diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 1fc417da2..4afbc7151 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -435,9 +435,32 @@ jobs:
       - name: A port inventory does not read as a capability claim
         run: node .harness/scripts/ci/45-validate-port-inventory-honesty.mjs --verbose
 
+      # GT-624: the 2026-07-23 security wave sat unpublished until 2026-07-27
+      # while SECURITY.md declared the 1.1.x line "actively patched". Nothing
+      # detected it; an audit did. This asks the registry what is published, finds
+      # the commit where each package's published version was SET, and fails on any
+      # commit after it whose type or scope marks it as security. It needs the
+      # network — a registry answer is the only honest source for "published", as
+      # the newest v* tag here is v1.1.0 while npm serves 1.2.2.
+      - name: No security fix is committed but unpublished
+        run: node .harness/scripts/ci/48-validate-security-publish-lag.mjs --verbose
+
+      # GT-638: a gap id is chosen by reading the highest GT-* on whichever branch
+      # you are on, so two parallel sessions allocate the same number and find out
+      # at merge time. `8449af3d` had to renumber GT-634 -> GT-637 for exactly this.
+      # The comparison needs the BASE branch, which a shallow checkout does not
+      # have — fetch it explicitly rather than letting the guard fail for the wrong
+      # reason.
+      - name: One gap id, one gap
+        run: |
+          git fetch --no-tags --depth=1 origin "${{ github.base_ref || github.event.repository.default_branch }}"
+          node .harness/scripts/ci/49-validate-gap-id-allocation.mjs --verbose
+
       - name: Self-tests for the governance guards
         run: |
           node --test .harness/scripts/ci/42-validate-guard-denominators.test.mjs
+          node --test .harness/scripts/ci/48-validate-security-publish-lag.test.mjs
+          node --test .harness/scripts/ci/49-validate-gap-id-allocation.test.mjs
           node --test .harness/scripts/ci/41-validate-evidence-commands.test.mjs
           node --test .harness/scripts/ci/43-validate-guard-negative-fixtures.test.mjs
           node --test .harness/scripts/ci/44-validate-adr-implementation-status.test.mjs
@@ -459,7 +482,7 @@ jobs:
       - name: Execute the board's recorded validationCommands (report mode)
         run: node .harness/scripts/ci/41-validate-evidence-commands.mjs --execute --verbose
 
-      # Ratchet, not a cliff. The budget is 21, which is what THIS RUNNER counts.
+      # Ratchet, not a cliff. The budget is 19, which is what THIS RUNNER counts.
       #
       # It was briefly lowered to 303 on the strength of the guard's computed
       # "ratchet basis" — 288 dead locally plus 15 that resolve only through
@@ -490,7 +513,7 @@ jobs:
       # Lower it as records are repaired, from a number this job printed; at 0,
       # delete the flag and this becomes the strict gate.
       - name: Dead-reference ratchet (must not grow)
-        run: node .harness/scripts/ci/41-validate-evidence-commands.mjs --strict --max-dead 21
+        run: node .harness/scripts/ci/41-validate-evidence-commands.mjs --strict --max-dead 19
 
   # RETIRED 2026-07-27 (GT-570): the `publish-npm` job lived here and published
   # ONLY `src/sdk/cli`, with `--tag beta` and no provenance, writing the token
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 79d647a33..4d49b6cdf 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -99,13 +99,17 @@ jobs:
       - name: Self-tests for the ADR ruleset generator
         run: node --test .harness/scripts/generate-adr-rulesets.test.mjs
 
-      # GT-598 / GT-633: `native-evaluability-snapshot.json` says of itself that it
-      # is a capture, and for a long time nothing captured it — it was written by
-      # hand and drifted, while its guard compared the file against six numbers
-      # typed into the test: the same six the file contained. Drift is not
-      # contained either, because `build-iso-5055-mapping.mjs` stamps
-      # nativeEvaluability onto all 388 mapping rows FROM this file. The order of
-      # these two steps is the order of the chain.
+      # GT-598: `native-evaluability-snapshot.json` says of itself that it is a
+      # capture, and until now nothing captured it — it was written by hand, and
+      # it drifted. It still declared `documentation-only: 129` after Core moved
+      # to 136 (the same seven ADR rulesets the step above exists for), and its
+      # guard could not see that, because it compared the snapshot against six
+      # numbers hardcoded in the test: the same six the snapshot contained.
+      #
+      # Drift here is not contained. `build-iso-5055-mapping.mjs` stamps
+      # nativeEvaluability onto all 388 rows of the mapping FROM this file, so a
+      # stale class is laundered into the larger artifact and overstates the
+      # handler backlog. The order of these two steps is the order of the chain.
       - name: Native evaluability snapshot is a faithful capture of Core's triage
         run: node src/rulesets/standards/capture-native-evaluability-snapshot.mjs --check
 
diff --git a/.gitignore b/.gitignore
index 453187c08..2030016fb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,7 +38,12 @@ bower_components
 build/Release
 
 # Dependency directories
-node_modules/
+# No trailing slash on purpose: `node_modules/` matches directories ONLY, and a
+# fresh worktree has no node_modules of its own — the documented workaround is to
+# symlink the main checkout's. A symlink is not a directory, so the slashed form
+# left it untracked-but-visible, and `git add -A` staged a link to an absolute
+# path on one machine.
+node_modules
 .harness/bin/
 jspm_packages/
 
diff --git a/.harness/scripts/ci/41-validate-evidence-commands.mjs b/.harness/scripts/ci/41-validate-evidence-commands.mjs
index 882c8a047..513765254 100644
--- a/.harness/scripts/ci/41-validate-evidence-commands.mjs
+++ b/.harness/scripts/ci/41-validate-evidence-commands.mjs
@@ -194,6 +194,56 @@ const SAFE_GIT_SUBS = new Set([
 /** `npm <sub>` classification. */
 const NPM_MUTATING = new Set(['publish', 'ci', 'install', 'i', 'link', 'version', 'pack', 'audit']);
 
+/**
+ * Flags whose VALUE is the next token, so the value is not an operand.
+ *
+ * Without this, `npm run --workspace src/sdk/cli test` reports that the script
+ * `"src/sdk/cli"` is not declared: the first non-dash token after `run` is the
+ * flag's value, not the script name. That form is valid npm, so the recorded
+ * command was right and the parser was wrong — and the failure LOOKED like stale
+ * evidence, which is the worst way for a guard to be wrong.
+ */
+const VALUE_TAKING_FLAGS = new Set([
+  '--workspace', '-w', '--prefix', '-C', '--filter', '--registry', '--loglevel', '--tag',
+]);
+
+/**
+ * Built-in subcommands of npm / pnpm / yarn that are NOT package scripts.
+ *
+ * `pnpm info <pkg>` and `yarn info <pkg>` query the registry. Reading `info` as a
+ * script name and then failing because no `"info"` script is declared blames the
+ * evidence for a command that runs perfectly well.
+ */
+const PM_BUILTIN_SUBCOMMANDS = new Set([
+  'info', 'view', 'ls', 'list', 'exec', 'why', 'outdated', 'dlx', 'create', 'init',
+  'ping', 'search', 'whoami', 'config', 'licenses', 'dedupe', 'store', 'root', 'bin',
+  'prefix', 'explain', 'doctor', 'help', 'add', 'remove', 'update', 'up', 'dist-tag',
+  'deprecate', 'owner', 'access', 'team', 'star', 'unpublish', 'login', 'logout',
+]);
+
+/**
+ * Index of the first true operand at or after `from`, skipping flags AND the
+ * values they consume. -1 when the token list is nothing but flags.
+ */
+function firstOperandIndex(tokens, from) {
+  for (let i = from; i < tokens.length; i += 1) {
+    const tok = tokens[i];
+    if (tok === '--') return -1; // everything after `--` belongs to the script
+    if (tok.startsWith('-')) {
+      if (VALUE_TAKING_FLAGS.has(tok)) i += 1; // its value is not an operand
+      continue;
+    }
+    return i;
+  }
+  return -1;
+}
+
+/** The operand itself, or null. */
+function firstOperand(tokens, from) {
+  const i = firstOperandIndex(tokens, from);
+  return i === -1 ? null : tokens[i];
+}
+
 /**
  * Scripts this runner refuses to spawn even though they are `node` and
  * resolvable. Each entry needs a reason: a bare denylist rots into a no-op.
@@ -512,17 +562,6 @@ function pathOperands(cmd) {
  * workspace's own VALUE token (which does not start with `-`) is mistaken for
  * the script name.
  */
-function npmScriptOperand(tokens) {
-  for (let i = 0; i < tokens.length; i++) {
-    const tok = tokens[i];
-    if (tok === '--workspace' || tok === '-w') { i += 1; continue; }
-    if (tok.startsWith('--workspace=')) continue;
-    if (tok.startsWith('-')) continue;
-    return tok;
-  }
-  return undefined;
-}
-
 /**
  * Resolve a command's referent.
  * @returns {{ status: 'resolved'|'dead'|'unchecked', detail: string }}
@@ -558,11 +597,14 @@ export function resolveCommand(cmd, ctx) {
         if (!ws) return { status: 'dead', detail: `npm workspace does not exist: ${wsRef}` };
       }
     }
-    const sub = t[1];
+    // The subcommand is the first OPERAND, not `t[1]`: `npm --workspace w run test`
+    // puts a flag there. Same skipping rule as the script name below.
+    const subIdx = firstOperandIndex(t, 1);
+    const sub = subIdx === -1 ? null : t[subIdx];
     let scriptName = null;
-    if (sub === 'run' || sub === 'run-script') scriptName = npmScriptOperand(t.slice(2));
+    if (sub === 'run' || sub === 'run-script') scriptName = firstOperand(t, subIdx + 1);
     else if (sub === 'test') scriptName = 'test';
-    else if (sub && !sub.startsWith('-') && !NPM_MUTATING.has(sub) && sub !== 'exec' && sub !== 'ls' && sub !== 'view') scriptName = sub;
+    else if (sub && !NPM_MUTATING.has(sub) && !PM_BUILTIN_SUBCOMMANDS.has(sub)) scriptName = sub;
 
     const pkg = ws ? ws.pkg : readJson(join(root, cmd.cwd || '.', 'package.json'));
     if (scriptName && pkg?.scripts && !Object.prototype.hasOwnProperty.call(pkg.scripts, scriptName)) {
diff --git a/.harness/scripts/ci/41-validate-evidence-commands.test.mjs b/.harness/scripts/ci/41-validate-evidence-commands.test.mjs
index 83afd2f4e..8cfd9e778 100644
--- a/.harness/scripts/ci/41-validate-evidence-commands.test.mjs
+++ b/.harness/scripts/ci/41-validate-evidence-commands.test.mjs
@@ -45,8 +45,13 @@ before(() => {
   mkdirSync(join(fixtureRoot, 'scripts'), { recursive: true });
   mkdirSync(join(fixtureRoot, 'pkgs', 'alpha'), { recursive: true });
 
+  // `scripts` must be PRESENT and must not contain the names under test. The
+  // undeclared-script branch is guarded by `pkg?.scripts`, so a root with no
+  // scripts block skips it entirely — and every assertion about an undeclared
+  // root script would pass without exercising anything.
   writeFileSync(join(fixtureRoot, 'package.json'), JSON.stringify({
     name: 'fixture-root', private: true, workspaces: ['pkgs/*'],
+    scripts: { lint: 'echo lint' },
   }));
   writeFileSync(join(fixtureRoot, 'pkgs', 'alpha', 'package.json'), JSON.stringify({
     name: '@fixture/alpha', version: '1.0.0', scripts: { test: 'echo ok' },
@@ -167,6 +172,53 @@ describe('resolveCommand', () => {
     assert.equal(r.status, 'resolved');
   });
 
+  // --- GT-598 follow-on: two parser defects that BLAMED THE EVIDENCE ---------
+  //
+  // Both produced a `dead` verdict for a command that runs perfectly well, which
+  // is the worst way for this guard to be wrong: it reads as stale evidence and
+  // invites someone to "repair" a record that was already correct.
+
+  test('the script name is not the value of --workspace (flag order must not matter)', () => {
+    // `npm run --workspace <path> <script>` is valid npm. The parser used to take
+    // the first non-dash token after `run`, which is the flag's VALUE, and then
+    // report that the script "pkgs/alpha" is not declared.
+    const r = resolveCommand(extractCommand('npm run --workspace pkgs/alpha test'), ctx());
+    assert.equal(r.status, 'resolved', r.detail);
+    assert.match(r.detail, /script test/);
+  });
+
+  test('…and the same when the flag precedes the subcommand entirely', () => {
+    const r = resolveCommand(extractCommand('npm --workspace pkgs/alpha run test'), ctx());
+    assert.equal(r.status, 'resolved', r.detail);
+    assert.match(r.detail, /script test/);
+  });
+
+  test('a genuinely undeclared script is STILL dead when the flag comes first', () => {
+    // The fix must not turn the check off: same shape, script that does not exist.
+    const r = resolveCommand(extractCommand('npm run --workspace pkgs/alpha nonexistent'), ctx());
+    assert.equal(r.status, 'dead');
+    assert.match(r.detail, /"nonexistent" is not declared/);
+  });
+
+  test('`pnpm info <pkg>` is a registry query, not an undeclared script', () => {
+    // Was reported as: npm script "info" is not declared in <root>/package.json.
+    const r = resolveCommand(extractCommand('pnpm info @beyondnet/evolith-cli'), ctx());
+    assert.notEqual(r.status, 'dead');
+  });
+
+  test('`yarn info <pkg>` likewise', () => {
+    const r = resolveCommand(extractCommand('yarn info @beyondnet/evolith-cli'), ctx());
+    assert.notEqual(r.status, 'dead');
+  });
+
+  test('a built-in subcommand does not mask a real workspace error', () => {
+    // `info` stops being read as a script name; it must NOT stop the workspace
+    // itself from being checked.
+    const r = resolveCommand(extractCommand('pnpm info --workspace pkgs/gone'), ctx());
+    assert.equal(r.status, 'dead');
+    assert.match(r.detail, /workspace does not exist/);
+  });
+
   test('does not invent a verdict for `node -e`', () => {
     const r = resolveCommand(extractCommand('node -e "process.exit(0)"'), ctx());
     assert.equal(r.status, 'unchecked');
diff --git a/.harness/scripts/ci/48-validate-security-publish-lag.mjs b/.harness/scripts/ci/48-validate-security-publish-lag.mjs
new file mode 100644
index 000000000..5a3a24276
--- /dev/null
+++ b/.harness/scripts/ci/48-validate-security-publish-lag.mjs
@@ -0,0 +1,367 @@
+#!/usr/bin/env node
+
+/**
+ * GT-624 — a security fix that never reached the registry must fail a check.
+ *
+ * ## The defect this exists for
+ *
+ * The 2026-07-23 security wave sat unpublished until 2026-07-27 while
+ * `SECURITY.md` declared the 1.1.x line "actively patched". Four days, on a
+ * public registry, with the public CHANGELOG naming the vulnerable files.
+ * **Nothing detected it. An audit did** — which is the same as saying the
+ * repository had no opinion about the difference between "fixed" and "shipped".
+ *
+ * Deprecating the old versions (GT-624's first criterion, done 2026-07-29) does
+ * not help here: it labels what is already out, and says nothing about a fix
+ * still sitting in `main`. This guard is the other half.
+ *
+ * ## What it checks
+ *
+ * For every publishable workspace: the commits that touch it AFTER the commit
+ * that set its currently-published version, filtered to the ones whose subject
+ * marks them as security work. Any such commit is a fix the registry does not
+ * serve, and it fails.
+ *
+ * ## Why the boundary comes from the REGISTRY and not from a tag
+ *
+ * Measured on 2026-07-30, not assumed: the newest `v*` tag in this repository is
+ * `v1.1.0`, while npm serves `@beyondnet/evolith-cli@1.2.2`. Three releases were
+ * published without a tag. A guard that asked git "what is the latest release?"
+ * would therefore have reported a four-release lag that does not exist, and
+ * flagged every commit since 1.1.0 as unpublished security work.
+ *
+ * So the registry answers WHAT is published, and git archaeology answers WHERE
+ * that version was set: the commit that last wrote `"version": "<published>"`
+ * into the package's own `package.json`. Everything after that commit, touching
+ * that package, is unreleased by construction.
+ *
+ * ## What counts as a security marker
+ *
+ * Two forms, and both are deliberate:
+ *
+ *   - type `security(...)` — used twice in this repository's history and, per
+ *     GT-623, **not a Conventional Commits type**, so release-please derives no
+ *     version bump from it. A commit announcing itself as a security change that
+ *     cannot move a version is exactly the failure mode of GT-570, so this guard
+ *     reports the type separately rather than only counting it.
+ *   - scope `security` / `sec` on any type — `fix(security):`, `chore(sec):`.
+ *
+ * What it deliberately does NOT do is grep subjects for the word "security".
+ * `fix(deps)!: … the SDK that carries the security wave` is a dependency fix that
+ * mentions the wave; treating prose as a marker would make the gate fire on
+ * anything discussing security, and a gate that cries wolf gets switched off. The
+ * marker is structural: type or scope, as the criterion says.
+ *
+ * ## Anti-vacuous pass
+ *
+ * Zero packages resolved, or zero commits examined, is a hard failure. A guard
+ * that scanned nothing must never report a pass — this repository has been bitten
+ * by that shape repeatedly (GT-569, GT-633, and the empty-fixture floor that
+ * `43-validate-guard-negative-fixtures` exists to observe).
+ *
+ * USAGE
+ *   node .harness/scripts/ci/48-validate-security-publish-lag.mjs
+ *   node .harness/scripts/ci/48-validate-security-publish-lag.mjs --verbose
+ *   node .harness/scripts/ci/48-validate-security-publish-lag.mjs --root <dir>
+ *   node .harness/scripts/ci/48-validate-security-publish-lag.mjs --offline
+ *       # treat each package's declared version as the published one: no network,
+ *       # so it answers "is anything unreleased relative to the manifest?"
+ *
+ * EXIT CODES
+ *   0  every security-marked commit is inside a published version
+ *   1  an unpublished security commit, or nothing was scanned
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const GUARD = '48-validate-security-publish-lag';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(__dirname, '../../..');
+
+/** Kept in step with `plan-npm-release.mjs`, which owns the same list. */
+export const WORKSPACE_DIRS = [
+  'src/packages/core-domain',
+  'src/packages/contracts',
+  'src/packages/core',
+  'src/packages/agent-runtime',
+  'src/packages/infra-providers',
+  'src/packages/sdk-client',
+  'src/packages/mcp-server',
+  'src/sdk/cli',
+];
+
+// ---------------------------------------------------------------------------
+// Pure core — no git, no registry, no filesystem. This is what the fixtures
+// exercise directly, and what makes the decision inspectable on its own.
+// ---------------------------------------------------------------------------
+
+/**
+ * Structural security marker in a Conventional-Commits subject.
+ *
+ * @param {string} subject
+ * @returns {{ marker: 'type' | 'scope', text: string } | null}
+ */
+export function securityMarker(subject) {
+  const header = /^([a-zA-Z]+)(?:\(([^)]*)\))?(!)?:/.exec(String(subject).trim());
+  if (!header) return null;
+  const [, type, scope] = header;
+  if (/^security$/i.test(type)) return { marker: 'type', text: `${type}(${scope ?? ''})` };
+  if (scope && /^(security|sec)$/i.test(scope.trim())) return { marker: 'scope', text: `${type}(${scope})` };
+  return null;
+}
+
+/**
+ * Decide, from already-gathered facts, what is unpublished security work.
+ *
+ * @param {Array<{ pkg: string, publishedVersion: string, commits: Array<{ sha: string, subject: string }> }>} units
+ * @returns {{ scanned: number, packages: number, findings: Array<object>, byMarker: Record<string, number> }}
+ */
+export function auditSecurityPublishLag(units) {
+  const findings = [];
+  const byMarker = { type: 0, scope: 0 };
+  let scanned = 0;
+
+  for (const unit of units) {
+    for (const commit of unit.commits) {
+      scanned += 1;
+      const marker = securityMarker(commit.subject);
+      if (!marker) continue;
+      byMarker[marker.marker] += 1;
+      findings.push({
+        pkg: unit.pkg,
+        publishedVersion: unit.publishedVersion,
+        sha: commit.sha,
+        subject: commit.subject,
+        marker: marker.marker,
+        header: marker.text,
+      });
+    }
+  }
+
+  return { scanned, packages: units.length, findings, byMarker };
+}
+
+// ---------------------------------------------------------------------------
+// I/O edges
+// ---------------------------------------------------------------------------
+
+/**
+ * git, or an empty answer.
+ *
+ * A repository with no commits makes `git log` exit non-zero, and letting that
+ * throw crashed the guard with a Node stack instead of reporting — found by the
+ * "cannot place in history" fixture. An unanswerable git question is UNKNOWN, and
+ * unknown is handled explicitly below (skipped, and a failure if everything is
+ * skipped). It must never be handled by a traceback.
+ */
+const git = (args, root) => {
+  try {
+    return execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+  } catch {
+    return '';
+  }
+};
+
+function readManifest(root, dir) {
+  const file = path.join(root, dir, 'package.json');
+  if (!fs.existsSync(file)) return null;
+  const pkg = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (!pkg.name || pkg.private) return null;
+  return { dir, name: pkg.name, version: pkg.version };
+}
+
+/** What the registry actually serves. `null` when it cannot answer. */
+export function registryLatest(name) {
+  try {
+    return execFileSync('npm', ['view', name, 'version'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The last commit at which this package's manifest still declared `version` —
+ * the publish boundary. Everything after it is a different version, so it is not
+ * what the registry serves.
+ *
+ * READ THE MANIFEST, DO NOT SEARCH FOR THE STRING. The first implementation used
+ * `git log -S'"version": "<published>"'`, and it was wrong in a way that hid work:
+ * `-S` counts occurrences, so it matches the commit that DELETED the string too.
+ * On a package whose version has just been bumped, the boundary therefore landed
+ * on the bump itself and every commit between the real publish point and the bump
+ * went unscanned — a false negative in the exact window this gate exists to watch.
+ * Observed on 2026-07-30 against `@beyondnet/evolith-cli`, whose boundary resolved
+ * to the 1.2.2 bump while the registry served 1.2.1.
+ *
+ * Walking newest-first and asking each revision of the manifest what version it
+ * declared answers the question directly, and costs one `git show` per manifest
+ * commit — a handful, for a file only releases touch.
+ */
+export function boundaryCommit(root, dir, version) {
+  const manifest = `${dir}/package.json`;
+  const shas = git(['log', '--format=%H', '--', manifest], root).split('\n').filter(Boolean);
+
+  const versionAt = (sha) => {
+    const raw = git(['show', `${sha}:${manifest}`], root);
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw).version ?? null;
+    } catch {
+      // A manifest that does not parse at that revision tells us nothing about
+      // the version; treat it as unknown rather than guessing.
+      return null;
+    }
+  };
+
+  // Walk newest-first to the run of commits at the published version, then take
+  // the OLDEST commit of that run: the point where the version was SET.
+  //
+  // Taking the newest one instead under-reports, and the second version of this
+  // function did exactly that. A later commit that edits the manifest while
+  // leaving the version alone — a dependency bump is the common case — would move
+  // the boundary forward and hide everything committed before it. The moment that
+  // matters is when the version became the published one, because that is when the
+  // release could have happened.
+  let i = 0;
+  while (i < shas.length && versionAt(shas[i]) !== version) i += 1;
+  if (i < shas.length) {
+    let last = i;
+    while (last + 1 < shas.length && versionAt(shas[last + 1]) === version) last += 1;
+    return { sha: shas[last], exact: true };
+  }
+  // The published version is in no revision of this manifest — it was released
+  // from history this checkout does not have. Scanning the whole history is the
+  // conservative answer, and it is reported as INEXACT rather than passed off.
+  return shas.length ? { sha: shas[shas.length - 1], exact: false } : null;
+}
+
+/** Commits touching this package after the boundary, newest first. */
+export function commitsSince(root, dir, sha) {
+  const out = git(['log', `${sha}..HEAD`, '--format=%h%x1f%s', '--', dir], root);
+  if (!out) return [];
+  return out.split('\n').map((line) => {
+    const [shortSha, subject] = line.split('\x1f');
+    return { sha: shortSha, subject };
+  });
+}
+
+function fail(lines) {
+  console.error(`\n✗ ${GUARD}: ${lines[0]}`);
+  for (const l of lines.slice(1)) console.error(`  ${l}`);
+  process.exit(1);
+}
+
+function main(argv) {
+  const rootIdx = argv.indexOf('--root');
+  const root = rootIdx !== -1 ? path.resolve(process.cwd(), argv[rootIdx + 1]) : REPO_ROOT;
+  const verbose = argv.includes('--verbose');
+  const offline = argv.includes('--offline');
+
+  const manifests = WORKSPACE_DIRS.map((dir) => readManifest(root, dir)).filter(Boolean);
+  if (manifests.length === 0) {
+    fail([
+      'resolved ZERO publishable packages — nothing was scanned.',
+      `Looked under ${root} for: ${WORKSPACE_DIRS.join(', ')}`,
+      'A guard that scanned nothing must not report a pass.',
+    ]);
+  }
+
+  const units = [];
+  const skipped = [];
+  for (const m of manifests) {
+    const published = offline ? m.version : registryLatest(m.name);
+    if (!published) {
+      skipped.push(`${m.name} — the registry did not answer, so "published" is unknown`);
+      continue;
+    }
+    const boundary = boundaryCommit(root, m.dir, published);
+    if (!boundary) {
+      skipped.push(`${m.name} — no commit history for ${m.dir}/package.json`);
+      continue;
+    }
+    units.push({
+      pkg: m.name,
+      dir: m.dir,
+      publishedVersion: published,
+      exactBoundary: boundary.exact,
+      boundarySha: boundary.sha,
+      commits: commitsSince(root, m.dir, boundary.sha),
+    });
+  }
+
+  if (units.length === 0) {
+    fail([
+      `resolved ${manifests.length} package(s) but could establish a publish boundary for NONE of them.`,
+      ...skipped.map((s) => `  • ${s}`),
+      'Unable to answer is not the same as nothing to report, so this is a failure.',
+    ]);
+  }
+
+  const audit = auditSecurityPublishLag(units);
+
+  console.log(`${GUARD} — security work that has not reached the registry`);
+  console.log(`  packages ........... ${audit.packages} of ${manifests.length}${offline ? ' (offline: manifest version treated as published)' : ''}`);
+  console.log(`  commits examined ... ${audit.scanned} since each package's published version`);
+  console.log(`  security-marked .... ${audit.findings.length} (type ${audit.byMarker.type}, scope ${audit.byMarker.scope})`);
+  for (const s of skipped) console.log(`  skipped ............ ${s}`);
+
+  if (verbose) {
+    for (const u of units) {
+      console.log(
+        `  · ${u.pkg} @ ${u.publishedVersion} — boundary ${u.boundarySha.slice(0, 8)}` +
+        `${u.exactBoundary ? '' : ' (INEXACT: that version string is not in this history)'}` +
+        `, ${u.commits.length} commit(s) since`,
+      );
+    }
+  }
+
+  // The scan must have looked at something. Zero commits across every package is
+  // legitimate only when every package is exactly at its published version AND
+  // nothing has landed since — rare, and worth distinguishing from a broken scan.
+  if (audit.scanned === 0) {
+    const allAtBoundary = units.every((u) => u.commits.length === 0);
+    if (!allAtBoundary) {
+      fail(['examined ZERO commits while packages report commits since their boundary — the scan is broken.']);
+    }
+    console.log('\n  Every package is exactly at its published version with nothing landed since.');
+  }
+
+  if (audit.findings.length > 0) {
+    fail([
+      `${audit.findings.length} security-marked commit(s) are NOT in any published version:`,
+      ...audit.findings.map(
+        (f) => `  • ${f.sha} ${f.subject}\n      ${f.pkg} serves ${f.publishedVersion}; this commit is after it (marked by ${f.marker})`,
+      ),
+      '',
+      '  A security fix that is committed but not published is the GT-570 failure:',
+      '  SECURITY.md claimed the line was "actively patched" for four days while the',
+      '  registry served the vulnerable build. Publish, or stop marking it security.',
+      '',
+      ...(audit.byMarker.type > 0
+        ? [
+          `  NOTE: ${audit.byMarker.type} of these use the type \`security(...)\`, which is NOT a`,
+          '  Conventional Commits type — release-please derives no version bump from it,',
+          '  so it cannot reach the registry by the normal path at all (GT-623).',
+          '',
+        ]
+        : []),
+      '  Release with: gh workflow run npm-release.yml --ref main -f dry_run=false',
+    ]);
+  }
+
+  console.log(
+    `\n✓ ${GUARD}: every security-marked commit across ${audit.packages} package(s) ` +
+    'is inside a version the registry serves.',
+  );
+  return 0;
+}
+
+const invokedDirectly =
+  process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url));
+if (invokedDirectly) process.exit(main(process.argv.slice(2)));
diff --git a/.harness/scripts/ci/48-validate-security-publish-lag.test.mjs b/.harness/scripts/ci/48-validate-security-publish-lag.test.mjs
new file mode 100644
index 000000000..aa8363ca0
--- /dev/null
+++ b/.harness/scripts/ci/48-validate-security-publish-lag.test.mjs
@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+
+/**
+ * GT-624 — fixtures for the security-publish-lag gate.
+ *
+ * The case that matters is the one this repository actually lived through: a
+ * commit that says `security(...)` sits in `main` while the registry serves an
+ * older version. If that fixture ever goes green, the gate is decoration — which
+ * is the whole reason GT-624's third criterion asks for a fixture that has been
+ * OBSERVED red rather than a guard someone believes works.
+ *
+ * The fixtures build real git repositories in a sandbox, because the boundary the
+ * guard computes is git archaeology (`git log -S` over a manifest) and a mock of
+ * that would only prove the mock. They run `--offline`, so the manifest version
+ * stands in for the registry and no test touches the network.
+ */
+
+import test, { describe, it, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync, execFileSync } from 'node:child_process';
+
+import { securityMarker, auditSecurityPublishLag } from './48-validate-security-publish-lag.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const GUARD = resolve(__dirname, '48-validate-security-publish-lag.mjs');
+
+let sandbox;
+before(() => { sandbox = mkdtempSync(join(tmpdir(), 'gt624-')); });
+after(() => { if (sandbox) rmSync(sandbox, { recursive: true, force: true }); });
+
+const run = (root, extra = []) => {
+  const r = spawnSync(process.execPath, [GUARD, '--root', root, '--offline', ...extra], {
+    encoding: 'utf8', timeout: 120000,
+  });
+  return { status: r.status, out: `${r.stdout}\n${r.stderr}` };
+};
+
+// ---------------------------------------------------------------------------
+// The marker, on its own. This is where the line between structure and prose is
+// drawn, so it is pinned rather than left to the integration fixtures.
+// ---------------------------------------------------------------------------
+
+describe('securityMarker', () => {
+  it('accepts the type this repository actually used', () => {
+    assert.equal(securityMarker('security(fase-7): add Docker/K8s hardening checklist').marker, 'type');
+    assert.equal(securityMarker('security: patch the shell runner').marker, 'type');
+  });
+
+  it('accepts a security scope on any type', () => {
+    assert.equal(securityMarker('fix(security): timing-safe key comparison').marker, 'scope');
+    assert.equal(securityMarker('chore(sec): rotate the signing key').marker, 'scope');
+    assert.equal(securityMarker('feat(Security)!: enforce ABAC').marker, 'scope');
+  });
+
+  it('REFUSES prose, which is the whole point', () => {
+    // The commit that shipped 1.2.2 mentions the security wave and is a dependency
+    // fix. If prose counted, this gate would fire on anything that discusses
+    // security, and a gate that cries wolf gets switched off.
+    assert.equal(securityMarker('fix(deps)!: resolve the SDK that carries the security wave (GT-634)'), null);
+    assert.equal(securityMarker('docs(gaps): register the security audit findings'), null);
+    assert.equal(securityMarker('not a conventional subject at all'), null);
+  });
+});
+
+describe('auditSecurityPublishLag', () => {
+  it('counts what it examined, not only what it found', () => {
+    const audit = auditSecurityPublishLag([
+      { pkg: 'a', publishedVersion: '1.0.0', commits: [
+        { sha: 'aaa', subject: 'fix(security): x' },
+        { sha: 'bbb', subject: 'docs: y' },
+      ] },
+    ]);
+    assert.equal(audit.scanned, 2);
+    assert.equal(audit.findings.length, 1);
+    assert.equal(audit.byMarker.scope, 1);
+    assert.equal(audit.byMarker.type, 0);
+  });
+
+  it('is empty for an empty input rather than throwing — the caller decides', () => {
+    const audit = auditSecurityPublishLag([]);
+    assert.deepEqual(audit.findings, []);
+    assert.equal(audit.scanned, 0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Integration, over real git history.
+// ---------------------------------------------------------------------------
+
+/**
+ * A miniature repository with one publishable workspace.
+ *
+ * `subjects` land AFTER the commit that sets the manifest to `version`, so they
+ * are unpublished by construction — the exact shape of the GT-570 window.
+ */
+const miniRepo = (name, { version, subjects }) => {
+  const root = join(sandbox, name);
+  const dir = join(root, 'src', 'sdk', 'cli');
+  mkdirSync(dir, { recursive: true });
+  const g = (...args) => execFileSync('git', args, { cwd: root, stdio: 'ignore' });
+
+  g('init', '-q', '-b', 'main');
+  g('config', 'user.email', 'fixture@example.com');
+  g('config', 'user.name', 'fixture');
+
+  writeFileSync(join(root, 'README.md'), '# fixture\n');
+  g('add', '-A');
+  g('commit', '-q', '-m', 'chore: seed');
+
+  const manifest = (v) => JSON.stringify({ name: '@beyondnet/evolith-cli', version: v }, null, 2) + '\n';
+  writeFileSync(join(dir, 'package.json'), manifest('0.0.1'));
+  g('add', '-A');
+  g('commit', '-q', '-m', 'chore(release): 0.0.1');
+
+  // The published boundary.
+  writeFileSync(join(dir, 'package.json'), manifest(version));
+  g('add', '-A');
+  g('commit', '-q', '-m', `chore(release): ${version}`);
+
+  // Everything after it is unreleased.
+  subjects.forEach((subject, i) => {
+    writeFileSync(join(dir, `change-${i}.ts`), `// ${subject}\n`);
+    g('add', '-A');
+    g('commit', '-q', '-m', subject);
+  });
+
+  return root;
+};
+
+describe('the GT-570 window', () => {
+  it('THE FIXTURE: a security commit after the published version turns it RED', () => {
+    const root = miniRepo('unpublished-security', {
+      version: '1.1.0',
+      subjects: [
+        'docs: unrelated',
+        'security(fase-6): add executable security rulesets',
+      ],
+    });
+    const { status, out } = run(root);
+    assert.equal(status, 1, out);
+    assert.match(out, /1 security-marked commit\(s\) are NOT in any published version/);
+    assert.match(out, /add executable security rulesets/);
+    // It must name the consequence, not just the count.
+    assert.match(out, /SECURITY\.md claimed the line was "actively patched"/);
+    // And the release-please trap, because `security(...)` cannot bump a version.
+    assert.match(out, /NOT a\n?\s*Conventional Commits type/);
+  });
+
+  it('a security commit INSIDE the published version is green', () => {
+    // Same subject, but the manifest bump comes after it, so it shipped.
+    const root = join(sandbox, 'published-security');
+    const dir = join(root, 'src', 'sdk', 'cli');
+    mkdirSync(dir, { recursive: true });
+    const g = (...args) => execFileSync('git', args, { cwd: root, stdio: 'ignore' });
+    g('init', '-q', '-b', 'main');
+    g('config', 'user.email', 'f@example.com');
+    g('config', 'user.name', 'f');
+    const manifest = (v) => JSON.stringify({ name: '@beyondnet/evolith-cli', version: v }, null, 2) + '\n';
+    writeFileSync(join(dir, 'package.json'), manifest('1.0.0'));
+    g('add', '-A'); g('commit', '-q', '-m', 'chore(release): 1.0.0');
+    writeFileSync(join(dir, 'fix.ts'), '// fix\n');
+    g('add', '-A'); g('commit', '-q', '-m', 'security(core): patch the shell runner');
+    writeFileSync(join(dir, 'package.json'), manifest('1.1.0'));
+    g('add', '-A'); g('commit', '-q', '-m', 'chore(release): 1.1.0');
+
+    const { status, out } = run(root);
+    assert.equal(status, 0, out);
+    assert.match(out, /is inside a version the registry serves/);
+  });
+
+  it('REGRESSION: a version bumped past the published one must not hide the window', () => {
+    // The false negative the first implementation had. `git log -S` matches the
+    // commit that DELETED the version string as well as the one that added it, so
+    // on a package already bumped to 1.2.2 the boundary landed on the bump and the
+    // security commit sitting between 1.2.1 and that bump was never scanned.
+    // Registry (offline: the manifest) says 1.2.1 is published — but here the
+    // manifest has moved on, so the fixture pins the version explicitly.
+    const root = join(sandbox, 'bumped-past');
+    const dir = join(root, 'src', 'sdk', 'cli');
+    mkdirSync(dir, { recursive: true });
+    const g = (...args) => execFileSync('git', args, { cwd: root, stdio: 'ignore' });
+    g('init', '-q', '-b', 'main');
+    g('config', 'user.email', 'f@example.com');
+    g('config', 'user.name', 'f');
+    const manifest = (v) => JSON.stringify({ name: '@beyondnet/evolith-cli', version: v }, null, 2) + '\n';
+
+    writeFileSync(join(dir, 'package.json'), manifest('1.2.1'));
+    g('add', '-A'); g('commit', '-q', '-m', 'chore(release): 1.2.1');   // <- published
+    writeFileSync(join(dir, 'patch.ts'), '// patch\n');
+    g('add', '-A'); g('commit', '-q', '-m', 'security(mcp): redact the secret from the log');
+    // A later manifest edit that KEEPS the version — a dependency bump, the common
+    // case. This is what the second implementation tripped over: it moved the
+    // boundary forward to here and hid the security commit above. The edit must be
+    // a real content change, or git records no manifest commit at all and the
+    // fixture proves nothing.
+    writeFileSync(
+      join(dir, 'package.json'),
+      JSON.stringify({ name: '@beyondnet/evolith-cli', version: '1.2.1', dependencies: { chalk: '^5.0.0' } }, null, 2) + '\n',
+    );
+    g('add', '-A'); g('commit', '-q', '-m', 'chore(deps): bump chalk');
+
+    // Offline mode reads the manifest as published (1.2.1). The boundary must be
+    // where 1.2.1 was SET — the first commit — not the later dep bump that also
+    // declares 1.2.1, so the security commit is inside the window and reported.
+    const { status, out } = run(root);
+    assert.equal(status, 1, out);
+    assert.match(out, /redact the secret from the log/);
+  });
+
+  it('an unpublished NON-security commit is green — the gate is narrow on purpose', () => {
+    const root = miniRepo('unpublished-ordinary', {
+      version: '1.1.0',
+      subjects: ['fix(deps)!: resolve the SDK that carries the security wave', 'docs: notes'],
+    });
+    const { status, out } = run(root);
+    assert.equal(status, 0, out);
+    assert.match(out, /commits examined \.+ 2/);
+  });
+});
+
+describe('anti-vacuous floor', () => {
+  it('refuses a root with no publishable package', () => {
+    const root = join(sandbox, 'empty');
+    mkdirSync(root, { recursive: true });
+    writeFileSync(join(root, 'placeholder.txt'), 'x');
+    const { status, out } = run(root);
+    assert.equal(status, 1, out);
+    assert.match(out, /resolved ZERO publishable packages/);
+    assert.match(out, /must not report a pass/);
+  });
+
+  it('refuses a package it cannot place in history', () => {
+    // A manifest with no git history at all: "unable to answer" must not read as
+    // "nothing to report".
+    const root = join(sandbox, 'no-history');
+    const dir = join(root, 'src', 'sdk', 'cli');
+    mkdirSync(dir, { recursive: true });
+    execFileSync('git', ['init', '-q', '-b', 'main'], { cwd: root, stdio: 'ignore' });
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: '@beyondnet/evolith-cli', version: '9.9.9' }) + '\n');
+    const { status, out } = run(root);
+    assert.equal(status, 1, out);
+    assert.match(out, /could establish a publish boundary for NONE of them/);
+  });
+
+  it('does not count a private workspace as publishable', () => {
+    const root = join(sandbox, 'private-only');
+    const dir = join(root, 'src', 'sdk', 'cli');
+    mkdirSync(dir, { recursive: true });
+    execFileSync('git', ['init', '-q', '-b', 'main'], { cwd: root, stdio: 'ignore' });
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: 'x', version: '1.0.0', private: true }) + '\n');
+    const { status, out } = run(root);
+    assert.equal(status, 1, out);
+    assert.match(out, /resolved ZERO publishable packages/);
+  });
+});
diff --git a/.harness/scripts/ci/49-validate-gap-id-allocation.mjs b/.harness/scripts/ci/49-validate-gap-id-allocation.mjs
new file mode 100644
index 000000000..dc8c32ad2
--- /dev/null
+++ b/.harness/scripts/ci/49-validate-gap-id-allocation.mjs
@@ -0,0 +1,229 @@
+#!/usr/bin/env node
+
+/**
+ * GT-638 — a gap id must not mean two different things on two branches.
+ *
+ * ## The defect
+ *
+ * A gap id is chosen by reading the highest `GT-*` on whichever branch you happen
+ * to be on, and nothing contrasts that with any other branch. Two sessions working
+ * in parallel therefore allocate the same number, and one of them finds out at
+ * merge time. It happened on 2026-07-30: `8449af3d` carries the message
+ * "renumber the ratchet fix GT-634 -> GT-637, ID collision with develop".
+ *
+ * The renumber is manual and LOSSY, which costs more than the clash: an id lives
+ * in the board row, the catalog anchor, the closure-evidence record,
+ * cross-references from other rows in both languages, commit messages and PR
+ * bodies — and only the first three are mechanically checkable.
+ *
+ * `08-validate-tracking` cannot help, and not for want of trying: it validates
+ * EN/ES parity, closure records and counters WITHIN ONE WORKING TREE, and branches
+ * are outside its world by construction. This guard is the part that needs two.
+ *
+ * ## What it checks
+ *
+ * For every `GT-*` id declared in the catalog on HEAD, compare its **Title:**
+ * against the title the same id carries on the BASE branch:
+ *
+ *   - id absent from base            -> newly allocated, fine
+ *   - id present, same title         -> the same gap, edited; fine
+ *   - id present, DIFFERENT title    -> COLLISION: one number, two gaps
+ *
+ * The title is the discriminator on purpose. "The id already exists on base" is
+ * the normal case for 600-odd rows and says nothing; what makes it a defect is the
+ * id naming a different gap on each side. Evidence, status and criteria are all
+ * expected to change on a branch — a title change on an id that exists on both
+ * sides is either a collision or a deliberate retitle, and both deserve a human
+ * looking at them.
+ *
+ * ## Anti-vacuous pass
+ *
+ * Zero ids parsed on either side is a hard failure: a moved file or a reshaped
+ * heading must not read as "no collisions". So is a base branch that cannot be
+ * resolved — unable to answer is not the same as nothing to report, and a guard
+ * that quietly skips is how the id collision reached `main` in the first place.
+ *
+ * USAGE
+ *   node .harness/scripts/ci/49-validate-gap-id-allocation.mjs
+ *   node .harness/scripts/ci/49-validate-gap-id-allocation.mjs --base origin/develop
+ *   node .harness/scripts/ci/49-validate-gap-id-allocation.mjs --root <dir> --verbose
+ *
+ * EXIT CODES
+ *   0  every id on HEAD names the same gap it names on the base branch
+ *   1  a collision, an unresolvable base, or a vacuous scan
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const GUARD = '49-validate-gap-id-allocation';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(__dirname, '../../..');
+
+/** The catalog is where a row's title lives; the board carries prose, not a title. */
+export const CATALOG = 'reference/core/control-center/gaps/gap-reference-catalog.md';
+
+/**
+ * The base to compare against, in the order CI and a laptop actually mean it.
+ *
+ * On a pull request the base is `GITHUB_BASE_REF`; locally the honest default is
+ * the default branch. Both are resolved through the remote, because a local
+ * `main` can be arbitrarily stale and comparing against a stale base is how a
+ * collision passes.
+ */
+export function defaultBase(env = process.env) {
+  if (env.GITHUB_BASE_REF) return `origin/${env.GITHUB_BASE_REF}`;
+  return 'origin/main';
+}
+
+// ---------------------------------------------------------------------------
+// Pure core
+// ---------------------------------------------------------------------------
+
+/**
+ * `GT-NNN -> title`, from a catalog document.
+ *
+ * @param {string} markdown
+ * @returns {Map<string, string>}
+ */
+export function parseCatalogTitles(markdown) {
+  const titles = new Map();
+  const sections = String(markdown).split(/^#### (GT-\d+)\s*$/m);
+  // split yields [preamble, id, body, id, body, ...]
+  for (let i = 1; i < sections.length; i += 2) {
+    const id = sections[i];
+    const body = sections[i + 1] ?? '';
+    const m = /^\*\*Title:\*\*\s*(.+?)\s*$/m.exec(body);
+    if (m) titles.set(id, m[1]);
+  }
+  return titles;
+}
+
+/**
+ * Ids that name a DIFFERENT gap on each side.
+ *
+ * @param {Map<string,string>} base
+ * @param {Map<string,string>} head
+ * @returns {Array<{id: string, baseTitle: string, headTitle: string}>}
+ */
+export function findIdCollisions(base, head) {
+  const collisions = [];
+  for (const [id, headTitle] of head) {
+    const baseTitle = base.get(id);
+    if (baseTitle === undefined) continue; // newly allocated
+    if (baseTitle !== headTitle) collisions.push({ id, baseTitle, headTitle });
+  }
+  return collisions.sort((a, b) => a.id.localeCompare(b.id));
+}
+
+/** Ids this branch allocates that the base has never seen. */
+export function newlyAllocated(base, head) {
+  return [...head.keys()].filter((id) => !base.has(id)).sort();
+}
+
+// ---------------------------------------------------------------------------
+// I/O edges
+// ---------------------------------------------------------------------------
+
+function fail(lines) {
+  console.error(`\n✗ ${GUARD}: ${lines[0]}`);
+  for (const l of lines.slice(1)) console.error(`  ${l}`);
+  process.exit(1);
+}
+
+function readAtRef(root, ref, file) {
+  try {
+    return execFileSync('git', ['show', `${ref}:${file}`], {
+      cwd: root,
+      encoding: 'utf8',
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  } catch {
+    return null;
+  }
+}
+
+function main(argv) {
+  const rootIdx = argv.indexOf('--root');
+  const root = rootIdx !== -1 ? path.resolve(process.cwd(), argv[rootIdx + 1]) : REPO_ROOT;
+  const baseIdx = argv.indexOf('--base');
+  const base = baseIdx !== -1 ? argv[baseIdx + 1] : defaultBase();
+  const verbose = argv.includes('--verbose');
+
+  const headPath = path.join(root, CATALOG);
+  if (!fs.existsSync(headPath)) {
+    fail([
+      `the catalog is not where this guard looks: ${CATALOG}`,
+      'A moved file must not read as "no collisions".',
+    ]);
+  }
+  const headDoc = fs.readFileSync(headPath, 'utf8');
+
+  const baseDoc = readAtRef(root, base, CATALOG);
+  if (baseDoc === null) {
+    fail([
+      `cannot read the catalog at the base ref \`${base}\`, so no comparison was made.`,
+      '  In CI the base comes from GITHUB_BASE_REF; locally it defaults to origin/main.',
+      '  Fetch it first: git fetch origin',
+      '',
+      '  Unable to answer is not the same as nothing to report. A guard that skipped',
+      '  quietly here is how an id collision reached main in the first place.',
+    ]);
+  }
+
+  const headTitles = parseCatalogTitles(headDoc);
+  const baseTitles = parseCatalogTitles(baseDoc);
+
+  if (headTitles.size === 0 || baseTitles.size === 0) {
+    fail([
+      `parsed ${headTitles.size} id(s) on HEAD and ${baseTitles.size} on ${base} — at least one side yielded NOTHING.`,
+      'The `#### GT-NNN` / `**Title:**` shape moved. Fix this parser rather than deleting the check.',
+    ]);
+  }
+
+  const collisions = findIdCollisions(baseTitles, headTitles);
+  const fresh = newlyAllocated(baseTitles, headTitles);
+
+  console.log(`${GUARD} — one gap id, one gap`);
+  console.log(`  base ................ ${base}`);
+  console.log(`  ids on base ......... ${baseTitles.size}`);
+  console.log(`  ids on HEAD ......... ${headTitles.size}`);
+  console.log(`  newly allocated ..... ${fresh.length}${fresh.length ? ` (${fresh.join(', ')})` : ''}`);
+  console.log(`  collisions .......... ${collisions.length}`);
+
+  if (verbose && fresh.length) {
+    for (const id of fresh) console.log(`  · ${id} is new here — check it against every OTHER open branch, not just this base`);
+  }
+
+  if (collisions.length > 0) {
+    fail([
+      `${collisions.length} gap id(s) name a DIFFERENT gap on each side:`,
+      ...collisions.flatMap((c) => [
+        `  • ${c.id}`,
+        `      on ${base}: ${c.baseTitle}`,
+        `      on HEAD:    ${c.headTitle}`,
+      ]),
+      '',
+      '  Two sessions allocated the same number, or a row was retitled. If it is a',
+      '  collision, renumber the NEWER row and update every place the id appears:',
+      '  the board row, the catalog anchor, the closure-evidence record and the',
+      '  cross-references in BOTH languages. If it is a deliberate retitle, say so',
+      '  in the commit — this guard cannot tell the two apart, and should not guess.',
+      '',
+      '  Allocate a new id from the UNION of ids across branches, never the maximum',
+      '  on one:',
+      '    { git show origin/main:<board>; git show origin/develop:<board>; } \\',
+      '      | grep -oE "GT-[0-9]{3}" | sort -u | tail -1',
+    ]);
+  }
+
+  console.log(`\n✓ ${GUARD}: every one of ${headTitles.size} id(s) names the same gap it names on ${base}.`);
+  return 0;
+}
+
+const invokedDirectly =
+  process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url));
+if (invokedDirectly) process.exit(main(process.argv.slice(2)));
diff --git a/.harness/scripts/ci/49-validate-gap-id-allocation.test.mjs b/.harness/scripts/ci/49-validate-gap-id-allocation.test.mjs
new file mode 100644
index 000000000..8d559fe4e
--- /dev/null
+++ b/.harness/scripts/ci/49-validate-gap-id-allocation.test.mjs
@@ -0,0 +1,194 @@
+#!/usr/bin/env node
+
+/**
+ * GT-638 — fixtures for the gap-id allocation guard.
+ *
+ * The case that matters is the one this repository lived through: two branches
+ * allocate `GT-634`, each for a different gap, and nothing says so until the
+ * merge. If that fixture ever goes green the guard is decoration — which is why
+ * GT-638's third criterion asks for a fixture that has been OBSERVED red rather
+ * than a guard someone believes works.
+ *
+ * The integration fixtures build real git repositories, because the comparison is
+ * `git show <base>:<file>` and a mock of that would only prove the mock.
+ */
+
+import { describe, it, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync, execFileSync } from 'node:child_process';
+
+import {
+  parseCatalogTitles,
+  findIdCollisions,
+  newlyAllocated,
+  defaultBase,
+  CATALOG,
+} from './49-validate-gap-id-allocation.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const GUARD = resolve(__dirname, '49-validate-gap-id-allocation.mjs');
+
+let sandbox;
+before(() => { sandbox = mkdtempSync(join(tmpdir(), 'gt638-')); });
+after(() => { if (sandbox) rmSync(sandbox, { recursive: true, force: true }); });
+
+const run = (root, extra = []) => {
+  const r = spawnSync(process.execPath, [GUARD, '--root', root, ...extra], {
+    encoding: 'utf8', timeout: 120000,
+  });
+  return { status: r.status, out: `${r.stdout}\n${r.stderr}` };
+};
+
+const catalog = (entries) =>
+  '# Catalog\n\n' +
+  entries
+    .map(([id, title, evidence = 'something']) => `#### ${id}\n\n**Title:** ${title}\n\n- **Evidence:** ${evidence}\n`)
+    .join('\n');
+
+// ---------------------------------------------------------------------------
+// Pure core
+// ---------------------------------------------------------------------------
+
+describe('parseCatalogTitles', () => {
+  it('reads one title per id', () => {
+    const t = parseCatalogTitles(catalog([['GT-001', 'first'], ['GT-002', 'second']]));
+    assert.equal(t.size, 2);
+    assert.equal(t.get('GT-002'), 'second');
+  });
+
+  it('yields nothing when the shape moves — the caller turns that into a failure', () => {
+    assert.equal(parseCatalogTitles('### GT-001\n\nTitle: no bold, no match\n').size, 0);
+  });
+});
+
+describe('findIdCollisions', () => {
+  const base = new Map([['GT-001', 'a'], ['GT-002', 'b']]);
+
+  it('THE CASE: same id, different gap', () => {
+    const found = findIdCollisions(base, new Map([['GT-002', 'something else entirely']]));
+    assert.equal(found.length, 1);
+    assert.equal(found[0].id, 'GT-002');
+    assert.equal(found[0].baseTitle, 'b');
+  });
+
+  it('an id edited but not renamed is NOT a collision', () => {
+    assert.deepEqual(findIdCollisions(base, new Map([['GT-001', 'a']])), []);
+  });
+
+  it('a newly allocated id is not a collision, and is reported separately', () => {
+    const head = new Map([['GT-001', 'a'], ['GT-003', 'new']]);
+    assert.deepEqual(findIdCollisions(base, head), []);
+    assert.deepEqual(newlyAllocated(base, head), ['GT-003']);
+  });
+});
+
+describe('defaultBase', () => {
+  it('uses the PR base in CI', () => {
+    assert.equal(defaultBase({ GITHUB_BASE_REF: 'develop' }), 'origin/develop');
+  });
+
+  it('falls back to the remote default branch, never a local one', () => {
+    // A local `main` can be arbitrarily stale, and comparing against a stale base
+    // is how a collision passes.
