clembot-doorman 0.1.0 → 0.2.1

package/README.md

@@ -1,18 +1,31 @@
-<img src="logo.png" alt="Clembot Doorman" width="150" align="right">
+<p align="center">
+  <img src="media/hero.png" alt="Clembot Doorman - The Package Manager and Security Gate for AI Agents" width="100%">
+</p>
 
 # Clembot Doorman
 
-> **The Package Manager & Security Doorman for Clembot.**  
+> **The Package Manager & Security Doorman for AI Agents.**  
 > Inspect your build. Recommend vetted MCPs from prompt history. Block rogue tools before they reach context.
 
 [![Live Explainer & Simulator](https://img.shields.io/badge/Live%20Explainer-clembot--doorman.wanessalabs.com-green.svg)](https://clembot-doorman.wanessalabs.com)
 [![Gateway](https://img.shields.io/badge/Bazantic%20Gateway-active-blue.svg)](https://clembot-doorman.bazgateway.com)
-[![Tests](https://img.shields.io/badge/Tests-403%20passing-brightgreen.svg)](RUNBOOK.md)
+[![Tests](https://img.shields.io/badge/Tests-505%20passing-brightgreen.svg)](RUNBOOK.md)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
 ---
 
-## TL;DR · What is Clembot Doorman?
+### 🏆 ETHOnline 2026 Prize Tracks & Judge Quick-Links
+
+| Track | Prize | Artifact / Manifest | What It Demonstrates |
+|---|---|---|---|
+| **Bazantic · Agentify an API** | $500 / 300 / 200 | [`01-vet-mcp-candidate.json`](./bazantic/recipes/01-vet-mcp-candidate.json) | Agentifies our live OpenAPI 3.1 `mcp-scorecard` service into an autonomous pre-flight tool that evaluates untrusted MCP servers before adoption. |
+| **Bazantic · Continuity** | 2×$500 | [`02-deepwiki-pinned-researcher.json`](./bazantic/recipes/02-deepwiki-pinned-researcher.json) | **87.6% Context Token Reduction**: Crushes 3,400 tokens of raw DeepWiki schema bloat down to 420 tokens using Doorman's cached pinned recipe. |
+| **Bazantic · Best Multi-API Recipe** | $500 / 300 / 200 | [`03-governance-pipeline.json`](./bazantic/recipes/03-governance-pipeline.json) | **3-Gateway Autonomous Pipeline**: Audits tool safety → Settles $0.01 audit micropayment on Base mainnet via x402 → Pins SHA-256 hash to allowlist. |
+| **Base · x402 Micropayments** | Sponsor Track | [`mcp-scorecard/src/routes/spend.ts`](./mcp-scorecard/src/routes/spend.ts) | Real $0.01 per-audit micropayment settlement using EIP-712 spend permits on Base mainnet. |
+
+> **Judge Portals**: [Live Interactive Simulator](https://clembot-doorman.wanessalabs.com/#flow) · [Bazantic Showcase Page](https://clembot-doorman.wanessalabs.com/bazantic.html#recipes) · [ETHOnline Judging Criteria](https://clembot-doorman.wanessalabs.com/judges.html) · [2-Minute Verification Runbook](RUNBOOK.md)
+
+---
 
 **Clembot is built in many versions, with the latest utilizing Claude Code and a custom combination of agent harnesses.** While AI agents need tools to do real work, loading raw MCP servers blindly introduces **in-context steering ads**, prompt injection risks, and token-draining schema hallucination. 
 
@@ -23,12 +36,62 @@
 3. **Arm with Bazantic Recipes (`recipe.md`)**  
    Turns raw, unpredictable APIs into bounded, high-performing tools via structured `recipe.md` guidance. Built and verified against the Bazantic gateway (`clembot-doorman.bazgateway.com`).
 
-![The doorman declining a server it just graded F](media/doorman-decline.gif)
+![Clembot Doorman live interactive flow and tool governance demo](media/doorman-demo.gif)
 
 *A real run against a real server. The grade, the hard fail, and the arithmetic are live values, not a mockup: `webzum.com/api/mcp` scores **89.9% on configuration** and still fails, because one tool description injects **6,290 characters of unprompted upsell and competitor steering** directly into your agent's context window. One cent through the Bazantic gateway answered a question that would have cost $54.47 to measure in an unguided LLM loop. [Run it live in the simulator](https://clembot-doorman.wanessalabs.com/#flow).*
 
 ---
 
+## 📸 Architecture & Platform Gallery
+
+<table>
+  <tr>
+    <td width="50%" align="center" valign="top">
+      <a href="media/gallery-03-two-phase-solution.png"><img src="media/gallery-03-two-phase-solution.png" alt="2 phase solution with Clembot Doorman" width="100%"></a><br>
+      <b>2-Phase Defense Solution with Clembot Doorman</b><br>
+      <i>$0.00 local pre-screening before $0.01 Base mainnet verification</i>
+    </td>
+    <td width="50%" align="center" valign="top">
+      <a href="media/gallery-04-tiered-architecture.png"><img src="media/gallery-04-tiered-architecture.png" alt="Tiered Clembot-doorman Architecture" width="100%"></a><br>
+      <b>Tiered Clembot-Doorman Architecture</b><br>
+      <i>Four modular layers (L0 Doctor → L1 Needs → L2 Offline Gate → L3 Scorecard)</i>
+    </td>
+  </tr>
+  <tr>
+    <td width="50%" align="center" valign="top">
+      <a href="media/gallery-01-bazantic-gateway.png"><img src="media/gallery-01-bazantic-gateway.png" alt="Bazantic doorman gateway" width="100%"></a><br>
+      <b>Bazantic Doorman Gateway</b><br>
+      <i>Live edge gateway (<code>clembot-doorman.bazgateway.com</code>) with 10 managed tools</i>
+    </td>
+    <td width="50%" align="center" valign="top">
+      <a href="media/gallery-02-bazantic-recipes.png"><img src="media/gallery-02-bazantic-recipes.png" alt="Bazantic recipes" width="100%"></a><br>
+      <b>Bazantic Recipes</b><br>
+      <i>Three published production recipes delivering 87% context token reduction</i>
+    </td>
+  </tr>
+  <tr>
+    <td width="50%" align="center" valign="top">
+      <a href="media/gallery-05-powered-by-bazantic.png"><img src="media/gallery-05-powered-by-bazantic.png" alt="Powered by Bazantic" width="100%"></a><br>
+      <b>Powered by Bazantic</b><br>
+      <i>Deep technical integration: Continuity, Edge Infrastructure, and Cryptographic Allowlisting</i>
+    </td>
+    <td width="50%" align="center" valign="top">
+      <a href="media/gallery-06-doorman-demo.png"><img src="media/gallery-06-doorman-demo.png" alt="Doorman demo" width="100%"></a><br>
+      <b>Doorman Demo</b><br>
+      <i>Interactive flow testing real MCPs with toggleable Base x402 micropayments</i>
+    </td>
+  </tr>
+  <tr>
+    <td colspan="2" align="center" valign="top">
+      <a href="media/gallery-07-clembot-org-chart.png"><img src="media/gallery-07-clembot-org-chart.png" alt="Clembot org chart" width="100%"></a><br>
+      <b>Clembot Organization Chart</b><br>
+      <i>27 autonomous agents across 5 divisions: Design Director is the sole surface gated by Doorman</i>
+    </td>
+  </tr>
+</table>
+
+---
+
 ## What this is for
 
