@vibekiln/cutline-mcp-cli 0.6.0 → 0.8.0

package/Dockerfile

@@ -3,7 +3,11 @@ FROM node:20-slim AS base
 WORKDIR /app
 
 # Install the CLI globally from npm (includes bundled servers)
-RUN npm install -g @vibekiln/cutline-mcp-cli@latest
+# Override at build time for staging package:
+#   --build-arg PACKAGE_NAME=@kylewadegrove/cutline-mcp-cli-staging
+ARG PACKAGE_NAME=@vibekiln/cutline-mcp-cli
+ARG PACKAGE_TAG=latest
+RUN npm install -g "${PACKAGE_NAME}@${PACKAGE_TAG}"
 
 # Default to the main constraints server (cutline-server.js)
 # Override with: docker run ... cutline-mcp serve premortem

package/dist/commands/init.js

@@ -1,11 +1,35 @@
 import chalk from 'chalk';
 import ora from 'ora';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { createInterface } from 'node:readline';
 import { resolve, join } from 'node:path';
 import { getRefreshToken } from '../auth/keychain.js';
 import { fetchFirebaseApiKey } from '../utils/config.js';
 import { saveConfig, loadConfig } from '../utils/config-store.js';
 const CUTLINE_CONFIG = '.cutline/config.json';
+function prompt(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolvePrompt) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolvePrompt(answer.trim());
+        });
+    });
+}
+async function fetchProducts(idToken, baseUrl) {
+    try {
+        const res = await fetch(`${baseUrl}/mcpListProducts`, {
+            headers: { Authorization: `Bearer ${idToken}` },
+        });
+        if (!res.ok)
+            return { products: [], requestOk: false };
+        const data = await res.json();
+        return { products: data.products ?? [], requestOk: true };
+    }
+    catch {
+        return { products: [], requestOk: false };
+    }
+}
 async function authenticate(options) {
     const refreshToken = await getRefreshToken();
     if (!refreshToken)
@@ -53,6 +77,13 @@ function readCutlineConfig(projectRoot) {
         return null;
     }
 }
+function writeCutlineConfig(projectRoot, config) {
+    const cutlineDir = join(projectRoot, '.cutline');
+    const configPath = join(cutlineDir, 'config.json');
+    mkdirSync(cutlineDir, { recursive: true });
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+    return configPath;
+}
 function cursorRgrRule(config, tier) {
     const productId = config?.product_id ?? '<from .cutline/config.json>';
     const productName = config?.product_name ?? 'your product';
@@ -203,7 +234,8 @@ function ensureGitignore(projectRoot, patterns) {
 }
 export async function initCommand(options) {
     const projectRoot = resolve(options.projectRoot ?? process.cwd());
-    const config = readCutlineConfig(projectRoot);
+    let config = readCutlineConfig(projectRoot);
+    const isInteractive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
     const scanUrl = options.staging
         ? 'https://cutline-staging.web.app/scan'
         : 'https://thecutline.ai/scan';
@@ -222,6 +254,79 @@ export async function initCommand(options) {
         tier = auth.tier;
         spinner.succeed(chalk.green(`Authenticated as ${auth.email} (${tier})`));
     }
+    if (tier === 'premium' && auth?.idToken && auth.baseUrl) {
+        const productsSpinner = ora('Fetching product graphs for normalization...').start();
+        const { products, requestOk } = await fetchProducts(auth.idToken, auth.baseUrl);
+        productsSpinner.stop();
+        if (requestOk && products.length > 0) {
+            const currentIndex = config?.product_id
+                ? products.findIndex((p) => p.id === config?.product_id)
+                : -1;
+            let selected;
+            if (isInteractive) {
+                console.log(chalk.bold('\n  Select canonical product for rule generation\n'));
+                products.forEach((p, i) => {
+                    const date = p.createdAt
+                        ? chalk.dim(` (${new Date(p.createdAt).toLocaleDateString()})`)
+                        : '';
+                    const currentTag = currentIndex === i ? chalk.green(' [current]') : '';
+                    console.log(`  ${chalk.cyan(`${i + 1}.`)} ${chalk.white(p.name)}${date}${currentTag}`);
+                    if (p.brief)
