
+}
+export declare function serveCommand(serverName: string, options?: ServeOptions): void;
+export {};

package/dist/commands/serve.js

@@ -1,4 +1,5 @@
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
+import { createServer } from 'node:http';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { existsSync } from 'node:fs';
@@ -11,7 +12,174 @@ const SERVER_MAP = {
     output: 'output-server.js',
     integrations: 'integrations-server.js',
 };
-export function serveCommand(serverName) {
+function readJsonBody(req) {
+    return new Promise((resolveBody, rejectBody) => {
+        const chunks = [];
+        let total = 0;
+        const MAX_BODY_BYTES = 1024 * 1024; // 1MB safety cap
+        req.on('data', (chunk) => {
+            total += chunk.length;
+            if (total > MAX_BODY_BYTES) {
+                rejectBody(new Error('Request body too large'));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            try {
+                const text = Buffer.concat(chunks).toString('utf8');
+                resolveBody(text ? JSON.parse(text) : {});
+            }
+            catch {
+                rejectBody(new Error('Invalid JSON body'));
+            }
+        });
+        req.on('error', rejectBody);
+    });
+}
+function writeJson(res, statusCode, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(statusCode, {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(payload),
+    });
+    res.end(payload);
+}
+function normalizeId(id) {
+    if (typeof id === 'string' || typeof id === 'number')
+        return String(id);
+    return '';
+}
+function serveHttpBridge(serverName, serverPath, opts) {
+    const host = opts.host || process.env.CUTLINE_MCP_HTTP_HOST || '0.0.0.0';
+    const port = Number(opts.port || process.env.CUTLINE_MCP_HTTP_PORT || '8080');
+    const mcpPath = opts.path || process.env.CUTLINE_MCP_HTTP_PATH || '/mcp';
+    const requestTimeoutMs = Number(process.env.CUTLINE_MCP_HTTP_TIMEOUT_MS || '30000');
+    if (!Number.isFinite(port) || port <= 0) {
+        console.error(`Invalid --port value: ${opts.port}`);
+        process.exit(1);
+    }
+    const child = spawn(process.execPath, [serverPath], {
+        stdio: ['pipe', 'pipe', 'inherit'],
+        env: process.env,
+    });
+    const pending = new Map();
+    let stdoutBuffer = Buffer.alloc(0);
+    const failAllPending = (reason) => {
+        for (const [key, entry] of pending.entries()) {
+            clearTimeout(entry.timer);
+            entry.reject(reason);
+            pending.delete(key);
+        }
+    };
+    const sendToStdioServer = (message) => {
+        if (!child.stdin || child.killed) {
+            throw new Error('MCP stdio server is not available');
+        }
+        const body = JSON.stringify(message);
+        const packet = `Content-Length: ${Buffer.byteLength(body, 'utf8')}\r\n\r\n${body}`;
+        child.stdin.write(packet, 'utf8');
+    };
+    child.stdout?.on('data', (chunk) => {
+        stdoutBuffer = Buffer.concat([stdoutBuffer, chunk]);
+        while (true) {
+            const separatorIndex = stdoutBuffer.indexOf('\r\n\r\n');
+            if (separatorIndex < 0)
+                break;
+            const headers = stdoutBuffer.slice(0, separatorIndex).toString('utf8');
+            const lengthMatch = headers.match(/content-length:\s*(\d+)/i);
+            if (!lengthMatch) {
+                stdoutBuffer = stdoutBuffer.slice(separatorIndex + 4);
+                continue;
+            }
+            const contentLength = Number(lengthMatch[1]);
+            const packetLength = separatorIndex + 4 + contentLength;
+            if (stdoutBuffer.length < packetLength)
+                break;
+            const jsonBytes = stdoutBuffer.slice(separatorIndex + 4, packetLength);
+            stdoutBuffer = stdoutBuffer.slice(packetLength);
+            try {
+                const message = JSON.parse(jsonBytes.toString('utf8'));
+                const id = normalizeId(message?.id);
+                if (!id)
+                    continue;
+                const entry = pending.get(id);
+                if (!entry)
+                    continue;
+                clearTimeout(entry.timer);
+                pending.delete(id);
+                entry.resolve(message);
+            }
+            catch {
+                // Ignore malformed child output and keep processing subsequent frames.