 Doorman measures whether a candidate tool actually helps **your** agent, and gives you a report about **your** build.
@@ -66,6 +129,7 @@ The verdict is yours, produced on your machine, from numbers we never receive.
 | `site/` | The live product & explainer at [clembot-doorman.wanessalabs.com](https://clembot-doorman.wanessalabs.com). |
 | `fixtures/planted-bad-mcp/` | A deliberately hostile MCP server, deployed, so the demo denies something real instead of a line in a JSON file. |
 
+<a id="install"></a>
 ## Quickstart & Installation
 
 **The answer depends on your stack, so run it on yours.**
@@ -106,20 +170,25 @@ components that never register:
 claude plugin details clembot-doorman
 #   Skills (3)  doorman, doorman-guide, vet
 #   Agents (1)  doorman
-#   Hooks (1)   PreToolUse
+#   Hooks (2)   PreToolUse, SessionStart
 #   MCP servers (1)  scorecard
 ```
 
-### 2. The CLI: doctor, needs, report, watch, eval
+### 2. The CLI: doctor, needs, report, watch, notify, eval
 
 ```bash
-git clone https://github.com/clemenswan/clembot-doorman
-npm i -g ./clembot-doorman
+npm i -g clembot-doorman
 doorman --version
 ```
 
 Node 20+. Zero runtime dependencies, deliberately: every dependency is one more thing that can fail to install on your machine.
 
+**`notify` and the SessionStart hook need 0.2.0 or later.** The 0.1.0 on npm was
+published before they landed, so `doorman --version` reporting `0.1.0` means the
+push half is absent and no session will ever announce anything. Nothing errors:
+that build simply stays quiet forever, which is indistinguishable from having no
+news.
+
 **New here?** [`WALKTHROUGH.md`](WALKTHROUGH.md) runs the first ten minutes
 against three real builds: one with a long history, one brand new, and one in
 between. The output in it is captured from real runs, not written by hand.
@@ -320,6 +389,54 @@ Doorman is specifically designed to stop "skill sprawl" and prevent duplicate to
 2. **Adverse Drift Detection (`doorman watch`)**:
    When you run `doorman watch`, any candidate server already in your inventory is tagged `already-installed`. If an installed server is downgraded or caught with prompt injection on the feed, `watch` raises an immediate security alert.
 
+2a. **Push, without a daemon and without telemetry**:
+   Nobody can push to a laptop behind NAT that is asleep half the day, so the
+   push here is not a new transport. It is the poll going invisible. A
+   SessionStart hook prints a digest that is already on disk, then fires a
+   detached refresh so the next session is current. The hook makes no network
+   call: one that waited on a fetch would make every session start as slow as
+   the worst network it has seen, and offline would make them all fail.
+
+   ```text
+   ## doorman
+
+   1 newly graded server this build does not have:
+   - **A** 85.71/100, model not recorded https://mcp.deepwiki.com/mcp
+     not measured: behavioral, guidance
+   ```
+
+   Three rules, and each one is a notification product failing if broken. It
+   is **silent when nothing is new**, because a hook that reports "nothing new"
+   every morning teaches you to skip past the one morning it matters. It
+   **announces nothing on the first run**, because with no cursor the feed
+   returns everything graded so far and 26 rows is a catalogue, not news. And a
+   digest is **shown exactly once**, because the same three servers every
+   morning is how a notification becomes furniture.
+
+2b. **Popularity and trend, as a second axis (`GET /feed`, `?sort=trending`)**:
+   Every feed row carries a `popularity` block: Smithery use counts, npm weekly
+   downloads and GitHub stars, swept daily, with a median percentile and a
+   trend.
+
+   It is **never part of the score**. The grade is what happened when an agent
+   drove the server; popularity is how many people installed it without asking
+   that. A popular F is the most useful row this feed can publish, and a
+   blended number is the one thing guaranteed to bury it.
+
+   Counts are **ranked within each source and never summed across them**:
+   87,579 Smithery uses, 4,200 npm downloads and 1,100 stars are three units
+   counting three populations, and adding them makes a meaningless number that
+   still sorts confidently. `sources_measured` says how many sources backed the
+   percentile, because a server ranked on one and a server ranked on three are
+   not equally known. A trend needs two readings at least 12 hours apart, so a
+   newly tracked server reports `null` rather than zero growth, and a source
+   that could not be read is **absent rather than zero**.
+
+   **Doorman's own install counts are refused as a fourth source.** They would
+   be the best popularity signal available to anyone, and collecting them needs
+   telemetry. That would sell the guarantee that makes `watch` and `needs`
+   worth running at all: your inventory never leaves your machine.
+
 3. **Frontmatter Arithmetic (30 KB vs 640 KB)**:
    Doorman reads only YAML frontmatter (`name`, `description`) from `.claude/skills/*/SKILL.md` and `.claude/agents/*.md`. In our production vault, reading full markdown bodies was **642 KB**; reading frontmatter was **30 KB**. This allows the complete roster to be reviewed by a model in a single prompt without bloating context.
 
@@ -645,13 +762,20 @@ node runner/run.mjs --once --server https://mcp.deepwiki.com/mcp \
   --needed-for "look up how a public repository works" \
   --static-only --out ../evidence/deepwiki
 
-# Full behavioural run (needs a key)
-export ANTHROPIC_API_KEY=...
+# Full behavioural run (needs a key).
+# `=...` is NOT a value: read the secret in rather than pasting a placeholder,
+# which also keeps it out of shell history. A pasted "..." reaches the server
+# as a wrong token and comes back 401, which reads as a broken credential
+# rather than as a placeholder nobody substituted.
+read -rsp 'ANTHROPIC_API_KEY: ' ANTHROPIC_API_KEY && export ANTHROPIC_API_KEY
+# --once PRINTS ONLY. Add --out DIR to keep the evidence bundle, or queue the
+# audit and use --poll below to publish it to the feed.
 node runner/run.mjs --once --server https://mcp.deepwiki.com/mcp \
-  --needed-for "look up how a public repository works"
+  --needed-for "look up how a public repository works" --out out/deepwiki
 
 # Poll the queue
-export RUNNER_TOKEN=... SCORECARD_API=http://127.0.0.1:8799
+read -rsp 'RUNNER_TOKEN: ' RUNNER_TOKEN && export RUNNER_TOKEN
+export SCORECARD_API=http://127.0.0.1:8799
 node runner/run.mjs --poll
 ```
 

