gitvow 0.1.0__tar.gz

gitvow-0.1.0/LICENSE

@@ -0,0 +1,17 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   Copyright 2026 gitvow contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

gitvow-0.1.0/PKG-INFO

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: gitvow
+Version: 0.1.0
+Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
+Author-email: Nikhil Bora <nikhil@wirevow.com>
+License: Apache-2.0
+Project-URL: Homepage, https://wirevow.dev/gitvow
+Project-URL: Documentation, https://wirevow.dev/gitvow
+Project-URL: Repository, https://github.com/wirevow/gitvow
+Project-URL: Security, https://github.com/wirevow/gitvow/blob/main/SECURITY.md
+Keywords: git,provenance,ai-agents,claude-code,hooks,policy
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Version Control :: Git
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-cov>=5; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Requires-Dist: bandit>=1.7; extra == "dev"
+Requires-Dist: pip-audit>=2.7; extra == "dev"
+Requires-Dist: mypy>=1.10; extra == "dev"
+Dynamic: license-file
+
+# gitvow
+
+Provenance and a policy gate for AI-agent coding sessions, stored in the git you already have.
+
+[![ci](https://github.com/wirevow/gitvow/actions/workflows/ci.yml/badge.svg)](https://github.com/wirevow/gitvow/actions/workflows/ci.yml)
+[![codeql](https://github.com/wirevow/gitvow/actions/workflows/codeql.yml/badge.svg)](https://github.com/wirevow/gitvow/actions/workflows/codeql.yml)
+![python](https://img.shields.io/badge/python-3.9%E2%80%933.12-blue) ![deps](https://img.shields.io/badge/runtime%20deps-0-brightgreen) ![license](https://img.shields.io/badge/license-Apache--2.0-blue)
+
+**Who made this change, what were they trying to do, and was it allowed?** For code written with AI agents, git alone cannot answer. gitvow makes it answer.
+
+- Commits made during an agent session carry the session id and a step number as **trailers**.
+- Each such commit gets a **session note**: the agent's stated plan, the tools it used, the files it touched, how much of the commit it wrote. Redacted, stored as a git note, never in the tree.
+- Every tool call passes a **gate** first: destructive commands are refused, risky ones require asking you, edits to gate-bearing files need a human. The rules are a JSON file you own. Missing policy fails closed.
+- A **ledger** of the whole session stays in your home directory. Nothing leaves the machine unless you push it.
+
+Standard-library Python and git. No runtime dependencies, no network calls, no telemetry.
+
+## Quick start
+
+```sh
+pip install gitvow
+gitvow install --user
+gitvow selftest
+```
+
+Work in Claude Code as usual. When the agent commits:
+
+```sh
+$ git log -1 --format=%B
+Fix week-start cache key
+
+Gitvow-Session: 8f3d5c71-574a-4eec-8903-9425e3a8335b