+            }
+        }
+    });
+    child.on('exit', (code, signal) => {
+        failAllPending(new Error(`MCP stdio server exited unexpectedly (${signal ? `signal ${signal}` : `code ${code ?? 'unknown'}`})`));
+    });
+    const httpServer = createServer(async (req, res) => {
+        const { method } = req;
+        const reqPath = (req.url || '/').split('?')[0];
+        if (method === 'GET' && reqPath === '/health') {
+            writeJson(res, 200, {
+                ok: true,
+                server: serverName,
+                transport: 'http-bridge-stdio',
+                mcp_path: mcpPath,
+            });
+            return;
+        }
+        if (method !== 'POST' || reqPath !== mcpPath) {
+            writeJson(res, 404, { error: `Not found. Use POST ${mcpPath}` });
+            return;
+        }
+        try {
+            const body = await readJsonBody(req);
+            if (Array.isArray(body)) {
+                writeJson(res, 400, { error: 'Batch JSON-RPC is not supported by this bridge' });
+                return;
+            }
+            const message = body;
+            const id = normalizeId(message?.id);
+            // Notifications do not have an id and do not expect a response.
+            if (!id) {
+                sendToStdioServer(message);
+                writeJson(res, 202, { ok: true });
+                return;
+            }
+            const response = await new Promise((resolveResponse, rejectResponse) => {
+                const timer = setTimeout(() => {
+                    pending.delete(id);
+                    rejectResponse(new Error(`Timed out waiting for response id=${id}`));
+                }, requestTimeoutMs);
+                pending.set(id, {
+                    resolve: resolveResponse,
+                    reject: rejectResponse,
+                    timer,
+                });
+                try {
+                    sendToStdioServer(message);
+                }
+                catch (error) {
+                    clearTimeout(timer);
+                    pending.delete(id);
+                    rejectResponse(error);
+                }
+            });
+            writeJson(res, 200, response);
+        }
+        catch (error) {
+            writeJson(res, 500, { error: error?.message || 'Bridge request failed' });
+        }
+    });
+    httpServer.listen(port, host, () => {
+        console.error(`Cutline MCP HTTP bridge listening on http://${host}:${port}${mcpPath}`);
+        console.error(`Health check: http://${host}:${port}/health`);
+    });
+}
+export function serveCommand(serverName, options = {}) {
     const fileName = SERVER_MAP[serverName];
     if (!fileName) {
         const valid = Object.keys(SERVER_MAP).join(', ');
@@ -24,8 +192,11 @@ export function serveCommand(serverName) {
         console.error('The package may not have been built correctly.');
         process.exit(1);
     }
-    // Replace this process with the MCP server.
-    // MCP servers use stdio transport, so we need to keep stdin/stdout connected.
+    if (options.http) {
+        serveHttpBridge(serverName, serverPath, options);
+        return;
+    }
+    // Replace this process with the MCP server (default stdio mode).