+                        console.log(`     ${chalk.dim(p.brief)}`);
+                });
+                console.log();
+                const defaultHint = currentIndex >= 0
+                    ? ` (Enter keeps ${products[currentIndex].name})`
+                    : '';
+                const answer = await prompt(chalk.cyan(`  Select a product number${defaultHint}: `));
+                const choice = parseInt(answer, 10);
+                if (!answer && currentIndex >= 0) {
+                    selected = products[currentIndex];
+                }
+                else if (Number.isFinite(choice) && choice >= 1 && choice <= products.length) {
+                    selected = products[choice - 1];
+                }
+                else if (currentIndex >= 0) {
+                    selected = products[currentIndex];
+                    console.log(chalk.yellow(`  Invalid selection. Keeping "${selected.name}".`));
+                }
+                else {
+                    selected = products[0];
+                    console.log(chalk.yellow(`  Invalid selection. Defaulting to "${selected.name}".`));
+                }
+            }
+            else {
+                selected = currentIndex >= 0 ? products[currentIndex] : products[0];
+                if (currentIndex < 0) {
+                    console.log(chalk.dim(`  Auto-selected product: ${selected.name}`));
+                }
+            }
+            const changed = selected.id !== config?.product_id || selected.name !== config?.product_name;
+            if (changed) {
+                const configPath = writeCutlineConfig(projectRoot, {
+                    product_id: selected.id,
+                    product_name: selected.name,
+                    linked_email: auth.email ?? null,
+                });
+                console.log(chalk.green(`  ✓ Normalized product to "${selected.name}"`));
+                console.log(chalk.dim(`    ${configPath}`));
+            }
+            config = {
+                product_id: selected.id,
+                product_name: selected.name,
+                linked_email: auth.email ?? config?.linked_email ?? null,
+            };
+            console.log();
+        }
+        else if (requestOk) {
+            console.log(chalk.yellow('  No completed product graphs found for this premium account.'));
+            console.log(chalk.dim('  Generate a deep dive first, then re-run cutline-mcp init for normalization.\n'));
+        }
+        else {
+            console.log(chalk.yellow('  Could not fetch products for normalization (network/auth issue).'));
+            console.log(chalk.dim('  Continuing with existing .cutline/config.json values.\n'));
+        }
+    }
     if (config) {
         console.log(chalk.dim(`  Product: ${config.product_name ?? config.product_id}`));
     }

package/dist/commands/serve.js

@@ -12,6 +12,18 @@ const SERVER_MAP = {
     output: 'output-server.js',
     integrations: 'integrations-server.js',
 };
+function handleChildMessage(message, pending) {
+    const parsed = message;
+    const id = normalizeId(parsed?.id);
+    if (!id)
+        return;
+    const entry = pending.get(id);
+    if (!entry)
+        return;
+    clearTimeout(entry.timer);
+    pending.delete(id);
+    entry.resolve(message);
+}
 function readJsonBody(req) {
     return new Promise((resolveBody, rejectBody) => {
         const chunks = [];
@@ -77,44 +89,68 @@ function serveHttpBridge(serverName, serverPath, opts) {
         if (!child.stdin || child.killed) {
             throw new Error('MCP stdio server is not available');
         }
-        const body = JSON.stringify(message);
-        const packet = `Content-Length: ${Buffer.byteLength(body, 'utf8')}\r\n\r\n${body}`;
-        child.stdin.write(packet, 'utf8');
+        // Our bundled servers (MCP SDK 1.x) use line-delimited JSON over stdio.
+        // Write one JSON-RPC envelope per line.
+        const line = `${JSON.stringify(message)}\n`;
+        child.stdin.write(line, 'utf8');
     };
     child.stdout?.on('data', (chunk) => {
         stdoutBuffer = Buffer.concat([stdoutBuffer, chunk]);
+        // 1) Support MCP framed responses (Content-Length) for compatibility.