+    assert.equal(defaultBase({}), 'origin/main');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Integration, over real git history
+// ---------------------------------------------------------------------------
+
+/** A repo with the catalog committed on `base`, then rewritten on the checked-out branch. */
+const repoWith = (name, baseEntries, headEntries) => {
+  const root = join(sandbox, name);
+  mkdirSync(join(root, dirname(CATALOG)), { recursive: true });
+  const g = (...args) => execFileSync('git', args, { cwd: root, stdio: 'ignore' });
+
+  g('init', '-q', '-b', 'base');
+  g('config', 'user.email', 'f@example.com');
+  g('config', 'user.name', 'f');
+  writeFileSync(join(root, CATALOG), catalog(baseEntries));
+  g('add', '-A');
+  g('commit', '-q', '-m', 'base catalog');
+
+  g('checkout', '-q', '-b', 'work');
+  writeFileSync(join(root, CATALOG), catalog(headEntries));
+  g('add', '-A');
+  g('commit', '-q', '-m', 'branch catalog');
+  return root;
+};
+
+describe('the collision this guard exists for', () => {
+  it('THE FIXTURE: two branches allocate GT-634 for different gaps — RED', () => {
+    const root = repoWith(
+      'collision',
+      [['GT-633', 'a guard that compared the snapshot with itself'], ['GT-634', 'the dead-reference ratchet is stuck']],
+      [['GT-633', 'a guard that compared the snapshot with itself'], ['GT-634', 'the published CLI resolves a stale SDK']],
+    );
+    const { status, out } = run(root, ['--base', 'base']);
+    assert.equal(status, 1, out);
+    assert.match(out, /1 gap id\(s\) name a DIFFERENT gap on each side/);
+    assert.match(out, /GT-634/);
+    // It must name BOTH sides, or resolving it is a search.
+    assert.match(out, /the dead-reference ratchet is stuck/);
+    assert.match(out, /the published CLI resolves a stale SDK/);
+    // And it must not guess which one is wrong.
+    assert.match(out, /this guard cannot tell the two apart, and should not guess/);
+  });
+
+  it('a branch that only ADDS an id is green', () => {
+    const root = repoWith('new-id', [['GT-633', 'x']], [['GT-633', 'x'], ['GT-634', 'y']]);
+    const { status, out } = run(root, ['--base', 'base', '--verbose']);
+    assert.equal(status, 0, out);
+    assert.match(out, /newly allocated \.+ 1 \(GT-634\)/);
+    // The one thing this guard cannot see, said out loud rather than implied.
+    assert.match(out, /check it against every OTHER open branch/);
+  });
+
+  it('a branch that edits a row without retitling it is green', () => {
+    const root = repoWith('edited', [['GT-633', 'x', 'first telling']], [['GT-633', 'x', 'rewritten evidence, same gap']]);
+    assert.equal(run(root, ['--base', 'base']).status, 0);
+  });
+});
+
+describe('anti-vacuous floor', () => {
+  it('refuses a tree where the catalog is not where it looks', () => {
+    const root = join(sandbox, 'no-catalog');
+    mkdirSync(root, { recursive: true });
+    writeFileSync(join(root, 'placeholder.txt'), 'x');
+    const { status, out } = run(root, ['--base', 'base']);
+    assert.equal(status, 1, out);
+    assert.match(out, /must not read as "no collisions"/);
+  });
+
+  it('refuses a base ref it cannot read, rather than skipping', () => {
+    const root = repoWith('bad-base', [['GT-001', 'a', 'before']], [['GT-001', 'a', 'after']]);
+    const { status, out } = run(root, ['--base', 'origin/nope']);
+    assert.equal(status, 1, out);
+    assert.match(out, /cannot read the catalog at the base ref/);
+    assert.match(out, /Unable to answer is not the same as nothing to report/);
+  });
+
+  it('refuses a catalog whose heading shape moved', () => {
+    const root = join(sandbox, 'reshaped');
+    mkdirSync(join(root, dirname(CATALOG)), { recursive: true });
+    const g = (...args) => execFileSync('git', args, { cwd: root, stdio: 'ignore' });
+    g('init', '-q', '-b', 'base');
+    g('config', 'user.email', 'f@example.com');
+    g('config', 'user.name', 'f');
+    writeFileSync(join(root, CATALOG), catalog([['GT-001', 'a']]));
+    g('add', '-A'); g('commit', '-q', '-m', 'base');
+    g('checkout', '-q', '-b', 'work');
+    writeFileSync(join(root, CATALOG), '### GT-001\n\nTitle: the shape moved\n');
+    g('add', '-A'); g('commit', '-q', '-m', 'reshaped');
+
+    const { status, out } = run(root, ['--base', 'base']);
+    assert.equal(status, 1, out);
+    assert.match(out, /at least one side yielded NOTHING/);
+    assert.match(out, /Fix this parser rather than deleting the check/);
+  });
+});
diff --git a/.harness/scripts/lib/coverage.mjs b/.harness/scripts/lib/coverage.mjs
index f0ba19920..9aa805946 100644
--- a/.harness/scripts/lib/coverage.mjs
+++ b/.harness/scripts/lib/coverage.mjs
@@ -20,6 +20,31 @@
  * site, with a mandatory `reason`, so the exemption is visible in review and in the diff
  * that introduced it. It is deliberately not settable via config or environment: an
  * exemption that can be granted from outside the code is an exemption nobody reviews.
+ *
+ * ## The same defect one level up: a fixture that never reaches the branch
+ *
+ * This module protects the guard. Nothing protects the guard's TEST, and the failure has
+ * the same shape: a test whose fixture never reaches the branch under test passes, and
+ * reads as proof.
+ *
+ * Observed on 2026-07-30 (GT-633) while fixing two parser defects in
+ * `41-validate-evidence-commands`. Six tests were written for the fix. Three of them
+ * asserted that a command is NOT reported dead — and they passed against the UNFIXED
+ * parser too, because the branch that reports it dead is guarded by `pkg?.scripts` and
+ * the fixture's root `package.json` declared no `scripts` at all. The assertions were
+ * true, the fix was real, and the tests proved nothing about it.
+ *
+ * So, whenever a test is written to pin a fix:
+ *
+ *   **run it against the unfixed code and watch it fail.** A test that passes before the
+ *   fix is not evidence of the fix; it is the vacuous pass of this file's first section,
+ *   wearing a green tick from the test runner instead of from a guard.
+ *
+ * Making the fixture live took the six from 3-of-6 red to 5-of-6 red against the old
+ * parser. The sixth passes either way and is kept as a REGRESSION guard — labelled as
+ * such, not counted as proof. Which is the other half of the rule: when a test cannot be
+ * made to fail, say why in the test rather than letting the count imply coverage it does
+ * not have.
  */
 
 /**
diff --git a/.harness/scripts/lib/guard-classification.mjs b/.harness/scripts/lib/guard-classification.mjs
index 2fd53e774..8b69ba196 100644
--- a/.harness/scripts/lib/guard-classification.mjs
+++ b/.harness/scripts/lib/guard-classification.mjs
@@ -40,6 +40,22 @@ export const CALLS_COVERAGE = /\b(?:assertScanned|assertScannedPerSource|scanned
  * deleting the check and leaving the exemption behind.
  */
 export const SELF_GUARDED = [
+  {
+    file: '49-validate-gap-id-allocation.mjs',
+    proof: /at least one side yielded NOTHING/,
+    reason:
+      'GT-638 gap-id allocation guard; refuses a missing catalog, a base ref it cannot read ' +
+      '(unable to answer is not "nothing to report" — a quiet skip is how the collision reached ' +
+      'main), and a parse that yields zero ids on either side',
+  },
+  {
+    file: '48-validate-security-publish-lag.mjs',
+    proof: /resolved ZERO publishable packages — nothing was scanned/,
+    reason:
+      'GT-624 security-publish-lag gate; refuses a root with no publishable package, a package ' +
+      'whose publish boundary cannot be established (unable to answer is not "nothing to report"), ' +
+      'and a scan that examined zero commits while packages report commits since their boundary',
+  },
   {
     file: '34-boundary-guard-repository.mjs',
     proof: /A zero-file scan must never be reported as "boundary guard passed"/,
diff --git a/reference/core/control-center/evidence/gap-closure-evidence.json b/reference/core/control-center/evidence/gap-closure-evidence.json
index 2509ae05d..13a4abd7a 100644
--- a/reference/core/control-center/evidence/gap-closure-evidence.json
+++ b/reference/core/control-center/evidence/gap-closure-evidence.json
@@ -3,2805 +3,2376 @@
   "policy": "./gap-closure-evidence-standard.md",
   "closures": [
     {
-      "id": "GT-574",
-      "closedAt": "2026-07-26",
-      "closureCommit": "44fe8dd3",
+      "id": "GT-01",
+      "closedAt": "2026-06-10",
+      "closureCommit": "ae21c92",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "reference/core/architecture/adrs/core/0073-unified-cli-output-contract.md",
+        "product/products/evolith-tracker/sdlc-tracker-technical-interfaces.md"
       ],
       "validationCommands": [
-        "gh api repos/beyondnetcode/evolith_arch32/branches/main/protection -> required contexts = [Test, Test core-domain, Test core, Test mcp-server, Test core-api, Validate documentation, CodeQL SAST] (7, up from 6); enforce_admins.enabled = TRUE (was false).",
-        "gh api repos/beyondnetcode/evolith_arch32/branches/develop/protection -> the same 7 contexts with enforce_admins.enabled = TRUE. Previously this endpoint returned 404 \"Branch not protected\", on the branch where every change lands.",
-        "The audit finding \"0 of the 6 required checks is a security check\" no longer holds: CodeQL SAST is now required on both branches.",
-        "ci-cd.yml runs on push to develop (44fe8dd3), so the engine suites now execute on the working branch rather than only after a change reaches main."
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
-      "dependencyDisposition": "none",
-      "dependencyRationale": "Branch protection applied and independently re-verified against the GitHub API on 2026-07-26: enforce_admins=true and CodeQL SAST required on BOTH main and develop. Not yet demonstrated: the acceptance criterion \"a test PR with a core check red cannot be merged\", and the 30-consecutive-day clean window, which is time-based. The commands above now carry their observed output rather than being bare invocations."
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "The Tracker technical interface references ADR-0073 as the unified output-envelope authority."
     },
     {
-      "id": "GT-465",
-      "closedAt": "2026-07-09",
-      "closureCommit": "70d8b8cc",
+      "id": "GT-02",
+      "closedAt": "2026-06-10",
+      "closureCommit": "8b4f673",
       "evidence": [
-        "product/infra/helm/evolith-core-api/templates/networkpolicy.yaml",
-        "product/infra/kubernetes/README.md"
+        "src/packages/core-domain/src/domain/gate-evidence.ts",
+        "src/rulesets/schema/gate-evidence.schema.json"
       ],
       "validationCommands": [
-        "ruby -ryaml -e 'YAML.load_stream(...network-policies.yaml)' — 22 NetworkPolicy docs parse",
-        "grep 'disableDefaultCNI: true' deploy/kubernetes/kind-cluster.yaml"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
-      "dependencyDisposition": "deferred",
-      "dependencyRationale": "Manifests + kind config delivered; live allow/deny assertions belong to the G1 integration gate (Cilium must be installed on a live kind cluster to enforce them)."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-463",
-      "closedAt": "2026-07-09",
-      "closureCommit": "79d1c403",
+      "id": "GT-03",
+      "closedAt": "2026-06-10",
+      "closureCommit": "b151e2f",
       "evidence": [
-        "product/operations/alerts/prometheus-alerts.yml",
-        "product/operations/incident-response-poison-message-reprocess.md",
-        "product/operations/incident-response-poison-message-reprocess.es.md"
+        "src/packages/core-domain/src/application/use-cases/evaluate-gate.use-case.ts",
+        "src/sdk/cli/test/gate.e2e-spec.ts"
       ],
       "validationCommands": [
-        "ruby -ryaml -e 'YAML.load_file(...)' — 3 groups; messaging-alerts: MassTransitPoisonMessages + TenantProjectionQueueMissing",
-        "grep '_error' product/operations/alerts/prometheus-alerts.yml"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-02 supplied the domain contract consumed by the use case."
     },
     {
-      "id": "GT-462",
-      "closedAt": "2026-07-09",
-      "closureCommit": "e9a4deb5",
+      "id": "GT-04",
+      "closedAt": "2026-06-10",
+      "closureCommit": "6f7a3e8",
       "evidence": [
-        "reference/core/architecture/adrs/core/0108-masstransit-owned-message-topology.md",
-        "reference/core/architecture/adrs/core/0108-masstransit-owned-message-topology.es.md",
-        "product/infra/kubernetes/README.md"
+        "src/packages/core-domain/src/domain/gate-evidence.ts",
+        "src/sdk/cli/.eslintrc.js"
       ],
       "validationCommands": [
-        "git show --stat -- deploy/kubernetes/messaging/broker-rbac.yaml (renamed from tenant-topology.yaml)",
-        "grep -L 'kind: Exchange' deploy/kubernetes/messaging/broker-rbac.yaml (no Exchange/Queue/Binding CRDs remain)",
-        "grep -c 'kind: Permission' deploy/kubernetes/messaging/broker-rbac.yaml (== 3 per-product permissions)"
+        "npm run lint --workspace src/sdk/cli"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Topology decision recorded (ADR-0108) and message-path CRDs retired in favor of per-product User/Permission RBAC. The G1 'consumer endpoint started' assertion (bus health, not pod Ready) is delegated to the G1 integration-gate automation (§13) and tracked there — it is not a blocker for the topology decision."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-434",
-      "closedAt": "2026-07-04",
-      "closureCommit": "6b1c5472",
+      "id": "GT-05",
+      "closedAt": "2026-06-11",
+      "closureCommit": "cb9474e",
       "evidence": [
-        "src/rulesets/schema/topology-manifest.schema.json",
-        "src/packages/core-domain/src/application/services/phase-artifact-profile.service.ts",
-        "src/apps/core-api/src/presentation/controllers/architecture.controller.ts",
-        "src/rulesets/schema/phase-artifact-registry.json",
-        "src/packages/core-domain/src/application/services/phase-artifacts.e2e.spec.ts"
+        "src/packages/mcp-server/src/main.ts"
       ],
       "validationCommands": [
-        "ajv: 8 manifests valid with spec.phaseProfiles",
-        "npx tsc -b tsconfig.json",
-        "jest phase-artifact (6 pass incl. real-corpus E2E) + architecture.controller (10 pass)"
+        "npm run mcp:smoke --workspace src/sdk/cli"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Delivered: spec.phaseProfiles in manifests + PhaseArtifactProfileService + Core API endpoint + phase-artifact-registry + E2E. Follow-on (task_1b27a217): unified 'phase-artifacts' EvaluationKind so it auto-exposes on CLI/MCP via evaluate(), for full BR-008 parity — mirrors the design evaluator; the capability is already exposed on the Core API (the Tracker's surface)."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-425",
-      "closedAt": "2026-07-04",
-      "closureCommit": "d93bc0f2",
+      "id": "GT-06",
+      "closedAt": "2026-06-10",
+      "closureCommit": "acbd2a8",
       "evidence": [
-        "reference/core/architecture/adrs/core/0104-topology-driven-advisory-design-governance.md",
-        "reference/core/architecture/design-phase-governance.md",
-        "src/packages/core-domain/src/evaluation/design-flow.e2e.spec.ts"
+        "src/packages/mcp-server/src/tools/gate.tools.ts",
+        ".harness/scripts/mcp-smoke.mjs"
       ],
       "validationCommands": [
-        "EPIC — all children GT-426..GT-433 DONE; E2E against the real corpus passes; tsc -b clean"
+        "npm run mcp:smoke --workspace src/sdk/cli"
       ],
       "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "GT-425 umbrella closed via F0-F8 (GT-426..GT-433). One follow-on remains outside the epic scope: CLI/MCP topology-recommend parity (task_0dfc5f71) mirroring the Core API endpoint for full BR-008 parity on the recommender."
+      "dependencyRationale": "Phase context is required on gate evaluation; retrofitting unrelated legacy tools was explicitly excluded to preserve their public schemas."
     },
     {
-      "id": "GT-433",
-      "closedAt": "2026-07-04",
-      "closureCommit": "d93bc0f2",
+      "id": "GT-07",
+      "closedAt": "2026-06-11",
+      "closureCommit": "732920c",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/design-flow.e2e.spec.ts",
-        "reference/core/architecture/design-phase-governance.md",
-        "reference/core/architecture/design-phase-governance.es.md"
+        ".harness/scripts/mcp-smoke.mjs"
       ],
       "validationCommands": [
-        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns evaluation (65 pass, incl. design-flow.e2e against the real corpus)",
-        "bilingual parity 8/8; links resolve"
+        "npm run mcp:smoke --workspace src/sdk/cli"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-05 and GT-06 provide the transport and gate tool exercised by the smoke."
     },
     {
-      "id": "GT-432",
-      "closedAt": "2026-07-04",
-      "closureCommit": "33306d72",
+      "id": "GT-08",
+      "closedAt": "2026-06-11",
+      "closureCommit": "fb9a07b",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/kind-evaluators.ts",
-        "src/packages/core-domain/src/evaluation/kind-evaluators.spec.ts"
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts"
       ],
       "validationCommands": [
-        "npx tsc -b tsconfig.json",
-        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns evaluation (64 pass, 1 new downstream-derivation spec)"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-431",
-      "closedAt": "2026-07-04",
-      "closureCommit": "4fcdc2c8",
+      "id": "GT-09",
+      "closedAt": "2026-06-11",
+      "closureCommit": "fbdf401",
       "evidence": [
-        "src/rulesets/schema/design-template.schema.json",
-        "reference/core/foundations/agent-skills/design-template-proposal.md",
-        "reference/core/foundations/agent-skills/template-promotion.md",
-        "src/apps/core-api/src/presentation/controllers/architecture.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/architecture.controller.spec.ts"
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts"
       ],
       "validationCommands": [
-        "ajv: design-template fixture valid",
-        "npx tsc -b tsconfig.json",
-        "npx jest architecture.controller (9 pass, 2 new recommend-topology specs)"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "design-evaluate exposed on all surfaces via evaluate(); topology-recommend exposed on the Core API (the Tracker's surface). CLI/MCP topology-recommend commands mirror the endpoint and are tracked as a follow-on (task_0dfc5f71) for full BR-008 parity on the recommender."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-430",
-      "closedAt": "2026-07-04",
-      "closureCommit": "0196b158",
+      "id": "GT-10",
+      "closedAt": "2026-06-11",
+      "closureCommit": "d2c0a3d",
       "evidence": [
-        "src/rulesets/schema/topology-recommendation.schema.json",
-        "src/rulesets/architecture/topology-recommendation.rules.json",
-        "src/packages/core-domain/src/application/services/topology-recommendation.service.ts",
-        "src/packages/core-domain/src/application/services/topology-recommendation.service.spec.ts"
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts"
       ],
       "validationCommands": [
-        "ajv: topology-recommendation.rules.json valid against its schema",
-        "npx tsc -b tsconfig.json",
-        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns topology-recommendation (5 pass)"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-429",
-      "closedAt": "2026-07-04",
-      "closureCommit": "1b4e6f98",
+      "id": "GT-11",
+      "closedAt": "2026-06-11",
+      "closureCommit": "d2c0a3d",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/kind-evaluators.ts",
-        "src/packages/core-domain/src/evaluation/kind-evaluators.spec.ts",
-        "src/packages/core-domain/src/application/services/topology-catalog.service.ts"
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts"
       ],
       "validationCommands": [
-        "npx tsc -b tsconfig.json",
-        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns evaluation (63 pass, 3 new design specs)"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
-      "dependencyDisposition": "none",
-      "dependencyRationale": "Advisory maturity evaluator (TS KindEvaluator); no new Native rule → no OPA parity twin required (R-25 N/A). Delivers the content/maturity evaluation capability behind the existence-only gate gaps."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-428",
-      "closedAt": "2026-07-04",
-      "closureCommit": "0392fefe",
+      "id": "GT-12",
+      "closedAt": "2026-06-11",
+      "closureCommit": "a30f7b0",
       "evidence": [
-        "src/rulesets/schema/blueprint.schema.json",
-        "src/rulesets/schema/design-block.schema.json",
-        "src/rulesets/schema/design-block-registry.json",
-        "src/rulesets/schema/fixtures/blueprint.multi-concern.valid.json",
-        "reference/core/sdlc/04-artifact-templates/design-block-template.md"
+        "src/sdk/cli/test"
       ],
       "validationCommands": [
-        "ajv: multi-concern fixture + legacy blueprint (backward-compat) + design-block sample all valid; registry 22 blocks, 0 unresolved schemaRefs"
+        "npm run test:e2e --workspace src/sdk/cli"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-427",
-      "closedAt": "2026-07-04",
-      "closureCommit": "46791e85",
+      "id": "GT-13",
+      "closedAt": "2026-06-12",
+      "closureCommit": "1ab485e",
       "evidence": [
-        "src/rulesets/schema/topology-manifest.schema.json",
-        "reference/core/architecture/topologies/progressive-axis/modular-monolith/topology.manifest.json",
-        "src/rulesets/topologies/agentic-ai/topology.manifest.json"
+        "src/packages/core-domain/src/application/use-cases/propose-phase-advance.use-case.ts",
+        "src/packages/core-domain/src/application/use-cases/propose-phase-advance.use-case.spec.ts"
       ],
       "validationCommands": [
-        "ajv compile of topology-manifest.schema.json + validate all 8 topology.manifest.json (8 valid, 0 invalid)"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-03 supplies the technical gate evaluation composed by the proposal runner."
     },
     {
-      "id": "GT-426",
-      "closedAt": "2026-07-04",
-      "closureCommit": "5ddf4471",
+      "id": "GT-14",
+      "closedAt": "2026-06-11",
+      "closureCommit": "b544411",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/contracts/evaluation-context.ts",
-        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts",
-        "src/rulesets/schema/evaluation-context.schema.json",
-        "src/rulesets/schema/evaluation-result.schema.json",
-        "src/rulesets/schema/evolith-yaml.schema.json"
+        "src/packages/infra-providers/src/webhook.adapter.ts",
+        "src/sdk/cli/src/infrastructure/adapters/webhook.adapter.spec.ts"
       ],
       "validationCommands": [
-        "npx tsc -b tsconfig.json",
-        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns evaluation"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-412",
-      "closedAt": "2026-07-02",
-      "closureCommit": "2f3e0bbe",
+      "id": "GT-16",
+      "closedAt": "2026-06-10",
+      "closureCommit": "225d3de",
       "evidence": [
-        "src/packages/agent-runtime/src/application/agent-runtime.service.ts",
-        "src/packages/agent-runtime/src/__tests__/agent-runtime.service.spec.ts",
-        "src/apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts",
-        ".harness/playbooks/sdlc-deep-audit.mjs"
+        "reference/core/control-center/gaps/gap-tracking.md",
+        "reference/core/control-center/gaps/gap-reference-catalog.md"
       ],
       "validationCommands": [
-        "npm run build --workspace src/packages/agent-runtime",
-        "npm run test --workspace src/packages/agent-runtime",
-        "npx tsc -p apps/agent-runtime-api/tsconfig.json",
-        "npm run build --workspace src/sdk/cli",
-        "node .harness/scripts/run-evolith-deep.mjs --markdown"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "GT-412 closes mandatory policy preflight, retained post-execution policy validation, and hosted runtime OPA default. GT-399 remains open for replacing CLI-side non-policy stubs with real HTTP/Harness adapters."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-402",
-      "closedAt": "2026-07-02",
-      "closureCommit": "9ef081b9",
-      "evidence": [
-        "src/sdk/cli/src/infrastructure/agent/agent-runtime.factory.ts",
-        "src/sdk/cli/src/infrastructure/agent/agent-runtime.factory.spec.ts",
-        "src/sdk/cli/src/commands/chat/chat.command.ts",
-        "src/sdk/cli/src/commands/chat/chat.command.spec.ts",
-        "src/sdk/cli/src/commands/plan/index.ts",
-        "src/packages/agent-runtime/src/index.ts",
-        "src/packages/agent-runtime/src/__tests__/public-surface.spec.ts"
+      "id": "GT-17",
+      "closedAt": "2026-06-12",
+      "closureCommit": "000bf3b",
+      "evidence": [
+        "src/sdk/cli/.eslintrc.js",
+        "src/sdk/cli/src"
       ],
       "validationCommands": [
-        "npm run build --workspace src/packages/agent-runtime",
-        "npm run test --workspace src/packages/agent-runtime",
-        "npx jest --config src/sdk/cli/jest.config.js --runTestsByPath src/sdk/cli/src/infrastructure/agent/agent-runtime.factory.spec.ts src/sdk/cli/src/commands/chat/chat.command.spec.ts --no-coverage --runInBand",
+        "npm run lint --workspace src/sdk/cli",
         "npm run build --workspace src/sdk/cli"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "GT-402 closes the Smart CLI interaction-adapter routing layer. GT-399 remains open for replacing stub/in-memory runtime adapters with real HTTP/Harness adapters."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-401",
-      "closedAt": "2026-07-02",
-      "closureCommit": "2e0814d3",
+      "id": "GT-18",
+      "closedAt": "2026-06-12",
+      "closureCommit": "206867c",
       "evidence": [
-        "src/packages/agent-runtime/src/domain/ports/interaction-adapter.port.ts",
-        "src/packages/agent-runtime/src/domain/ports/index.ts",
-        "src/packages/agent-runtime/src/adapters/index.ts",
-        "src/packages/agent-runtime/src/adapters/interaction/ExternalTriggerInteractionAdapter.ts",
-        "src/packages/agent-runtime/src/adapters/interaction/SmartCliCommandInteractionAdapter.ts",
-        "src/packages/agent-runtime/src/adapters/interaction/SmartCliChatInteractionAdapter.ts",
-        "src/packages/agent-runtime/src/adapters/interaction/HermesChatBoxInteractionAdapter.ts",
-        "src/packages/agent-runtime/src/__tests__/interaction-adapters.spec.ts",
-        "src/packages/agent-runtime/src/__tests__/public-surface.spec.ts",
-        "src/apps/agent-runtime-api/src/agent-runtime/agent-runtime.controller.ts",
-        "src/sdk/cli/src/infrastructure/agent/agent-runtime.factory.ts"
+        ".github/workflows/sdk-cli-release.yml",
+        "src/sdk/cli/package.json"
       ],
       "validationCommands": [
-        "npm run build --workspace src/packages/agent-runtime",
-        "npm run test --workspace src/packages/agent-runtime",
-        "npx tsc -p apps/agent-runtime-api/tsconfig.json"
+        "npm view @beyondnet/evolith-cli"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "GT-401 closes the shared public InteractionAdapterPort contract and the existing CLI/Hermes/API adapter path. MCP/webhook-specific rollout remains explicitly tracked by GT-405 and follow-on interface gaps."
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-28, GT-05, and GT-07 were closed before the public release workflow was accepted."
     },
     {
-      "id": "GT-398",
-      "closedAt": "2026-07-02",
-      "closureCommit": "f826a927",
+      "id": "GT-19",
+      "closedAt": "2026-06-12",
+      "closureCommit": "3492321",
       "evidence": [
-        "src/rulesets/opa/capability-source-interface.rego",
-        "src/rulesets/opa/capability-source-interface.test.rego",
-        "src/rulesets/opa/main.rego",
-        "src/packages/agent-runtime/src/application/context-mapper.ts",
-        "src/packages/agent-runtime/src/__tests__/units.spec.ts",
-        "src/packages/agent-runtime/src/__tests__/agent-runtime.service.spec.ts"
+        "src/packages/core-domain/src/domain",
+        "src/packages/core-domain/src/application",
+        "src/sdk/cli/src/infrastructure",
+        "src/sdk/cli/.eslintrc.js"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/29-test-core-opa.mjs",
-        "npx jest --config src/packages/agent-runtime/jest.config.js --runTestsByPath src/packages/agent-runtime/src/__tests__/units.spec.ts src/packages/agent-runtime/src/__tests__/agent-runtime.service.spec.ts --no-coverage"
+        "npm run lint --workspace src/sdk/cli",
+        "npm run build --workspace src/sdk/cli"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-164",
-      "closedAt": "2026-06-22",
-      "closureCommit": "fcd5d2af",
+      "id": "GT-20",
+      "closedAt": "2026-06-25",
+      "closureCommit": "2d510597",
       "evidence": [
-        "src/rulesets/topologies/event-driven/event-driven.rules.json",
-        "src/rulesets/topologies/event-driven/event-driven.rego",
-        "src/rulesets/topologies/event-driven/event-driven.test.rego",
-        "src/rulesets/topologies/data-mesh/data-mesh.rules.json",
-        "src/rulesets/topologies/data-mesh/data-mesh.rego",
-        "src/rulesets/topologies/data-mesh/data-mesh.test.rego"
+        "reference/core/architecture/adrs/",
+        "reference/core/control-center/gaps/gap-reference-catalog.md",
+        "reference/core/control-center/gaps/gap-reference-catalog.es.md"
       ],
       "validationCommands": [
-        ".harness/bin/opa test reference/core/architecture/topologies/integration/event-driven/event-driven.rego reference/core/architecture/topologies/integration/event-driven/event-driven.test.rego -v",
-        ".harness/bin/opa test reference/core/architecture/topologies/data/data-mesh/data-mesh.rego reference/core/architecture/topologies/data/data-mesh/data-mesh.test.rego -v"
+        "rg -n \"GT-20\" reference/core/architecture/adrs"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "none",
+      "closureNote": "ADR corpus backfill completed; only ADR authoring standard references to GT-20 remain as historical tracking links."
     },
     {
-      "id": "GT-163",
-      "closedAt": "2026-06-22",
-      "closureCommit": "fa3650f8",
+      "id": "GT-21",
+      "closedAt": "2026-06-12",
+      "closureCommit": "617241d",
       "evidence": [
-        ".harness/scripts/validate-topology-manifests.mjs",
-        "src/rulesets/schema/maturity-evidence.schema.json"
+        "reference/core/architecture/adrs/core/0001-monorepo-orchestration-principle.md",
+        "reference/core/architecture/adrs/adr-authoring-standard.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/validate-topology-manifests.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-162",
-      "closedAt": "2026-06-22",
-      "closureCommit": "d958c18c",
+      "id": "GT-22",
+      "closedAt": "2026-06-12",
+      "closureCommit": "d424bfd",
       "evidence": [
-        "src/rulesets/opa/main_test.rego",
-        "src/packages/core-domain/src/application/validators/evaluators/aggregator-parity.spec.ts"
+        "reference/core/architecture/adrs/adr-authoring-standard.md",
+        "reference/core/architecture/adrs/adr-matrix.md"
       ],
       "validationCommands": [
-        "./.harness/bin/opa test src/rulesets/opa/ --ignore=schemas -v",
-        "npx jest src/packages/core-domain/src/application/validators/evaluators/aggregator-parity.spec.ts"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-161",
-      "closedAt": "2026-06-22",
-      "closureCommit": "644f047e",
+      "id": "GT-23",
+      "closedAt": "2026-06-12",
+      "closureCommit": "c9137a0",
       "evidence": [
-        "src/rulesets/opa/schemas/governance.input.schema.json",
-        "src/rulesets/opa/schemas/mcp.input.schema.json",
-        "src/rulesets/opa/schemas/version-pinning.input.schema.json",
-        "src/rulesets/opa/schemas/cli-readiness.input.schema.json",
-        "src/rulesets/opa/schemas/knowledge-intake.input.schema.json",
-        "src/rulesets/opa/schemas/taxonomy.input.schema.json",
-        "src/rulesets/opa/schemas/ci-cd.input.schema.json",
-        "src/rulesets/opa/schemas/evidence.input.schema.json",
-        "src/rulesets/opa/schemas/abac-mcp-tool-access.input.schema.json",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.spec.ts",
-        "src/rulesets/opa/README.md",
-        "src/rulesets/opa/README.es.md",
-        "src/rulesets/schema/README.md",
-        "src/rulesets/schema/README.es.md",
-        "src/rulesets/README.md",
-        "src/rulesets/README.es.md"
+        "reference/core/sdlc/governance/BILINGUAL_INDEX.md",
+        "reference/core/sdlc/governance/BILINGUAL_INDEX.es.md"
       ],
       "validationCommands": [
-        "npm run build --workspace src/packages/core-domain",
-        "npx jest src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.spec.ts",
-        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/bilingual-coverage.mjs",
         "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-160",
-      "closedAt": "2026-06-22",
-      "closureCommit": "a8e70ac3",
+      "id": "GT-24",
+      "closedAt": "2026-06-12",
+      "closureCommit": "e7bb4c2",
       "evidence": [
-        "src/packages/core-domain/src/common/request-context.ts",
-        "src/packages/mcp-server/src/common/envelopes.ts",
-        "src/packages/mcp-server/src/mcp/mcp-server.service.ts",
-        "src/apps/core-api/src/infrastructure/middleware/correlation-id.middleware.ts",
-        "src/apps/core-api/src/infrastructure/interceptors/envelope.interceptor.ts",
-        "src/packages/infra-providers/src/webhook.adapter.ts"
+        "reference/core/control-center/taxonomy/documentation-taxonomy.md",
+        "product/suite/README.md",
+        "product/products/README.md"
       ],
       "validationCommands": [
-        "npm run build --workspace src/packages/core-domain",
-        "npm run test --workspace src/packages/mcp-server",
-        "npm run test --workspace src/apps/core-api",
-        "npm run test --workspace src/sdk/cli"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-158",
-      "closedAt": "2026-06-22",
-      "closureCommit": "a8e70ac3",
+      "id": "GT-25",
+      "closedAt": "2026-06-12",
+      "closureCommit": "40c6846",
       "evidence": [
-        "src/packages/mcp-server/src/mcp/abac-evaluator.ts",
-        "src/packages/mcp-server/src/mcp/mcp-server.service.ts",
-        "src/packages/mcp-server/src/mcp/mcp-server.service.spec.ts",
-        "src/rulesets/opa/abac-mcp-tool-access.rego",
-        "src/packages/mcp-server/src/mcp/mcp.module.ts"
+        "product/infra/README.md",
+        "product/infra/scm/github-profile.md",
+        "product/infra/ci-cd/github-actions-profile.md",
+        "product/infra/observability/otel-stack-profile.md",
+        "product/infra/security/codeql-trivy-profile.md"
       ],
       "validationCommands": [
-        "npm run build:policy",
-        "npm run test --workspace src/packages/mcp-server",
-        "./.harness/bin/opa test src/rulesets/opa/"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-157",
-      "closedAt": "2026-06-21",
-      "closureCommit": "a8e70ac3",
+      "id": "GT-26",
+      "closedAt": "2026-06-12",
+      "closureCommit": "c315597",
       "evidence": [
-        "src/packages/mcp-server/src/mcp/tool.interface.ts",
-        "src/packages/mcp-server/src/mcp/mcp-server.service.ts",
-        "src/packages/mcp-server/src/mcp/mcp-server.service.spec.ts",
-        "src/packages/mcp-server/src/common/envelopes.spec.ts"
+        "reference/core/sdlc/01-playbooks/zero-downtime-release.md"
       ],
       "validationCommands": [
-        "npm run build --workspace src/packages/mcp-server",
-        "npm run test --workspace src/packages/mcp-server"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-174",
-      "closedAt": "2026-06-21",
-      "closureCommit": "4e8fcad3",
+      "id": "GT-27",
+      "closedAt": "2026-06-11",
+      "closureCommit": "4fb2321",
       "evidence": [
-        "src/rulesets/schema/output-envelope.schema.json",
-        "reference/core/control-center/audits/surface-compatibility.json",
-        "reference/core/control-center/audits/surface-compatibility.schema.json",
-        ".harness/scripts/ci/20-validate-surface-compatibility.mjs",
-        ".harness/scripts/ci/20-validate-surface-compatibility.test.mjs"
+        "reference/core/control-center/gaps/gap-tracking.md",
+        "reference/core/control-center/gaps/gap-reference-catalog.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/20-validate-surface-compatibility.mjs",
-        "node --test .harness/scripts/ci/20-validate-surface-compatibility.test.mjs"
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-168",
-      "closedAt": "2026-06-21",
-      "closureCommit": "507bb5a4",
+      "id": "GT-28",
+      "closedAt": "2026-06-13",
+      "closureCommit": "84ec879",
       "evidence": [
-        "src/rulesets/schema/topology-composition.schema.json",
-        "product/research/demo/examples/cross-topology-composition/topology.composition.json",
-        "product/research/demo/examples/cross-topology-composition/modular-monolith.config.json",
-        "product/research/demo/examples/cross-topology-composition/event-driven.config.json",
-        "product/research/demo/examples/cross-topology-composition/README.md",
-        "product/research/demo/examples/cross-topology-composition/README.es.md",
-        ".harness/scripts/ci/22-validate-topology-composition.mjs",
-        "reference/core/architecture/topologies/topology-dimensions.md",
-        "reference/core/architecture/topologies/topology-dimensions.es.md"
+        ".github/workflows/sdk-cli-ci.yml",
+        ".github/workflows/ci-cd.yml",
+        ".github/workflows/sdk-cli-release.yml",
+        "src/sdk/cli/package.json"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/22-validate-topology-composition.mjs",
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+        "npm ci",
+        "npm run lint --workspace @beyondnet/evolith-cli",
+        "npm run build --workspace @beyondnet/evolith-cli",
+        "npm run test:unit --workspace @beyondnet/evolith-cli -- --runInBand",
+        "npm run test:e2e --workspace @beyondnet/evolith-cli",
+        "npm run mcp:smoke --workspace @beyondnet/evolith-cli"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "GT-28 restores clean-checkout installation and the executable lint, build, test, and MCP smoke baseline. The independently measured coverage regression remains blocking and is tracked as GT-48."
     },
     {
-      "id": "GT-170",
-      "closedAt": "2026-06-21",
-      "closureCommit": "334e5019",
+      "id": "GT-29",
+      "closedAt": "2026-06-11",
+      "closureCommit": "769651c",
       "evidence": [
-        "product/products/ums-reference/README.md",
-        "product/products/ums-reference/README.es.md",
-        "product/products/ums-reference/overview.md",
-        "product/products/ums-reference/overview.es.md",
-        "product/products/ums-reference/reference-model.md",
-        "product/products/ums-reference/reference-model.es.md",
-        "product/products/README.md",
-        "product/products/README.es.md",
-        "product/research/demo/README.md",
-        "product/research/demo/README.es.md"
+        "reference/core/architecture/topologies/progressive-axis/modular-monolith/modular-monolith.rego",
+        "src/sdk/cli/src"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/11-validate-product-docs.mjs"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-167",
-      "closedAt": "2026-06-21",
-      "closureCommit": "b6a67a60",
+      "id": "GT-33",
+      "closedAt": "2026-06-12",
+      "closureCommit": "990af1a",
       "evidence": [
-        "src/rulesets/schema/observability-validation.schema.json",
-        "src/rulesets/schema/security-scan-report.schema.json",
-        "src/rulesets/schema/integration-evidence.schema.json",
-        "src/rulesets/sdlc/phase-gates.rules.json",
-        "src/rulesets/schema/ruleset-sdlc.schema.json",
-        "reference/core/sdlc/04-artifact-templates/observability-validation-template.md",
-        "reference/core/sdlc/04-artifact-templates/observability-validation-template.es.md",
-        "reference/core/sdlc/04-artifact-templates/security-scan-report-template.md",
-        "reference/core/sdlc/04-artifact-templates/security-scan-report-template.es.md",
-        "reference/core/sdlc/04-artifact-templates/integration-evidence-template.md",
-        "reference/core/sdlc/04-artifact-templates/integration-evidence-template.es.md",
-        "reference/core/sdlc/04-artifact-templates/test-summary-report-template.md",
-        "reference/core/sdlc/04-artifact-templates/test-summary-report-template.es.md",
-        "reference/core/sdlc/01-playbooks/phase-4-rc-stamp.md",
-        "reference/core/sdlc/01-playbooks/phase-4-rc-stamp.es.md",
-        "reference/core/sdlc/01-playbooks/zero-downtime-release.md",
-        "reference/core/sdlc/01-playbooks/zero-downtime-release.es.md",
-        ".harness/scripts/ci/21-validate-phase-gate-templates.mjs",
-        "reference/core/sdlc/README.md",
-        "reference/core/sdlc/README.es.md"
+        "reference/core/control-center/maturity-reports/maturity-assessment.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/21-validate-phase-gate-templates.mjs",
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-166 playbooks now cite each evidence template."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-166",
-      "closedAt": "2026-06-21",
-      "closureCommit": "bbe5db91",
+      "id": "GT-34",
+      "closedAt": "2026-06-12",
+      "closureCommit": "82f2d0f",
       "evidence": [
-        "reference/core/sdlc/01-playbooks/phase-1-business-signoff.md",
-        "reference/core/sdlc/01-playbooks/phase-1-business-signoff.es.md",
-        "reference/core/sdlc/01-playbooks/phase-2-design-baseline.md",
-        "reference/core/sdlc/01-playbooks/phase-2-design-baseline.es.md",
-        "reference/core/sdlc/01-playbooks/phase-4-rc-stamp.md",
-        "reference/core/sdlc/01-playbooks/phase-4-rc-stamp.es.md",
-        "src/rulesets/sdlc/phase-gates.rules.json",
-        "src/rulesets/schema/ruleset-sdlc.schema.json",
-        "reference/core/sdlc/quality-gates.md",
-        "reference/core/sdlc/quality-gates.es.md",
-        "reference/core/sdlc/README.md",
-        "reference/core/sdlc/README.es.md"
+        "product/suite/strategy/evolutionary-strategy-roadmap.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-165",
-      "closedAt": "2026-06-21",
-      "closureCommit": "956bba24",
+      "id": "GT-35",
+      "closedAt": "2026-06-12",
+      "closureCommit": "0fe0696",
       "evidence": [
-        "src/rulesets/schema/topology-manifest.schema.json",
-        "src/rulesets/topologies/serverless/topology.manifest.json",
-        "src/rulesets/topologies/edge-computing/topology.manifest.json",
-        "reference/core/architecture/topologies/execution/operational-budgets-runbook.md",
-        "reference/core/architecture/topologies/execution/operational-budgets-runbook.es.md",
-        ".harness/scripts/validate-topology-manifests.mjs"
+        ".harness/scripts/ci/08-validate-tracking.mjs",
+        ".harness/scripts/ci/07-generate-inventories.mjs",
+        "reference/core/control-center/maturity-reports/inventory-summary.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/validate-topology-manifests.mjs"
+        "node .harness/scripts/ci/08-validate-tracking.mjs",
+        "node .harness/scripts/ci/07-generate-inventories.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-159",
-      "closedAt": "2026-06-21",
-      "closureCommit": "a9297f4e",
+      "id": "GT-36",
+      "closedAt": "2026-06-12",
+      "closureCommit": "2a831b1",
       "evidence": [
-        "reference/core/architecture/adrs/core/0098-rest-uri-versioning-deprecation-policy.md",
-        "reference/core/architecture/adrs/core/0098-rest-uri-versioning-deprecation-policy.es.md",
-        "src/apps/core-api/src/infrastructure/interceptors/deprecation.interceptor.ts",
-        "src/apps/core-api/src/infrastructure/interceptors/deprecation.interceptor.spec.ts",
-        "src/apps/core-api/src/main.ts",
-        "src/apps/core-api/src/e2e.spec.ts",
-        ".harness/scripts/ci/19-validate-rest-versioning.mjs",
-        ".harness/scripts/ci/19-validate-rest-versioning.test.mjs",
-        "product/products/core-api/changelog.md",
-        "product/products/core-api/changelog.es.md"
+        "reference/core/sdlc/governance/adr-0090-rule-language-policy.md"
       ],
       "validationCommands": [
-        "npm --workspace core-api run test",
-        "node .harness/scripts/ci/19-validate-rest-versioning.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-155 is a completed requirement providing response envelope conformance."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-155",
-      "closedAt": "2026-06-21",
-      "closureCommit": "4d8ad2f52f2243d5e6acbb02d038d21cd069b8ec",
+      "id": "GT-37",
+      "closedAt": "2026-06-13",
+      "closureCommit": "f3c8520",
       "evidence": [
-        "src/apps/core-api/src/presentation/decorators/swagger-envelope.decorator.ts",
-        "src/apps/core-api/src/presentation/controllers/architecture.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/gates.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/health.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/phases.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/projects.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/reference.controller.ts",
-        "src/apps/core-api/src/e2e.spec.ts"
+        ".harness/scripts/ci/08-validate-tracking.mjs",
+        ".harness/scripts/validate-tracking.test.mjs",
+        "reference/core/control-center/evidence/gap-closure-evidence-standard.md",
+        "reference/core/control-center/evidence/gap-closure-evidence.json"
       ],
       "validationCommands": [
-        "npm --workspace core-api run test",
-        "node .harness/scripts/ci/10-validate-contract-conformance.mjs"
+        "node --test .harness/scripts/validate-tracking.test.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-156",
-      "closedAt": "2026-06-21",
-      "closureCommit": "4d8ad2f52f2243d5e6acbb02d038d21cd069b8ec",
+      "id": "GT-41",
+      "closedAt": "2026-06-13",
+      "closureCommit": "e4fa0e3",
       "evidence": [
-        "product/products/core-api/README.md",
-        "product/products/core-api/README.es.md",
-        "product/products/core-api/api-reference.md",
-        "product/products/core-api/api-reference.es.md",
-        "reference/core/sdlc/01-playbooks/core-api-deployment.md",
-        "reference/core/sdlc/01-playbooks/core-api-deployment.es.md"
+        ".github/workflows/docs.yml",
+        ".harness/scripts/ci/09-reconcile-maturity.mjs",
+        ".harness/scripts/reconcile-maturity.test.mjs",
+        "reference/core/control-center/maturity-reports/maturity-evidence.json",
+        "reference/core/control-center/maturity-reports/maturity-reconciliation.json"
       ],
       "validationCommands": [
-        "node .harness/scripts/generate-bilingual-index.mjs",
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "node --test .harness/scripts/reconcile-maturity.test.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs",
+        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check",
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "Documentation Validation run 27470122212 passed with full Git history and validated the runtime evidence-backed reconciliation."
     },
     {
-      "id": "GT-148",
-      "closedAt": "2026-06-20",
-      "closureCommit": "ec968d190388dc5e22086f870741ea68f59d8dcb",
+      "id": "GT-42",
+      "closedAt": "2026-06-13",
+      "closureCommit": "154aadf",
       "evidence": [
-        "src/rulesets/governance/satellite-contracts.rules.json"
+        ".harness/scripts/ci/10-validate-contract-conformance.mjs",
+        ".harness/scripts/validate-contract-conformance.test.mjs",
+        "src/rulesets/contracts/evolith-machine-contracts.json",
+        "src/rulesets/contracts/README.md",
+        ".github/workflows/docs.yml"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "node --test .harness/scripts/validate-contract-conformance.test.mjs",
+        "node .harness/scripts/ci/10-validate-contract-conformance.mjs",
+        "node .harness/scripts/ci/10-validate-contract-conformance.mjs --consumer ../evolith_tracker/contracts/evolith-core-contracts.json"
       ],
       "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-149 owns executable OPA semantics; its remaining ID-divergence warnings are intentionally reported without blocking this reference-integrity closure."
+      "dependencyRationale": "Evolith Tracker main commit 4256e7b pins contract 1.0.0 and executes the Core conformance validator in CI."
     },
     {
-      "id": "GT-129",
-      "closedAt": "2026-06-20",
-      "closureCommit": "fcf22ee27a160d1e5b34acab7210186531495a3d",
+      "id": "GT-44",
+      "closedAt": "2026-06-13",
+      "closureCommit": "26f6a1809b6258880173a934357d53beb37fcb7b",
       "evidence": [
-        "src/rulesets/topologies/edge-computing/edge-computing.rules.json",
-        "src/rulesets/topologies/edge-computing/edge-computing.rego",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
+        ".github/workflows/sdk-cli-release.yml",
+        ".github/workflows/sdk-cli-ci.yml",
+        ".harness/scripts/verify-git-tag.mjs",
+        ".harness/scripts/verify-version-log.mjs",
+        "reference/core/control-center/gaps/gap-reference-catalog.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "GITHUB_REF_NAME=main GITHUB_EVENT_NAME=push node .harness/scripts/verify-git-tag.mjs",
+        "GITHUB_REF_NAME=main GITHUB_EVENT_NAME=push node .harness/scripts/verify-version-log.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs",
+        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-128",
-      "closedAt": "2026-06-20",
-      "closureCommit": "e72d8c1de0fa10ee0abc853c5c04be36f032830f",
+      "id": "GT-45",
+      "closedAt": "2026-06-13",
+      "closureCommit": "b07460d",
       "evidence": [
-        "reference/core/architecture/adrs/core/0084-data-mesh-data-products.md",
-        "src/rulesets/topologies/data-mesh/data-mesh.rules.json",
-        "src/rulesets/topologies/data-mesh/data-mesh.rego",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
+        "src/packages/mcp-server/src/main.ts",
+        "src/packages/mcp-server/src/mcp/tool-registry.service.ts",
+        "src/packages/mcp-server/src/tools/gate.tools.spec.ts",
+        "src/packages/mcp-server/src/tools/architecture.tools.spec.ts",
+        "src/packages/mcp-server/src/tools/sdlc.tools.spec.ts",
+        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npm run lint --workspace src/sdk/cli",
+        "npm run test:unit --workspace src/sdk/cli -- --runInBand",
+        "npm run test:e2e --workspace src/sdk/cli -- --runTestsByPath test/e2e/mcp-e2e.test.ts",
+        "npm run mcp:smoke --workspace src/sdk/cli"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-126",
-      "closedAt": "2026-06-20",
-      "closureCommit": "8566249bbefe547f87116d90ecb8c8a797e5cc2b",
+      "id": "GT-46",
+      "closedAt": "2026-06-13",
+      "closureCommit": "b07460d",
       "evidence": [
-        "src/rulesets/topologies/serverless/serverless.rules.json",
-        "src/rulesets/topologies/serverless/serverless.rego",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
-        "src/rulesets/topologies/serverless/README.md"
+        "src/sdk/cli/src/app.module.ts",
+        "src/packages/mcp-server/src/main.ts",
+        "reference/core/control-center/gaps/gap-reference-catalog.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npm run build --workspace src/sdk/cli",
+        "npm run lint --workspace src/sdk/cli",
+        "npm run mcp:smoke --workspace src/sdk/cli",
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Tracker-owned chat and session behavior was removed; Core exposes governed capabilities through CLI and MCP only."
     },
     {
-      "id": "GT-127",
-      "closedAt": "2026-06-20",
-      "closureCommit": "8566249bbefe547f87116d90ecb8c8a797e5cc2b",
+      "id": "GT-47",
+      "closedAt": "2026-06-14",
+      "closureCommit": "38dfc985fa4f4a09e561678032b0412098f2273b",
       "evidence": [
-        "src/rulesets/topologies/event-driven/event-driven.rules.json",
-        "src/rulesets/topologies/event-driven/event-driven.rego",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
-        "src/rulesets/topologies/event-driven/README.md"
+        ".harness/scripts/generate-product-inventory.mjs",
+        ".harness/scripts/ci/11-validate-product-docs.mjs",
+        "product/products/smart-cli/product-inventory.md",
+        "product/products/smart-cli/README.md",
+        "product/products/mcp-services/README.md",
+        ".github/workflows/docs.yml"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "node .harness/scripts/generate-product-inventory.mjs --check",
+        "node .harness/scripts/ci/11-validate-product-docs.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-125",
-      "closedAt": "2026-06-20",
-      "closureCommit": "0fc716a48dc24ea2bec348a42b3780661de5a0b4",
+      "id": "GT-48",
+      "closedAt": "2026-06-13",
+      "closureCommit": "48e1d909992f29cd2cd49993101eb36ec730ae3a",
       "evidence": [
-        "reference/core/architecture/topologies/topology-corpus-standard.md",
-        "src/rulesets/topologies/agentic-ai/topology.manifest.json",
-        "src/rulesets/topologies/agentic-ai/adoption.md",
-        "src/rulesets/topologies/agentic-ai/operations.md",
-        "src/rulesets/topologies/agentic-ai/security.md",
-        "src/rulesets/topologies/agentic-ai/agent.config.schema.json",
-        ".harness/scripts/validate-topology-manifests.mjs"
+        "src/sdk/cli/src/infrastructure/adapters/moscow-prioritization.service.spec.ts",
+        "src/packages/core-domain/src/application/validators/architecture-drift.service.spec.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.spec.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/governance-rule.handler.spec.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.spec.ts",
+        "src/sdk/cli/src/infrastructure/providers/node-filesystem.provider.spec.ts",
+        "src/sdk/cli/src/infrastructure/adapters/disk-ruleset.repository.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/validate-topology-manifests.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/01-validate-docs.mjs --render-mermaid",
-        "npm run build --workspace @beyondnet/evolith-core-domain",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npm run test:cov --workspace @beyondnet/evolith-cli -- --coverageReporters=json-summary",
+        "node -e \"process.exit(require('./sdk/cli/coverage/coverage-summary.json').total.statements.pct >= 80 ? 0 : 1)\""
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-04 removed the service locator; the revived suites now inject collaborators through the constructor."
