# RM-02 Gate Registry Implementation Plan > **For Pi:** Use test-driven development and execute each task RED → GREEN → refactor. **Goal:** Build a machine-readable seven-gate registry and an unconditional CI verifier that detects inert gates, binds criteria to observed negative controls, records defects honestly, and verifies the current PR tree unprivileged and fail-closed. **Architecture:** A dependency-free Node CLI reads `gates/gates.manifest.json` and the same-checkout `gates/required-gates.baseline.json`, validates closed schemas and references, then runs typed cases in isolated main-disk fixtures. Detects accidental and incompetent inventory drift within a checkout; does NOT survive an adversary who rewrites baseline, manifest, and verifier consistently — that guarantee requires RM-60's external boundary. Gate-specific fixture setup remains declarative; exact invocations, evidence-side subjects, and exact observed/required exits stay in JSON. The production verifier is structurally incapable of asserting history provenance; RM-60 owns the provider-controlled/protected pre-execution boundary. **Tech Stack:** Node.js ESM, `node:test`, JSON, shell gates, pnpm, Woodpecker CI. --- ### Task 1: Meta-negative-control kernel **Files:** - Create: `scripts/gate-verify.test.mjs` - Create: `scripts/gate-verify.mjs` 1. Write a black-box fixture whose gate failure branch has already been changed to success. 2. Run `node --test scripts/gate-verify.test.mjs`; require failure because the absent verifier does not name the inert gate. 3. Implement manifest loading, exact process execution, and named mismatch reporting only. 4. Re-run and require the external inert mutation to produce verifier nonzero while the test passes. 5. Add an internally applied declared mutation and require a healthy fixture to report its negative control armed. ### Task 2: Registry structural clauses **Files:** - Modify: `scripts/gate-verify.test.mjs` - Modify: `scripts/gate-verify.mjs` Add failing tests, one behavior at a time, for: `unregistered gate`; `no negative control`; unbound criterion; unbound `GATE-CLAIM`; ownerless required/actual delta; stale/ambiguous/ineffective mutation; direct modeled conflict; missing meaning-change provenance. Implement the minimum validator after each observed RED. ### Task 3: Gate fixtures and seven-gate manifest **Files:** - Create: `gates/gates.manifest.json` - Create: `gates/fixtures/quality-case.mjs` - Create: `gates/fixtures/preflight-case.mjs` - Create: `gates/fixtures/queue-case.sh` - Create: `gates/fixtures/hook-case.sh` - Modify: `scripts/gate-verify.test.mjs` Register typecheck, lint, format, RM-01 preflight, queue guard, pre-commit, and pre-push. For each, first run its known-bad case against an intentionally inert fixture and observe verifier RED; then restore the real gate behavior and require its exact observed exit/reason. Record queue defects as required/actual deltas owned by RM-03, never as pass/green/OK. ### Task 4: Source-versus-deployed identity **Files:** - Modify: `gates/gates.manifest.json` - Modify: `scripts/gate-verify.test.mjs` - Modify: `scripts/gate-verify.mjs` Write and observe a failing test with a byte-mutated deployed counterpart. Implement byte equality and internal drift mutation controls. Declare `none` explicitly for gates without deployed counterparts. ### Task 5: Prose claims and compatibility constructions **Files:** - Modify: `docs/remediation/MISSION.md` - Modify: `docs/remediation/TASKS.md` only if coordinator authorization overrides the worker prohibition; otherwise place markers in an RM-02 claim index that references immutable source anchors. - Modify: `gates/gates.manifest.json` - Modify: verifier tests/implementation. Enumerate current security/integrity claims, bind each marker/id to a negative case, and reject unbound markers. Execute finite compatibility scenarios and clearly document that arbitrary English consistency is outside the model. ### Task 6: Current-tree boundary and enforced history-provenance exclusion **Files:** - Create: `gates/required-gates.baseline.json` - Create: `scripts/gate-history-exclusion-control.mjs` - Create: `scripts/gate-inventory-shrink-control.mjs` - Modify: `scripts/gate-verify.mjs` - Modify: `gates/gates.manifest.json` Verify current-tree behavior only. Remove the anchor-dependent history verifier and provider-history consumption because PR-controlled lifecycle code executes before the gate and makes every local git anchor untrustworthy. Use a closed current-tree observation renderer and register a must-fail control that turns red if history/ancestry/lineage success becomes representable or production output bypasses renderer consumption. Compare the verifier inventory and manifest separately against the same-checkout baseline, register must-fail attacks that shrink either paired representation, and register an overclaim control. Detects accidental and incompetent inventory drift within a checkout; does NOT survive an adversary who rewrites baseline, manifest, and verifier consistently — that guarantee requires RM-60's external boundary. State both directions: current-tree controls, inventory shape, and evidence subjects are enforced here; history provenance is not established until RM-60 provides a provider-controlled/protected pre-execution boundary. ### Task 7: CI and documentation **Files:** - Modify: `package.json` - Modify: `.woodpecker/ci.yml` - Create/update: `docs/DEVELOPER-GUIDE/quality-gate-registry.md` - Create/update: `docs/ADMIN-GUIDE/quality-gate-registry.md` - Modify: `docs/SITEMAP.md` Add `gate:verify`; run it in an unconditional PR/main CI step. Document invocation, defect semantics, coverage/exclusions, marker syntax, replay/provider boundaries, and source/deployed identity. ### Task 8: Verification and delivery Run focused tests, `pnpm gate:verify`, checkout tests, typecheck, lint, format, and applicable integration tests. Run Codex code and security review; remediate and re-review. Verify authorship, commit, execute queue guard before push, push, create PR via Mosaic wrapper, and send exact-head review request to rev-974 through the coordinator. Do not merge without coordinator authorization.