         while (true) {
-            const separatorIndex = stdoutBuffer.indexOf('\r\n\r\n');
+            const crlfSeparator = stdoutBuffer.indexOf('\r\n\r\n');
+            const lfSeparator = stdoutBuffer.indexOf('\n\n');
+            let separatorIndex = -1;
+            let separatorLength = 0;
+            if (crlfSeparator >= 0 && (lfSeparator < 0 || crlfSeparator < lfSeparator)) {
+                separatorIndex = crlfSeparator;
+                separatorLength = 4;
+            }
+            else if (lfSeparator >= 0) {
+                separatorIndex = lfSeparator;
+                separatorLength = 2;
+            }
             if (separatorIndex < 0)
                 break;
             const headers = stdoutBuffer.slice(0, separatorIndex).toString('utf8');
             const lengthMatch = headers.match(/content-length:\s*(\d+)/i);
-            if (!lengthMatch) {
-                stdoutBuffer = stdoutBuffer.slice(separatorIndex + 4);
-                continue;
-            }
+            if (!lengthMatch)
+                break;
             const contentLength = Number(lengthMatch[1]);
-            const packetLength = separatorIndex + 4 + contentLength;
+            const packetLength = separatorIndex + separatorLength + contentLength;
             if (stdoutBuffer.length < packetLength)
                 break;
-            const jsonBytes = stdoutBuffer.slice(separatorIndex + 4, packetLength);
+            const jsonBytes = stdoutBuffer.slice(separatorIndex + separatorLength, packetLength);
             stdoutBuffer = stdoutBuffer.slice(packetLength);
             try {
                 const message = JSON.parse(jsonBytes.toString('utf8'));
-                const id = normalizeId(message?.id);
-                if (!id)
-                    continue;
-                const entry = pending.get(id);
-                if (!entry)
-                    continue;
-                clearTimeout(entry.timer);
-                pending.delete(id);
-                entry.resolve(message);
+                handleChildMessage(message, pending);
             }
             catch {
                 // Ignore malformed child output and keep processing subsequent frames.
             }
         }
+        // 2) Support line-delimited JSON responses used by our bundled servers.
+        const head = stdoutBuffer.slice(0, Math.min(stdoutBuffer.length, 32)).toString('utf8');
+        const looksLikeFramedPrefix = /^\s*content-length\s*:/i.test(head);
+        if (!looksLikeFramedPrefix) {
+            const text = stdoutBuffer.toString('utf8');
+            const lines = text.split(/\r?\n/);
+            const remainder = lines.pop() ?? '';
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                try {
+                    const message = JSON.parse(trimmed);
+                    handleChildMessage(message, pending);
+                }
+                catch {
+                    // Ignore non-JSON stdout lines (if any).
+                }
+            }
+            stdoutBuffer = Buffer.from(remainder, 'utf8');
+        }
     });
     child.on('exit', (code, signal) => {
         failAllPending(new Error(`MCP stdio server exited unexpectedly (${signal ? `signal ${signal}` : `code ${code ?? 'unknown'}`})`));

package/dist/servers/cutline-server.js

@@ -7395,6 +7395,18 @@ function mcpAudit(entry) {
   }));
 }
 var DEFAULT_MODEL = process.env.MODEL_ID || "gemini-2.5-pro";
+var GOVERNANCE_ENFORCEMENT = (process.env.CUTLINE_GOVERNANCE_ENFORCEMENT || "advisory").toLowerCase() === "enforced";
+function buildGovernanceEnvelope(input) {
+  return {
+    decision: input.decision,
+    decisionReasons: input.reasons ?? [],
+    requiredActions: input.requiredActions ?? [],
+    executionPermission: input.executionPermission ?? "conditional",
+    ...input.closePermission ? { closePermission: input.closePermission } : {},
+    ...input.requiredBranches?.length ? { requiredBranches: input.requiredBranches } : {},
+    ...input.mode ? { mode: input.mode } : {}
+  };
+}
 var generateStructuredContent = (options) => withLlmMonitor(options.modelId || DEFAULT_MODEL, () => cfGenerateStructuredContent(options));
 var explorationSessions = /* @__PURE__ */ new Map();
 function generateId(prefix = "id") {
@@ -8003,6 +8015,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             max_constraints: { type: "number", description: "Max constraints to return (default: 5)" },
             use_semantic: { type: "boolean", description: "Use semantic search if embeddings available (default: true)" },
             phase: { type: "string", enum: ["test_spec", "functional", "security", "performance", "economics", "full", "auto"], description: "RGR phase filter. 'auto' uses complexity heuristic. Default: 'full'" },
+            requestedOutcome: {
+              type: "string",
+              enum: ["approve", "revise", "execute", "close"],
+              description: "Governance intent for this transition (default: approve)"
+            },
             auto_scope_expand: { type: "boolean", description: "If true, auto-seed a new graph entity when scope expansion intent is confidently detected and entity fields are provided." },
             scope_entity_name: { type: "string", description: "Optional explicit entity name to seed during scope expansion (for example 'Vibe Check Extension')." },
