godpowers 2.4.3 → 2.5.0

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.5.0] - 2026-06-10
+
+### Added
+- Added `npx godpowers gate --tier=<tier> --project=.` for PRD, design,
+  architecture, roadmap, stack, repo, build, and harden tier gates.
+- Added `lib/artifact-map.js`, `lib/gate.js`, and `lib/cli-dispatch.js` so
+  artifact paths, executable gates, and CLI command dispatch are tested outside
+  the installer binary.
+- Added gate fixtures and tests for green tier artifacts, missing artifacts,
+  lint failures, harden Critical findings, build verification evidence, JSON
+  shape stability, async API coverage, and CLI exit codes.
+
+### Changed
+- Updated eight tier skills and their routing metadata to require the
+  executable gate before downstream work proceeds.
+- Updated `/god-mode` and its runbook to run executable gates between tier
+  transitions.
+- Updated static checks and route-quality sync so missing gate instructions and
+  missing `standards.gate-command` metadata block release readiness.
+
 ## [2.4.3] - 2026-06-09
 
 ### Added

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-2.4.3-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.5.0-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -26,9 +26,10 @@ Godpowers makes AI coding accountable: every serious run should leave disk
 state, artifacts, validation gates, host guarantees, and a next action. Code is
 only one output. The project memory and proof trail matter too.
 
-Version 2.4.3 keeps the 2.4 command-family UX and adds external CLI canary
-evidence, prompt-size guardrails, legacy command quarantine, lib coverage
-gating, and temp-directory package verification before publish.
+Version 2.5.0 adds executable tier gates through `npx godpowers gate` while
+keeping the 2.4 command-family UX, external CLI canary evidence, prompt-size
+guardrails, legacy command quarantine, lib coverage gating, and package
+verification before publish.
 
 Maintainer hardening continues on the 2.x line with small, audited public
 surface updates when they close real workflow gaps. The 2.1.0 patch closes a command-injection vector in the
@@ -251,6 +252,7 @@ npx godpowers next --project=.
 npx godpowers status --project=. --brief
 npx godpowers status --project=. --json
 npx godpowers quick-proof --project=.
+npx godpowers gate --tier=prd --project=.
 npx godpowers dogfood
 npx godpowers extension-scaffold --name=@godpowers/my-pack --output=.
 ```
@@ -271,6 +273,17 @@ test order is maintained as a readable list instead of a long package script.
 decomposition, async runtime APIs, agent reference validation coverage, and God
 Mode runbook delegation.
 
+Tier skills now run the executable gate before downstream work proceeds:
+
+```bash
+npx godpowers gate --tier=prd --project=.
+npx godpowers gate --tier=build --project=.
+npx godpowers gate --tier=harden --project=.
+```
+
+The gate reads disk artifacts, runs the shared artifact linter, checks build
+verification evidence, and blocks unresolved Critical harden findings.
+
 The runtime remains dependency-free. YAML parsing is intentionally limited to
 the documented Godpowers subset used by intent, routing, workflow, and
 extension files, with parser coverage in `scripts/test-yaml-parser.js`.

package/RELEASE.md

@@ -1,12 +1,12 @@
-# Godpowers 2.4.3 Release
+# Godpowers 2.5.0 Release
 
 > Status: Ready for package verification
-> Date: 2026-06-09
+> Date: 2026-06-10
 
-Godpowers 2.4.3 is a review-followup release for the 2.4 line. It keeps the
-2.4 command-family UX intact while adding external CLI proof, prompt-size
-guardrails, legacy surface quarantine, lib coverage gating, and clean package
-verification before publish.
+Godpowers 2.5.0 ships executable tier gates for the code-first kernel
+migration. It keeps the slash-command workflow intact while giving command
+capable hosts a stable JSON gate contract and non-zero exit codes for blocked
+tier transitions.
 
 ## What's in this release
 
@@ -14,45 +14,39 @@ verification before publish.
 - 40 specialist agents
 - 13 executable workflows
 - 42 intent recipes
+- 8 installer CLI helpers
 
 ## Highlights
 
-- Three external CLI adoption canary case studies now cover sindresorhus/is,
-  expressjs/cors, and tinyhttp/tinyhttp, including commit hashes, elapsed time,
-  zero-dollar local CLI cost, pause counts, and explicit host-run gaps.
-- `agents/god-orchestrator.md`, `skills/god-next.md`, and
-  `skills/god-status.md` are now concise dispatch contracts that delegate
-  detailed runbook content to `references/`.
-- Repeated skill locking boilerplate now points to
-  `references/shared/LOCKING.md`.
-- `/god-roadmap-check` is deprecated, kept for full-profile compatibility, and
-  excluded from non-full installer profiles by regression test.
-- `npm run coverage:lib` enforces a 90 percent line coverage floor for
-  `lib/**/*.js`.
-- `npm run release:check` runs the full suite under the lib coverage floor
-  before audit and package verification.
-- Package verification now creates the npm tarball in a temporary directory and
-  removes it automatically.
+- `npx godpowers gate --tier=<tier> --project=.` checks PRD, design,
+  architecture, roadmap, stack, repo, build, and harden artifacts.
+- Gate JSON returns `{tier, verdict, artifacts, checks, findings, summary}` for
+  host-visible evidence.
+- Build gates require `.godpowers/build/STATE.md` to record exact verification
+  commands that passed.
+- Harden gates fail unresolved Critical findings and blocked launch gates.
+- `/god-mode` now runs executable gates between tier transitions.
+- Tier routes declare `standards.gate-command`, and static checks enforce the
+  skill and route metadata.
+- CLI command dispatch now lives in `lib/cli-dispatch.js`, keeping
+  `bin/install.js` thin.