     },
     {
-      "id": "MT-A17",
-      "closedAt": "2026-06-20",
-      "closureCommit": "dadcb17",
+      "id": "GT-49",
+      "closedAt": "2026-06-13",
+      "closureCommit": "398729dff32735cac56069bb7c84a9fa44a2bff6",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/ruleset-validator-architecture.spec.ts"
+        "src/sdk/cli/tsconfig.json",
+        "src/sdk/cli/.eslintrc.js",
+        "src/sdk/cli/src/commands/adr/adr.command.ts",
+        "src/sdk/cli/src/commands/standards/standards.command.ts",
+        "src/packages/core-domain/src/application/services/index.ts",
+        "src/packages/core-domain/src/domain/interfaces.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace @beyondnet/evolith-core-domain"
+        "npx tsc --noEmit --project src/sdk/cli/tsconfig.json",
+        "npm run build --workspace src/sdk/cli",
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "MT-A26",
-      "closedAt": "2026-06-20",
-      "closureCommit": "683c5e1",
+      "id": "GT-50",
+      "closedAt": "2026-06-14",
+      "closureCommit": "040ea7f6b4354a87a44c702dd8e4cd37997e5b43",
       "evidence": [
-        "reference/core/control-center/taxonomy/MASTER_INDEX.md",
-        "reference/core/control-center/taxonomy/MASTER_INDEX.es.md"
+        "src/sdk/cli/jest.config.js",
+        ".github/workflows/sdk-cli-ci.yml"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npm run test:cov --workspace @beyondnet/evolith-cli -- --coverageReporters=text-summary"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-48 restored statement coverage to 80.65%; this threshold pins the recovered floor so regressions fail locally."
     },
     {
-      "id": "MT-A24",
-      "closedAt": "2026-06-20",
-      "closureCommit": "af871fc",
+      "id": "GT-51",
+      "closedAt": "2026-06-14",
+      "closureCommit": "54386a3485c987f6b9a09d48d369d8efc837312a",
       "evidence": [
-        "src/packages/core/src/index.ts",
-        "src/packages/mcp-server/src/mcp/resources.service.ts",
-        "src/packages/mcp-server/src/tools/topology.tools.ts"
+        "src/rulesets/schema/build-vs-compose.schema.json",
+        "src/rulesets/sdlc/phase-gates.rules.json",
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
+        "src/packages/core-domain/src/application/validators/build-vs-compose.schema.spec.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace @beyondnet/evolith-core",
-        "npm --workspace @beyondnet/evolith-mcp test"
+        "npm test --workspace src/sdk/cli -- --runInBand --testPathPattern build-vs-compose",
+        "npm run test:e2e --workspace src/sdk/cli -- --runTestsByPath test/gate.e2e-spec.ts"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "Builds on the ADR-0073 GateEvidence contract (GT-02/GT-03) and the deepened phase-gate content checks (GT-08…GT-11)."
     },
     {
-      "id": "MT-A25",
-      "closedAt": "2026-06-20",
-      "closureCommit": "1ee04e6",
+      "id": "GT-52",
+      "closedAt": "2026-06-14",
+      "closureCommit": "0601eaf9b933d6ff0b43782cac2f62b94ed623d3",
       "evidence": [
-        "src/apps/core-api/src/presentation/controllers/architecture.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/architecture.controller.spec.ts"
+        "src/sdk/cli/src/app.module.spec.ts",
+        "src/sdk/cli/src/commands/adr/adr.command.spec.ts",
+        "src/sdk/cli/src/commands/standards/standards.command.spec.ts"
       ],
       "validationCommands": [
-        "npm --workspace core-api test",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npm run build --workspace src/sdk/cli",
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "Completes the service-locator removal (GT-04) and DI consolidation (GT-17) by deleting the leftover no-op stubs."
     },
     {
-      "id": "GT-118",
-      "closedAt": "2026-06-20",
-      "closureCommit": "1ee04e6",
+      "id": "GT-53",
+      "closedAt": "2026-06-14",
+      "closureCommit": "0da71feda4238fe247a0033145e7e4a1008bad29",
       "evidence": [
-        "reference/core/architecture/adrs/core/0080-remote-repository-reference-contract.md",
-        "src/apps/core-api/src/application/services/workspace-reference-resolver.service.ts",
-        "src/apps/core-api/src/application/services/workspace-reference-resolver.service.spec.ts"
+        "reference/core/control-center/maturity-reports/maturity-assessment.md",
+        "product/suite/vision/README.md",
+        "src/rulesets/acl/README.md",
+        "README.md"
       ],
       "validationCommands": [
-        "npm --workspace core-api test",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "MT-A20",
-      "closedAt": "2026-06-20",
-      "closureCommit": "1ee04e6",
+      "id": "GT-54",
+      "closedAt": "2026-06-13",
+      "closureCommit": "5c576867419b18096f39f58391e92cd69727e451",
       "evidence": [
-        "src/rulesets/topologies/agentic-ai/agentic-ai.rules.json",
-        "src/rulesets/topologies/agentic-ai/agentic-ai.rego",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
+        "src/sdk/cli/.eslintrc.js",
+        "src/packages/core-domain/src/application/services/project-scaffolder.service.ts",
+        "src/packages/core-domain/src/application/use-cases/initialize-project.use-case.ts",
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npm run lint --workspace src/sdk/cli",
+        "npm test --workspace src/sdk/cli -- --runInBand",
+        "npm run test:e2e --workspace src/sdk/cli"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-19 deferred this gap; it is now closed by removing the direct instantiations."
     },
     {
-      "id": "MT-A19",
-      "closedAt": "2026-06-20",
-      "closureCommit": "1ee04e6",
+      "id": "GT-55",
+      "closedAt": "2026-06-14",
+      "closureCommit": "6772c5b",
       "evidence": [
-        "src/rulesets/topologies/event-driven/event-driven.rules.json",
-        "src/rulesets/topologies/event-driven/event-driven.rego",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
+        "src/sdk/cli/.eslintrc.js",
+        "src/packages/core-domain/src/domain/interfaces.ts",
+        "src/sdk/cli/src/infrastructure/cli/base-command.ts",
+        "src/sdk/cli/src/infrastructure/prompts/prompt.service.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npm run lint --workspace src/sdk/cli",
+        "npm run test:unit --workspace src/sdk/cli",
+        "npm run test:e2e --workspace src/sdk/cli"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "MT-A18",
-      "closedAt": "2026-06-20",
-      "closureCommit": "6049045",
+      "id": "GT-56",
+      "closedAt": "2026-06-14",
+      "closureCommit": "da470d460c8fc99e4322b1ec5f5980006b3b7968",
       "evidence": [
-        "src/rulesets/topologies/serverless/serverless.rules.json",
-        "src/rulesets/topologies/serverless/serverless.rego",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
+        "src/sdk/cli/test/agents.e2e-spec.ts",
+        "src/sdk/cli/test/mock-prompt.service.ts",
+        "src/sdk/cli/src/commands/init/init.command.ts",
+        "src/sdk/cli/src/commands/agents/agents.command.ts",
+        "src/sdk/cli/src/commands/adr/adr.command.ts"
       ],
       "validationCommands": [
-        "npm --workspace @beyondnet/evolith-core-domain test -- --runInBand",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npm run test:e2e --workspace src/sdk/cli"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "All interactive prompts are safely mocked."
     },
     {
-      "id": "GT-117",
-      "closedAt": "2026-06-19",
-      "closureCommit": "1067a41",
+      "id": "GT-57",
+      "closedAt": "2026-06-13",
+      "closureCommit": "c73c209228dc18beeb296837eda5b1e70df4667d",
       "evidence": [
-        "src/apps/core-api/src/application/services/core-reference-query.service.ts",
-        "src/apps/core-api/src/presentation/controllers/reference.controller.ts"
+        "src/packages/mcp-server/src/mcp/resources.service.ts",
+        "src/packages/mcp-server/src/mcp/prompts.service.ts",
+        "src/packages/mcp-server/src/tools/architecture.tools.ts",
+        "src/packages/mcp-server/src/tools/sdlc.tools.ts",
+        "product/products/smart-cli/docs/planning/sdk-cli-mcp-implementation-roadmap.md"
       ],
       "validationCommands": [
-        "npm --workspace src/apps/core-api test -- --runInBand"
+        "npm run lint --workspace src/sdk/cli",
+        "npm test --workspace src/sdk/cli"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "All MCP roadmap TODO items have been implemented and F1/F2/F3 architecture validation now correctly delegates to the OPA RulesetValidatorService."
     },
     {
-      "id": "MT-A21",
-      "closedAt": "2026-06-19",
-      "closureCommit": "2010ce0",
+      "id": "GT-58",
+      "closedAt": "2026-06-13",
+      "closureCommit": "b9b638c7b72a223432170922727923946c22b7a3",
       "evidence": [
-        "src/packages/core-domain/src/application/services/topology-catalog.service.ts",
-        "src/apps/core-api/src/core-domain.module.ts"
+        "src/packages/core-domain/src/application/generators/hexagonal-scaffolder.ts"
       ],
       "validationCommands": [
-        "npm --workspace @beyondnet/evolith-core-domain run build",
-        "npm --workspace src/apps/core-api test -- --runInBand",
-        "npm --workspace src/apps/core-api run build"
+        "npm run lint --workspace src/sdk/cli",
+        "npm test --workspace src/sdk/cli"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "No dependencies. Technical debt placeholders replaced with valid implementation patterns."
     },
     {
-      "id": "GT-105",
-      "closedAt": "2026-06-16",
-      "closureCommit": "651ef9b",
+      "id": "GT-59",
+      "closedAt": "2026-06-13",
+      "closureCommit": "b32a985",
       "evidence": [
-        "src/sdk/cli/Dockerfile",
-        ".github/workflows/ci-cd.yml"
+        "src/apps/core-api/src/main.ts",
+        "src/apps/core-api/src/app.module.ts",
+        "src/apps/core-api/src/presentation/controllers/security-headers.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"security-headers\" --no-coverage"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-106",
-      "closedAt": "2026-06-16",
-      "closureCommit": "2c45e89",
+      "id": "GT-60",
+      "closedAt": "2026-06-13",
+      "closureCommit": "19b0738",
       "evidence": [
-        "src/sdk/cli/src/config/alias.service.ts",
-        "src/sdk/cli/src/commands/alias/alias.command.ts",
-        "src/sdk/cli/src/main.ts",
-        "src/sdk/cli/src/app.module.ts"
+        "src/apps/core-api/src/main.ts",
+        "src/apps/core-api/src/presentation/dtos/",
+        "src/apps/core-api/src/presentation/controllers/"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"security-headers\" --no-coverage"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-103",
-      "closedAt": "2026-06-16",
-      "closureCommit": "e7cdf47",
+      "id": "GT-61",
+      "closedAt": "2026-06-13",
+      "closureCommit": "72599da",
       "evidence": [
-        "src/sdk/cli/src/commands/sdlc/handoff.command.ts",
-        "src/sdk/cli/src/commands/sdlc/generate-domain.command.ts",
-        "src/sdk/cli/src/commands/sdlc/gate-status.command.ts",
-        "src/sdk/cli/src/app.module.ts"
+        "src/apps/core-api/src/infrastructure/filters/http-exception.filter.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "npx jest src/app.module.spec.ts"
+        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"e2e\" --no-coverage"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-98",
-      "closedAt": "2026-06-16",
-      "closureCommit": "4d71fd3",
+      "id": "GT-62",
+      "closedAt": "2026-06-13",
+      "closureCommit": "ee57f82",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/plugins/plugin-loader.ts",
-        "src/sdk/cli/src/infrastructure/plugins/plugin.module.ts",
-        "src/sdk/cli/src/app.module.ts"
+        "reference/core/architecture/adrs/core/0075-core-api-auth-strategy.md",
+        "src/apps/core-api/src/presentation/controllers/health.controller.ts"
       ],
       "validationCommands": [
-        "npx jest src/infrastructure/plugins/plugin-loader.spec.ts"
+        "npm test --workspace src/apps/core-api -- --no-coverage"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "API Key auth implemented for M2M. JWT Bearer tokens deferred to future iteration per ADR-0075."
     },
     {
-      "id": "GT-110",
-      "closedAt": "2026-06-15",
-      "closureCommit": "d050b9e",
+      "id": "GT-63",
+      "closedAt": "2026-06-13",
+      "closureCommit": "9aa78c6",
       "evidence": [
-        "product/infra/docker-compose.yml",
-        "product/infra/helm/evolith-core-api/templates/ingressroute.yaml"
+        "src/apps/core-api/src/infrastructure/interceptors/security-audit.interceptor.ts",
+        "src/apps/core-api/src/infrastructure/guards/audit-throttler.guard.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "npm test --workspace src/apps/core-api -- --no-coverage"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "Traefik replaces Kong in infrastructure configuration."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-01",
-      "closedAt": "2026-06-10",
-      "closureCommit": "ae21c92",
+      "id": "GT-64",
+      "closedAt": "2026-06-13",
+      "closureCommit": "db9ab18",
       "evidence": [
-        "reference/core/architecture/adrs/core/0073-unified-cli-output-contract.md",
-        "product/products/evolith-tracker/sdlc-tracker-technical-interfaces.md"
+        "src/apps/core-api/src/app.module.ts",
+        "src/apps/core-api/src/main.ts",
+        "src/apps/core-api/src/infrastructure/middleware/correlation-id.middleware.ts",
+        "src/apps/core-api/src/presentation/controllers/security-headers.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"security-headers\" --no-coverage"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "The Tracker technical interface references ADR-0073 as the unified output-envelope authority."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-02",
-      "closedAt": "2026-06-10",
-      "closureCommit": "8b4f673",
+      "id": "GT-65",
+      "closedAt": "2026-06-13",
+      "closureCommit": "3418a1d",
       "evidence": [
-        "src/packages/core-domain/src/domain/gate-evidence.ts",
-        "src/rulesets/schema/gate-evidence.schema.json"
+        "src/apps/core-api/src/infrastructure/metrics/",
+        "src/apps/core-api/src/presentation/controllers/health.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/metrics.controller.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npm test --workspace src/apps/core-api -- --no-coverage"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-03",
-      "closedAt": "2026-06-10",
-      "closureCommit": "b151e2f",
+      "id": "GT-66",
+      "closedAt": "2026-06-13",
+      "closureCommit": "535959b",
       "evidence": [
-        "src/packages/core-domain/src/application/use-cases/evaluate-gate.use-case.ts",
-        "src/sdk/cli/test/gate.e2e-spec.ts"
+        "src/apps/core-api/src/tracing.ts",
+        "src/apps/core-api/src/main.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npm test --workspace src/apps/core-api -- --no-coverage"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-02 supplied the domain contract consumed by the use case."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-04",
-      "closedAt": "2026-06-10",
-      "closureCommit": "6f7a3e8",
+      "id": "GT-67",
+      "closedAt": "2026-06-13",
+      "closureCommit": "b006a16",
       "evidence": [
-        "src/packages/core-domain/src/domain/gate-evidence.ts",
-        "src/sdk/cli/.eslintrc.js"
+        "src/apps/core-api/src/main.ts",
+        "src/apps/core-api/src/presentation/dtos/",
+        "src/apps/core-api/src/presentation/controllers/"
       ],
       "validationCommands": [
-        "npm run lint --workspace src/sdk/cli"
+        "npm test --workspace src/apps/core-api -- --no-coverage"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-05",
-      "closedAt": "2026-06-11",
-      "closureCommit": "cb9474e",
+      "id": "GT-68",
+      "closedAt": "2026-06-13",
+      "closureCommit": "d705167",
       "evidence": [
-        "src/packages/mcp-server/src/main.ts"
+        "src/apps/core-api/src/main.ts"
       ],
       "validationCommands": [
-        "npm run mcp:smoke --workspace src/sdk/cli"
+        "npm test --workspace src/apps/core-api -- --no-coverage"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-06",
-      "closedAt": "2026-06-10",
-      "closureCommit": "acbd2a8",
+      "id": "GT-69",
+      "closedAt": "2026-06-13",
+      "closureCommit": "1f1b023",
       "evidence": [
-        "src/packages/mcp-server/src/tools/gate.tools.ts",
-        ".harness/scripts/mcp-smoke.mjs"
+        "src/apps/core-api/src/presentation/controllers/",
+        "src/apps/core-api/src/infrastructure/filters/",
+        "src/apps/core-api/src/main.ts"
       ],
       "validationCommands": [
-        "npm run mcp:smoke --workspace src/sdk/cli"
+        "npm test --workspace src/apps/core-api -- --no-coverage"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Phase context is required on gate evaluation; retrofitting unrelated legacy tools was explicitly excluded to preserve their public schemas."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-07",
-      "closedAt": "2026-06-11",
-      "closureCommit": "732920c",
+      "id": "GT-70",
+      "closedAt": "2026-06-13",
+      "closureCommit": "cedf3c2",
       "evidence": [
-        ".harness/scripts/mcp-smoke.mjs"
+        "src/apps/core-api/src/main.ts",
+        "src/apps/core-api/src/graceful-shutdown.spec.ts"
       ],
       "validationCommands": [
-        "npm run mcp:smoke --workspace src/sdk/cli"
+        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"graceful\" --no-coverage"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-05 and GT-06 provide the transport and gate tool exercised by the smoke."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-08",
-      "closedAt": "2026-06-11",
-      "closureCommit": "fb9a07b",
+      "id": "GT-71",
+      "closedAt": "2026-06-13",
+      "closureCommit": "ec0a54c",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts"
+        "reference/core/foundations/common-rules/senior-architectural-assessment.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"circuit\" --no-coverage"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "none",
+      "closureNote": "2026-07-24 (GT-560): the circuit breaker delivered here was later found to be a DI-registered orphan protecting nothing (the Core is a stateless evaluator, ADR-0101) and was removed. This closure is SUPERSEDED by GT-560; evidence repointed to the resilience note in senior-architectural-assessment.md, which now documents the removal and the 4/10 rating."
     },
     {
-      "id": "GT-09",
-      "closedAt": "2026-06-11",
-      "closureCommit": "fbdf401",
+      "id": "GT-72",
+      "closedAt": "2026-06-13",
+      "closureCommit": "b2dffde",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts"
+        "src/packages/core-domain/tsconfig.json",
+        "src/packages/core-domain/src/application/"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npx tsc --project src/packages/core-domain/tsconfig.json --noEmit",
+        "npm run build --workspace src/packages/core-domain"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Core-domain application layer (12 files) cleared of @ts-nocheck with strict:true. sdk/cli @ts-nocheck removal (19 files) deferred to a follow-up gap as those files have different architectural ownership."
     },
     {
-      "id": "GT-10",
-      "closedAt": "2026-06-11",
-      "closureCommit": "d2c0a3d",
+      "id": "GT-73",
+      "closedAt": "2026-06-13",
+      "closureCommit": "1ec18af",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts"
+        "src/apps/core-api/src/"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npm run test:cov --workspace src/apps/core-api -- --coverageReporters=text-summary"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-11",
-      "closedAt": "2026-06-11",
-      "closureCommit": "d2c0a3d",
+      "id": "GT-74",
+      "closedAt": "2026-06-13",
+      "closureCommit": "28e177c",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts"
+        "src/apps/core-api/src/infrastructure/config/env.validation.ts",
+        "src/apps/core-api/.env.example",
+        "src/apps/core-api/src/main.ts",
+        "src/apps/core-api/src/app.module.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npm test --workspace src/apps/core-api -- --no-coverage"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-12",
-      "closedAt": "2026-06-11",
-      "closureCommit": "a30f7b0",
+      "id": "GT-75",
+      "closedAt": "2026-06-13",
+      "closureCommit": "9ef03bf",
       "evidence": [
-        "src/sdk/cli/test"
+        "src/packages/infra-providers/",
+        "src/apps/core-api/src/core-domain.module.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "npm run test:e2e --workspace src/sdk/cli"
+        "npm test --workspace src/apps/core-api -- --no-coverage",
+        "npm run build --workspace src/packages/infra-providers"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-13",
-      "closedAt": "2026-06-12",
-      "closureCommit": "1ab485e",
+      "id": "GT-76",
+      "closedAt": "2026-06-13",
+      "closureCommit": "47032b7",
       "evidence": [
-        "src/packages/core-domain/src/application/use-cases/propose-phase-advance.use-case.ts",
-        "src/packages/core-domain/src/application/use-cases/propose-phase-advance.use-case.spec.ts"
+        "src/apps/core-api/src/presentation/controllers/phases.controller.ts",
+        "src/apps/core-api/src/core-domain.module.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"phases\" --no-coverage"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-03 supplies the technical gate evaluation composed by the proposal runner."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-14",
-      "closedAt": "2026-06-11",
-      "closureCommit": "b544411",
+      "id": "GT-77",
+      "closedAt": "2026-06-13",
+      "closureCommit": "685ebd4",
       "evidence": [
-        "src/packages/infra-providers/src/webhook.adapter.ts",
-        "src/sdk/cli/src/infrastructure/adapters/webhook.adapter.spec.ts"
+        "src/apps/core-api/src/core-domain.module.ts",
+        "src/apps/core-api/src/app.module.ts",
+        "src/apps/core-api/src/core-domain.module.spec.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"core-domain.module\" --no-coverage"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-16",
-      "closedAt": "2026-06-10",
-      "closureCommit": "225d3de",
+      "id": "GT-78",
+      "closedAt": "2026-06-13",
+      "closureCommit": "b55a498",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md",
-        "reference/core/control-center/gaps/gap-reference-catalog.md"
+        ".harness/scripts/ci/03-validate-root-cleanliness.mjs"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "node .harness/scripts/ci/03-validate-root-cleanliness.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-17",
-      "closedAt": "2026-06-12",
-      "closureCommit": "000bf3b",
+      "id": "GT-79",
+      "closedAt": "2026-06-15",
+      "closureCommit": "db87af3",
       "evidence": [
-        "src/sdk/cli/.eslintrc.js",
-        "src/sdk/cli/src"
+        ".harness/scripts/adr-lifecycle.mjs",
+        ".harness/scripts/bilingual-terminology-lint.mjs",
+        "reference/core/control-center/gaps/gap-reference-catalog.md",
+        "reference/core/control-center/gaps/gap-reference-catalog.es.md"
       ],
       "validationCommands": [
-        "npm run lint --workspace src/sdk/cli",
-        "npm run build --workspace src/sdk/cli"
+        "node .harness/scripts/adr-lifecycle.mjs --check-only",
+        "node .harness/scripts/bilingual-terminology-lint.mjs"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "The CI pipeline (sdk-cli-ci.yml) lives in the UMS product repository. The two scripts that caused pipeline failures are fixed in this commit; the pipeline will run green once UMS updates its reference."
     },
     {
-      "id": "GT-18",
-      "closedAt": "2026-06-12",
-      "closureCommit": "206867c",
+      "id": "GT-80",
+      "closedAt": "2026-06-15",
+      "closureCommit": "ec17914",
       "evidence": [
-        ".github/workflows/sdk-cli-release.yml",
-        "src/sdk/cli/package.json"
+        "src/sdk/cli/src/infrastructure/observability/index.ts",
+        ".github/workflows/sdk-cli-ci.yml"
       ],
       "validationCommands": [
-        "npm view @beyondnet/evolith-cli"
+        "npx tsc --noEmit -p src/sdk/cli/tsconfig.test.json",
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-28, GT-05, and GT-07 were closed before the public release workflow was accepted."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-19",
-      "closedAt": "2026-06-12",
-      "closureCommit": "3492321",
+      "id": "GT-81",
+      "closedAt": "2026-06-16",
+      "closureCommit": "973013ab210ac2ab6631601caf839ca966706e54",
       "evidence": [
-        "src/packages/core-domain/src/domain",
-        "src/packages/core-domain/src/application",
-        "src/sdk/cli/src/infrastructure",
-        "src/sdk/cli/.eslintrc.js"
+        "src/sdk/cli/jest.config.js"
       ],
       "validationCommands": [
-        "npm run lint --workspace src/sdk/cli",
-        "npm run build --workspace src/sdk/cli"
+        "npm run test:cov",
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-21",
-      "closedAt": "2026-06-12",
-      "closureCommit": "617241d",
+      "id": "GT-82",
+      "closedAt": "2026-06-16",
+      "closureCommit": "e7f4490",
       "evidence": [
-        "reference/core/architecture/adrs/core/0001-monorepo-orchestration-principle.md",
-        "reference/core/architecture/adrs/adr-authoring-standard.md"
+        "src/sdk/cli/src/commands/sdlc/",
+        "src/sdk/cli/test/e2e/sdlc-gate-commands-e2e.test.ts",
+        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "grep -rl 'describe.skip' src/sdk/cli/src || echo 'none'",
+        "npm run build --workspace src/sdk/cli"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-22",
-      "closedAt": "2026-06-12",
-      "closureCommit": "d424bfd",
+      "id": "GT-97",
+      "closedAt": "2026-06-15",
+      "closureCommit": "80bef6f",
       "evidence": [
-        "reference/core/architecture/adrs/adr-authoring-standard.md",
-        "reference/core/architecture/adrs/adr-matrix.md"
+        "src/sdk/cli/src/infrastructure/config/config.service.ts",
+        "src/sdk/cli/src/infrastructure/config/config.service.spec.ts",
+        "src/sdk/cli/src/infrastructure/cli/base-command.ts",
+        "src/sdk/cli/src/commands/profile/profile.command.ts",
+        "src/sdk/cli/src/commands/validate/validate.command.ts",
+        "src/sdk/cli/src/commands/gate/gate.command.ts",
+        "src/sdk/cli/src/commands/upgrade/upgrade.command.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "npm run build --workspace src/sdk/cli",
+        "npx jest src/infrastructure/config/config.service.spec.ts --no-coverage",
+        "npx tsc --noEmit -p tsconfig.test.json"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-23",
-      "closedAt": "2026-06-12",
-      "closureCommit": "c9137a0",
+      "id": "GT-98",
+      "closedAt": "2026-06-16",
+      "closureCommit": "4d71fd3",
       "evidence": [
-        "reference/core/sdlc/governance/BILINGUAL_INDEX.md",
-        "reference/core/sdlc/governance/BILINGUAL_INDEX.es.md"
+        "src/sdk/cli/src/infrastructure/plugins/plugin-loader.ts",
+        "src/sdk/cli/src/infrastructure/plugins/plugin.module.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/bilingual-coverage.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+        "npx jest src/infrastructure/plugins/plugin-loader.spec.ts"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-24",
-      "closedAt": "2026-06-12",
-      "closureCommit": "e7bb4c2",
+      "id": "GT-100",
+      "closedAt": "2026-06-16",
+      "closureCommit": "686bb2fc416897379f7d90300ccc3196c212ac1d",
       "evidence": [
-        "reference/core/control-center/taxonomy/documentation-taxonomy.md",
-        "product/suite/README.md",
-        "product/products/README.md"
+        "src/sdk/cli/src/commands/api/api.command.ts",
+        "src/sdk/cli/src/commands/api/api.command.spec.ts",
+        "src/sdk/cli/test/api.e2e-spec.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "npm run build --workspace src/sdk/cli",
+        "npm run test -- --testPathPattern=api.command.spec"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-25",
-      "closedAt": "2026-06-12",
-      "closureCommit": "40c6846",
+      "id": "GT-101",
+      "closedAt": "2026-06-16",
+      "closureCommit": "686bb2fc416897379f7d90300ccc3196c212ac1d",
       "evidence": [
-        "product/infra/README.md",
-        "product/infra/scm/github-profile.md",
-        "product/infra/ci-cd/github-actions-profile.md",
-        "product/infra/observability/otel-stack-profile.md",
-        "product/infra/security/codeql-trivy-profile.md"
+        "src/sdk/cli/src/commands/update/update.command.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "npm run build --workspace src/sdk/cli"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-26",
-      "closedAt": "2026-06-12",
-      "closureCommit": "c315597",
+      "id": "GT-102",
+      "closedAt": "2026-06-16",
+      "closureCommit": "94308575101b1ecd1bd571026003d9b1b276a7e7",
       "evidence": [
-        "reference/core/sdlc/01-playbooks/zero-downtime-release.md"
+        "src/sdk/cli/src/infrastructure/prompts/progress.service.ts",
+        "src/sdk/cli/src/infrastructure/prompts/progress.service.spec.ts",
+        "src/sdk/cli/test/progress.e2e-spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"progress\"",
+        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=\"progress\""
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-27",
-      "closedAt": "2026-06-11",
-      "closureCommit": "4fb2321",
+      "id": "GT-103",
+      "closedAt": "2026-06-16",
+      "closureCommit": "e7cdf47",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md",
-        "reference/core/control-center/gaps/gap-reference-catalog.md"
+        "src/sdk/cli/src/commands/sdlc/handoff.command.ts",
+        "src/sdk/cli/src/commands/sdlc/generate-domain.command.ts",
+        "src/sdk/cli/src/commands/sdlc/gate-status.command.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npm run build --workspace src/sdk/cli",
+        "npx jest src/app.module.spec.ts"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-28",
-      "closedAt": "2026-06-13",
-      "closureCommit": "84ec879",
+      "id": "GT-104",
+      "closedAt": "2026-06-16",
+      "closureCommit": "b4c2dcc95a6f00de53782546ae51ea975a03fce7",
       "evidence": [
-        ".github/workflows/sdk-cli-ci.yml",
-        ".github/workflows/ci-cd.yml",
         ".github/workflows/sdk-cli-release.yml",
-        "src/sdk/cli/package.json"
+        "src/sdk/cli/README.md",
+        "src/sdk/cli/README.es.md"
       ],
       "validationCommands": [
-        "npm ci",
-        "npm run lint --workspace @beyondnet/evolith-cli",
-        "npm run build --workspace @beyondnet/evolith-cli",
-        "npm run test:unit --workspace @beyondnet/evolith-cli -- --runInBand",
-        "npm run test:e2e --workspace @beyondnet/evolith-cli",
-        "npm run mcp:smoke --workspace @beyondnet/evolith-cli"
+        "npm view @beyondnet/evolith-cli versions",
+        "pnpm info @beyondnet/evolith-cli",
+        "yarn info @beyondnet/evolith-cli"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "GT-28 restores clean-checkout installation and the executable lint, build, test, and MCP smoke baseline. The independently measured coverage regression remains blocking and is tracked as GT-48."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-29",
-      "closedAt": "2026-06-11",
-      "closureCommit": "769651c",
+      "id": "GT-105",
+      "closedAt": "2026-06-16",
+      "closureCommit": "651ef9b",
       "evidence": [
-        "reference/core/architecture/topologies/progressive-axis/modular-monolith/modular-monolith.rego",
-        "src/sdk/cli/src"
+        "src/sdk/cli/Dockerfile",
+        ".github/workflows/ci-cd.yml"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-33",
-      "closedAt": "2026-06-12",
-      "closureCommit": "990af1a",
+      "id": "GT-106",
+      "closedAt": "2026-06-16",
+      "closureCommit": "2c45e89",
       "evidence": [
-        "reference/core/control-center/maturity-reports/maturity-assessment.md"
+        "src/sdk/cli/src/config/alias.service.ts",
+        "src/sdk/cli/src/commands/alias/alias.command.ts",
+        "src/sdk/cli/src/main.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-34",
-      "closedAt": "2026-06-12",
-      "closureCommit": "82f2d0f",
+      "id": "GT-107",
+      "closedAt": "2026-06-16",
+      "closureCommit": "4084db5e61f5f54e691de61c1ba8a169c0291663",
       "evidence": [
-        "product/suite/strategy/evolutionary-strategy-roadmap.md"
+        "src/sdk/cli/src/infrastructure/prompts/wizard.service.ts",
+        "src/sdk/cli/src/infrastructure/prompts/wizard.service.spec.ts",
+        "src/sdk/cli/src/commands/init/init.wizard.ts",
+        "src/sdk/cli/test/wizard.e2e-spec.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"wizard\"",
+        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=\"wizard\""
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-35",
-      "closedAt": "2026-06-12",
-      "closureCommit": "0fe0696",
+      "id": "GT-108",
+      "closedAt": "2026-06-16",
+      "closureCommit": "39086c4",
       "evidence": [
-        ".harness/scripts/ci/08-validate-tracking.mjs",
-        ".harness/scripts/ci/07-generate-inventories.mjs",
-        "reference/core/control-center/maturity-reports/inventory-summary.md"
+        "src/sdk/cli/src/commands/fixtures/fixtures.command.ts",
+        "src/sdk/cli/src/commands/fixtures/fixtures.command.spec.ts",
+        "src/sdk/cli/test/fixtures.e2e-spec.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/08-validate-tracking.mjs",
-        "node .harness/scripts/ci/07-generate-inventories.mjs"
+        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=fixtures",
+        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=fixtures"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-36",
-      "closedAt": "2026-06-12",
-      "closureCommit": "2a831b1",
+      "id": "GT-109",
+      "closedAt": "2026-06-16",
+      "closureCommit": "abb39bb8648d06d95c67cd9f65b6e56c568723be",
       "evidence": [
-        "reference/core/sdlc/governance/adr-0090-rule-language-policy.md"
+        "src/sdk/cli/src/commands/completion/completion.command.ts",
+        "src/sdk/cli/shell/hooks.bash",
+        "src/sdk/cli/shell/hooks.zsh",
+        "src/sdk/cli/shell/hooks.fish",
+        "src/sdk/cli/src/commands/completion/completion.command.spec.ts",
+        "src/sdk/cli/test/completion.e2e-spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+        "npm run build --workspace src/sdk/cli",
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-37",
-      "closedAt": "2026-06-13",
-      "closureCommit": "f3c8520",
+      "id": "GT-110",
+      "closedAt": "2026-06-15",
+      "closureCommit": "d050b9e",
       "evidence": [
-        ".harness/scripts/ci/08-validate-tracking.mjs",
-        ".harness/scripts/validate-tracking.test.mjs",
-        "reference/core/control-center/evidence/gap-closure-evidence-standard.md",
-        "reference/core/control-center/evidence/gap-closure-evidence.json"
+        "product/infra/docker-compose.yml",
+        "product/infra/helm/evolith-core-api/templates/ingressroute.yaml"
       ],
       "validationCommands": [
-        "node --test .harness/scripts/validate-tracking.test.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs",
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "Traefik replaces Kong in infrastructure configuration."
     },
     {
-      "id": "GT-41",
-      "closedAt": "2026-06-13",
-      "closureCommit": "e4fa0e3",
+      "id": "GT-111",
+      "closedAt": "2026-06-15",
+      "closureCommit": "189b03d",
       "evidence": [
-        ".github/workflows/docs.yml",
-        ".harness/scripts/ci/09-reconcile-maturity.mjs",
-        ".harness/scripts/reconcile-maturity.test.mjs",
-        "reference/core/control-center/maturity-reports/maturity-evidence.json",
-        "reference/core/control-center/maturity-reports/maturity-reconciliation.json"
+        "reference/core/architecture/adrs/core/0077-masstransit-v9-commercial-pivot.md",
+        "reference/core/architecture/adrs/core/0077-masstransit-v9-commercial-pivot.es.md"
       ],
       "validationCommands": [
-        "node --test .harness/scripts/reconcile-maturity.test.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs",
-        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check",
         "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "satisfied",
-      "dependencyRationale": "Documentation Validation run 27470122212 passed with full Git history and validated the runtime evidence-backed reconciliation."
+      "dependencyRationale": "The ADR records a dated decision with a re-evaluation gate, satisfying the closure criterion."
     },
     {
-      "id": "GT-42",
-      "closedAt": "2026-06-13",
-      "closureCommit": "154aadf",
+      "id": "GT-112",
+      "closedAt": "2026-06-15",
+      "closureCommit": "faa012f",
       "evidence": [
-        ".harness/scripts/ci/10-validate-contract-conformance.mjs",
-        ".harness/scripts/validate-contract-conformance.test.mjs",
-        "src/rulesets/contracts/evolith-machine-contracts.json",
-        "src/rulesets/contracts/README.md",
-        ".github/workflows/docs.yml"
+        "product/infra/docker-compose.yml",
+        "product/infra/README.md",
+        "product/infra/validated-tool-catalog.md",
+        "reference/core/foundations/common-rules/detailed-stack-audit-2026.md",
+        "reference/core/architecture/blueprints/authoritative-tech-stack-agnostic.md",
+        "reference/core/architecture/blueprints/tech-stack-summary.md",
+        "reference/core/architecture/blueprints/reference-blueprint.md",
+        "reference/core/architecture/blueprints/multi-cloud-deployment-scenarios.md",
+        "reference/core/architecture/adrs/core/0028-self-hosted-hybrid-infrastructure-on-premise.md",
+        "reference/core/architecture/adrs/core/0039-deployment-topology-abstraction-switcher.md",
+        "reference/core/foundations/common-rules/communication/visuals/v08-infrastructure-topology.md",
+        "reference/core/foundations/common-rules/senior-architectural-assessment.md",
+        "product/suite/strategy/evolutionary-strategy-roadmap.md",
+        "src/sdk/cli/src/config/tool-catalog.json",
+        "src/sdk/cli/src/config/cli-commands-matrix.json",
+        "src/sdk/cli/src/infrastructure/catalog/catalog-loader.ts",
+        "src/sdk/cli/src/infrastructure/cli/command-executor.ts",
+        "src/packages/core-domain/src/domain/services/index.ts"
       ],
       "validationCommands": [
-        "node --test .harness/scripts/validate-contract-conformance.test.mjs",
-        "node .harness/scripts/ci/10-validate-contract-conformance.mjs",
-        "node .harness/scripts/ci/10-validate-contract-conformance.mjs --consumer ../evolith_tracker/contracts/evolith-core-contracts.json"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "satisfied",
-      "dependencyRationale": "Evolith Tracker main commit 4256e7b pins contract 1.0.0 and executes the Core conformance validator in CI."
+      "dependencyRationale": "OpenBao is API-compatible with Vault; all existing secrets workflows remain unchanged."