             scope_entity_type: { type: "string", enum: ["feature", "component", "data_type"], description: "Entity type for auto scope expansion." },
@@ -8223,7 +8240,12 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           properties: {
             product_id: { type: "string", description: "Product ID" },
             file_path: { type: "string", description: "File path to assess (e.g., 'src/api/upload.ts')" },
-            depth: { type: "number", description: "BFS traversal depth for subgraph extraction (default: 2)" }
+            depth: { type: "number", description: "BFS traversal depth for subgraph extraction (default: 2)" },
+            requestedOutcome: {
+              type: "string",
+              enum: ["approve", "revise", "execute", "close"],
+              description: "Governance intent for this transition (default: approve)"
+            }
           },
           required: ["product_id", "file_path"]
         }
@@ -8240,6 +8262,39 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["product_id", "phase"]
         }
       },
+      {
+        name: "request_execution_gate",
+        description: "\u{1F512} PREMIUM - Governance checkpoint before downstream actions (code generation, file edits, migrations, deploy). Uses RGR completion, audit signals, and constraint acknowledgments to return approved/conditional/blocked.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            product_id: { type: "string", description: "Product ID" },
+            target_action: { type: "string", enum: ["generate_code", "modify_files", "run_migration", "deploy"], description: "Planned downstream action" },
+            target_artifacts: { type: "array", items: { type: "string" }, description: "Files/modules the action will touch" },
+            based_on_step_ids: { type: "array", items: { type: "string" }, description: "Optional planning step IDs this execution is based on" },
+            open_critical_findings: { type: "number", description: "Count of unresolved critical/high findings from latest audit context" },
+            touched_sensitive_paths: { type: "array", items: { type: "string" }, description: "Sensitive files touched in this action (auth, billing, security, AI, integrations, user flows)" },
+            constraints_acknowledged: { type: "boolean", description: "Whether relevant constraints have been reviewed and acknowledged for touched sensitive paths" }
+          },
+          required: ["product_id", "target_action", "target_artifacts"]
+        }
+      },
+      {
+        name: "submit_done_claim",
+        description: "\u{1F512} PREMIUM - Governance close gate. Evaluates completion claims against RGR state, unresolved critical findings, and provided evidence references.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            product_id: { type: "string", description: "Product ID" },
+            completion_summary: { type: "string", description: "What was completed" },
+            claimed_criteria_satisfied: { type: "array", items: { type: "string" }, description: "Success criteria the agent claims are satisfied" },
+            known_limitations: { type: "array", items: { type: "string" }, description: "Known limitations or intentional exclusions" },
+            evidence_refs: { type: "array", items: { type: "string" }, description: "Evidence links/refs (tests, reports, docs, PRs)" },
+            open_critical_findings: { type: "number", description: "Count of unresolved critical/high findings from latest audit context" }
+          },
+          required: ["product_id", "completion_summary", "claimed_criteria_satisfied"]
+        }
+      },
       {
         name: "export_readiness_badge",
         description: "\u{1F512} PREMIUM - Export a public readiness badge and verification page for this product. Computes an architecture readiness grade from the constraint graph, stores a public snapshot, and returns embeddable badge snippets (Markdown for GitHub README, HTML for website footer) plus a full CUTLINE-REPORT.md. The verification page at thecutline.ai/verify/{id} provides SEO backlinks.",
@@ -9182,7 +9237,7 @@ Meta: ${JSON.stringify(output.meta)}` }
             return void 0;
           };
           var detectFramework = detectFramework2;
-          const { product_id, file_paths, code_snippet, task_description, mode = "auto", max_constraints = 5, use_semantic = true, phase: autoPhase = "full", auto_scope_expand = false, scope_entity_name, scope_entity_type, scope_entity_description, scope_entity_tags, scope_parent_id, scope_similarity_threshold } = args;
+          const { product_id, file_paths, code_snippet, task_description, mode = "auto", max_constraints = 5, use_semantic = true, phase: autoPhase = "full", requestedOutcome = "approve", auto_scope_expand = false, scope_entity_name, scope_entity_type, scope_entity_description, scope_entity_tags, scope_parent_id, scope_similarity_threshold } = args;
           if (!product_id) {
             throw new McpError(ErrorCode.InvalidParams, "product_id is required");
           }
@@ -9192,6 +9247,19 @@ Meta: ${JSON.stringify(output.meta)}` }
             task_description
           };
           if (!hasEnoughSignal(fileContext)) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "revise",
+              reasons: [{
+                constraintId: "context.signal.missing",
+                severity: "warning",
+                message: "Insufficient context to match constraints deterministically."