package/WALKTHROUGH.md

@@ -5,6 +5,8 @@ captured from an actual run on 2026-09-11 against the live feed, not written by
 hand. Where a run produced nothing useful, that is shown too, because "nothing
 matched" is a result and hiding it would make this document a brochure.
 
+![Clembot Doorman live interactive demo walkthrough](media/doorman-demo.gif)
+
 ---
 
 ## Install both halves
@@ -13,8 +15,7 @@ matched" is a result and hiding it would make this document a brochure.
 claude plugin marketplace add clemenswan/clembot-doorman
 claude plugin install clembot-doorman     # the gate, /doorman, /vet, the subagent
 
-git clone https://github.com/clemenswan/clembot-doorman
-npm i -g ./clembot-doorman                # doctor, needs, report, watch, eval
+npm i -g clembot-doorman                  # doctor, needs, report, watch, eval
 ```
 
 Check what actually loaded. A manifest can validate and still ship components

package/doorman/.claude/hooks/session-notify.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+#
+# SessionStart hook. The visible half of the push model.
+#
+# Prints a digest that is ALREADY ON DISK, then fires a detached refresh so the
+# next session is current. It makes no network call itself, which is the whole
+# design: a SessionStart hook that waits on a fetch makes every session start as
+# slow as the worst network it has ever seen, and offline it makes them fail.
+# The cost of this hook on a normal morning is one `test -f` and one `cat`.
+#
+# THIS IS NOT THE GATE. `mcp-gate.sh` is a security control and is offline,
+# dependency-free, and fails CLOSED with exit 2. This is a notification and
+# fails OPEN and silent: it always exits 0, and every failure path prints
+# nothing. A notifier that can break a session start is worse than no notifier.
+#
+# ponytail: the refresh rides on session start, so the first session after
+# install prints nothing (no digest yet) and news is at most one session stale.
+# A background poller (`doorman watch --poll`, roadmap Phase 2) would close that
+# gap and is not worth a daemon yet.
+
+set -uo pipefail
+
+# Never let this hook be the reason a session fails to start.
+trap 'exit 0' ERR
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+DIGEST="$PROJECT_DIR/.doorman/notify.md"
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RESOLVE="$HERE/../../scripts/resolve-cli.sh"
+
+# 1. Say what is already known. Reading is destructive: consume-once is what
+#    stops the same three servers being announced every morning until they are
+#    furniture. `notify consume` does the delete.
+if [ -f "$DIGEST" ]; then
+  CLI=""
+  [ -x "$RESOLVE" ] && CLI="$(bash "$RESOLVE" 2>/dev/null || true)"
+  if [ -n "$CLI" ] && [ "$CLI" != "NOT_FOUND" ]; then
+    $CLI notify consume --digest "$DIGEST" 2>/dev/null || true
+  else
+    # No CLI resolved. Print it anyway and remove it by hand rather than
+    # holding news hostage to a resolution problem.
+    cat "$DIGEST" 2>/dev/null || true
+    rm -f "$DIGEST" 2>/dev/null || true
+  fi
+fi
+
+# 2. Refresh for next time, detached.
+#
+# stdout and stderr MUST be redirected away from this process. A background
+# child that inherits the hook's stdout keeps the pipe open, and the harness
+# waits on the pipe rather than on the process, so an unredirected `&` turns a
+# fire-and-forget into the exact session-start stall this design avoids.
+if [ -z "${DOORMAN_NO_REFRESH:-}" ]; then
+  CLI="${CLI:-}"
+  if [ -z "$CLI" ] && [ -x "$RESOLVE" ]; then
+    CLI="$(bash "$RESOLVE" 2>/dev/null || true)"
+  fi
+  if [ -n "$CLI" ] && [ "$CLI" != "NOT_FOUND" ]; then
+    LOG="$PROJECT_DIR/.doorman/notify.log"
+    mkdir -p "$PROJECT_DIR/.doorman" 2>/dev/null || true
+    nohup $CLI notify refresh --root "$PROJECT_DIR" >"$LOG" 2>&1 &
+    disown 2>/dev/null || true
+  fi
+fi
+
+exit 0

package/doorman/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "clembot-doorman",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "A gate on what your agent is allowed to use. Blocks MCP servers that are not on your trust list, reads your prompt history to find what the build actually needs, and grades candidates before you install them.",
   "author": {
     "name": "Clemens Wan",

package/doorman/cli/audit.mjs

@@ -0,0 +1,232 @@
+/**
+ * `doorman audit` — Unified security audit & tool recommendation report.
+ *
+ * Combines three layers in one fast, local sweep:
+ *   1. L0 doctor: Inspects your harness, gate wiring, and installed MCP servers.
+ *   2. L0.5 needs: Scans local prompt history to detect missing capability needs.
+ *   3. L2 watch: Cross-references unmet gaps against the public graded feed.
+ *
+ * Output: An actionable, executive-grade posture and tool recommendation report.
+ * Free, offline-first, zero runtime dependencies.
+ */
+
+import { resolve } from 'node:path';
+import { writeFileSync } from 'node:fs';
+import { doctor } from './doctor.mjs';
+import { needs as readNeeds } from './needs.mjs';
+import { watch } from './watch.mjs';
+
+export async function auditProject(targetDir = process.cwd(), opts = {}) {
+  const absRoot = resolve(targetDir);
+
+  // 1. Run Doctor (L0: Harness, Gate, Installed servers)
+  const doc = await doctor(absRoot, opts);
+  if (!doc.ok) {
+    return { ok: false, why: doc.why };
+  }
+
+  // 2. Run Needs (L0.5: Prompt history scan for capability gaps)
+  let needsResult = null;
+  try {
+    needsResult = await readNeeds({
+      root: absRoot,
+      historyDir: opts.historyDir,
+      candidateFile: opts.candidateFile,
+      api: opts.api,
+    });
+  } catch {
+    needsResult = null;
+  }
+
+  // 3. Run Watch (L2: Classified feed of newly graded tools & threats)
+  let watchResult = null;
+  try {
+    watchResult = await watch({
+      root: absRoot,
+      api: opts.api,
+      all: true,
+    });
+  } catch {
+    watchResult = null;
+  }
+
+  // Synthesize executive findings
+  const gateStatus = doc.gate?.verdict || 'unknown';
+  const isGateWired = gateStatus === 'installed and wired' || gateStatus.includes('wired');
+  const harnesses = (doc.harnesses || []).map((h) => h.harness);