     },
     {
-      "id": "GT-45",
-      "closedAt": "2026-06-13",
-      "closureCommit": "b07460d",
+      "id": "GT-113",
+      "closedAt": "2026-06-15",
+      "closureCommit": "4dd76b5",
       "evidence": [
-        "src/packages/mcp-server/src/main.ts",
-        "src/packages/mcp-server/src/mcp/tool-registry.service.ts",
-        "src/packages/mcp-server/src/tools/gate.tools.spec.ts",
-        "src/packages/mcp-server/src/tools/architecture.tools.spec.ts",
-        "src/packages/mcp-server/src/tools/sdlc.tools.spec.ts",
-        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
+        "src/packages/core-domain/package.json",
+        "src/packages/core-domain/src/application/sync/sync.service.ts",
+        "src/packages/core-domain/src/domain/services/default-workflow-definition.ts",
+        "src/sdk/cli/jest.config.js",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "npm run lint --workspace src/sdk/cli",
-        "npm run test:unit --workspace src/sdk/cli -- --runInBand",
-        "npm run test:e2e --workspace src/sdk/cli -- --runTestsByPath test/e2e/mcp-e2e.test.ts",
-        "npm run mcp:smoke --workspace src/sdk/cli"
+        "npm run build --workspace src/packages/core-domain",
+        "npm run build --workspace src/sdk/cli",
+        "npx jest"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-46",
-      "closedAt": "2026-06-13",
-      "closureCommit": "b07460d",
+      "id": "GT-114",
+      "closedAt": "2026-06-16",
+      "closureCommit": "e3792aa01c5a71d7864703b0430ecf3ccaa0a09a",
       "evidence": [
-        "src/sdk/cli/src/app.module.ts",
-        "src/packages/mcp-server/src/main.ts",
-        "reference/core/control-center/gaps/gap-reference-catalog.md"
+        "src/packages/mcp-server/src/tools/auto-fix.tools.ts",
+        "src/packages/mcp-server/src/tools/tools.module.ts",
+        "src/sdk/cli/test/e2e/cli-e2e.test.ts",
+        "src/sdk/cli/src/commands/agents/agents.command.ts",
+        "src/packages/mcp-server/src/main.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "npm run lint --workspace src/sdk/cli",
-        "npm run mcp:smoke --workspace src/sdk/cli",
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"confirmation\"",
+        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=\"mcp-confirmation\""
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Tracker-owned chat and session behavior was removed; Core exposes governed capabilities through CLI and MCP only."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-52",
-      "closedAt": "2026-06-14",
-      "closureCommit": "0601eaf9b933d6ff0b43782cac2f62b94ed623d3",
+      "id": "GT-115",
+      "closedAt": "2026-06-16",
+      "closureCommit": "ea2a3934cfcbebaf3b05e15538e4b5ac721b1b53",
       "evidence": [
-        "src/sdk/cli/src/app.module.spec.ts",
-        "src/sdk/cli/src/commands/adr/adr.command.spec.ts",
-        "src/sdk/cli/src/commands/standards/standards.command.spec.ts"
+        "src/packages/mcp-server/src/tools/auto-fix.tools.ts",
+        "src/packages/mcp-server/src/tools/auto-fix.tools.spec.ts",
+        "src/packages/mcp-server/src/tools/tools.module.ts",
+        "src/sdk/cli/examples/mcp-test.js"
       ],
       "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"auto-fix\"",
+        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=\"auto-fix\""
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "Completes the service-locator removal (GT-04) and DI consolidation (GT-17) by deleting the leftover no-op stubs."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-53",
-      "closedAt": "2026-06-14",
-      "closureCommit": "0da71feda4238fe247a0033145e7e4a1008bad29",
+      "id": "GT-116",
+      "closedAt": "2026-06-16",
+      "closureCommit": "3b41cfe11b84d7d6c9dc04cd5febf698171ad5c5",
       "evidence": [
-        "reference/core/control-center/maturity-reports/maturity-assessment.md",
-        "product/suite/vision/README.md",
-        "src/rulesets/acl/README.md",
-        "README.md"
+        "src/sdk/cli/src/commands/validate/validate.command.ts",
+        "src/packages/core-domain/src/domain/interfaces.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+        "npm run build --workspace src/sdk/cli",
+        "npm run test --workspace src/sdk/cli"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-51",
-      "closedAt": "2026-06-14",
-      "closureCommit": "54386a3485c987f6b9a09d48d369d8efc837312a",
+      "id": "GT-117",
+      "closedAt": "2026-06-19",
+      "closureCommit": "1067a41",
       "evidence": [
-        "src/rulesets/schema/build-vs-compose.schema.json",
-        "src/rulesets/sdlc/phase-gates.rules.json",
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
-        "src/packages/core-domain/src/application/validators/build-vs-compose.schema.spec.ts"
+        "src/apps/core-api/src/application/services/core-reference-query.service.ts",
+        "src/apps/core-api/src/presentation/controllers/reference.controller.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand --testPathPattern build-vs-compose",
-        "npm run test:e2e --workspace src/sdk/cli -- --runTestsByPath test/gate.e2e-spec.ts"
+        "npm --workspace src/apps/core-api test -- --runInBand"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "Builds on the ADR-0073 GateEvidence contract (GT-02/GT-03) and the deepened phase-gate content checks (GT-08…GT-11)."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-50",
-      "closedAt": "2026-06-14",
-      "closureCommit": "040ea7f6b4354a87a44c702dd8e4cd37997e5b43",
+      "id": "GT-118",
+      "closedAt": "2026-06-20",
+      "closureCommit": "1ee04e6",
       "evidence": [
-        "src/sdk/cli/jest.config.js",
-        ".github/workflows/sdk-cli-ci.yml"
+        "reference/core/architecture/adrs/core/0080-remote-repository-reference-contract.md",
+        "src/apps/core-api/src/application/services/workspace-reference-resolver.service.ts",
+        "src/apps/core-api/src/application/services/workspace-reference-resolver.service.spec.ts"
       ],
       "validationCommands": [
-        "npm run test:cov --workspace @beyondnet/evolith-cli -- --coverageReporters=text-summary"
+        "npm --workspace core-api test",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-48 restored statement coverage to 80.65%; this threshold pins the recovered floor so regressions fail locally."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-47",
-      "closedAt": "2026-06-14",
-      "closureCommit": "38dfc985fa4f4a09e561678032b0412098f2273b",
+      "id": "GT-119",
+      "closedAt": "2026-06-19",
+      "closureCommit": "e93c68a",
       "evidence": [
-        ".harness/scripts/generate-product-inventory.mjs",
-        ".harness/scripts/ci/11-validate-product-docs.mjs",
-        "product/products/smart-cli/product-inventory.md",
-        "product/products/smart-cli/README.md",
-        "product/products/mcp-services/README.md",
-        ".github/workflows/docs.yml"
+        "reference/core/architecture/adrs/core/0074-evolith-core-api-exposure-layer.md",
+        "product/suite/vision/evolith-product-vision-master.md",
+        "src/packages/mcp-server/README.md",
+        "src/apps/core-api/src/core-domain.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/generate-product-inventory.mjs --check",
-        "node .harness/scripts/ci/11-validate-product-docs.mjs",
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-49",
-      "closedAt": "2026-06-13",
-      "closureCommit": "398729dff32735cac56069bb7c84a9fa44a2bff6",
+      "id": "GT-120",
+      "closedAt": "2026-06-19",
+      "closureCommit": "cb05ffa",
       "evidence": [
-        "src/sdk/cli/tsconfig.json",
-        "src/sdk/cli/.eslintrc.js",
-        "src/sdk/cli/src/commands/adr/adr.command.ts",
-        "src/sdk/cli/src/commands/standards/standards.command.ts",
-        "src/packages/core-domain/src/application/services/index.ts",
-        "src/packages/core-domain/src/domain/interfaces.ts"
+        "reference/core/architecture/adrs/core/0074-evolith-core-api-exposure-layer.md",
+        "product/suite/vision/evolith-product-vision-master.md",
+        "src/apps/core-api/README.md"
       ],
       "validationCommands": [
-        "npx tsc --noEmit --project src/sdk/cli/tsconfig.json",
-        "npm run build --workspace src/sdk/cli",
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs",
+        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-48",
-      "closedAt": "2026-06-13",
-      "closureCommit": "48e1d909992f29cd2cd49993101eb36ec730ae3a",
+      "id": "GT-121",
+      "closedAt": "2026-06-19",
+      "closureCommit": "c4835e0db3006d7cc6cb88205537a8086e302066",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/adapters/moscow-prioritization.service.spec.ts",
-        "src/packages/core-domain/src/application/validators/architecture-drift.service.spec.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.spec.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/governance-rule.handler.spec.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.spec.ts",
-        "src/sdk/cli/src/infrastructure/providers/node-filesystem.provider.spec.ts",
-        "src/sdk/cli/src/infrastructure/adapters/disk-ruleset.repository.spec.ts"
+        "src/sdk/cli/src/commands/agents/agents.command.ts",
+        "src/sdk/cli/test/e2e/cli-e2e.test.ts",
+        "src/sdk/cli/src/infrastructure/providers/node-filesystem.provider.ts",
+        "src/packages/mcp-server/src/main.ts"
       ],
       "validationCommands": [
-        "npm run test:cov --workspace @beyondnet/evolith-cli -- --coverageReporters=json-summary",
-        "node -e \"process.exit(require('./sdk/cli/coverage/coverage-summary.json').total.statements.pct >= 80 ? 0 : 1)\""
+        "npm run build --workspace src/sdk/cli",
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-04 removed the service locator; the revived suites now inject collaborators through the constructor."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-44",
-      "closedAt": "2026-06-13",
-      "closureCommit": "26f6a1809b6258880173a934357d53beb37fcb7b",
-      "evidence": [
-        ".github/workflows/sdk-cli-release.yml",
-        ".github/workflows/sdk-cli-ci.yml",
-        ".harness/scripts/verify-git-tag.mjs",
-        ".harness/scripts/verify-version-log.mjs",
-        "reference/core/control-center/gaps/gap-reference-catalog.md"
+      "id": "GT-122",
+      "closedAt": "2026-06-19",
+      "closureCommit": "71263df",
+      "evidence": [
+        "src/packages/infra-providers/src/index.ts",
+        "src/packages/infra-providers/src/disk-ruleset.repository.ts",
+        "src/packages/infra-providers/src/webhook.adapter.ts",
+        "src/packages/infra-providers/src/moscow-prioritization.service.ts",
+        "src/apps/core-api/src/core-domain.module.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "GITHUB_REF_NAME=main GITHUB_EVENT_NAME=push node .harness/scripts/verify-git-tag.mjs",
-        "GITHUB_REF_NAME=main GITHUB_EVENT_NAME=push node .harness/scripts/verify-version-log.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs",
-        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check"
+        "npm run build --workspace src/packages/infra-providers",
+        "npm run build --workspace src/apps/core-api",
+        "npm run build --workspace src/sdk/cli",
+        "npm test --workspace src/apps/core-api -- --runInBand",
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-54",
-      "closedAt": "2026-06-13",
-      "closureCommit": "5c576867419b18096f39f58391e92cd69727e451",
+      "id": "GT-123",
+      "closedAt": "2026-06-18",
+      "closureCommit": "31f8f079313c58b6b5d551d770ab7dea7653057b",
       "evidence": [
-        "src/sdk/cli/.eslintrc.js",
-        "src/packages/core-domain/src/application/services/project-scaffolder.service.ts",
-        "src/packages/core-domain/src/application/use-cases/initialize-project.use-case.ts",
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts"
+        "src/sdk/cli/src/commands/init/init.wizard.ts",
+        "src/sdk/cli/src/infrastructure/prompts/progress.service.ts",
+        "src/sdk/cli/src/infrastructure/prompts/progress.service.spec.ts",
+        "src/sdk/cli/src/commands/alias/alias.command.ts",
+        "src/sdk/cli/src/app.module.ts"
       ],
       "validationCommands": [
-        "npm run lint --workspace src/sdk/cli",
-        "npm test --workspace src/sdk/cli -- --runInBand",
-        "npm run test:e2e --workspace src/sdk/cli"
+        "npx tsc -p src/sdk/cli/tsconfig.json --noEmit",
+        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"progress|alias\""
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-19 deferred this gap; it is now closed by removing the direct instantiations."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-58",
-      "closedAt": "2026-06-13",
-      "closureCommit": "b9b638c7b72a223432170922727923946c22b7a3",
+      "id": "GT-124",
+      "closedAt": "2026-06-19",
+      "closureCommit": "e93c68a",
       "evidence": [
-        "src/packages/core-domain/src/application/generators/hexagonal-scaffolder.ts"
+        "src/sdk/cli/src/commands/completion/completion.command.ts",
+        "src/sdk/cli/src/commands/sdlc/handoff.command.ts",
+        "src/packages/mcp-server/src/mcp/prompts.service.ts",
+        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
       ],
       "validationCommands": [
-        "npm run lint --workspace src/sdk/cli",
-        "npm test --workspace src/sdk/cli"
+        "npm run build --workspace src/packages/mcp-server",
+        "npm test --workspace src/packages/mcp-server -- --runInBand",
+        "npm run build --workspace src/sdk/cli",
+        "npm test --workspace src/sdk/cli -- --runInBand",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "No dependencies. Technical debt placeholders replaced with valid implementation patterns."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-57",
-      "closedAt": "2026-06-13",
-      "closureCommit": "c73c209228dc18beeb296837eda5b1e70df4667d",
+      "id": "GT-125",
+      "closedAt": "2026-06-20",
+      "closureCommit": "0fc716a48dc24ea2bec348a42b3780661de5a0b4",
       "evidence": [
-        "src/packages/mcp-server/src/mcp/resources.service.ts",
-        "src/packages/mcp-server/src/mcp/prompts.service.ts",
-        "src/packages/mcp-server/src/tools/architecture.tools.ts",
-        "src/packages/mcp-server/src/tools/sdlc.tools.ts",
-        "product/products/smart-cli/docs/planning/sdk-cli-mcp-implementation-roadmap.md"
+        "reference/core/architecture/topologies/topology-corpus-standard.md",
+        "src/rulesets/topologies/agentic-ai/topology.manifest.json",
+        "src/rulesets/topologies/agentic-ai/adoption.md",
+        "src/rulesets/topologies/agentic-ai/operations.md",
+        "src/rulesets/topologies/agentic-ai/security.md",
+        "src/rulesets/topologies/agentic-ai/agent.config.schema.json",
+        ".harness/scripts/validate-topology-manifests.mjs"
       ],
       "validationCommands": [
-        "npm run lint --workspace src/sdk/cli",
-        "npm test --workspace src/sdk/cli"
+        "node .harness/scripts/validate-topology-manifests.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs --render-mermaid",
+        "npm run build --workspace @beyondnet/evolith-core-domain",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "All MCP roadmap TODO items have been implemented and F1/F2/F3 architecture validation now correctly delegates to the OPA RulesetValidatorService."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-56",
-      "closedAt": "2026-06-14",
-      "closureCommit": "da470d460c8fc99e4322b1ec5f5980006b3b7968",
+      "id": "GT-126",
+      "closedAt": "2026-06-20",
+      "closureCommit": "8566249bbefe547f87116d90ecb8c8a797e5cc2b",
       "evidence": [
-        "src/sdk/cli/test/agents.e2e-spec.ts",
-        "src/sdk/cli/test/mock-prompt.service.ts",
-        "src/sdk/cli/src/commands/init/init.command.ts",
-        "src/sdk/cli/src/commands/agents/agents.command.ts",
-        "src/sdk/cli/src/commands/adr/adr.command.ts"
+        "src/rulesets/topologies/serverless/serverless.rules.json",
+        "src/rulesets/topologies/serverless/serverless.rego",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
+        "src/rulesets/topologies/serverless/README.md"
       ],
       "validationCommands": [
-        "npm run test:e2e --workspace src/sdk/cli"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "All interactive prompts are safely mocked."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-55",
-      "closedAt": "2026-06-14",
-      "closureCommit": "6772c5b",
+      "id": "GT-127",
+      "closedAt": "2026-06-20",
+      "closureCommit": "8566249bbefe547f87116d90ecb8c8a797e5cc2b",
       "evidence": [
-        "src/sdk/cli/.eslintrc.js",
-        "src/packages/core-domain/src/domain/interfaces.ts",
-        "src/sdk/cli/src/infrastructure/cli/base-command.ts",
-        "src/sdk/cli/src/infrastructure/prompts/prompt.service.ts"
+        "src/rulesets/topologies/event-driven/event-driven.rules.json",
+        "src/rulesets/topologies/event-driven/event-driven.rego",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
+        "src/rulesets/topologies/event-driven/README.md"
       ],
       "validationCommands": [
-        "npm run lint --workspace src/sdk/cli",
-        "npm run test:unit --workspace src/sdk/cli",
-        "npm run test:e2e --workspace src/sdk/cli"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-78",
-      "closedAt": "2026-06-13",
-      "closureCommit": "b55a498",
+      "id": "GT-128",
+      "closedAt": "2026-06-20",
+      "closureCommit": "e72d8c1de0fa10ee0abc853c5c04be36f032830f",
       "evidence": [
-        ".harness/scripts/ci/03-validate-root-cleanliness.mjs"
+        "reference/core/architecture/adrs/core/0084-data-mesh-data-products.md",
+        "src/rulesets/topologies/data-mesh/data-mesh.rules.json",
+        "src/rulesets/topologies/data-mesh/data-mesh.rego",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/03-validate-root-cleanliness.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-77",
-      "closedAt": "2026-06-13",
-      "closureCommit": "685ebd4",
+      "id": "GT-129",
+      "closedAt": "2026-06-20",
+      "closureCommit": "fcf22ee27a160d1e5b34acab7210186531495a3d",
       "evidence": [
-        "src/apps/core-api/src/core-domain.module.ts",
-        "src/apps/core-api/src/app.module.ts",
-        "src/apps/core-api/src/core-domain.module.spec.ts"
+        "src/rulesets/topologies/edge-computing/edge-computing.rules.json",
+        "src/rulesets/topologies/edge-computing/edge-computing.rego",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"core-domain.module\" --no-coverage"
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-72",
-      "closedAt": "2026-06-13",
-      "closureCommit": "b2dffde",
+      "id": "GT-130",
+      "closedAt": "2026-06-20",
+      "closureCommit": "5d4dc982",
       "evidence": [
-        "src/packages/core-domain/tsconfig.json",
-        "src/packages/core-domain/src/application/"
+        ".harness/scripts/ci/12-validate-bmad-signatures.mjs"
       ],
       "validationCommands": [
-        "npx tsc --project src/packages/core-domain/tsconfig.json --noEmit",
-        "npm run build --workspace src/packages/core-domain"
+        "node .harness/scripts/ci-runner.mjs"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Core-domain application layer (12 files) cleared of @ts-nocheck with strict:true. sdk/cli @ts-nocheck removal (19 files) deferred to a follow-up gap as those files have different architectural ownership."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-59",
-      "closedAt": "2026-06-13",
-      "closureCommit": "b32a985",
+      "id": "GT-131",
+      "closedAt": "2026-06-20",
+      "closureCommit": "5d4dc982",
       "evidence": [
-        "src/apps/core-api/src/main.ts",
-        "src/apps/core-api/src/app.module.ts",
-        "src/apps/core-api/src/presentation/controllers/security-headers.spec.ts"
+        "src/packages/agent-runtime/src/domain/ports/skill-registry.port.ts",
+        "src/packages/agent-runtime/src/adapters/skills/local-skill-registry.adapter.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"security-headers\" --no-coverage"
+        "node apps/agent-sandbox/index.js"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-64",
-      "closedAt": "2026-06-13",
-      "closureCommit": "db9ab18",
+      "id": "GT-132",
+      "closedAt": "2026-06-20",
+      "closureCommit": "0b6eb03a",
       "evidence": [
-        "src/apps/core-api/src/app.module.ts",
-        "src/apps/core-api/src/main.ts",
-        "src/apps/core-api/src/infrastructure/middleware/correlation-id.middleware.ts",
-        "src/apps/core-api/src/presentation/controllers/security-headers.spec.ts"
+        ".harness/scripts/ci/agentic/13-agentic-code-review.mjs"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"security-headers\" --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-60",
-      "closedAt": "2026-06-13",
-      "closureCommit": "19b0738",
+      "id": "GT-133",
+      "closedAt": "2026-06-20",
+      "closureCommit": "dcdad405",
       "evidence": [
-        "src/apps/core-api/src/main.ts",
-        "src/apps/core-api/src/presentation/dtos/",
-        "src/apps/core-api/src/presentation/controllers/"
+        "reference/core/architecture/adrs/core/0085-agnostic-opa-wasm-distribution.md",
+        "reference/core/architecture/adrs/core/0085-agnostic-opa-wasm-distribution.es.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"security-headers\" --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-73",
-      "closedAt": "2026-06-13",
-      "closureCommit": "1ec18af",
+      "id": "GT-134",
+      "closedAt": "2026-06-20",
+      "closureCommit": "f84c3ac4",
       "evidence": [
-        "src/apps/core-api/src/"
+        "src/packages/mcp-server/package.json",
+        "src/packages/mcp-server/src/tools/tools.module.ts",
+        ".harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "validationCommands": [
-        "npm run test:cov --workspace src/apps/core-api -- --coverageReporters=text-summary"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-62",
-      "closedAt": "2026-06-13",
-      "closureCommit": "ee57f82",
+      "id": "GT-135",
+      "closedAt": "2026-06-20",
+      "closureCommit": "d1811b9b",
       "evidence": [
-        "reference/core/architecture/adrs/core/0075-core-api-auth-strategy.md",
-        "src/apps/core-api/src/presentation/controllers/health.controller.ts"
+        "reference/core/architecture/adrs/core/0086-agentic-ai-telemetry-cost-control.md",
+        "reference/core/architecture/adrs/core/0086-agentic-ai-telemetry-cost-control.es.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "API Key auth implemented for M2M. JWT Bearer tokens deferred to future iteration per ADR-0075."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-74",
-      "closedAt": "2026-06-13",
-      "closureCommit": "28e177c",
+      "id": "GT-136",
+      "closedAt": "2026-06-20",
+      "closureCommit": "92e80b5c",
       "evidence": [
-        "src/apps/core-api/src/infrastructure/config/env.validation.ts",
-        "src/apps/core-api/.env.example",
-        "src/apps/core-api/src/main.ts",
-        "src/apps/core-api/src/app.module.ts"
+        "reference/core/architecture/adrs/core/0087-abac-agentic-tool-execution.md",
+        "reference/core/architecture/adrs/core/0087-abac-agentic-tool-execution.es.md",
+        "src/rulesets/opa/abac-mcp-tool-access.rego"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-70",
-      "closedAt": "2026-06-13",
-      "closureCommit": "cedf3c2",
+      "id": "GT-137",
+      "closedAt": "2026-06-20",
+      "closureCommit": "1d78117d",
       "evidence": [
-        "src/apps/core-api/src/main.ts",
-        "src/apps/core-api/src/graceful-shutdown.spec.ts"
+        "reference/core/architecture/adrs/core/0088-sovereign-identity-agentic-ai.md",
+        "reference/core/architecture/adrs/core/0088-sovereign-identity-agentic-ai.es.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"graceful\" --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-69",
-      "closedAt": "2026-06-13",
-      "closureCommit": "1f1b023",
+      "id": "GT-138",
+      "closedAt": "2026-06-20",
+      "closureCommit": "155ee197",
       "evidence": [
-        "src/apps/core-api/src/presentation/controllers/",
-        "src/apps/core-api/src/infrastructure/filters/",
-        "src/apps/core-api/src/main.ts"
+        "reference/core/architecture/adrs/core/0089-event-driven-agentic-workflows.md",
+        "reference/core/architecture/adrs/core/0089-event-driven-agentic-workflows.es.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-63",
-      "closedAt": "2026-06-13",
-      "closureCommit": "9aa78c6",
+      "id": "GT-139",
+      "closedAt": "2026-06-20",
+      "closureCommit": "69976156",
       "evidence": [
-        "src/apps/core-api/src/infrastructure/interceptors/security-audit.interceptor.ts",
-        "src/apps/core-api/src/infrastructure/guards/audit-throttler.guard.ts"
+        "reference/core/architecture/adrs/core/0090-rag-knowledge-governance.md",
+        "reference/core/architecture/adrs/core/0090-rag-knowledge-governance.es.md",
+        ".harness/scripts/ci/14-rag-index-sync.mjs"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-61",
-      "closedAt": "2026-06-13",
-      "closureCommit": "72599da",
+      "id": "GT-140",
+      "closedAt": "2026-06-20",
+      "closureCommit": "25731436",
       "evidence": [
-        "src/apps/core-api/src/infrastructure/filters/http-exception.filter.ts"
+        "reference/core/architecture/adrs/core/0091-workload-identity-token-rotation.md",
+        "reference/core/architecture/adrs/core/0091-workload-identity-token-rotation.es.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"e2e\" --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-76",
-      "closedAt": "2026-06-13",
-      "closureCommit": "47032b7",
+      "id": "GT-141",
+      "closedAt": "2026-06-20",
+      "closureCommit": "3310dc11",
       "evidence": [
-        "src/apps/core-api/src/presentation/controllers/phases.controller.ts",
-        "src/apps/core-api/src/core-domain.module.ts"
+        "reference/core/architecture/adrs/core/0093-mcp-concurrency-locking.md",
+        "reference/core/architecture/adrs/core/0093-mcp-concurrency-locking.es.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"phases\" --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-67",
-      "closedAt": "2026-06-13",
-      "closureCommit": "b006a16",
+      "id": "GT-142",
+      "closedAt": "2026-06-20",
+      "closureCommit": "929ac878",
       "evidence": [
-        "src/apps/core-api/src/main.ts",
-        "src/apps/core-api/src/presentation/dtos/",
-        "src/apps/core-api/src/presentation/controllers/"
+        ".harness/scripts/ci/agentic/13-agentic-code-review.mjs"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-65",
-      "closedAt": "2026-06-13",
-      "closureCommit": "3418a1d",
+      "id": "GT-143",
+      "closedAt": "2026-06-20",
+      "closureCommit": "8c238ec7",
       "evidence": [
-        "src/apps/core-api/src/infrastructure/metrics/",
-        "src/apps/core-api/src/presentation/controllers/health.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/metrics.controller.ts"
+        "reference/core/architecture/adrs/core/0094-multi-agent-handoff.md",
+        "reference/core/architecture/adrs/core/0094-multi-agent-handoff.es.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-68",
-      "closedAt": "2026-06-13",
-      "closureCommit": "d705167",
+      "id": "GT-144",
+      "closedAt": "2026-06-20",
+      "closureCommit": "10fa4962",
       "evidence": [
-        "src/apps/core-api/src/main.ts"
+        "reference/core/architecture/adrs/core/0092-agent-infinite-loop-prevention.md",
+        "reference/core/architecture/adrs/core/0092-agent-infinite-loop-prevention.es.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --no-coverage"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-71",
-      "closedAt": "2026-06-13",
-      "closureCommit": "ec0a54c",
+      "id": "GT-145",
+      "closedAt": "2026-06-20",
+      "closureCommit": "d41bc3a3427cb897d72523a57283c75a27c2815b",
       "evidence": [
-        "reference/core/foundations/common-rules/senior-architectural-assessment.md"
+        ".harness/scripts/ci/rag-port.mjs",
+        ".harness/scripts/ci/rag-sync.mjs",
+        ".harness/scripts/ci/14-rag-index-sync.mjs",
+        "product/operations/agentic-ci-rag-support.md",
+        "product/operations/agentic-ci-rag-support.es.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --testPathPatterns=\"circuit\" --no-coverage"
+        "node --test .harness/scripts/ci/rag-sync.test.mjs"
       ],
-      "dependencyDisposition": "none",
-      "closureNote": "2026-07-24 (GT-560): the circuit breaker delivered here was later found to be a DI-registered orphan protecting nothing (the Core is a stateless evaluator, ADR-0101) and was removed. This closure is SUPERSEDED by GT-560; evidence repointed to the resilience note in senior-architectural-assessment.md, which now documents the removal and the 4/10 rating."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-75",
-      "closedAt": "2026-06-13",
-      "closureCommit": "9ef03bf",
+      "id": "GT-146",
+      "closedAt": "2026-06-20",
+      "closureCommit": "3efbb5900405322751edd139e4cf87095ddf82b3",
       "evidence": [
-        "src/packages/infra-providers/",
-        "src/apps/core-api/src/core-domain.module.ts",
-        "src/sdk/cli/src/app.module.ts"
+        ".harness/scripts/ci/agentic/review-input.mjs",
+        ".harness/scripts/ci/agentic/review-result.mjs",
+        ".harness/scripts/ci/agentic/review-provider.mjs",
+        ".harness/scripts/ci/agentic/13-agentic-code-review.mjs",
+        ".github/workflows/sdk-cli-ci.yml"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --no-coverage",
-        "npm run build --workspace src/packages/infra-providers"
+        "node --test .harness/scripts/ci/agentic/review-input.test.mjs .harness/scripts/ci/agentic/review-result.test.mjs .harness/scripts/ci/agentic/review-provider.test.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-66",
-      "closedAt": "2026-06-13",
-      "closureCommit": "535959b",
+      "id": "GT-147",
+      "closedAt": "2026-06-20",
+      "closureCommit": "861505eef043406dcad4d15a030017bb52d2b641",
       "evidence": [
-        "src/apps/core-api/src/tracing.ts",
-        "src/apps/core-api/src/main.ts"
+        ".harness/scripts/ci/drift-audit.mjs",
+        ".harness/scripts/ci/25-operational-drift-audit.mjs",
+        ".harness/scripts/ci/drift-audit.test.mjs"
       ],
       "validationCommands": [
-        "npm test --workspace src/apps/core-api -- --no-coverage"
+        "node --test .harness/scripts/ci/drift-audit.test.mjs",
+        "node .harness/scripts/ci/25-operational-drift-audit.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-112",
-      "closedAt": "2026-06-15",
-      "closureCommit": "faa012f",
+      "id": "GT-148",
+      "closedAt": "2026-06-20",
+      "closureCommit": "ec968d190388dc5e22086f870741ea68f59d8dcb",
       "evidence": [
-        "product/infra/docker-compose.yml",
-        "product/infra/README.md",
-        "product/infra/validated-tool-catalog.md",
-        "reference/core/foundations/common-rules/detailed-stack-audit-2026.md",
-        "reference/core/architecture/blueprints/authoritative-tech-stack-agnostic.md",
-        "reference/core/architecture/blueprints/tech-stack-summary.md",
-        "reference/core/architecture/blueprints/reference-blueprint.md",
-        "reference/core/architecture/blueprints/multi-cloud-deployment-scenarios.md",
-        "reference/core/architecture/adrs/core/0028-self-hosted-hybrid-infrastructure-on-premise.md",
-        "reference/core/architecture/adrs/core/0039-deployment-topology-abstraction-switcher.md",
-        "reference/core/foundations/common-rules/communication/visuals/v08-infrastructure-topology.md",
-        "reference/core/foundations/common-rules/senior-architectural-assessment.md",
-        "product/suite/strategy/evolutionary-strategy-roadmap.md",
-        "src/sdk/cli/src/config/tool-catalog.json",
-        "src/sdk/cli/src/config/cli-commands-matrix.json",
-        "src/sdk/cli/src/infrastructure/catalog/catalog-loader.ts",
-        "src/sdk/cli/src/infrastructure/cli/command-executor.ts",
-        "src/packages/core-domain/src/domain/services/index.ts"
+        "src/rulesets/governance/satellite-contracts.rules.json"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "node .harness/scripts/ci-runner.mjs"
       ],
       "dependencyDisposition": "satisfied",
-      "dependencyRationale": "OpenBao is API-compatible with Vault; all existing secrets workflows remain unchanged."
-    },
-    {
-      "id": "GT-79",
-      "closedAt": "2026-06-15",
-      "closureCommit": "db87af3",
-      "evidence": [
-        ".harness/scripts/adr-lifecycle.mjs",
-        ".harness/scripts/bilingual-terminology-lint.mjs",
-        "reference/core/control-center/gaps/gap-reference-catalog.md",
-        "reference/core/control-center/gaps/gap-reference-catalog.es.md"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/adr-lifecycle.mjs --check-only",
-        "node .harness/scripts/bilingual-terminology-lint.mjs"
-      ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "The CI pipeline (sdk-cli-ci.yml) lives in the UMS product repository. The two scripts that caused pipeline failures are fixed in this commit; the pipeline will run green once UMS updates its reference."
+      "dependencyRationale": "GT-149 owns executable OPA semantics; its remaining ID-divergence warnings are intentionally reported without blocking this reference-integrity closure."
     },
     {
-      "id": "GT-80",
-      "closedAt": "2026-06-15",
-      "closureCommit": "ec17914",
+      "id": "GT-149",
+      "closedAt": "2026-06-20",
+      "closureCommit": "0c5c57d52a89db364626725b40062d6d9ce9da03",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/observability/index.ts",
-        ".github/workflows/sdk-cli-ci.yml"
+        "src/rulesets/opa/version-pinning.test.rego",
+        "src/rulesets/opa/evidence.test.rego",
+        "src/rulesets/opa/governance.test.rego",
+        "src/rulesets/opa/taxonomy.test.rego",
+        "src/rulesets/opa/ci-cd.test.rego",
+        "src/rulesets/opa/cli-readiness.test.rego",
+        "src/rulesets/opa/mcp.test.rego",
+        "src/rulesets/opa/abac-mcp-tool-access.test.rego",
+        "src/rulesets/opa/main.rego",
+        "reference/core/architecture/topologies/progressive-axis/modular-monolith/parity-fixtures/compliant.json",
+        "reference/core/architecture/topologies/progressive-axis/modular-monolith/parity-fixtures/violation.json",
+        "reference/core/architecture/topologies/progressive-axis/modular-monolith/modular-monolith.wasm",
+        "reference/core/architecture/topologies/progressive-axis/distributed-modules/parity-fixtures/compliant.json",
+        "reference/core/architecture/topologies/progressive-axis/distributed-modules/parity-fixtures/violation.json",
+        "reference/core/architecture/topologies/progressive-axis/distributed-modules/distributed-modules.wasm",
+        "reference/core/architecture/topologies/progressive-axis/microservices/parity-fixtures/compliant.json",
+        "reference/core/architecture/topologies/progressive-axis/microservices/parity-fixtures/violation.json",
+        "reference/core/architecture/topologies/progressive-axis/microservices/microservices.wasm",
+        "src/rulesets/topologies/serverless/parity-fixtures/compliant.json",
+        "src/rulesets/topologies/serverless/parity-fixtures/violation.json",
+        "src/rulesets/topologies/serverless/serverless.wasm",
+        "src/rulesets/topologies/edge-computing/parity-fixtures/compliant.json",
+        "src/rulesets/topologies/edge-computing/parity-fixtures/violation.json",
+        "src/rulesets/topologies/edge-computing/edge-computing.wasm",
+        "src/rulesets/topologies/event-driven/parity-fixtures/compliant.json",
+        "src/rulesets/topologies/event-driven/parity-fixtures/violation.json",
+        "src/rulesets/topologies/event-driven/event-driven.wasm",
+        "src/rulesets/topologies/data-mesh/parity-fixtures/compliant.json",
+        "src/rulesets/topologies/data-mesh/parity-fixtures/violation.json",
+        "src/rulesets/topologies/data-mesh/data-mesh.wasm",
+        "src/rulesets/topologies/agentic-ai/parity-fixtures/compliant.json",
+        "src/rulesets/topologies/agentic-ai/parity-fixtures/violation.json",
+        "src/rulesets/topologies/agentic-ai/agentic-ai.wasm",
+        ".harness/scripts/ci/27-opa-parity-gate.mjs",
+        ".harness/scripts/ci/28-test-topology-opa.mjs",
+        ".harness/scripts/ci/opa-eval.mjs",
+        ".harness/scripts/ci/parity-gate.mjs",
+        ".harness/scripts/ci/parity-gate.test.mjs"
       ],
       "validationCommands": [
-        "npx tsc --noEmit -p src/sdk/cli/tsconfig.test.json",
+        "node .harness/scripts/ci/28-test-topology-opa.mjs",
+        "EVOLITH_PARITY_FULL=true node .harness/scripts/ci/27-opa-parity-gate.mjs",
+        "node .harness/scripts/compile-opa-wasm.mjs",
         "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-97",
-      "closedAt": "2026-06-15",
-      "closureCommit": "80bef6f",
-      "evidence": [
-        "src/sdk/cli/src/infrastructure/config/config.service.ts",
-        "src/sdk/cli/src/infrastructure/config/config.service.spec.ts",
-        "src/sdk/cli/src/infrastructure/cli/base-command.ts",
-        "src/sdk/cli/src/commands/profile/profile.command.ts",
-        "src/sdk/cli/src/commands/validate/validate.command.ts",
-        "src/sdk/cli/src/commands/gate/gate.command.ts",
-        "src/sdk/cli/src/commands/upgrade/upgrade.command.ts",
-        "src/sdk/cli/src/app.module.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "npx jest src/infrastructure/config/config.service.spec.ts --no-coverage",
-        "npx tsc --noEmit -p tsconfig.test.json"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-111",
-      "closedAt": "2026-06-15",
-      "closureCommit": "189b03d",
-      "evidence": [
-        "reference/core/architecture/adrs/core/0077-masstransit-v9-commercial-pivot.md",
-        "reference/core/architecture/adrs/core/0077-masstransit-v9-commercial-pivot.es.md"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
-      ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "The ADR records a dated decision with a re-evaluation gate, satisfying the closure criterion."
-    },
-    {
-      "id": "GT-113",
-      "closedAt": "2026-06-15",
-      "closureCommit": "4dd76b5",
-      "evidence": [
-        "src/packages/core-domain/package.json",
-        "src/packages/core-domain/src/application/sync/sync.service.ts",
-        "src/packages/core-domain/src/domain/services/default-workflow-definition.ts",
-        "src/sdk/cli/jest.config.js",
-        "src/sdk/cli/src/app.module.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace src/packages/core-domain",
-        "npm run build --workspace src/sdk/cli",
-        "npx jest"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-108",
-      "closedAt": "2026-06-16",
-      "closureCommit": "39086c4",
-      "evidence": [
-        "src/sdk/cli/src/commands/fixtures/fixtures.command.ts",
-        "src/sdk/cli/src/commands/fixtures/fixtures.command.spec.ts",
-        "src/sdk/cli/test/fixtures.e2e-spec.ts",
-        "src/sdk/cli/src/app.module.ts"
-      ],
-      "validationCommands": [
-        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=fixtures",
-        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=fixtures"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-109",
-      "closedAt": "2026-06-16",
-      "closureCommit": "abb39bb8648d06d95c67cd9f65b6e56c568723be",
-      "evidence": [
-        "src/sdk/cli/src/commands/completion/completion.command.ts",
-        "src/sdk/cli/shell/hooks.bash",
-        "src/sdk/cli/shell/hooks.zsh",
-        "src/sdk/cli/shell/hooks.fish",
-        "src/sdk/cli/src/commands/completion/completion.command.spec.ts",
-        "src/sdk/cli/test/completion.e2e-spec.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "node .harness/scripts/ci/01-validate-docs.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-82",
-      "closedAt": "2026-06-16",
-      "closureCommit": "e7f4490",
-      "evidence": [
-        "src/sdk/cli/src/commands/sdlc/",
-        "src/sdk/cli/test/e2e/sdlc-gate-commands-e2e.test.ts",
-        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
-      ],
-      "validationCommands": [
-        "grep -rl 'describe.skip' src/sdk/cli/src || echo 'none'",
-        "npm run build --workspace src/sdk/cli"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-100",
-      "closedAt": "2026-06-16",
-      "closureCommit": "686bb2fc416897379f7d90300ccc3196c212ac1d",
-      "evidence": [
-        "src/sdk/cli/src/commands/api/api.command.ts",
-        "src/sdk/cli/src/commands/api/api.command.spec.ts",
-        "src/sdk/cli/test/api.e2e-spec.ts",
-        "src/sdk/cli/src/app.module.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "npm run test -- --testPathPattern=api.command.spec"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-101",
-      "closedAt": "2026-06-16",
-      "closureCommit": "686bb2fc416897379f7d90300ccc3196c212ac1d",
-      "evidence": [
-        "src/sdk/cli/src/commands/update/update.command.ts",
-        "src/sdk/cli/src/app.module.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace src/sdk/cli"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-114",
-      "closedAt": "2026-06-16",
-      "closureCommit": "e3792aa01c5a71d7864703b0430ecf3ccaa0a09a",
-      "evidence": [
-        "src/packages/mcp-server/src/tools/auto-fix.tools.ts",
-        "src/packages/mcp-server/src/tools/tools.module.ts",
-        "src/sdk/cli/test/e2e/cli-e2e.test.ts",
-        "src/sdk/cli/src/commands/agents/agents.command.ts",
-        "src/packages/mcp-server/src/main.ts"
-      ],
-      "validationCommands": [
-        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"confirmation\"",
-        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=\"mcp-confirmation\""
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-102",
-      "closedAt": "2026-06-16",
-      "closureCommit": "94308575101b1ecd1bd571026003d9b1b276a7e7",
-      "evidence": [
-        "src/sdk/cli/src/infrastructure/prompts/progress.service.ts",
-        "src/sdk/cli/src/infrastructure/prompts/progress.service.spec.ts",
-        "src/sdk/cli/test/progress.e2e-spec.ts"
-      ],
-      "validationCommands": [
-        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"progress\"",
-        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=\"progress\""
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-104",
-      "closedAt": "2026-06-16",
-      "closureCommit": "b4c2dcc95a6f00de53782546ae51ea975a03fce7",
-      "evidence": [
-        ".github/workflows/sdk-cli-release.yml",
-        "src/sdk/cli/README.md",
-        "src/sdk/cli/README.es.md"
-      ],
-      "validationCommands": [
-        "npm view @beyondnet/evolith-cli versions",
-        "pnpm info @beyondnet/evolith-cli",
-        "yarn info @beyondnet/evolith-cli"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-107",
-      "closedAt": "2026-06-16",
-      "closureCommit": "4084db5e61f5f54e691de61c1ba8a169c0291663",
-      "evidence": [
-        "src/sdk/cli/src/infrastructure/prompts/wizard.service.ts",
-        "src/sdk/cli/src/infrastructure/prompts/wizard.service.spec.ts",
-        "src/sdk/cli/src/commands/init/init.wizard.ts",
-        "src/sdk/cli/test/wizard.e2e-spec.ts",
-        "src/sdk/cli/src/app.module.ts"
-      ],
-      "validationCommands": [
-        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"wizard\"",
-        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=\"wizard\""
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-81",
-      "closedAt": "2026-06-16",
-      "closureCommit": "973013ab210ac2ab6631601caf839ca966706e54",
-      "evidence": [
-        "src/sdk/cli/jest.config.js"
-      ],
-      "validationCommands": [
-        "npm run test:cov",
-        "node .harness/scripts/ci/01-validate-docs.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-116",
-      "closedAt": "2026-06-16",
-      "closureCommit": "3b41cfe11b84d7d6c9dc04cd5febf698171ad5c5",
-      "evidence": [
-        "src/sdk/cli/src/commands/validate/validate.command.ts",
-        "src/packages/core-domain/src/domain/interfaces.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "npm run test --workspace src/sdk/cli"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-115",
-      "closedAt": "2026-06-16",
-      "closureCommit": "ea2a3934cfcbebaf3b05e15538e4b5ac721b1b53",
-      "evidence": [
-        "src/packages/mcp-server/src/tools/auto-fix.tools.ts",
-        "src/packages/mcp-server/src/tools/auto-fix.tools.spec.ts",
-        "src/packages/mcp-server/src/tools/tools.module.ts",
-        "src/sdk/cli/examples/mcp-test.js"
-      ],
-      "validationCommands": [
-        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"auto-fix\"",
-        "npx jest --config src/sdk/cli/test/jest-e2e.json --testPathPatterns=\"auto-fix\""
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-123",
-      "closedAt": "2026-06-18",
-      "closureCommit": "31f8f079313c58b6b5d551d770ab7dea7653057b",
-      "evidence": [
-        "src/sdk/cli/src/commands/init/init.wizard.ts",
-        "src/sdk/cli/src/infrastructure/prompts/progress.service.ts",
-        "src/sdk/cli/src/infrastructure/prompts/progress.service.spec.ts",
-        "src/sdk/cli/src/commands/alias/alias.command.ts",
-        "src/sdk/cli/src/app.module.ts"
-      ],
-      "validationCommands": [
-        "npx tsc -p src/sdk/cli/tsconfig.json --noEmit",
-        "npx jest --config src/sdk/cli/jest.config.js --testPathPatterns=\"progress|alias\""
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-121",
-      "closedAt": "2026-06-19",
-      "closureCommit": "c4835e0db3006d7cc6cb88205537a8086e302066",
-      "evidence": [
-        "src/sdk/cli/src/commands/agents/agents.command.ts",
-        "src/sdk/cli/test/e2e/cli-e2e.test.ts",
-        "src/sdk/cli/src/infrastructure/providers/node-filesystem.provider.ts",
-        "src/packages/mcp-server/src/main.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "npm test --workspace src/sdk/cli -- --runInBand"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-124",
-      "closedAt": "2026-06-19",
-      "closureCommit": "e93c68a",
-      "evidence": [
-        "src/sdk/cli/src/commands/completion/completion.command.ts",
-        "src/sdk/cli/src/commands/sdlc/handoff.command.ts",
-        "src/packages/mcp-server/src/mcp/prompts.service.ts",
-        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace src/packages/mcp-server",
-        "npm test --workspace src/packages/mcp-server -- --runInBand",
-        "npm run build --workspace src/sdk/cli",
-        "npm test --workspace src/sdk/cli -- --runInBand",
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-119",
-      "closedAt": "2026-06-19",
-      "closureCommit": "e93c68a",
-      "evidence": [
-        "reference/core/architecture/adrs/core/0074-evolith-core-api-exposure-layer.md",
-        "product/suite/vision/evolith-product-vision-master.md",
-        "src/packages/mcp-server/README.md",
-        "src/apps/core-api/src/core-domain.module.ts"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-122",
-      "closedAt": "2026-06-19",
-      "closureCommit": "71263df",
-      "evidence": [
-        "src/packages/infra-providers/src/index.ts",
-        "src/packages/infra-providers/src/disk-ruleset.repository.ts",
-        "src/packages/infra-providers/src/webhook.adapter.ts",
-        "src/packages/infra-providers/src/moscow-prioritization.service.ts",
-        "src/apps/core-api/src/core-domain.module.ts",
-        "src/sdk/cli/src/app.module.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace src/packages/infra-providers",
-        "npm run build --workspace src/apps/core-api",
-        "npm run build --workspace src/sdk/cli",
-        "npm test --workspace src/apps/core-api -- --runInBand",
-        "npm test --workspace src/sdk/cli -- --runInBand"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-120",
-      "closedAt": "2026-06-19",
-      "closureCommit": "cb05ffa",
-      "evidence": [
-        "reference/core/architecture/adrs/core/0074-evolith-core-api-exposure-layer.md",
-        "product/suite/vision/evolith-product-vision-master.md",
-        "src/apps/core-api/README.md"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs",
-        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-130",
-      "closedAt": "2026-06-20",
-      "closureCommit": "5d4dc982",
-      "evidence": [
-        ".harness/scripts/ci/12-validate-bmad-signatures.mjs"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-131",
-      "closedAt": "2026-06-20",
-      "closureCommit": "5d4dc982",
-      "evidence": [
-        "src/packages/agent-runtime/src/domain/ports/skill-registry.port.ts",
-        "src/packages/agent-runtime/src/adapters/skills/local-skill-registry.adapter.ts"
-      ],
-      "validationCommands": [
-        "node apps/agent-sandbox/index.js"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-134",
-      "closedAt": "2026-06-20",
-      "closureCommit": "f84c3ac4",
-      "evidence": [
-        "src/packages/mcp-server/package.json",
-        "src/packages/mcp-server/src/tools/tools.module.ts",
-        ".harness/scripts/ci/08-validate-tracking.mjs"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-132",
-      "closedAt": "2026-06-20",
-      "closureCommit": "0b6eb03a",
-      "evidence": [
-        ".harness/scripts/ci/agentic/13-agentic-code-review.mjs"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-133",
-      "closedAt": "2026-06-20",
-      "closureCommit": "dcdad405",
-      "evidence": [
-        "reference/core/architecture/adrs/core/0085-agnostic-opa-wasm-distribution.md",
-        "reference/core/architecture/adrs/core/0085-agnostic-opa-wasm-distribution.es.md"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-135",
-      "closedAt": "2026-06-20",
-      "closureCommit": "d1811b9b",
-      "evidence": [
-        "reference/core/architecture/adrs/core/0086-agentic-ai-telemetry-cost-control.md",
-        "reference/core/architecture/adrs/core/0086-agentic-ai-telemetry-cost-control.es.md"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-136",
+      "id": "GT-150",
       "closedAt": "2026-06-20",
-      "closureCommit": "92e80b5c",
+      "closureCommit": "0c5c57d52a89db364626725b40062d6d9ce9da03",
       "evidence": [
-        "reference/core/architecture/adrs/core/0087-abac-agentic-tool-execution.md",
-        "reference/core/architecture/adrs/core/0087-abac-agentic-tool-execution.es.md",
-        "src/rulesets/opa/abac-mcp-tool-access.rego"
+        "src/rulesets/topologies/serverless/maturity.md",
+        "src/rulesets/topologies/serverless/maturity.es.md",
+        "src/rulesets/topologies/serverless/topology.config.schema.json",
+        "src/rulesets/topologies/serverless/fixtures/valid.topology.config.json",
+        "src/rulesets/topologies/serverless/fixtures/invalid.topology.config.json",
+        "src/rulesets/topologies/serverless/serverless.test.rego",
+        "src/rulesets/topologies/serverless/topology.manifest.json",
+        "src/rulesets/topologies/serverless/README.md",
+        "src/rulesets/topologies/serverless/README.es.md",
+        "reference/core/architecture/adrs/core/0095-serverless-architecture-governance.md",
+        "reference/core/architecture/adrs/core/0095-serverless-architecture-governance.es.md",
+        "src/rulesets/topologies/event-driven/maturity.md",
+        "src/rulesets/topologies/event-driven/maturity.es.md",
+        "src/rulesets/topologies/event-driven/topology.config.schema.json",
+        "src/rulesets/topologies/event-driven/fixtures/valid.topology.config.json",
+        "src/rulesets/topologies/event-driven/fixtures/invalid.topology.config.json",
+        "src/rulesets/topologies/event-driven/event-driven.test.rego",
+        "src/rulesets/topologies/event-driven/topology.manifest.json",
+        "src/rulesets/topologies/event-driven/README.md",
+        "src/rulesets/topologies/event-driven/README.es.md",
+        "src/rulesets/topologies/data-mesh/maturity.md",
+        "src/rulesets/topologies/data-mesh/maturity.es.md",
+        "src/rulesets/topologies/data-mesh/topology.config.schema.json",
+        "src/rulesets/topologies/data-mesh/fixtures/valid.topology.config.json",
+        "src/rulesets/topologies/data-mesh/fixtures/invalid.topology.config.json",
+        "src/rulesets/topologies/data-mesh/data-mesh.test.rego",
+        "src/rulesets/topologies/data-mesh/topology.manifest.json",
+        "src/rulesets/topologies/data-mesh/README.md",
+        "src/rulesets/topologies/data-mesh/README.es.md",
+        "src/rulesets/topologies/edge-computing/maturity.md",
+        "src/rulesets/topologies/edge-computing/maturity.es.md",
+        "src/rulesets/topologies/edge-computing/topology.config.schema.json",
+        "src/rulesets/topologies/edge-computing/fixtures/valid.topology.config.json",
+        "src/rulesets/topologies/edge-computing/fixtures/invalid.topology.config.json",
+        "src/rulesets/topologies/edge-computing/edge-computing.test.rego",
+        "src/rulesets/topologies/edge-computing/topology.manifest.json",
+        "src/rulesets/topologies/edge-computing/README.md",
+        "src/rulesets/topologies/edge-computing/README.es.md",
+        "reference/core/architecture/adrs/core/0096-edge-computing-architecture-governance.md",
+        "reference/core/architecture/adrs/core/0096-edge-computing-architecture-governance.es.md",
+        "reference/core/architecture/topologies/README.md",
+        "reference/core/architecture/topologies/README.es.md",
+        "reference/core/control-center/gaps/gap-tracking.md",
+        "reference/core/control-center/gaps/gap-tracking.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-137",
+      "id": "GT-151",
       "closedAt": "2026-06-20",
-      "closureCommit": "1d78117d",
+      "closureCommit": "b443dcd2",
       "evidence": [
-        "reference/core/architecture/adrs/core/0088-sovereign-identity-agentic-ai.md",
-        "reference/core/architecture/adrs/core/0088-sovereign-identity-agentic-ai.es.md"
+        "reference/core/control-center/gaps/gap-tracking.md",
+        "reference/core/control-center/gaps/gap-tracking.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "node .harness/scripts/ci/28-test-topology-opa.mjs",
+        "EVOLITH_PARITY_FULL=true node .harness/scripts/ci/27-opa-parity-gate.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-138",
-      "closedAt": "2026-06-20",
-      "closureCommit": "155ee197",
+      "id": "GT-152",
+      "closedAt": "2026-06-21",
+      "closureCommit": "176d0897",
       "evidence": [
-        "reference/core/architecture/adrs/core/0089-event-driven-agentic-workflows.md",
-        "reference/core/architecture/adrs/core/0089-event-driven-agentic-workflows.es.md"
+        "src/rulesets/schema/knowledge-intake.schema.json",
+        "src/rulesets/schema/source-registry.schema.json",
+        "product/research/intake/KI-EVANS-AGGREGATE-001.yaml",
+        "product/research/intake/SRC-EVANS-001.yaml",
+        "src/rulesets/governance/knowledge-intake.rules.json",
+        "src/rulesets/opa/knowledge-intake.rego",
+        "src/rulesets/opa/knowledge-intake.test.rego",
+        ".harness/scripts/ci/17-validate-knowledge-intake.mjs",
+        ".harness/scripts/ci/17-validate-knowledge-intake.test.mjs",
+        "reference/core/control-center/gaps/gap-tracking.md",
+        "reference/core/control-center/gaps/gap-tracking.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "node .harness/scripts/ci/17-validate-knowledge-intake.mjs",
+        "node --test .harness/scripts/ci/17-validate-knowledge-intake.test.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-139",
-      "closedAt": "2026-06-20",
-      "closureCommit": "69976156",
+      "id": "GT-153",
+      "closedAt": "2026-06-21",
+      "closureCommit": "176d0897",
       "evidence": [
-        "reference/core/architecture/adrs/core/0090-rag-knowledge-governance.md",
-        "reference/core/architecture/adrs/core/0090-rag-knowledge-governance.es.md",
-        ".harness/scripts/ci/14-rag-index-sync.mjs"
+        "reference/core/architecture/adrs/core/0097-knowledge-lifecycle-governance.md",
+        "reference/core/architecture/adrs/core/0097-knowledge-lifecycle-governance.es.md",
+        "reference/core/architecture/adrs/core/README.md",
+        "reference/core/architecture/adrs/core/README.es.md",
+        "src/rulesets/schema/knowledge-intake.schema.json",
+        "product/research/intake/KI-EVANS-AGGREGATE-001.yaml",
+        "src/rulesets/governance/knowledge-intake.rules.json",
+        "src/rulesets/opa/knowledge-intake.rego",
+        "src/rulesets/opa/knowledge-intake.test.rego",
+        ".harness/scripts/ci/17-validate-knowledge-intake.mjs",
+        ".harness/scripts/ci/17-validate-knowledge-intake.test.mjs",
+        "reference/core/control-center/gaps/gap-tracking.md",
+        "reference/core/control-center/gaps/gap-tracking.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "node .harness/scripts/ci/17-validate-knowledge-intake.mjs",
+        "node --test .harness/scripts/ci/17-validate-knowledge-intake.test.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-140",
-      "closedAt": "2026-06-20",
-      "closureCommit": "25731436",
+      "id": "GT-154",
+      "closedAt": "2026-06-21",
+      "closureCommit": "176d0897",
       "evidence": [
-        "reference/core/architecture/adrs/core/0091-workload-identity-token-rotation.md",
-        "reference/core/architecture/adrs/core/0091-workload-identity-token-rotation.es.md"
+        "src/rulesets/schema/knowledge-projection.schema.json",
+        "product/research/intake/approved-projection.json",
+        "product/research/intake/parity-fixtures/compliant.json",
+        "product/research/intake/parity-fixtures/violation.json",
+        ".harness/scripts/ci/18-validate-knowledge-parity.mjs",
+        ".harness/scripts/ci/17-validate-knowledge-intake.mjs",
+        "reference/core/control-center/gaps/gap-tracking.md",
+        "reference/core/control-center/gaps/gap-tracking.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "node .harness/scripts/ci/18-validate-knowledge-parity.mjs",
+        "node .harness/scripts/ci/17-validate-knowledge-intake.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-142",
-      "closedAt": "2026-06-20",
-      "closureCommit": "929ac878",
+      "id": "GT-155",
+      "closedAt": "2026-06-21",
+      "closureCommit": "4d8ad2f52f2243d5e6acbb02d038d21cd069b8ec",
       "evidence": [
-        ".harness/scripts/ci/agentic/13-agentic-code-review.mjs"
+        "src/apps/core-api/src/presentation/decorators/swagger-envelope.decorator.ts",
+        "src/apps/core-api/src/presentation/controllers/architecture.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/gates.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/health.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/phases.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/projects.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/reference.controller.ts",
+        "src/apps/core-api/src/e2e.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "npm --workspace core-api run test",
+        "node .harness/scripts/ci/10-validate-contract-conformance.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-144",
-      "closedAt": "2026-06-20",
-      "closureCommit": "10fa4962",
+      "id": "GT-156",
+      "closedAt": "2026-06-21",
+      "closureCommit": "4d8ad2f52f2243d5e6acbb02d038d21cd069b8ec",
       "evidence": [
-        "reference/core/architecture/adrs/core/0092-agent-infinite-loop-prevention.md",
-        "reference/core/architecture/adrs/core/0092-agent-infinite-loop-prevention.es.md"
+        "product/products/core-api/README.md",
+        "product/products/core-api/README.es.md",
+        "product/products/core-api/api-reference.md",
+        "product/products/core-api/api-reference.es.md",
+        "reference/core/sdlc/01-playbooks/core-api-deployment.md",
+        "reference/core/sdlc/01-playbooks/core-api-deployment.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "node .harness/scripts/generate-bilingual-index.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-141",
-      "closedAt": "2026-06-20",
-      "closureCommit": "3310dc11",
+      "id": "GT-157",
+      "closedAt": "2026-06-21",
+      "closureCommit": "a8e70ac3",
       "evidence": [
-        "reference/core/architecture/adrs/core/0093-mcp-concurrency-locking.md",
-        "reference/core/architecture/adrs/core/0093-mcp-concurrency-locking.es.md"
+        "src/packages/mcp-server/src/mcp/tool.interface.ts",
+        "src/packages/mcp-server/src/mcp/mcp-server.service.ts",
+        "src/packages/mcp-server/src/mcp/mcp-server.service.spec.ts",
+        "src/packages/mcp-server/src/common/envelopes.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "npm run build --workspace src/packages/mcp-server",
+        "npm run test --workspace src/packages/mcp-server"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-143",
-      "closedAt": "2026-06-20",
-      "closureCommit": "8c238ec7",
+      "id": "GT-158",
+      "closedAt": "2026-06-22",
+      "closureCommit": "a8e70ac3",
       "evidence": [
-        "reference/core/architecture/adrs/core/0094-multi-agent-handoff.md",
-        "reference/core/architecture/adrs/core/0094-multi-agent-handoff.es.md"
+        "src/packages/mcp-server/src/mcp/abac-evaluator.ts",
+        "src/packages/mcp-server/src/mcp/mcp-server.service.ts",
+        "src/packages/mcp-server/src/mcp/mcp-server.service.spec.ts",
+        "src/rulesets/opa/abac-mcp-tool-access.rego",
+        "src/packages/mcp-server/src/mcp/mcp.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs"
+        "npm run build:policy",
+        "npm run test --workspace src/packages/mcp-server",
+        "./.harness/bin/opa test src/rulesets/opa/"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-146",
-      "closedAt": "2026-06-20",
-      "closureCommit": "3efbb5900405322751edd139e4cf87095ddf82b3",
+      "id": "GT-159",
+      "closedAt": "2026-06-21",
+      "closureCommit": "a9297f4e",
       "evidence": [
-        ".harness/scripts/ci/agentic/review-input.mjs",
-        ".harness/scripts/ci/agentic/review-result.mjs",
-        ".harness/scripts/ci/agentic/review-provider.mjs",
-        ".harness/scripts/ci/agentic/13-agentic-code-review.mjs",
-        ".github/workflows/sdk-cli-ci.yml"
+        "reference/core/architecture/adrs/core/0098-rest-uri-versioning-deprecation-policy.md",
+        "reference/core/architecture/adrs/core/0098-rest-uri-versioning-deprecation-policy.es.md",
+        "src/apps/core-api/src/infrastructure/interceptors/deprecation.interceptor.ts",
+        "src/apps/core-api/src/infrastructure/interceptors/deprecation.interceptor.spec.ts",
+        "src/apps/core-api/src/main.ts",
+        "src/apps/core-api/src/e2e.spec.ts",
+        ".harness/scripts/ci/19-validate-rest-versioning.mjs",
+        ".harness/scripts/ci/19-validate-rest-versioning.test.mjs",
+        "product/products/core-api/changelog.md",
+        "product/products/core-api/changelog.es.md"
       ],
       "validationCommands": [
-        "node --test .harness/scripts/ci/agentic/review-input.test.mjs .harness/scripts/ci/agentic/review-result.test.mjs .harness/scripts/ci/agentic/review-provider.test.mjs"
+        "npm --workspace core-api run test",
+        "node .harness/scripts/ci/19-validate-rest-versioning.mjs"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-155 is a completed requirement providing response envelope conformance."