 
 ## Validation
 
-- `node scripts/static-check.js` green
+- `node scripts/test-gate.js` green
 - `node scripts/test-cli-dispatch.js` green
-- `node scripts/test-installer-profiles.js` green
-- `node scripts/run-adoption-canary.js https://github.com/sindresorhus/is.git --output=docs/case-studies/sindresorhus-is-adoption-canary.md` green
-- `node scripts/run-adoption-canary.js https://github.com/expressjs/cors.git --output=docs/case-studies/expressjs-cors-adoption-canary.md` green
-- `node scripts/run-adoption-canary.js https://github.com/tinyhttp/tinyhttp.git --output=docs/case-studies/tinyhttp-adoption-canary.md` green
+- `node scripts/static-check.js` green
 - `npm run release:check` required before publish
 
 ## Upgrade
 
-- `npm install -g godpowers@2.4.3` or `npx godpowers@2.4.3`
-- Re-run `/god-context` in each project to refresh installed runtime metadata
-- No breaking changes for valid `.godpowers/` state.
+- `npm install -g godpowers@2.5.0` or `npx godpowers@2.5.0`
+- Re-run `/god-context` in each project to refresh installed runtime metadata.
+- Existing `.godpowers/` state remains compatible.
 
 ## Notes
 
-- GitHub release creation for `v2.4.3`
+- GitHub release creation for `v2.5.0`.
 - The tag should match the npm package version.
-- The `v2.4.3` tag should point to the release commit that matches the npm
-  `godpowers@2.4.3` package.
+- The `v2.5.0` tag should point to the release commit that matches the npm
+  `godpowers@2.5.0` package.

package/SKILL.md

@@ -53,6 +53,11 @@ Each tier gates on a verified artifact from the prior tier. You cannot build
 without architecture. You cannot deploy without a build. You cannot launch with
 unresolved Critical security findings.
 
+For PRD, design, architecture, roadmap, stack, repo, build, and harden, run
+`npx godpowers gate --tier=<tier> --project=.` after the tier artifact is
+created and before starting downstream tier work. A non-zero exit blocks
+progress until the artifact or evidence is repaired.
+
 ### 5. Context Isolation
 Every execution agent gets a fresh context window. The orchestrator is thin; it
 spawns workers with full context budgets. This defeats context rot.

package/bin/install.js

@@ -20,6 +20,7 @@ const {
 const { describeProfiles } = require('../lib/install-profiles');
 const commandFamilies = require('../lib/command-families');
 const identity = require('../lib/package-identity');
+const cliDispatch = require('../lib/cli-dispatch');
 
 const VERSION = identity.PACKAGE_VERSION;
 
@@ -50,6 +51,7 @@ function showHelp() {
   log('Commands:');
   log('  status               Show the Godpowers Dashboard for a project');
   log('  next                 Show the dashboard and recommended next command');
+  log('  gate                 Check a tier artifact gate');
   log('  quick-proof          Show a runnable proof from the shipped fixture');
   log('  automation-status    Show host automation provider support');
   log('  automation-setup     Show an opt-in automation setup plan');
@@ -63,6 +65,7 @@ function showHelp() {
   log('');
   log('Options:');
   log('  --project=<path>     Project root for status, next, proof, or automation commands');
+  log('  --tier=<name>        Tier for gate: prd, design, arch, roadmap, stack, repo, build, or harden');
   log('  --json               Emit JSON for status, next, proof, or automation commands');
   log('  --brief              Render compact output for status, next, or proof');
   log('  --name=<scope/name>  Extension package name for extension-scaffold');
@@ -96,6 +99,7 @@ function showHelp() {
   log('Examples:');
   log('  npx godpowers status --project=.');
   log('  npx godpowers next --project=.');
+  log('  npx godpowers gate --tier=prd --project=.');
   log('  npx godpowers quick-proof --project=.');
   log('  npx godpowers automation-status --project=.');
   log('  npx godpowers automation-setup --project=.');
@@ -107,105 +111,6 @@ function showHelp() {
   log('  npx godpowers --codex --cursor');
 }
 
-function runAutomationCommand(opts) {
-  const automation = require('../lib/automation-providers');
-  const result = opts.command === 'automation-setup'
-    ? automation.setupPlan(opts.project)
-    : automation.detect(opts.project);
-  if (opts.json) {
-    console.log(JSON.stringify(result, null, 2));
-  } else if (opts.command === 'automation-setup') {
-    console.log(automation.renderSetupPlan(result));
-  } else {
-    console.log(automation.render(result));
-  }
-}
-
-function runDashboardCommand(opts) {
-  const dashboard = require('../lib/dashboard');
-  const result = dashboard.compute(opts.project);
-  if (opts.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-
-  console.log(dashboard.render(result, { brief: opts.brief }));
-  if (opts.command === 'next') {
-    console.log('');
-    console.log('Suggested next command:');
-    console.log(`  ${result.next && result.next.command ? result.next.command : 'describe the next intent'}`);
-  }
-}
-
-function runDogfoodCommand(opts) {
-  const dogfood = require('../lib/dogfood-runner');
-  const result = dogfood.runAll();
-  if (opts.json) {
-    console.log(JSON.stringify(result, null, 2));
-  } else {
-    console.log(dogfood.render(result));
-  }
-  if (result.status !== 'pass') process.exit(1);
-}
-
-function runQuickProofCommand(opts) {
-  const quickProof = require('../lib/quick-proof');
-  const result = quickProof.compute(opts.project);
-  if (opts.json) {
