dsh-tower 2.1.0 → 2.4.0

package/scripts/check-philosophy.mjs

@@ -0,0 +1,266 @@
+#!/usr/bin/env node
+// Engineering-philosophy gate (#83).
+//
+// The repository writes down what it refuses to do and points every principle at
+// the thing that enforces it. A pointer that does not resolve is a slogan, so
+// this check fails on it. It also keeps the ADR set dated/structure-complete and
+// makes every "Non-goals" heading in docs/ auditable: it must either name an
+// existing enforcement file or be explicitly labelled `unowned`.
+//
+// Usage:
+//   node scripts/check-philosophy.mjs [--root <dir>] [--json]
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { parseArgs, runMain } from './lib/cli.mjs'
+
+const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const PRINCIPLES_FILE = 'PRINCIPLES.md'
+const ADR_DIR = 'docs/adr'
+const MIN_PRINCIPLES = 8
+const MIN_ADRS = 3
+const ADR_REQUIRED_SECTIONS = ['Context', 'Decision', 'Consequences', 'Rejected alternatives']
+const ADR_REQUIRED_TOPICS = ['ports', 'state.json', 'allowAgentControl']
+const USAGE = `usage: node scripts/check-philosophy.mjs [--root <dir>] [--json]
+
+  --root   repository root to check (default: this package)
+  --json   print the report as JSON
+  --help   print this text
+
+Every principle needs "Refused because of this:" and "Enforced by:" where the
+enforcement names an existing file and a test or gate. Every docs/ "Non-goals"
+heading needs an existing enforcement pointer or the word "unowned". At least
+${MIN_ADRS} dated ADRs need Context, Decision, Consequences and Rejected alternatives.`
+
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/
+
+function finding(code, message) {
+  return { code, level: 'error', message }
+}
+
+function listMarkdown(dir) {
+  const files = []
+  if (!fs.existsSync(dir)) return files
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name)
+    if (entry.isDirectory()) files.push(...listMarkdown(full))
+    else if (entry.isFile() && entry.name.endsWith('.md')) files.push(full)
+  }
+  return files
+}
+
+/** Candidate repository paths: backticked tokens with a slash or a file suffix. */
+function backtickedPaths(text) {
+  const paths = []
+  for (const match of String(text ?? '').matchAll(/`([^`]+)`/g)) {
+    const token = match[1].trim().replace(/\\/g, '/')
+    if (!token || token.startsWith('npm ') || token.startsWith('gh ') || token.includes(' ')) continue
+    if (!token.includes('/') && !/\.(?:mjs|js|cjs|ts|md|json|ya?ml)$/.test(token)) continue
+    paths.push(token)
+  }
+  return paths
+}
+
+function fieldText(body, label) {
+  const lines = String(body ?? '').split(/\r?\n/)
+  const start = lines.findIndex((line) => new RegExp(`^\\s*(?:[-*]\\s*)?\\**${label}:?\\**\\s*(.*)$`, 'i').test(line))
+  if (start < 0) return null
+  const match = new RegExp(`^\\s*(?:[-*]\\s*)?\\**${label}:?\\**\\s*(.*)$`, 'i').exec(lines[start])
+  const parts = [match?.[1] ?? '']
+  for (let index = start + 1; index < lines.length; index += 1) {
+    const line = lines[index]
+    if (!line.trim()) break
+    if (/^\s*(?:[-*]\s*)?\**Refused because of this:?/i.test(line)) break
+    if (/^\s*(?:[-*]\s*)?\**Enforced by:?/i.test(line)) break
+    if (/^#{1,6}\s+/.test(line)) break
+    parts.push(line.trim())
+  }
+  return parts.join(' ').replace(/\s+/g, ' ').trim() || null
+}
+
+/**
+ * Read PRINCIPLES.md into sections, then check each section's refusal and
+ * enforcement pointer. A section without both is not a principle.