+Gitvow-Step: 4
+
+$ gitvow show HEAD
+...
+gitvow-session
+{
+ "step": 4,
+ "tools_used": ["Bash", "Edit", "Read"],
+ "last_stated_plan": "Change the cache key to include week start so per-org settings do not collide...",
+ "files_in_commit": ["query-engine/.../QueryCacheHelper.java | 4 +++-"],
+ "files_written_by_agent_this_session": ["query-engine/.../QueryCacheHelper.java"],
+ "attribution": {"files_in_commit": 1, "touched_by_agent": 1}
+}
+```
+
+Try the gate by hand:
+
+```sh
+gitvow check -- git push --force          # DENY: force push
+gitvow check -- kubectl apply -f x.yaml   # CONFIRM: cluster apply
+gitvow check --path core/authz_rules.go   # CONFIRM: edits an authorization or gate file
+```
+
+Remove everything:
+
+```sh
+gitvow uninstall --user
+```
+
+## Documentation
+
+The docs site is the source of truth: **https://wirevow.dev/gitvow** (built from `docs/`).
+
+- [Quick start](docs/quickstart.md)
+- Concepts: [Sessions, steps and notes](docs/concepts/sessions.md) · [The gate](docs/concepts/gate.md) · [What stays out of git](docs/concepts/storage.md)
+- Guides: [Install per user or per repo](docs/guides/install.md) · [Write a policy](docs/guides/policy.md) · [Read a commit's session](docs/guides/reading.md) · [Run a trial](docs/guides/trial.md) · [Redaction](docs/guides/redaction.md)
+- Reference: [CLI](docs/reference/cli.md) · [Hook payloads](docs/reference/hooks.md) · [Note schema](docs/reference/note.md) · [Policy schema](docs/reference/policy.md)
+- [Security](docs/security.md) · [Roadmap](docs/roadmap.md) · [FAQ](docs/faq.md)
+
+## How it works
+
+```
+Claude Code ──hook──▶ gitvow hook PreToolUse ──▶ policy ──▶ allow / confirm / deny  (exit 0 / 2 / 2)
+            ──hook──▶ gitvow hook PostToolUse ─▶ on `git commit`: read transcript → redact → git notes add
+git commit ──prepare-commit-msg──▶ Gitvow-Session / Gitvow-Step trailers   (from .git/gitvow-session.json)
+Claude Code ──hook──▶ gitvow hook Stop ─────────▶ ~/.gitvow/ledger/<session>.json
+```
+
+| Data | Where | Enters git? |
+|---|---|---|
+| session id, step | commit trailers | yes |
+| session note (structure, redacted plan, attribution) | `refs/notes/sessions` | as a note; local until pushed |
+| ledger, hook log, session state | `~/.gitvow/`, `<repo>/.git/` | no |
+| transcript | untouched | never |
+
+## Status
+
+0.1.0. Used in a small internal trial; the [roadmap](docs/roadmap.md) lists what comes next and what is deliberately not planned. Claude Code is the only agent supported today; the hook payload is [documented](docs/reference/hooks.md) so adapters are straightforward.
+
+## Contributing and security
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md). Reproductions of redaction gaps must use synthetic secrets.
+
+Apache-2.0.