     try {
         execFileSync(process.execPath, [serverPath], {
             stdio: 'inherit',

package/dist/index.js

@@ -47,7 +47,16 @@ program
 program
     .command('serve <server>')
     .description('Start an MCP server (constraints, premortem, exploration, tools, output, integrations)')
-    .action(serveCommand);
+    .option('--http', 'Expose the selected stdio server over an HTTP bridge')
+    .option('--host <host>', 'HTTP bind host for bridge mode (default: 0.0.0.0)')
+    .option('--port <port>', 'HTTP port for bridge mode (default: 8080)')
+    .option('--path <path>', 'HTTP MCP path for bridge mode (default: /mcp)')
+    .action((server, opts) => serveCommand(server, {
+    http: opts.http,
+    host: opts.host,
+    port: opts.port,
+    path: opts.path,
+}));
 program
     .command('setup')
     .description('One-command onboarding: authenticate, write IDE MCP config, generate rules')

package/dist/servers/cutline-server.js

@@ -7395,6 +7395,18 @@ function mcpAudit(entry) {
   }));
 }
 var DEFAULT_MODEL = process.env.MODEL_ID || "gemini-2.5-pro";
+var GOVERNANCE_ENFORCEMENT = (process.env.CUTLINE_GOVERNANCE_ENFORCEMENT || "advisory").toLowerCase() === "enforced";
+function buildGovernanceEnvelope(input) {
+  return {
+    decision: input.decision,
+    decisionReasons: input.reasons ?? [],
+    requiredActions: input.requiredActions ?? [],
+    executionPermission: input.executionPermission ?? "conditional",
+    ...input.closePermission ? { closePermission: input.closePermission } : {},
+    ...input.requiredBranches?.length ? { requiredBranches: input.requiredBranches } : {},
+    ...input.mode ? { mode: input.mode } : {}
+  };
+}
 var generateStructuredContent = (options) => withLlmMonitor(options.modelId || DEFAULT_MODEL, () => cfGenerateStructuredContent(options));
 var explorationSessions = /* @__PURE__ */ new Map();
 function generateId(prefix = "id") {
@@ -8003,6 +8015,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             max_constraints: { type: "number", description: "Max constraints to return (default: 5)" },
             use_semantic: { type: "boolean", description: "Use semantic search if embeddings available (default: true)" },
             phase: { type: "string", enum: ["test_spec", "functional", "security", "performance", "economics", "full", "auto"], description: "RGR phase filter. 'auto' uses complexity heuristic. Default: 'full'" },
+            requestedOutcome: {
+              type: "string",
+              enum: ["approve", "revise", "execute", "close"],
+              description: "Governance intent for this transition (default: approve)"
+            },
             auto_scope_expand: { type: "boolean", description: "If true, auto-seed a new graph entity when scope expansion intent is confidently detected and entity fields are provided." },
             scope_entity_name: { type: "string", description: "Optional explicit entity name to seed during scope expansion (for example 'Vibe Check Extension')." },
             scope_entity_type: { type: "string", enum: ["feature", "component", "data_type"], description: "Entity type for auto scope expansion." },
@@ -8223,7 +8240,12 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           properties: {
             product_id: { type: "string", description: "Product ID" },
             file_path: { type: "string", description: "File path to assess (e.g., 'src/api/upload.ts')" },
-            depth: { type: "number", description: "BFS traversal depth for subgraph extraction (default: 2)" }
+            depth: { type: "number", description: "BFS traversal depth for subgraph extraction (default: 2)" },
+            requestedOutcome: {
+              type: "string",
+              enum: ["approve", "revise", "execute", "close"],
+              description: "Governance intent for this transition (default: approve)"
+            }
           },
           required: ["product_id", "file_path"]
         }
@@ -8240,6 +8262,39 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["product_id", "phase"]
         }
       },
+      {
+        name: "request_execution_gate",
+        description: "\u{1F512} PREMIUM - Governance checkpoint before downstream actions (code generation, file edits, migrations, deploy). Uses RGR completion, audit signals, and constraint acknowledgments to return approved/conditional/blocked.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            product_id: { type: "string", description: "Product ID" },
+            target_action: { type: "string", enum: ["generate_code", "modify_files", "run_migration", "deploy"], description: "Planned downstream action" },
+            target_artifacts: { type: "array", items: { type: "string" }, description: "Files/modules the action will touch" },
