@zerwiz/ymir 0.1.4 → 0.1.5

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/NSRcompliance/templates/compliance/harness/README.md

@@ -0,0 +1,11 @@
+# harness/ — __PROJECT__
+
+Local execution harness.
+
+## Files
+- `runner.py` — orchestrator (feature scripts + gates).
+- `envelopes/` — typed handoff schemas.
+
+## Rules
+- Runner invokes `.agents/skills/features/<feature>/*.sh` and evaluates exit codes.
+- Handoffs use typed envelopes.

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/NSRcompliance/templates/compliance/harness/envelopes/README.md

@@ -0,0 +1,10 @@
+# envelopes/ — __PROJECT__
+
+Typed inter-agent handoff schemas.
+
+## Files
+- `task_envelope.json` — standard task packet schema.
+
+## Rules
+- No unstructured text summaries between agents.
+- New envelope types added here before use.

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/NSRcompliance/templates/compliance/installer/README.md

@@ -0,0 +1,10 @@
+# installer/ — __PROJECT__
+
+Self-install tooling for the deterministic harness.
+
+## Files
+- `install.sh` — install the harness into a repo.
+
+## Rules
+- Single repeatable command to install `.compliance/`.
+- Installs config, gates, harness, envelopes, telemetry.

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/NSRcompliance/templates/compliance/installer/install.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# deterministic harness installer: stamp .compliance/ + the compliance skill into a target repo.
+#
+# Usage:
+#   install.sh [TARGET] [--source DIR] [--force] [--dry-run]
+#
+# - TARGET defaults to the current directory.
+# - SOURCE defaults to the compliance templates inside the NSR skill found upward from this
+#   script (any directory containing assets/compliance + assets/agents_skills).
+# - Never overwrites existing files unless --force.
+# - Post-condition: the installed harness is sanity-checked (runner loads, gates skipped
+#   existing). Single repeatable command; re-run doubles as a drift check.
+set -e
+
+TARGET="${1:-.}"
+SOURCE=""
+FORCE=0
+DRY=0
+
+usage() {
+  echo "Usage: install.sh [TARGET] [--source DIR] [--force] [--dry-run]"
+  exit 1
+}
+
+find_repo_root() {
+  local d; d="$(cd "$(dirname "$0")" && pwd)"
+  while [ "$d" != "/" ]; do
+    if [ -d "$d/.compliance" ]; then echo "$d"; return 0; fi
+    d="$(dirname "$d")"
+  done
+  return 1
+}
+
+find_source() {
+  local d repo
+  # 1. an ancestor that is itself a skill (assets/compliance + assets/agents_skills)
+  d="$(cd "$(dirname "$0")" && pwd)"
+  while [ "$d" != "/" ]; do
+    if [ -d "$d/assets/compliance" ] && [ -d "$d/assets/agents_skills" ]; then
+      echo "$d"; return 0
+    fi
+    d="$(dirname "$d")"
+  done
+  # 2. a skill dir inside the repo under .agents/skills/
+  repo="$(find_repo_root)" || return 1
+  for d in "$repo"/.agents/skills/*/; do
+    [ -d "$d" ] || continue
+    if [ -d "$d/assets/compliance" ] && [ -d "$d/assets/agents_skills" ]; then
+      echo "$d"; return 0
+    fi
+  done
+  return 1
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --source) SOURCE="$2"; shift 2 ;;
+    --force) FORCE=1; shift ;;
+    --dry-run) DRY=1; shift ;;
+    -h|--help) usage ;;
+    -*) echo "unknown option: $1"; usage ;;
+    *) TARGET="$1"; shift ;;
+  esac
+done
+
+if [ -z "$SOURCE" ]; then
+  SKILL_ROOT="$(find_source)" \
+    || { echo "error: cannot auto-discover source; pass --source DIR with assets/compliance + assets/agents_skills"; exit 1; }
+  SOURCE="$SKILL_ROOT/assets"
+fi
+
+[ -d "$SOURCE/compliance" ] || { echo "error: $SOURCE/compliance not found"; exit 1; }
+[ -d "$SOURCE/agents_skills/NSRcompliance" ] || { echo "error: $SOURCE/agents_skills/NSRcompliance not found"; exit 1; }
+
+mkdir -p "$TARGET"
+TARGET="$(cd "$TARGET" && pwd)"
+
+copy_tree() {
+  local src="$1" dst="$2"
+  mkdir -p "$dst"
+  for item in "$src"/*; do
+    [ -e "$item" ] || continue
+    local base; base="$(basename "$item")"
+    if [ -d "$item" ]; then
+      copy_tree "$item" "$dst/$base"
+    else
+      if [ -e "$dst/$base" ] && [ "$FORCE" -eq 0 ]; then
+        echo "[installer] SKIP (exists): ${dst#$TARGET/}/$base"
+        continue
+      fi
+      if [ "$DRY" -eq 1 ]; then
+        echo "[installer] would write: ${dst#$TARGET/}/$base"
+      else
+        cp "$item" "$dst/$base"
+        echo "[installer] wrote: ${dst#$TARGET/}/$base"
+      fi
+    fi
+  done
+}
+
+echo "[installer] installing harness -> $TARGET"
+copy_tree "$SOURCE/compliance" "$TARGET/.compliance"
+copy_tree "$SOURCE/agents_skills/NSRcompliance" "$TARGET/.agents/skills/NSRcompliance"
+chmod -R u+x "$TARGET/.compliance" "$TARGET/.agents/skills/NSRcompliance" 2>/dev/null || true
+
+if [ "$DRY" -eq 1 ]; then
+  echo "[installer] dry-run complete (nothing written)"
+  exit 0
+fi
+
+if [ ! -f "$TARGET/.compliance/harness/runner.py" ]; then
+  echo "[installer] FAIL: runner.py missing after install"
+  exit 1
+fi
+if [ ! -f "$TARGET/.compliance/harness/envelopes/task_envelope.json" ]; then
+  echo "[installer] FAIL: task envelope schema missing after install"
+  exit 1
+fi
+
+echo "[installer] sanity: runner loads"
+python3 "$TARGET/.compliance/harness/runner.py" --help >/dev/null 2>&1 \
+  || { echo "[installer] FAIL: runner.py did not load"; exit 1; }
+
+echo "[installer] DONE: harness at $TARGET/.compliance + compliance skill at $TARGET/.agents/skills/NSRcompliance"
+exit 0