gitvow-0.1.0/README.md

@@ -0,0 +1,96 @@
+# gitvow
+
+Provenance and a policy gate for AI-agent coding sessions, stored in the git you already have.
+
+[![ci](https://github.com/wirevow/gitvow/actions/workflows/ci.yml/badge.svg)](https://github.com/wirevow/gitvow/actions/workflows/ci.yml)
+[![codeql](https://github.com/wirevow/gitvow/actions/workflows/codeql.yml/badge.svg)](https://github.com/wirevow/gitvow/actions/workflows/codeql.yml)
+![python](https://img.shields.io/badge/python-3.9%E2%80%933.12-blue) ![deps](https://img.shields.io/badge/runtime%20deps-0-brightgreen) ![license](https://img.shields.io/badge/license-Apache--2.0-blue)
+
+**Who made this change, what were they trying to do, and was it allowed?** For code written with AI agents, git alone cannot answer. gitvow makes it answer.
+
+- Commits made during an agent session carry the session id and a step number as **trailers**.
+- Each such commit gets a **session note**: the agent's stated plan, the tools it used, the files it touched, how much of the commit it wrote. Redacted, stored as a git note, never in the tree.
+- Every tool call passes a **gate** first: destructive commands are refused, risky ones require asking you, edits to gate-bearing files need a human. The rules are a JSON file you own. Missing policy fails closed.
+- A **ledger** of the whole session stays in your home directory. Nothing leaves the machine unless you push it.
+
+Standard-library Python and git. No runtime dependencies, no network calls, no telemetry.
+
+## Quick start
+
+```sh
+pip install gitvow
+gitvow install --user
+gitvow selftest
+```
+
+Work in Claude Code as usual. When the agent commits:
+
+```sh
+$ git log -1 --format=%B
+Fix week-start cache key
+
+Gitvow-Session: 8f3d5c71-574a-4eec-8903-9425e3a8335b
+Gitvow-Step: 4
+
+$ gitvow show HEAD
+...
+gitvow-session
+{
+ "step": 4,
+ "tools_used": ["Bash", "Edit", "Read"],
+ "last_stated_plan": "Change the cache key to include week start so per-org settings do not collide...",
+ "files_in_commit": ["query-engine/.../QueryCacheHelper.java | 4 +++-"],
+ "files_written_by_agent_this_session": ["query-engine/.../QueryCacheHelper.java"],
+ "attribution": {"files_in_commit": 1, "touched_by_agent": 1}
+}
+```
+
+Try the gate by hand:
+
+```sh
+gitvow check -- git push --force          # DENY: force push
+gitvow check -- kubectl apply -f x.yaml   # CONFIRM: cluster apply
+gitvow check --path core/authz_rules.go   # CONFIRM: edits an authorization or gate file
+```
+
+Remove everything:
+
+```sh
+gitvow uninstall --user
+```
+
+## Documentation
+
+The docs site is the source of truth: **https://wirevow.dev/gitvow** (built from `docs/`).
+
+- [Quick start](docs/quickstart.md)
+- Concepts: [Sessions, steps and notes](docs/concepts/sessions.md) · [The gate](docs/concepts/gate.md) · [What stays out of git](docs/concepts/storage.md)
+- Guides: [Install per user or per repo](docs/guides/install.md) · [Write a policy](docs/guides/policy.md) · [Read a commit's session](docs/guides/reading.md) · [Run a trial](docs/guides/trial.md) · [Redaction](docs/guides/redaction.md)
+- Reference: [CLI](docs/reference/cli.md) · [Hook payloads](docs/reference/hooks.md) · [Note schema](docs/reference/note.md) · [Policy schema](docs/reference/policy.md)
+- [Security](docs/security.md) · [Roadmap](docs/roadmap.md) · [FAQ](docs/faq.md)
+
+## How it works
+
+```
+Claude Code ──hook──▶ gitvow hook PreToolUse ──▶ policy ──▶ allow / confirm / deny  (exit 0 / 2 / 2)
+            ──hook──▶ gitvow hook PostToolUse ─▶ on `git commit`: read transcript → redact → git notes add
+git commit ──prepare-commit-msg──▶ Gitvow-Session / Gitvow-Step trailers   (from .git/gitvow-session.json)
+Claude Code ──hook──▶ gitvow hook Stop ─────────▶ ~/.gitvow/ledger/<session>.json
+```
+
+| Data | Where | Enters git? |
+|---|---|---|
+| session id, step | commit trailers | yes |
+| session note (structure, redacted plan, attribution) | `refs/notes/sessions` | as a note; local until pushed |
+| ledger, hook log, session state | `~/.gitvow/`, `<repo>/.git/` | no |
+| transcript | untouched | never |
+
+## Status
+
+0.1.0. Used in a small internal trial; the [roadmap](docs/roadmap.md) lists what comes next and what is deliberately not planned. Claude Code is the only agent supported today; the hook payload is [documented](docs/reference/hooks.md) so adapters are straightforward.
+
+## Contributing and security
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md). Reproductions of redaction gaps must use synthetic secrets.
+
+Apache-2.0.