+ * @param {string} text
+ * @param {(relative: string) => boolean} exists
+ */
+export function checkPrinciplesText(text, exists) {
+  const findings = []
+  const headings = [...String(text ?? '').matchAll(/^##\s+(\d+)\.\s+(.+?)\s*$/gm)]
+  if (headings.length < MIN_PRINCIPLES) {
+    findings.push(finding('principles-count', `${PRINCIPLES_FILE} has ${headings.length} numbered principles; at least ${MIN_PRINCIPLES} are required`))
+  }
+  const principles = []
+  headings.forEach((heading, index) => {
+    const start = heading.index + heading[0].length
+    const end = index + 1 < headings.length ? headings[index + 1].index : text.length
+    const body = text.slice(start, end)
+    const number = Number(heading[1])
+    const title = heading[2].trim()
+    const refusal = fieldText(body, 'Refused because of this')
+    const enforcement = fieldText(body, 'Enforced by')
+    const record = { number, title, refusal, enforcement }
+    principles.push(record)
+    if (!record.refusal) {
+      findings.push(finding('principle-refusal', `principle ${number} (${title}) has no "Refused because of this:" line`))
+    }
+    if (!record.enforcement) {
+      findings.push(finding('principle-enforcement', `principle ${number} (${title}) has no "Enforced by:" line`))
+      return
+    }
+    const candidates = backtickedPaths(record.enforcement)
+    const missing = candidates.filter((candidate) => !exists(candidate))
+    if (candidates.length === 0) {
+      findings.push(finding('principle-pointer-missing', `principle ${number} (${title}) names no backticked file in "Enforced by:"`))
+    } else {
+      for (const candidate of missing) {
+        findings.push(
+          finding('principle-pointer-missing', `principle ${number} (${title}) points at a missing file: ${candidate}`),
+        )
+      }
+    }
+    if (!/(?:tests\/|\.test\.|npm run [a-z0-9:_-]+)/i.test(record.enforcement)) {
+      findings.push(
+        finding('principle-enforcement-weak', `principle ${number} (${title}) names no test or gate in "Enforced by:"`),
+      )
+    }
+  })
+  return { principles, findings }
+}
+
+/**
+ * Check that the ADR set is dated, structured and covers the three load-bearing
+ * decisions the issue asked to backfill.
+ * @param {string} root
+ */
+export function checkAdrs(root) {
+  const findings = []
+  const dir = path.join(root, ADR_DIR)
+  const files = fs.existsSync(dir)
+    ? fs
+        .readdirSync(dir)
+        .filter((name) => /^\d{4}-.+\.md$/.test(name))
+        .sort()
+    : []
+  if (files.length < MIN_ADRS) {
+    findings.push(finding('adr-count', `${ADR_DIR} has ${files.length} numbered ADRs; at least ${MIN_ADRS} are required`))
+  }
+  const combined = []
+  for (const name of files) {
+    const relative = `${ADR_DIR}/${name}`
+    const text = fs.readFileSync(path.join(dir, name), 'utf8')
+    combined.push(text)
+    for (const section of ADR_REQUIRED_SECTIONS) {
+      const heading = new RegExp(`^#{1,6}\\s+${section}\\b`, 'im')
+      if (!heading.test(text)) findings.push(finding('adr-section', `${relative} misses the "${section}" section`))
+    }
+    if (!/^\s*(?:[-*]\s*)?Date:\s*(\d{4}-\d{2}-\d{2})\s*$/im.test(text)) {
+      findings.push(finding('adr-date', `${relative} needs a "Date: YYYY-MM-DD" line`))
+    }
+    if (!/^\s*(?:[-*]\s*)?Status:\s*\S+/im.test(text)) {
+      findings.push(finding('adr-status', `${relative} needs a "Status:" line`))
+    }
+  }
+  const all = combined.join('\n')
+  for (const topic of ADR_REQUIRED_TOPICS) {
+    if (!new RegExp(topic.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'i').test(all)) {
+      findings.push(finding('adr-topic', `no ADR explains the "${topic}" decision`))
+    }
+  }
+  return { adrDir: ADR_DIR, adrs: files, findings }
+}
+
+/**
+ * Every "Non-goals" heading in docs/ must carry an enforcement pointer that
+ * resolves or the explicit word `unowned`. No heading may be an orphan refusal.
