runward 0.16.0 → 0.18.0

package/README.md

@@ -74,7 +74,9 @@ New here? Follow [your first mission in 15 minutes](docs/first-mission.md).
 
 Global flags: `--yes`, `--dry-run`, `--verbose`, `--no-color`. Exit codes: 0 success, 1 gaps/warnings, 2 missing prerequisite.
 
-The gate's exit code is a **port**: `runward/adapters/` ships inert sample wiring so the gate runs at each harness's natural moment. The git `pre-commit` and CI adapters are **agent-agnostic** — they gate whatever agent produced the code (Codex, Claude, Cursor, Copilot, Gemini); the Claude Code `Stop`-hook is one example of a per-harness turn-end hook, not a privileged one. You copy an adapter in; runward never installs or runs one for you.
+The gate's exit code is a **port**: `runward/adapters/` ships inert sample wiring so the gate runs at each harness's natural moment.
+
+**Install runward from where you already work.** Beyond the copy-in adapters, runward publishes distributable packagings — a **GitHub Action** (`uses: stranxik/runward@<sha>` as a required check, the hard governance gate at merge), a **Claude Code plugin** (`/plugin marketplace add stranxik/runward`), and siblings for Gemini CLI, Codex, Copilot, Cursor and Kiro — each honestly tiered by how hard its gate can block, plus an MCP descriptor for discovery only (an MCP tool is model-controlled — findable, never a gate). The full, honestly-tiered map is [`docs/distribution.md`](docs/distribution.md). The operator installs; none is privileged. The git `pre-commit` and CI adapters are **agent-agnostic** — they gate whatever agent produced the code (Codex, Claude, Cursor, Copilot, Gemini); the Claude Code `Stop`-hook is one example of a per-harness turn-end hook, not a privileged one. You copy an adapter in; runward never installs or runs one for you.
 
 `init` creates:
 
@@ -85,6 +87,7 @@ your-project/
 │   ├── framing.md               # problem, value, observable success criterion, floor vs target
 │   ├── mission-contract.md      # one-page steering contract: engagements, DoD, gates
 │   ├── architecture.md          # boundaries, ports, integration protocol — stack stays open
+│   ├── execution-topology.md    # per-port placement: location family, data class, sovereignty (gated)
 │   ├── decision-matrix.md       # 22 arbitrations: one sober default + one explicit trigger each
 │   ├── reference-stack.md       # default adapter kit per layer, with evolution triggers
 │   ├── shared-bricks.md         # bricks beyond the app: placement families, brick matrix, sovereignty by data class
@@ -98,7 +101,7 @@ your-project/
 │   │   └── observability-schema.md
 │   ├── contracts/               # port contracts (versioned, additive, tolerant reader)
 │   ├── runbook.md               # recovery runbook for the team that inherits the system
-│   ├── adapters/                # inert samples that run the gate at each harness seam (git, GitHub/GitLab CI, Claude Code)
+│   ├── adapters/                # inert samples that run the gate at each harness seam (git, GitHub/GitLab CI, Claude Code, Kiro, BMAD)
 │   └── workflows/               # the method, executable by your agent
 └── .claude/ | .cursor/          # tool profiles (--tools)
 ```
@@ -120,17 +123,19 @@ Phase 5 is transverse: it starts at day zero, not after the incident.
 
 ## What makes it different
 
-- **The gate you own — deterministic and zero-LLM.** `runward check --strict` is a non-probabilistic, operator-owned exit-code gate: it cannot be jailbroken by injection (no model in the gate path) and reruns byte-for-byte. Every competitor gates on LLM generation plus human prose review; this one does not depend on an LLM to pass.
+Four things, and a code-level competitive check (July 2026) confirmed no other scaffold pairs them: a **rule-level gate with verified, sealed evidence**, a **gated hand-over**, and a **published, deterministic OSCAL mapping**. Each exists somewhere in isolation; the combination is runward's ground. The rest of this section is those four and the invariants under them.