-    console.log(JSON.stringify(result, null, 2));
-  } else {
-    console.log(quickProof.render(result, { brief: opts.brief }));
-  }
-}
-
-function runExtensionScaffoldCommand(opts) {
-  const authoring = require('../lib/extension-authoring');
-  if (!opts.extensionName) {
-    error('extension-scaffold requires --name=@scope/package');
-    process.exit(1);
-  }
-  const result = authoring.scaffold(opts.extensionOutput, {
-    name: opts.extensionName,
-    skill: opts.extensionSkill || undefined,
-    agent: opts.extensionAgent || undefined,
-    workflow: opts.extensionWorkflow || undefined,
-    runtimeVersion: VERSION
-  });
-  if (opts.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-
-  success(`Scaffolded ${result.name} at ${result.path}`);
-  if (result.written.length > 0) {
-    log(`Wrote ${result.written.length} file(s): ${result.written.join(', ')}`);
-  }
-  if (result.validation.length > 0) {
-    warn(`Validation warnings: ${result.validation.join('; ')}`);
-  } else {
-    success('Extension manifest validates');
-  }
-}
-
-const COMMAND_RUNNERS = {
-  status: runDashboardCommand,
-  next: runDashboardCommand,
-  'quick-proof': runQuickProofCommand,
-  'automation-status': runAutomationCommand,
-  'automation-setup': runAutomationCommand,
-  dogfood: runDogfoodCommand,
-  'extension-scaffold': runExtensionScaffoldCommand
-};
-
-function runCommand(opts) {
-  const runner = COMMAND_RUNNERS[opts.command];
-  if (runner) {
-    runner(opts);
-    return true;
-  }
-  return false;
-}
-
 function applyDefaultRuntimeSelection(opts) {
   if (opts.runtimes.length > 0 || opts.all) return;
   if (!process.stdin.isTTY) {
@@ -277,7 +182,7 @@ function main() {
     process.exit(0);
   }
 
-  if (runCommand(opts)) return;
+  if (cliDispatch.runCommand(opts)) return;
 
   console.log(BANNER);
   const srcDir = path.resolve(__dirname, '..');
@@ -300,13 +205,14 @@ if (require.main === module) {
 
 module.exports = {
   showHelp,
-  COMMAND_RUNNERS,
-  runCommand,
-  runAutomationCommand,
-  runDashboardCommand,
-  runDogfoodCommand,
-  runQuickProofCommand,
-  runExtensionScaffoldCommand,
+  COMMAND_RUNNERS: cliDispatch.COMMAND_RUNNERS,
+  runCommand: cliDispatch.runCommand,
+  runAutomationCommand: cliDispatch.runAutomationCommand,
+  runDashboardCommand: cliDispatch.runDashboardCommand,
+  runDogfoodCommand: cliDispatch.runDogfoodCommand,
+  runQuickProofCommand: cliDispatch.runQuickProofCommand,
+  runExtensionScaffoldCommand: cliDispatch.runExtensionScaffoldCommand,
+  runGateCommand: cliDispatch.runGateCommand,
   applyDefaultRuntimeSelection,
   runInstall,
   runUninstall,

package/fixtures/gate/build-pass/.godpowers/build/STATE.md

@@ -0,0 +1,10 @@
+# Build State
+
+## Delivered
+
+[DECISION] The build gate fixture records a completed implementation slice for executable gate tests.
+
+## Verification Commands
+
+- [DECISION] `npm test`: passed for the fixture project.
+- [DECISION] `npm run lint`: passed for the fixture project.

package/fixtures/gate/harden-pass/.godpowers/harden/FINDINGS.md

@@ -0,0 +1,14 @@
+# Security Findings
+
+## Summary
+
+[DECISION] The harden fixture contains no unresolved Critical findings.
+
+| Severity | Count |
+|---|---:|
+| Critical | 0 |
+| High | 0 |
+| Medium | 0 |
+| Low | 0 |
+
+[DECISION] Launch gate: PASSED.

package/fixtures/gate/repo-pass/.godpowers/repo/AUDIT.md

@@ -0,0 +1,9 @@
+# Repo Audit
+
+## Scaffold Evidence
+
+[DECISION] The repo gate fixture records that the scaffold artifact exists and can be linted by the Phase 1 gate.
+
+## Verification
+
+[DECISION] The fixture is intentionally minimal because Phase 1 does not run scaffold CI commands.

package/lib/artifact-map.js

@@ -0,0 +1,60 @@
+/**
+ * Shared tier artifact map for dashboard, gates, and documentation checks.
+ */
+
+const TIER_ARTIFACTS = {
+  prd: [
+    { path: '.godpowers/prd/PRD.md', required: true, lint: true }
+  ],
+  design: [
+    { path: 'DESIGN.md', required: true, lint: true },
+    { path: 'PRODUCT.md', required: false, lint: true },
+    { path: '.godpowers/design/STATE.md', required: true, lint: true }
+  ],
+  arch: [
+    { path: '.godpowers/arch/ARCH.md', required: true, lint: true }
+  ],
+  roadmap: [
+    { path: '.godpowers/roadmap/ROADMAP.md', required: true, lint: true }
+  ],
+  stack: [
+    { path: '.godpowers/stack/DECISION.md', required: true, lint: true }
+  ],
+  repo: [
+    { path: '.godpowers/repo/AUDIT.md', required: true, lint: true }
+  ],
+  build: [
+    { path: '.godpowers/build/STATE.md', required: true, lint: true }
+  ],
+  harden: [
+    { path: '.godpowers/harden/FINDINGS.md', required: true, lint: true }
+  ]
+};
+
+function normalizeTier(tier) {
+  if (!tier) return null;
+  return String(tier).replace(/^\/?god-/, '').toLowerCase();
+}
+
+function tiers() {
+  return Object.keys(TIER_ARTIFACTS);
+}
+
+function artifactsForTier(tier) {
+  const key = normalizeTier(tier);
+  if (!key || !TIER_ARTIFACTS[key]) return null;
+  return TIER_ARTIFACTS[key].map((artifact) => ({ ...artifact }));
+}
+
+function requiredArtifactsForTier(tier) {
+  const artifacts = artifactsForTier(tier);
+  return artifacts ? artifacts.filter((artifact) => artifact.required) : null;
+}
+
+module.exports = {
+  TIER_ARTIFACTS,
+  normalizeTier,
+  tiers,
+  artifactsForTier,
+  requiredArtifactsForTier
+};

package/lib/cli-dispatch.js

@@ -0,0 +1,162 @@
+/**
+ * Installer CLI command dispatch.