     },
     {
-      "id": "GT-145",
-      "closedAt": "2026-06-20",
-      "closureCommit": "d41bc3a3427cb897d72523a57283c75a27c2815b",
+      "id": "GT-160",
+      "closedAt": "2026-06-22",
+      "closureCommit": "a8e70ac3",
       "evidence": [
-        ".harness/scripts/ci/rag-port.mjs",
-        ".harness/scripts/ci/rag-sync.mjs",
-        ".harness/scripts/ci/14-rag-index-sync.mjs",
-        "product/operations/agentic-ci-rag-support.md",
-        "product/operations/agentic-ci-rag-support.es.md"
+        "src/packages/core-domain/src/common/request-context.ts",
+        "src/packages/mcp-server/src/common/envelopes.ts",
+        "src/packages/mcp-server/src/mcp/mcp-server.service.ts",
+        "src/apps/core-api/src/infrastructure/middleware/correlation-id.middleware.ts",
+        "src/apps/core-api/src/infrastructure/interceptors/envelope.interceptor.ts",
+        "src/packages/infra-providers/src/webhook.adapter.ts"
       ],
       "validationCommands": [
-        "node --test .harness/scripts/ci/rag-sync.test.mjs"
+        "npm run build --workspace src/packages/core-domain",
+        "npm run test --workspace src/packages/mcp-server",
+        "npm run test --workspace src/apps/core-api",
+        "npm run test --workspace src/sdk/cli"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-147",
-      "closedAt": "2026-06-20",
-      "closureCommit": "861505eef043406dcad4d15a030017bb52d2b641",
+      "id": "GT-161",
+      "closedAt": "2026-06-22",
+      "closureCommit": "644f047e",
       "evidence": [
-        ".harness/scripts/ci/drift-audit.mjs",
-        ".harness/scripts/ci/25-operational-drift-audit.mjs",
-        ".harness/scripts/ci/drift-audit.test.mjs"
+        "src/rulesets/opa/schemas/governance.input.schema.json",
+        "src/rulesets/opa/schemas/mcp.input.schema.json",
+        "src/rulesets/opa/schemas/version-pinning.input.schema.json",
+        "src/rulesets/opa/schemas/cli-readiness.input.schema.json",
+        "src/rulesets/opa/schemas/knowledge-intake.input.schema.json",
+        "src/rulesets/opa/schemas/taxonomy.input.schema.json",
+        "src/rulesets/opa/schemas/ci-cd.input.schema.json",
+        "src/rulesets/opa/schemas/evidence.input.schema.json",
+        "src/rulesets/opa/schemas/abac-mcp-tool-access.input.schema.json",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.spec.ts",
+        "src/rulesets/opa/README.md",
+        "src/rulesets/opa/README.es.md",
+        "src/rulesets/schema/README.md",
+        "src/rulesets/schema/README.es.md",
+        "src/rulesets/README.md",
+        "src/rulesets/README.es.md"
       ],
       "validationCommands": [
-        "node --test .harness/scripts/ci/drift-audit.test.mjs",
-        "node .harness/scripts/ci/25-operational-drift-audit.mjs"
+        "npm run build --workspace src/packages/core-domain",
+        "npx jest src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.spec.ts",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-150",
-      "closedAt": "2026-06-20",
-      "closureCommit": "0c5c57d52a89db364626725b40062d6d9ce9da03",
+      "id": "GT-162",
+      "closedAt": "2026-06-22",
+      "closureCommit": "d958c18c",
       "evidence": [
-        "src/rulesets/topologies/serverless/maturity.md",
-        "src/rulesets/topologies/serverless/maturity.es.md",
-        "src/rulesets/topologies/serverless/topology.config.schema.json",
-        "src/rulesets/topologies/serverless/fixtures/valid.topology.config.json",
-        "src/rulesets/topologies/serverless/fixtures/invalid.topology.config.json",
-        "src/rulesets/topologies/serverless/serverless.test.rego",
-        "src/rulesets/topologies/serverless/topology.manifest.json",
-        "src/rulesets/topologies/serverless/README.md",
-        "src/rulesets/topologies/serverless/README.es.md",
-        "reference/core/architecture/adrs/core/0095-serverless-architecture-governance.md",
-        "reference/core/architecture/adrs/core/0095-serverless-architecture-governance.es.md",
-        "src/rulesets/topologies/event-driven/maturity.md",
-        "src/rulesets/topologies/event-driven/maturity.es.md",
-        "src/rulesets/topologies/event-driven/topology.config.schema.json",
-        "src/rulesets/topologies/event-driven/fixtures/valid.topology.config.json",
-        "src/rulesets/topologies/event-driven/fixtures/invalid.topology.config.json",
-        "src/rulesets/topologies/event-driven/event-driven.test.rego",
-        "src/rulesets/topologies/event-driven/topology.manifest.json",
-        "src/rulesets/topologies/event-driven/README.md",
-        "src/rulesets/topologies/event-driven/README.es.md",
-        "src/rulesets/topologies/data-mesh/maturity.md",
-        "src/rulesets/topologies/data-mesh/maturity.es.md",
-        "src/rulesets/topologies/data-mesh/topology.config.schema.json",
-        "src/rulesets/topologies/data-mesh/fixtures/valid.topology.config.json",
-        "src/rulesets/topologies/data-mesh/fixtures/invalid.topology.config.json",
-        "src/rulesets/topologies/data-mesh/data-mesh.test.rego",
-        "src/rulesets/topologies/data-mesh/topology.manifest.json",
-        "src/rulesets/topologies/data-mesh/README.md",
-        "src/rulesets/topologies/data-mesh/README.es.md",
-        "src/rulesets/topologies/edge-computing/maturity.md",
-        "src/rulesets/topologies/edge-computing/maturity.es.md",
-        "src/rulesets/topologies/edge-computing/topology.config.schema.json",
-        "src/rulesets/topologies/edge-computing/fixtures/valid.topology.config.json",
-        "src/rulesets/topologies/edge-computing/fixtures/invalid.topology.config.json",
-        "src/rulesets/topologies/edge-computing/edge-computing.test.rego",
-        "src/rulesets/topologies/edge-computing/topology.manifest.json",
-        "src/rulesets/topologies/edge-computing/README.md",
-        "src/rulesets/topologies/edge-computing/README.es.md",
-        "reference/core/architecture/adrs/core/0096-edge-computing-architecture-governance.md",
-        "reference/core/architecture/adrs/core/0096-edge-computing-architecture-governance.es.md",
-        "reference/core/architecture/topologies/README.md",
-        "reference/core/architecture/topologies/README.es.md",
-        "reference/core/control-center/gaps/gap-tracking.md",
-        "reference/core/control-center/gaps/gap-tracking.es.md"
+        "src/rulesets/opa/main_test.rego",
+        "src/packages/core-domain/src/application/validators/evaluators/aggregator-parity.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "./.harness/bin/opa test src/rulesets/opa/ --ignore=schemas -v",
+        "npx jest src/packages/core-domain/src/application/validators/evaluators/aggregator-parity.spec.ts"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-149",
-      "closedAt": "2026-06-20",
-      "closureCommit": "0c5c57d52a89db364626725b40062d6d9ce9da03",
+      "id": "GT-163",
+      "closedAt": "2026-06-22",
+      "closureCommit": "fa3650f8",
       "evidence": [
-        "src/rulesets/opa/version-pinning.test.rego",
-        "src/rulesets/opa/evidence.test.rego",
-        "src/rulesets/opa/governance.test.rego",
-        "src/rulesets/opa/taxonomy.test.rego",
-        "src/rulesets/opa/ci-cd.test.rego",
-        "src/rulesets/opa/cli-readiness.test.rego",
-        "src/rulesets/opa/mcp.test.rego",
-        "src/rulesets/opa/abac-mcp-tool-access.test.rego",
-        "src/rulesets/opa/main.rego",
-        "reference/core/architecture/topologies/progressive-axis/modular-monolith/parity-fixtures/compliant.json",
-        "reference/core/architecture/topologies/progressive-axis/modular-monolith/parity-fixtures/violation.json",
-        "reference/core/architecture/topologies/progressive-axis/modular-monolith/modular-monolith.wasm",
-        "reference/core/architecture/topologies/progressive-axis/distributed-modules/parity-fixtures/compliant.json",
-        "reference/core/architecture/topologies/progressive-axis/distributed-modules/parity-fixtures/violation.json",
-        "reference/core/architecture/topologies/progressive-axis/distributed-modules/distributed-modules.wasm",
-        "reference/core/architecture/topologies/progressive-axis/microservices/parity-fixtures/compliant.json",
-        "reference/core/architecture/topologies/progressive-axis/microservices/parity-fixtures/violation.json",
-        "reference/core/architecture/topologies/progressive-axis/microservices/microservices.wasm",
-        "src/rulesets/topologies/serverless/parity-fixtures/compliant.json",
-        "src/rulesets/topologies/serverless/parity-fixtures/violation.json",
-        "src/rulesets/topologies/serverless/serverless.wasm",
-        "src/rulesets/topologies/edge-computing/parity-fixtures/compliant.json",
-        "src/rulesets/topologies/edge-computing/parity-fixtures/violation.json",
-        "src/rulesets/topologies/edge-computing/edge-computing.wasm",
-        "src/rulesets/topologies/event-driven/parity-fixtures/compliant.json",
-        "src/rulesets/topologies/event-driven/parity-fixtures/violation.json",
-        "src/rulesets/topologies/event-driven/event-driven.wasm",
-        "src/rulesets/topologies/data-mesh/parity-fixtures/compliant.json",
-        "src/rulesets/topologies/data-mesh/parity-fixtures/violation.json",
-        "src/rulesets/topologies/data-mesh/data-mesh.wasm",
-        "src/rulesets/topologies/agentic-ai/parity-fixtures/compliant.json",
-        "src/rulesets/topologies/agentic-ai/parity-fixtures/violation.json",
-        "src/rulesets/topologies/agentic-ai/agentic-ai.wasm",
-        ".harness/scripts/ci/27-opa-parity-gate.mjs",
-        ".harness/scripts/ci/28-test-topology-opa.mjs",
-        ".harness/scripts/ci/opa-eval.mjs",
-        ".harness/scripts/ci/parity-gate.mjs",
-        ".harness/scripts/ci/parity-gate.test.mjs"
+        ".harness/scripts/validate-topology-manifests.mjs",
+        "src/rulesets/schema/maturity-evidence.schema.json"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/28-test-topology-opa.mjs",
-        "EVOLITH_PARITY_FULL=true node .harness/scripts/ci/27-opa-parity-gate.mjs",
-        "node .harness/scripts/compile-opa-wasm.mjs",
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "node .harness/scripts/validate-topology-manifests.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-151",
-      "closedAt": "2026-06-20",
-      "closureCommit": "b443dcd2",
+      "id": "GT-164",
+      "closedAt": "2026-06-22",
+      "closureCommit": "fcd5d2af",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md",
-        "reference/core/control-center/gaps/gap-tracking.es.md"
+        "src/rulesets/topologies/event-driven/event-driven.rules.json",
+        "src/rulesets/topologies/event-driven/event-driven.rego",
+        "src/rulesets/topologies/event-driven/event-driven.test.rego",
+        "src/rulesets/topologies/data-mesh/data-mesh.rules.json",
+        "src/rulesets/topologies/data-mesh/data-mesh.rego",
+        "src/rulesets/topologies/data-mesh/data-mesh.test.rego"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/28-test-topology-opa.mjs",
-        "EVOLITH_PARITY_FULL=true node .harness/scripts/ci/27-opa-parity-gate.mjs",
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+        ".harness/bin/opa test reference/core/architecture/topologies/integration/event-driven/event-driven.rego reference/core/architecture/topologies/integration/event-driven/event-driven.test.rego -v",
+        ".harness/bin/opa test reference/core/architecture/topologies/data/data-mesh/data-mesh.rego reference/core/architecture/topologies/data/data-mesh/data-mesh.test.rego -v"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-152",
+      "id": "GT-165",
       "closedAt": "2026-06-21",
-      "closureCommit": "176d0897",
+      "closureCommit": "956bba24",
       "evidence": [
-        "src/rulesets/schema/knowledge-intake.schema.json",
-        "src/rulesets/schema/source-registry.schema.json",
-        "product/research/intake/KI-EVANS-AGGREGATE-001.yaml",
-        "product/research/intake/SRC-EVANS-001.yaml",
-        "src/rulesets/governance/knowledge-intake.rules.json",
-        "src/rulesets/opa/knowledge-intake.rego",
-        "src/rulesets/opa/knowledge-intake.test.rego",
-        ".harness/scripts/ci/17-validate-knowledge-intake.mjs",
-        ".harness/scripts/ci/17-validate-knowledge-intake.test.mjs",
-        "reference/core/control-center/gaps/gap-tracking.md",
-        "reference/core/control-center/gaps/gap-tracking.es.md"
+        "src/rulesets/schema/topology-manifest.schema.json",
+        "src/rulesets/topologies/serverless/topology.manifest.json",
+        "src/rulesets/topologies/edge-computing/topology.manifest.json",
+        "reference/core/architecture/topologies/execution/operational-budgets-runbook.md",
+        "reference/core/architecture/topologies/execution/operational-budgets-runbook.es.md",
+        ".harness/scripts/validate-topology-manifests.mjs"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/validate-topology-manifests.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-166",
+      "closedAt": "2026-06-21",
+      "closureCommit": "bbe5db91",
+      "evidence": [
+        "reference/core/sdlc/01-playbooks/phase-1-business-signoff.md",
+        "reference/core/sdlc/01-playbooks/phase-1-business-signoff.es.md",
+        "reference/core/sdlc/01-playbooks/phase-2-design-baseline.md",
+        "reference/core/sdlc/01-playbooks/phase-2-design-baseline.es.md",
+        "reference/core/sdlc/01-playbooks/phase-4-rc-stamp.md",
+        "reference/core/sdlc/01-playbooks/phase-4-rc-stamp.es.md",
+        "src/rulesets/sdlc/phase-gates.rules.json",
+        "src/rulesets/schema/ruleset-sdlc.schema.json",
+        "reference/core/sdlc/quality-gates.md",
+        "reference/core/sdlc/quality-gates.es.md",
+        "reference/core/sdlc/README.md",
+        "reference/core/sdlc/README.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/17-validate-knowledge-intake.mjs",
-        "node --test .harness/scripts/ci/17-validate-knowledge-intake.test.mjs",
         "node .harness/scripts/ci/01-validate-docs.mjs",
         "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-153",
+      "id": "GT-167",
       "closedAt": "2026-06-21",
-      "closureCommit": "176d0897",
+      "closureCommit": "b6a67a60",
       "evidence": [
-        "reference/core/architecture/adrs/core/0097-knowledge-lifecycle-governance.md",
-        "reference/core/architecture/adrs/core/0097-knowledge-lifecycle-governance.es.md",
-        "reference/core/architecture/adrs/core/README.md",
-        "reference/core/architecture/adrs/core/README.es.md",
-        "src/rulesets/schema/knowledge-intake.schema.json",
-        "product/research/intake/KI-EVANS-AGGREGATE-001.yaml",
-        "src/rulesets/governance/knowledge-intake.rules.json",
-        "src/rulesets/opa/knowledge-intake.rego",
-        "src/rulesets/opa/knowledge-intake.test.rego",
-        ".harness/scripts/ci/17-validate-knowledge-intake.mjs",
-        ".harness/scripts/ci/17-validate-knowledge-intake.test.mjs",
-        "reference/core/control-center/gaps/gap-tracking.md",
-        "reference/core/control-center/gaps/gap-tracking.es.md"
+        "src/rulesets/schema/observability-validation.schema.json",
+        "src/rulesets/schema/security-scan-report.schema.json",
+        "src/rulesets/schema/integration-evidence.schema.json",
+        "src/rulesets/sdlc/phase-gates.rules.json",
+        "src/rulesets/schema/ruleset-sdlc.schema.json",
+        "reference/core/sdlc/04-artifact-templates/observability-validation-template.md",
+        "reference/core/sdlc/04-artifact-templates/observability-validation-template.es.md",
+        "reference/core/sdlc/04-artifact-templates/security-scan-report-template.md",
+        "reference/core/sdlc/04-artifact-templates/security-scan-report-template.es.md",
+        "reference/core/sdlc/04-artifact-templates/integration-evidence-template.md",
+        "reference/core/sdlc/04-artifact-templates/integration-evidence-template.es.md",
+        "reference/core/sdlc/04-artifact-templates/test-summary-report-template.md",
+        "reference/core/sdlc/04-artifact-templates/test-summary-report-template.es.md",
+        "reference/core/sdlc/01-playbooks/phase-4-rc-stamp.md",
+        "reference/core/sdlc/01-playbooks/phase-4-rc-stamp.es.md",
+        "reference/core/sdlc/01-playbooks/zero-downtime-release.md",
+        "reference/core/sdlc/01-playbooks/zero-downtime-release.es.md",
+        ".harness/scripts/ci/21-validate-phase-gate-templates.mjs",
+        "reference/core/sdlc/README.md",
+        "reference/core/sdlc/README.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/17-validate-knowledge-intake.mjs",
-        "node --test .harness/scripts/ci/17-validate-knowledge-intake.test.mjs",
+        "node .harness/scripts/ci/21-validate-phase-gate-templates.mjs",
         "node .harness/scripts/ci/01-validate-docs.mjs",
         "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-166 playbooks now cite each evidence template."
+    },
+    {
+      "id": "GT-168",
+      "closedAt": "2026-06-21",
+      "closureCommit": "507bb5a4",
+      "evidence": [
+        "src/rulesets/schema/topology-composition.schema.json",
+        "product/research/demo/examples/cross-topology-composition/topology.composition.json",
+        "product/research/demo/examples/cross-topology-composition/modular-monolith.config.json",
+        "product/research/demo/examples/cross-topology-composition/event-driven.config.json",
+        "product/research/demo/examples/cross-topology-composition/README.md",
+        "product/research/demo/examples/cross-topology-composition/README.es.md",
+        ".harness/scripts/ci/22-validate-topology-composition.mjs",
+        "reference/core/architecture/topologies/topology-dimensions.md",
+        "reference/core/architecture/topologies/topology-dimensions.es.md"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/22-validate-topology-composition.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+      ],
       "dependencyDisposition": "none"
     },
     {
@@ -2836,25 +2407,26 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-154",
+      "id": "GT-170",
       "closedAt": "2026-06-21",
-      "closureCommit": "176d0897",
+      "closureCommit": "334e5019",
       "evidence": [
-        "src/rulesets/schema/knowledge-projection.schema.json",
-        "product/research/intake/approved-projection.json",
-        "product/research/intake/parity-fixtures/compliant.json",
-        "product/research/intake/parity-fixtures/violation.json",
-        ".harness/scripts/ci/18-validate-knowledge-parity.mjs",
-        ".harness/scripts/ci/17-validate-knowledge-intake.mjs",
-        "reference/core/control-center/gaps/gap-tracking.md",
-        "reference/core/control-center/gaps/gap-tracking.es.md"
+        "product/products/ums-reference/README.md",
+        "product/products/ums-reference/README.es.md",
+        "product/products/ums-reference/overview.md",
+        "product/products/ums-reference/overview.es.md",
+        "product/products/ums-reference/reference-model.md",
+        "product/products/ums-reference/reference-model.es.md",
+        "product/products/README.md",
+        "product/products/README.es.md",
+        "product/research/demo/README.md",
+        "product/research/demo/README.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/18-validate-knowledge-parity.mjs",
-        "node .harness/scripts/ci/17-validate-knowledge-intake.mjs",
         "node .harness/scripts/ci/01-validate-docs.mjs",
         "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/11-validate-product-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
@@ -2903,28 +2475,63 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-179",
-      "closedAt": "2026-06-23",
-      "closureCommit": "6694314d",
+      "id": "GT-174",
+      "closedAt": "2026-06-21",
+      "closureCommit": "4e8fcad3",
       "evidence": [
-        "src/sdk/cli/src/commands/gate/gate.command.spec.ts",
-        "src/sdk/cli/src/commands/agents/agents.command.spec.ts",
-        "src/sdk/cli/src/commands/init/init.wizard.spec.ts",
-        "src/sdk/cli/src/commands/phase/phase-advance.command.spec.ts"
+        "src/rulesets/schema/output-envelope.schema.json",
+        "reference/core/control-center/audits/surface-compatibility.json",
+        "reference/core/control-center/audits/surface-compatibility.schema.json",
+        ".harness/scripts/ci/20-validate-surface-compatibility.mjs",
+        ".harness/scripts/ci/20-validate-surface-compatibility.test.mjs"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/20-validate-surface-compatibility.mjs",
+        "node --test .harness/scripts/ci/20-validate-surface-compatibility.test.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-175",
+      "closedAt": "2026-06-22",
+      "closureCommit": "47e670b7",
+      "evidence": [
+        "reference/core/architecture/adrs/core/0099-opa-bundle-s3-distribution.md",
+        "reference/core/architecture/adrs/core/0099-opa-bundle-s3-distribution.es.md",
+        "reference/core/architecture/adrs/core/0085-agnostic-opa-wasm-distribution.md",
+        "reference/core/architecture/adrs/core/0085-agnostic-opa-wasm-distribution.es.md"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-176",
+      "closedAt": "2026-06-22",
+      "closureCommit": "825a668a",
+      "evidence": [
+        "product/research/architecture-intelligence/patterns/modular-monolith-first.md",
+        "product/research/architecture-intelligence/patterns/modular-monolith-first.es.md",
+        "product/research/architecture-intelligence/patterns/no-cross-domain-joins.md",
+        "product/research/architecture-intelligence/patterns/contract-first-integration.md",
+        "product/research/architecture-intelligence/patterns/data-ownership-per-bounded-context.md"
       ],
       "validationCommands": [
-        "npx jest --config src/sdk/cli/jest.config.js --coverage",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-210",
-      "closedAt": "2026-06-23",
-      "closureCommit": "6de4b602",
+      "id": "GT-177",
+      "closedAt": "2026-06-22",
+      "closureCommit": "a5b6b0a7",
       "evidence": [
-        "reference/core/sdlc/05-delivery-and-operations/README.md",
-        "reference/core/sdlc/05-delivery-and-operations/README.es.md"
+        "reference/core/architecture/adrs/core/README.md"
       ],
       "validationCommands": [
         "node .harness/scripts/ci/01-validate-docs.mjs",
@@ -2934,59 +2541,47 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-184",
+      "id": "GT-178",
       "closedAt": "2026-06-23",
-      "closureCommit": "b0c5959f",
+      "closureCommit": "e4819615",
       "evidence": [
-        "src/sdk/cli/src/app.module.ts",
-        "src/sdk/cli/src/commands/architecture/scaffold.command.ts",
-        "src/sdk/cli/src/commands/sdlc/gate-status.command.ts",
-        "src/sdk/cli/src/commands/sdlc/generate-domain.command.ts",
-        "src/sdk/cli/src/commands/sdlc/handoff.command.ts",
-        "src/sdk/cli/src/commands/init/init.command.ts",
-        "src/sdk/cli/src/infrastructure/cli/command-executor.ts",
-        "src/sdk/cli/src/infrastructure/cli/base-command.ts",
-        "src/sdk/cli/src/infrastructure/catalog/catalog-loader.ts",
-        "src/sdk/cli/src/infrastructure/prompts/init-prompt-group.ts",
-        "src/sdk/cli/src/infrastructure/prompts/prompt.service.ts",
-        "src/packages/infra-providers/src/architecture/nx-workspace.strategy.ts",
-        "src/sdk/cli/src/infrastructure/observability/error-reporter.ts",
-        "src/packages/core-domain/src/domain/interfaces.ts"
+        "reference/core/architecture/adrs/core/README.es.md"
       ],
       "validationCommands": [
-        "npx tsc --noEmit -p src/sdk/cli/tsconfig.json",
-        "npm test --workspace src/sdk/cli",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/01-validate-docs.mjs",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-185",
+      "id": "GT-179",
       "closedAt": "2026-06-23",
-      "closureCommit": "f824d58e",
+      "closureCommit": "6694314d",
       "evidence": [
-        "src/packages/mcp-server/src/tools/phase-advance.tools.spec.ts",
-        "src/packages/mcp-server/src/tools/topology.tools.spec.ts",
-        "src/packages/mcp-server/src/tools/tools-registration.spec.ts"
+        "src/sdk/cli/src/commands/gate/gate.command.spec.ts",
+        "src/sdk/cli/src/commands/agents/agents.command.spec.ts",
+        "src/sdk/cli/src/commands/init/init.wizard.spec.ts",
+        "src/sdk/cli/src/commands/phase/phase-advance.command.spec.ts"
       ],
       "validationCommands": [
-        "npx jest --config src/packages/mcp-server/jest.config.js --coverage",
+        "npx jest --config src/sdk/cli/jest.config.js --coverage",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-182",
-      "closedAt": "2026-06-23",
-      "closureCommit": "a374d0cb",
+      "id": "GT-180",
+      "closedAt": "2026-06-22",
+      "closureCommit": "3e4c7f71",
       "evidence": [
-        "src/packages/core-domain/jest.config.js",
-        "src/packages/core-domain/src/application/agents/agent-ruleset-builder.spec.ts",
-        "src/packages/core-domain/src/domain/metrics/dora-calculator.spec.ts",
-        "src/packages/core-domain/src/domain/metrics/git-log-reader.spec.ts"
+        "src/sdk/cli/src/commands/update/update.command.ts",
+        "src/sdk/cli/src/infrastructure/providers/node-filesystem.provider.ts",
+        "src/sdk/cli/src/infrastructure/plugins/plugin-loader.ts"
       ],
       "validationCommands": [
-        "npx jest --config src/packages/core-domain/jest.config.js --coverage",
+        "npm run build --workspace src/sdk/cli",
+        "npm run test:unit --workspace src/sdk/cli",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
@@ -3028,86 +2623,140 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-180",
-      "closedAt": "2026-06-22",
-      "closureCommit": "3e4c7f71",
+      "id": "GT-182",
+      "closedAt": "2026-06-23",
+      "closureCommit": "a374d0cb",
       "evidence": [
-        "src/sdk/cli/src/commands/update/update.command.ts",
-        "src/sdk/cli/src/infrastructure/providers/node-filesystem.provider.ts",
-        "src/sdk/cli/src/infrastructure/plugins/plugin-loader.ts"
+        "src/packages/core-domain/jest.config.js",
+        "src/packages/core-domain/src/application/agents/agent-ruleset-builder.spec.ts",
+        "src/packages/core-domain/src/domain/metrics/dora-calculator.spec.ts",
+        "src/packages/core-domain/src/domain/metrics/git-log-reader.spec.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "npm run test:unit --workspace src/sdk/cli",
+        "npx jest --config src/packages/core-domain/jest.config.js --coverage",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-177",
-      "closedAt": "2026-06-22",
-      "closureCommit": "a5b6b0a7",
+      "id": "GT-184",
+      "closedAt": "2026-06-23",
+      "closureCommit": "b0c5959f",
       "evidence": [
-        "reference/core/architecture/adrs/core/README.md"
+        "src/sdk/cli/src/app.module.ts",
+        "src/sdk/cli/src/commands/architecture/scaffold.command.ts",
+        "src/sdk/cli/src/commands/sdlc/gate-status.command.ts",
+        "src/sdk/cli/src/commands/sdlc/generate-domain.command.ts",
+        "src/sdk/cli/src/commands/sdlc/handoff.command.ts",
+        "src/sdk/cli/src/commands/init/init.command.ts",
+        "src/sdk/cli/src/infrastructure/cli/command-executor.ts",
+        "src/sdk/cli/src/infrastructure/cli/base-command.ts",
+        "src/sdk/cli/src/infrastructure/catalog/catalog-loader.ts",
+        "src/sdk/cli/src/infrastructure/prompts/init-prompt-group.ts",
+        "src/sdk/cli/src/infrastructure/prompts/prompt.service.ts",
+        "src/packages/infra-providers/src/architecture/nx-workspace.strategy.ts",
+        "src/sdk/cli/src/infrastructure/observability/error-reporter.ts",
+        "src/packages/core-domain/src/domain/interfaces.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "npx tsc --noEmit -p src/sdk/cli/tsconfig.json",
+        "npm test --workspace src/sdk/cli",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-176",
-      "closedAt": "2026-06-22",
-      "closureCommit": "825a668a",
+      "id": "GT-185",
+      "closedAt": "2026-06-23",
+      "closureCommit": "f824d58e",
       "evidence": [
-        "product/research/architecture-intelligence/patterns/modular-monolith-first.md",
-        "product/research/architecture-intelligence/patterns/modular-monolith-first.es.md",
-        "product/research/architecture-intelligence/patterns/no-cross-domain-joins.md",
-        "product/research/architecture-intelligence/patterns/contract-first-integration.md",
-        "product/research/architecture-intelligence/patterns/data-ownership-per-bounded-context.md"
+        "src/packages/mcp-server/src/tools/phase-advance.tools.spec.ts",
+        "src/packages/mcp-server/src/tools/topology.tools.spec.ts",
+        "src/packages/mcp-server/src/tools/tools-registration.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "npx jest --config src/packages/mcp-server/jest.config.js --coverage",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-175",
-      "closedAt": "2026-06-22",
-      "closureCommit": "47e670b7",
+      "id": "GT-186",
+      "closedAt": "2026-06-23",
+      "closureCommit": "a529ad63",
       "evidence": [
-        "reference/core/architecture/adrs/core/0099-opa-bundle-s3-distribution.md",
-        "reference/core/architecture/adrs/core/0099-opa-bundle-s3-distribution.es.md",
-        "reference/core/architecture/adrs/core/0085-agnostic-opa-wasm-distribution.md",
-        "reference/core/architecture/adrs/core/0085-agnostic-opa-wasm-distribution.es.md"
+        "reference/core/control-center/gaps/gap-reference-catalog.md",
+        "reference/core/control-center/gaps/gap-reference-catalog.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "none",
+      "closureNote": "Resolved by GT-184 — zero @ts-nocheck directives remain in the codebase"
     },
     {
-      "id": "GT-209",
-      "closedAt": "2026-06-22",
-      "closureCommit": "2e58fd46",
+      "id": "GT-187",
+      "closedAt": "2026-06-23",
+      "closureCommit": "742be2df",
       "evidence": [
-        "reference/core/architecture/foundations/agnostic-baseline.md",
-        "reference/core/architecture/foundations/agnostic-baseline.es.md",
-        "reference/core/architecture/README.md",
-        "reference/core/architecture/README.es.md"
+        "src/sdk/cli/tsconfig.json",
+        "src/packages/core/tsconfig.json",
+        "src/packages/mcp-server/tsconfig.json",
+        "src/apps/core-api/tsconfig.json",
+        "src/sdk/cli/src/infrastructure/observability/otel-tracing.ts",
+        "src/sdk/cli/src/infrastructure/prompts/init-prompt-options.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/08-validate-tracking.mjs"
+        "npx tsc --noEmit --project src/sdk/cli/tsconfig.json",
+        "npx tsc --noEmit --project src/packages/core/tsconfig.json",
+        "npx tsc --noEmit --project src/packages/mcp-server/tsconfig.json",
+        "npx tsc --noEmit --project src/apps/core-api/tsconfig.json",
+        "npm test"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "none",
+      "closureNote": "Enabled strict mode across all 5 packages. Fixed 2 type errors, installed @types/opossum. 151 tests pass."
+    },
+    {
+      "id": "GT-188",
+      "closedAt": "2026-06-23",
+      "closureCommit": "b9e891db",
+      "evidence": [
+        "src/sdk/cli/src/infrastructure/providers/config-parser.provider.spec.ts",
+        "src/sdk/cli/src/infrastructure/prompts/init-prompt-options.spec.ts",
+        "src/sdk/cli/src/infrastructure/prompts/init-prompt-group.spec.ts",
+        "src/sdk/cli/src/infrastructure/observability/otel-tracing.spec.ts",
+        "src/sdk/cli/src/config/alias.service.spec.ts"
+      ],
+      "validationCommands": [
+        "NODE_OPTIONS=--max-old-space-size=8192 npx jest --coverage"
+      ],
+      "dependencyDisposition": "none",
+      "closureNote": "Created 5 spec files covering previously uncovered modules. All files now above 60% statement coverage. 840 tests pass (from 802)."
+    },
+    {
+      "id": "GT-189",
+      "closedAt": "2026-06-23",
+      "closureCommit": "7a3aa44c",
+      "evidence": [
+        "src/packages/core-domain/src/domain/services/index.ts",
+        "src/packages/core-domain/src/domain/services/default-workflow-definition.ts",
+        "src/packages/core-domain/src/application/use-cases/phase-transition.use-case.ts",
+        "src/packages/core-domain/src/application/use-cases/validate-satellite.use-case.ts",
+        "src/packages/infra-providers/src/node-filesystem.provider.ts",
+        "src/apps/core-api/src/infrastructure/providers/node-filesystem.provider.ts",
+        "src/packages/mcp-server/src/mcp/mcp-tool-dispatch.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture/ast-rules.ts"
+      ],
+      "validationCommands": [
+        "npx tsc --noEmit --project src/packages/core-domain/tsconfig.json",
+        "npx tsc --noEmit --project src/packages/infra-providers/tsconfig.json",
+        "npx tsc --noEmit --project src/packages/mcp-server/tsconfig.json",
+        "npx tsc --noEmit --project src/apps/core-api/tsconfig.json",
+        "npm test"
+      ],
+      "dependencyDisposition": "none",
+      "closureNote": "Replaced 12 require() calls with ES imports across 9 source files. Zero require() in production TS source."
     },
     {
       "id": "GT-190",
@@ -3169,63 +2818,68 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-196",
+      "id": "GT-194",
       "closedAt": "2026-06-23",
-      "closureCommit": "31e4e079",
+      "closureCommit": "9c8ae9a5",
       "evidence": [
-        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
+        "src/packages/core-domain/src/domain/interfaces.ts",
+        "src/packages/core-domain/src/application/sync/sync.service.ts",
+        "src/packages/mcp-server/src/mcp/mcp-server-auth.ts",
+        "src/sdk/cli/src/test/mocks/index.ts"
       ],
       "validationCommands": [
-        "NODE_OPTIONS=--max-old-space-size=4096 npx jest --config src/sdk/cli/test/jest-e2e.json --runInBand --no-bail --testPathPatterns='mcp-e2e'"
+        "npx tsc --noEmit --project src/packages/core-domain/tsconfig.json",
+        "npx tsc --noEmit --project src/packages/mcp-server/tsconfig.json",
+        "npx tsc --noEmit --project src/packages/infra-providers/tsconfig.json",
+        "npx tsc --noEmit --project src/sdk/cli/tsconfig.json",
+        "npx tsc --noEmit --project src/apps/core-api/tsconfig.json",
+        "npm test"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Added 11 HTTP transport protocol E2E tests covering initialize, tools, resources, prompts, error handling, and session management. 40 E2E tests pass."
+      "closureNote": "Removed any from IFileSystem (4 methods), IConfigParser (2 methods), IConfigService, verifyJwtToken, getContextFromPayload, and mock stat/readdir"
     },
     {
-      "id": "GT-188",
+      "id": "GT-195",
       "closedAt": "2026-06-23",
-      "closureCommit": "b9e891db",
+      "closureCommit": "8eb7ce71",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/providers/config-parser.provider.spec.ts",
-        "src/sdk/cli/src/infrastructure/prompts/init-prompt-options.spec.ts",
-        "src/sdk/cli/src/infrastructure/prompts/init-prompt-group.spec.ts",
-        "src/sdk/cli/src/infrastructure/observability/otel-tracing.spec.ts",
-        "src/sdk/cli/src/config/alias.service.spec.ts"
+        "src/sdk/cli/src/commands/update/update.command.ts",
+        "src/sdk/cli/src/commands/completion/completion.command.ts"
       ],
       "validationCommands": [
-        "NODE_OPTIONS=--max-old-space-size=8192 npx jest --coverage"
+        "npm run build --workspace src/sdk/cli",
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
-      "dependencyDisposition": "none",
-      "closureNote": "Created 5 spec files covering previously uncovered modules. All files now above 60% statement coverage. 840 tests pass (from 802)."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-195",
+      "id": "GT-196",
       "closedAt": "2026-06-23",
-      "closureCommit": "8eb7ce71",
-      "evidence": [
-        "src/sdk/cli/src/commands/update/update.command.ts",
-        "src/sdk/cli/src/commands/completion/completion.command.ts"
+      "closureCommit": "31e4e079",
+      "evidence": [
+        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace src/sdk/cli",
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "NODE_OPTIONS=--max-old-space-size=4096 npx jest --config src/sdk/cli/test/jest-e2e.json --runInBand --no-bail --testPathPatterns='mcp-e2e'"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "none",
+      "closureNote": "Added 11 HTTP transport protocol E2E tests covering initialize, tools, resources, prompts, error handling, and session management. 40 E2E tests pass."
     },
     {
-      "id": "GT-211",
+      "id": "GT-197",
       "closedAt": "2026-06-23",
-      "closureCommit": "8eb7ce71",
+      "closureCommit": "507382f3",
       "evidence": [
-        "reference/core/architecture/adrs/core/0041-dual-engine-policy-evaluation.md",
-        "reference/core/architecture/adrs/core/0095-serverless-architecture-governance.md",
-        "reference/core/architecture/adrs/core/0096-edge-computing-architecture-governance.md"
+        ".github/workflows/sdk-cli-release.yml",
+        ".github/workflows/sdk-cli-ci.yml",
+        ".github/workflows/docs.yml",
+        ".github/workflows/docs-release.yml"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+        "gh api \"repos/beyondnetcode/evolith_arch32/actions/runs?per_page=20&status=completed\" --jq '.workflow_runs[] | select(.workflow_id == 288813898) | {id: .id, conclusion: .conclusion, event: .event}'"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "none",
+      "closureNote": "Root cause: missing npm ci in core-validation jobs. 10 consecutive successful release pipeline runs verified. 20 auto-generated failure issues closed."
     },
     {
       "id": "GT-198",
@@ -3386,116 +3040,51 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-189",
-      "closedAt": "2026-06-23",
-      "closureCommit": "7a3aa44c",
-      "evidence": [
-        "src/packages/core-domain/src/domain/services/index.ts",
-        "src/packages/core-domain/src/domain/services/default-workflow-definition.ts",
-        "src/packages/core-domain/src/application/use-cases/phase-transition.use-case.ts",
-        "src/packages/core-domain/src/application/use-cases/validate-satellite.use-case.ts",
-        "src/packages/infra-providers/src/node-filesystem.provider.ts",
-        "src/apps/core-api/src/infrastructure/providers/node-filesystem.provider.ts",
-        "src/packages/mcp-server/src/mcp/mcp-tool-dispatch.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture/ast-rules.ts"
-      ],
-      "validationCommands": [
-        "npx tsc --noEmit --project src/packages/core-domain/tsconfig.json",
-        "npx tsc --noEmit --project src/packages/infra-providers/tsconfig.json",
-        "npx tsc --noEmit --project src/packages/mcp-server/tsconfig.json",
-        "npx tsc --noEmit --project src/apps/core-api/tsconfig.json",
-        "npm test"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "Replaced 12 require() calls with ES imports across 9 source files. Zero require() in production TS source."
-    },
-    {
-      "id": "GT-194",
-      "closedAt": "2026-06-23",
-      "closureCommit": "9c8ae9a5",
-      "evidence": [
-        "src/packages/core-domain/src/domain/interfaces.ts",
-        "src/packages/core-domain/src/application/sync/sync.service.ts",
-        "src/packages/mcp-server/src/mcp/mcp-server-auth.ts",
-        "src/sdk/cli/src/test/mocks/index.ts"
-      ],
-      "validationCommands": [
-        "npx tsc --noEmit --project src/packages/core-domain/tsconfig.json",
-        "npx tsc --noEmit --project src/packages/mcp-server/tsconfig.json",
-        "npx tsc --noEmit --project src/packages/infra-providers/tsconfig.json",
-        "npx tsc --noEmit --project src/sdk/cli/tsconfig.json",
-        "npx tsc --noEmit --project src/apps/core-api/tsconfig.json",
-        "npm test"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "Removed any from IFileSystem (4 methods), IConfigParser (2 methods), IConfigService, verifyJwtToken, getContextFromPayload, and mock stat/readdir"
-    },
-    {
-      "id": "GT-187",
-      "closedAt": "2026-06-23",
-      "closureCommit": "742be2df",
-      "evidence": [
-        "src/sdk/cli/tsconfig.json",
-        "src/packages/core/tsconfig.json",
-        "src/packages/mcp-server/tsconfig.json",
-        "src/apps/core-api/tsconfig.json",
-        "src/sdk/cli/src/infrastructure/observability/otel-tracing.ts",
-        "src/sdk/cli/src/infrastructure/prompts/init-prompt-options.ts"
-      ],
-      "validationCommands": [
-        "npx tsc --noEmit --project src/sdk/cli/tsconfig.json",
-        "npx tsc --noEmit --project src/packages/core/tsconfig.json",
-        "npx tsc --noEmit --project src/packages/mcp-server/tsconfig.json",
-        "npx tsc --noEmit --project src/apps/core-api/tsconfig.json",
-        "npm test"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "Enabled strict mode across all 5 packages. Fixed 2 type errors, installed @types/opossum. 151 tests pass."
-    },
-    {
-      "id": "GT-186",
-      "closedAt": "2026-06-23",
-      "closureCommit": "a529ad63",
+      "id": "GT-209",
+      "closedAt": "2026-06-22",
+      "closureCommit": "2e58fd46",
       "evidence": [
-        "reference/core/control-center/gaps/gap-reference-catalog.md",
-        "reference/core/control-center/gaps/gap-reference-catalog.es.md"
+        "reference/core/architecture/foundations/agnostic-baseline.md",
+        "reference/core/architecture/foundations/agnostic-baseline.es.md",
+        "reference/core/architecture/README.md",
+        "reference/core/architecture/README.es.md"
       ],
       "validationCommands": [
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "dependencyDisposition": "none",
-      "closureNote": "Resolved by GT-184 — zero @ts-nocheck directives remain in the codebase"
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-178",
+      "id": "GT-210",
       "closedAt": "2026-06-23",
-      "closureCommit": "e4819615",
+      "closureCommit": "6de4b602",
       "evidence": [
-        "reference/core/architecture/adrs/core/README.es.md"
+        "reference/core/sdlc/05-delivery-and-operations/README.md",
+        "reference/core/sdlc/05-delivery-and-operations/README.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
         "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
         "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-197",
+      "id": "GT-211",
       "closedAt": "2026-06-23",
-      "closureCommit": "507382f3",
+      "closureCommit": "8eb7ce71",
       "evidence": [
-        ".github/workflows/sdk-cli-release.yml",
-        ".github/workflows/sdk-cli-ci.yml",
-        ".github/workflows/docs.yml",
-        ".github/workflows/docs-release.yml"
+        "reference/core/architecture/adrs/core/0041-dual-engine-policy-evaluation.md",
+        "reference/core/architecture/adrs/core/0095-serverless-architecture-governance.md",
+        "reference/core/architecture/adrs/core/0096-edge-computing-architecture-governance.md"
       ],
       "validationCommands": [
-        "gh api \"repos/beyondnetcode/evolith_arch32/actions/runs?per_page=20&status=completed\" --jq '.workflow_runs[] | select(.workflow_id == 288813898) | {id: .id, conclusion: .conclusion, event: .event}'"
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
       ],
-      "dependencyDisposition": "none",
-      "closureNote": "Root cause: missing npm ci in core-validation jobs. 10 consecutive successful release pipeline runs verified. 20 auto-generated failure issues closed."
+      "dependencyDisposition": "none"
     },
     {
       "id": "GT-212",
@@ -3535,221 +3124,249 @@
       "closureNote": "Added metadata.governance (owner, criticality) to all 8 topology manifests. Schema updated with required governance block. Validation script enforces the new fields."
     },
     {
-      "id": "GT-230",
+      "id": "GT-216",
       "closedAt": "2026-06-23",
-      "closureCommit": "49f55404",
+      "closureCommit": "f1d9814f",
       "evidence": [
-        "reference/core/foundations/agent-skills/manifest.json",
-        "reference/core/foundations/agent-skills/requirements-traceability-mapper.md",
-        "reference/core/foundations/agent-skills/gap-prioritization-engine.md",
-        "reference/core/foundations/agent-skills/adr-freshness-monitor.md",
-        "reference/core/foundations/agent-skills/analyst.md",
-        "reference/core/foundations/agent-skills/po.md",
-        "reference/core/foundations/agent-skills/architect.md"
+        "src/rulesets/opa/hexagonal-architecture.rego",
+        "src/rulesets/opa/cicd-quality-gates.rego",
+        "src/rulesets/opa/multi-tenancy.rego",
+        "src/rulesets/opa/testing-pyramid.rego",
+        "src/rulesets/opa/protocol-selection.rego",
+        "src/rulesets/opa/multi-runtime.rego",
+        "src/rulesets/opa/gitflow-branching.rego",
+        "src/rulesets/opa/executive-scorecards.rego",
+        "src/rulesets/opa/open-core-boundary.rego",
+        "src/rulesets/opa/satellite-contracts.rego",
+        "src/rulesets/opa/cli-core-parity.rego",
+        "src/rulesets/opa/cli-release-readiness.rego"
       ],
       "validationCommands": [
-        "node .harness/scripts/skills/adr-freshness-monitor.mjs --help"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created composable skills framework with manifest.json, 3 reference skills (EN/ES), 3 scripts, and updated agent personas with skills field."
+      "closureNote": "Created 17 OPA policies + input schemas for all uncovered native rulesets."
     },
     {
-      "id": "GT-236",
+      "id": "GT-217",
       "closedAt": "2026-06-23",
-      "closureCommit": "266f4357",
+      "closureCommit": "f1d9814f",
       "evidence": [
-        ".github/workflows/knowledge-intake.yml",
-        ".harness/scripts/knowledge-promote.mjs",
-        ".harness/scripts/knowledge-winston-review.mjs",
-        "product/operations/knowledge-intake-automation.md"
+        "reference/core/architecture/topologies/progressive-axis/modular-monolith/operations.md",
+        "src/rulesets/topologies/data-mesh/operations.md",
+        "src/rulesets/topologies/event-driven/operations.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/17-validate-knowledge-intake.mjs"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Automated knowledge intake pipeline with CI workflow, promotion script, Winston review trigger, and --fix flag."
+      "closureNote": "Created 8 guidance files x 7 topologies x 2 languages = 112 files."
     },
     {
-      "id": "GT-246",
+      "id": "GT-218",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "product/operations/chaos-experiments/cpu-stress.yaml",
-        "product/operations/chaos-experiments/network-partition.yaml",
-        "product/operations/chaos-experiments/pod-kill.yaml"
+        "reference/core/sdlc/04-artifact-templates/rollback-rehearsal-template.md",
+        "reference/core/sdlc/04-artifact-templates/on-call-handoff-template.md",
+        "src/rulesets/schema/rollback-rehearsal.schema.json",
+        "src/rulesets/schema/on-call-handoff.schema.json"
       ],
       "validationCommands": [
-        "cat product/operations/chaos-experiments/cpu-stress.yaml"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created 3 Chaos Mesh CRD experiments: CPU stress, network partition, pod kill."
+      "closureNote": "Created rollback rehearsal and on-call handoff templates with schemas."
     },
     {
-      "id": "GT-237",
+      "id": "GT-219",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "reference/core/architecture/adrs/ai-augmented/0001-harness-engineering.md",
-        "reference/core/architecture/adrs/ai-augmented/0002-mcp-integration-protocol.md",
-        "reference/core/architecture/adrs/ai-augmented/0003-model-selection-governance.md",
-        "reference/core/architecture/adrs/ai-augmented/0004-agents-md-mandatory-artifact.md",
-        "reference/core/architecture/adrs/ai-augmented/0005-human-in-the-loop-policy.md"
+        "src/rulesets/topologies/agentic-ai/topology.manifest.json",
+        "src/rulesets/schema/topology-manifest.schema.json"
       ],
       "validationCommands": [
-        "ls reference/core/architecture/adrs/ai-augmented/000*.md"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created 5 AI-Augmented ADRs with EN/ES versions."
+      "closureNote": "Added operationalBudgets to agentic-ai manifest with AI-specific fields."
     },
     {
-      "id": "GT-238",
+      "id": "GT-220",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "product/infra/docker-compose.yml",
-        "product/operations/otel/prometheus-config.yml"
+        "src/sdk/cli/src/commands/sdlc/gate-status.command.spec.ts",
+        "src/sdk/cli/jest.config.js"
       ],
       "validationCommands": [
-        "grep -c 'prometheus' product/infra/docker-compose.yml"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Added Prometheus and Mimir services to docker-compose with scrape config."
+      "closureNote": "Raised gate-status branch coverage from 40% to 91.42%."
     },
     {
-      "id": "GT-239",
+      "id": "GT-221",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "product/operations/slo/core-api-slo.md",
-        "product/operations/alerts/prometheus-alerts.yml"
+        "src/packages/mcp-server/src/mcp/audit-logger.ts",
+        "src/packages/mcp-server/src/mcp/mcp-server.service.ts"
       ],
       "validationCommands": [
-        "ls product/operations/slo/ product/operations/alerts/"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Defined SLOs for Core API and created Prometheus alerting rules."
+      "closureNote": "Created AuditLogger service with structured events for MCP tool calls."
     },
     {
-      "id": "GT-243",
+      "id": "GT-222",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "product/operations/load-tests/api-throughput-baseline.js",
-        "product/operations/load-tests/mcp-concurrent-connections.js",
-        "product/operations/load-tests/cli-batch-operations.js"
+        "reference/core/architecture/topologies/progressive-axis/modular-monolith/modular-monolith.test.rego",
+        "reference/core/architecture/topologies/progressive-axis/distributed-modules/distributed-modules.test.rego",
+        "src/rulesets/topologies/agentic-ai/agentic-ai.test.rego"
+      ],
+      "validationCommands": [
+        "echo validated"
+      ],
+      "dependencyDisposition": "none",
+      "closureNote": "Added 19 new OPA test cases for under-covered topologies."
+    },
+    {
+      "id": "GT-223",
+      "closedAt": "2026-06-23",
+      "closureCommit": "f1d9814f",
+      "evidence": [
+        "src/sdk/cli/test/e2e/surface-parity.e2e-spec.ts"
+      ],
+      "validationCommands": [
+        "echo validated"
+      ],
+      "dependencyDisposition": "none",
+      "closureNote": "Created cross-surface parity e2e tests for 5 core operations."
+    },
+    {
+      "id": "GT-224",
+      "closedAt": "2026-06-23",
+      "closureCommit": "f1d9814f",
+      "evidence": [
+        "src/sdk/cli/src/commands/drift/drift.command.ts",
+        "src/sdk/cli/src/commands/architecture/scaffold.command.ts",
+        "src/sdk/cli/src/commands/docs/docs.command.ts"
       ],
       "validationCommands": [
-        "node --check product/operations/load-tests/api-throughput-baseline.js"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created 3 k6 load test scripts."
+      "closureNote": "Added --format json to drift, scaffold, and docs commands."
     },
     {
-      "id": "GT-244",
+      "id": "GT-225",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "product/operations/incident-response-service-outage.md",
-        "product/operations/incident-response-data-breach.md",
-        "product/operations/incident-response-dependency-cve.md",
-        "product/operations/incident-response-production-rollback.md"
+        "src/sdk/cli/src/infrastructure/prompts/wizard.service.spec.ts"
       ],
       "validationCommands": [
-        "ls product/operations/incident-response-*.md"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created 4 incident response playbooks."
+      "closureNote": "Removed 4 it.skip cases and fixed root cause (missing TTY mock)."
     },
     {
-      "id": "GT-245",
+      "id": "GT-226",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        ".github/workflows/sdk-cli-ci.yml"
+        ".github/dependabot.yml"
       ],
       "validationCommands": [
-        "grep -c dast-scan .github/workflows/sdk-cli-ci.yml"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Added DAST scan job."
+      "closureNote": "Created Dependabot configuration for npm and GitHub Actions."
     },
     {
-      "id": "GT-247",
+      "id": "GT-227",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "product/infra/docker-compose.yml",
-        "product/infra/.env.example"
+        ".github/workflows/sdk-cli-ci.yml"
       ],
       "validationCommands": [
-        "grep -c ENV product/infra/docker-compose.yml"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Replaced hardcoded passwords."
+      "closureNote": "Added CodeQL analysis, Trivy scan, and DAST scan jobs to CI."
     },
     {
-      "id": "GT-248",
-      "closedAt": "2026-06-23",
-      "closureCommit": "f1d9814f",
+      "id": "GT-228",
+      "closedAt": "2026-06-24",
+      "closureCommit": "593f5a6e",
       "evidence": [
-        ".harness/scripts/adr-freshness-monitor.mjs"
+        ".bmad-core/engine/index.mjs",
+        ".bmad-core/engine/orchestrate.mjs"
       ],
       "validationCommands": [
-        "node .harness/scripts/adr-freshness-monitor.mjs"
+        "ls .bmad-core/engine/"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created ADR freshness monitor."
+      "closureNote": "Full orchestration engine: parser, state machine, step executor, artifact registry, handoff enforcer. CLI wrapper added."
     },
     {
-      "id": "GT-240",
-      "closedAt": "2026-06-23",
-      "closureCommit": "f1d9814f",
+      "id": "GT-229",
+      "closedAt": "2026-06-24",
+      "closureCommit": "6ba915c1",
       "evidence": [
-        "src/apps/core-api/src/main.ts",
-        "src/apps/core-api/src/infrastructure/config/env.validation.ts"
+        "src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/native-opa-parity.spec.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/aggregator-parity.spec.ts",
+        "src/packages/core-domain/test/parity-fixtures/",
+        ".harness/scripts/ci/28-native-evaluator-parity.mjs"
       ],
       "validationCommands": [
-        "grep -c CORS_ORIGINS src/apps/core-api/src/main.ts"
+        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='native-opa-parity' --no-coverage",
+        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='aggregator-parity' --no-coverage",
+        "node .harness/scripts/ci/28-native-evaluator-parity.mjs"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Implemented environment-based CORS configuration."
+      "closureNote": "NativeEvaluator with 12 domain handlers, 17 parity fixtures, 65 passing tests, CI parity gate passing."
     },
     {
-      "id": "GT-241",
+      "id": "GT-230",
       "closedAt": "2026-06-23",
-      "closureCommit": "f1d9814f",
+      "closureCommit": "49f55404",
       "evidence": [
-        ".github/workflows/sdk-cli-release.yml"
+        "reference/core/foundations/agent-skills/manifest.json",
+        "reference/core/foundations/agent-skills/requirements-traceability-mapper.md",
+        "reference/core/foundations/agent-skills/gap-prioritization-engine.md",
+        "reference/core/foundations/agent-skills/adr-freshness-monitor.md",
+        "reference/core/foundations/agent-skills/analyst.md",
+        "reference/core/foundations/agent-skills/po.md",
+        "reference/core/foundations/agent-skills/architect.md"
       ],
       "validationCommands": [
-        "grep -c cyclonedx .github/workflows/sdk-cli-release.yml"
+        "node .harness/scripts/skills/adr-freshness-monitor.mjs --help"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Added CycloneDX SBOM generation step."
+      "closureNote": "Created composable skills framework with manifest.json, 3 reference skills (EN/ES), 3 scripts, and updated agent personas with skills field."
     },
     {
-      "id": "GT-242",
+      "id": "GT-231",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "src/rulesets/opa/hexagonal-architecture.rego",
-        "src/rulesets/opa/cicd-quality-gates.rego",
-        "src/rulesets/opa/multi-tenancy.rego",
-        "src/rulesets/opa/testing-pyramid.rego",
-        "src/rulesets/opa/protocol-selection.rego",
-        "src/rulesets/opa/multi-runtime.rego",
-        "src/rulesets/opa/gitflow-branching.rego",
-        "src/rulesets/opa/executive-scorecards.rego",
-        "src/rulesets/opa/open-core-boundary.rego",
-        "src/rulesets/opa/satellite-contracts.rego",
-        "src/rulesets/opa/cli-core-parity.rego",
-        "src/rulesets/opa/cli-release-readiness.rego"
+        ".github/workflows/docs.yml",
+        ".github/workflows/sdk-cli-ci.yml"
       ],
       "validationCommands": [
-        ".harness/bin/opa test src/rulesets/opa/ -v"
+        "echo validated"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created 12 OPA policies for all previously uncovered native rulesets."
+      "closureNote": "Created governance CI workflow running 12 unlinked scripts."
     },
     {
       "id": "GT-232",
@@ -3765,6 +3382,20 @@
       "dependencyDisposition": "none",
       "closureNote": "Created Winston and PO persona definitions."
     },
+    {
+      "id": "GT-233",
+      "closedAt": "2026-06-21",
+      "closureCommit": "b443dcd2",
+      "evidence": [
+        "src/apps/core-api/src/app.module.ts",
+        "src/apps/core-api/src/infrastructure/guards/audit-throttler.guard.ts"
+      ],
+      "validationCommands": [
+        "grep ThrottlerModule src/apps/core-api/src/app.module.ts"
+      ],
+      "dependencyDisposition": "none",
+      "closureNote": "ThrottlerModule configured with ttl:60000, limit:100. AuditThrottlerGuard registered globally."
+    },
     {
       "id": "GT-234",
       "closedAt": "2026-06-23",
@@ -3796,197 +3427,202 @@
       "closureNote": "Renamed 6 CI scripts to resolve numbering collisions."
     },
     {
-      "id": "GT-216",
+      "id": "GT-236",
       "closedAt": "2026-06-23",
-      "closureCommit": "f1d9814f",
+      "closureCommit": "266f4357",
       "evidence": [
-        "src/rulesets/opa/hexagonal-architecture.rego",
-        "src/rulesets/opa/cicd-quality-gates.rego",
-        "src/rulesets/opa/multi-tenancy.rego",
-        "src/rulesets/opa/testing-pyramid.rego",
-        "src/rulesets/opa/protocol-selection.rego",
-        "src/rulesets/opa/multi-runtime.rego",
-        "src/rulesets/opa/gitflow-branching.rego",
-        "src/rulesets/opa/executive-scorecards.rego",
-        "src/rulesets/opa/open-core-boundary.rego",
-        "src/rulesets/opa/satellite-contracts.rego",
-        "src/rulesets/opa/cli-core-parity.rego",
-        "src/rulesets/opa/cli-release-readiness.rego"
+        ".github/workflows/knowledge-intake.yml",
+        ".harness/scripts/knowledge-promote.mjs",
+        ".harness/scripts/knowledge-winston-review.mjs",
+        "product/operations/knowledge-intake-automation.md"
       ],
       "validationCommands": [
-        "echo validated"
+        "node .harness/scripts/ci/17-validate-knowledge-intake.mjs"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created 17 OPA policies + input schemas for all uncovered native rulesets."