+ * @param {string} root
+ */
+export function checkNonGoals(root) {
+  const findings = []
+  const files = listMarkdown(path.join(root, 'docs'))
+  let headings = 0
+  for (const file of files) {
+    const relative = path.relative(root, file).replace(/\\/g, '/')
+    const lines = fs.readFileSync(file, 'utf8').split(/\r?\n/)
+    lines.forEach((line, index) => {
+      const heading = /^(#{1,6})\s+(.+?)\s*$/.exec(line)
+      if (!heading || !/\bnon[-\s]?goals?\b/i.test(heading[2])) return
+      headings += 1
+      const level = heading[1].length
+      const body = []
+      for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
+        const next = /^(#{1,6})\s+/.exec(lines[cursor])
+        if (next && next[1].length <= level) break
+        body.push(lines[cursor])
+      }
+      const text = body.join('\n')
+      const enforcement = /^\s*(?:[-*]\s*)?\**Enforced by:?\**\s*(.+)$/im.exec(text)
+      const unowned = /\bunowned\b/i.test(text)
+      const enforced =
+        Boolean(unowned) ||
+        Boolean(enforcement && backtickedPaths(enforcement[1]).some((candidate) => fs.existsSync(path.join(root, candidate))))
+      if (!enforced) {
+        findings.push(
+          finding(
+            'non-goal-unowned',
+            `${relative}:${index + 1} has a "Non-goals" heading with no existing enforcement pointer and no "unowned" label`,
+          ),
+        )
+      }
+    })
+  }
+  return { headings, findings }
+}
+
+/** Run all three checks against one repository root. */
+export function checkPhilosophy(root) {
+  const findings = []
+  const principlesFile = path.join(root, PRINCIPLES_FILE)
+  let principles = []
+  if (!fs.existsSync(principlesFile)) {
+    findings.push(finding('principles-missing', `${PRINCIPLES_FILE} is missing`))
+  } else {
+    const result = checkPrinciplesText(fs.readFileSync(principlesFile, 'utf8'), (relative) =>
+      fs.existsSync(path.join(root, relative)),
+    )
+    principles = result.principles
+    findings.push(...result.findings)
+  }
+  const adr = checkAdrs(root)
+  findings.push(...adr.findings)
+  const nonGoals = checkNonGoals(root)
+  findings.push(...nonGoals.findings)
+  return {
+    ok: findings.length === 0,
+    principles,
+    adrs: adr.adrs,
+    nonGoals,
+    findings,
+  }
+}
+
+function main(argv) {
+  const options = parseArgs(argv, {
+    initial: { root: PACKAGE_ROOT, json: false, help: false },
+    values: { '--root': { key: 'root', parse: path.resolve } },
+    flags: { '--json': 'json', '--help': 'help', '-h': 'help' },
+  })
+  if (options.help) {
+    console.log(USAGE)
+    return 0
+  }
+  const report = checkPhilosophy(path.resolve(options.root))
+  if (options.json) {
+    console.log(JSON.stringify(report, null, 2))
+    return report.ok ? 0 : 1
+  }
+  console.log(
+    `philosophy: ${report.principles.length} principles, ${report.adrs.length} ADRs, ${report.nonGoals.headings} non-goal heading(s)`,
+  )
+  for (const item of report.findings) console.log(`philosophy: ${item.level} [${item.code}] ${item.message}`)
+  if (report.ok) console.log('philosophy: ok — every refusal points at an existing test or gate')
+  else console.log(`philosophy: ${report.findings.length} unenforced statement(s)`)
+  return report.ok ? 0 : 1
+}
+
+await runMain(import.meta.url, () => main(process.argv.slice(2)), { errorPrefix: 'philosophy', usage: USAGE })

package/scripts/component-surface.json

@@ -0,0 +1,395 @@
+{
+  "schema": 1,
+  "date": "2026-10-23",
+  "adr": "docs/adr/0005-component-surface.md",
+  "classes": {
+    "core": "Removing it breaks the Tower contract. It is never a switch.",
+    "optional-component": "A capability whose off state leaves the rest of Tower intact. It must be a user-visible switch with a documented fallback.",
+    "optional-config": "A tuning knob, not a capability. It stays in the config form and never hides a component.",
+    "forbidden-to-disable": "The host, the health contract, the recovery escape, the review contract and the merge gates. No group, row or boolean key may turn it off."
+  },
+  "components": [
+    {
+      "id": "tower",
+      "scope": "visible",
+      "kind": "group",
+      "fallback": "Off equals uninstalling Tower: no tools, presets or skills remain. That is the accepted all-off boundary of the mandatory host anchor, not an optional capability."
+    },
+    {
+      "id": "tower-host",
+      "scope": "internal",
+      "kind": "row",
+      "fallback": "The Host plugin itself, nested under the mandatory tower anchor. A mandatory dependency, never its own switch."