+ */
+
+const gate = require('./gate');
+const identity = require('./package-identity');
+
+const VERSION = identity.PACKAGE_VERSION;
+
+function log(msg) {
+  console.log(`  ${msg}`);
+}
+
+function success(msg) {
+  console.log(`  \x1b[32m+\x1b[0m ${msg}`);
+}
+
+function warn(msg) {
+  console.log(`  \x1b[33m!\x1b[0m ${msg}`);
+}
+
+function error(msg) {
+  console.error(`  \x1b[31mx\x1b[0m ${msg}`);
+}
+
+function runAutomationCommand(opts) {
+  const automation = require('./automation-providers');
+  const result = opts.command === 'automation-setup'
+    ? automation.setupPlan(opts.project)
+    : automation.detect(opts.project);
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else if (opts.command === 'automation-setup') {
+    console.log(automation.renderSetupPlan(result));
+  } else {
+    console.log(automation.render(result));
+  }
+}
+
+function runDashboardCommand(opts) {
+  const dashboard = require('./dashboard');
+  const result = dashboard.compute(opts.project);
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  console.log(dashboard.render(result, { brief: opts.brief }));
+  if (opts.command === 'next') {
+    console.log('');
+    console.log('Suggested next command:');
+    console.log(`  ${result.next && result.next.command ? result.next.command : 'describe the next intent'}`);
+  }
+}
+
+function runDogfoodCommand(opts) {
+  const dogfood = require('./dogfood-runner');
+  const result = dogfood.runAll();
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(dogfood.render(result));
+  }
+  if (result.status !== 'pass') process.exit(1);
+}
+
+function runQuickProofCommand(opts) {
+  const quickProof = require('./quick-proof');
+  const result = quickProof.compute(opts.project);
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(quickProof.render(result, { brief: opts.brief }));
+  }
+}
+
+function runExtensionScaffoldCommand(opts) {
+  const authoring = require('./extension-authoring');
+  if (!opts.extensionName) {
+    error('extension-scaffold requires --name=@scope/package');
+    process.exit(1);
+  }
+  const result = authoring.scaffold(opts.extensionOutput, {
+    name: opts.extensionName,
+    skill: opts.extensionSkill || undefined,
+    agent: opts.extensionAgent || undefined,
+    workflow: opts.extensionWorkflow || undefined,
+    runtimeVersion: VERSION
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  success(`Scaffolded ${result.name} at ${result.path}`);
+  if (result.written.length > 0) {
+    log(`Wrote ${result.written.length} file(s): ${result.written.join(', ')}`);
+  }
+  if (result.validation.length > 0) {
+    warn(`Validation warnings: ${result.validation.join('; ')}`);
+  } else {
+    success('Extension manifest validates');
+  }
+}
+
+function runGateCommand(opts) {
+  if (!opts.tier) {
+    const result = {
+      tier: null,
+      verdict: 'fail',
+      artifacts: [],
+      checks: [{ id: 'tier-required', status: 'fail', artifact: null, reason: 'gate requires --tier=<name>' }],
+      findings: [{ id: 'tier-required', severity: 'error', artifact: null, reason: 'gate requires --tier=<name>' }],
+      summary: { errors: 1, warnings: 0, infos: 0, missing: 0, checkedArtifacts: 0 }
+    };
+    if (opts.json) console.log(JSON.stringify(result, null, 2));
+    else console.log(gate.render(result));
+    process.exitCode = 1;
+    return;
+  }
+
+  const result = gate.check({ tier: opts.tier, projectRoot: opts.project });
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(gate.render(result));
+  }
+  if (gate.exitCode(result) !== 0) {
+    process.exitCode = 1;
+  }
+}
+
+const COMMAND_RUNNERS = {
+  status: runDashboardCommand,
+  next: runDashboardCommand,
+  'quick-proof': runQuickProofCommand,
+  'automation-status': runAutomationCommand,
+  'automation-setup': runAutomationCommand,
+  dogfood: runDogfoodCommand,
+  'extension-scaffold': runExtensionScaffoldCommand,
+  gate: runGateCommand
+};
+
+function runCommand(opts) {
+  const runner = COMMAND_RUNNERS[opts.command];
+  if (runner) {
+    runner(opts);
+    return true;
+  }
+  return false;
+}
+
+module.exports = {
+  COMMAND_RUNNERS,
+  runCommand,
+  runAutomationCommand,
+  runDashboardCommand,
+  runDogfoodCommand,
+  runQuickProofCommand,
+  runExtensionScaffoldCommand,
+  runGateCommand
+};

package/lib/dashboard.js

@@ -16,10 +16,11 @@ const automationProviders = require('./automation-providers');
 const repoDocSync = require('./repo-doc-sync');
 const repoSurfaceSync = require('./repo-surface-sync');
 const hostCapabilities = require('./host-capabilities');
+const artifactMap = require('./artifact-map');
 
 const GOD_DIR = '.godpowers';
-const PRD_PATH = '.godpowers/prd/PRD.md';
-const ROADMAP_PATH = '.godpowers/roadmap/ROADMAP.md';
+const PRD_PATH = artifactMap.requiredArtifactsForTier('prd')[0].path;
+const ROADMAP_PATH = artifactMap.requiredArtifactsForTier('roadmap')[0].path;
 const CHECKPOINT_PATH = '.godpowers/CHECKPOINT.md';
 const SYNC_LOG_PATH = '.godpowers/SYNC-LOG.md';
 const REVIEW_PATH = '.godpowers/REVIEW-REQUIRED.md';

package/lib/gate.js

@@ -0,0 +1,271 @@
+/**
+ * Executable Godpowers tier gates.