+  const installedCount = (doc.servers || []).length;
+
+  const gaps = (needsResult?.matches || []).filter((m) => m.status === 'GAP' || m.status === 'UNMET');
+  const covered = (needsResult?.matches || []).filter((m) => m.status === 'COVERED');
+
+  const candidates = watchResult?.candidates || [];
+  const recommended = candidates
+    .filter((c) => (c.grade === 'A' || c.grade === 'B') && c.verdict === 'unreviewed' && !c.is_fixture && !c.self_graded)
+    .slice(0, 5);
+
+  const blockedThreats = candidates
+    .filter((c) => c.grade === 'F' || c.hard_fail || c.verdict === 'blocked')
+    .slice(0, 3);
+
+  const result = {
+    ok: true,
+    root: absRoot,
+    timestamp: new Date().toISOString(),
+    posture: {
+      gateStatus,
+      isGateWired,
+      harnesses,
+      installedCount,
+      agentsCount: doc.agents?.count ?? 0,
+    },
+    needs: {
+      totalPrompts: needsResult?.promptCount ?? 0,
+      gaps,
+      covered,
+    },
+    recommendations: recommended,
+    threats: blockedThreats,
+  };
+
+  if (opts.out) {
+    const md = renderAuditMarkdown(result);
+    writeFileSync(opts.out, md, 'utf8');
+    result.outFile = opts.out;
+  }
+
+  return result;
+}
+
+export function renderAuditMarkdown(res) {
+  const lines = [];
+  lines.push('# Clembot Doorman Security & Tool Recommendation Report');
+  lines.push(`\n**Target:** \`${res.root}\``);
+  lines.push(`**Generated:** ${res.timestamp}`);
+  lines.push('');
+
+  // Posture
+  lines.push('## 1. Security & Gate Posture');
+  const gateIcon = res.posture.isGateWired ? 'PASS' : 'WARN';
+  lines.push(`- **Gate Status:** [${gateIcon}] ${res.posture.gateStatus}`);
+  lines.push(`- **Harnesses Detected:** ${res.posture.harnesses.join(', ') || 'none'}`);
+  lines.push(`- **Reachable MCP Servers:** ${res.posture.installedCount}`);
+  lines.push(`- **Subagents Configured:** ${res.posture.agentsCount}`);
+  lines.push('');
+
+  // Recommendations based on needs
+  lines.push('## 2. Capability Needs & Tool Recommendations');
+  if (res.needs.gaps.length > 0) {
+    lines.push('Your prompt history reveals the following unmet tool capabilities:');
+    for (const g of res.needs.gaps) {
+      lines.push(`- **${g.title}:** ${g.promptsCount} prompt(s) reaching for this capability.`);
+      if (g.topCandidates && g.topCandidates.length > 0) {
+        for (const c of g.topCandidates.slice(0, 2)) {
+          lines.push(`  → Recommended: **${c.name || c.url}** (${c.grade ? `Grade ${c.grade}` : 'verified'})`);
+        }
+      }
+    }
+  } else {
+    lines.push('- No active capability gaps detected in prompt history.');
+  }
+  lines.push('');
+
+  if (res.recommendations.length > 0) {
+    lines.push('### Top Verified Safe MCP Servers');
+    for (const r of res.recommendations) {
+      const score = typeof r.score === 'number' ? `${r.score.toFixed(1)}/100` : 'passing';
+      lines.push(`- **${r.server_name || r.server_url}** — Grade **${r.grade}** (${score})`);
+      lines.push(`  \`${r.server_url}\``);
+    }
+    lines.push('');
+  }
+
+  // Threats
+  lines.push('## 3. Threat Intelligence');
+  if (res.threats.length > 0) {
+    lines.push('The following servers failed security inspection and are blocked at the gate:');
+    for (const t of res.threats) {
+      const reason = t.hard_fail || 'Failed safety scan / commercial steering detected';
+      lines.push(`- ⚠️ **${t.server_name || t.server_url}** — Grade **${t.grade}** [BLOCKED]: ${reason}`);
+    }
+  } else {
+    lines.push('- No active threat flags recorded on your trust list.');
+  }
+  lines.push('');
+
+  // Next Steps
+  lines.push('## 4. Recommended Actions');
+  if (!res.posture.isGateWired) {
+    lines.push('1. **Wire the security gate:** `claude plugin marketplace add clemenswan/clembot-doorman && claude plugin install clembot-doorman`');
+  }
+  lines.push('2. **Vet new candidate servers before adoption:** `/vet <url>`');
+  lines.push('3. **Allow trusted servers:** `doorman allow <server-name>`');
+  lines.push('4. **Schedule recurring audits:** `doorman schedule`');
+
+  return lines.join('\n');
+}
+
+export function renderAudit(res) {
+  const lines = [];
+  lines.push('');
+  lines.push('================================================================');
+  lines.push('          CLEMBOT DOORMAN · UNIFIED AUDIT & RECOMMENDATIONS     ');
+  lines.push('================================================================');
+  lines.push(`Build: ${res.root}`);
+  lines.push('');
+
+  // 1. Security Posture
+  lines.push('── 1. SECURITY POSTURE ─────────────────────────────────────────');
+  const gateMark = res.posture.isGateWired ? '✓' : '!';
+  lines.push(`  [${gateMark}] Gate: ${res.posture.gateStatus}`);
+  lines.push(`  [i] Harness: ${res.posture.harnesses.join(', ') || 'None declared'}`);
+  lines.push(`  [i] Reachable MCP Tools: ${res.posture.installedCount} declared`);
+  lines.push('');
+
+  // 2. Capability Recommendations
+  lines.push('── 2. CAPABILITY GAPS & RECOMMENDED TOOLS ──────────────────────');
+  if (res.needs.gaps.length > 0) {
+    lines.push(`  Detected ${res.needs.gaps.length} capability gap(s) from prompt history:`);
+    for (const g of res.needs.gaps) {
+      lines.push(`  • ${g.title} (${g.promptsCount} prompt asks)`);
+    }
+  } else {
+    lines.push('  No unmet capability gaps detected.');
+  }
+
+  if (res.recommendations.length > 0) {
+    lines.push('');
+    lines.push('  Top Vetted Candidates from Graded Feed:');
+    for (const r of res.recommendations) {
+      const score = typeof r.score === 'number' ? `${r.score.toFixed(1)}/100` : '';
+      lines.push(`  → [Grade ${r.grade} · ${score}] ${r.server_name || 'Server'}`);
+      lines.push(`    URL: ${r.server_url}`);
+    }
+  }
+  lines.push('');
+
+  // 3. Blocked Threats
+  lines.push('── 3. THREATS BLOCKED AT THE GATE ──────────────────────────────');
+  if (res.threats.length > 0) {
+    for (const t of res.threats) {
+      lines.push(`  ✗ [Grade ${t.grade}] ${t.server_name || t.server_url}`);
+      if (t.hard_fail) lines.push(`    Reason: ${t.hard_fail}`);
+    }
+  } else {
+    lines.push('  No active security alerts on installed servers.');