gitvow-0.1.0/pyproject.toml

@@ -0,0 +1,61 @@
+[build-system]
+requires = ["setuptools>=69", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "gitvow"
+version = "0.1.0"
+description = "Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies."
+readme = "README.md"
+license = {text = "Apache-2.0"}
+requires-python = ">=3.9"
+authors = [{name = "Nikhil Bora", email = "nikhil@wirevow.com"}]
+keywords = ["git", "provenance", "ai-agents", "claude-code", "hooks", "policy"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: Apache Software License",
+  "Programming Language :: Python :: 3",
+  "Topic :: Software Development :: Version Control :: Git",
+]
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "pytest-cov>=5", "ruff>=0.6", "bandit>=1.7", "pip-audit>=2.7", "mypy>=1.10"]
+
+[project.scripts]
+gitvow = "gitvow.cli:main"
+
+[project.urls]
+Homepage = "https://wirevow.dev/gitvow"
+Documentation = "https://wirevow.dev/gitvow"
+Repository = "https://github.com/wirevow/gitvow"
+Security = "https://github.com/wirevow/gitvow/blob/main/SECURITY.md"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.ruff]
+line-length = 120
+target-version = "py39"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "B", "UP", "S", "N", "C4", "SIM", "RUF"]
+ignore = ["S101", "S603", "S607", "E501"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = ["S105", "S106", "S108"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q --cov=gitvow --cov-report=term-missing --cov-fail-under=85"
+
+[tool.mypy]
+python_version = "3.10"
+strict = false
+ignore_missing_imports = true
+
+[tool.bandit]
+exclude_dirs = ["tests"]
+skips = ["B404", "B603", "B607"]

gitvow-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

gitvow-0.1.0/src/gitvow/__init__.py

@@ -0,0 +1,3 @@
+"""gitvow: provenance and policy gate for AI-agent coding sessions."""
+
+__version__ = "0.1.0"