+      "closureNote": "Automated knowledge intake pipeline with CI workflow, promotion script, Winston review trigger, and --fix flag."
     },
     {
-      "id": "GT-217",
+      "id": "GT-237",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "reference/core/architecture/topologies/progressive-axis/modular-monolith/operations.md",
-        "src/rulesets/topologies/data-mesh/operations.md",
-        "src/rulesets/topologies/event-driven/operations.md"
+        "reference/core/architecture/adrs/ai-augmented/0001-harness-engineering.md",
+        "reference/core/architecture/adrs/ai-augmented/0002-mcp-integration-protocol.md",
+        "reference/core/architecture/adrs/ai-augmented/0003-model-selection-governance.md",
+        "reference/core/architecture/adrs/ai-augmented/0004-agents-md-mandatory-artifact.md",
+        "reference/core/architecture/adrs/ai-augmented/0005-human-in-the-loop-policy.md"
       ],
       "validationCommands": [
-        "echo validated"
+        "ls reference/core/architecture/adrs/ai-augmented/000*.md"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created 8 guidance files x 7 topologies x 2 languages = 112 files."
+      "closureNote": "Created 5 AI-Augmented ADRs with EN/ES versions."
     },
     {
-      "id": "GT-218",
+      "id": "GT-238",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "reference/core/sdlc/04-artifact-templates/rollback-rehearsal-template.md",
-        "reference/core/sdlc/04-artifact-templates/on-call-handoff-template.md",
-        "src/rulesets/schema/rollback-rehearsal.schema.json",
-        "src/rulesets/schema/on-call-handoff.schema.json"
+        "product/infra/docker-compose.yml",
+        "product/operations/otel/prometheus-config.yml"
       ],
       "validationCommands": [
-        "echo validated"
+        "grep -c 'prometheus' product/infra/docker-compose.yml"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created rollback rehearsal and on-call handoff templates with schemas."
+      "closureNote": "Added Prometheus and Mimir services to docker-compose with scrape config."
     },
     {
-      "id": "GT-219",
+      "id": "GT-239",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "src/rulesets/topologies/agentic-ai/topology.manifest.json",
-        "src/rulesets/schema/topology-manifest.schema.json"
+        "product/operations/slo/core-api-slo.md",
+        "product/operations/alerts/prometheus-alerts.yml"
       ],
       "validationCommands": [
-        "echo validated"
+        "ls product/operations/slo/ product/operations/alerts/"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Added operationalBudgets to agentic-ai manifest with AI-specific fields."
+      "closureNote": "Defined SLOs for Core API and created Prometheus alerting rules."
     },
     {
-      "id": "GT-220",
+      "id": "GT-240",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "src/sdk/cli/src/commands/sdlc/gate-status.command.spec.ts",
-        "src/sdk/cli/jest.config.js"
+        "src/apps/core-api/src/main.ts",
+        "src/apps/core-api/src/infrastructure/config/env.validation.ts"
       ],
       "validationCommands": [
-        "echo validated"
+        "grep -c CORS_ORIGINS src/apps/core-api/src/main.ts"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Raised gate-status branch coverage from 40% to 91.42%."
+      "closureNote": "Implemented environment-based CORS configuration."
     },
     {
-      "id": "GT-221",
+      "id": "GT-241",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "src/packages/mcp-server/src/mcp/audit-logger.ts",
-        "src/packages/mcp-server/src/mcp/mcp-server.service.ts"
+        ".github/workflows/sdk-cli-release.yml"
       ],
       "validationCommands": [
-        "echo validated"
+        "grep -c cyclonedx .github/workflows/sdk-cli-release.yml"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created AuditLogger service with structured events for MCP tool calls."
+      "closureNote": "Added CycloneDX SBOM generation step."
     },
     {
-      "id": "GT-222",
+      "id": "GT-242",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "reference/core/architecture/topologies/progressive-axis/modular-monolith/modular-monolith.test.rego",
-        "reference/core/architecture/topologies/progressive-axis/distributed-modules/distributed-modules.test.rego",
-        "src/rulesets/topologies/agentic-ai/agentic-ai.test.rego"
+        "src/rulesets/opa/hexagonal-architecture.rego",
+        "src/rulesets/opa/cicd-quality-gates.rego",
+        "src/rulesets/opa/multi-tenancy.rego",
+        "src/rulesets/opa/testing-pyramid.rego",
+        "src/rulesets/opa/protocol-selection.rego",
+        "src/rulesets/opa/multi-runtime.rego",
+        "src/rulesets/opa/gitflow-branching.rego",
+        "src/rulesets/opa/executive-scorecards.rego",
+        "src/rulesets/opa/open-core-boundary.rego",
+        "src/rulesets/opa/satellite-contracts.rego",
+        "src/rulesets/opa/cli-core-parity.rego",
+        "src/rulesets/opa/cli-release-readiness.rego"
       ],
       "validationCommands": [
-        "echo validated"
+        ".harness/bin/opa test src/rulesets/opa/ -v"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Added 19 new OPA test cases for under-covered topologies."
+      "closureNote": "Created 12 OPA policies for all previously uncovered native rulesets."
     },
     {
-      "id": "GT-223",
+      "id": "GT-243",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "src/sdk/cli/test/e2e/surface-parity.e2e-spec.ts"
+        "product/operations/load-tests/api-throughput-baseline.js",
+        "product/operations/load-tests/mcp-concurrent-connections.js",
+        "product/operations/load-tests/cli-batch-operations.js"
       ],
       "validationCommands": [
-        "echo validated"
+        "node --check product/operations/load-tests/api-throughput-baseline.js"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created cross-surface parity e2e tests for 5 core operations."
+      "closureNote": "Created 3 k6 load test scripts."
     },
     {
-      "id": "GT-224",
+      "id": "GT-244",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "src/sdk/cli/src/commands/drift/drift.command.ts",
-        "src/sdk/cli/src/commands/architecture/scaffold.command.ts",
-        "src/sdk/cli/src/commands/docs/docs.command.ts"
+        "product/operations/incident-response-service-outage.md",
+        "product/operations/incident-response-data-breach.md",
+        "product/operations/incident-response-dependency-cve.md",
+        "product/operations/incident-response-production-rollback.md"
       ],
       "validationCommands": [
-        "echo validated"
+        "ls product/operations/incident-response-*.md"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Added --format json to drift, scaffold, and docs commands."
+      "closureNote": "Created 4 incident response playbooks."
     },
     {
-      "id": "GT-225",
+      "id": "GT-245",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/prompts/wizard.service.spec.ts"
+        ".github/workflows/sdk-cli-ci.yml"
       ],
       "validationCommands": [
-        "echo validated"
+        "grep -c dast-scan .github/workflows/sdk-cli-ci.yml"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Removed 4 it.skip cases and fixed root cause (missing TTY mock)."
+      "closureNote": "Added DAST scan job."
     },
     {
-      "id": "GT-226",
+      "id": "GT-246",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        ".github/dependabot.yml"
+        "product/operations/chaos-experiments/cpu-stress.yaml",
+        "product/operations/chaos-experiments/network-partition.yaml",
+        "product/operations/chaos-experiments/pod-kill.yaml"
       ],
       "validationCommands": [
-        "echo validated"
+        "cat product/operations/chaos-experiments/cpu-stress.yaml"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created Dependabot configuration for npm and GitHub Actions."
+      "closureNote": "Created 3 Chaos Mesh CRD experiments: CPU stress, network partition, pod kill."
     },
     {
-      "id": "GT-227",
+      "id": "GT-247",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        ".github/workflows/sdk-cli-ci.yml"
+        "product/infra/docker-compose.yml",
+        "product/infra/.env.example"
       ],
       "validationCommands": [
-        "echo validated"
+        "grep -c ENV product/infra/docker-compose.yml"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Added CodeQL analysis, Trivy scan, and DAST scan jobs to CI."
+      "closureNote": "Replaced hardcoded passwords."
     },
     {
-      "id": "GT-231",
+      "id": "GT-248",
       "closedAt": "2026-06-23",
       "closureCommit": "f1d9814f",
       "evidence": [
-        ".github/workflows/docs.yml",
-        ".github/workflows/sdk-cli-ci.yml"
+        ".harness/scripts/adr-freshness-monitor.mjs"
       ],
       "validationCommands": [
-        "echo validated"
+        "node .harness/scripts/adr-freshness-monitor.mjs"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Created governance CI workflow running 12 unlinked scripts."
+      "closureNote": "Created ADR freshness monitor."
     },
     {
       "id": "GT-249",
@@ -4036,19 +3672,6 @@
       "dependencyDisposition": "none",
       "closureNote": "execSync replaced with execFileSync; SEMVER_REGEX validates version before use. Malicious version strings rejected."
     },
-    {
-      "id": "GT-253",
-      "closedAt": "2026-06-24",
-      "closureCommit": "866bbe8d",
-      "evidence": [
-        ".github/workflows/sdk-cli-ci.yml"
-      ],
-      "validationCommands": [
-        "grep trivy-action .github/workflows/sdk-cli-ci.yml"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "trivy-action pinned to @v0.36.0 instead of @master."
-    },
     {
       "id": "GT-252",
       "closedAt": "2026-06-24",
@@ -4063,31 +3686,17 @@
       "closureNote": "All 26 OPA policy packages imported into main.rego aggregator. 19 previously orphaned policies now wired."
     },
     {
-      "id": "GT-269",
+      "id": "GT-253",
       "closedAt": "2026-06-24",
-      "closureCommit": "fb97c4c3",
-      "evidence": [
-        "src/packages/core-domain/src/domain/gate-evidence.ts"
-      ],
-      "validationCommands": [
-        "grep createSuccessEnvelope src/packages/core-domain/src/domain/gate-evidence.ts"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "ADR-0073 contract types (SuccessEnvelope, ErrorEnvelope, OutputEnvelope) fully implemented."
-    },
-    {
-      "id": "GT-233",
-      "closedAt": "2026-06-21",
-      "closureCommit": "b443dcd2",
+      "closureCommit": "866bbe8d",
       "evidence": [
-        "src/apps/core-api/src/app.module.ts",
-        "src/apps/core-api/src/infrastructure/guards/audit-throttler.guard.ts"
+        ".github/workflows/sdk-cli-ci.yml"
       ],
       "validationCommands": [
-        "grep ThrottlerModule src/apps/core-api/src/app.module.ts"
+        "grep trivy-action .github/workflows/sdk-cli-ci.yml"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "ThrottlerModule configured with ttl:60000, limit:100. AuditThrottlerGuard registered globally."
+      "closureNote": "trivy-action pinned to @v0.36.0 instead of @master."
     },
     {
       "id": "GT-254",
@@ -4141,6 +3750,20 @@
       "dependencyDisposition": "none",
       "closureNote": "MongoDB image pinned to mongo:7.0. All infrastructure images now pinned."
     },
+    {
+      "id": "GT-258",
+      "closedAt": "2026-06-24",
+      "closureCommit": "dae62ce3",
+      "evidence": [
+        ".github/workflows/sdk-cli-ci.yml",
+        ".github/workflows/docs.yml"
+      ],
+      "validationCommands": [
+        "grep concurrency .github/workflows/sdk-cli-ci.yml"
+      ],
+      "dependencyDisposition": "none",
+      "closureNote": "All 11 GitHub Actions workflows have concurrency blocks."
+    },
     {
       "id": "GT-259",
       "closedAt": "2026-06-24",
@@ -4169,45 +3792,31 @@
       "closureNote": "PO agent Spanish language file created with full persona definition."
     },
     {
-      "id": "GT-258",
-      "closedAt": "2026-06-24",
-      "closureCommit": "dae62ce3",
-      "evidence": [
-        ".github/workflows/sdk-cli-ci.yml",
-        ".github/workflows/docs.yml"
-      ],
-      "validationCommands": [
-        "grep concurrency .github/workflows/sdk-cli-ci.yml"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "All 11 GitHub Actions workflows have concurrency blocks."
-    },
-    {
-      "id": "GT-228",
+      "id": "GT-261",
       "closedAt": "2026-06-24",
-      "closureCommit": "593f5a6e",
+      "closureCommit": "6fb9be1b",
       "evidence": [
-        ".bmad-core/engine/index.mjs",
-        ".bmad-core/engine/orchestrate.mjs"
+        "product/infra/docker-compose.yml"
       ],
       "validationCommands": [
-        "ls .bmad-core/engine/"
+        "grep deploy.resources product/infra/docker-compose.yml | wc -l"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Full orchestration engine: parser, state machine, step executor, artifact registry, handoff enforcer. CLI wrapper added."
+      "closureNote": "All Docker containers have deploy.resources.limits with memory and cpus."
     },
     {
-      "id": "GT-261",
+      "id": "GT-262",
       "closedAt": "2026-06-24",
       "closureCommit": "6fb9be1b",
       "evidence": [
-        "product/infra/docker-compose.yml"
+        "product/operations/data-store-backup-dr.md",
+        "product/operations/data-store-backup-dr.es.md"
       ],
       "validationCommands": [
-        "grep deploy.resources product/infra/docker-compose.yml | wc -l"
+        "ls product/operations/data-store-backup-dr.md"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "All Docker containers have deploy.resources.limits with memory and cpus."
+      "closureNote": "Comprehensive backup/DR procedures for PostgreSQL, MongoDB, MinIO, OpenBao with RPO/RTO targets."
     },
     {
       "id": "GT-263",
@@ -4223,31 +3832,33 @@
       "closureNote": "12 Prometheus alert rules across infrastructure and core-api groups."
     },
     {
-      "id": "GT-265",
-      "closedAt": "2026-06-24",
-      "closureCommit": "866bbe8d",
+      "id": "GT-264",
+      "closedAt": "2026-06-25",
+      "closureCommit": "bbd2e517",
       "evidence": [
-        ".github/workflows/sdk-cli-ci.yml"
+        ".github/workflows/sdk-cli-ci.yml",
+        "reference/core/control-center/gaps/gap-reference-catalog.md",
+        "reference/core/control-center/gaps/gap-reference-catalog.es.md"
       ],
       "validationCommands": [
-        "grep gitleaks .github/workflows/sdk-cli-ci.yml"
+        "rg -n \"dast-scan|zaproxy/action-full-scan|gitleaks\" .github/workflows/sdk-cli-ci.yml",
+        "rg -n \"#### GT-273|long-term DAST plan|plan DAST de largo plazo\" reference/core/control-center/gaps/gap-reference-catalog.md reference/core/control-center/gaps/gap-reference-catalog.es.md"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "gitleaks/gitleaks-action@v2 with full history scanning (fetch-depth: 0) in CI."
+      "closureNote": "DAST (OWASP ZAP) scan removed from sdk-cli-ci.yml. The step scanned against localhost:8000 without a server running, producing a silent no-op. Replaced by gitleaks secret detection (GT-265) and Trivy container scanning (GT-227) as higher-signal security controls. Long-term DAST plan tracked as GT-273."
     },
     {
-      "id": "GT-262",
+      "id": "GT-265",
       "closedAt": "2026-06-24",
-      "closureCommit": "6fb9be1b",
+      "closureCommit": "866bbe8d",
       "evidence": [
-        "product/operations/data-store-backup-dr.md",
-        "product/operations/data-store-backup-dr.es.md"
+        ".github/workflows/sdk-cli-ci.yml"
       ],
       "validationCommands": [
-        "ls product/operations/data-store-backup-dr.md"
+        "grep gitleaks .github/workflows/sdk-cli-ci.yml"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "Comprehensive backup/DR procedures for PostgreSQL, MongoDB, MinIO, OpenBao with RPO/RTO targets."
+      "closureNote": "gitleaks/gitleaks-action@v2 with full history scanning (fetch-depth: 0) in CI."
     },
     {
       "id": "GT-266",
@@ -4264,25 +3875,6 @@
       "dependencyDisposition": "none",
       "closureNote": "ApiKeyProvisioningService with evk_ prefix, SHA-256 hashed storage, rotation, revocation, audit logging, and legacy migration."
     },
-    {
-      "id": "GT-268",
-      "closedAt": "2026-06-25",
-      "closureCommit": "98d60390",
-      "evidence": [
-        ".harness/scripts/bilingual-coverage.mjs",
-        ".harness/scripts/coverage-dashboard.mjs",
-        ".harness/scripts/ci/26-validate-topology-rule-coverage.mjs",
-        ".harness/scripts/generate-rule-coverage.mjs",
-        ".harness/scripts/generate-rule-coverage.test.mjs"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/bilingual-coverage.mjs",
-        "node .harness/scripts/coverage-dashboard.mjs",
-        "node .harness/scripts/ci/26-validate-topology-rule-coverage.mjs"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "All 3 missing CI scripts recovered from git history (deleted in 79af9929). bilingual-coverage reports 100% coverage, coverage-dashboard generates COVERAGE_REPORT.md, topology-rule-coverage validates all 8 topologies with 0 errors."
-    },
     {
       "id": "GT-267",
       "closedAt": "2026-06-26",
@@ -4310,121 +3902,74 @@
       "dependencyRationale": "Core API and MCP Server cache dependencies are declared in their workspace manifests and locked in package-lock.json."
     },
     {
-      "id": "GT-270",
-      "closedAt": "2026-06-25",
-      "closureCommit": "c5f42067",
-      "evidence": [
-        "product/infra/helm/evolith-core-api/values.yaml",
-        "product/infra/helm/evolith-mcp/values.yaml",
-        "product/infra/docker-compose.yml"
-      ],
-      "validationCommands": [
-        "grep tag: reference/infrastructure/helm/evolith-bff/values.yaml",
-        "grep opa: reference/infrastructure/helm/evolith-bff/values.yaml"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "Helm app images pinned to 1.1.0, OPA sidecar pinned to 0.65.0. Traefik --api.insecure=true removed. Grafana anonymous auth disabled."
-    },
-    {
-      "id": "GT-264",
+      "id": "GT-268",
       "closedAt": "2026-06-25",
-      "closureCommit": "bbd2e517",
+      "closureCommit": "98d60390",
       "evidence": [
-        ".github/workflows/sdk-cli-ci.yml",
-        "reference/core/control-center/gaps/gap-reference-catalog.md",
-        "reference/core/control-center/gaps/gap-reference-catalog.es.md"
+        ".harness/scripts/bilingual-coverage.mjs",
+        ".harness/scripts/coverage-dashboard.mjs",
+        ".harness/scripts/ci/26-validate-topology-rule-coverage.mjs",
+        ".harness/scripts/generate-rule-coverage.mjs",
+        ".harness/scripts/generate-rule-coverage.test.mjs"
       ],
       "validationCommands": [
-        "rg -n \"dast-scan|zaproxy/action-full-scan|gitleaks\" .github/workflows/sdk-cli-ci.yml",
-        "rg -n \"#### GT-273|long-term DAST plan|plan DAST de largo plazo\" reference/core/control-center/gaps/gap-reference-catalog.md reference/core/control-center/gaps/gap-reference-catalog.es.md"
+        "node .harness/scripts/bilingual-coverage.mjs",
+        "node .harness/scripts/coverage-dashboard.mjs",
+        "node .harness/scripts/ci/26-validate-topology-rule-coverage.mjs"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "DAST (OWASP ZAP) scan removed from sdk-cli-ci.yml. The step scanned against localhost:8000 without a server running, producing a silent no-op. Replaced by gitleaks secret detection (GT-265) and Trivy container scanning (GT-227) as higher-signal security controls. Long-term DAST plan tracked as GT-273."
+      "closureNote": "All 3 missing CI scripts recovered from git history (deleted in 79af9929). bilingual-coverage reports 100% coverage, coverage-dashboard generates COVERAGE_REPORT.md, topology-rule-coverage validates all 8 topologies with 0 errors."
     },
     {
-      "id": "GT-229",
+      "id": "GT-269",
       "closedAt": "2026-06-24",
-      "closureCommit": "6ba915c1",
+      "closureCommit": "fb97c4c3",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/native-opa-parity.spec.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/aggregator-parity.spec.ts",
-        "src/packages/core-domain/test/parity-fixtures/",
-        ".harness/scripts/ci/28-native-evaluator-parity.mjs"
+        "src/packages/core-domain/src/domain/gate-evidence.ts"
       ],
       "validationCommands": [
-        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='native-opa-parity' --no-coverage",
-        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='aggregator-parity' --no-coverage",
-        "node .harness/scripts/ci/28-native-evaluator-parity.mjs"
+        "grep createSuccessEnvelope src/packages/core-domain/src/domain/gate-evidence.ts"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "NativeEvaluator with 12 domain handlers, 17 parity fixtures, 65 passing tests, CI parity gate passing."
+      "closureNote": "ADR-0073 contract types (SuccessEnvelope, ErrorEnvelope, OutputEnvelope) fully implemented."
     },
     {
-      "id": "GT-271",
+      "id": "GT-270",
       "closedAt": "2026-06-25",
-      "closureCommit": "2d510597",
+      "closureCommit": "c5f42067",
       "evidence": [
-        "product/infra/helm/evolith-core-api/templates/deployment.yaml",
-        "product/infra/helm/evolith-core-api/templates/hpa.yaml",
-        "product/infra/helm/evolith-core-api/templates/networkpolicy.yaml",
-        "product/infra/helm/evolith-core-api/templates/pdb.yaml",
         "product/infra/helm/evolith-core-api/values.yaml",
-        "product/infra/helm/evolith-mcp/templates/deployment.yaml",
-        "product/infra/helm/evolith-mcp/templates/hpa.yaml",
-        "product/infra/helm/evolith-mcp/templates/networkpolicy.yaml",
-        "product/infra/helm/evolith-mcp/templates/pdb.yaml",
-        "product/infra/helm/evolith-mcp/values.yaml"
-      ],
-      "validationCommands": [
-        "rg -n \"runAsNonRoot|readOnlyRootFilesystem|allowPrivilegeEscalation|livenessProbe|readinessProbe|startupProbe|resources:|kind: (HorizontalPodAutoscaler|PodDisruptionBudget|NetworkPolicy)\" reference/infrastructure/helm/evolith-bff reference/infrastructure/helm/evolith-mcp"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "BFF and MCP Helm charts define resources, probes, security contexts, NetworkPolicy, PodDisruptionBudget, and optional HPA defaults."
-    },
-    {
-      "id": "GT-20",
-      "closedAt": "2026-06-25",
-      "closureCommit": "2d510597",
-      "evidence": [
-        "reference/core/architecture/adrs/",
-        "reference/core/control-center/gaps/gap-reference-catalog.md",
-        "reference/core/control-center/gaps/gap-reference-catalog.es.md"
-      ],
-      "validationCommands": [
-        "rg -n \"GT-20\" reference/core/architecture/adrs"
-      ],
-      "dependencyDisposition": "none",
-      "closureNote": "ADR corpus backfill completed; only ADR authoring standard references to GT-20 remain as historical tracking links."
-    },
-    {
-      "id": "GT-274",
-      "closedAt": "2026-06-25",
-      "closureCommit": "60221b30",
-      "evidence": [
-        ".harness/scripts/cleanup-temp-files.mjs",
-        ".harness/scripts/cleanup-temp-files.test.mjs",
-        ".harness/playbooks/winston-audit-playbook.md",
-        ".harness/playbooks/winston-audit-playbook.es.md"
+        "product/infra/helm/evolith-mcp/values.yaml",
+        "product/infra/docker-compose.yml"
       ],
       "validationCommands": [
-        "node --test .harness/scripts/cleanup-temp-files.test.mjs"
+        "grep tag: reference/infrastructure/helm/evolith-bff/values.yaml",
+        "grep opa: reference/infrastructure/helm/evolith-bff/values.yaml"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "isInTempDir uses path-segment matching; isTrackedFile guard added to TEMP_DIRS_SPECIFIC loop; both functions accept injectable root for testability; main() guarded with import.meta.url; 8/8 regression tests pass proving bilingual-coverage.mjs, coverage-dashboard.mjs, and 26-validate-topology-rule-coverage.mjs are never deleted; Winston playbook updated with BLOQUEANTE warning."
+      "closureNote": "Helm app images pinned to 1.1.0, OPA sidecar pinned to 0.65.0. Traefik --api.insecure=true removed. Grafana anonymous auth disabled."
     },
     {
-      "id": "GT-273",
+      "id": "GT-271",
       "closedAt": "2026-06-25",
-      "closureCommit": "426db1d9",
+      "closureCommit": "2d510597",
       "evidence": [
-        ".github/workflows/sdk-cli-ci.yml"
+        "product/infra/helm/evolith-core-api/templates/deployment.yaml",
+        "product/infra/helm/evolith-core-api/templates/hpa.yaml",
+        "product/infra/helm/evolith-core-api/templates/networkpolicy.yaml",
+        "product/infra/helm/evolith-core-api/templates/pdb.yaml",
+        "product/infra/helm/evolith-core-api/values.yaml",
+        "product/infra/helm/evolith-mcp/templates/deployment.yaml",
+        "product/infra/helm/evolith-mcp/templates/hpa.yaml",
+        "product/infra/helm/evolith-mcp/templates/networkpolicy.yaml",
+        "product/infra/helm/evolith-mcp/templates/pdb.yaml",
+        "product/infra/helm/evolith-mcp/values.yaml"
       ],
       "validationCommands": [
-        "ZAP scan runs as Job 12 (dast-scan) in sdk-cli-ci.yml, building MCP server ephemerally on port 3001 and scanning http://localhost:3001"
+        "rg -n \"runAsNonRoot|readOnlyRootFilesystem|allowPrivilegeEscalation|livenessProbe|readinessProbe|startupProbe|resources:|kind: (HorizontalPodAutoscaler|PodDisruptionBudget|NetworkPolicy)\" reference/infrastructure/helm/evolith-bff reference/infrastructure/helm/evolith-mcp"
       ],
       "dependencyDisposition": "none",
-      "closureNote": "DAST scan restored via ephemeral MCP server in CI. Job 12 in sdk-cli-ci.yml spins up MCP on port 3001, runs zaproxy/action-full-scan@v0.10.0, uploads report.html/report.md as artifacts. continue-on-error: true so CI gate is not blocked."
+      "closureNote": "BFF and MCP Helm charts define resources, probes, security contexts, NetworkPolicy, PodDisruptionBudget, and optional HPA defaults."
     },
     {
       "id": "GT-272",
@@ -4452,6 +3997,35 @@
       "dependencyDisposition": "none",
       "closureNote": "OPA sidecar bundle defaults now use HTTPS in-cluster MinIO, secret-backed S3 credentials, RS256 bundle signature verification, expected SHA-256 digest metadata, /health?bundles fail-closed readiness, and a CI gate that validates rendered Helm values with both Native Node.js checks and OPA policy."
     },
+    {
+      "id": "GT-273",
+      "closedAt": "2026-06-25",
+      "closureCommit": "426db1d9",
+      "evidence": [
+        ".github/workflows/sdk-cli-ci.yml"
+      ],
+      "validationCommands": [
+        "ZAP scan runs as Job 12 (dast-scan) in sdk-cli-ci.yml, building MCP server ephemerally on port 3001 and scanning http://localhost:3001"
+      ],
+      "dependencyDisposition": "none",
+      "closureNote": "DAST scan restored via ephemeral MCP server in CI. Job 12 in sdk-cli-ci.yml spins up MCP on port 3001, runs zaproxy/action-full-scan@v0.10.0, uploads report.html/report.md as artifacts. continue-on-error: true so CI gate is not blocked."
+    },
+    {
+      "id": "GT-274",
+      "closedAt": "2026-06-25",
+      "closureCommit": "60221b30",
+      "evidence": [
+        ".harness/scripts/cleanup-temp-files.mjs",
+        ".harness/scripts/cleanup-temp-files.test.mjs",
+        ".harness/playbooks/winston-audit-playbook.md",
+        ".harness/playbooks/winston-audit-playbook.es.md"
+      ],
+      "validationCommands": [
+        "node --test .harness/scripts/cleanup-temp-files.test.mjs"
+      ],
+      "dependencyDisposition": "none",
+      "closureNote": "isInTempDir uses path-segment matching; isTrackedFile guard added to TEMP_DIRS_SPECIFIC loop; both functions accept injectable root for testability; main() guarded with import.meta.url; 8/8 regression tests pass proving bilingual-coverage.mjs, coverage-dashboard.mjs, and 26-validate-topology-rule-coverage.mjs are never deleted; Winston playbook updated with BLOQUEANTE warning."
+    },
     {
       "id": "GT-275",
       "closedAt": "2026-06-26",
@@ -4552,6 +4126,98 @@
       ],
       "dependencyDisposition": "none"
     },
+    {
+      "id": "GT-280",
+      "closedAt": "2026-06-25",
+      "closureCommit": "661a8846",
+      "evidence": [
+        "reference/governance/sdlc/gates/gate-f1.json",
+        "reference/governance/sdlc/gates/gate-f5.json",
+        "reference/core/sdlc/sdlc-phase.schema.json",
+        "reference/core/sdlc/sdlc-gate.schema.json",
+        ".harness/playbooks/sdlc-phase-gate-validator.mjs",
+        "src/rulesets/opa/sdlc/coverage.rego",
+        "src/rulesets/opa/sdlc/pyramid-distribution.rego"
+      ],
+      "validationCommands": [
+        "node .harness/playbooks/sdlc-phase-gate-validator.mjs",
+        "node .harness/scripts/run-evolith-deep.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-281",
+      "closedAt": "2026-06-25",
+      "closureCommit": "661a8846",
+      "evidence": [
+        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts",
+        "src/packages/core-domain/src/application/services/sdlc-data-loader.service.ts",
+        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.spec.ts",
+        "src/packages/core-domain/src/application/use-cases/validate-satellite.use-case.ts",
+        "src/packages/core-domain/src/domain/satellite-manifest.ts",
+        "src/packages/mcp-server/src/tools/validate.tool.ts",
+        "src/sdk/cli/src/commands/validate/validate.command.ts"
+      ],
+      "validationCommands": [
+        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='satellite-evaluation-pipeline' --no-coverage",
+        "node .harness/scripts/run-evolith-deep.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-282",
+      "closedAt": "2026-06-25",
+      "closureCommit": "661a8846",
+      "evidence": [
+        "src/packages/core-domain/src/domain/satellite-manifest.ts",
+        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts",
+        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.spec.ts",
+        "src/packages/mcp-server/src/tools/validate.tool.ts",
+        "src/sdk/cli/src/commands/validate/validate.command.ts",
+        ".harness/playbooks/sdlc-deep-audit.mjs"
+      ],
+      "validationCommands": [
+        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='satellite-evaluation-pipeline' --no-coverage",
+        "node .harness/scripts/run-evolith-deep.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-283",
+      "closedAt": "2026-06-26",
+      "closureCommit": "856912b9",
+      "evidence": [
+        "src/rulesets/topologies/progressive-axis/modular-monolith/modular-monolith.rules.json"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/26-validate-topology-rule-coverage.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-284",
+      "closedAt": "2026-06-26",
+      "closureCommit": "856912b9",
+      "evidence": [
+        "src/rulesets/topologies/progressive-axis/distributed-modules/distributed-modules.rules.json"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/26-validate-topology-rule-coverage.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-285",
+      "closedAt": "2026-06-26",
+      "closureCommit": "856912b9",
+      "evidence": [
+        "src/rulesets/topologies/progressive-axis/microservices/microservices.rules.json"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/26-validate-topology-rule-coverage.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
     {
       "id": "GT-286",
       "closedAt": "2026-06-26",
@@ -4678,134 +4344,21 @@
       ],
       "dependencyDisposition": "none"
     },
-    {
-      "id": "GT-280",
-      "closedAt": "2026-06-25",
-      "closureCommit": "661a8846",
-      "evidence": [
-        "reference/governance/sdlc/gates/gate-f1.json",
-        "reference/governance/sdlc/gates/gate-f5.json",
-        "reference/core/sdlc/sdlc-phase.schema.json",
-        "reference/core/sdlc/sdlc-gate.schema.json",
-        ".harness/playbooks/sdlc-phase-gate-validator.mjs",
-        "src/rulesets/opa/sdlc/coverage.rego",
-        "src/rulesets/opa/sdlc/pyramid-distribution.rego"
-      ],
-      "validationCommands": [
-        "node .harness/playbooks/sdlc-phase-gate-validator.mjs",
-        "node .harness/scripts/run-evolith-deep.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-281",
-      "closedAt": "2026-06-25",
-      "closureCommit": "661a8846",
-      "evidence": [
-        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts",
-        "src/packages/core-domain/src/application/services/sdlc-data-loader.service.ts",
-        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.spec.ts",
-        "src/packages/core-domain/src/application/use-cases/validate-satellite.use-case.ts",
-        "src/packages/core-domain/src/domain/satellite-manifest.ts",
-        "src/packages/mcp-server/src/tools/validate.tool.ts",
-        "src/sdk/cli/src/commands/validate/validate.command.ts"
-      ],
-      "validationCommands": [
-        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='satellite-evaluation-pipeline' --no-coverage",
-        "node .harness/scripts/run-evolith-deep.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-282",
-      "closedAt": "2026-06-25",
-      "closureCommit": "661a8846",
-      "evidence": [
-        "src/packages/core-domain/src/domain/satellite-manifest.ts",
-        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts",
-        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.spec.ts",
-        "src/packages/mcp-server/src/tools/validate.tool.ts",
-        "src/sdk/cli/src/commands/validate/validate.command.ts",
-        ".harness/playbooks/sdlc-deep-audit.mjs"
-      ],
-      "validationCommands": [
-        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='satellite-evaluation-pipeline' --no-coverage",
-        "node .harness/scripts/run-evolith-deep.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-312",
-      "closedAt": "2026-06-26",
-      "closureCommit": "00bb08d5",
-      "evidence": [
-        "src/packages/core-domain/src/application/validators/modes/composable-validation-engine.ts",
-        "src/packages/core-domain/src/application/validators/modes/composable-validation-engine.spec.ts",
-        "src/packages/core-domain/src/application/validators/modes/sdlc-validation.mode.spec.ts",
-        "src/packages/core-domain/src/application/validators/modes/architecture-validation.mode.spec.ts",
-        "src/packages/core-domain/src/application/validators/modes/ruleset-validation.mode.spec.ts",
-        "src/packages/core-domain/src/application/validators/modes/adr-validation.mode.spec.ts",
-        "src/packages/core-domain/src/application/validators/modes/adhoc-validation.mode.spec.ts",
-        "src/packages/mcp-server/src/tools/composable-validate.tool.ts",
-        "src/apps/core-api/src/presentation/controllers/composable-validate.controller.ts"
-      ],
-      "validationCommands": [
-        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='composable-validation-engine|sdlc-validation.mode|architecture-validation.mode|ruleset-validation.mode|adr-validation.mode|adhoc-validation.mode' --no-coverage",
-        "npx tsc -p src/packages/core-domain/tsconfig.json --noEmit"
-      ],
-      "dependencyDisposition": "none"
-    },
     {
       "id": "GT-292",
       "closedAt": "2026-06-26",
       "closureCommit": "cd40dd8b",
       "evidence": [
-        "src/rulesets/governance/satellite-contracts.rules.json",
-        "src/rulesets/governance/README.md",
-        "src/rulesets/governance/README.es.md",
-        "src/packages/core-domain/src/application/validators/modes/ruleset-validation.mode.ts",
-        "src/rulesets/README.md",
-        "src/rulesets/README.es.md"
-      ],
-      "validationCommands": [
-        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='ruleset-validation.mode' --no-coverage",
-        ".harness/bin/opa test src/rulesets/opa/satellite-contracts.rego src/rulesets/opa/satellite-contracts.test.rego -v"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-283",
-      "closedAt": "2026-06-26",
-      "closureCommit": "856912b9",
-      "evidence": [
-        "src/rulesets/topologies/progressive-axis/modular-monolith/modular-monolith.rules.json"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci/26-validate-topology-rule-coverage.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-284",
-      "closedAt": "2026-06-26",
-      "closureCommit": "856912b9",
-      "evidence": [
-        "src/rulesets/topologies/progressive-axis/distributed-modules/distributed-modules.rules.json"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci/26-validate-topology-rule-coverage.mjs"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-285",
-      "closedAt": "2026-06-26",
-      "closureCommit": "856912b9",
-      "evidence": [
-        "src/rulesets/topologies/progressive-axis/microservices/microservices.rules.json"
+        "src/rulesets/governance/satellite-contracts.rules.json",
+        "src/rulesets/governance/README.md",
+        "src/rulesets/governance/README.es.md",
+        "src/packages/core-domain/src/application/validators/modes/ruleset-validation.mode.ts",
+        "src/rulesets/README.md",
+        "src/rulesets/README.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/26-validate-topology-rule-coverage.mjs"
+        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='ruleset-validation.mode' --no-coverage",
+        ".harness/bin/opa test src/rulesets/opa/satellite-contracts.rego src/rulesets/opa/satellite-contracts.test.rego -v"
       ],
       "dependencyDisposition": "none"
     },
@@ -5037,6 +4590,41 @@
       ],
       "dependencyDisposition": "none"
     },
+    {
+      "id": "GT-312",
+      "closedAt": "2026-06-26",
+      "closureCommit": "00bb08d5",
+      "evidence": [
+        "src/packages/core-domain/src/application/validators/modes/composable-validation-engine.ts",
+        "src/packages/core-domain/src/application/validators/modes/composable-validation-engine.spec.ts",
+        "src/packages/core-domain/src/application/validators/modes/sdlc-validation.mode.spec.ts",
+        "src/packages/core-domain/src/application/validators/modes/architecture-validation.mode.spec.ts",
+        "src/packages/core-domain/src/application/validators/modes/ruleset-validation.mode.spec.ts",
+        "src/packages/core-domain/src/application/validators/modes/adr-validation.mode.spec.ts",
+        "src/packages/core-domain/src/application/validators/modes/adhoc-validation.mode.spec.ts",
+        "src/packages/mcp-server/src/tools/composable-validate.tool.ts",
+        "src/apps/core-api/src/presentation/controllers/composable-validate.controller.ts"
+      ],
+      "validationCommands": [
+        "npx jest --config src/packages/core-domain/jest.config.js --rootDir src/packages/core-domain --testPathPatterns='composable-validation-engine|sdlc-validation.mode|architecture-validation.mode|ruleset-validation.mode|adr-validation.mode|adhoc-validation.mode' --no-coverage",
+        "npx tsc -p src/packages/core-domain/tsconfig.json --noEmit"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-313",
+      "closedAt": "2026-06-28",
+      "closureCommit": "1ffb1064",
+      "evidence": [
+        "src/sdk/cli/src/commands/satellite/satellite-create.command.ts",
+        "src/sdk/cli/src/commands/satellite/satellite-adopt.command.ts"
+      ],
+      "validationCommands": [
+        "npm test --workspace src/sdk/cli -- --runInBand"
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "GH_TOKEN externalized to environment/secret (commit 1ffb1064); credential rotation deferred under owner-accepted risk."
+    },
     {
       "id": "GT-314",
       "closedAt": "2026-06-26",
@@ -5181,6 +4769,19 @@
       ],
       "dependencyDisposition": "none"
     },
+    {
+      "id": "GT-326",
+      "closedAt": "2026-06-28",
+      "closureCommit": "262d29d5",
+      "evidence": [
+        "src/packages/core-domain/src/__e2e__/governance-flow.e2e.spec.ts",
+        ".github/workflows/ci-cd.yml"
+      ],
+      "validationCommands": [
+        "npm run test:e2e --workspace @beyondnet/evolith-core-domain"
+      ],
+      "dependencyDisposition": "none"
+    },
     {
       "id": "GT-327",
       "closedAt": "2026-06-26",
@@ -5221,21 +4822,182 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-357",
+      "id": "GT-330",
       "closedAt": "2026-06-28",
-      "closureCommit": "f5261bbf",
+      "closureCommit": "2d7a6edc",
       "evidence": [
-        "reference/core/control-center/evidence/gap-closure-evidence.json",
-        "reference/core/control-center/maturity-reports/maturity-reconciliation.json",
-        ".harness/scripts/ci/08-validate-tracking.mjs",
-        ".harness/scripts/ci/09-reconcile-maturity.mjs"
+        "reference/core/sdlc/01-playbooks/e2e-test-playbooks.md",
+        "src/apps/core-api/test/app.e2e-spec.ts",
+        "src/packages/mcp-server/test/mcp-server.e2e-spec.ts",
+        "src/packages/core-domain/src/__e2e__/governance-flow.e2e.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/08-validate-tracking.mjs",
-        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check"
+        "npm run test:e2e --workspace @beyondnet/evolith-core-domain",
+        "npm run --workspace src/apps/core-api test:e2e",
+        "npm run --workspace src/packages/mcp-server build && npm run --workspace src/packages/mcp-server test:e2e",
+        "npm run --workspace src/sdk/cli test:e2e"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "GT-341 (inventory reconciliation) satisfied; GT-357 reconciles board status against executed build/test evidence (closure-evidence + maturity), which is independent of GT-347’s separate core-OPA-suite remediation."
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-331",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "src/packages/mcp-server/src/main.ts"
+      ],
+      "validationCommands": [
+        "npm run --workspace src/packages/mcp-server test"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-332",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "src/packages/mcp-server/src/mcp/mcp-tool-dispatch.ts"
+      ],
+      "validationCommands": [
+        "npm run --workspace src/packages/mcp-server test"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-333",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "src/packages/mcp-server/src/mcp/mcp-server-auth.ts"
+      ],
+      "validationCommands": [
+        "npm run --workspace src/packages/mcp-server test"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-334",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "src/packages/mcp-server/package.json"
+      ],
+      "validationCommands": [
+        "npm run --workspace src/packages/mcp-server build"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-335",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        ".harness/scripts/ci/08-validate-tracking.mjs"
+      ],
+      "validationCommands": [
+        "npm run --workspace packages/mcp-tools test"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-336",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "src/packages/sdk-client/src/rest/evolith-rest-client.ts"
+      ],
+      "validationCommands": [
+        "npm run --workspace src/packages/sdk-client test"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-337",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "src/packages/sdk-client/src/rest/types.ts"
+      ],
+      "validationCommands": [
+        "npm run --workspace src/packages/sdk-client test"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-338",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "src/packages/core/package.json",
+        "src/packages/core/README.md"
+      ],
+      "validationCommands": [
+        "npm test --workspace @beyondnet/evolith-core"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-339",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "src/apps/core-api/src/presentation/controllers/projects.controller.ts"
+      ],
+      "validationCommands": [
+        "npm test --workspace core-api"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-340",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "src/apps/core-api/test-setup.js"
+      ],
+      "validationCommands": [
+        "npm test --workspace core-api"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-341",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        ".harness/scripts/generate-product-inventory.mjs"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/07-generate-inventories.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-342",
+      "closedAt": "2026-06-28",
+      "closureCommit": "91cbd789",
+      "evidence": [
+        "README.md"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-343",
+      "closedAt": "2026-06-28",
+      "closureCommit": "95b5d51d",
+      "evidence": [
+        "src/packages/core-domain/src/domain/sdlc/phase-id.ts",
+        ".harness/scripts/ci/30-validate-phase-topology-disjoint.mjs",
+        "src/rulesets/schema/topology-manifest.schema.json"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/30-validate-phase-topology-disjoint.mjs",
+        "npm run --workspace src/packages/core-domain test"
+      ],
+      "dependencyDisposition": "none"
     },
     {
       "id": "GT-344",
@@ -5251,42 +5013,44 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-347",
+      "id": "GT-345",
       "closedAt": "2026-06-28",
-      "closureCommit": "c5998d1a",
+      "closureCommit": "92750656",
       "evidence": [
-        "src/rulesets/opa",
-        ".harness/scripts/ci/29-test-core-opa.mjs"
+        "src/sdk/cli/test/e2e/cli-e2e.test.ts",
+        "src/sdk/cli/src/commands/validate/validate.command.ts",
+        "src/sdk/cli/src/main.ts"
       ],
       "validationCommands": [
-        ".harness/bin/opa test src/rulesets/opa/ --ignore=schemas",
-        "node .harness/scripts/ci/29-test-core-opa.mjs"
+        "npm run --workspace src/sdk/cli test"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-358",
+      "id": "GT-346",
       "closedAt": "2026-06-28",
-      "closureCommit": "c5998d1a",
+      "closureCommit": "d34bc3a5",
       "evidence": [
-        "src/rulesets/opa"
+        "src/sdk/cli/src/infrastructure/cli/command-executor.ts",
+        "src/sdk/cli/src/infrastructure/cli/providers/index.ts",
+        "src/sdk/cli/src/infrastructure/cli/providers/providers.spec.ts"
       ],
       "validationCommands": [
-        ".harness/bin/opa test src/rulesets/opa/ --ignore=schemas"
+        "npm run --workspace src/sdk/cli test"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-345",
+      "id": "GT-347",
       "closedAt": "2026-06-28",
-      "closureCommit": "92750656",
+      "closureCommit": "c5998d1a",
       "evidence": [
-        "src/sdk/cli/test/e2e/cli-e2e.test.ts",
-        "src/sdk/cli/src/commands/validate/validate.command.ts",
-        "src/sdk/cli/src/main.ts"
+        "src/rulesets/opa",
+        ".harness/scripts/ci/29-test-core-opa.mjs"
       ],
       "validationCommands": [
-        "npm run --workspace src/sdk/cli test"
+        ".harness/bin/opa test src/rulesets/opa/ --ignore=schemas",
+        "node .harness/scripts/ci/29-test-core-opa.mjs"
       ],
       "dependencyDisposition": "none"
     },
@@ -5330,16 +5094,16 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-346",
+      "id": "GT-351",
       "closedAt": "2026-06-28",
-      "closureCommit": "d34bc3a5",
+      "closureCommit": "cb121075",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/cli/command-executor.ts",
-        "src/sdk/cli/src/infrastructure/cli/providers/index.ts",
-        "src/sdk/cli/src/infrastructure/cli/providers/providers.spec.ts"
+        "src/packages/infra-providers/src/disk-ruleset.repository.spec.ts",
+        "src/packages/infra-providers/README.md",
+        "src/packages/infra-providers/src/disk-ruleset.repository.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/sdk/cli test"
+        "npm run --workspace src/packages/infra-providers test"
       ],
       "dependencyDisposition": "none"
     },
@@ -5357,6 +5121,33 @@
       ],
       "dependencyDisposition": "none"
     },
+    {
+      "id": "GT-353",
+      "closedAt": "2026-06-28",
+      "closureCommit": "92dbbd15",
+      "evidence": [
+        "src/packages/sdk-client/README.md",
+        "src/packages/sdk-client/src/__tests__/sdk.spec.ts"
+      ],
+      "validationCommands": [
+        "npm run --workspace src/packages/sdk-client test"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-354",
+      "closedAt": "2026-06-28",
+      "closureCommit": "56546549",
+      "evidence": [
+        "src/apps/core-api/src/main.ts",
+        "product/products/core-api/api-reference.md"
+      ],
+      "validationCommands": [
+        "npm run --workspace src/apps/core-api build",
+        "npm run --workspace src/apps/core-api test"
+      ],
+      "dependencyDisposition": "none"
+    },
     {
       "id": "GT-355",
       "closedAt": "2026-06-28",
@@ -5384,192 +5175,192 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-353",
+      "id": "GT-357",
       "closedAt": "2026-06-28",
-      "closureCommit": "92dbbd15",
+      "closureCommit": "f5261bbf",
       "evidence": [
-        "src/packages/sdk-client/README.md",
-        "src/packages/sdk-client/src/__tests__/sdk.spec.ts"
+        "reference/core/control-center/evidence/gap-closure-evidence.json",
+        "reference/core/control-center/maturity-reports/maturity-reconciliation.json",
+        ".harness/scripts/ci/08-validate-tracking.mjs",
+        ".harness/scripts/ci/09-reconcile-maturity.mjs"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/sdk-client test"
+        "node .harness/scripts/ci/08-validate-tracking.mjs",
+        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "GT-341 (inventory reconciliation) satisfied; GT-357 reconciles board status against executed build/test evidence (closure-evidence + maturity), which is independent of GT-347’s separate core-OPA-suite remediation."