+            based_on_step_ids: { type: "array", items: { type: "string" }, description: "Optional planning step IDs this execution is based on" },
+            open_critical_findings: { type: "number", description: "Count of unresolved critical/high findings from latest audit context" },
+            touched_sensitive_paths: { type: "array", items: { type: "string" }, description: "Sensitive files touched in this action (auth, billing, security, AI, integrations, user flows)" },
+            constraints_acknowledged: { type: "boolean", description: "Whether relevant constraints have been reviewed and acknowledged for touched sensitive paths" }
+          },
+          required: ["product_id", "target_action", "target_artifacts"]
+        }
+      },
+      {
+        name: "submit_done_claim",
+        description: "\u{1F512} PREMIUM - Governance close gate. Evaluates completion claims against RGR state, unresolved critical findings, and provided evidence references.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            product_id: { type: "string", description: "Product ID" },
+            completion_summary: { type: "string", description: "What was completed" },
+            claimed_criteria_satisfied: { type: "array", items: { type: "string" }, description: "Success criteria the agent claims are satisfied" },
+            known_limitations: { type: "array", items: { type: "string" }, description: "Known limitations or intentional exclusions" },
+            evidence_refs: { type: "array", items: { type: "string" }, description: "Evidence links/refs (tests, reports, docs, PRs)" },
+            open_critical_findings: { type: "number", description: "Count of unresolved critical/high findings from latest audit context" }
+          },
+          required: ["product_id", "completion_summary", "claimed_criteria_satisfied"]
+        }
+      },
       {
         name: "export_readiness_badge",
         description: "\u{1F512} PREMIUM - Export a public readiness badge and verification page for this product. Computes an architecture readiness grade from the constraint graph, stores a public snapshot, and returns embeddable badge snippets (Markdown for GitHub README, HTML for website footer) plus a full CUTLINE-REPORT.md. The verification page at thecutline.ai/verify/{id} provides SEO backlinks.",
@@ -9182,7 +9237,7 @@ Meta: ${JSON.stringify(output.meta)}` }
             return void 0;
           };
           var detectFramework = detectFramework2;
-          const { product_id, file_paths, code_snippet, task_description, mode = "auto", max_constraints = 5, use_semantic = true, phase: autoPhase = "full", auto_scope_expand = false, scope_entity_name, scope_entity_type, scope_entity_description, scope_entity_tags, scope_parent_id, scope_similarity_threshold } = args;
+          const { product_id, file_paths, code_snippet, task_description, mode = "auto", max_constraints = 5, use_semantic = true, phase: autoPhase = "full", requestedOutcome = "approve", auto_scope_expand = false, scope_entity_name, scope_entity_type, scope_entity_description, scope_entity_tags, scope_parent_id, scope_similarity_threshold } = args;
           if (!product_id) {
             throw new McpError(ErrorCode.InvalidParams, "product_id is required");
           }
@@ -9192,6 +9247,19 @@ Meta: ${JSON.stringify(output.meta)}` }
             task_description
           };
           if (!hasEnoughSignal(fileContext)) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "revise",
+              reasons: [{
+                constraintId: "context.signal.missing",
+                severity: "warning",
+                message: "Insufficient context to match constraints deterministically."
+              }],
+              requiredActions: [
+                "Provide file_paths, code_snippet, or task_description.",
+                "Re-run constraints_auto with richer context."
+              ],
+              executionPermission: "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -9202,7 +9270,8 @@ Meta: ${JSON.stringify(output.meta)}` }
                   meta: {
                     mode: "silent",
                     signal_strength: 0
-                  }
+                  },
+                  governance: governance2
                 })
               }]
             };
@@ -9238,6 +9307,16 @@ Meta: ${JSON.stringify(output.meta)}` }
           }
           const actualMode = mode === "auto" ? analysis.suggested_mode : mode;
           if (actualMode === "silent") {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "approved",
+              reasons: [{
+                constraintId: "constraints.mode.silent",
+                severity: "info",
+                message: "Silent mode selected; constraints were analyzed but not injected into output."