gitvow-0.1.0/src/gitvow/cli.py

@@ -0,0 +1,135 @@
+"""gitvow command line."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+
+from . import __version__
+from .collect import collect, summarize_text
+from .hooks import HANDLERS
+from .install import install_repo, install_user, uninstall_repo, uninstall_user
+from .policy import PolicyError, evaluate, load_policy
+from .state import git
+
+
+def cmd_hook(a: argparse.Namespace) -> int:
+    try:
+        payload = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        payload = {}
+    handler = HANDLERS.get(a.event)
+    if not handler:
+        print(f"unknown hook event {a.event}", file=sys.stderr)
+        return 1
+    code, msg = handler(payload)
+    if msg:
+        print(msg, file=sys.stderr)
+    return code
+
+
+def cmd_install(a: argparse.Namespace) -> int:
+    done = install_user(os.path.expanduser("~")) if a.user else install_repo(os.path.abspath(a.repo))
+    print("\n".join(done))
+    return 0
+
+
+def cmd_uninstall(a: argparse.Namespace) -> int:
+    done = (
+        uninstall_user(os.path.expanduser("~"), a.purge_policy, a.purge_ledger)
+        if a.user
+        else uninstall_repo(os.path.abspath(a.repo), a.purge_notes)
+    )
+    print("\n".join(done))
+    return 0
+
+
+def cmd_check(a: argparse.Namespace) -> int:
+    """Dry-run the policy against a command, path or MCP tool name."""
+    try:
+        pol = load_policy(os.getcwd())
+    except PolicyError as e:
+        print(f"policy error: {e}", file=sys.stderr)
+        return 2
+    if a.path:
+        d = evaluate(pol, "Edit", {"file_path": a.path})
+    elif a.mcp:
+        d = evaluate(pol, a.mcp, {})
+    else:
+        d = evaluate(pol, "Bash", {"command": " ".join(a.command)})
+    print(d.outcome.upper() + (f": {d.reason}" if d.reason else ""))
+    return 2 if d.blocks else 0
+
+
+def cmd_show(a: argparse.Namespace) -> int:
+    """Print a commit's trailers and session note."""
+    rc, msg, _ = git(["log", "-1", "--format=%H%n%s%n%b", a.commit], os.getcwd())
+    if rc != 0:
+        print(f"no such commit: {a.commit}", file=sys.stderr)
+        return 1
+    print(msg)
+    rc, note, _ = git(["notes", "--ref=sessions", "show", a.commit], os.getcwd())
+    print(note if rc == 0 else "(no session note)")
+    return 0
+
+
+def cmd_collect(a: argparse.Namespace) -> int:
+    w = collect(os.path.expanduser("~"), a.out)
+    print(summarize_text(w))
+    print(f"collected into {w}  (redacted at write time; review before sending)")
+    return 0
+
+
+def cmd_summarize(a: argparse.Namespace) -> int:
+    print(summarize_text(a.dir))
+    return 0
+
+
+def cmd_selftest(a: argparse.Namespace) -> int:
+    from .selftest import run
+
+    return run()
+
+
+def main(argv: list[str] | None = None) -> int:
+    p = argparse.ArgumentParser(prog="gitvow", description="Provenance and policy gate for agent coding sessions.")
+    p.add_argument("--version", action="version", version=f"gitvow {__version__}")
+    sub = p.add_subparsers(dest="cmd", required=True)
+    s = sub.add_parser("hook", help="run as a Claude Code hook (reads JSON on stdin)")
+    s.add_argument("event")
+    s.set_defaults(f=cmd_hook)
+    s = sub.add_parser("install", help="install per user (--user) or into a repo")
+    s.add_argument("repo", nargs="?", default=".")
+    s.add_argument("--user", action="store_true")
+    s.set_defaults(f=cmd_install)
+    s = sub.add_parser("uninstall", help="remove what install added")
+    s.add_argument("repo", nargs="?", default=".")
+    s.add_argument("--user", action="store_true")
+    s.add_argument("--purge-notes", action="store_true")
+    s.add_argument("--purge-policy", action="store_true")
+    s.add_argument("--purge-ledger", action="store_true")
+    s.set_defaults(f=cmd_uninstall)
+    s = sub.add_parser("check", help="dry-run the policy: gitvow check -- git push --force")
+    s.add_argument("command", nargs="*")
+    s.add_argument("--path")
+    s.add_argument("--mcp")
+    s.set_defaults(f=cmd_check)
+    s = sub.add_parser("show", help="print a commit's trailers and session note")
+    s.add_argument("commit", nargs="?", default="HEAD")
+    s.set_defaults(f=cmd_show)
+    s = sub.add_parser("collect", help="gather ledger, logs, trailers and notes into one directory")
+    s.add_argument("--out", default=os.path.expanduser("~/Desktop"))
+    s.set_defaults(f=cmd_collect)
+    s = sub.add_parser("summarize", help="metrics from a collected directory")
+    s.add_argument("dir")
+    s.set_defaults(f=cmd_summarize)
+    s = sub.add_parser("selftest", help="prove the hooks work here without touching a real repo")
+    s.set_defaults(f=cmd_selftest)
+    a = p.parse_args(argv)
+    return a.f(a)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