+              }],
+              requiredActions: [
+                "Provide file_paths, code_snippet, or task_description.",
+                "Re-run constraints_auto with richer context."
+              ],
+              executionPermission: "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -9202,7 +9270,8 @@ Meta: ${JSON.stringify(output.meta)}` }
                   meta: {
                     mode: "silent",
                     signal_strength: 0
-                  }
+                  },
+                  governance: governance2
                 })
               }]
             };
@@ -9238,6 +9307,16 @@ Meta: ${JSON.stringify(output.meta)}` }
           }
           const actualMode = mode === "auto" ? analysis.suggested_mode : mode;
           if (actualMode === "silent") {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "approved",
+              reasons: [{
+                constraintId: "constraints.mode.silent",
+                severity: "info",
+                message: "Silent mode selected; constraints were analyzed but not injected into output."
+              }],
+              requiredActions: requestedOutcome === "execute" ? ["If execution is next, run request_execution_gate before downstream write/deploy actions."] : [],
+              executionPermission: requestedOutcome === "execute" ? "conditional" : "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -9252,7 +9331,8 @@ Meta: ${JSON.stringify(output.meta)}` }
                     keywords_detected: analysis.signal.keywords?.slice(0, 5),
                     scope_expansion: scopeExpansion,
                     scope_seeded: scopeSeedResult || void 0
-                  }
+                  },
+                  governance: governance2
                 })
               }]
             };
@@ -9264,6 +9344,19 @@ Meta: ${JSON.stringify(output.meta)}` }
             lightNodes = await getAllNodesLight(product_id);
           }
           if (lightNodes.length === 0) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "blocked",
+              reasons: [{
+                constraintId: "constraints.graph.empty",
+                severity: "high",
+                message: "No ingested constraints are available for this product."
+              }],
+              requiredActions: [
+                "Run constraints_ingest_* or graph_ingest_requirements first.",
+                "Re-run constraints_auto after ingestion."
+              ],
+              executionPermission: "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -9275,7 +9368,8 @@ Meta: ${JSON.stringify(output.meta)}` }
                     mode: actualMode,
                     detected_domains: analysis.detected_domains,
                     signal_strength: Math.round(analysis.confidence * 100) / 100
-                  }
+                  },
+                  governance: governance2
                 })
               }]
             };
@@ -9413,6 +9507,36 @@ Meta: ${JSON.stringify(output.meta)}` }
 ${recommendation}`;
             }
           }
+          const criticalCount = topConstraints.filter((c) => c.severity === "critical").length;
+          const warningCount = topConstraints.filter((c) => c.severity === "warning").length;
+          const branchRequired = detectedConflicts.length > 0;
+          const shouldBlock = actualMode === "blocking" && criticalCount > 0;
+          const governanceDecision = shouldBlock ? "blocked" : branchRequired ? "branch" : criticalCount > 0 || warningCount > 0 ? "revise" : "approved";
+          const governance = buildGovernanceEnvelope({
+            decision: governanceDecision,
+            reasons: [
+              ...criticalCount > 0 ? [{
+                constraintId: "constraints.severity.critical",
+                severity: "critical",
+                message: `${criticalCount} critical constraint(s) detected for the proposed transition.`
+              }] : [],
+              ...branchRequired ? [{
+                constraintId: "constraints.conflict.detected",
+                severity: "high",
+                message: `${detectedConflicts.length} constraint conflict(s) detected; compare alternatives before execution.`
+              }] : []
+            ],
+            requiredActions: [
+              ...criticalCount > 0 ? ["Address critical constraints before implementation handoff."] : [],
+              ...branchRequired ? ["Compare at least two implementation alternatives and resolve conflicts explicitly."] : [],
+              ...requestedOutcome === "execute" ? ["Run request_execution_gate before invoking code-write or deploy actions."] : []
+            ],
+            executionPermission: shouldBlock ? "denied" : requestedOutcome === "execute" ? "conditional" : "denied",
+            requiredBranches: branchRequired ? [
+              { branchId: "A", instruction: "Propose the lowest-risk compliant implementation path." },