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/NSRcompliance/templates/compliance/telemetry/README.md

@@ -0,0 +1,11 @@
+# telemetry/ — __PROJECT__
+
+Observability & cost tracking.
+
+## Files
+- `logger.py` — SQLite logger: writes `runs`/`events` to `runs.db`.
+- `runs.db` — generated local store (git-ignored).
+
+## Rules
+- Every run logs tokens, latency, tool calls, cost.
+- One data path: agents write to SQLite; readers poll SQLite (`logger.py query`).

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/README.md

@@ -0,0 +1,20 @@
+# .agents/skills/ — __PROJECT__
+
+Deterministic scripted automation layer. Zero ad-hoc shell commands — every operation runs through these skills.
+
+## Structure
+
+```
+.agents/skills/
+├── lifecycle/            # start.sh, stop.sh, status.sh, smoke_test.sh
+├── git_ops/              # create_branch.sh, safe_commit.sh, sync_upstream.sh
+├── features/             # <feature>/ (setup, test, smoke_test, rollback)
+└── compliance/              # Embedded Agent Skill Compliance
+```
+
+## Rules
+
+- Agents are forbidden from raw terminal commands.
+- Scripts exit `0` on success, non-zero on failure.
+- Each skill dir has a `SKILL.md` manifest.
+- Every project ships the full skill set per `docs/project-skills.md`.