+ *
+ * Phase 1 gates are intentionally mechanical. They check expected artifacts on
+ * disk, run the shared artifact linter, and apply narrow tier-specific checks.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const artifactMap = require('./artifact-map');
+const linter = require('./artifact-linter');
+const router = require('./router');
+
+function relToAbs(projectRoot, relPath) {
+  return path.join(projectRoot, relPath);
+}
+
+function makeCheck(id, status, artifact, reason) {
+  return { id, status, artifact, reason };
+}
+
+function makeFinding(id, severity, artifact, reason, extra = {}) {
+  return { id, severity, artifact, reason, ...extra };
+}
+
+function emptySummary() {
+  return {
+    errors: 0,
+    warnings: 0,
+    infos: 0,
+    missing: 0,
+    checkedArtifacts: 0
+  };
+}
+
+function addFindingSummary(summary, severity) {
+  if (severity === 'error') summary.errors++;
+  else if (severity === 'warning') summary.warnings++;
+  else summary.infos++;
+}
+
+function lintArtifact(projectRoot, relPath, opts = {}) {
+  return linter.lintFile(relToAbs(projectRoot, relPath), {
+    projectRoot,
+    today: opts.today
+  });
+}
+
+function checkArtifacts(projectRoot, tier, artifacts, opts, result) {
+  for (const artifact of artifacts) {
+    const exists = fs.existsSync(relToAbs(projectRoot, artifact.path));
+    const artifactResult = {
+      path: artifact.path,
+      required: artifact.required,
+      exists,
+      lint: null
+    };
+    result.artifacts.push(artifactResult);
+
+    if (!exists) {
+      const status = artifact.required ? 'fail' : 'skipped';
+      result.checks.push(makeCheck(
+        `artifact:${tier}:${artifact.path}`,
+        status,
+        artifact.path,
+        artifact.required ? 'Required artifact is missing.' : 'Optional artifact is absent.'
+      ));
+      if (artifact.required) {
+        result.summary.missing++;
+        const finding = makeFinding(
+          `missing-artifact:${tier}:${artifact.path}`,
+          'error',
+          artifact.path,
+          'Required artifact is missing.'
+        );
+        result.findings.push(finding);
+        addFindingSummary(result.summary, finding.severity);
+      }
+      continue;
+    }
+
+    result.checks.push(makeCheck(
+      `artifact:${tier}:${artifact.path}`,
+      'pass',
+      artifact.path,
+      'Artifact exists on disk.'
+    ));
+
+    if (!artifact.lint) continue;
+    const lintResult = lintArtifact(projectRoot, artifact.path, opts);
+    artifactResult.lint = {
+      type: lintResult.type,
+      summary: lintResult.summary
+    };
+    result.summary.checkedArtifacts++;
+    for (const finding of lintResult.findings) {
+      result.findings.push({
+        ...finding,
+        id: `lint:${artifact.path}:${finding.code}:${finding.line}`,
+        artifact: artifact.path,
+        reason: finding.message
+      });
+      addFindingSummary(result.summary, finding.severity);
+    }
+    result.checks.push(makeCheck(
+      `lint:${tier}:${artifact.path}`,
+      lintResult.summary.errors > 0 ? 'fail' : 'pass',
+      artifact.path,
+      lintResult.summary.errors > 0
+        ? `${lintResult.summary.errors} lint error(s) block this gate.`
+        : `${lintResult.summary.warnings} warning(s), ${lintResult.summary.infos} info finding(s).`
+    ));
+  }
+}
+
+function extractPassedCommands(text) {
+  const commands = [];
+  for (const line of text.split(/\r?\n/)) {
+    const backtick = line.match(/`([^`\n]+)`/);
+    const labeled = line.match(/\bcommand\s*:\s*([^;]+?)(?:\s{2,}|\s+status\s*:|\s+result\s*:|$)/i);
+    const command = backtick ? backtick[1].trim() : (labeled ? labeled[1].trim() : null);
+    if (!command) continue;
+    if (/\b(pass|passed|green|success|succeeded|ok)\b/i.test(line)) {
+      commands.push(command);
+    }
+  }
+  return [...new Set(commands)];
+}
+
+function checkBuildEvidence(projectRoot, result) {
+  const relPath = '.godpowers/build/STATE.md';
+  const file = relToAbs(projectRoot, relPath);
+  if (!fs.existsSync(file)) return;
+  const text = fs.readFileSync(file, 'utf8');
+  const passedCommands = extractPassedCommands(text);
+  if (passedCommands.length === 0) {
+    const finding = makeFinding(
+      'build-verification-evidence',
+      'error',
+      relPath,
+      'Build state does not record exact project verification commands that passed.'
+    );
+    result.findings.push(finding);
+    addFindingSummary(result.summary, finding.severity);
+    result.checks.push(makeCheck(
+      'build-verification-evidence',
+      'fail',
+      relPath,
+      finding.reason
+    ));
+    return;
+  }
+  result.checks.push(makeCheck(
+    'build-verification-evidence',
+    'pass',
+    relPath,
+    `Build state records ${passedCommands.length} passed verification command(s).`
+  ));
+  result.summary.buildVerificationCommands = passedCommands;
+}
+
+function checkHardenCriticals(projectRoot, result) {
+  const relPath = '.godpowers/harden/FINDINGS.md';
+  const file = relToAbs(projectRoot, relPath);
+  if (!fs.existsSync(file)) return;
+  const pass = router.hasNoCriticalFindings(projectRoot);
+  if (!pass) {
+    const finding = makeFinding(
+      'harden-critical-findings',
+      'error',
+      relPath,
+      'Harden findings contain unresolved Critical findings or a blocked launch gate.'