+              }],
+              requiredActions: requestedOutcome === "execute" ? ["If execution is next, run request_execution_gate before downstream write/deploy actions."] : [],
+              executionPermission: requestedOutcome === "execute" ? "conditional" : "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -9252,7 +9331,8 @@ Meta: ${JSON.stringify(output.meta)}` }
                     keywords_detected: analysis.signal.keywords?.slice(0, 5),
                     scope_expansion: scopeExpansion,
                     scope_seeded: scopeSeedResult || void 0
-                  }
+                  },
+                  governance: governance2
                 })
               }]
             };
@@ -9264,6 +9344,19 @@ Meta: ${JSON.stringify(output.meta)}` }
             lightNodes = await getAllNodesLight(product_id);
           }
           if (lightNodes.length === 0) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "blocked",
+              reasons: [{
+                constraintId: "constraints.graph.empty",
+                severity: "high",
+                message: "No ingested constraints are available for this product."
+              }],
+              requiredActions: [
+                "Run constraints_ingest_* or graph_ingest_requirements first.",
+                "Re-run constraints_auto after ingestion."
+              ],
+              executionPermission: "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -9275,7 +9368,8 @@ Meta: ${JSON.stringify(output.meta)}` }
                     mode: actualMode,
                     detected_domains: analysis.detected_domains,
                     signal_strength: Math.round(analysis.confidence * 100) / 100
-                  }
+                  },
+                  governance: governance2
                 })
               }]
             };
@@ -9413,6 +9507,36 @@ Meta: ${JSON.stringify(output.meta)}` }
 ${recommendation}`;
             }
           }
+          const criticalCount = topConstraints.filter((c) => c.severity === "critical").length;
+          const warningCount = topConstraints.filter((c) => c.severity === "warning").length;
+          const branchRequired = detectedConflicts.length > 0;
+          const shouldBlock = actualMode === "blocking" && criticalCount > 0;
+          const governanceDecision = shouldBlock ? "blocked" : branchRequired ? "branch" : criticalCount > 0 || warningCount > 0 ? "revise" : "approved";
+          const governance = buildGovernanceEnvelope({
+            decision: governanceDecision,
+            reasons: [
+              ...criticalCount > 0 ? [{
+                constraintId: "constraints.severity.critical",
+                severity: "critical",
+                message: `${criticalCount} critical constraint(s) detected for the proposed transition.`
+              }] : [],
+              ...branchRequired ? [{
+                constraintId: "constraints.conflict.detected",
+                severity: "high",
+                message: `${detectedConflicts.length} constraint conflict(s) detected; compare alternatives before execution.`
+              }] : []
+            ],
+            requiredActions: [
+              ...criticalCount > 0 ? ["Address critical constraints before implementation handoff."] : [],
+              ...branchRequired ? ["Compare at least two implementation alternatives and resolve conflicts explicitly."] : [],
+              ...requestedOutcome === "execute" ? ["Run request_execution_gate before invoking code-write or deploy actions."] : []
+            ],
+            executionPermission: shouldBlock ? "denied" : requestedOutcome === "execute" ? "conditional" : "denied",
+            requiredBranches: branchRequired ? [
+              { branchId: "A", instruction: "Propose the lowest-risk compliant implementation path." },
+              { branchId: "B", instruction: "Propose an alternative path and document trade-offs." }
+            ] : void 0
+          });
           return {
             content: [{
               type: "text",
@@ -9433,9 +9557,12 @@ ${recommendation}`;
                   used_category_prefilter: usePreFilter,
                   phase: autoPhase,
                   rgr_plan: autoRgrPlan || void 0,
+                  requested_outcome: requestedOutcome,
                   scope_expansion: scopeExpansion,
-                  scope_seeded: scopeSeedResult || void 0
-                }
+                  scope_seeded: scopeSeedResult || void 0,
+                  requested_outcome: requestedOutcome
+                },
+                governance
               })
             }]
           };
@@ -10253,7 +10380,7 @@ ${JSON.stringify(metrics, null, 2)}` }
         // RGR_PLAN
         // ─────────────────────────────────────────────────────────────────
         case "rgr_plan": {
-          const { product_id, file_path, depth: rgrDepth = 2 } = args;
+          const { product_id, file_path, depth: rgrDepth = 2, requestedOutcome = "approve" } = args;
           if (!product_id || !file_path) {
             throw new McpError(ErrorCode.InvalidParams, "product_id and file_path are required");
           }
@@ -10264,10 +10391,26 @@ ${JSON.stringify(metrics, null, 2)}` }
             getAllBindings(product_id)
           ]);
           if (rgrEntities.length === 0) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "blocked",
+              reasons: [{
+                constraintId: "graph.entities.missing",
+                severity: "high",
+                message: `No graph entities found for product "${product_id}".`
+              }],
+              requiredActions: [
+                "Run graph_ingest_requirements or constraints_ingest_* to seed the graph.",
+                "Re-run rgr_plan after ingestion."