+              { branchId: "B", instruction: "Propose an alternative path and document trade-offs." }
+            ] : void 0
+          });
           return {
             content: [{
               type: "text",
@@ -9433,9 +9557,12 @@ ${recommendation}`;
                   used_category_prefilter: usePreFilter,
                   phase: autoPhase,
                   rgr_plan: autoRgrPlan || void 0,
+                  requested_outcome: requestedOutcome,
                   scope_expansion: scopeExpansion,
-                  scope_seeded: scopeSeedResult || void 0
-                }
+                  scope_seeded: scopeSeedResult || void 0,
+                  requested_outcome: requestedOutcome
+                },
+                governance
               })
             }]
           };
@@ -10253,7 +10380,7 @@ ${JSON.stringify(metrics, null, 2)}` }
         // RGR_PLAN
         // ─────────────────────────────────────────────────────────────────
         case "rgr_plan": {
-          const { product_id, file_path, depth: rgrDepth = 2 } = args;
+          const { product_id, file_path, depth: rgrDepth = 2, requestedOutcome = "approve" } = args;
           if (!product_id || !file_path) {
             throw new McpError(ErrorCode.InvalidParams, "product_id and file_path are required");
           }
@@ -10264,10 +10391,26 @@ ${JSON.stringify(metrics, null, 2)}` }
             getAllBindings(product_id)
           ]);
           if (rgrEntities.length === 0) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "blocked",
+              reasons: [{
+                constraintId: "graph.entities.missing",
+                severity: "high",
+                message: `No graph entities found for product "${product_id}".`
+              }],
+              requiredActions: [
+                "Run graph_ingest_requirements or constraints_ingest_* to seed the graph.",
+                "Re-run rgr_plan after ingestion."
+              ],
+              executionPermission: "denied"
+            });
             return {
               content: [{
                 type: "text",
-                text: `No graph entities found for product "${product_id}". Run graph_ingest_requirements first.`
+                text: JSON.stringify({
+                  message: `No graph entities found for product "${product_id}". Run graph_ingest_requirements first.`,
+                  governance: governance2
+                }, null, 2)
               }]
             };
           }
@@ -10286,6 +10429,19 @@ ${JSON.stringify(metrics, null, 2)}` }
             }
           }
           if (rgrMatched.length === 0) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "revise",
+              reasons: [{
+                constraintId: "graph.binding.missing",
+                severity: "warning",
+                message: `No graph entity is bound to "${file_path}".`
+              }],
+              requiredActions: [
+                "Bind codebase entities using graph_bind_codebase/graph_bind_confirm.",
+                "Proceed with full delivery only if no bound entity is expected."
+              ],
+              executionPermission: requestedOutcome === "execute" ? "conditional" : "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -10293,7 +10449,8 @@ ${JSON.stringify(metrics, null, 2)}` }
                   strategy: "full",
                   phases: [{ name: "full", label: "Full Delivery", description: "No entity bound to this file. Deliver all constraints.", categories: [], constraint_count: 0 }],
                   total_constraints: 0,
-                  rationale: `No entity bound to "${file_path}". Cannot assess constraint complexity.`
+                  rationale: `No entity bound to "${file_path}". Cannot assess constraint complexity.`,
+                  governance: governance2
                 }, null, 2)
               }]
             };
@@ -10302,13 +10459,36 @@ ${JSON.stringify(metrics, null, 2)}` }
           const fileConstraints = rgrSubgraph?.constraints ?? [];
           const plan = planRgrPhases(fileConstraints);
           const complexity = assessComplexity(fileConstraints);
+          const branchNeeded = plan.strategy === "phased" && (complexity.critical_count > 0 || requestedOutcome === "execute");
+          const governance = buildGovernanceEnvelope({
+            decision: branchNeeded ? "branch" : "approved",
+            reasons: branchNeeded ? [{
+              constraintId: "rgr.phased.required",
+              severity: "high",
+              message: `${complexity.critical_count} critical constraint(s) across ${complexity.category_count} categories require phased comparison.`
+            }] : [{
+              constraintId: "rgr.plan.ready",
+              severity: "info",
+              message: "Plan assessed and ready for implementation sequencing."