+    );
+    result.findings.push(finding);
+    addFindingSummary(result.summary, finding.severity);
+  }
+  result.checks.push(makeCheck(
+    'harden-critical-findings',
+    pass ? 'pass' : 'fail',
+    relPath,
+    pass
+      ? 'No unresolved Critical findings or blocked launch gate found.'
+      : 'Unresolved Critical findings or a blocked launch gate block this gate.'
+  ));
+}
+
+function finalize(result) {
+  result.verdict = result.findings.some((finding) => finding.severity === 'error')
+    ? 'fail'
+    : 'pass';
+  return result;
+}
+
+function check(opts = {}) {
+  const projectRoot = path.resolve(opts.projectRoot || opts.project || process.cwd());
+  const tier = artifactMap.normalizeTier(opts.tier);
+  const artifacts = artifactMap.artifactsForTier(tier);
+  const result = {
+    tier,
+    verdict: 'fail',
+    project: projectRoot,
+    artifacts: [],
+    checks: [],
+    findings: [],
+    summary: emptySummary()
+  };
+
+  if (!tier || !artifacts) {
+    const supported = artifactMap.tiers().join(', ');
+    const finding = makeFinding(
+      'unknown-tier',
+      'error',
+      null,
+      `Unknown gate tier. Supported tiers: ${supported}.`
+    );
+    result.findings.push(finding);
+    addFindingSummary(result.summary, finding.severity);
+    result.checks.push(makeCheck('tier-supported', 'fail', null, finding.reason));
+    return finalize(result);
+  }
+
+  checkArtifacts(projectRoot, tier, artifacts, opts, result);
+  if (tier === 'build') checkBuildEvidence(projectRoot, result);
+  if (tier === 'harden') checkHardenCriticals(projectRoot, result);
+  return finalize(result);
+}
+
+async function checkAsync(opts = {}) {
+  return check(opts);
+}
+
+function exitCode(result) {
+  return result.verdict === 'pass' ? 0 : 1;
+}
+
+function render(result) {
+  const lines = [];
+  lines.push(`Godpowers Gate: ${result.tier || 'unknown'}`);
+  lines.push(`Verdict: ${result.verdict}`);
+  lines.push('');
+  lines.push('Artifacts:');
+  for (const artifact of result.artifacts) {
+    const marker = artifact.exists ? '+' : (artifact.required ? 'x' : '-');
+    lines.push(`  ${marker} ${artifact.path}${artifact.required ? '' : ' (optional)'}`);
+  }
+  lines.push('');
+  lines.push('Checks:');
+  for (const checkResult of result.checks) {
+    lines.push(`  ${checkResult.status.toUpperCase()} ${checkResult.id}: ${checkResult.reason}`);
+  }
+  if (result.findings.length > 0) {
+    lines.push('');
+    lines.push('Findings:');
+    for (const finding of result.findings) {
+      const where = finding.artifact ? `${finding.artifact}: ` : '';
+      lines.push(`  ${finding.severity.toUpperCase()} ${finding.id}: ${where}${finding.reason}`);
+    }
+  }
+  lines.push('');
+  lines.push(`Summary: ${result.summary.errors} error(s), ${result.summary.warnings} warning(s), ${result.summary.infos} info finding(s)`);
+  return lines.join('\n');
+}
+
+module.exports = {
+  check,
+  checkAsync,
+  extractPassedCommands,
+  exitCode,
+  render
+};

package/lib/installer-args.js

@@ -8,7 +8,8 @@ const COMMANDS = new Set([
   'automation-status',
   'automation-setup',
   'dogfood',
-  'extension-scaffold'
+  'extension-scaffold',
+  'gate'
 ]);
 
 function parseArgs(argv, cwd = process.cwd()) {
@@ -23,6 +24,7 @@ function parseArgs(argv, cwd = process.cwd()) {
     extensionSkill: null,
     extensionAgent: null,
     extensionWorkflow: null,
+    tier: null,
     runtimes: [],
     global: false,
     local: false,
@@ -46,6 +48,12 @@ function parseArgs(argv, cwd = process.cwd()) {
       case '--brief':
         opts.brief = true;
         break;
+      case '--tier':
+        if (args[i + 1]) {
+          opts.tier = args[i + 1];
+          i++;
+        }
+        break;
       case '--project':
         if (args[i + 1]) {
           opts.project = path.resolve(args[i + 1]);
@@ -93,6 +101,8 @@ function parseArgs(argv, cwd = process.cwd()) {
           opts.extensionAgent = arg.slice('--agent='.length);
         } else if (arg.startsWith('--workflow=')) {
           opts.extensionWorkflow = arg.slice('--workflow='.length);
+        } else if (arg.startsWith('--tier=')) {
+          opts.tier = arg.slice('--tier='.length);
         } else if (arg.startsWith('--profile=')) {
           opts.profile = arg.slice('--profile='.length);
         } else if (arg.startsWith('--') && RUNTIMES[arg.slice(2)]) {

package/lib/route-quality-sync.js

@@ -89,6 +89,17 @@ const STANDARDS_EXEMPT_COMMANDS = new Set([
   '/god-tech-debt'
 ]);
 
+const TIER_GATE_COMMANDS = new Set([
+  '/god-prd',
+  '/god-design',
+  '/god-arch',
+  '/god-roadmap',
+  '/god-stack',
+  '/god-repo',
+  '/god-build',
+  '/god-harden'
+]);
+
 function read(projectRoot, relPath) {
   const file = path.join(projectRoot, relPath);
   if (!fs.existsSync(file)) return '';
@@ -166,6 +177,7 @@ function detect(projectRoot) {
   let typedOutcomeCount = 0;
   let standardsExemptCount = 0;
   let traceEventMissingCount = 0;
+  let gateCommandCount = 0;
 
   for (const routePath of routes) {