+  }
+  lines.push('');
+
+  // 4. Quick Actions
+  lines.push('── 4. QUICK ACTIONS ────────────────────────────────────────────');
+  if (!res.posture.isGateWired) {
+    lines.push('  • Wire Gate:   claude plugin install clembot-doorman');
+  }
+  lines.push('  • Vet Tool:    /vet <candidate_url>');
+  lines.push('  • Trust Tool:  doorman allow <server_name>');
+  lines.push('  • Schedule:    doorman schedule');
+  if (res.outFile) {
+    lines.push(`  • Report:      Saved to ${res.outFile}`);
+  }
+  lines.push('');
+  return lines.join('\n');
+}

package/doorman/cli/doorman.mjs

@@ -16,6 +16,7 @@
   doorman needs [path]               read this build's own prompt history, propose servers.
  *   doorman watch [path]               poll the feed for candidates new to THIS build.
  *   doorman discover                   sweep a public directory for candidates. Curate, never enqueue.
+ *   doorman notify refresh|consume     the SessionStart push. Called by the hook, not by hand.
  *
  * Zero runtime dependencies, per the requirement in package.json. That is why
  * the YAML loader and the arg parser are in-tree rather than installed.
@@ -29,12 +30,49 @@ import { discover, renderDiscover, writeCandidates } from './discover.mjs';
 import { needs as readNeeds, render as renderNeedsCli } from './needs.mjs';
 import { install, renderInstall } from './install.mjs';
 import { allow, renderAllow, SCOPES } from './allow.mjs';
-
-const VERSION = '0.1.0';
+import { refreshNotify, consumeDigest, DEFAULT_DIGEST } from './notify.mjs';
+import { auditProject, renderAudit } from './audit.mjs';
+import { schedule as scheduleReport, renderSchedule } from './schedule.mjs';
+import { join } from 'node:path';
+
+// Pinned to every other declaration by version.test.mjs. There are FOUR of
+// them (root package.json, doorman/package.json, plugin.json, this) and this
+// one silently reported 0.1.0 out of a 0.2.0 tarball.
+const VERSION = '0.2.1';
+
+const QUICKSTART = `
+doorman ${VERSION} — Security gate & tool package manager for AI agents
+
+QUICKSTART (3 SIMPLE STEPS):
+  1. doorman audit        Run full build check & get vetted MCP recommendations
+  2. /vet <url>           Audit an untrusted candidate MCP server before adoption
+  3. doorman schedule     Configure automated weekly/daily audit reports
+
+COMMON COMMANDS:
+  doorman audit [path]    Unified scan: doctor + prompt needs + recommended tools
+  doorman schedule        Configure recurring automated reports (cron, GitHub Actions)
+  doorman doctor [path]   L0 build & gate inspection (free, offline, <5ms)
+  doorman needs [path]    L0.5 scan prompt history for missing capabilities
+  doorman watch [path]    Check public feed for newly graded tools
+  doorman allow <server>  Trust an MCP server by name on your local allowlist
+  doorman install [path]  Install the gate & hooks into this project
+
+Run \`doorman --help\` for full manual and advanced benchmark flags.
+`;
 
 const HELP = `
 doorman ${VERSION} — measure a candidate, do not just read it
 
+  doorman audit [path] [--out FILE] [--json]
+      Unified security audit & capability recommendations. Runs doctor,
+      prompt-history needs, and watch in one fast command. Produces an
+      executive report with security posture, capability gaps, and top
+      verified tools.
+
+  doorman schedule [path] [--github]
+      Set up automated recurring audit reports via GitHub Actions, system
+      cron, or session-notify hooks.
+
   doorman doctor [path]
       L0. What is in YOUR build: which harness, which MCP servers your agents can
       reach, how many subagents hold MCP tools, and whether the gate is installed
@@ -58,6 +96,12 @@ doorman ${VERSION} — measure a candidate, do not just read it
       a match is only ever worth-measuring. Nothing here drove anything, so
       nothing here claims a server will work. Only eval answers that.
 
+  doorman notify refresh [--root DIR]   |   doorman notify consume [--digest FILE]
+      The push half, and the SessionStart hook is what calls it. refresh polls
+      the feed and leaves a short digest on disk; consume prints that digest
+      and deletes it. Nothing is announced on the first run, nothing is written
+      when nothing is new, and a digest is shown exactly once.
+
   doorman report <link> [--out DIR] [--needed-for TEXT]
       L1. The static implementation report: protocol, schemas, annotations, and
       a scan-only pass over every description an agent would read before
@@ -113,7 +157,7 @@ Options
  */
 const BOOLEAN_FLAGS = new Set([
   'json', 'dry-run', 'all', 'estimate', 'help', 'version', 'allow-network',
-  'static-only', 'no-feed',
+  'static-only', 'no-feed', 'github', 'cron', 'weekly',
 ]);
 
 function parseArgs(argv) {
@@ -137,12 +181,34 @@ const log = (m) => console.error(`${new Date().toISOString().slice(11, 19)} ${m}
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (args.version) { console.log(VERSION); return; }
-  if (args.help || args._.length === 0) { console.log(HELP); return; }
+  if (args.help) { console.log(HELP); return; }
+  if (args._.length === 0) { console.log(QUICKSTART); return; }
 
-  // `doctor` is the one command that needs no link: it reads the project.
+  const [cmd, link] = args._;
 
+  if (cmd === 'audit' || cmd === 'scan' || cmd === 'recommend') {
+    const target = args._[1] || process.cwd();
+    const r = await auditProject(target, {
+      out: typeof args.out === 'string' ? args.out : null,
+      api: typeof args.api === 'string' ? args.api : undefined,
+      historyDir: typeof args.history === 'string' ? args.history : undefined,
+    });
+    if (!r.ok) { console.error(`audit: ${r.why}`); process.exitCode = 1; return; }
+    if (args.json) { console.log(JSON.stringify(r, null, 2)); return; }
+    console.log(renderAudit(r));
+    return;
+  }
 
-  const [cmd, link] = args._;
+  if (cmd === 'schedule') {
+    const target = args._[1] || process.cwd();
+    const r = await scheduleReport(target, {
+      github: Boolean(args.github),
+    });
+    if (!r.ok) { console.error(`schedule: ${r.why}`); process.exitCode = 1; return; }