+            }],
+            requiredActions: [
+              ...plan.strategy === "phased" ? ["Follow phased RGR execution order from this plan."] : ["Deliver full constraint set in a single pass."],
+              ...requestedOutcome === "execute" ? ["Request execution permission via request_execution_gate before downstream write/deploy actions."] : []
+            ],
+            executionPermission: requestedOutcome === "execute" ? "conditional" : "denied",
+            requiredBranches: branchNeeded ? [
+              { branchId: "A", instruction: "Prioritize functional progress (test_spec/functional) then apply NFR phases." },
+              { branchId: "B", instruction: "Prioritize security/performance constraints before broad implementation." }
+            ] : void 0
+          });
           return {
             content: [{
               type: "text",
               text: JSON.stringify({
                 ...plan,
                 entity: rgrMatched[0].name,
-                complexity
+                complexity,
+                governance
               }, null, 2)
             }]
           };
@@ -10379,6 +10559,157 @@ ${JSON.stringify(metrics, null, 2)}` }
           };
         }
         // ─────────────────────────────────────────────────────────────────
+        // REQUEST_EXECUTION_GATE
+        // ─────────────────────────────────────────────────────────────────
+        case "request_execution_gate": {
+          const { product_id, target_action, target_artifacts, based_on_step_ids = [], open_critical_findings = 0, touched_sensitive_paths = [], constraints_acknowledged = false } = args;
+          if (!product_id || !target_action || !Array.isArray(target_artifacts) || target_artifacts.length === 0) {
+            throw new McpError(ErrorCode.InvalidParams, "product_id, target_action, and non-empty target_artifacts are required");
+          }
+          const meta = await getGraphMetadata(product_id);
+          const completedPhases = meta?.rgr_completed_phases ?? [];
+          const metrics = meta?.metrics;
+          const unmetCheckpoints = [];
+          const blockingFindings = [];
+          const requiredNextSteps = [];
+          if (!completedPhases.includes("security")) {
+            unmetCheckpoints.push("security_commitment");
+            blockingFindings.push({
+              constraintId: "rgr.phase.security",
+              severity: "high",
+              message: "Security phase is not marked complete."
+            });
+            requiredNextSteps.push('Complete security remediation and call rgr_complete_phase(product_id, phase: "security").');
+          }
+          if (target_action === "deploy" && !completedPhases.includes("performance")) {
+            unmetCheckpoints.push("implementation_readiness");
+            blockingFindings.push({
+              constraintId: "rgr.phase.performance",
+              severity: "warning",
+              message: "Deploy requested before performance phase completion."
+            });
+            requiredNextSteps.push('Complete performance checks and call rgr_complete_phase(product_id, phase: "performance").');
+          }
+          if (open_critical_findings > 0) {
+            unmetCheckpoints.push("verification");
+            blockingFindings.push({
+              constraintId: "audit.findings.open",
+              severity: "critical",
+              message: `${open_critical_findings} unresolved critical/high findings are still open.`
+            });
+            requiredNextSteps.push("Resolve or explicitly accept outstanding critical/high findings before execution.");
+          }
+          if (touched_sensitive_paths.length > 0 && !constraints_acknowledged) {
+            unmetCheckpoints.push("implementation_readiness");
+            blockingFindings.push({
+              constraintId: "constraints.ack.required",
+              severity: "high",
+              message: "Sensitive paths were provided without explicit constraint acknowledgment."