     const route = parseRoute(projectRoot, routePath);
@@ -253,6 +265,24 @@ function detect(projectRoot) {
         );
       }
     }
+
+    if (TIER_GATE_COMMANDS.has(command)) {
+      const tierName = command.replace('/god-', '');
+      const expected = `npx godpowers gate --tier=${tierName} --project=.`;
+      const actual = route.standards && route.standards['gate-command'];
+      if (actual === expected) {
+        gateCommandCount++;
+      } else {
+        addCheck(
+          checks,
+          `missing-gate-command-${command.replace(/[^a-z0-9]+/gi, '-')}`,
+          'stale',
+          routePath,
+          `${command} must declare standards.gate-command as ${expected}.`,
+          { spawn: 'god-auditor' }
+        );
+      }
+    }
   }
 
   if (symbolicCount === 0) {
@@ -287,6 +317,14 @@ function detect(projectRoot) {
       : `${traceEventMissingCount} agent-spawning routes are missing required trace events.`,
     { spawn: traceEventMissingCount === 0 ? null : 'god-auditor' }
   );
+  addCheck(
+    checks,
+    'gate-command-policy',
+    checks.some((check) => check.id.startsWith('missing-gate-command-')) ? 'stale' : 'fresh',
+    'routing/',
+    `${gateCommandCount} tier routes declare executable gate commands.`,
+    { spawn: checks.some((check) => check.id.startsWith('missing-gate-command-')) ? 'god-auditor' : null }
+  );
 
   const stale = checks.filter((check) => check.status !== 'fresh');
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "godpowers",
-  "version": "2.4.3",
+  "version": "2.5.0",
   "description": "AI-powered development system: 112 slash commands and 40 specialist agents that take a project from raw idea to hardened production. Runs inside Claude Code, Codex, Cursor, Windsurf, Gemini, and 10+ other AI coding tools.",
   "bin": {
     "godpowers": "./bin/install.js"

package/references/orchestration/GOD-MODE-RUNBOOK.md

@@ -124,6 +124,25 @@ quality drift before declaring complete.
 ### --skip-hygiene
 Default. Skip the hygiene pass. Use when iterating quickly.
 
+## Tier transition gates
+
+After each tier skill returns, run the matching executable gate before starting
+the downstream tier:
+
+```bash
+npx godpowers gate --tier=prd --project=.
+npx godpowers gate --tier=design --project=.
+npx godpowers gate --tier=arch --project=.
+npx godpowers gate --tier=roadmap --project=.
+npx godpowers gate --tier=stack --project=.
+npx godpowers gate --tier=repo --project=.
+npx godpowers gate --tier=build --project=.
+npx godpowers gate --tier=harden --project=.
+```
+
+Run the design gate only when the project requires design. A non-zero gate exit
+pauses the project run for repair and blocks downstream tier dispatch.
+
 ## Mandatory final sync
 
 Regardless of flags, `/god-mode` always runs `/god-sync` before declaring

package/routing/god-arch.yaml

@@ -34,6 +34,7 @@ standards:
   three-label-test: true
   have-nots: [A-01, A-02, A-03, A-04, A-05, A-06, A-07, A-08, A-09, A-10, A-11, A-12, A-13]
   gate-on-failure: pause-for-user
+  gate-command: npx godpowers gate --tier=arch --project=.
 
 success-path:
   next-recommended: /god-roadmap

package/routing/god-build.yaml

@@ -29,6 +29,7 @@ standards:
   three-label-test: true
   have-nots: [B-01, B-02, B-03, B-04, B-05, B-06, B-07, B-08, B-09, B-10, B-11, B-12]
   gate-on-failure: pause-for-user
+  gate-command: npx godpowers gate --tier=build --project=.
 
 success-path:
   next-recommended: /god-deploy

package/routing/god-design.yaml

@@ -50,6 +50,7 @@ standards:
     - "purple-blue gradients" # impeccable anti-pattern
     - "Inter everywhere"      # impeccable anti-pattern
     - "cards in cards"        # impeccable anti-pattern
+  gate-command: npx godpowers gate --tier=design --project=.
 
 success-path:
   next-recommended: /god-arch

package/routing/god-harden.yaml

@@ -33,6 +33,7 @@ standards:
   three-label-test: true
   have-nots: [H-01, H-02, H-03, H-04, H-05, H-06, H-07, H-08, H-09, H-10, H-11]
   gate-on-failure: pause-for-user
+  gate-command: npx godpowers gate --tier=harden --project=.
 
 success-path:
   next-recommended: /god-launch

package/routing/god-prd.yaml

@@ -35,6 +35,7 @@ standards:
   three-label-test: true
   have-nots: [P-01, P-02, P-03, P-04, P-05, P-06, P-07, P-08, P-09, P-10, P-11, P-12, P-13, P-14, P-15]
   gate-on-failure: pause-for-user
+  gate-command: npx godpowers gate --tier=prd --project=.
 
 success-path:
   next-recommended: /god-arch

package/routing/god-repo.yaml

@@ -24,6 +24,7 @@ standards:
   three-label-test: true
   have-nots: [RP-01, RP-02, RP-03, RP-04, RP-05, RP-06, RP-07, RP-08]
   gate-on-failure: pause-for-user
+  gate-command: npx godpowers gate --tier=repo --project=.
 
 success-path:
   next-recommended: /god-build

package/routing/god-roadmap.yaml

@@ -31,6 +31,7 @@ standards:
   three-label-test: true
   have-nots: [R-01, R-02, R-03, R-04, R-05, R-06, R-07, R-08, R-09, R-10]
   gate-on-failure: pause-for-user
+  gate-command: npx godpowers gate --tier=roadmap --project=.