+    },
+    {
+      "id": "tower-skills",
+      "scope": "visible",
+      "kind": "row",
+      "fallback": "The 3 skills leave the catalog; the worker/reviewer PROTOCOL sections still ship through systemPrompt.section, so only the tower-recovery guidance is lost."
+    },
+    {
+      "id": "tower-batch",
+      "scope": "visible",
+      "kind": "row",
+      "fallback": "tower_batch is not registered; missions, gates and merges are unaffected because no state depends on a batch."
+    },
+    {
+      "id": "tower-import",
+      "scope": "visible",
+      "kind": "row",
+      "fallback": "tower_import_legacy and tower_legacy_map are not registered; new repository state is unaffected."
+    },
+    {
+      "id": "tower-leases",
+      "scope": "visible",
+      "kind": "row",
+      "fallback": "tower_resource is not registered; advisory leases are coordination only, so nothing else depends on them."
+    },
+    {
+      "id": "tower-tests",
+      "scope": "visible",
+      "kind": "row",
+      "fallback": "tower_test is not registered and no test receipt can be recorded. With gates.requireTests:true planning/mode entry is rejected with an explanation, and the merge gate still reports tests-missing."
+    },
+    {
+      "id": "tower-hmr",
+      "scope": "visible",
+      "kind": "row",
+      "fallback": "tower_reload and /tower reload are unavailable; a profile without HMR behaves exactly as before. Shipped disabled: enable the row for a linked dev profile."
+    },
+    {
+      "id": "preset-tower-worker",
+      "scope": "internal",
+      "kind": "row",
+      "fallback": "tower_spawn fails without the worker preset. A mandatory dependency, never a switch."
+    },
+    {
+      "id": "preset-tower-reviewer",
+      "scope": "visible",
+      "kind": "row",
+      "fallback": "The reviewer cannot be dispatched. Supported while review.requireReview is false (merge is unaffected); with the gate on planning/mode entry is locked with an explanatory error."
+    }
+  ],
+  "gateableTools": {},
+  "keys": [
+    {
+      "name": "section",
+      "class": "core",
+      "note": "Legacy alias for mode.promptSection: the Tower-mode prompt contract, not a capability."
+    },
+    {
+      "name": "allowAgentControl",
+      "class": "core",
+      "note": "Legacy alias for mode.allowAgentControl: the human-owned mode rule (ADR 0003), not a component."
+    },
+    {
+      "name": "init.autoGitInit",
+      "class": "optional-config",
+      "note": "Bootstrap convenience; off only means tower_init will not run git init."
+    },
+    {
+      "name": "init.snapshotDirty",
+      "class": "optional-config",
+      "note": "Dirty-work baseline convenience; no capability is removed."
+    },
+    {
+      "name": "init.autoExclude",
+      "class": "optional-config",
+      "note": "Keeps Tower artifacts out of .git/info/exclude; safe either way."
+    },
+    {
+      "name": "mode.promptSection",
+      "class": "core",
+      "note": "Replaces the whole Tower-mode prompt text; contract text, not a capability."
+    },
+    {
+      "name": "mode.sectionAppend",
+      "class": "optional-config",
+      "note": "Appends team conventions to the prompt."
+    },
+    {
+      "name": "mode.allowAgentControl",
+      "class": "core",
+      "note": "Decides whether the model may toggle the mode (ADR 0003). A governance rule, never a component."
+    },
+    {
+      "name": "mode.autoPauseGoal",
+      "class": "core",
+      "note": "Entering the mode pauses an active goal; exit never resumes it."
+    },
+    {
+      "name": "mode.requireResumeAuthorization",
+      "class": "core",
+      "note": "Guards resuming a user-paused mission."
+    },
+    {
+      "name": "mode.requireHumanAckOnFirstEntry",
+      "class": "core",
+      "note": "First entry can require an explicit human ack."
+    },
+    {
+      "name": "mode.workspaceLock",
+      "class": "core",
+      "note": "One Tower session per repository is a safety contract; a row may not turn it off."
+    },
+    {
+      "name": "mode.workspaceLockScope",
+      "class": "optional-config",
+      "note": "Chooses whether read-only tools take the workspace lock."
+    },
+    {
+      "name": "mode.planModePolicy",
+      "class": "core",
+      "note": "Plan mode and Tower mode stay mutually exclusive."