+    if (args.json) { console.log(JSON.stringify(r, null, 2)); return; }
+    console.log(renderSchedule(r));
+    return;
+  }
 
   if (cmd === 'doctor') {
     const d = await doctor(args._[1] || process.cwd());
@@ -248,6 +314,42 @@ async function main() {
     return;
   }
 
+  // The push half. Two verbs, and neither is meant to be typed by a human:
+  // the SessionStart hook calls `consume`, then `refresh` detached.
+  if (cmd === 'notify') {
+    const sub = args._[1];
+    const root = args.root || process.cwd();
+
+    if (sub === 'consume') {
+      const file = args.digest || join(root, DEFAULT_DIGEST);
+      const text = consumeDigest(file);
+      if (text) console.log(text);
+      // Nothing to say is exit 0 and silence, not an error. See rule 1 in
+      // notify.mjs: a notifier that speaks every session gets ignored.
+      return;
+    }
+
+    if (sub === 'refresh') {
+      const api = (args.api || DEFAULT_API).replace(/\/+$/, '');
+      try {
+        const r = await refreshNotify({ root, api, limit: Number(args.limit) > 0 ? Number(args.limit) : 50 });
+        if (args.json) console.log(JSON.stringify(r, null, 2));
+        else if (r.firstRun) console.log('First run: cursor established, nothing announced.');
+        else console.log(r.wrote ? `digest written to ${r.digest}` : 'nothing new, no digest written');
+      } catch (e) {
+        // Could not measure is 3, same as watch. This runs detached from a
+        // hook, so the exit code lands in .doorman/notify.log and nowhere else.
+        console.error(`notify refresh: ${e.message}`);
+        process.exitCode = e.code === 3 ? 3 : 1;
+      }
+      return;
+    }
+
+    console.error('notify needs a subcommand: consume or refresh');
+    process.exitCode = 2;
+    return;
+  }
+
   if (!['report', 'eval'].includes(cmd)) {
     console.error(`unknown command "${cmd}". Try: doorman --help`);
     process.exitCode = 2;

package/doorman/cli/install.mjs

@@ -14,7 +14,7 @@
  * And safely inspects/wires .claude/settings.json without destructive clobbering.
  */
 
-import { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
 import { resolve, join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -58,6 +58,19 @@ export async function install(targetDir = process.cwd(), { dryRun = false } = {}
 
   // 1. Hooks, Subagent, Command
   copy('.claude/hooks/mcp-gate.sh', '.claude/hooks/mcp-gate.sh');
+  // copyFileSync preserves the SOURCE mode, and the source inside an installed
+  // npm package is 644: npm pack on Windows drops the executable bit from every
+  // file. Verified against the published 0.1.0 tarball, 2026-09-12. Without this
+  // the gate lands non-executable, fails to SPAWN rather than exiting 2, and the
+  // security control fails open. install.sh has carried the same chmod since it
+  // was written; this path never did.
+  if (!dryRun) {
+    try {
+      chmodSync(join(absTarget, '.claude/hooks/mcp-gate.sh'), 0o755);
+    } catch {
+      warnings.push('could not mark .claude/hooks/mcp-gate.sh executable; run: chmod +x .claude/hooks/mcp-gate.sh');
+    }
+  }
   copy('agents/doorman.md', '.claude/agents/doorman.md');
   copy('commands/vet.md', '.claude/commands/vet.md');
 
@@ -170,6 +183,20 @@ export function renderInstall(res) {
     L.push('');
   }
 
-  L.push('Done. Run `doorman doctor` to verify your installation.');
+  L.push('════════════════════════════════════════════════════════════════');
+  L.push('  INSTALLATION COMPLETE · GETTING STARTED GUIDANCE');
+  L.push('════════════════════════════════════════════════════════════════');
+  L.push('  1. Run unified health & tool check:');
+  L.push('     doorman audit');
+  L.push('');
+  L.push('  2. In Claude Code, manage your gate interactively:');
+  L.push('     /doorman');
+  L.push('');
+  L.push('  3. Audit any candidate tool before adoption:');
+  L.push('     /vet <mcp_server_url>');
+  L.push('');
+  L.push('  4. Set up recurring automated audit digests:');
+  L.push('     doorman schedule');
+  L.push('════════════════════════════════════════════════════════════════');
   return L.join('\n');
 }

package/doorman/cli/notify.mjs

@@ -0,0 +1,145 @@
+/**
+ * The push half of the subscription.
+ *
+ * WHAT "PUSH" HONESTLY MEANS HERE. Nobody can push to a laptop behind NAT that
+ * is asleep half the day, and a doorman that opened a socket to wait for us
+ * would be a worse product than one that does not. So the push is not a new
+ * transport: it is the POLL BECOMING INVISIBLE. A SessionStart hook reads a
+ * digest that is already on disk and costs nothing, then fires a detached
+ * refresh so the NEXT session is current. From where the operator sits they
+ * never ran a command and the doorman told them anyway, which is the whole
+ * claim, and it is true.
+ *
+ * THREE RULES, AND EACH ONE IS A NOTIFICATION PRODUCT FAILING IF BROKEN:
+ *
+ * 1. SILENT WHEN THERE IS NOTHING. No digest file is written when nothing is
+ *    new. A hook that prints "nothing new" at every session start teaches the
+ *    operator to skip past the one session where it matters.
+ *
+ * 2. THE FIRST RUN SAYS NOTHING. With no cursor the feed returns everything
+ *    graded so far. Announcing 26 rows as "new" the first time a plugin loads
+ *    is not news, it is a catalogue nobody asked for. The first refresh
+ *    establishes the cursor and writes no digest.
+ *
+ * 3. CONSUMED ONCE. The hook prints the digest and deletes it. Re-showing the
+ *    same three servers every morning is how a notification becomes furniture.
+ *
+ * The network never runs inside the hook. A SessionStart hook that waits on a
+ * fetch makes every session start as slow as the slowest network it has ever
+ * been on, and offline it makes them all fail.
+ */
+
+import { readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { watch, readState, writeState, DEFAULT_API, DEFAULT_STATE } from './watch.mjs';
+
+export const DEFAULT_DIGEST = join('.doorman', 'notify.md');
+
+/** How many rows the digest will name before it stops listing and counts. */
+export const MAX_LISTED = 3;
+
+/**