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/features/README.md

@@ -0,0 +1,36 @@
+# features/ — __PROJECT__
+
+Feature-specific automation. One directory per feature registered in `FEATURES.md`.
+Each feature is a slot where the compliance can operate a real procedure of this project.
+Every feature registered in `FEATURES.md` (root) MUST have a matching skill directory
+here — this is how zero feature duplication and zero ad-hoc commands are enforced.
+
+## Layout
+
+```
+features/<feature>/
+├── SKILL.md         # Feature scope & script binding map
+├── setup.sh         # Environment/data bootstrap
+├── test.sh          # Feature-isolated test suite
+├── smoke_test.sh    # Feature health verification
+└── rollback.sh      # Teardown / emergency rollback
+```
+
+## Rules
+
+- Every feature has the five script domains (Lifecycle, Testing, Data & Setup, Source Control, Diagnostics) per `docs/project-skills.md`.
+- No feature may exist in `FEATURES.md` without a matching directory here.
+- **Register first, then wire:** add a row in `FEATURES.md`, create the directory, then bind the scripts to the app's real commands.
+- **Wire, never rewrite:** delegate to existing procedures (e.g., `scripts/...`, `mix test`, `npm test`, `pytest`) and add env + exit-code guards.
+- **Danger annotations:** a script that can delete data, migrate production, or force operations MUST start with a comment `# gate: dev|guard|human`. `check_danger.sh` fails on unannotated dangerous scripts; the runner refuses to auto-run `guard`/`human`.
+- **No stubs in production:** `check_wiring.sh --strict` must pass before agents are trusted. A stub script is `WIRE ME` until replaced.
+- Keep this file in sync via `.compliance/gates/verify_docs.py`.
+
+## Growth
+
+Adding a feature grows the compliance automatically: register it, wire its five scripts,
+and `runner.py --list` / `--plan --feature <name>` pick it up with no compliance changes.
+
+## Wiring walkthrough
+
+See `docs/BEST_PRACTICES/compliance-wiring.md`.

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/features/SKILL-template.md

@@ -0,0 +1,14 @@
+# SKILL.md — <feature>
+
+Feature: <feature>. Script binding map.
+
+## Scripts
+| Command | Script |
+|---------|--------|
+| setup | `setup.sh` |
+| test | `test.sh` |
+| smoke_test | `smoke_test.sh` |
+| rollback | `rollback.sh` |
+
+## Scope
+- *(feature scope)*

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/git_ops/README.md

@@ -0,0 +1,25 @@
+# git_ops/ — __PROJECT__
+
+Deterministic Git workflow. All source-control operations run through these scripts to protect repo history and enforce conventions.
+
+## What Goes Here
+
+- `SKILL.md` — Skill guidelines for Git operations.
+- `create_branch.sh` — Branch creation with proper naming & ticket linking.
+- `safe_commit.sh` — Pre-commit gates + commit message formatting.
+- `sync_upstream.sh` — Rebase & conflict checks.
+
+## File Pattern
+
+```
+git_ops/
+├── SKILL.md
+├── create_branch.sh
+├── safe_commit.sh
+└── sync_upstream.sh
+```
+
+## Rules
+
+- Git actions (branching, committing, rebasing) MUST go through these scripts — no bare `git commit -m ...`.
+- Pre-commit gates (lint, tests) run inside `safe_commit.sh` before anything is committed.

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/git_ops/SKILL.md

@@ -0,0 +1,13 @@
+# SKILL.md — git_ops
+
+Routing for Git operations.
+
+## Scripts
+| Command | Script | Usage |
+|---------|--------|-------|
+| create_branch | `create_branch.sh` | Create `feat/<feature>` / `fix/<ticket>` branch |
+| safe_commit | `safe_commit.sh` | Run gates, format message, commit |
+| sync_upstream | `sync_upstream.sh` | Rebase + conflict check + push |
+
+## Rules
+- Never run bare git commands outside these scripts.

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/git_ops/create_branch.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# STUB: create branch with naming + ticket link.
+set -e
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+echo "[git_ops/create_branch] stub: git checkout -b feat/<feature>-<ticket>"
+exit 0

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/git_ops/safe_commit.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# STUB: safe commit — pre-commit gates + formatted message.
+set -e
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+echo "[git_ops/safe_commit] stub: running pre-commit gates"
+bash "$ROOT/.compliance/gates/check_paths.sh"
+bash "$ROOT/.compliance/gates/check_platform.sh"
+echo "[git_ops/safe_commit] stub: git add + commit (conventional style)"
+exit 0

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/git_ops/sync_upstream.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# STUB: sync upstream — rebase + conflict check + push.
+set -e
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+echo "[git_ops/sync_upstream] stub: git fetch, rebase, conflict check, push"
+exit 0

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/lifecycle/README.md

@@ -0,0 +1,27 @@
+# lifecycle/ — __PROJECT__
+
+Application lifecycle automation. Predictable spin-up, teardown, and health verification.
+
+## What Goes Here
+
+- `SKILL.md` — Tool routing & skill guidelines for lifecycle operations.
+- `start.sh` — Safe application spin-up.
+- `stop.sh` — Graceful shutdown.
+- `status.sh` — Health check.
+- `smoke_test.sh` — Post-boot verification.
+
+## File Pattern
+
+```
+lifecycle/
+├── SKILL.md
+├── start.sh
+├── stop.sh
+├── status.sh
+└── smoke_test.sh
+```
+
+## Rules
+
+- No direct `kill` or manual background execution — always via these scripts.
+- Scripts must exit `0` on success, non-zero on failure (harness parses exit codes, not stdout).