gitvow-0.1.0/src/gitvow/collect.py

@@ -0,0 +1,103 @@
+"""Gather what a trial produced on this machine into one redacted directory, and compute trial metrics."""
+
+from __future__ import annotations
+
+import collections
+import glob
+import json
+import os
+import shutil
+import time
+from typing import Any
+
+from .state import git
+
+
+def collect(home: str, out_dir: str) -> str:
+    stamp = time.strftime("%Y%m%d-%H%M%S")
+    w = os.path.join(out_dir, f"gitvow-{stamp}")
+    os.makedirs(os.path.join(w, "ledger"), exist_ok=True)
+    os.makedirs(os.path.join(w, "repos"), exist_ok=True)
+    led = os.path.join(home, ".gitvow", "ledger")
+    repos: set[str] = set()
+    for f in glob.glob(os.path.join(led, "*.json")):
+        shutil.copy(f, os.path.join(w, "ledger"))
+        try:
+            with open(f) as fh:
+                r = json.load(fh).get("repo")
+            if r:
+                repos.add(r)
+        except (OSError, json.JSONDecodeError):
+            pass
+    for r in sorted(repos):
+        if not os.path.isdir(r):
+            continue
+        d = os.path.join(w, "repos", os.path.basename(r.rstrip("/")))
+        os.makedirs(d, exist_ok=True)
+        rc, gd, _ = git(["rev-parse", "--git-dir"], r)
+        if rc != 0:
+            continue
+        gd = gd if os.path.isabs(gd) else os.path.join(r, gd)
+        lp = os.path.join(gd, "gitvow-hooks.log")
+        if os.path.exists(lp):
+            shutil.copy(lp, os.path.join(d, "gitvow-hooks.log"))
+        for name, args in (
+            ("commits-with-trailers.txt", ["log", "--format=%H %ad %s", "--date=short", "--grep=Gitvow-Session:"]),
+            ("notes.txt", ["log", "--show-notes=sessions", "--format=%H%n%N%n----", "--grep=Gitvow-Session:"]),
+            ("remote.txt", ["remote", "get-url", "origin"]),
+        ):
+            _, out, _ = git(args, r)
+            with open(os.path.join(d, name), "w") as fh:
+                fh.write(out)
+    with open(os.path.join(w, "SUMMARY.txt"), "w") as fh:
+        fh.write(summarize_text(w))
+    return w
+
+
+def summarize(w: str) -> dict[str, Any]:
+    led = [json.load(open(f)) for f in glob.glob(os.path.join(w, "ledger", "*.json"))]  # noqa: SIM115
+    tools: collections.Counter[str] = collections.Counter(t.get("tool") for s in led for t in s.get("tool_calls", []))
+    kinds: collections.Counter[str] = collections.Counter()
+    reasons: collections.Counter[tuple[str, str]] = collections.Counter()
+    trailered = notes = 0
+    for lp in glob.glob(os.path.join(w, "repos", "*", "gitvow-hooks.log")):
+        with open(lp) as fh:
+            for line in fh:
+                try:
+                    e = json.loads(line)
+                except json.JSONDecodeError:
+                    continue
+                kinds[e.get("kind", "?")] += 1
+                if e.get("kind") in ("blocked", "confirm_required"):
+                    reasons[(e.get("kind", "?"), e.get("reason", "?"))] += 1
+    for f in glob.glob(os.path.join(w, "repos", "*", "commits-with-trailers.txt")):
+        with open(f) as fh:
+            trailered += sum(1 for ln in fh if ln.strip())
+    for f in glob.glob(os.path.join(w, "repos", "*", "notes.txt")):
+        with open(f) as fh:
+            notes += fh.read().count("gitvow-session")
+    return {
+        "sessions": len(led),
+        "repos": len({s.get("repo") for s in led}),
+        "tool_calls": sum(tools.values()),
+        "by_tool": dict(tools.most_common(8)),
+        "commits_during_sessions": sum(len(s.get("commits_during_session", [])) for s in led),
+        "hook_decisions": dict(kinds),
+        "commits_with_trailers": trailered,
+        "notes_attached": notes,
+        "gate_fired_on": [{"kind": k, "reason": r, "n": n} for (k, r), n in reasons.most_common(20)],
+    }
+
+
+def summarize_text(w: str) -> str:
+    s = summarize(w)
+    lines = [
+        f"sessions: {s['sessions']}   repos touched: {s['repos']}",
+        f"tool calls: {s['tool_calls']} | by tool: {s['by_tool']}",
+        f"commits during sessions: {s['commits_during_sessions']}",
+        f"hook decisions: {s['hook_decisions']}",
+        f"commits with trailers: {s['commits_with_trailers']} | notes attached: {s['notes_attached']}",
+        "gate fired on:",
+    ]
+    lines += [f"  {g['kind']:<17} {g['n']:>4}  {g['reason']}" for g in s["gate_fired_on"]] or ["  (never)"]
+    return "\n".join(lines) + "\n"