+
+- **The gate you own — deterministic and zero-LLM.** `runward check --strict` is a non-probabilistic, operator-owned exit-code gate: it cannot be jailbroken by injection (no model in the gate path) and reruns byte-for-byte. Every competitor's *code* check is judged by the model; this one does not depend on an LLM to pass. (Two 2026 signals back the stance: FedRAMP RFC-0024 forbids GenAI-produced factual evidence, and the Delve affair showed why AI-produced audit evidence is not trusted.)
 - **The gate verifies the evidence, not just the row.** A pointer must resolve to real, non-empty content; a symbol or test name must actually be there; a rule can declare the shape its evidence must contain (`signature:` — the founding cited-not-applied incident is now caught deterministically); a stale pointer fails the gate; a sealed gate (`--freeze`) makes later erosion loud. Still bytes, never judgment — and never a model.
 - **runward gates itself.** This repository carries its own `runward/` mission, and CI requires `runward check --strict` green on runward's own code — including under network isolation. The discipline is demonstrated, not claimed.
-- **Audit-ready evidence, not compliance theatre.** Craft rules carry an OWASP ASI (Top 10 for Agentic Applications) mapping — a universal, region-agnostic security posture — so the conformance manifest reads as supporting evidence. Security-only by default; it maps to your regime when you need one — ISO/IEC 42001 (global), NIST AI RMF (US), or the EU AI Act art. 13 technical file (EU) — see [`docs/compliance/`](docs/compliance/). An input to that work — never a conformity assessment, never a claim to certify.
+- **Audit-ready evidence, in a published format.** Craft rules carry an OWASP ASI (Top 10 for Agentic Applications) mapping — a universal, region-agnostic security posture — so the conformance manifest reads as supporting evidence and exports as a machine-readable OSCAL pack. The decision → ADR → manifest → OSCAL chain is a **versioned, citable mini-spec** ([`docs/spec/runward-oscal-mapping.md`](docs/spec/runward-oscal-mapping.md)) anyone can reproduce or critique — the reference implementation of gate-level agentic-delivery evidence, not a black box. Security-only by default; it maps to your regime when you need one — ISO/IEC 42001 (global), NIST AI RMF (US), or the EU AI Act art. 13 technical file (EU) — see [`docs/compliance/`](docs/compliance/). An input to that work — never a conformity assessment, never a claim to certify.
 - **Never a runtime.** Runward writes nothing into `.git/`, installs nothing, and runs nothing of yours — it frames, gates and hands off. Your runtime and model are swappable adapters behind a port; the thing you depend on is never Runward.
 - **Floor, not MVP deck.** The floor is the smallest *running* system that proves value on real traffic. A presentation is not a floor.
 - **Evolution on evidence.** Multi-agent, long-term memory, microservices, a bigger model: each has a sober default and an explicit trigger. No trigger, no complexity. Every switch is an ADR.
 - **Security by architecture, not detection.** Prompt injection is constrained structurally (lethal trifecta, 2-of-3 rule), not filtered heuristically.
-- **Craft rules, not vibes.** 58 engineering craft rules ship with the mission (memory scoring, tiered retrieval, event sourcing, request-id propagation, multi-provider fallback, cost routing, post-turn pipelines, prompt-injection defenses…) — your agent applies them, `runward check` will not invent them. Code examples follow the reference-stack default (a single language in the core — TypeScript by default, an adapter decision like any other: see the decision matrix). The patterns are the contract; the language is the adapter.
+- **Craft rules, not vibes.** 64 engineering craft rules ship with the mission (memory scoring, tiered retrieval, event sourcing, request-id propagation, multi-provider fallback, cost routing, post-turn pipelines, prompt-injection defenses…) — your agent applies them, `runward check` will not invent them. Code examples follow the reference-stack default (a single language in the core — TypeScript by default, an adapter decision like any other: see the decision matrix). The patterns are the contract; the language is the adapter.