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/lifecycle/SKILL.md

@@ -0,0 +1,15 @@
+# SKILL.md — lifecycle
+
+Routing for application lifecycle operations.
+
+## Scripts
+| Command | Script | Usage |
+|---------|--------|-------|
+| start | `start.sh` | Spin up the app for the configured env |
+| stop | `stop.sh` | Graceful shutdown |
+| status | `status.sh` | Health check |
+| smoke_test | `smoke_test.sh` | Post-boot verification |
+
+## Rules
+- Run only these scripts for lifecycle ops.
+- Exit codes are authoritative (`0` pass, non-zero fail).

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/lifecycle/smoke_test.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# WIRE ME — post-boot smoke verification. Runs AFTER start.sh returns healthy.
+#
+# Replace with a real end-to-end probe, e.g.:
+#   fetch the app's landing/health URL and assert a status code
+#   login round-trip or a read query against the real stack
+#   wrapper: delegate to existing scripts/.../smoke*.sh
+set -e
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+cd "$ROOT"
+echo "[lifecycle/smoke_test] WIRE ME: replace this stub with a real post-boot probe"
+exit 1

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/lifecycle/start.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# WIRE ME — start lifecycle. Bind this to your app's real boot command.
+#
+# Replace this stub with your stack's boot command, e.g.:
+#   Elixir/Phoenix:  exec mix phx.server
+#   Node:            exec npm run dev            (APP_ENV=prod -> npm run start)
+#   Python/Django:   exec python manage.py runserver 0.0.0.0:"${PORT:-8000}"
+#   Wrapper:         existing scripts/.../start*.sh delegated + guard
+#
+# Wrapping an existing procedure never rewrites it:
+#   [ "${APP_ENV:-development}" != "prod" ] || { scripts/cloudflare/startprod.sh; exit $?; }
+#   exec scripts/cloudflare/startdev.sh
+#
+# After wiring, prove it: .compliance/gates/check_wiring.sh --strict
+set -e
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+cd "$ROOT"
+echo "[lifecycle/start] WIRE ME: replace this stub with the app's real boot command (env=${APP_ENV:-development})"
+exit 1

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/lifecycle/status.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# WIRE ME — status/health check. Exit 0 = healthy, non-zero = down.
+#
+# Replace with your real health signal, e.g.:
+#   HTTP:   curl -fsS "http://${PHX_HOST:-localhost}:${PORT:-4000}/health"
+#   DB:     pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
+#   wrapper: delegate to existing scripts/.../status*.sh
+set -e
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+cd "$ROOT"
+echo "[lifecycle/status] WIRE ME: replace this stub with a real health check"
+exit 1

package/.agents/skills/nsr-compliance/assets/nsr/assets/agents_skills/lifecycle/stop.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# WIRE ME — stop lifecycle. Graceful shutdown. Never force-kill processes.
+#
+# Replace with your stack's graceful shutdown, e.g.:
+#   docker:    exec docker compose down
+#   systemd:   systemctl stop <service>
+#   wrapper:   existing scripts/.../stop*.sh delegated + guard
+#
+# Tip: keep a pidfile at runtime (write $! in start.sh) so stop.sh can
+# terminate exactly the process the compliance started.
+set -e
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+cd "$ROOT"
+echo "[lifecycle/stop] WIRE ME: replace this stub with the app's graceful shutdown"
+exit 1

package/.agents/skills/nsr-compliance/assets/nsr/assets/compliance/README.md

@@ -0,0 +1,18 @@
+# .compliance/ — __PROJECT__
+
+Deterministic harness engine. Programmatic guardrails for every agent run.
+
+## Structure
+```
+.compliance/
+├── config/         # core_four.yaml (Core Four)
+├── gates/          # check_env.sh, check_paths.sh, check_platform.sh
+├── harness/        # runner.py + envelopes/
+├── telemetry/      # logger.py
+└── installer/      # install.sh
+```
+
+## Rules
+- Code-based gates: `$? == 0`, never text parsing.
+- Typed envelopes for inter-agent handoffs.
+- Observability logged for every run.