+ * The digest, or null for "say nothing".
+ *
+ * Only two verdicts are ever worth interrupting a session for. `unreviewed` is
+ * something you could adopt and have not looked at. `blocked` is something the
+ * registry already refuses, and seeing it in a fresh grade is a reason to check
+ * whether anyone tried. `already-installed` and `skipped` are not news: the
+ * first is a server you have, and the second you decided about.
+ */
+export function renderNotify(result, { firstRun = false } = {}) {
+  if (firstRun) return null;
+
+  const rows = result.candidates ?? [];
+  const fresh = rows.filter((c) => c.verdict === 'unreviewed' && !c.is_fixture && !c.self_graded);
+  const blocked = rows.filter((c) => c.verdict === 'blocked');
+  if (!fresh.length && !blocked.length) return null;
+
+  const out = [];
+  out.push('## doorman');
+  out.push('');
+
+  if (fresh.length) {
+    const shown = fresh.slice(0, MAX_LISTED);
+    const noun = fresh.length === 1 ? 'server' : 'servers';
+    out.push(`${fresh.length} newly graded ${noun} this build does not have:`);
+    for (const c of shown) {
+      // The grade travels with what produced it. A letter with no model behind
+      // it invites a comparison across models that the grade cannot support.
+      const model = c.model ? ` on ${c.model}` : ', model not recorded';
+      const score = c.score === null || c.score === undefined ? 'not scored' : `${c.score}/100`;
+      out.push(`- **${c.grade ?? '?'}** ${score}${model} ${c.server_url}`);
+      const layers = c.layers ?? {};
+      const missing = ['behavioral_pct', 'guidance_pct']
+        .filter((k) => layers[k] === null || layers[k] === undefined)
+        .map((k) => k.replace('_pct', ''));
+      if (missing.length) out.push(`  not measured: ${missing.join(', ')}`);
+    }
+    if (fresh.length > shown.length) {
+      out.push(`- and ${fresh.length - shown.length} more`);
+    }
+    out.push('');
+  }
+
+  if (blocked.length) {
+    out.push(`${blocked.length} on your denylist were re-graded. Run \`doorman watch\` for the detail.`);
+    out.push('');
+  }
+
+  out.push('Run `doorman needs` to see which of these answer something this build ' +
+           'keeps asking for, or `doorman watch` for the full list. Nothing has been ' +
+           'installed and nothing was sent anywhere: the match runs on this machine.');
+  return out.join('\n');
+}
+
+/**
+ * Fetch, classify, and leave a digest for the next session to find.
+ *
+ * Advances the cursor whether or not a digest is written, because the cursor
+ * tracks what has been SEEN by the subscription rather than what was worth
+ * mentioning. Not advancing it on a quiet day would re-announce the same rows
+ * the moment something interesting finally landed.
+ */
+export async function refreshNotify({
+  root = process.cwd(), api = DEFAULT_API, limit = 50,
+  stateFile, digestFile, fetchImpl = fetch,
+} = {}) {
+  const state = stateFile ?? join(root, DEFAULT_STATE);
+  const digest = digestFile ?? join(root, DEFAULT_DIGEST);
+
+  const prior = readState(state);
+  const firstRun = !prior.since;
+
+  const result = await watch({ root, api, since: prior.since, limit, fetchImpl });
+  const text = renderNotify(result, { firstRun });
+
+  if (text) {
+    mkdirSync(dirname(digest), { recursive: true });
+    writeFileSync(digest, text + '\n', 'utf8');
+  }
+
+  if (result.next_since) {
+    writeState(state, { since: result.next_since, seen: (prior.seen ?? 0) + result.candidates.length });
+  }
+
+  return { wrote: Boolean(text), firstRun, digest, candidates: result.candidates.length };
+}
+
+/**
+ * What the hook prints. Reading is destructive on purpose: see rule 3.
+ *
+ * Any failure here returns nothing rather than throwing. This runs at session
+ * start, and a notification that can break a session start is worse than no
+ * notification.
+ */
+export function consumeDigest(file) {
+  try {
+    if (!file || typeof file !== 'string') return null;
+    if (!existsSync(file)) return null;
+    const text = readFileSync(file, 'utf8').trim();
+    unlinkSync(file);
+    return text || null;
+  } catch {
+    return null;
+  }
+}

package/doorman/cli/schedule.mjs

@@ -0,0 +1,128 @@
+/**
+ * `doorman schedule` — Configure automated, recurring tool audits & recommendation reports.
+ *
+ * Supports three automation modes:
+ *   1. Built-in SessionStart Hook (runs silently in background on session open)
+ *   2. GitHub Actions Workflow (--github: creates .github/workflows/doorman-audit.yml)
+ *   3. Agent / Cron Scheduling (prints crontab entry & /schedule agent prompt)
+ */
+
+import { resolve, join } from 'node:path';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+
+export const GITHUB_WORKFLOW_YAML = `name: Doorman Tool Audit & Security Report
+
+on:
+  schedule:
+    # Run every Monday at 09:00 UTC
+    - cron: '0 9 * * 1'
+  workflow_dispatch:
+
+jobs:
+  audit:
+    name: Run Clembot Doorman Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install Clembot Doorman
+        run: npm i -g clembot-doorman
+
+      - name: Run Unified Audit
+        run: |
+          mkdir -p .doorman
+          doorman audit --out .doorman/audit-report.md
+
+      - name: Upload Audit Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: doorman-audit-report
+          path: .doorman/audit-report.md
+`;
+
+export async function schedule(targetDir = process.cwd(), opts = {}) {
+  const absRoot = resolve(targetDir);
+
+  if (opts.github) {
+    const wfDir = join(absRoot, '.github', 'workflows');
+    mkdirSync(wfDir, { recursive: true });
+    const wfPath = join(wfDir, 'doorman-audit.yml');
+    writeFileSync(wfPath, GITHUB_WORKFLOW_YAML, 'utf8');
+    return {
+      ok: true,
+      mode: 'github',
+      path: wfPath,
+    };
+  }
+
+  // Check hook status
+  const sessionHook = join(absRoot, '.claude', 'hooks', 'session-notify.sh');
+  const hasHook = existsSync(sessionHook);
+
+  return {
+    ok: true,
+    mode: 'guide',
+    root: absRoot,
+    hasHook,
+  };
+}
+
+export function renderSchedule(res) {
+  const lines = [];
+  lines.push('');
+  lines.push('================================================================');