 - **One accountable operator, not a simulated team.** One human owns every gate while the agent executes the workflows — see [the operator role](docs/operator-role.md).
-- **Handover as a deliverable.** The mission ends when the receiving team is autonomous, with proof.
+- **Hand-over gated on proof, not a folder.** The mission ends when the receiving team redoes a real task without you — and that succession is a gated deliverable (`handover.md`, four handover rules), verified like every other phase. No other scaffold carries the mission past tested code, let alone checks the succession.
 
 ## The reference floor
 
@@ -146,7 +151,7 @@ Read the doctrine: [Concevoir et exécuter des systèmes agentiques (FR)](https:
 
 Two vendor-neutral files are **always written**, so the method works on any agent with no profile at all: `AGENTS.md` (the standard charter read by Codex, Cursor, Copilot, Windsurf, Cline, Zed, Amp, opencode, Junie, Warp and more), and the **phase skills** at `.agents/skills/runward-<phase>/SKILL.md` — the converged `SKILL.md` seam read by 14+ harnesses, which surface each build phase's craft rules *by relevance* at the point of action (subordinate to the gate: a skill loaded but not applied still fails `check --strict`).
 
-Tool profiles (`--tools`) add harness-specific wiring on top: **Claude Code** (`/rw-*` commands + `.claude/skills/`), **Cursor**, **GitHub Copilot**, **Gemini CLI**, **Windsurf** (charter files), **Continue.dev** (`.continue/rules/`), **JetBrains Junie** and **Trae** (`.<harness>/skills/`). The mission structure itself is plain markdown in your repo. More profiles welcome (see [ROADMAP.md](ROADMAP.md)).
+Tool profiles (`--tools`) add harness-specific wiring on top: **Claude Code** (`/rw-*` commands + `.claude/skills/`), **Cursor**, **GitHub Copilot**, **Gemini CLI**, **Windsurf** (charter files), **Continue.dev** (`.continue/rules/`), **JetBrains Junie** and **Trae** (`.<harness>/skills/`), and **Kiro** (`.kiro/steering/`, relevance-loaded). The mission structure itself is plain markdown in your repo. More profiles welcome (see [ROADMAP.md](ROADMAP.md)).
 
 ## License
 

package/dist/commands/characterize.js

@@ -2,7 +2,7 @@ import { existsSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { buildInventory, renderCharacterization, mineDrafts, renderDraft } from "../lib/characterize.js";
 import { makeWriter } from "../lib/write.js";
-import { c, createHeader, isNonInteractive, section, status } from "../lib/styles.js";
+import { c, createHeader, generationDate, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
 /**
  * Characterize an existing codebase (ADR-0014) — read-only, deterministic, zero-LLM.
@@ -22,7 +22,7 @@ export async function characterizeCommand(opts) {
     console.log(section("Reading (read-only)"));
     const inv = buildInventory(root);
     const dryRun = process.env.RUNWARD_DRY_RUN === "1";
-    const generatedAt = isNonInteractive() && process.env.RUNWARD_NOW ? process.env.RUNWARD_NOW : new Date().toISOString().slice(0, 10);
+    const generatedAt = generationDate();
     const md = renderCharacterization(inv, generatedAt);
     // Generated artifact, not mission state: always refresh it (idempotent).