package/.agents/skills/nsr-compliance/assets/nsr/assets/compliance/config/README.md

@@ -0,0 +1,10 @@
+# config/ — __PROJECT__
+
+Core Four configuration.
+
+## Files
+- `core_four.yaml` — Context, Model, Prompt, Tools per agent phase.
+
+## Rules
+- Everything governed via config; no agent discretion.
+- Read by `.compliance/harness/runner.py`.

package/.agents/skills/nsr-compliance/assets/nsr/assets/compliance/config/core_four.yaml

@@ -0,0 +1,13 @@
+core_four:
+  context:
+    default: "docs/features/*.md"
+    routing: "AGENTS.md, STRUCTURE.md, FEATURES.md"
+  model:
+    coding: "fast-cheap-model"
+    planning: "large-reasoning-model"
+  prompt:
+    system: "Follow AGENTS.md. No ad-hoc shell commands."
+  tools:
+    allowed_scripts: ".agents/skills/**"
+    forbidden: ["npm test", "git commit -m", "kill -9"]
+    handoff_format: "JSON/YAML typed envelopes"

package/.agents/skills/nsr-compliance/assets/nsr/assets/compliance/gates/README.md

@@ -0,0 +1,12 @@
+# gates/ — __PROJECT__
+
+Deterministic validation gates. Decided by exit code.
+
+## Files
+- `check_env.sh` — required env vars present.
+- `check_paths.sh` — no absolute paths.
+- `check_platform.sh` — POSIX-portable.
+
+## Rules
+- Gates evaluate by `$? == 0`.
+- Run before commit and before deploy.

package/.agents/skills/nsr-compliance/assets/nsr/assets/compliance/gates/check_danger.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# check_danger: validate that scripts may be run by the compliance, or are explicitly gated.
+#
+# Any script containing a dangerous primitive (data loss, force ops, shell
+# injection, destructive commands) MUST declare its blast radius in a comment:
+#
+#   # gate: dev    - safe for agents/automation in dev; human confirm in prod
+#   # gate: guard  - must not run until a required guard script passes
+#   # gate: human  - irreversible; agents must never run this alone
+#
+# A script with dangerous primitives and no # gate: annotation FAILS this check.
+#
+# Usage:
+#   check_danger.sh            # scan .agents/skills/{lifecycle,git_ops,features,compliance}
+#   check_danger.sh --path <f> # evaluate a single script in isolation
+set -e
+
+find_root() {
+  local d; d="$(cd "$(dirname "$0")" && pwd)"
+  while [ "$d" != "/" ]; do
+    if [ -d "$d/.agents" ]; then echo "$d"; return 0; fi
+    d="$(dirname "$d")"
+  done
+  return 1
+}
+
+ROOT="$(find_root)" || { echo "[check_danger] FAIL: no repo root (.agents/ not found upward)"; exit 1; }
+SINGLE_PATH=""
+
+DANGER_PRIMS=(
+  'rm[[:space:]]+-rf'
+  'rm[[:space:]]+-fr'
+  ':\(\)[[:space:]]*\{'
+  'kill[[:space:]]+-9'
+  'pkill'
+  'taskkill'
+  'git[[:space:]]+push[[:space:]]+--force'
+  'git[[:space:]]+reset[[:space:]]+--hard'
+  'DROP[[:space:]]+(TABLE|DATABASE)'
+  'TRUNCATE[[:space:]]+TABLE'
+  'dd[[:space:]]+if='
+  'mkfs'
+  'chmod[[:space:]]+-R[[:space:]]+777'
+  'curl[[:space:]].*\|[[:space:]]*sh'
+  'wget[[:space:]].*\|[[:space:]]*sh'
+)
+
+GATE_RE='^[[:space:]]*# gate:[[:space:]]*(dev|guard|human)([[:space:]]+.*|:|$)'
+
+has_danger() {
+  local f="$1" prim
+  for prim in "${DANGER_PRIMS[@]}"; do
+    grep -qiE "$prim" "$f" 2>/dev/null && return 0
+  done
+  return 1
+}
+
+has_gate() { grep -qiE "$GATE_RE" "$1" 2>/dev/null; }
+
+check_file() {
+  local f="$1" g
+  has_danger "$f" || return 0
+  if has_gate "$f"; then
+    g="$(grep -iE "$GATE_RE" "$f" | head -1 | sed -E 's/^[[:space:]]*//')"
+    echo "  OK   [gated] $g"
+    echo "        $f"
+  else
+    echo "  FAIL [ungated danger] $f"
+    echo "        contains a dangerous primitive but no '# gate:' annotation"
+    return 1
+  fi
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --path) SINGLE_PATH="$2"; shift 2 ;;
+    -h|--help) echo "usage: check_danger.sh [--path FILE]"; exit 0 ;;
+    -*) echo "unknown option: $1"; exit 1 ;;
+    *) SINGLE_PATH="$1"; shift ;;
+  esac
+done
+
+fail=0
+
+if [ -n "$SINGLE_PATH" ]; then
+  check_file "$SINGLE_PATH" || fail=1
+else
+  echo "[check_danger] scanning $ROOT/.agents/skills for dangerous primitives"
+  for f in "$ROOT"/.agents/skills/lifecycle/*.sh \
+           "$ROOT"/.agents/skills/git_ops/*.sh \
+           "$ROOT"/.agents/skills/features/*/*.sh; do
+    [ -f "$f" ] || continue
+    check_file "$f" || fail=1
+  done
+fi
+
+if [ "$fail" -ne 0 ]; then
+  echo "[check_danger] FAIL: dangerous scripts without a # gate: annotation"
+  exit 1
+fi
+echo "[check_danger] PASS: no undeclared dangerous scripts"
+exit 0