+  lines.push('          CLEMBOT DOORMAN · AUTOMATED AUDIT SCHEDULING           ');
+  lines.push('================================================================');
+  lines.push('');
+
+  if (res.mode === 'github') {
+    lines.push(`  ✓ Created GitHub Actions workflow at:`);
+    lines.push(`    ${res.path}`);
+    lines.push('');
+    lines.push('  This workflow runs `doorman audit` every Monday at 09:00 UTC');
+    lines.push('  and uploads the markdown report as an artifact.');
+    lines.push('');
+    return lines.join('\n');
+  }
+
+  lines.push('Choose how you want to schedule your tool audit & recommendations:');
+  lines.push('');
+
+  // 1. SessionStart Hook
+  lines.push('── 1. BUILT-IN SESSION HOOK (ZERO CONFIG) ───────────────────────');
+  if (res.hasHook) {
+    lines.push('  [ACTIVE] .claude/hooks/session-notify.sh is installed.');
+    lines.push('  Claude Code automatically checks for new graded MCP tools at the');
+    lines.push('  start of every session and notifies you if fresh tools are available.');
+  } else {
+    lines.push('  Install the plugin to enable silent background session checks:');
+    lines.push('  claude plugin marketplace add clemenswan/clembot-doorman && claude plugin install clembot-doorman');
+  }
+  lines.push('');
+
+  // 2. AI Agent Loop / Slash Command
+  lines.push('── 2. AI AGENT RECURRING SCHEDULING ────────────────────────────');
+  lines.push('  In Antigravity or pair-programming chat, invoke the /schedule command:');
+  lines.push('  /schedule CronExpression="0 9 * * 1", Prompt="Run doorman audit and report recommended MCP tools"');
+  lines.push('');
+
+  // 3. GitHub Actions
+  lines.push('── 3. CI/CD GITHUB ACTIONS (RECOMMENDED FOR TEAMS) ──────────────');
+  lines.push('  Generate a weekly automated audit workflow with:');
+  lines.push('  doorman schedule --github');
+  lines.push('');
+
+  // 4. System Cron
+  lines.push('── 4. SYSTEM CRON / TASK SCHEDULER ─────────────────────────────');
+  lines.push('  Add to your crontab (crontab -e) to generate weekly markdown reports:');
+  lines.push(`  0 9 * * 1 cd "${res.root}" && npx clembot-doorman audit --out .doorman/audit.md`);
+  lines.push('');
+
+  return lines.join('\n');
+}

package/doorman/commands/doorman.md

@@ -29,8 +29,7 @@ If it prints `NOT_FOUND`, stop and tell the user this, then end the turn:
 > Reinstall the plugin, or install the CLI directly:
 >
 > ```bash
-> git clone https://github.com/clemenswan/clembot-doorman
-> npm i -g ./clembot-doorman
+> npm i -g clembot-doorman
 > ```
 >
 > The gate is still running either way. It is pure bash and depends on none of

package/doorman/hooks/hooks.json

@@ -11,7 +11,16 @@
     "",
     "Timeout matches .claude/settings.json. The gate does no network and no",
     "subprocess, so 5s is generous; it exists so a wedged hook fails rather",
-    "than hanging every tool call."
+    "than hanging every tool call.",
+    "",
+    "BOTH COMMANDS RUN THROUGH `bash` ON PURPOSE. npm pack on Windows drops",
+    "the executable bit from every file, so the .sh files inside an installed",
+    "package are 644 and cannot be invoked by path. Verified against the",
+    "published 0.1.0 tarball on 2026-09-12: mcp-gate.sh ships -rw-r--r--.",
+    "A gate that cannot start does not exit 2, it fails to spawn, so the",
+    "security control FAILS OPEN, which is the one thing its design forbids.",
+    "Invoking through the interpreter makes the mode irrelevant on every",
+    "platform. Do not `simplify` this back to a bare path."
   ],
   "hooks": {
     "PreToolUse": [
@@ -20,11 +29,33 @@
         "hooks": [
           {
             "type": "command",
-            "command": "${CLAUDE_PLUGIN_ROOT}/.claude/hooks/mcp-gate.sh",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/.claude/hooks/mcp-gate.sh",
             "timeout": 5
           }
         ]
       }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/.claude/hooks/session-notify.sh",
+            "timeout": 10
+          }
+        ]
+      }
     ]
-  }
+  },
+  "$comment2": [
+    "SessionStart is the PUSH surface, and it is a different kind of hook from",
+    "the gate above. The gate is a security control: offline, dependency-free,",
+    "and it fails CLOSED with exit 2. The notifier fails OPEN and silent, always",
+    "exits 0, and prints nothing on every error path, because a notification",
+    "that can break a session start is worse than no notification.",
+    "",
+    "It makes no network call. It prints a digest already on disk and fires a",
+    "detached refresh for next time, so the cost on a normal session is one",
+    "file test. The 10s timeout is for a slow disk, not for a fetch."
+  ]
 }

package/doorman/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clembot-doorman",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "private": true,
   "type": "module",
   "description": "Vets MCP servers, skills and repos before an agent gets them. Fit review first, paid grade second.",

package/doorman/recipes/README.md

@@ -32,5 +32,9 @@ Worth separating, because the project doc uses one word for both.
   its own past is not a record. The account is still the blocker, not the spec.
   Full detail in the root `README.md` under **Bazantic**.
 
-Filing these does not advance the prize recipes. It fills a directory the
-project doc asked for and that shipped empty.
+The three canonical Bazantic platform prize recipes are published in
+[`bazantic/recipes/`](../../bazantic/recipes/):
+1. `01-vet-mcp-candidate.json` — Agentify an API ($500/300/200)
+2. `02-deepwiki-pinned-researcher.json` — Help an Agent Use Your Project / Continuity (2×$500)
+3. `03-governance-pipeline.json` — Best Multi-API Recipe ($500/300/200)
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clembot-doorman",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "The Package Manager & Security Doorman for Claude Code: inspect your build, recommend vetted MCPs from prompt history, and block rogue tools before context.",
   "homepage": "https://clembot-doorman.wanessalabs.com",
   "type": "module",