+              ],
+              executionPermission: "denied"
+            });
             return {
               content: [{
                 type: "text",
-                text: `No graph entities found for product "${product_id}". Run graph_ingest_requirements first.`
+                text: JSON.stringify({
+                  message: `No graph entities found for product "${product_id}". Run graph_ingest_requirements first.`,
+                  governance: governance2
+                }, null, 2)
               }]
             };
           }
@@ -10286,6 +10429,19 @@ ${JSON.stringify(metrics, null, 2)}` }
             }
           }
           if (rgrMatched.length === 0) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "revise",
+              reasons: [{
+                constraintId: "graph.binding.missing",
+                severity: "warning",
+                message: `No graph entity is bound to "${file_path}".`
+              }],
+              requiredActions: [
+                "Bind codebase entities using graph_bind_codebase/graph_bind_confirm.",
+                "Proceed with full delivery only if no bound entity is expected."
+              ],
+              executionPermission: requestedOutcome === "execute" ? "conditional" : "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -10293,7 +10449,8 @@ ${JSON.stringify(metrics, null, 2)}` }
                   strategy: "full",
                   phases: [{ name: "full", label: "Full Delivery", description: "No entity bound to this file. Deliver all constraints.", categories: [], constraint_count: 0 }],
                   total_constraints: 0,
-                  rationale: `No entity bound to "${file_path}". Cannot assess constraint complexity.`
+                  rationale: `No entity bound to "${file_path}". Cannot assess constraint complexity.`,
+                  governance: governance2
                 }, null, 2)
               }]
             };
@@ -10302,13 +10459,36 @@ ${JSON.stringify(metrics, null, 2)}` }
           const fileConstraints = rgrSubgraph?.constraints ?? [];
           const plan = planRgrPhases(fileConstraints);
           const complexity = assessComplexity(fileConstraints);
+          const branchNeeded = plan.strategy === "phased" && (complexity.critical_count > 0 || requestedOutcome === "execute");
+          const governance = buildGovernanceEnvelope({
+            decision: branchNeeded ? "branch" : "approved",
+            reasons: branchNeeded ? [{
+              constraintId: "rgr.phased.required",
+              severity: "high",
+              message: `${complexity.critical_count} critical constraint(s) across ${complexity.category_count} categories require phased comparison.`
+            }] : [{
+              constraintId: "rgr.plan.ready",
+              severity: "info",
+              message: "Plan assessed and ready for implementation sequencing."