     },
     {
-      "id": "GT-354",
+      "id": "GT-358",
       "closedAt": "2026-06-28",
-      "closureCommit": "56546549",
+      "closureCommit": "c5998d1a",
       "evidence": [
-        "src/apps/core-api/src/main.ts",
-        "product/products/core-api/api-reference.md"
+        "src/rulesets/opa"
       ],
       "validationCommands": [
-        "npm run --workspace src/apps/core-api build",
-        "npm run --workspace src/apps/core-api test"
+        ".harness/bin/opa test src/rulesets/opa/ --ignore=schemas"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-351",
+      "id": "GT-359",
       "closedAt": "2026-06-28",
-      "closureCommit": "cb121075",
+      "closureCommit": "0896b1e9",
       "evidence": [
-        "src/packages/infra-providers/src/disk-ruleset.repository.spec.ts",
-        "src/packages/infra-providers/README.md",
-        "src/packages/infra-providers/src/disk-ruleset.repository.ts"
+        "src/packages/core-domain/src/domain/satellite-manifest.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/infra-providers test"
+        "npm run build --workspace @beyondnet/evolith-core-domain",
+        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-326",
+      "id": "GT-360",
       "closedAt": "2026-06-28",
-      "closureCommit": "262d29d5",
+      "closureCommit": "3e6f0556",
       "evidence": [
-        "src/packages/core-domain/src/__e2e__/governance-flow.e2e.spec.ts",
-        ".github/workflows/ci-cd.yml"
+        "src/apps/core-api/src/presentation/controllers/evaluation.controller.ts"
       ],
       "validationCommands": [
-        "npm run test:e2e --workspace @beyondnet/evolith-core-domain"
+        "npm test --workspace core-api -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-330",
+      "id": "GT-361",
       "closedAt": "2026-06-28",
-      "closureCommit": "2d7a6edc",
+      "closureCommit": "3e6f0556",
       "evidence": [
-        "reference/core/sdlc/01-playbooks/e2e-test-playbooks.md",
-        "src/apps/core-api/test/app.e2e-spec.ts",
-        "src/packages/mcp-server/test/mcp-server.e2e-spec.ts",
-        "src/packages/core-domain/src/__e2e__/governance-flow.e2e.spec.ts"
+        "src/apps/core-api/src/presentation/controllers/evaluation.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/evaluation.controller.spec.ts"
       ],
       "validationCommands": [
-        "npm run test:e2e --workspace @beyondnet/evolith-core-domain",
-        "npm run --workspace src/apps/core-api test:e2e",
-        "npm run --workspace src/packages/mcp-server build && npm run --workspace src/packages/mcp-server test:e2e",
-        "npm run --workspace src/sdk/cli test:e2e"
+        "npm test --workspace core-api -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-331",
+      "id": "GT-362",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "e2b1c12b",
       "evidence": [
-        "src/packages/mcp-server/src/main.ts"
+        "src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.ts",
+        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/mcp-server test"
+        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-332",
+      "id": "GT-363",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "daab4f74",
       "evidence": [
-        "src/packages/mcp-server/src/mcp/mcp-tool-dispatch.ts"
+        "src/packages/infra-providers/src/adapters/github-api.adapter.ts",
+        "src/packages/core-domain/src/domain/github-api-client.interface.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/mcp-server test"
+        "npm run --workspace src/packages/infra-providers test"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-333",
+      "id": "GT-364",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "2ff50b10",
       "evidence": [
-        "src/packages/mcp-server/src/mcp/mcp-server-auth.ts"
+        "src/packages/core-domain/src/application/use-cases/initialize-satellite.use-case.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/mcp-server test"
+        "npm run --workspace src/packages/core-domain test"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-334",
+      "id": "GT-365",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "d57e5e42",
       "evidence": [
-        "src/packages/mcp-server/package.json"
+        "src/sdk/cli/src/commands/satellite/satellite-create.command.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/mcp-server build"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-335",
+      "id": "GT-366",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "34ebcff1",
       "evidence": [
-        ".harness/scripts/ci/08-validate-tracking.mjs"
+        "src/sdk/cli/src/commands/satellite/satellite-adopt.command.ts"
       ],
       "validationCommands": [
-        "npm run --workspace packages/mcp-tools test"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-336",
+      "id": "GT-367",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "4e2380cc",
       "evidence": [
-        "src/packages/sdk-client/src/rest/evolith-rest-client.ts"
+        "src/apps/core-api/src/presentation/controllers/satellites.controller.ts",
+        "src/apps/core-api/src/application/services/satellite-registry.service.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/sdk-client test"
+        "npm test --workspace core-api"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-337",
+      "id": "GT-368",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "3dd62152",
       "evidence": [
-        "src/packages/sdk-client/src/rest/types.ts"
+        "src/packages/mcp-server/src/tools/satellite-create.tool.ts",
+        "src/packages/mcp-server/src/tools/satellite-adopt.tool.ts",
+        "src/packages/mcp-server/src/tools/satellite-list.tool.ts",
+        "src/packages/mcp-server/src/tools/satellite-status.tool.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/sdk-client test"
+        "npm run --workspace src/packages/mcp-server test"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-338",
+      "id": "GT-369",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "880e17eb",
       "evidence": [
-        "src/packages/core/package.json",
-        "src/packages/core/README.md"
+        "src/packages/core-domain/src/domain/satellite-record.ts"
       ],
       "validationCommands": [
-        "npm test --workspace @beyondnet/evolith-core"
+        "npm run --workspace src/packages/core-domain test"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-339",
+      "id": "GT-370",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "6f1e2bae",
       "evidence": [
-        "src/apps/core-api/src/presentation/controllers/projects.controller.ts"
+        "src/packages/core-domain/src/application/sync/sync.service.ts"
       ],
       "validationCommands": [
-        "npm test --workspace core-api"
+        "npm run --workspace src/packages/core-domain test"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-340",
+      "id": "GT-371",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "38334bf0",
       "evidence": [
-        "src/apps/core-api/test-setup.js"
+        "src/apps/core-api/src/presentation/controllers/satellites.controller.ts"
       ],
       "validationCommands": [
         "npm test --workspace core-api"
@@ -5577,391 +5368,429 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-341",
+      "id": "GT-372",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "94cad958",
       "evidence": [
-        ".harness/scripts/generate-product-inventory.mjs"
+        "src/packages/core-domain/src/application/audit/satellite-audit.service.ts",
+        "src/packages/core-domain/src/domain/satellite-audit.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/07-generate-inventories.mjs"
+        "npm run --workspace src/packages/core-domain test"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-342",
+      "id": "GT-373",
       "closedAt": "2026-06-28",
-      "closureCommit": "91cbd789",
+      "closureCommit": "51e1577d",
       "evidence": [
-        "README.md"
+        "src/packages/sdk-client/src/satellites.client.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs"
+        "npm run --workspace src/packages/sdk-client test"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-343",
+      "id": "GT-374",
       "closedAt": "2026-06-28",
-      "closureCommit": "95b5d51d",
+      "closureCommit": "556f7c9d",
+      "evidence": [
+        "src/sdk/cli/src/commands/upgrade/upgrade.command.ts"
+      ],
+      "validationCommands": [
+        "npm test --workspace src/sdk/cli -- --runInBand"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-375",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
+      "evidence": [
+        "reference/core/control-center/gaps/gap-tracking.md"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci-runner.mjs fast"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-376",
+      "closedAt": "2026-06-29",
+      "closureCommit": "4e9c50be",
+      "evidence": [
+        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts",
+        "src/packages/core-domain/src/evaluation/contracts/evaluation-context.ts"
+      ],
+      "validationCommands": [
+        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-377",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/src/domain/sdlc/phase-id.ts",
-        ".harness/scripts/ci/30-validate-phase-topology-disjoint.mjs",
-        "src/rulesets/schema/topology-manifest.schema.json"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/30-validate-phase-topology-disjoint.mjs",
-        "npm run --workspace src/packages/core-domain test"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-363",
-      "closedAt": "2026-06-28",
-      "closureCommit": "daab4f74",
+      "id": "GT-378",
+      "closedAt": "2026-06-29",
+      "closureCommit": "3ca91bb0",
       "evidence": [
-        "src/packages/infra-providers/src/adapters/github-api.adapter.ts",
-        "src/packages/core-domain/src/domain/github-api-client.interface.ts"
+        "src/packages/core-domain/src/evaluation/canonical-result.mapper.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/infra-providers test"
+        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-364",
-      "closedAt": "2026-06-28",
-      "closureCommit": "2ff50b10",
+      "id": "GT-379",
+      "closedAt": "2026-06-29",
+      "closureCommit": "5b21cbda",
       "evidence": [
-        "src/packages/core-domain/src/application/use-cases/initialize-satellite.use-case.ts"
+        "src/packages/core-domain/src/evaluation/kind-evaluators.ts",
+        "src/apps/core-api/src/app.module.ts"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/core-domain test"
+        "npm test --workspace core-api -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-365",
-      "closedAt": "2026-06-28",
-      "closureCommit": "d57e5e42",
+      "id": "GT-380",
+      "closedAt": "2026-06-29",
+      "closureCommit": "44dfdb41",
       "evidence": [
-        "src/sdk/cli/src/commands/satellite/satellite-create.command.ts"
+        "src/packages/core-domain/src/evaluation/contracts/evaluation-context.ts",
+        "reference/core/sdlc/sdlc-evolith-artifact-mapping.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-366",
-      "closedAt": "2026-06-28",
-      "closureCommit": "34ebcff1",
+      "id": "GT-381",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/sdk/cli/src/commands/satellite/satellite-adopt.command.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-367",
-      "closedAt": "2026-06-28",
-      "closureCommit": "4e2380cc",
+      "id": "GT-382",
+      "closedAt": "2026-06-29",
+      "closureCommit": "c3ca99f3",
       "evidence": [
-        "src/apps/core-api/src/presentation/controllers/satellites.controller.ts",
-        "src/apps/core-api/src/application/services/satellite-registry.service.ts"
+        "src/packages/core-domain/eslint.config.mjs",
+        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts"
       ],
       "validationCommands": [
-        "npm test --workspace core-api"
+        "npm run build --workspace @beyondnet/evolith-core-domain"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-368",
-      "closedAt": "2026-06-28",
-      "closureCommit": "3dd62152",
+      "id": "GT-383",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/mcp-server/src/tools/satellite-create.tool.ts",
-        "src/packages/mcp-server/src/tools/satellite-adopt.tool.ts",
-        "src/packages/mcp-server/src/tools/satellite-list.tool.ts",
-        "src/packages/mcp-server/src/tools/satellite-status.tool.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/mcp-server test"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-369",
-      "closedAt": "2026-06-28",
-      "closureCommit": "880e17eb",
+      "id": "GT-384",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/src/domain/satellite-record.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/core-domain test"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-370",
-      "closedAt": "2026-06-28",
-      "closureCommit": "6f1e2bae",
+      "id": "GT-385",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/src/application/sync/sync.service.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/core-domain test"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-371",
-      "closedAt": "2026-06-28",
-      "closureCommit": "38334bf0",
+      "id": "GT-386",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/apps/core-api/src/presentation/controllers/satellites.controller.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace core-api"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-372",
-      "closedAt": "2026-06-28",
-      "closureCommit": "94cad958",
+      "id": "GT-387",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/src/application/audit/satellite-audit.service.ts",
-        "src/packages/core-domain/src/domain/satellite-audit.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/core-domain test"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-373",
-      "closedAt": "2026-06-28",
-      "closureCommit": "51e1577d",
+      "id": "GT-388",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/sdk-client/src/satellites.client.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm run --workspace src/packages/sdk-client test"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-374",
-      "closedAt": "2026-06-28",
-      "closureCommit": "556f7c9d",
+      "id": "GT-389",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/sdk/cli/src/commands/upgrade/upgrade.command.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-313",
-      "closedAt": "2026-06-28",
-      "closureCommit": "1ffb1064",
+      "id": "GT-390",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/sdk/cli/src/commands/satellite/satellite-create.command.ts",
-        "src/sdk/cli/src/commands/satellite/satellite-adopt.command.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "GH_TOKEN externalized to environment/secret (commit 1ffb1064); credential rotation deferred under owner-accepted risk."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-359",
-      "closedAt": "2026-06-28",
-      "closureCommit": "0896b1e9",
+      "id": "GT-391",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/src/domain/satellite-manifest.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm run build --workspace @beyondnet/evolith-core-domain",
-        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-360",
-      "closedAt": "2026-06-28",
-      "closureCommit": "3e6f0556",
+      "id": "GT-392",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/apps/core-api/src/presentation/controllers/evaluation.controller.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace core-api -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-361",
-      "closedAt": "2026-06-28",
-      "closureCommit": "3e6f0556",
+      "id": "GT-393",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/apps/core-api/src/presentation/controllers/evaluation.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/evaluation.controller.spec.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace core-api -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-362",
-      "closedAt": "2026-06-28",
-      "closureCommit": "e2b1c12b",
+      "id": "GT-394",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.ts",
-        "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-376",
-      "closedAt": "2026-06-29",
-      "closureCommit": "4e9c50be",
+      "id": "GT-395",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts",
-        "src/packages/core-domain/src/evaluation/contracts/evaluation-context.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-378",
-      "closedAt": "2026-06-29",
-      "closureCommit": "3ca91bb0",
+      "id": "GT-396",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/canonical-result.mapper.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-379",
-      "closedAt": "2026-06-29",
-      "closureCommit": "5b21cbda",
+      "id": "GT-397",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/kind-evaluators.ts",
-        "src/apps/core-api/src/app.module.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace core-api -- --runInBand"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-380",
-      "closedAt": "2026-06-29",
-      "closureCommit": "44dfdb41",
+      "id": "GT-398",
+      "closedAt": "2026-07-02",
+      "closureCommit": "f826a927",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/contracts/evaluation-context.ts",
-        "reference/core/sdlc/sdlc-evolith-artifact-mapping.md"
+        "src/rulesets/opa/capability-source-interface.rego",
+        "src/rulesets/opa/capability-source-interface.test.rego",
+        "src/rulesets/opa/main.rego",
+        "src/packages/agent-runtime/src/application/context-mapper.ts",
+        "src/packages/agent-runtime/src/__tests__/units.spec.ts",
+        "src/packages/agent-runtime/src/__tests__/agent-runtime.service.spec.ts"
       ],
       "validationCommands": [
-        "npm test --workspace @beyondnet/evolith-core-domain -- --runInBand"
+        "node .harness/scripts/ci/29-test-core-opa.mjs",
+        "npx jest --config src/packages/agent-runtime/jest.config.js --runTestsByPath src/packages/agent-runtime/src/__tests__/units.spec.ts src/packages/agent-runtime/src/__tests__/agent-runtime.service.spec.ts --no-coverage"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-382",
-      "closedAt": "2026-06-29",
-      "closureCommit": "c3ca99f3",
+      "id": "GT-399",
+      "closedAt": "2026-07-03",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/core-domain/eslint.config.mjs",
-        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm run build --workspace @beyondnet/evolith-core-domain"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-419",
+      "id": "GT-400",
       "closedAt": "2026-07-03",
-      "closureCommit": "4f00d511",
+      "closureCommit": "030e9dd6",
       "evidence": [
-        "AGENTS.md",
-        "AGENTS.es.md",
-        ".harness/agents/discovery-agents.md",
-        ".harness/agents/discovery-agents.es.md"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-420",
-      "closedAt": "2026-07-03",
-      "closureCommit": "6f09344c",
+      "id": "GT-401",
+      "closedAt": "2026-07-02",
+      "closureCommit": "2e0814d3",
       "evidence": [
-        "src/packages/agent-runtime/src/adapters/tracker/file-tracker-trace.adapter.ts",
-        "src/packages/agent-runtime/src/adapters/tracker/opentelemetry-tracker-adapter.ts",
-        "src/packages/agent-runtime/src/adapters/tracker/composite-tracker-adapter.ts",
-        "src/packages/agent-runtime/src/bootstrap.ts"
+        "src/packages/agent-runtime/src/domain/ports/interaction-adapter.port.ts",
+        "src/packages/agent-runtime/src/domain/ports/index.ts",
+        "src/packages/agent-runtime/src/adapters/index.ts",
+        "src/packages/agent-runtime/src/adapters/interaction/ExternalTriggerInteractionAdapter.ts",
+        "src/packages/agent-runtime/src/adapters/interaction/SmartCliCommandInteractionAdapter.ts",
+        "src/packages/agent-runtime/src/adapters/interaction/SmartCliChatInteractionAdapter.ts",
+        "src/packages/agent-runtime/src/adapters/interaction/HermesChatBoxInteractionAdapter.ts",
+        "src/packages/agent-runtime/src/__tests__/interaction-adapters.spec.ts",
+        "src/packages/agent-runtime/src/__tests__/public-surface.spec.ts",
+        "src/apps/agent-runtime-api/src/agent-runtime/agent-runtime.controller.ts",
+        "src/sdk/cli/src/infrastructure/agent/agent-runtime.factory.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace src/packages/agent-runtime"
+        "npm run build --workspace src/packages/agent-runtime",
+        "npm run test --workspace src/packages/agent-runtime",
+        "npx tsc -p apps/agent-runtime-api/tsconfig.json"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "GT-401 closes the shared public InteractionAdapterPort contract and the existing CLI/Hermes/API adapter path. MCP/webhook-specific rollout remains explicitly tracked by GT-405 and follow-on interface gaps."
     },
     {
-      "id": "GT-421",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-402",
+      "closedAt": "2026-07-02",
+      "closureCommit": "9ef081b9",
       "evidence": [
-        ".harness/schemas/winston-audit-output.schema.json",
-        ".harness/scripts/apply-winston-audit.mjs",
-        ".harness/playbooks/winston-audit-playbook.md",
-        ".harness/playbooks/winston-audit-playbook.es.md"
+        "src/sdk/cli/src/infrastructure/agent/agent-runtime.factory.ts",
+        "src/sdk/cli/src/infrastructure/agent/agent-runtime.factory.spec.ts",
+        "src/sdk/cli/src/commands/chat/chat.command.ts",
+        "src/sdk/cli/src/commands/chat/chat.command.spec.ts",
+        "src/sdk/cli/src/commands/plan/index.ts",
+        "src/packages/agent-runtime/src/index.ts",
+        "src/packages/agent-runtime/src/__tests__/public-surface.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/run-evolith-audit.mjs"
+        "npm run build --workspace src/packages/agent-runtime",
+        "npm run test --workspace src/packages/agent-runtime",
+        "npx jest --config src/sdk/cli/jest.config.js --runTestsByPath src/sdk/cli/src/infrastructure/agent/agent-runtime.factory.spec.ts src/sdk/cli/src/commands/chat/chat.command.spec.ts --no-coverage --runInBand",
+        "npm run build --workspace src/sdk/cli"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "GT-402 closes the Smart CLI interaction-adapter routing layer. GT-399 remains open for replacing stub/in-memory runtime adapters with real HTTP/Harness adapters."
     },
     {
-      "id": "GT-423",
+      "id": "GT-403",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        ".harness/scripts/ci/35-validate-core-health.mjs",
-        ".harness/scripts/ci-runner.mjs"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs governance"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-422",
+      "id": "GT-404",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        ".harness/agents/router-agent.md",
-        ".harness/agents/router-agent.es.md",
-        ".harness/schemas/router-agent-output.schema.json",
-        "AGENTS.md",
-        ".bmad-core/AGENTS.md"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
         "node .harness/scripts/ci-runner.mjs fast"
@@ -5969,46 +5798,43 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-413",
+      "id": "GT-405",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/agent-runtime/src/adapters/policy/opa-cli-policy-validation.adapter.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/packages/agent-runtime"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-414",
+      "id": "GT-406",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/agent-runtime/src/adapters/skills/default-skills.ts",
-        ".harness/manifest.yaml",
-        "src/packages/agent-runtime/src/__tests__/units.spec.ts"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/packages/agent-runtime"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-415",
+      "id": "GT-407",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        "src/packages/agent-runtime/README.md",
-        "src/packages/agent-runtime/README.es.md"
+        "reference/core/control-center/gaps/gap-tracking.md"
       ],
       "validationCommands": [
-        "npm test --workspace src/packages/agent-runtime"
+        "node .harness/scripts/ci-runner.mjs fast"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-377",
+      "id": "GT-408",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
@@ -6020,7 +5846,7 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-395",
+      "id": "GT-409",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
@@ -6032,7 +5858,7 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-375",
+      "id": "GT-410",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
@@ -6044,7 +5870,7 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-390",
+      "id": "GT-411",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
@@ -6056,43 +5882,66 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-405",
+      "id": "GT-412",
+      "closedAt": "2026-07-02",
+      "closureCommit": "2f3e0bbe",
+      "evidence": [
+        "src/packages/agent-runtime/src/application/agent-runtime.service.ts",
+        "src/packages/agent-runtime/src/__tests__/agent-runtime.service.spec.ts",
+        "src/apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts",
+        ".harness/playbooks/sdlc-deep-audit.mjs"
+      ],
+      "validationCommands": [
+        "npm run build --workspace src/packages/agent-runtime",
+        "npm run test --workspace src/packages/agent-runtime",
+        "npx tsc -p apps/agent-runtime-api/tsconfig.json",
+        "npm run build --workspace src/sdk/cli",
+        "node .harness/scripts/run-evolith-deep.mjs --markdown"
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "GT-412 closes mandatory policy preflight, retained post-execution policy validation, and hosted runtime OPA default. GT-399 remains open for replacing CLI-side non-policy stubs with real HTTP/Harness adapters."
+    },
+    {
+      "id": "GT-413",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/agent-runtime/src/adapters/policy/opa-cli-policy-validation.adapter.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "npm test --workspace src/packages/agent-runtime"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-410",
+      "id": "GT-414",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/agent-runtime/src/adapters/skills/default-skills.ts",
+        ".harness/manifest.yaml",
+        "src/packages/agent-runtime/src/__tests__/units.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "npm test --workspace src/packages/agent-runtime"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-411",
+      "id": "GT-415",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/agent-runtime/README.md",
+        "src/packages/agent-runtime/README.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "npm test --workspace src/packages/agent-runtime"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-384",
+      "id": "GT-416",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
@@ -6104,7 +5953,7 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-396",
+      "id": "GT-417",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
@@ -6116,7 +5965,7 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-399",
+      "id": "GT-418",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
@@ -6128,47 +5977,60 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-400",
+      "id": "GT-419",
       "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "closureCommit": "4f00d511",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "AGENTS.md",
+        "AGENTS.es.md",
+        ".harness/agents/discovery-agents.md",
+        ".harness/agents/discovery-agents.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "node .harness/scripts/ci/01-validate-docs.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-403",
+      "id": "GT-420",
       "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "closureCommit": "6f09344c",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/agent-runtime/src/adapters/tracker/file-tracker-trace.adapter.ts",
+        "src/packages/agent-runtime/src/adapters/tracker/opentelemetry-tracker-adapter.ts",
+        "src/packages/agent-runtime/src/adapters/tracker/composite-tracker-adapter.ts",
+        "src/packages/agent-runtime/src/bootstrap.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "npm run build --workspace src/packages/agent-runtime"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-406",
+      "id": "GT-421",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        ".harness/schemas/winston-audit-output.schema.json",
+        ".harness/scripts/apply-winston-audit.mjs",
+        ".harness/playbooks/winston-audit-playbook.md",
+        ".harness/playbooks/winston-audit-playbook.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "node .harness/scripts/run-evolith-audit.mjs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-407",
+      "id": "GT-422",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        ".harness/agents/router-agent.md",
+        ".harness/agents/router-agent.es.md",
+        ".harness/schemas/router-agent-output.schema.json",
+        "AGENTS.md",
+        ".bmad-core/AGENTS.md"
       ],
       "validationCommands": [
         "node .harness/scripts/ci-runner.mjs fast"
@@ -6176,249 +6038,363 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-408",
+      "id": "GT-423",
       "closedAt": "2026-07-03",
       "closureCommit": "030e9dd6",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        ".harness/scripts/ci/35-validate-core-health.mjs",
+        ".harness/scripts/ci-runner.mjs"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "node .harness/scripts/ci-runner.mjs governance"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-383",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-424",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        ".harness/scripts/ci/34-check-skill-registry-parity.mjs",
+        ".harness/scripts/ci/34-check-skill-registry-parity.test.mjs",
+        ".github/workflows/ci-cd.yml"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "34-check-skill-registry-parity -> exit 0; 9/9 executable capabilities routable (4 hand-bound, 5 synthesized), reported separately.",
+        "node --test .harness/scripts/ci/34-check-skill-registry-parity.test.mjs -> 15/15, including three negative fixtures: derivation absent, derivation uncalled, and a synthesis narrowed by one extra conjunct.",
+        "Wired into the governance-guards job in ci-cd.yml, so it is no longer inert."
       ],
+      "closedAt": "2026-07-28",
+      "closureCommit": "caf5fb97",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-388",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-425",
+      "closedAt": "2026-07-04",
+      "closureCommit": "d93bc0f2",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "reference/core/architecture/adrs/core/0104-topology-driven-advisory-design-governance.md",
+        "reference/core/architecture/design-phase-governance.md",
+        "src/packages/core-domain/src/evaluation/design-flow.e2e.spec.ts"
+      ],
+      "validationCommands": [
+        "EPIC — all children GT-426..GT-433 DONE; E2E against the real corpus passes; tsc -b clean"
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "GT-425 umbrella closed via F0-F8 (GT-426..GT-433). One follow-on remains outside the epic scope: CLI/MCP topology-recommend parity (task_0dfc5f71) mirroring the Core API endpoint for full BR-008 parity on the recommender."
+    },
+    {
+      "id": "GT-426",
+      "closedAt": "2026-07-04",
+      "closureCommit": "5ddf4471",
+      "evidence": [
+        "src/packages/core-domain/src/evaluation/contracts/evaluation-context.ts",
+        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts",
+        "src/rulesets/schema/evaluation-context.schema.json",
+        "src/rulesets/schema/evaluation-result.schema.json",
+        "src/rulesets/schema/evolith-yaml.schema.json"
+      ],
+      "validationCommands": [
+        "npx tsc -b tsconfig.json",
+        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns evaluation"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-427",
+      "closedAt": "2026-07-04",
+      "closureCommit": "46791e85",
+      "evidence": [
+        "src/rulesets/schema/topology-manifest.schema.json",
+        "reference/core/architecture/topologies/progressive-axis/modular-monolith/topology.manifest.json",
+        "src/rulesets/topologies/agentic-ai/topology.manifest.json"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "ajv compile of topology-manifest.schema.json + validate all 8 topology.manifest.json (8 valid, 0 invalid)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-389",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-428",
+      "closedAt": "2026-07-04",
+      "closureCommit": "0392fefe",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/rulesets/schema/blueprint.schema.json",
+        "src/rulesets/schema/design-block.schema.json",
+        "src/rulesets/schema/design-block-registry.json",
+        "src/rulesets/schema/fixtures/blueprint.multi-concern.valid.json",
+        "reference/core/sdlc/04-artifact-templates/design-block-template.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "ajv: multi-concern fixture + legacy blueprint (backward-compat) + design-block sample all valid; registry 22 blocks, 0 unresolved schemaRefs"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-391",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-429",
+      "closedAt": "2026-07-04",
+      "closureCommit": "1b4e6f98",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/core-domain/src/evaluation/kind-evaluators.ts",
+        "src/packages/core-domain/src/evaluation/kind-evaluators.spec.ts",
+        "src/packages/core-domain/src/application/services/topology-catalog.service.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "npx tsc -b tsconfig.json",
+        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns evaluation (63 pass, 3 new design specs)"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "none",
+      "dependencyRationale": "Advisory maturity evaluator (TS KindEvaluator); no new Native rule → no OPA parity twin required (R-25 N/A). Delivers the content/maturity evaluation capability behind the existence-only gate gaps."
     },
     {
-      "id": "GT-393",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-430",
+      "closedAt": "2026-07-04",
+      "closureCommit": "0196b158",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/rulesets/schema/topology-recommendation.schema.json",
+        "src/rulesets/architecture/topology-recommendation.rules.json",
+        "src/packages/core-domain/src/application/services/topology-recommendation.service.ts",
+        "src/packages/core-domain/src/application/services/topology-recommendation.service.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "ajv: topology-recommendation.rules.json valid against its schema",
+        "npx tsc -b tsconfig.json",
+        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns topology-recommendation (5 pass)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-397",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-431",
+      "closedAt": "2026-07-04",
+      "closureCommit": "4fcdc2c8",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/rulesets/schema/design-template.schema.json",
+        "reference/core/foundations/agent-skills/design-template-proposal.md",
+        "reference/core/foundations/agent-skills/template-promotion.md",
+        "src/apps/core-api/src/presentation/controllers/architecture.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/architecture.controller.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "ajv: design-template fixture valid",
+        "npx tsc -b tsconfig.json",
+        "npx jest architecture.controller (9 pass, 2 new recommend-topology specs)"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "design-evaluate exposed on all surfaces via evaluate(); topology-recommend exposed on the Core API (the Tracker's surface). CLI/MCP topology-recommend commands mirror the endpoint and are tracked as a follow-on (task_0dfc5f71) for full BR-008 parity on the recommender."
     },
     {
-      "id": "GT-381",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-432",
+      "closedAt": "2026-07-04",
+      "closureCommit": "33306d72",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/core-domain/src/evaluation/kind-evaluators.ts",
+        "src/packages/core-domain/src/evaluation/kind-evaluators.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "npx tsc -b tsconfig.json",
+        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns evaluation (64 pass, 1 new downstream-derivation spec)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-386",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-433",
+      "closedAt": "2026-07-04",
+      "closureCommit": "d93bc0f2",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/core-domain/src/evaluation/design-flow.e2e.spec.ts",
+        "reference/core/architecture/design-phase-governance.md",
+        "reference/core/architecture/design-phase-governance.es.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns evaluation (65 pass, incl. design-flow.e2e against the real corpus)",
+        "bilingual parity 8/8; links resolve"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-385",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-434",
+      "closedAt": "2026-07-04",
+      "closureCommit": "6b1c5472",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/rulesets/schema/topology-manifest.schema.json",
+        "src/packages/core-domain/src/application/services/phase-artifact-profile.service.ts",
+        "src/apps/core-api/src/presentation/controllers/architecture.controller.ts",
+        "src/rulesets/schema/phase-artifact-registry.json",
+        "src/packages/core-domain/src/application/services/phase-artifacts.e2e.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "ajv: 8 manifests valid with spec.phaseProfiles",
+        "npx tsc -b tsconfig.json",
+        "jest phase-artifact (6 pass incl. real-corpus E2E) + architecture.controller (10 pass)"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Delivered: spec.phaseProfiles in manifests + PhaseArtifactProfileService + Core API endpoint + phase-artifact-registry + E2E. Follow-on (task_1b27a217): unified 'phase-artifacts' EvaluationKind so it auto-exposes on CLI/MCP via evaluate(), for full BR-008 parity — mirrors the design evaluator; the capability is already exposed on the Core API (the Tracker's surface)."
     },
     {
-      "id": "GT-387",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-436",
+      "closedAt": "2026-07-04",
+      "closureCommit": "0edaa22b",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/mcp-server/package.json",
+        "src/packages/core/package.json",
+        ".github/workflows/sdk-cli-release.yml"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "npm view @beyondnet/evolith-mcp version",
+        "npm view @beyondnet/evolith-core version"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-392",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-437",
+      "closedAt": "2026-07-17",
+      "closureCommit": "1ddbe25b",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        ".github/workflows/ci-cd.yml",
+        "src/apps/agent-runtime-api/Dockerfile"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "ci-cd.yml parses as YAML and resolves to 3 docker-services matrix entries (core-api -> evolith-core-api, mcp-server -> evolith-mcp, agent-runtime -> evolith-agent-runtime) and 3 Coolify deploy steps; the referenced ./src/apps/agent-runtime-api/Dockerfile exists.",
+        "The gap's premise was partly stale: agent-runtime was already built/tested by ci-cd.yml (3 workspace builds). The real hole — absent from the docker-services matrix and from the deploy job on main (docker-images.yml only covered it on tags/workflow_dispatch) — is now closed; agent-runtime-api sits in the same CI/CD posture as its two sibling services."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Workflow wiring is complete and validated declaratively (YAML parse + Dockerfile path + parity with two already-working sibling services). The deploy step uses the established fail-soft contract (unset hook warns and exits 0, never failing CD). Provisioning COOLIFY_AGENTRUNTIME_DEPLOY_HOOK / COOLIFY_API_TOKEN is owner-gated and already tracked by GT-324; the first live build+deploy runs on the next merge to main, since this job is main/tag-only and cannot be exercised from develop."
     },
     {
-      "id": "GT-394",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-438",
+      "closedAt": "2026-07-17",
+      "closureCommit": "ff57cec6",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/agent-runtime/src/domain/ports/workspace-context.port.ts",
+        "src/packages/agent-runtime/src/adapters/core/fs-workspace-context.adapter.ts",
+        "src/packages/agent-runtime/src/application/agent-runtime.service.ts",
+        "src/packages/agent-runtime/src/application/context-mapper.ts",
+        "src/apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "agent-runtime 131/131 (+8 workspace-context tests); agent-runtime-api 80/80 (+3 factory wiring tests); tsc --noEmit clean.",
+        "The runtime assembles the workspace and passes it inline as evaluationInput.files (the OverlayFileSystem shape the Core API already consumes), so the stateless Core no longer evaluates an empty context; a workspace outage degrades to the prior flow (never fails a run).",
+        "LIVE-VERIFIED end-to-end in kind `evolith-cluster` (2026-07-18) — and the verification EXPOSED A REGRESSION in this very change, now fixed (`e361b52b`). The wiring fell back to AGENT_RUNTIME_WORKSPACE_ROOT, a pre-existing variable the service image hard-codes (`ENV AGENT_RUNTIME_WORKSPACE_ROOT=/repo/corpus`), so whole-corpus inlining was silently ON in every containerised deployment: the runtime inlined the entire bundled corpus into one evaluate request, the Core rejected the oversized body BEFORE its audit interceptor (so nothing appeared in core-api logs, making it look like the request never arrived), and the chain died on an opaque `Core evaluation failed: HTTP 500`. Inlining is now strictly opt-in via AGENT_RUNTIME_WORKSPACE_CONTEXT_ROOT only, with the old fallback spec inverted into a regression guard. A second, independent Core defect surfaced in the same hunt and was fixed (`6c3d78d3`): the `architecture` kind 500'd for every request because ArchitectureDriftService's history WRITE was unguarded while its READ already tolerated failure. After both fixes the governed chain completes: resolve-context → ground → select-capability → policy-preflight → harness-execute → core-evaluate → policy-validate → completed, returning the correct governed `blocked` verdict with 39 findings (was `exception`). All 13 evaluation kinds return 200."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "The HttpCoreEvaluationAdapter was already wired+verified in kind; this landed the last non-gated piece (real workspace-context assembly). Gated remainder stays out of scope by design: the real reasoning engine (GT-385/Hermes) and durable memory/scheduler needing external services; a Tracker-driven context assembler is a future sibling adapter behind the same IWorkspaceContextPort."
     },
     {
-      "id": "GT-404",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-439",
+      "closedAt": "2026-07-13",
+      "closureCommit": "efd05f67",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/apps/agent-runtime-api/src/auth/api-key.guard.ts",
+        "src/apps/agent-runtime-api/src/auth/tenant-corpus.guard.ts",
+        "src/apps/agent-runtime-api/src/auth/jwt.util.ts",
+        "src/apps/agent-runtime-api/src/app.module.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "cd src/apps/agent-runtime-api && npx jest (33/33) — fail-closed auth (unset-key⇒denied, dev-bypass⇒allowed), JWT tenant-claim extraction, TenantCorpusGuard cross-tenant denial; both guards in APP_GUARD"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-409",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-440",
+      "closedAt": "2026-07-04",
+      "closureCommit": "b3c6557f",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/apps/agent-runtime-api/src/health/metrics.controller.ts",
+        "src/apps/agent-runtime-api/src/health/health.controller.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "grep -n \"/metrics\" src/apps/agent-runtime-api/src/health/metrics.controller.ts",
+        "grep -n \"health\" src/apps/agent-runtime-api/src/health/health.controller.ts"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-416",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-441",
+      "closedAt": "2026-07-24",
+      "closureCommit": "a299ab89",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "src/packages/agent-runtime/src/adapters/approval/tracker-approval.http-client.ts",
+        "src/apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts",
+        "product/infra/docker-compose.fullstack.yml"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "cd src/packages/agent-runtime && npm test -> 28 suites / 249 tests passed, incl. tracker-approval.http-client.spec: submit() POSTs to /runtime-approvals with x-api-key, DROPS tenantId from the body, maps the response; non-2xx throws; fed through the real adapter, an approved answer grants and a 401 denies fail-closed as unavailable.",
+        "cd src/apps/agent-runtime-api && npm test -> 7 suites / 81 tests passed; the runtime.factory approval wiring typechecks clean against the built package (tsc --noEmit -p tsconfig.json clean).",
+        "Live smoke vs the running Tracker (docker-compose.fullstack, tracker-api :5100 configured with a CoreMachine key bound to the dev tenant): client.submit() -> {status:pending, approvalId} (a real approval persisted in Postgres); adapter.requireApproval() -> {granted:false, status:pending}; a second submit with the same correlationId returns the SAME approvalId (idempotent); POST /runtime-approvals/{id}/resolve {status:rejected} as a dev-bypass human -> HTTP 200; a third submit -> {status:rejected, approver} and the adapter denies it as a tracker-decision. Full loop end to end.",
+        "node .harness/scripts/ci/08-validate-tracking.mjs -> green with this record + the counter flip (557/568)."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-441 extends GT-387 (the governed-executor approval port, done in a prior wave) and its receiving half is CD-23 on the Tracker board, shipped 2026-07-19 (RuntimeApprovalEndpoints + migration AddRuntimeApprovals) — both satisfied, so the Core-side TrackerApprovalHttpClient could finally be written against a real, agreed contract instead of a fabricated one (the exact reason it was deliberately left unimplemented before). The approve->grant path is intentionally NOT live-smoked here: granting requires a designated UMS approver (CD-31) and dev-bypass carries every permission but no authority, which the endpoint deliberately rejects ('permission is not authority'). That path is covered by the adapter unit test (approved->grant) and the Tracker's own RuntimeApprovalEndpointTests; the pending, idempotency and human-reject paths ARE live-smoked against the real Tracker."
     },
     {
-      "id": "GT-417",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-442",
+      "closedAt": "2026-07-17",
+      "closureCommit": "fd9f56de",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        "product/infra/README.md",
+        "product/infra/README.es.md",
+        "product/infra/helm/evolith-core-api/values.yaml",
+        "product/infra/helm/evolith-mcp/values.yaml",
+        "product/infra/helm/evolith-agent-runtime/values.yaml"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "Secret wiring verified in all three charts: each takes credentials from a pre-created K8s Secret BY NAME, injected via secretKeyRef and gated on auth.existingSecretName — evolith-core-api -> core-api-auth/EVOLITH_API_KEY, evolith-mcp -> mcp-auth/EVOLITH_API_KEY, evolith-agent-runtime -> agent-runtime-auth/AGENT_RUNTIME_API_KEY; evolith-mcp additionally consumes opa-bundle-credentials and opa-bundle-signing-key by name. No chart embeds a literal credential.",
+        "DB-connectivity claim disproved against the code: core-api and agent-runtime-api declare ZERO database dependencies (no pg/typeorm/prisma/mongo driver or ORM) in their package.json. The `postgresql` occurrences in projects.controller.ts / core-domain.module.ts are the scaffolding generator selecting a database for the GENERATED project, not a Core runtime connection.",
+        "Consolidated the previously scattered secret configuration into product/infra/README.md and README.es.md, section 'Secrets and Data Connectivity' / 'Secretos y Conectividad de Datos', including the kubectl create secret example and the Coolify encrypted-env-var equivalent."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Both halves of the original framing were misaligned with the codebase. The secret store was substantially already wired (K8s Secrets by name via secretKeyRef across all three charts); what was genuinely missing was documentation, now consolidated bilingually. The DB half is NOT APPLICABLE to the Core: ADR-0101 makes it a stateless evaluation engine (EvaluationContext -> EvaluationResult, no persisted entities), so there is no DATABASE_URL to configure and adding one would contradict the ADR — persistence lives in the Tracker (own Postgres, tracker_governance), a separate repository whose board owns any DB-connectivity work. Remaining is owner-gated and not code: provisioning the real secret VALUES on the VPS/cluster, the same blocker already tracked by GT-324 and GT-437."
     },
     {
-      "id": "GT-418",
-      "closedAt": "2026-07-03",
-      "closureCommit": "030e9dd6",
+      "id": "GT-445",
+      "closedAt": "2026-07-18",
+      "closureCommit": "702de08b",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md"
+        ".harness/scripts/ci/07-generate-inventories.mjs",
+        "reference/core/control-center/maturity-reports/inventory-summary.md",
+        "reference/core/control-center/maturity-reports/maturity-reconciliation.json",
+        "reference/core/control-center/maturity-reports/maturity-assessment.md",
+        "product/products/smart-cli/product-inventory.md",
+        "reference/core/foundations/common-rules/ai-augmented/03-tools-catalog/evolith-mcp-tools.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci-runner.mjs fast"
+        "All four named surfaces are regenerated. maturity-reconciliation.json was regenerated in 35ea46e1 and now reports 559 gaps / 145 rulesets / 132 ADRs / @beyondnet/evolith-cli@1.1.0.",
+        "maturity-assessment.md verified clean: no `1.1.4`, no \"32 tools\", no `@beyondnet/evolith-cli`. product-inventory.md clean at 1.1.0. evolith-mcp-tools.md regenerated to the source-derived 47-tool table in 459676aa.",
+        "The final blocker was the inventory generator itself: `07-generate-inventories.mjs` resolved the dead `rulesets/` path and reported 0, wrote to an orphaned location, and its `--check` flag WROTE FILES instead of only checking. Fixed in 702de08b.",
+        "Measured effect: the canonical `reference/core/control-center/maturity-reports/inventory-summary.md` went from a two-week-frozen 119 ADRs / 144 rulesets / 40 schemas to 132 / 145 / 44, now agreeing exactly with what `09-reconcile-maturity.mjs` derives independently.",
+        "Corpus cross-check: `find src/rulesets -name \"*.rules.json\" | wc -l` -> 145, the same figure both scripts now report."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "none",
+      "dependencyRationale": "The gap has no remaining dependencies. Regeneration had been gated on the inventory generator producing real numbers; that generator was the last blocker and was fixed in the closure commit, so the four surfaces could be regenerated from code rather than by hand and nothing is left waiting."
     },
     {
-      "id": "GT-436",
-      "closedAt": "2026-07-04",
-      "closureCommit": "0edaa22b",
+      "id": "GT-446",
+      "closedAt": "2026-07-13",
+      "closureCommit": "2c67a1aa",
       "evidence": [
-        "src/packages/mcp-server/package.json",
-        "src/packages/core/package.json",
-        ".github/workflows/sdk-cli-release.yml"
+        "product/infra/kind/tracker-web.local.yaml",
+        "product/infra/docker-compose.evolith.yml"
       ],
       "validationCommands": [
-        "npm view @beyondnet/evolith-mcp version",
-        "npm view @beyondnet/evolith-core version"
+        "kind load docker-image evolith-tracker-web:local --name evolith-tracker; kubectl apply -f product/infra/kind/tracker-web.local.yaml (rollout 1/1) + port-forward svc/tracker-web 8088:80 -> the Evolith Tracker React SPA loads (HTTP 200, dev-auth as user AN / tenant root), the Control Tower renders governance KPIs from the live backend, and the nginx /api proxy reaches tracker-api -> real Core (/api/health 200). Objective-1 UI chain (tracker-web -> tracker-api -> core-api) verified in a browser"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Cross-repo (evolith_tracker): the M1 pilot closure — DB persistence + real Core evaluate() + Discovery gate E2E — was already met in the Tracker repo; this closes the last tail (verify the React UI in a browser) against the local Core chain. Broader per-phase UI coverage is follow-on. Core provides the stable contract (ADR-0101/0104)."
     },
     {
-      "id": "GT-440",
-      "closedAt": "2026-07-04",
-      "closureCommit": "b3c6557f",
+      "id": "GT-447",
+      "closedAt": "2026-07-24",
+      "closureCommit": "0b387b44",
       "evidence": [
-        "src/apps/agent-runtime-api/src/health/metrics.controller.ts",
-        "src/apps/agent-runtime-api/src/health/health.controller.ts"
+        "product/infra/docker-compose.fullstack.yml"
       ],
       "validationCommands": [
-        "grep -n \"/metrics\" src/apps/agent-runtime-api/src/health/metrics.controller.ts",
-        "grep -n \"health\" src/apps/agent-runtime-api/src/health/health.controller.ts"
+        "cd product/infra && EVOLITH_API_KEY=local-dev-key docker compose -f docker-compose.fullstack.yml up -d --build -> 8/8 servicios healthy (redis, core-api, mcp, agent-runtime, tracker-postgres, tracker-api, tracker-gateway, tracker-web); `docker compose ps` los muestra todos (healthy).",
+        "curl -sS -X POST http://localhost:8088/api/v1/core/evaluate -H 'Content-Type: application/json' -d '{\"targetType\":\"initiative\",\"targetId\":\"gt-447-demo\",\"phase\":\"design\",\"gate\":\"design-gate\",\"topology\":\"modular-monolith\"}' -> HTTP 200, status=COMPLETED, provenance=core, coreEndpoint=/api/v1/evaluate, overallVerdict=FAIL (39 hallazgos bloqueantes sobre el workspace 'rulesets'), durationMs~533. Round-trip real al Core por el chain completo del navegador (nginx -> tracker-api -> core-api), no un mock (MockFallback=false).",
+        "curl -sS http://localhost:8088/api/v1/core-evaluation-transactions/ -> la evaluacion queda persistida en Postgres (operationId tracker-82339e85..., status=completed, decision=FAILED); confirma el camino de escritura tracker-api -> Postgres.",
+        "Navegador (http://localhost:8088): la SPA React renderiza el Control Tower via dev-bypass; el network muestra /api/v1/{auth/config,auth/session,tenants,initiatives,sdlc-executions,core-evaluation-transactions,audit-entries} todos 200, indicador 'PostgreSQL healthy'.",
+        "node .harness/scripts/ci/08-validate-tracking.mjs -> verde con este registro de cierre + el flip del contador."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-447 es un milestone cuyo alcance son sus 7 hijos (GT-436/438/439/440/446 en este repo + GT-437/442), todos ya COMPLETADOS. Este cierre entrega la aceptacion restante a nivel de milestone: un bring-up local full-stack de un solo comando que incluye la UI del Tracker (cross-repo), verificado end-to-end en un navegador. Los fixes de build de tracker-web viajan en la rama feature/gt-447-fullstack-local de evolith_tracker (f8b68f2). Nota: el appsettings committeado de tracker-api apunta CoreApi.BaseUrl al gateway con un path drifteado (/api/core/api/v1 vs la ruta real del gateway /api/core/evaluate) -- aqui se cableo el hop directo a core-api; se rastrea como follow-up aparte."
     },
     {
       "id": "GT-449",
@@ -6452,379 +6428,316 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-452",
-      "closedAt": "2026-07-09",
-      "closureCommit": "3c0ccf8a",
+      "id": "GT-451",
+      "closedAt": "2026-07-17",
+      "closureCommit": "fd03cf53",
       "evidence": [
-        "src/sdk/cli/src/commands/validate/validate.command.ts",
-        "src/sdk/cli/src/commands/validate/validate.command.spec.ts"
+        "src/sdk/cli/package.json",
+        "src/sdk/cli/scripts/check-release-drift.mjs",
+        "src/sdk/cli/CHANGELOG.md",
+        "src/packages/core-domain/package.json",
+        "src/packages/mcp-server/package.json"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand -t validate.command"
+        "Verified against the LIVE npm registry: a clean `npm i @beyondnet/evolith-cli@1.1.0` in an empty project resolves the full closure from npm (agent-runtime/core-domain/infra-providers/sdk all 1.1.0) and the CLI boots — `--version` -> 1.1.0, `evaluate --help` OK, `enforce --help` OK (exercises enforcement/policy-compiler, the subpath missing from the stale 1.0.0). cli dist-tag latest: 1.1.0.",
+        "check:release-drift hardened to fail the publish when the shipped dist imports any @beyondnet/* not declared in dependencies — proven: aborts without the infra-providers dep, passes with it. npm publish --dry-run green for all 8 packages."
       ],
       "dependencyDisposition": "satisfied",
-      "dependencyRationale": "Proper closure delivered by GT-474 (resolver fix, commit 3c0ccf8a): an unresolvable/empty ruleset corpus now throws RulesetsNotFoundError and a zero-rule full run is a blocking failed; the interim non-blocking warning mitigation is retired."
-    },
-    {
-      "id": "GT-466",
-      "closedAt": "2026-07-09",
-      "closureCommit": "88866308",
-      "evidence": [
-        "src/rulesets/governance/satellite-contracts.rules.json",
-        "src/rulesets/opa/satellite-contracts.rego",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/satellite-contract-rule.handler.ts"
-      ],
-      "validationCommands": [
-        "npm run build --workspace @beyondnet/evolith-core-domain"
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-467",
-      "closedAt": "2026-07-09",
-      "closureCommit": "88866308",
-      "evidence": [
-        "src/rulesets/schema/evolith-workspace.schema.json",
-        "src/rulesets/governance/satellite-contracts.rules.json"
-      ],
-      "validationCommands": [
-        "node -e \"JSON.parse(require('fs').readFileSync('src/rulesets/schema/evolith-workspace.schema.json','utf8'))\""
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-468",
-      "closedAt": "2026-07-09",
-      "closureCommit": "88866308",
-      "evidence": [
-        "src/packages/core-domain/src/domain/satellite-record.ts",
-        "src/packages/core-domain/src/domain/workspace-descriptor.ts",
-        "src/rulesets/schema/satellite-record.schema.json"
-      ],
-      "validationCommands": [
-        "npm run build --workspace @beyondnet/evolith-core-domain"
-      ],
-      "dependencyDisposition": "none"
+      "dependencyRationale": "The real defect was the whole @beyondnet/evolith-*@1.0.0 line being stale vs develop (CLI deep-imports subpaths absent from the 1.0.0 tarballs) plus cli@1.0.1 crashing on an undeclared infra-providers dep. Resolved by a coordinated 1.1.0 re-release of all 8 packages (owner published in dependency order); the owner-publish dependency is now satisfied and verified live."
     },
     {
-      "id": "GT-469",
+      "id": "GT-452",
       "closedAt": "2026-07-09",
-      "closureCommit": "88866308",
+      "closureCommit": "3c0ccf8a",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/paths/satellite-resolver.ts"
+        "src/sdk/cli/src/commands/validate/validate.command.ts",
+        "src/sdk/cli/src/commands/validate/validate.command.spec.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand"
+        "npm test --workspace src/sdk/cli -- --runInBand -t validate.command"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "Proper closure delivered by GT-474 (resolver fix, commit 3c0ccf8a): an unresolvable/empty ruleset corpus now throws RulesetsNotFoundError and a zero-rule full run is a blocking failed; the interim non-blocking warning mitigation is retired."
     },
     {
-      "id": "GT-470",
-      "closedAt": "2026-07-09",
-      "closureCommit": "7e772d1c",
+      "id": "GT-453",
+      "closedAt": "2026-07-12",
+      "closureCommit": "fc28a318",
       "evidence": [
-        "src/packages/infra-providers/src/disk-ruleset.repository.ts"
+        "src/sdk/cli/templates/evolith.yaml.example",
+        "src/sdk/cli/src/commands/docs/evolith-yaml-template.spec.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace @beyondnet/evolith-infra-providers"
+        "cd src/sdk/cli && npx jest --runInBand evolith-yaml-template (ajv: template validates vs evolith-yaml.schema.json)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-471",
-      "closedAt": "2026-07-09",
-      "closureCommit": "70ccc230",
+      "id": "GT-454",
+      "closedAt": "2026-07-12",
+      "closureCommit": "fc28a318",
       "evidence": [
-        "src/tests/contract/roundtrip-gate-evaluate.spec.ts",
-        "src/apps/core-api/src/presentation/controllers/gates.controller.ts"
+        "src/sdk/cli/src/commands/docs/docs.command.ts",
+        "src/sdk/cli/src/commands/docs/docs.command.spec.ts"
       ],
       "validationCommands": [
-        "npm run test:contract"
+        "cd src/sdk/cli && npx jest --runInBand docs.command (writes evolith.yaml at repo ROOT in v1 shape; not .evolith/)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-472",
-      "closedAt": "2026-07-09",
-      "closureCommit": "70ccc230",
+      "id": "GT-455",
+      "closedAt": "2026-07-12",
+      "closureCommit": "74e87dee",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/cross-cutting-rule.handler.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/taxonomy-rule.handler.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
+        "src/sdk/cli/src/commands/architecture/scaffold.command.ts",
+        "src/sdk/cli/src/commands/architecture/scaffold.command.spec.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace @beyondnet/evolith-core-domain"
+        "cd src/sdk/cli && npx jest scaffold (dotnet dry-run); real `dotnet build` (SDK 10.0.201) 0 errors; init/scaffold dotnet parity"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-473",
-      "closedAt": "2026-07-09",
-      "closureCommit": "70ccc230",
+      "id": "GT-456",
+      "closedAt": "2026-07-12",
+      "closureCommit": "377e9af7",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/modes/ruleset-validation.mode.ts"
+        "src/sdk/cli/src/infrastructure/paths/core-resolver.ts",
+        "src/sdk/cli/src/commands/validate/validate.command.ts"
       ],
       "validationCommands": [
-        "npm run build --workspace @beyondnet/evolith-core-domain"
+        "resolveCoreOverride unified across validate/gate/phase/evaluate; --core resolves 129 topology rules + coreRef.path; missing Core -> actionable error"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-474",
-      "closedAt": "2026-07-09",
-      "closureCommit": "3c0ccf8a",
+      "id": "GT-457",
+      "closedAt": "2026-07-12",
+      "closureCommit": "d3524852",
       "evidence": [
-        "src/sdk/cli/src/commands/validate/validate.command.ts",
-        "src/sdk/cli/src/commands/validate/validate.command.spec.ts"
+        "src/sdk/cli/src/infrastructure/formatters/output-formatter.service.ts",
+        "src/sdk/cli/src/infrastructure/formatters/output-formatter.service.spec.ts"
       ],
       "validationCommands": [
-        "npm test --workspace src/sdk/cli -- --runInBand -t validate.command"
+        "cd src/sdk/cli && npx jest --runInBand output-formatter (table renders ruleId+title+description+remediation; opaque count gone)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-484",
-      "closedAt": "2026-07-11",
-      "closureCommit": "85e6502a",
+      "id": "GT-458",
+      "closedAt": "2026-07-12",
+      "closureCommit": "d3524852",
       "evidence": [
-        "src/packages/mcp-server/README.md",
-        "src/packages/mcp-server/README.es.md",
-        "src/packages/mcp-server/src/tools/tools.module.ts"
+        "src/sdk/cli/src/commands/agents/agents.command.ts",
+        "src/sdk/cli/src/commands/agents/agents.command.spec.ts"
       ],
       "validationCommands": [
-        "grep -rhoE \"name: 'evolith-[a-z0-9-]+'\" src/packages/mcp-server/src/tools | sort -u | wc -l",
-        "grep -n \"disponibles (47)\" src/packages/mcp-server/README.md src/packages/mcp-server/README.es.md"
+        "cd src/sdk/cli && npx jest --runInBand agents.command (--list/-install/-remove/-run route non-interactively; positional wins)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-529",
-      "closedAt": "2026-07-13",
-      "closureCommit": "856d2b56",
+      "id": "GT-459",
+      "closedAt": "2026-07-12",
+      "closureCommit": "d3524852",
       "evidence": [
-        "src/packages/infra-providers/src/jira-work-system.adapter.ts",
-        "src/packages/core-domain/src/domain/external-work-acl.ts"
+        "src/sdk/cli/src/commands/upgrade/upgrade.command.ts",
+        "src/sdk/cli/src/commands/upgrade/upgrade.command.spec.ts"
       ],
       "validationCommands": [
-        "cd src/packages/infra-providers && npx jest --runInBand jira-work-system (green)",
-        "infra-providers 78/78"
+        "cd src/sdk/cli && npx jest --runInBand upgrade.command (SatelliteUpgradeService built with fileSystem+logger; dry-run no crash)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-530",
-      "closedAt": "2026-07-13",
-      "closureCommit": "959538d6",
+      "id": "GT-460",
+      "closedAt": "2026-07-12",
+      "closureCommit": "a15c5b76",
       "evidence": [
-        "src/packages/infra-providers/src/langfuse-evidence.adapter.ts",
-        "src/packages/core-domain/src/domain/observability-evidence.ts"
+        "src/sdk/cli/scripts/gen-api-catalog.mjs",
+        "src/sdk/cli/src/commands/api/api.catalog.generated.ts",
+        "src/packages/mcp-server/src/tools/api-catalog-parity.spec.ts"
       ],
       "validationCommands": [
-        "cd src/packages/infra-providers && npx jest --runInBand langfuse-evidence (green)",
-        "infra-providers 78/78"
+        "cd src/packages/mcp-server && npx jest api-catalog-parity (3/3) — CLI catalog == live MCP registry (47 tools / 11 resources incl. GT-520 capabilities+contracts)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-527",
-      "closedAt": "2026-07-13",
-      "closureCommit": "702915bb",
+      "id": "GT-461",
+      "closedAt": "2026-07-12",
+      "closureCommit": "377e9af7",
       "evidence": [
-        "src/packages/infra-providers/src/idp-blueprint.adapter.ts",
-        "src/packages/infra-providers/src/backstage-catalog.loader.ts",
-        "src/packages/core-domain/src/domain/ownership.ts"
+        "reference/governance/sdlc/gates/gate-f1.json",
+        "src/sdk/cli/src/commands/sdlc/gate-status.command.ts"
       ],
       "validationCommands": [
-        "cd src/packages/infra-providers && npx jest --runInBand idp-blueprint (green)",
-        "infra-providers 78/78"
+        "gate evaluate -p discovery --core emits ADR-0073 GateEvidence (verdict failed); phase advance blocks; sdlc gate-status --core unified"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-477",
-      "closedAt": "2026-07-13",
-      "closureCommit": "56968194",
+      "id": "GT-462",
+      "closedAt": "2026-07-09",
+      "closureCommit": "e9a4deb5",
       "evidence": [
-        ".github/workflows/docs.yml",
-        ".harness/scripts/ci/08-validate-tracking.mjs"
+        "reference/core/architecture/adrs/core/0108-masstransit-owned-message-topology.md",
+        "reference/core/architecture/adrs/core/0108-masstransit-owned-message-topology.es.md",
+        "product/infra/kubernetes/README.md"
       ],
       "validationCommands": [
-        "guard validates parseProgress on PR/push (GT-476)"
+        "git show --stat -- deploy/kubernetes/messaging/broker-rbac.yaml (renamed from tenant-topology.yaml)",
+        "grep -L 'kind: Exchange' deploy/kubernetes/messaging/broker-rbac.yaml (no Exchange/Queue/Binding CRDs remain)",
+        "grep -c 'kind: Permission' deploy/kubernetes/messaging/broker-rbac.yaml (== 3 per-product permissions)"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Topology decision recorded (ADR-0108) and message-path CRDs retired in favor of per-product User/Permission RBAC. The G1 'consumer endpoint started' assertion (bus health, not pod Ready) is delegated to the G1 integration-gate automation (§13) and tracked there — it is not a blocker for the topology decision."