+    },
+    {
+      "name": "mode.workspaceStaleMs",
+      "class": "optional-config",
+      "note": "Stale window for the advisory workspace lock."
+    },
+    {
+      "name": "mode.heartbeatMs",
+      "class": "optional-config",
+      "note": "Heartbeat interval while the mode is on."
+    },
+    {
+      "name": "mode.denyTools",
+      "class": "core",
+      "note": "The denied-tool list is part of the mode guard."
+    },
+    {
+      "name": "mode.storePath",
+      "class": "optional-config",
+      "note": "Custom mode-store location; no capability is removed."
+    },
+    {
+      "name": "mode.maxEntries",
+      "class": "optional-config",
+      "note": "Bounds the persisted mode store."
+    },
+    {
+      "name": "mode.lockTimeoutMs",
+      "class": "optional-config",
+      "note": "Bounded wait for the cross-process mode lock."
+    },
+    {
+      "name": "review.requireReview",
+      "class": "forbidden-to-disable",
+      "note": "Turns independent review into a merge blocker; no component may switch it off. With it on, the preset-tower-reviewer row may not be off (planning/mode entry refuse the combination)."
+    },
+    {
+      "name": "review.maxRoundsPerReviewer",
+      "class": "forbidden-to-disable",
+      "note": "Caps review rounds; part of the review contract."
+    },
+    {
+      "name": "merge.timeoutMs",
+      "class": "optional-config",
+      "note": "Default merge timeout; a per-call value wins."
+    },
+    {
+      "name": "merge.maxBufferBytes",
+      "class": "optional-config",
+      "note": "Captured merge output buffer."
+    },
+    {
+      "name": "git.timeoutMs",
+      "class": "optional-config",
+      "note": "Default Git command timeout outside merge."
+    },
+    {
+      "name": "worktrees.root",
+      "class": "optional-config",
+      "note": "Default worktree placement."
+    },
+    {
+      "name": "spawn.workerPreset",
+      "class": "core",
+      "note": "Chooses the worker tool surface; a dependency, never a switch."
+    },
+    {
+      "name": "spawn.reviewerPreset",
+      "class": "core",
+      "note": "Chooses the read-only reviewer surface; a dependency, never a switch."
+    },
+    {
+      "name": "spawn.maxDepth",
+      "class": "optional-config",
+      "note": "Subagent depth requested at spawn."
+    },
+    {
+      "name": "spawn.provider",
+      "class": "optional-config",
+      "note": "Provider route for spawned agents."
+    },
+    {
+      "name": "spawn.workerModel",
+      "class": "optional-config",
+      "note": "Optional model route for workers."
+    },
+    {
+      "name": "spawn.reviewerModel",
+      "class": "optional-config",
+      "note": "Optional independent model route for reviewers."
+    },
+    {
+      "name": "spawn.maxLiveWorkers",
+      "class": "core",
+      "note": "Resource-safety cap on live workers."
+    },
+    {
+      "name": "spawn.staleMs",
+      "class": "optional-config",
+      "note": "Roster staleness window before merge is blocked."
+    },
+    {
+      "name": "spawn.maxWaitMs",
+      "class": "optional-config",
+      "note": "Upper bound for a blocking spawn wait."
+    },
+    {
+      "name": "spawn.requireLease",
+      "class": "optional-config",
+      "note": "Advisory-lease gate before a worker starts."
+    },
+    {
+      "name": "send.maxPerMinute",
+      "class": "optional-config",
+      "note": "Message rate limit; zero disables it."
+    },
+    {
+      "name": "send.interruptDefault",
+      "class": "optional-config",
+      "note": "Default for the interrupt-before-deliver flag."
+    },
+    {
+      "name": "tests.enabled",
+      "class": "optional-component",
+      "note": "Tuning inside the optional tower-tests component: it decides whether discovery runs when the row is on. Off with gates.requireTests:true is rejected at config resolution."
+    },
+    {
+      "name": "tests.admission",
+      "class": "optional-config",
+      "note": "Chooses when discovery runs inside the optional tests capability."
+    },
+    {
+      "name": "tests.timeoutMs",
+      "class": "optional-config",
+      "note": "Per-command discovery timeout."
+    },
+    {
+      "name": "tests.maxBytes",
+      "class": "optional-config",
+      "note": "Captured discovery output cap."