 
 success-path:
   next-recommended: /god-stack

package/routing/god-stack.yaml

@@ -29,6 +29,7 @@ standards:
   three-label-test: true
   have-nots: [S-01, S-02, S-03, S-04, S-05]
   gate-on-failure: pause-for-user
+  gate-command: npx godpowers gate --tier=stack --project=.
 
 success-path:
   next-recommended: /god-repo

package/skills/god-arch.md

@@ -26,7 +26,8 @@ Spawn the **god-architect** agent in a fresh context via the host platform's nat
 After god-architect returns:
 1. Verify ARCH.md and ADRs exist on disk
 2. Spawn god-auditor to verify have-nots pass
-3. Update `.godpowers/PROGRESS.md`: Architecture status = done
+3. Run `npx godpowers gate --tier=arch --project=.` and do not proceed on a non-zero exit
+4. Update `.godpowers/PROGRESS.md`: Architecture status = done
 
 ## Pause Format
 

package/skills/god-build.md

@@ -76,8 +76,10 @@ After all waves:
    decompose, prune, or escalate. Pass the exact failing diagnostics, rerun the
    command, and repeat until green or until the same root failure exhausts the
    repair budget.
-5. Update PROGRESS.md: Build status = done
-6. If the build plan or implementation establishes durable conventions, plan
+5. Record the exact verification commands that passed in `.godpowers/build/STATE.md`
+6. Run `npx godpowers gate --tier=build --project=.` and do not proceed on a non-zero exit
+7. Update PROGRESS.md: Build status = done
+8. If the build plan or implementation establishes durable conventions, plan
    pillar updates through `lib/pillars.planArtifactSync`. Under
    `/god-mode --yolo`, apply those updates immediately and log the decision.
 

package/skills/god-design.md

@@ -92,6 +92,14 @@ When DESIGN.md or PRODUCT.md change as a result of any subcommand:
 This pattern mirrors code review (god-spec-reviewer + god-quality-reviewer)
 applied to design.
 
+## Verification
+
+After god-designer and god-design-reviewer return:
+1. Verify `DESIGN.md` exists on disk
+2. Verify `.godpowers/design/STATE.md` exists on disk
+3. Run `npx godpowers gate --tier=design --project=.` and do not proceed on a non-zero exit
+4. Update `.godpowers/PROGRESS.md`: Design status = done when the project requires design
+
 ## Output
 
 Project root:

package/skills/god-harden.md

@@ -21,7 +21,8 @@ Spawn the **god-harden-auditor** agent in a fresh context via the host platform'
 
 After god-harden-auditor returns:
 1. Verify FINDINGS.md exists on disk
-2. Read findings classification:
+2. Run `npx godpowers gate --tier=harden --project=.` and do not proceed on a non-zero exit
+3. Read findings classification:
    - If any Critical: PROGRESS.md status = failed, launch is BLOCKED
    - If only High/Medium/Low: PROGRESS.md status = done
 

package/skills/god-mode.md

@@ -121,6 +121,10 @@ workflow.
        `safe-sync-clear` fails, run
        `/god-reconcile Release Truth And Safe Sync` before deploy, observe,
        harden, launch, broad migration, or resume work.
+     - Instruction to run `npx godpowers gate --tier=<tier> --project=.`
+       after each tier skill returns and before starting the downstream tier
+       for PRD, design when required, architecture, roadmap, stack, repo,
+       build, and harden. A non-zero exit pauses the project run for repair.
      - Instruction that `--yolo` cannot bypass safe sync blockers or
        unresolved Critical harden findings. These are release-truth gates, not
        preference pauses.

package/skills/god-prd.md

@@ -30,7 +30,8 @@ Spawn the **god-pm** agent in a fresh context via the host platform's native age
 After god-pm returns:
 1. Verify `.godpowers/prd/PRD.md` exists on disk
 2. Spawn god-auditor briefly to verify have-nots pass
-3. Update `.godpowers/PROGRESS.md`: PRD status = done
+3. Run `npx godpowers gate --tier=prd --project=.` and do not proceed on a non-zero exit
+4. Update `.godpowers/PROGRESS.md`: PRD status = done
 
 ## Pause Format
 

package/skills/god-repo.md

@@ -22,7 +22,8 @@ Spawn the **god-repo-scaffolder** agent in a fresh context via the host platform
 After god-repo-scaffolder returns:
 1. Verify AUDIT.md exists on disk
 2. Verify CI passes on the empty scaffold
-3. Update `.godpowers/PROGRESS.md`: Repo status = done
+3. Run `npx godpowers gate --tier=repo --project=.` and do not proceed on a non-zero exit
+4. Update `.godpowers/PROGRESS.md`: Repo status = done
 
 ## On Completion
 

package/skills/god-roadmap.md

@@ -23,7 +23,8 @@ Spawn the **god-roadmapper** agent in a fresh context via the host platform's na
 After god-roadmapper returns:
 1. Verify ROADMAP.md exists on disk
 2. Spawn god-auditor to verify have-nots pass
-3. Update `.godpowers/PROGRESS.md`: Roadmap status = done
+3. Run `npx godpowers gate --tier=roadmap --project=.` and do not proceed on a non-zero exit
+4. Update `.godpowers/PROGRESS.md`: Roadmap status = done
 
 ## On Completion
 

package/skills/god-stack.md

@@ -21,7 +21,8 @@ Spawn the **god-stack-selector** agent in a fresh context via the host platform'
 
 After god-stack-selector returns:
 1. Verify DECISION.md exists on disk
-2. Update `.godpowers/PROGRESS.md`: Stack status = done
+2. Run `npx godpowers gate --tier=stack --project=.` and do not proceed on a non-zero exit
+3. Update `.godpowers/PROGRESS.md`: Stack status = done
 
 ## On Completion