     const w = makeWriter({ force: true, dryRun, root });

package/dist/commands/check.js

@@ -6,7 +6,7 @@ import { evidenceReport, verifyEvidenceLock, renderEvidenceLock, EVIDENCE_LOCK }
 import { behavioralProof } from "../lib/behavioral-proof.js";
 import { verifyFindings, VERIFY_FINDINGS } from "../lib/verify-findings.js";
 import { runHooks } from "../lib/hooks.js";
-import { c, createHeader, isNonInteractive, section, status } from "../lib/styles.js";
+import { c, createHeader, generationDate, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
 /**
  * Gate audit — the gap analysis: which deliverable, expected at which
@@ -195,7 +195,7 @@ export async function checkCommand(opts) {
             console.log("  " + status.error("refusing to seal a red gate — a seal certifies a crossing, not a hope. Close the gaps above, then re-run `runward check --freeze`."));
         }
         else {
-            const sealedAt = isNonInteractive() && process.env.RUNWARD_NOW ? process.env.RUNWARD_NOW : new Date().toISOString().slice(0, 10);
+            const sealedAt = generationDate();
             const content = renderEvidenceLock(mission, sealedAt);
             const count = Object.keys(JSON.parse(content).files).length;
             if (process.env.RUNWARD_DRY_RUN === "1") {

package/dist/commands/compliance.js

@@ -3,7 +3,7 @@ import { findMissionRoot } from "../lib/mission.js";
 import { gatherComplianceInputs, renderIso42001Readiness, renderNistAiRmf, renderEuAiAct, renderOscal } from "../lib/compliance.js";
 import { loadRegime, regimeLensId } from "../lib/regimes.js";
 import { makeWriter } from "../lib/write.js";
-import { c, createHeader, isNonInteractive, section, status } from "../lib/styles.js";
+import { c, createHeader, generationDate, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
 /**
  * Assemble a regime-framed compliance evidence pack (ADR-0016) — deterministic, read-only, zero-LLM,
@@ -44,7 +44,7 @@ export async function complianceCommand(regime, opts) {
     }
     const mission = join(root, "runward");
     const dryRun = process.env.RUNWARD_DRY_RUN === "1";
-    const generatedAt = isNonInteractive() && process.env.RUNWARD_NOW ? process.env.RUNWARD_NOW : new Date().toISOString().slice(0, 10);
+    const generatedAt = generationDate();
     console.log(section("Assembling (read-only, deterministic)"));
     const inputs = gatherComplianceInputs(mission);
     const md = spec.render(inputs, generatedAt, lens);

package/dist/commands/doctor.js

@@ -36,7 +36,8 @@ export async function doctorCommand() {
     const ruleCount = existsSync(rulesDir) ? readdirSync(rulesDir).filter((f) => f.endsWith(".md")).length : 0;
     ruleCount === EXPECTED_RULES ? ok(`${ruleCount} craft rules`) : fail(`craft rules mismatch: ${ruleCount}/${EXPECTED_RULES}`);
     const adaptersDir = join(TEMPLATES, "adapters");
-    const adapterCount = existsSync(adaptersDir) ? readdirSync(adaptersDir).length : 0;
+    // Count real adapters, not the README — else substituting an adapter for a stray file passes.
+    const adapterCount = existsSync(adaptersDir) ? readdirSync(adaptersDir).filter((f) => f !== "README.md").length : 0;
     adapterCount === EXPECTED_ADAPTERS ? ok(`${adapterCount} gate adapters`) : fail(`gate adapters mismatch: ${adapterCount}/${EXPECTED_ADAPTERS}`);
     // Routed-count floor (ADR-0002): the phases: mapping must not be stripped below its pinned minimum.
     const belowFloor = Object.entries(EXPECTED_MAPPED).filter(([phase, floor]) => expectedRules(TEMPLATES, phase).length < floor);

package/dist/lib/compliance.js

@@ -34,7 +34,9 @@ function readRules(missionDir) {
     if (!existsSync(dir))
         return [];
     const out = [];
-    for (const f of readdirSync(dir)) {
+    // Sorted: the ASI coverage lists and the OSCAL derive from this order, so it must be deterministic
+    // across filesystems (readdirSync order is not guaranteed) for the byte-identity invariant to hold.