+            });
+            requiredNextSteps.push("Run constraints_auto for touched sensitive paths and acknowledge applicable constraints.");
+          }
+          const hasBlocks = blockingFindings.some((f) => f.severity === "critical" || f.severity === "high");
+          const denied = hasBlocks && GOVERNANCE_ENFORCEMENT;
+          const decision = denied ? "blocked" : blockingFindings.length > 0 ? "conditional" : "approved";
+          const governance = buildGovernanceEnvelope({
+            decision: denied ? "blocked" : blockingFindings.length > 0 ? "revise" : "approved",
+            reasons: blockingFindings,
+            requiredActions: requiredNextSteps,
+            executionPermission: denied ? "denied" : blockingFindings.length > 0 ? "conditional" : "granted",
+            mode: GOVERNANCE_ENFORCEMENT ? "enforced" : "advisory"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: JSON.stringify({
+                decision,
+                unmetCheckpoints: [...new Set(unmetCheckpoints)],
+                blockingFindings,
+                requiredNextSteps,
+                based_on_step_ids,
+                product_id,
+                target_action,
+                target_artifacts,
+                governanceMode: GOVERNANCE_ENFORCEMENT ? "enforced" : "advisory",
+                readiness: {
+                  rgr_completed_phases: completedPhases,
+                  security_readiness_pct: metrics?.security_readiness_pct ?? null,
+                  engineering_readiness_pct: metrics?.engineering_readiness_pct ?? null
+                },
+                governance
+              }, null, 2)
+            }]
+          };
+        }
+        // ─────────────────────────────────────────────────────────────────
+        // SUBMIT_DONE_CLAIM
+        // ─────────────────────────────────────────────────────────────────
+        case "submit_done_claim": {
+          const { product_id, completion_summary, claimed_criteria_satisfied, known_limitations = [], evidence_refs = [], open_critical_findings = 0 } = args;
+          if (!product_id || !completion_summary || !Array.isArray(claimed_criteria_satisfied)) {
+            throw new McpError(ErrorCode.InvalidParams, "product_id, completion_summary, and claimed_criteria_satisfied are required");
+          }
+          const meta = await getGraphMetadata(product_id);
+          const completedPhases = meta?.rgr_completed_phases ?? [];
+          const unsatisfiedCriteria = [];
+          const blockingFindings = [];
+          const requiredNextSteps = [];
+          if (!completedPhases.includes("security")) {
+            unsatisfiedCriteria.push("Security phase completion not recorded.");
+            blockingFindings.push({
+              constraintId: "done.rgr.security_missing",
+              severity: "high",
+              message: "Cannot close work item before security phase completion."
+            });
+            requiredNextSteps.push('Complete and record security phase via rgr_complete_phase(product_id, phase: "security").');
+          }
+          if (evidence_refs.length === 0) {
+            unsatisfiedCriteria.push("No evidence references provided for completion claim.");
+            blockingFindings.push({
+              constraintId: "done.evidence.required",
+              severity: "warning",
+              message: "Done claims require evidence refs (tests, reports, or docs)."
+            });
+            requiredNextSteps.push("Provide evidence_refs for tests, audit reruns, or implementation verification.");
+          }
+          if (open_critical_findings > 0) {
+            unsatisfiedCriteria.push(`${open_critical_findings} unresolved critical/high findings remain.`);
+            blockingFindings.push({
+              constraintId: "done.critical_findings.open",
+              severity: "critical",
+              message: "Outstanding critical/high findings prevent closure."
+            });
+            requiredNextSteps.push("Resolve or explicitly disposition outstanding critical/high findings before closure.");
+          }
+          const hasHardBlock = blockingFindings.some((f) => f.severity === "critical" || f.severity === "high");
+          const decision = hasHardBlock ? "blocked" : unsatisfiedCriteria.length > 0 ? "incomplete" : "complete";
+          const governance = buildGovernanceEnvelope({
+            decision: hasHardBlock ? "blocked" : unsatisfiedCriteria.length > 0 ? "incomplete" : "approved",
+            reasons: blockingFindings,
+            requiredActions: requiredNextSteps,
+            executionPermission: "denied",
+            closePermission: decision === "complete" ? "granted" : "denied",
+            mode: GOVERNANCE_ENFORCEMENT ? "enforced" : "advisory"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: JSON.stringify({
+                decision,
+                closePermission: decision === "complete" ? "granted" : "denied",
+                completionSummary: completion_summary,
+                claimedCriteriaSatisfied: claimed_criteria_satisfied,
+                knownLimitations: known_limitations,
+                evidenceRefs: evidence_refs,
+                unsatisfiedCriteria,
+                blockingFindings,
+                requiredNextSteps,
+                governance
+              }, null, 2)
+            }]
+          };
+        }
+        // ─────────────────────────────────────────────────────────────────
         // GENERATE_CUTLINE_MD
         // ─────────────────────────────────────────────────────────────────
         case "generate_cutline_md": {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vibekiln/cutline-mcp-cli",
-    "version": "0.6.0",
+    "version": "0.8.0",
     "description": "CLI and MCP servers for Cutline — authenticate, then run constraint-aware MCP servers in Cursor or any MCP client.",
     "type": "module",
     "main": "dist/index.js",