forked from mosaicstack/stack
mos-dt-0andClaude Opus 5
8c496993e4
The gate that actually runs is the installed copy at ~/.config/mosaic/tools/git/; a repo-scoped registry would test packages/mosaic/framework/tools/git/. Byte-identical today (sha256 19cda2f7009c536e both) but nothing asserts it. A registry that verifies the wrong artifact is worse than none — it manufactures confidence, and the divergence would be invisible from every signal we have: registry green, CI green, deployed gate arbitrarily different. D-1/P-ACTIVATION applied to the enforcement mechanism itself rather than to config. RM-02 gains: for every registered gate with a deployed counterpart, assert repo-source == deployed-copy with a must-fail control; where none exists, record that explicitly. Found by design review before implementation — the only finding tonight not found by execution, which is the design-first gate on keystone tasks paying for itself. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>