+    for (const f of readdirSync(dir).sort()) {
         if (!f.endsWith(".md"))
             continue;
         let fm = "";
@@ -324,9 +326,15 @@ const ASI_CATALOG = "https://genai.owasp.org/resource/owasp-top-10-for-agentic-a
  */
 export function renderOscal(inputs, missionName, generatedAt, lensId) {
     const ns = missionName || "mission";
+    // The link points at the readiness draft co-generated with this pack — the one whose lens framed it.
+    const regime = lensId ? lensId.split("@")[0] : "iso-42001";
+    const readinessHref = `./${regime}-readiness.md`;
     const irs = Object.keys(ASI_LABELS).map((id) => {
         const slugs = inputs.asiCoverage.get(id) ?? [];
-        const statuses = slugs.map((s) => inputs.conformance.find((c) => c.rule === s)?.status).filter(Boolean);
+        // Aggregate EVERY manifest row of EVERY rule mapping this ASI, across all gated deliverables —
+        // a rule can appear in more than one manifest (spec §3). `find` (first row) made the status depend
+        // on deliverable order and could report `implemented` where a later `deviated` row means `partial`.
+        const statuses = slugs.flatMap((s) => inputs.conformance.filter((c) => c.rule === s).map((c) => c.status));
         let impl;
         if (slugs.length === 0)
             impl = "planned"; // no rule maps this risk — a gap
@@ -339,7 +347,7 @@ export function renderOscal(inputs, missionName, generatedAt, lensId) {
             "control-id": `asi-${id.slice(3)}`,
             description: `${id} ${ASI_LABELS[id]}. ${slugs.length ? "Addressed by rules: " + slugs.join(", ") + "." : "No rule mapped — gap to assess."}`,
             props: [{ name: "implementation-status", value: impl }],
-            links: [{ href: "./iso-42001-readiness.md", rel: "reference", text: "runward assessment-readiness draft" }],
+            links: [{ href: readinessHref, rel: "reference", text: "runward assessment-readiness draft" }],
         };
     });
     const doc = {

package/dist/lib/constants.js

@@ -1,6 +1,9 @@
 /** Total number of craft rules shipped under templates/rules/. */
 export const EXPECTED_RULES = 64;
-/** Gate adapters shipped under templates/adapters/ (ADR-0012): one per harness seam, plus the port-contract README. */
+/** Gate adapters shipped under templates/adapters/ (ADR-0012): one per harness seam. Counts the real
+ *  adapters only — the port-contract README.md is excluded, so swapping an adapter for a stray file
+ *  cannot pass the count. pre-commit, github-actions, gitlab-ci, claude-code-settings, kiro-hooks,
+ *  bmad-review-layer. */
 export const EXPECTED_ADAPTERS = 6;
 /** Routed-count floor: minimum CRITICAL/HIGH rules mapped to each build phase (ADR-0002).
  *  Lowering a floor is a deliberate, tracked edit — the `phases:` mapping cannot be silently

package/dist/lib/evidence.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { dirname, isAbsolute, join, relative } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { parseManifest, evidencePathTokens, adrIdExists, GATED_DELIVERABLES } from "./conformance.js";
 const POINTER_PREFIX = /\b(file|test|adr):(\S.*)$/;
 /** Parse the typed pointers out of an Evidence cell. One pointer per `;`-separated segment. */
@@ -53,16 +53,33 @@ export function parseEvidencePointers(evidence) {
 function clean(token) {
     return token.replace(/[),.:]+$/, "");
 }
+/**
+ * A rule signature is operator-authored data the gate compiles into a RegExp and runs against file
+ * content — so a catastrophic-backtracking pattern (nested quantifiers like `(a+)+`) could hang the
+ * gate on adversarial input (a self-inflicted DoS in CI). Reject the known-dangerous shape up front,
+ * deterministically: a quantifier applied to a group that itself contains a quantifier. This is a
+ * conservative screen (it may reject a rare safe pattern — the operator rewrites it), never a promise
+ * to catch every pathological regex. Signatures are simple token alternations in practice. See ADR-0020.
