Plugin

Deterministic write gate: scope policy denies out-of-scope write/edit calls before they touch the disk, residue rules scan the written text, and every decision lands in a content-hashed JSONL ledger; can reuse the repo's agent-pr-gate.yaml so CI and session enforce one policy.