+            }],
+            requiredActions: [
+              ...plan.strategy === "phased" ? ["Follow phased RGR execution order from this plan."] : ["Deliver full constraint set in a single pass."],
+              ...requestedOutcome === "execute" ? ["Request execution permission via request_execution_gate before downstream write/deploy actions."] : []
+            ],
+            executionPermission: requestedOutcome === "execute" ? "conditional" : "denied",
+            requiredBranches: branchNeeded ? [
+              { branchId: "A", instruction: "Prioritize functional progress (test_spec/functional) then apply NFR phases." },
+              { branchId: "B", instruction: "Prioritize security/performance constraints before broad implementation." }
+            ] : void 0
+          });
           return {
             content: [{
               type: "text",
               text: JSON.stringify({
                 ...plan,
                 entity: rgrMatched[0].name,
-                complexity
+                complexity,
+                governance
               }, null, 2)
             }]
           };
@@ -10379,6 +10559,157 @@ ${JSON.stringify(metrics, null, 2)}` }
           };
         }
         // ─────────────────────────────────────────────────────────────────
+        // REQUEST_EXECUTION_GATE
+        // ─────────────────────────────────────────────────────────────────
+        case "request_execution_gate": {
+          const { product_id, target_action, target_artifacts, based_on_step_ids = [], open_critical_findings = 0, touched_sensitive_paths = [], constraints_acknowledged = false } = args;
+          if (!product_id || !target_action || !Array.isArray(target_artifacts) || target_artifacts.length === 0) {
+            throw new McpError(ErrorCode.InvalidParams, "product_id, target_action, and non-empty target_artifacts are required");
+          }
+          const meta = await getGraphMetadata(product_id);
+          const completedPhases = meta?.rgr_completed_phases ?? [];
+          const metrics = meta?.metrics;
+          const unmetCheckpoints = [];
+          const blockingFindings = [];
+          const requiredNextSteps = [];
+          if (!completedPhases.includes("security")) {
+            unmetCheckpoints.push("security_commitment");
+            blockingFindings.push({
+              constraintId: "rgr.phase.security",
+              severity: "high",
+              message: "Security phase is not marked complete."
+            });
+            requiredNextSteps.push('Complete security remediation and call rgr_complete_phase(product_id, phase: "security").');
+          }
+          if (target_action === "deploy" && !completedPhases.includes("performance")) {
+            unmetCheckpoints.push("implementation_readiness");
+            blockingFindings.push({
+              constraintId: "rgr.phase.performance",
+              severity: "warning",
+              message: "Deploy requested before performance phase completion."
+            });
+            requiredNextSteps.push('Complete performance checks and call rgr_complete_phase(product_id, phase: "performance").');
+          }
+          if (open_critical_findings > 0) {
+            unmetCheckpoints.push("verification");
+            blockingFindings.push({
+              constraintId: "audit.findings.open",
+              severity: "critical",
+              message: `${open_critical_findings} unresolved critical/high findings are still open.`
+            });
+            requiredNextSteps.push("Resolve or explicitly accept outstanding critical/high findings before execution.");
+          }
+          if (touched_sensitive_paths.length > 0 && !constraints_acknowledged) {
+            unmetCheckpoints.push("implementation_readiness");
+            blockingFindings.push({
+              constraintId: "constraints.ack.required",
+              severity: "high",
+              message: "Sensitive paths were provided without explicit constraint acknowledgment."
+            });
+            requiredNextSteps.push("Run constraints_auto for touched sensitive paths and acknowledge applicable constraints.");
+          }
+          const hasBlocks = blockingFindings.some((f) => f.severity === "critical" || f.severity === "high");
+          const denied = hasBlocks && GOVERNANCE_ENFORCEMENT;
+          const decision = denied ? "blocked" : blockingFindings.length > 0 ? "conditional" : "approved";
+          const governance = buildGovernanceEnvelope({
+            decision: denied ? "blocked" : blockingFindings.length > 0 ? "revise" : "approved",
+            reasons: blockingFindings,
+            requiredActions: requiredNextSteps,
+            executionPermission: denied ? "denied" : blockingFindings.length > 0 ? "conditional" : "granted",
+            mode: GOVERNANCE_ENFORCEMENT ? "enforced" : "advisory"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: JSON.stringify({
+                decision,