+ */
+export function unsafeSignature(source) {
+    // group whose body holds a quantifier, immediately followed by another quantifier: (…+…)+ (…*…)* etc.
+    return /\((?![?])[^()]*[+*}][^()]*\)[+*{]/.test(source);
+}
 /** The same three resolution bases as the drift pass (ADR-0004). */
 export function resolutionBases(missionDir, deliverable) {
     return [dirname(missionDir), missionDir, dirname(join(missionDir, deliverable))];
 }
+/** Resolve a pointer strictly WITHIN one of the three project bases (ADR-0019): an absolute
+ *  path, or a `../` that climbs out of every base, is not "evidence in your project" — it is
+ *  rejected, not resolved. `resolve` normalizes `..`; the containment check is a prefix test on
+ *  the normalized path (with a separator, so `/a/project-evil` never counts as under `/a/project`). */
 function resolveFile(p, bases) {
     if (isAbsolute(p))
-        return existsSync(p) ? p : null;
+        return null; // an absolute evidence path escapes the project — never valid
     for (const b of bases) {
-        const abs = join(b, p);
-        if (existsSync(abs))
+        const baseAbs = resolve(b);
+        const abs = resolve(baseAbs, p);
+        if ((abs === baseAbs || abs.startsWith(baseAbs + sep)) && existsSync(abs))
             return abs;
     }
     return null;
@@ -139,6 +156,10 @@ export function evidenceReport(missionDir, deliverable, signatures) {
         // Signature (ADR-0020): a signed rule's applied evidence must contain the rule's shape.
         const sig = signatures[row.rule];
         if (sig) {
+            if (unsafeSignature(sig)) {
+                out.push({ rule: row.rule, problem: `unsafe signature regex (nested quantifiers risk catastrophic backtracking): /${sig}/ — simplify it in runward/rules/${row.rule}.md` });
+                continue;
+            }
             let re;
             try {
                 re = new RegExp(sig, "i");

package/dist/lib/styles.js

@@ -54,6 +54,19 @@ export function section(title) {
 export function isNonInteractive() {
     return process.env.RUNWARD_YES === "1" || !process.stdout.isTTY;
 }
+/** Today (UTC, YYYY-MM-DD), or the RUNWARD_NOW override in non-interactive runs. The override is
+ *  VALIDATED as a real YYYY-MM-DD date: an unvalidated value flowed straight into the OSCAL and the
+ *  seal, so a malformed env var produced schema-invalid output. A bad value falls back to today. */
+export function generationDate() {
+    const today = new Date().toISOString().slice(0, 10);
+    const override = process.env.RUNWARD_NOW;
+    if (!isNonInteractive() || !override)
+        return today;
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(override))
+        return today;
+    const d = new Date(override + "T00:00:00Z");
+    return !isNaN(d.getTime()) && d.toISOString().slice(0, 10) === override ? override : today;
+}
 function stripAnsi(s) {
     // eslint-disable-next-line no-control-regex
     return s.replace(/\[[0-9;]*m/g, "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runward",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "After the spec: ship and run. A delivery framework for agentic systems \u2014 floor first, evolution on evidence, governance from day zero, handover with proof.",
   "keywords": [
     "agentic",

package/regimes/eu-ai-act@2024-1689.json

@@ -3,10 +3,10 @@
   "regime": "eu-ai-act",
   "label": "EU AI Act (Annex IV)",
   "version": "2024-1689",
-  "notes": "Mapped 2026-07 against Regulation (EU) 2024/1689 (OJ L, 12 July 2024). High-risk (Annex III) obligations bind from 2 August 2026. Annex IV wording moves — confirm against the Official Journal before filing.",
+  "notes": "Mapped against Regulation (EU) 2024/1689 (OJ L, 12 July 2024), as amended by the Digital Omnibus on AI (Council final green light 29 June 2026), which postponed the Annex III high-risk obligations to 2 December 2027 (Annex I to 2 August 2028). The 2 August 2026 milestone remains real for other obligations (Article 50 transparency for systems placed on the market after that date, governance, GPAI enforcement) but is NOT the high-risk / Annex IV deadline. Annex IV wording moves — confirm against the Official Journal before filing.",