+    },
+    {
+      "name": "tests.autoChecks",
+      "class": "optional-config",
+      "note": "Attaches a tests check to completion when discovery runs."
+    },
+    {
+      "name": "tests.allowPackageDiscovery",
+      "class": "core",
+      "note": "Allows repository code to execute; a security contract, not a component."
+    },
+    {
+      "name": "gates.requireChecks",
+      "class": "forbidden-to-disable",
+      "note": "Requires completion evidence before merge; a merge gate."
+    },
+    {
+      "name": "gates.requireTests",
+      "class": "forbidden-to-disable",
+      "note": "Requires a test receipt before merge; a merge gate. With the tower-tests row off, planning/mode entry refuse the combination."
+    },
+    {
+      "name": "gates.allowReviewExemption",
+      "class": "forbidden-to-disable",
+      "note": "The review-exemption path is part of the review and merge contract."
+    },
+    {
+      "name": "gates.maxReportBytes",
+      "class": "forbidden-to-disable",
+      "note": "The report cap is part of the completion contract; the refusal itself is never configurable away."
+    },
+    {
+      "name": "docs.board",
+      "class": "optional-config",
+      "note": "Writes the human-readable board; no capability is removed."
+    },
+    {
+      "name": "docs.boardLocation",
+      "class": "optional-config",
+      "note": "Chooses the board location."
+    },
+    {
+      "name": "archive.enabled",
+      "class": "optional-config",
+      "note": "Archival is maintenance, not a tool capability; off only leaves terminal missions hot."
+    },
+    {
+      "name": "archive.afterDays",
+      "class": "optional-config",
+      "note": "Archive age threshold."
+    },
+    {
+      "name": "archive.maxMissions",
+      "class": "optional-config",
+      "note": "Hot terminal-mission cap."
+    },
+    {
+      "name": "leases.ttlMs",
+      "class": "optional-config",
+      "note": "Tuning inside the optional tower-leases component."
+    },
+    {
+      "name": "dev.reloadDelayMs",
+      "class": "optional-config",
+      "note": "Delay so a tool result is delivered before a scheduled reload inside the optional tower-hmr component."
+    },
+    {
+      "name": "dev.reloadRequiredIds",
+      "class": "optional-config",
+      "note": "Loader ids passed to reconcileProfile as required by the tower-hmr component."
+    }
+  ],
+  "forbidden": [
+    {
+      "id": "host",
+      "capability": "the Tower host",
+      "reason": "Without the host the plugin registers nothing; there is no off state that leaves the rest working, and no config boolean may remove it. The visible `tower` anchor is the all-off boundary, and the host section nested under it may never become its own switch.",
+      "tools": [],
+      "rowIds": ["tower-host"]
+    },
+    {
+      "id": "health",
+      "capability": "tower_doctor (read-only health contract)",
+      "reason": "Diagnosis must always exist so a failure message can point at it. #122 removed exposeDoctor and the exposeOperational master switch; the tool is registered for every configuration.",
+      "tools": ["tower_doctor"],
+      "rowIds": ["tower-doctor"]
+    },
+    {
+      "id": "recovery",
+      "capability": "tower_recover (stale state-lock escape)",
+      "reason": "The escape hatch must exist whenever the lock it repairs can be left behind. #122 removed exposeRecovery and the exposeOperational master switch; the tool is registered for every configuration.",
+      "tools": ["tower_recover"],
+      "rowIds": ["tower-recover"]
+    },
+    {
+      "id": "review",
+      "capability": "the review contract",
+      "reason": "review.requireReview is a merge blocker, not a component; a row may not switch it off. The reviewer row is conditional, not a way to weaken the gate.",
+      "tools": ["tower_diff", "tower_preflight", "tower_review"],
+      "rowIds": ["tower-review"],
+      "gatedBy": ["review.requireReview", "review.maxRoundsPerReviewer"]
+    },
+    {
+      "id": "merge-gates",
+      "capability": "the merge gates",
+      "reason": "gates.* decides delivery; a component may not bypass it.",
+      "tools": ["tower_complete", "tower_merge"],
+      "rowIds": ["tower-gates", "tower-merge-gates"],
+      "gatedBy": ["gates.requireChecks", "gates.requireTests", "gates.allowReviewExemption", "gates.maxReportBytes"]
+    }
+  ]
+}