package/.agents/skills/nsr-compliance/assets/nsr/assets/compliance/gates/check_env.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Gate: verify required env vars are present (env-driven config).
+set -e
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+
+if [ -f "$ROOT/.env" ]; then
+  set -a; . "$ROOT/.env"; set +a
+fi
+
+REQUIRED=()
+[ -n "${REQUIRED_ENV:-}" ] && IFS=',' read -ra REQUIRED <<< "$REQUIRED_ENV" || true
+
+missing=0
+for var in "${REQUIRED[@]}"; do
+  if [ -z "${!var:-}" ]; then
+    echo "[check_env] MISSING: $var"
+    missing=1
+  fi
+done
+
+[ "$missing" -ne 0 ] && { echo "[check_env] FAIL"; exit 1; }
+echo "[check_env] PASS"
+exit 0

package/.agents/skills/nsr-compliance/assets/nsr/assets/compliance/gates/check_paths.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Gate: enforce RELATIVE filepaths only. Rejects absolute paths in scripts/configs.
+set -e
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT"
+
+violations=0
+for ext in sh py yaml yml json; do
+  for f in $(find . -type f -name "*.$ext" -not -path './.git/*' -not -path './.compliance/telemetry/*'); do
+    while IFS= read -r line; do
+      case "$line" in
+        /*|C:*|D:*) echo "[check_paths] ABSOLUTE PATH: $f -> $line"; violations=1 ;;
+      esac
+    done < "$f"
+  done
+done
+
+[ "$violations" -ne 0 ] && { echo "[check_paths] FAIL"; exit 1; }
+echo "[check_paths] PASS"
+exit 0

package/.agents/skills/nsr-compliance/assets/nsr/assets/compliance/gates/check_platform.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Gate: validate scripts are POSIX-portable (Mac/Linux/Windows).
+set -e
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT"
+
+violations=0
+for f in $(find . -type f -name "*.sh" -not -path './.git/*' -not -path './.compliance/gates/*' -not -path './.agents/skills/NSRcompliance/*' -not -path './.agents/skills/NSR/*' -not -path './.agents/skills/NSR-SKILLMAKER/*' -not -path './mockprojectroot/*'); do
+  for cmd in 'taskkill' 'pkill' 'kill -9'; do
+    if grep -qE "$cmd" "$f" 2>/dev/null; then
+      echo "[check_platform] NON-PORTABLE: $f uses '$cmd'"
+      violations=1
+    fi
+  done
+  if grep -q $'\r' "$f" 2>/dev/null; then
+    echo "[check_platform] CRLF in $f"
+    violations=1
+  fi
+done
+
+[ "$violations" -ne 0 ] && { echo "[check_platform] FAIL"; exit 1; }
+echo "[check_platform] PASS"
+exit 0