   "highRisk": {
-    "bindFrom": "2 August 2026",
-    "scope": "Annex III"
+    "bindFrom": "2 December 2027",
+    "scope": "Annex III, as postponed by the Digital Omnibus on AI (June 2026)"
   },
   "articles": {
     "runtimeLogging": "art. 12"

package/templates/adapters/README.md

@@ -53,6 +53,10 @@ This is **one example** of a per-harness turn-end hook, not a privileged one —
 
 Copy the file into `.kiro/hooks/` in your workspace. The `Stop` trigger runs `runward check --strict` when the agent finishes, and surfaces the verdict in the session — the same one line as the Claude Code hook, another non-privileged example of a per-harness turn-end seam. Kiro also reads `AGENTS.md` natively, and `runward init --tools kiro` mirrors the phase skills as steering files (`.kiro/steering/`, relevance-loaded) — the traced decisions inform the session; the gate stays the only authority.
 
+## `bmad-review-layer.toml` — the gate as a review layer BMAD calls
+
+Copy the `[[workflow.review_layers]]` block into the customize.toml of BMAD's `bmad-code-review` skill. It adds runward's deterministic gate as one review layer beside BMAD's adversarial LLM reviewers (their extension point explicitly allows "an external reviewer via bash"): they judge the code's craft, runward verifies the traced decisions and their evidence. A complement running on BMAD's flow, not a competitor to it — same inert posture, same exit-code port (ADR-0027).
+
 ---
 
 Adapters are runward-owned templates: `runward update` refreshes them, `runward doctor` verifies them. They are never mission state. Add a new harness by dropping a new sample here — the port contract above does not change.

package/templates/adapters/bmad-review-layer.toml

@@ -0,0 +1,32 @@
+# runward gate — BMAD review-layer adapter (sample).
+# Inert until you install it: see runward/adapters/README.md.
+#
+# BMAD's bmad-code-review skill exposes a review-layers extension point whose
+# `instruction` may "run anything (e.g. an external reviewer via bash)". This
+# adds runward's deterministic, zero-LLM gate as one review layer BESIDE BMAD's
+# LLM reviewers — a complement, not a replacement: BMAD's subagents judge the
+# code's craft; runward verifies, deterministically, that every CRITICAL/HIGH
+# rule mapped to the phase is accounted for with real, resolving evidence.
+#
+# To install: copy this [[workflow.review_layers]] block into the customize.toml
+# of BMAD's bmad-code-review skill (src/bmm-skills/4-implementation/bmad-code-review/).
+# runward writes nothing into BMAD and runs nothing on its own — you wire it (ADR-0012).
+#
+# Exit codes (the port contract): 0 clean · 1 gaps · 2 no mission found.
+
+[[workflow.review_layers]]
+id = "runward-gate"
+name = "runward deterministic gate"
+# `when` (optional) could gate this layer on a runward/ mission being present.
+instruction = """
+Run the runward deterministic conformance gate as an external reviewer, via bash:
+
+    npx --yes runward check --strict
+
+Report its exit code and output verbatim as this layer's finding:
+- exit 0 → the conformance manifests are complete and their evidence resolves (a PASS finding, no severity).
+- exit 1 → report each printed gap as a finding the operator must close before merge (a traced rule is unaccounted for, or an evidence pointer is hollow/stale). Do NOT paraphrase or soften: the gate is deterministic and its verdict is not a matter of judgment.
+- exit 2 → no runward/ mission here; skip this layer (it does not apply to this repo).
+
+This layer verifies traced decisions and their evidence; it never judges code quality — that stays the other review layers' job and the operator's at the gate.
+"""