+                unmetCheckpoints: [...new Set(unmetCheckpoints)],
+                blockingFindings,
+                requiredNextSteps,
+                based_on_step_ids,
+                product_id,
+                target_action,
+                target_artifacts,
+                governanceMode: GOVERNANCE_ENFORCEMENT ? "enforced" : "advisory",
+                readiness: {
+                  rgr_completed_phases: completedPhases,
+                  security_readiness_pct: metrics?.security_readiness_pct ?? null,
+                  engineering_readiness_pct: metrics?.engineering_readiness_pct ?? null
+                },
+                governance
+              }, null, 2)
+            }]
+          };
+        }
+        // ─────────────────────────────────────────────────────────────────
+        // SUBMIT_DONE_CLAIM
+        // ─────────────────────────────────────────────────────────────────
+        case "submit_done_claim": {
+          const { product_id, completion_summary, claimed_criteria_satisfied, known_limitations = [], evidence_refs = [], open_critical_findings = 0 } = args;
+          if (!product_id || !completion_summary || !Array.isArray(claimed_criteria_satisfied)) {
+            throw new McpError(ErrorCode.InvalidParams, "product_id, completion_summary, and claimed_criteria_satisfied are required");
+          }
+          const meta = await getGraphMetadata(product_id);
+          const completedPhases = meta?.rgr_completed_phases ?? [];
+          const unsatisfiedCriteria = [];
+          const blockingFindings = [];
+          const requiredNextSteps = [];
+          if (!completedPhases.includes("security")) {
+            unsatisfiedCriteria.push("Security phase completion not recorded.");
+            blockingFindings.push({
+              constraintId: "done.rgr.security_missing",
+              severity: "high",
+              message: "Cannot close work item before security phase completion."
+            });
+            requiredNextSteps.push('Complete and record security phase via rgr_complete_phase(product_id, phase: "security").');
+          }
+          if (evidence_refs.length === 0) {
+            unsatisfiedCriteria.push("No evidence references provided for completion claim.");
+            blockingFindings.push({
+              constraintId: "done.evidence.required",
+              severity: "warning",
+              message: "Done claims require evidence refs (tests, reports, or docs)."
+            });
+            requiredNextSteps.push("Provide evidence_refs for tests, audit reruns, or implementation verification.");
+          }
+          if (open_critical_findings > 0) {
+            unsatisfiedCriteria.push(`${open_critical_findings} unresolved critical/high findings remain.`);
+            blockingFindings.push({
+              constraintId: "done.critical_findings.open",
+              severity: "critical",
+              message: "Outstanding critical/high findings prevent closure."
+            });
+            requiredNextSteps.push("Resolve or explicitly disposition outstanding critical/high findings before closure.");
+          }
+          const hasHardBlock = blockingFindings.some((f) => f.severity === "critical" || f.severity === "high");
+          const decision = hasHardBlock ? "blocked" : unsatisfiedCriteria.length > 0 ? "incomplete" : "complete";
+          const governance = buildGovernanceEnvelope({
+            decision: hasHardBlock ? "blocked" : unsatisfiedCriteria.length > 0 ? "incomplete" : "approved",
+            reasons: blockingFindings,
+            requiredActions: requiredNextSteps,
+            executionPermission: "denied",
+            closePermission: decision === "complete" ? "granted" : "denied",
+            mode: GOVERNANCE_ENFORCEMENT ? "enforced" : "advisory"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: JSON.stringify({
+                decision,
+                closePermission: decision === "complete" ? "granted" : "denied",
+                completionSummary: completion_summary,
+                claimedCriteriaSatisfied: claimed_criteria_satisfied,
+                knownLimitations: known_limitations,
+                evidenceRefs: evidence_refs,
+                unsatisfiedCriteria,
+                blockingFindings,
+                requiredNextSteps,
+                governance
+              }, null, 2)
+            }]
+          };
+        }
+        // ─────────────────────────────────────────────────────────────────
         // GENERATE_CUTLINE_MD
         // ─────────────────────────────────────────────────────────────────
         case "generate_cutline_md": {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vibekiln/cutline-mcp-cli",
-    "version": "0.5.0",
+    "version": "0.7.0",
     "description": "CLI and MCP servers for Cutline — authenticate, then run constraint-aware MCP servers in Cursor or any MCP client.",
     "type": "module",
     "main": "dist/index.js",