     },
     {
-      "id": "GT-480",
-      "closedAt": "2026-07-13",
-      "closureCommit": "85595fd6",
+      "id": "GT-463",
+      "closedAt": "2026-07-09",
+      "closureCommit": "79d1c403",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.es.md"
+        "product/operations/alerts/prometheus-alerts.yml",
+        "product/operations/incident-response-poison-message-reprocess.md",
+        "product/operations/incident-response-poison-message-reprocess.es.md"
       ],
       "validationCommands": [
-        "0 HECHO tokens; guard STATUS_MAP green"
+        "ruby -ryaml -e 'YAML.load_file(...)' — 3 groups; messaging-alerts: MassTransitPoisonMessages + TenantProjectionQueueMissing",
+        "grep '_error' product/operations/alerts/prometheus-alerts.yml"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-476",
-      "closedAt": "2026-07-12",
-      "closureCommit": "56968194",
+      "id": "GT-465",
+      "closedAt": "2026-07-09",
+      "closureCommit": "70d8b8cc",
       "evidence": [
-        ".github/workflows/docs.yml",
-        ".harness/scripts/ci/08-validate-tracking.mjs"
+        "product/infra/helm/evolith-core-api/templates/networkpolicy.yaml",
+        "product/infra/kubernetes/README.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/08-validate-tracking.mjs (Validated 532 gaps and 478 closure records, green)",
-        "grep -L 'control-center/gap-tracking' .harness/scripts/sync-*.mjs .harness/scripts/fix-tracking-*.mjs (all 5 re-pointed to gaps/+evidence/)",
-        "node --check on each edited script + docs.yml parses (jobs tracking-guard + validate; guard armed on pull_request/push)"
+        "ruby -ryaml -e 'YAML.load_stream(...network-policies.yaml)' — 22 NetworkPolicy docs parse",
+        "grep 'disableDefaultCNI: true' deploy/kubernetes/kind-cluster.yaml"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "deferred",
+      "dependencyRationale": "Manifests + kind config delivered; live allow/deny assertions belong to the G1 integration gate (Cilium must be installed on a live kind cluster to enforce them)."
     },
     {
-      "id": "GT-528",
-      "closedAt": "2026-07-12",
-      "closureCommit": "5c66dd69",
+      "id": "GT-466",
+      "closedAt": "2026-07-09",
+      "closureCommit": "88866308",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/enforcement/structurizr-parser.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/structurizr-parser.spec.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/c4-compiler.ts"
+        "src/rulesets/governance/satellite-contracts.rules.json",
+        "src/rulesets/opa/satellite-contracts.rego",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/satellite-contract-rule.handler.ts"
       ],
       "validationCommands": [
-        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand structurizr-parser (5/5)",
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (950/950 core-domain)"
+        "npm run build --workspace @beyondnet/evolith-core-domain"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "GT-528 required an executable C4 model: compileC4ToBoundaryRules (prior) + parseStructurizrDsl (this) close the intent→executable path end-to-end. GT-516 (enforce: compiler) is a sibling engine, satisfied."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-525",
-      "closedAt": "2026-07-12",
-      "closureCommit": "57b2cc09",
+      "id": "GT-467",
+      "closedAt": "2026-07-09",
+      "closureCommit": "88866308",
       "evidence": [
-        "src/packages/core-domain/src/domain/compliance.ts",
-        "src/packages/core-domain/src/domain/compliance.spec.ts",
-        "src/packages/core-domain/src/domain/violation.ts",
-        "src/packages/core-domain/src/evaluation/sarif-exporter.ts",
-        "src/packages/core-domain/src/evaluation/sarif-exporter.spec.ts"
+        "src/rulesets/schema/evolith-workspace.schema.json",
+        "src/rulesets/governance/satellite-contracts.rules.json"
       ],
       "validationCommands": [
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand 'compliance|sarif-exporter' (27/27)",
-        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (910/910 core-domain)"
+        "node -e \"JSON.parse(require('fs').readFileSync('src/rulesets/schema/evolith-workspace.schema.json','utf8'))\""
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-511",
-      "closedAt": "2026-07-12",
-      "closureCommit": "d769c97b",
+      "id": "GT-468",
+      "closedAt": "2026-07-09",
+      "closureCommit": "88866308",
       "evidence": [
-        "src/packages/core-domain/src/domain/violation.ts",
-        "src/packages/core-domain/src/domain/violation.spec.ts",
-        "src/rulesets/schema/violation.schema.json",
-        "src/rulesets/schema/enforcer-evidence.schema.json",
-        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts"
+        "src/packages/core-domain/src/domain/satellite-record.ts",
+        "src/packages/core-domain/src/domain/workspace-descriptor.ts",
+        "src/rulesets/schema/satellite-record.schema.json"
       ],
       "validationCommands": [
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand violation.spec (17/17)",
-        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (752/752 core-domain)"
+        "npm run build --workspace @beyondnet/evolith-core-domain"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-514",
-      "closedAt": "2026-07-12",
-      "closureCommit": "30aee332",
+      "id": "GT-469",
+      "closedAt": "2026-07-09",
+      "closureCommit": "88866308",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/enforcement/enforcer.types.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/shell-enforcer-adapter.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/enforcer-evaluator.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/composite-rule-evaluator.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/enforcer.spec.ts",
-        "src/rulesets/enforcement/enforcer-catalog.json",
-        "product/infra/validated-tool-catalog.md"
+        "src/sdk/cli/src/infrastructure/paths/satellite-resolver.ts"
       ],
       "validationCommands": [
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand enforcer.spec (+10)",
-        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (762/762 core-domain)"
+        "npm test --workspace src/sdk/cli -- --runInBand"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "GT-511 (Violation model) is satisfied. GT-512 (evaluation-environment provisioning/sandbox) is still open, but GT-514's scope is the SEAM: IEnforcerAdapter, EnforcerEvaluator, CompositeRuleEvaluator, ShellEnforcerAdapter and the IProcessRunner PORT all land and are stub-tested. The production sandboxed IProcessRunner is GT-512's deliverable (a sibling adapter behind the same port); Core intentionally ships no unsandboxed default runner. Real enforcer adapters (dependency-cruiser) land in GT-515."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-517",
-      "closedAt": "2026-07-12",
-      "closureCommit": "e0e2b72c",
+      "id": "GT-470",
+      "closedAt": "2026-07-09",
+      "closureCommit": "7e772d1c",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/enforcement/policy-baseline.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/policy-baseline.spec.ts"
+        "src/packages/infra-providers/src/disk-ruleset.repository.ts"
       ],
       "validationCommands": [
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand policy-baseline.spec (+17)",
-        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
-        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (822/822 core-domain, combined wave)"
+        "npm run build --workspace @beyondnet/evolith-infra-providers"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-478",
-      "closedAt": "2026-07-12",
-      "closureCommit": "4baec214",
+      "id": "GT-471",
+      "closedAt": "2026-07-09",
+      "closureCommit": "70ccc230",
       "evidence": [
-        "src/apps/core-api/src/architecture-plan/architecture-plan.controller.ts",
-        "src/apps/core-api/src/architecture-plan/architecture-plan.dto.ts",
-        "src/apps/core-api/src/architecture-plan/architecture-plan.controller.spec.ts"
+        "src/tests/contract/roundtrip-gate-evaluate.spec.ts",
+        "src/apps/core-api/src/presentation/controllers/gates.controller.ts"
       ],
       "validationCommands": [
-        "cd src/apps/core-api && npx jest --runInBand architecture-plan (6/6)",
-        "cd src/apps/core-api && npx tsc -b tsconfig.json (clean); full core-api 143/143",
-        "OpenAPI exposes /api/v1/architecture-plans/evaluate (single v1), DTO schemas registered"
+        "npm run test:contract"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-482",
-      "closedAt": "2026-07-12",
-      "closureCommit": "05baab8f",
+      "id": "GT-472",
+      "closedAt": "2026-07-09",
+      "closureCommit": "70ccc230",
       "evidence": [
-        "src/packages/mcp-server/src/tools/tools-registration.spec.ts",
-        "src/packages/mcp-server/src/tools/tools.module.ts"
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/cross-cutting-rule.handler.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/taxonomy-rule.handler.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
       ],
       "validationCommands": [
-        "cd src/packages/mcp-server && npx jest --runInBand tools-registration (2/2)",
-        "set-equality vs the real 47 registered tools; negative check (fake tool -> fail) confirmed"
+        "npm run build --workspace @beyondnet/evolith-core-domain"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-483",
-      "closedAt": "2026-07-12",
-      "closureCommit": "597d3581",
+      "id": "GT-473",
+      "closedAt": "2026-07-09",
+      "closureCommit": "70ccc230",
       "evidence": [
-        ".bmad-core/engine/step-executor.mjs",
-        "reference/core/sdlc/01-playbooks/e2e-test-playbooks.md",
-        "reference/core/sdlc/01-playbooks/e2e-test-playbooks.es.md"
+        "src/packages/core-domain/src/application/validators/modes/ruleset-validation.mode.ts"
       ],
       "validationCommands": [
-        "grep '.bmad-core/agents/' over the 3 fixed files -> 0 dangling refs",
-        "5 reference/core/foundations/agent-skills/qa-*.md targets confirmed present"
+        "npm run build --workspace @beyondnet/evolith-core-domain"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-510",
-      "closedAt": "2026-07-12",
-      "closureCommit": "0d45a08e",
+      "id": "GT-474",
+      "closedAt": "2026-07-09",
+      "closureCommit": "3c0ccf8a",
       "evidence": [
-        ".harness/scripts/ci/08-validate-tracking.mjs",
-        ".harness/scripts/ci/09-reconcile-maturity.mjs"
+        "src/sdk/cli/src/commands/validate/validate.command.ts",
+        "src/sdk/cli/src/commands/validate/validate.command.spec.ts"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/08-validate-tracking.mjs -> 'Validated 523 gaps and 439 closure records. passed'",
-        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check -> 'Maturity reconciliation matches' (asOf sync 0d45a08e)"
+        "npm test --workspace src/sdk/cli -- --runInBand -t validate.command"
       ],
       "dependencyDisposition": "none"
     },
@@ -6844,67 +6757,70 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-453",
+      "id": "GT-476",
       "closedAt": "2026-07-12",
-      "closureCommit": "fc28a318",
+      "closureCommit": "56968194",
       "evidence": [
-        "src/sdk/cli/templates/evolith.yaml.example",
-        "src/sdk/cli/src/commands/docs/evolith-yaml-template.spec.ts"
+        ".github/workflows/docs.yml",
+        ".harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "validationCommands": [
-        "cd src/sdk/cli && npx jest --runInBand evolith-yaml-template (ajv: template validates vs evolith-yaml.schema.json)"
+        "node .harness/scripts/ci/08-validate-tracking.mjs (Validated 532 gaps and 478 closure records, green)",
+        "grep -L 'control-center/gap-tracking' .harness/scripts/sync-*.mjs .harness/scripts/fix-tracking-*.mjs (all 5 re-pointed to gaps/+evidence/)",
+        "node --check on each edited script + docs.yml parses (jobs tracking-guard + validate; guard armed on pull_request/push)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-454",
-      "closedAt": "2026-07-12",
-      "closureCommit": "fc28a318",
+      "id": "GT-477",
+      "closedAt": "2026-07-13",
+      "closureCommit": "56968194",
       "evidence": [
-        "src/sdk/cli/src/commands/docs/docs.command.ts",
-        "src/sdk/cli/src/commands/docs/docs.command.spec.ts"
+        ".github/workflows/docs.yml",
+        ".harness/scripts/ci/08-validate-tracking.mjs"
       ],
       "validationCommands": [
-        "cd src/sdk/cli && npx jest --runInBand docs.command (writes evolith.yaml at repo ROOT in v1 shape; not .evolith/)"
+        "guard validates parseProgress on PR/push (GT-476)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-457",
+      "id": "GT-478",
       "closedAt": "2026-07-12",
-      "closureCommit": "d3524852",
+      "closureCommit": "4baec214",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/formatters/output-formatter.service.ts",
-        "src/sdk/cli/src/infrastructure/formatters/output-formatter.service.spec.ts"
+        "src/apps/core-api/src/architecture-plan/architecture-plan.controller.ts",
+        "src/apps/core-api/src/architecture-plan/architecture-plan.dto.ts",
+        "src/apps/core-api/src/architecture-plan/architecture-plan.controller.spec.ts"
       ],
       "validationCommands": [
-        "cd src/sdk/cli && npx jest --runInBand output-formatter (table renders ruleId+title+description+remediation; opaque count gone)"
+        "cd src/apps/core-api && npx jest --runInBand architecture-plan (6/6)",
+        "cd src/apps/core-api && npx tsc -b tsconfig.json (clean); full core-api 143/143",
+        "OpenAPI exposes /api/v1/architecture-plans/evaluate (single v1), DTO schemas registered"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-458",
+      "id": "GT-479",
       "closedAt": "2026-07-12",
-      "closureCommit": "d3524852",
+      "closureCommit": "e6567eb7",
       "evidence": [
-        "src/sdk/cli/src/commands/agents/agents.command.ts",
-        "src/sdk/cli/src/commands/agents/agents.command.spec.ts"
+        "src/sdk/cli/test/e2e/surface-parity.e2e-spec.ts"
       ],
       "validationCommands": [
-        "cd src/sdk/cli && npx jest --runInBand agents.command (--list/-install/-remove/-run route non-interactively; positional wins)"
+        "envCommand dead field removed; envelope assertions made unconditional (fail on unparseable); GT-223 surface-parity-fixture claim reconciled as inaccurate"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-459",
-      "closedAt": "2026-07-12",
-      "closureCommit": "d3524852",
+      "id": "GT-480",
+      "closedAt": "2026-07-13",
+      "closureCommit": "85595fd6",
       "evidence": [
-        "src/sdk/cli/src/commands/upgrade/upgrade.command.ts",
-        "src/sdk/cli/src/commands/upgrade/upgrade.command.spec.ts"
+        "reference/core/control-center/gaps/gap-tracking.es.md"
       ],
       "validationCommands": [
-        "cd src/sdk/cli && npx jest --runInBand upgrade.command (SatelliteUpgradeService built with fileSystem+logger; dry-run no crash)"
+        "0 HECHO tokens; guard STATUS_MAP green"
       ],
       "dependencyDisposition": "none"
     },
@@ -6924,6 +6840,50 @@
       "dependencyDisposition": "deferred",
       "dependencyRationale": "Underlying standalone-CLI reference-path defect (ENOENT scandir reference/governance/sdlc/gates on gate/gate-status/phase after the taxonomy refactor) is tracked by GT-451 (F-007); the e2e suite is greened test-only via a mock Core rather than by shipping the fix here."
     },
+    {
+      "id": "GT-482",
+      "closedAt": "2026-07-12",
+      "closureCommit": "05baab8f",
+      "evidence": [
+        "src/packages/mcp-server/src/tools/tools-registration.spec.ts",
+        "src/packages/mcp-server/src/tools/tools.module.ts"
+      ],
+      "validationCommands": [
+        "cd src/packages/mcp-server && npx jest --runInBand tools-registration (2/2)",
+        "set-equality vs the real 47 registered tools; negative check (fake tool -> fail) confirmed"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-483",
+      "closedAt": "2026-07-12",
+      "closureCommit": "597d3581",
+      "evidence": [
+        ".bmad-core/engine/step-executor.mjs",
+        "reference/core/sdlc/01-playbooks/e2e-test-playbooks.md",
+        "reference/core/sdlc/01-playbooks/e2e-test-playbooks.es.md"
+      ],
+      "validationCommands": [
+        "grep '.bmad-core/agents/' over the 3 fixed files -> 0 dangling refs",
+        "5 reference/core/foundations/agent-skills/qa-*.md targets confirmed present"
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-484",
+      "closedAt": "2026-07-11",
+      "closureCommit": "85e6502a",
+      "evidence": [
+        "src/packages/mcp-server/README.md",
+        "src/packages/mcp-server/README.es.md",
+        "src/packages/mcp-server/src/tools/tools.module.ts"
+      ],
+      "validationCommands": [
+        "grep -rhoE \"name: 'evolith-[a-z0-9-]+'\" src/packages/mcp-server/src/tools | sort -u | wc -l",
+        "grep -n \"disponibles (47)\" src/packages/mcp-server/README.md src/packages/mcp-server/README.es.md"
+      ],
+      "dependencyDisposition": "none"
+    },
     {
       "id": "GT-485",
       "closedAt": "2026-07-12",
@@ -7250,354 +7210,388 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-479",
+      "id": "GT-510",
       "closedAt": "2026-07-12",
-      "closureCommit": "e6567eb7",
+      "closureCommit": "0d45a08e",
       "evidence": [
-        "src/sdk/cli/test/e2e/surface-parity.e2e-spec.ts"
+        ".harness/scripts/ci/08-validate-tracking.mjs",
+        ".harness/scripts/ci/09-reconcile-maturity.mjs"
       ],
       "validationCommands": [
-        "envCommand dead field removed; envelope assertions made unconditional (fail on unparseable); GT-223 surface-parity-fixture claim reconciled as inaccurate"
+        "node .harness/scripts/ci/08-validate-tracking.mjs -> 'Validated 523 gaps and 439 closure records. passed'",
+        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check -> 'Maturity reconciliation matches' (asOf sync 0d45a08e)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-455",
+      "id": "GT-511",
       "closedAt": "2026-07-12",
-      "closureCommit": "74e87dee",
+      "closureCommit": "d769c97b",
       "evidence": [
-        "src/sdk/cli/src/commands/architecture/scaffold.command.ts",
-        "src/sdk/cli/src/commands/architecture/scaffold.command.spec.ts"
+        "src/packages/core-domain/src/domain/violation.ts",
+        "src/packages/core-domain/src/domain/violation.spec.ts",
+        "src/rulesets/schema/violation.schema.json",
+        "src/rulesets/schema/enforcer-evidence.schema.json",
+        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts"
       ],
       "validationCommands": [
-        "cd src/sdk/cli && npx jest scaffold (dotnet dry-run); real `dotnet build` (SDK 10.0.201) 0 errors; init/scaffold dotnet parity"
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand violation.spec (17/17)",
+        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (752/752 core-domain)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-456",
-      "closedAt": "2026-07-12",
-      "closureCommit": "377e9af7",
+      "id": "GT-512",
+      "closedAt": "2026-07-13",
+      "closureCommit": "dcff9ebc",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/paths/core-resolver.ts",
-        "src/sdk/cli/src/commands/validate/validate.command.ts"
+        "product/infra/kind/analysis-sandbox.yaml",
+        "src/packages/core-domain/src/application/validators/enforcement/provisioning.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/shell-enforcer-adapter.ts"
       ],
       "validationCommands": [
-        "resolveCoreOverride unified across validate/gate/phase/evaluate; --core resolves 129 topology rules + coreRef.path; missing Core -> actionable error"
+        "kubectl apply -f product/infra/kind/analysis-sandbox.yaml -> the sandbox Job runs as uid 65532 (non-root), rootfs READONLY, egress fails, offline compute OK; SecurityContext (caps drop/seccomp/no-privesc) + cgroup limits enforced by kind. Egress-deny NetworkPolicy is the artifact (Calico/Cilium in prod; docker run --network none verified genuine egress-deny). Real fetch verified: curl GitHub tarball + tar extract (tar present in evolith-agent-runtime image). Analyzers-run-on-restored-checkout proven by GT-515 (depcruise 0-FP) / GT-524 (NetArchTest 0-FP); PA-01..07 provisioning + cache in provisioning.ts."
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-461",
-      "closedAt": "2026-07-12",
-      "closureCommit": "377e9af7",
+      "id": "GT-513",
+      "closedAt": "2026-07-13",
+      "closureCommit": "9f027797",
       "evidence": [
-        "reference/governance/sdlc/gates/gate-f1.json",
-        "src/sdk/cli/src/commands/sdlc/gate-status.command.ts"
+        "src/packages/contracts/src/index.ts",
+        "src/packages/contracts/src/schemas/machine-contract-set.ts",
+        "src/packages/contracts/src/capabilities/capability-contract.parity.spec.ts",
+        "src/apps/core-api/src/presentation/controllers/capabilities.controller.ts"
       ],
       "validationCommands": [
-        "gate evaluate -p discovery --core emits ADR-0073 GateEvidence (verdict failed); phase advance blocks; sdlc gate-status --core unified"
+        "cd src/packages/contracts && npx tsc -p tsconfig.json && npx jest (2 suites, 13/13) — @beyondnet/evolith-contracts SemVer + CONTRACT_SET_SHA256; parity spec binds package to live buildCapabilityManifest and FAILS on added-engine / single-consumer drift. GET /api/v1/capabilities served by CapabilitiesController (on develop)."
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-460",
+      "id": "GT-514",
       "closedAt": "2026-07-12",
-      "closureCommit": "a15c5b76",
+      "closureCommit": "30aee332",
       "evidence": [
-        "src/sdk/cli/scripts/gen-api-catalog.mjs",
-        "src/sdk/cli/src/commands/api/api.catalog.generated.ts",
-        "src/packages/mcp-server/src/tools/api-catalog-parity.spec.ts"
+        "src/packages/core-domain/src/application/validators/enforcement/enforcer.types.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/shell-enforcer-adapter.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/enforcer-evaluator.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/composite-rule-evaluator.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/enforcer.spec.ts",
+        "src/rulesets/enforcement/enforcer-catalog.json",
+        "product/infra/validated-tool-catalog.md"
       ],
       "validationCommands": [
-        "cd src/packages/mcp-server && npx jest api-catalog-parity (3/3) — CLI catalog == live MCP registry (47 tools / 11 resources incl. GT-520 capabilities+contracts)"
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand enforcer.spec (+10)",
+        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (762/762 core-domain)"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "GT-511 (Violation model) is satisfied. GT-512 (evaluation-environment provisioning/sandbox) is still open, but GT-514's scope is the SEAM: IEnforcerAdapter, EnforcerEvaluator, CompositeRuleEvaluator, ShellEnforcerAdapter and the IProcessRunner PORT all land and are stub-tested. The production sandboxed IProcessRunner is GT-512's deliverable (a sibling adapter behind the same port); Core intentionally ships no unsandboxed default runner. Real enforcer adapters (dependency-cruiser) land in GT-515."
     },
     {
-      "id": "GT-439",
+      "id": "GT-515",
       "closedAt": "2026-07-13",
-      "closureCommit": "efd05f67",
+      "closureCommit": "6ca47e4d",
       "evidence": [
-        "src/apps/agent-runtime-api/src/auth/api-key.guard.ts",
-        "src/apps/agent-runtime-api/src/auth/tenant-corpus.guard.ts",
-        "src/apps/agent-runtime-api/src/auth/jwt.util.ts",
-        "src/apps/agent-runtime-api/src/app.module.ts"
+        "src/rulesets/enforcement/dependency-cruiser.cjs",
+        "src/packages/core-domain/src/application/validators/enforcement/adapters/dependency-cruiser-adapter.ts"
       ],
       "validationCommands": [
-        "cd src/apps/agent-runtime-api && npx jest (33/33) — fail-closed auth (unset-key⇒denied, dev-bypass⇒allowed), JWT tenant-claim extraction, TenantCorpusGuard cross-tenant denial; both guards in APP_GUARD"
+        "dependency-cruise --config src/rulesets/enforcement/dependency-cruiser.cjs (enhancedResolveOptions+tsConfig) over the deps-installed core-domain from 4 entry points -> 144 modules cruised, 0 couldNotResolve (the FP class), 9 REAL violations (no-circular/no-orphans); parseDependencyCruiserReport parsed all 9 1:1 -> 0 false positives on the real corpus"
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-512 restored-environment requirement met for the Node/TS runtime: the committed depcruise config + deps-installed checkout resolve every import (0 couldNotResolve), so the adapter runs against a real corpus with 0 FP."
     },
     {
-      "id": "GT-534",
+      "id": "GT-516",
       "closedAt": "2026-07-13",
-      "closureCommit": "af97a14c",
+      "closureCommit": "806e3337",
       "evidence": [
-        "src/packages/infra-providers/src/lighthouse-evidence.provider.ts",
-        "src/packages/infra-providers/src/lighthouse-evidence.provider.spec.ts",
-        "reference/core/architecture/adrs/core/0113-nodejs-lighthouse-evidence-adapter.md"
+        "src/packages/core-domain/src/application/validators/enforcement/policy-compiler.ts",
+        "src/rulesets/adr/adr-0002-hexagonal-architecture.rules.json",
+        "src/packages/core-domain/src/application/validators/enforcement/enforcer-subsystem.ts"
       ],
       "validationCommands": [
-        "cd src/packages/infra-providers && npx tsc && npx jest (13 suites, 105/105) — LighthouseEvidenceProvider emits deterministic canonical Evidence with full provenance; categories→EvidenceFinding severity; stubbed LHR (no Chrome)"
+        "End-to-end: compileRuleset(ADR-0002 HXA rules) -> 5 compiled dependency-cruiser forbidden checks (hxa-01/02/04/05/07) + HXA-06 documented native fallback; toDependencyCruiserConfig -> a real .dependency-cruiser config; a REAL depcruise spawn against a workspace where application/service.ts imports infrastructure/db reports hxa-02-application-no-infrastructure -> parseDependencyCruiserReport -> 1 canonical Violation; a clean workspace yields 0 -> 0 false positives on a real cross-runtime tool spawn."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-512 restored-workspace/toolchain now demonstrated (the analyzer runs a real depcruise spawn resolving TS); the enforce block compiles and the round-trip is 0-FP on a live run."
     },
     {
-      "id": "GT-526",
-      "closedAt": "2026-07-13",
-      "closureCommit": "8fd95eb3",
+      "id": "GT-517",
+      "closedAt": "2026-07-12",
+      "closureCommit": "e0e2b72c",
       "evidence": [
-        "src/sdk/cli/src/commands/enforce/enforce.command.ts",
-        "src/sdk/cli/src/infrastructure/agent/edit-hook/edit-hook.service.ts",
-        "src/sdk/cli/src/infrastructure/agent/edit-hook/hook-payload.ts",
-        "src/sdk/cli/docs/edit-time-enforcement.md"
+        "src/packages/core-domain/src/application/validators/enforcement/policy-baseline.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/policy-baseline.spec.ts"
       ],
       "validationCommands": [
-        "cd src/sdk/cli && npm run build && npx jest (71 suites, 967/967; edit-hook+enforce 45/45) — `evolith enforce edit` blocks a boundary-violating edit (exit 2) with canonical Violation; conforming edit exit 0; cross-agent VendorHookAdapter registry"
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand policy-baseline.spec (+17)",
+        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (822/822 core-domain, combined wave)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-533",
+      "id": "GT-518",
       "closedAt": "2026-07-13",
-      "closureCommit": "baf570f4",
+      "closureCommit": "2abe60b5",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/evaluation-orchestrator.service.ts",
-        "src/packages/core-domain/src/evaluation/contracts/quality-evidence.ts",
-        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts",
-        "src/packages/core-domain/src/evaluation/evaluation-orchestrator.spec.ts"
+        "src/packages/infra-providers/src/file-waiver-store.provider.ts",
+        "src/packages/infra-providers/src/file-waiver-store.provider.spec.ts",
+        "src/sdk/cli/src/commands/waiver/waiver.command.ts",
+        "src/packages/core-domain/src/evaluation/drift-gate.ts"
       ],
       "validationCommands": [
-        "cd src/packages/core-domain && npx tsc && npx jest (95 suites, 966/966) — evaluate() folds ctx.qualitySignals via resolveEvidenceSignals onto EvaluationResult.qualitySignals; WITH evidence ⇒ present signal surfaced, verdict PASS; WITHOUT ⇒ no-evidence signal, evaluation still succeeds. Core stays provider-free (grep-clean)."
+        "FileWaiverStore infra-providers 2/2 (persists+reloads across instances, retains versions, fails closed on corrupt file); CLI smoke green; LIVE: evolith waiver request/approve/revise persists v1,v2 to JSON across separate invocations; evolith evaluate --format drift on a violating workspace exits 1 and renders a PR-comment body (Blocked, 37 blocking violations, each citing rule + CODEOWNERS owner) — the mandated fallback meets the block+comment criterion; native GitHub-App Checks-API publish is a follow-on. SARIF/evidence criterion already done."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "The native GitHub/GitLab Checks-API publish needs a GitHub App with checks:write (owner infra); the mandated PrCommentFallbackPublisher + non-zero exit satisfy the block+comment requirement, verified live. The durable waiver store + CLI are complete."
     },
     {
-      "id": "GT-513",
-      "closedAt": "2026-07-13",
-      "closureCommit": "9f027797",
+      "id": "GT-519",
+      "closedAt": "2026-07-17",
+      "closureCommit": "4eb471a6",
       "evidence": [
-        "src/packages/contracts/src/index.ts",
-        "src/packages/contracts/src/schemas/machine-contract-set.ts",
-        "src/packages/contracts/src/capabilities/capability-contract.parity.spec.ts",
-        "src/apps/core-api/src/presentation/controllers/capabilities.controller.ts"
+        "src/packages/core-domain/src/application/validators/ruleset-validator.types.ts",
+        "src/packages/core-domain/src/application/validators/ruleset-validator.service.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/index.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/enforcer-metrics.spec.ts",
+        "src/packages/core-domain/src/index.ts"
       ],
       "validationCommands": [
-        "cd src/packages/contracts && npx tsc -p tsconfig.json && npx jest (2 suites, 13/13) — @beyondnet/evolith-contracts SemVer + CONTRACT_SET_SHA256; parity spec binds package to live buildCapabilityManifest and FAILS on added-engine / single-consumer drift. GET /api/v1/capabilities served by CapabilitiesController (on develop)."
+        "core-domain 1026/1026 (+2 tests locking options.metrics threading through createCompositeEnforcerStrategy + the noop fallback); mcp 326/326; cli 969/969; core-api 152/152; tsc --noEmit clean across all four.",
+        "Public seam verified: RulesetValidatorOptions.metrics forwarded into the enforcer subsystem factory and the metrics API (IEnforcerMetrics/NoopEnforcerMetrics/RecordingEnforcerMetrics/ENFORCER_METRICS) re-exported from core-domain, so a host can construct a real Meter-backed adapter (previously the seam was permanently no-op and un-wireable through any surface)."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Parity wiring (processRunner injected in CLI/MCP/REST) and enforcer-catalog<->tool-catalog version pins were already live (f8310fac/4b6db4d5); this closed the remaining OTel-metrics seam. Ops-only remainder stays out of scope: per-runtime composable CI images + vuln-scan/Renovate, and activating a live OTel Meter-backed IEnforcerMetrics adapter inside each surface module (host config) — the code seam is complete and importable."
     },
     {
-      "id": "GT-535",
+      "id": "GT-520",
       "closedAt": "2026-07-13",
-      "closureCommit": "d450d969",
+      "closureCommit": "87645d26",
       "evidence": [
-        "src/packages/agent-runtime/src/domain/rubrics/structural-review-rubric.ts",
-        "src/packages/agent-runtime/src/application/structural-review-provider.ts",
-        "src/packages/agent-runtime/src/application/structural-quality-gate.ts",
-        "src/packages/agent-runtime/src/adapters/skills/default-skills.ts"
+        "src/packages/mcp-server/src/mcp/oauth-resource-server.ts",
+        "src/packages/mcp-server/src/mcp/abac-evaluator.ts",
+        "src/packages/mcp-server/src/mcp/resources.service.ts",
+        "src/packages/mcp-server/src/mcp/mcp-server-auth.ts"
       ],
       "validationCommands": [
-        "cd src/packages/agent-runtime && npx tsc && npx jest (16 suites, 110/110) — rubric ranked by severity; StructuralReviewProvider emits probabilistic Evidence + provenance and registers in the GT-533 registry; evaluateStructuralGate blocks high/critical; GT-424 skill-registry parity green"
+        "cd src/packages/mcp-server && npx jest oauth abac mcp-server-auth (5 suites, 35/35) + full 326/326 — all three ACs met: OAuth 2.1 resource-server validator (JWKS RS/PS/ES + shared HS, iss/aud/exp/nbf) wired into the Streamable HTTP bearer path (401 on missing/invalid/expired/spoofed); every tools/call ABAC-checked per verified identity + audited; evolith://capabilities and evolith://contracts resources served (resources.service.ts)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-540",
-      "closedAt": "2026-07-13",
-      "closureCommit": "40464149",
+      "id": "GT-521",
+      "closedAt": "2026-07-14",
+      "closureCommit": "e322bd7b",
       "evidence": [
-        "src/packages/agent-runtime/src/adapters/knowledge/pgvector-knowledge.adapter.ts",
-        "src/packages/agent-runtime/src/adapters/knowledge/pgvector-knowledge.adapter.spec.ts",
-        "src/apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts",
-        "reference/core/control-center/maturity-reports/maturity-assessment.md"
+        "src/packages/core-domain/src/application/validators/enforcement/adapters/import-linter-adapter.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/adapters/sarif-security-adapter.ts",
+        "src/packages/core-domain/src/domain/violation.ts",
+        "src/rulesets/enforcement/enforcer-catalog.json",
+        "product/infra/validated-tool-catalog.md"
       ],
       "validationCommands": [
-        "cd src/packages/agent-runtime && npx tsc && npx jest (17 suites, 118/118) + cd src/apps/agent-runtime-api && npx nest build && npx jest (5 suites, 67/67) — PgVectorKnowledgeAdapter cosine top-k over rag_chunks with injected embedder+pg seams, ranked KnowledgeChunk + citation; runtime.factory selects pgvector via env, in-memory default preserved"
+        "core-domain 1024/1024 (incl. import-linter-adapter.spec + sarif-security-adapter.spec + updated enforcer-catalog-parity/enforcer-subsystem anti-drift specs); core-api tsc --noEmit clean (Violation.category propagates).",
+        "import-linter (Python) LIVE-verified against a real corpus: a package whose domain imports infrastructure yields exactly 1 Violation carrying the broken import chain; a clean package yields 0 (0 FP).",
+        "Security-SARIF (Checkov/Trivy) LIVE-verified: a real Checkov SARIF over a Terraform corpus (8 findings) parses via the shared GT-515 ingestSarif to 8 Violations, ALL category='security'; a clean scan yields 0."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-514 (ShellEnforcerAdapter/IProcessRunner seam) + GT-515 (SARIF 2.1.0 ingester, reused wholesale by the security adapters) both DONE. Criterion #1's own gate held: import-linter (Python) + Checkov/Trivy (IaC/security) landed and were exercised against real corpora; Deptrac (PHP) / ArchUnit (JVM) / jQAssistant (Neo4j) correctly stay adapter-pending — no real repo of those runtimes exists to exercise them, so building them would be speculative and untestable per the gap's Risk/Evidence."
     },
     {
-      "id": "GT-542",
-      "closedAt": "2026-07-13",
-      "closureCommit": "56028e52",
+      "id": "GT-523",
+      "closedAt": "2026-07-18",
+      "closureCommit": "35ea46e1",
       "evidence": [
-        "src/apps/core-api/src/infrastructure/metrics/metrics.service.ts",
-        "src/apps/core-api/src/infrastructure/metrics/metrics.service.spec.ts",
-        "src/apps/core-api/src/presentation/controllers/evaluation.controller.ts",
-        "src/apps/core-api/src/presentation/controllers/gates.controller.ts"
+        "reference/core/control-center/gaps/gap-tracking.md",
+        "reference/core/control-center/gaps/gap-tracking.es.md",
+        "reference/core/control-center/gaps/gap-reference-catalog.md",
+        "reference/core/control-center/gaps/gap-reference-catalog.es.md",
+        "reference/core/control-center/evidence/gap-closure-evidence.json",
+        "reference/core/control-center/maturity-reports/maturity-evidence.json",
+        ".harness/scripts/ci/08-validate-tracking.mjs",
+        ".github/workflows/docs.yml"
       ],
       "validationCommands": [
-        "cd src/apps/core-api && npx tsc -p tsconfig.json --noEmit && npx jest metrics (3 suites, 10/10) + full 150/150 — recordGateEvaluation emits evolith_gate_evaluations_total{status,gateId,phase} + evolith_gate_evaluation_duration_seconds, wired into EvaluationController (inline/canonical/legacy) and GatesController; spec asserts the increment + duration bucket appear in /metrics output"
+        "node .harness/scripts/ci/08-validate-tracking.mjs -- exit 0, zero ERROR lines, \"Validated 565 gaps and 530 closure records\". The ~653-error report that opened this gap is gone: EN/ES boards resync row-for-row, every board id has a catalog section in both languages, and the progress counters are re-derived from the rows the guard itself parses.",
+        "Board/registry reconciliation landed across f3f271da (EN/ES resync, GT-484 status desync), f70b98ce (six legacy closure records repaired: partial -> accepted-scope for GT-425/431/434/462, GT-463 criteria checked against evidence, GT-465 reworded to delivered scope) and e138b1d4 (records for GT-519/438/451).",
+        "ES token normalization verified: zero `HECHO` status cells remain in gap-tracking.es.md, all 13 normalized to COMPLETADO (GT-480).",
+        "Guard re-arm confirmed delivered by GT-476 (now DONE): .github/workflows/docs.yml runs 08-validate-tracking.mjs and 09-reconcile-maturity.mjs --check, so both guards are armed in CI rather than dormant.",
+        "The CI-owned remainder was paid genuinely, not by a date bump (commit 35ea46e1): all four checks in maturity-evidence.json now carry observedAt 2026-07-18 with real GitHub Actions run URLs and commits, asOf is re-synced to the board, and the observation was honest enough to INVERT three checks from PASS to BLOCKED -- MCP smoke timeout, branch coverage 62.89% against a 75% gate, and 174 doc-validation errors -- with no threshold relaxed and no stale figure carried forward.",
+        "Placeholder mapping cleared before closing: the three BLOCKED checks that had been provisionally mapped to GT-523 pending rows of their own are repointed to GT-561 (cli-baseline), GT-562 (coverage) and GT-563 (documentation), so no maturity evidence maps to a closed gap. The `release` check's pointer at the now-closed GT-552 was repointed to GT-563, the cause its own summary already named as what actually reds the gate; 09-reconcile-maturity.mjs no longer reports \"must map BLOCKED evidence to an active gap\"."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Two items are deliberately outside this closure rather than claimed. First, the guard path-fix and CI re-arm were always delegated to GT-476, which is now DONE and verified in docs.yml. Second, `09-reconcile-maturity.mjs` still reports its generated snapshot as stale: maturity-reconciliation.json has not been regenerated, and that regeneration is owned by GT-553 (the guard's dead path constants and ruleset miscount) and GT-445 (the stale doc-count surfaces), not by this gap, whose scope was the board/registry reconciliation and the fresh maturity OBSERVATION -- both of which are done. The three failures the observation exposed are not remainders of this gap either; they are independent defects now carried by GT-561, GT-562 and GT-563."
     },
     {
-      "id": "GT-543",
+      "id": "GT-524",
       "closedAt": "2026-07-13",
-      "closureCommit": "56028e52",
+      "closureCommit": "9eebcbdb",
       "evidence": [
-        "src/apps/core-api/src/infrastructure/metrics/metrics.service.ts",
-        "src/apps/core-api/src/infrastructure/interceptors/security-audit.interceptor.ts",
-        "product/operations/alerts/prometheus-alerts.yml",
-        "product/operations/slo/core-api-slo.md",
-        "src/apps/core-api/src/infrastructure/metrics/metric-drift.spec.ts"
+        "src/packages/core-domain/src/application/validators/enforcement/adapters/netarchtest-adapter.ts",
+        "src/rulesets/enforcement/enforcer-catalog.json"
       ],
       "validationCommands": [
-        "cd src/apps/core-api && npx jest metrics metric-drift (10/10) — added evolith_http_request_duration_seconds histogram (recorded from the SecurityAudit interceptor) and reconciled prometheus-alerts.yml + core-api-slo.md/.es.md from bare http_requests_total / http_request_duration_seconds_bucket to the evolith_-prefixed emitted names; the GT-550 drift guard asserts every referenced metric is emitted"
+        "dotnet 10: scaffolded a real .NET corpus (Domain/Infrastructure/ArchTests) with NetArchTest.Rules 1.3.2; DOTNET_CLI_UI_LANGUAGE=en dotnet test — a Domain->Infrastructure violation FAILS the arch test and parseNetArchTestReport parses it into 1 canonical Violation (tool=NetArchTest, error, locationless); the CLEAN corpus (no violation) PASSES and parses to 0 violations. 0 false positives on a real .NET corpus."
       ],
       "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-542 (gate metric emitted) and GT-550 (drift guard) both landed in the same commit; the histogram + name reconciliation are verified by the guard."
+      "dependencyRationale": "GT-512 restored-.NET-checkout requirement met: a real dotnet restore+build+test runs NetArchTest against a compiled corpus; the adapter parses real failures 1:1 and a clean corpus yields 0."
     },
     {
-      "id": "GT-546",
-      "closedAt": "2026-07-13",
-      "closureCommit": "56028e52",
+      "id": "GT-525",
+      "closedAt": "2026-07-12",
+      "closureCommit": "57b2cc09",
       "evidence": [
-        "src/apps/agent-runtime-api/src/health/agent-metrics.service.ts",
-        "src/apps/agent-runtime-api/src/health/agent-metrics.service.spec.ts",
-        "src/apps/agent-runtime-api/src/agent-runtime/agent-runtime.controller.ts",
-        "src/apps/agent-runtime-api/src/agent-runtime/agent-runtime.module.ts"
+        "src/packages/core-domain/src/domain/compliance.ts",
+        "src/packages/core-domain/src/domain/compliance.spec.ts",
+        "src/packages/core-domain/src/domain/violation.ts",
+        "src/packages/core-domain/src/evaluation/sarif-exporter.ts",
+        "src/packages/core-domain/src/evaluation/sarif-exporter.spec.ts"
       ],
       "validationCommands": [
-        "cd src/apps/agent-runtime-api && npx tsc -p tsconfig.json --noEmit && npx jest (6 suites, 72/72) — AgentMetricsService emits evolith_agent_runs_total{engine,verdict}, evolith_agent_run_duration_seconds, evolith_skill_invocations_total{skill}, evolith_agent_core_calls_total{outcome}, evolith_hitl_approvals_total{decision} on the default registry (so the existing /metrics exposes them); recorded from the AgentRuntimeResult via the controller; spec asserts each series"
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand 'compliance|sarif-exporter' (27/27)",
+        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (910/910 core-domain)"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "The catalog named a GT-519 noop metrics port to hang these on, but no such port exists in the agent-runtime package. Instrumented at the API/adapter boundary instead (per ADR-0102, metrics stay out of the domain), which satisfies both acceptance criteria without GT-519."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-550",
+      "id": "GT-526",
       "closedAt": "2026-07-13",
-      "closureCommit": "56028e52",
+      "closureCommit": "8fd95eb3",
       "evidence": [
-        "src/apps/core-api/src/infrastructure/metrics/metric-drift.spec.ts",
-        "product/operations/alerts/prometheus-alerts.yml",
-        "product/operations/slo/core-api-slo.md"
+        "src/sdk/cli/src/commands/enforce/enforce.command.ts",
+        "src/sdk/cli/src/infrastructure/agent/edit-hook/edit-hook.service.ts",
+        "src/sdk/cli/src/infrastructure/agent/edit-hook/hook-payload.ts",
+        "src/sdk/cli/docs/edit-time-enforcement.md"
       ],
       "validationCommands": [
-        "cd src/apps/core-api && npx jest metric-drift (2/2) — the guard extracts PromQL metric names from prometheus-alerts.yml + core-api-slo.md/.es.md and fails when a non-external (not node/kube/rabbitmq/opa/up) metric is emitted by no Core service; runs in the Test core-api CI job on every PR touching those files"
+        "cd src/sdk/cli && npm run build && npx jest (71 suites, 967/967; edit-hook+enforce 45/45) — `evolith enforce edit` blocks a boundary-violating edit (exit 2) with canonical Violation; conforming edit exit 0; cross-agent VendorHookAdapter registry"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-543 reconciled the metric names in the same commit, so the guard is green while enforcing no future drift."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-549",
+      "id": "GT-527",
       "closedAt": "2026-07-13",
-      "closureCommit": "e99064eb",
+      "closureCommit": "702915bb",
       "evidence": [
-        "src/apps/agent-runtime-api/src/auth/metrics-auth.guard.ts",
-        "src/apps/agent-runtime-api/src/auth/metrics-auth.guard.spec.ts",
-        "src/apps/agent-runtime-api/src/health/metrics.controller.ts",
-        "src/packages/mcp-server/src/mcp/mcp-server.service.ts"
+        "src/packages/infra-providers/src/idp-blueprint.adapter.ts",
+        "src/packages/infra-providers/src/backstage-catalog.loader.ts",
+        "src/packages/core-domain/src/domain/ownership.ts"
       ],
       "validationCommands": [
-        "cd src/packages/mcp-server && npx tsc && npx jest (44 suites, 326/326 — +2 HTTP tests: anon GET /metrics→401, x-api-key→200) + cd src/apps/agent-runtime-api && npx tsc && npx jest (7 suites, 77/77 — +5 MetricsAuthGuard tests) — /metrics now fail-closed on both services with a trusted-network opt-out, matching core-api MetricsAuthGuard (GT-393)"
+        "cd src/packages/infra-providers && npx jest --runInBand idp-blueprint (green)",
+        "infra-providers 78/78"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Catalog lists GT-545 (scrape config) as a dependency; the acceptance criterion \"scraper still succeeds with credentials\" is proven at the code/test level (the guard accepts the credential and rejects anonymous callers). Wiring the actual Prometheus scrape job with the credential is GT-545 (infra)."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-544",
-      "closedAt": "2026-07-13",
-      "closureCommit": "869f691d",
+      "id": "GT-528",
+      "closedAt": "2026-07-12",
+      "closureCommit": "5c66dd69",
       "evidence": [
-        "product/infra/observability/grafana/dashboards/evolith-governance.json",
-        "product/infra/observability/grafana/dashboards/evolith-sre-red.json",
-        "product/infra/observability/grafana/dashboards/dashboards.yml",
-        "product/operations/grafana/provisioning/datasources/datasources.yml"
+        "src/packages/core-domain/src/application/validators/enforcement/structurizr-parser.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/structurizr-parser.spec.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/c4-compiler.ts"
       ],
       "validationCommands": [
-        "docker compose -f docker-compose.evolith.yml -f docker-compose.observability.yml up -d; curl -su admin:admin http://localhost:3009/api/search?type=dash-db -> BOTH \"Evolith — Governance Health\" and \"Evolith — Platform SRE (RED)\" provisioned; the Prometheus datasource (uid evolith-prometheus) resolves and panels render live gate/HTTP/agent series"
+        "cd src/packages/core-domain && npx tsc -b tsconfig.json (clean)",
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand structurizr-parser (5/5)",
+        "cd src/packages/core-domain && npx jest --config jest.config.js --runInBand (950/950 core-domain)"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-542/543 (metrics emitted) and GT-545 (scrape) all DONE, so the datasource + dashboards render real series — verified live."
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "GT-528 required an executable C4 model: compileC4ToBoundaryRules (prior) + parseStructurizrDsl (this) close the intent→executable path end-to-end. GT-516 (enforce: compiler) is a sibling engine, satisfied."
     },
     {
-      "id": "GT-545",
+      "id": "GT-529",
       "closedAt": "2026-07-13",
-      "closureCommit": "869f691d",
+      "closureCommit": "856d2b56",
       "evidence": [
-        "product/infra/observability/prometheus.yml",
-        "product/operations/otel/prometheus-config.yml",
-        "product/infra/docker-compose.observability.yml"
+        "src/packages/infra-providers/src/jira-work-system.adapter.ts",
+        "src/packages/core-domain/src/domain/external-work-acl.ts"
       ],
       "validationCommands": [
-        "curl http://localhost:9090/api/v1/targets -> core-api, mcp, agent-runtime all health=up (scraped on :3000 with the API-key Bearer credential); fixed the canonical otel/prometheus-config.yml (was a single wrong bff:8000 target) to the same 3 jobs"
+        "cd src/packages/infra-providers && npx jest --runInBand jira-work-system (green)",
+        "infra-providers 78/78"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-547 (runnable stack) and GT-549 (guarded /metrics) DONE; the scrape authenticates against the fail-closed /metrics and all three targets are up — verified live."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-547",
+      "id": "GT-530",
       "closedAt": "2026-07-13",
-      "closureCommit": "869f691d",
+      "closureCommit": "959538d6",
       "evidence": [
-        "product/infra/docker-compose.observability.yml",
-        "product/infra/observability/prometheus.yml"
+        "src/packages/infra-providers/src/langfuse-evidence.adapter.ts",
+        "src/packages/core-domain/src/domain/observability-evidence.ts"
       ],
       "validationCommands": [
-        "cd product/infra && EVOLITH_API_KEY=local-dev-key docker compose -f docker-compose.evolith.yml -f docker-compose.observability.yml up -d -> one command brings up the 3 Node services + Prometheus (:9090, 3 targets up) + provisioned Grafana (:3009); the overlay is opt-in (separate compose file) and documented in its header"
+        "cd src/packages/infra-providers && npx jest --runInBand langfuse-evidence (green)",
+        "infra-providers 78/78"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-544 (Grafana) and GT-545 (scrape) close together in the same overlay; the whole stack was brought up and exercised end-to-end."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-520",
+      "id": "GT-533",
       "closedAt": "2026-07-13",
-      "closureCommit": "87645d26",
+      "closureCommit": "baf570f4",
       "evidence": [
-        "src/packages/mcp-server/src/mcp/oauth-resource-server.ts",
-        "src/packages/mcp-server/src/mcp/abac-evaluator.ts",
-        "src/packages/mcp-server/src/mcp/resources.service.ts",
-        "src/packages/mcp-server/src/mcp/mcp-server-auth.ts"
+        "src/packages/core-domain/src/evaluation/evaluation-orchestrator.service.ts",
+        "src/packages/core-domain/src/evaluation/contracts/quality-evidence.ts",
+        "src/packages/core-domain/src/evaluation/contracts/evaluation-result.ts",
+        "src/packages/core-domain/src/evaluation/evaluation-orchestrator.spec.ts"
       ],
       "validationCommands": [
-        "cd src/packages/mcp-server && npx jest oauth abac mcp-server-auth (5 suites, 35/35) + full 326/326 — all three ACs met: OAuth 2.1 resource-server validator (JWKS RS/PS/ES + shared HS, iss/aud/exp/nbf) wired into the Streamable HTTP bearer path (401 on missing/invalid/expired/spoofed); every tools/call ABAC-checked per verified identity + audited; evolith://capabilities and evolith://contracts resources served (resources.service.ts)"
+        "cd src/packages/core-domain && npx tsc && npx jest (95 suites, 966/966) — evaluate() folds ctx.qualitySignals via resolveEvidenceSignals onto EvaluationResult.qualitySignals; WITH evidence ⇒ present signal surfaced, verdict PASS; WITHOUT ⇒ no-evidence signal, evaluation still succeeds. Core stays provider-free (grep-clean)."
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-538",
+      "id": "GT-534",
       "closedAt": "2026-07-13",
-      "closureCommit": "cace6118",
+      "closureCommit": "af97a14c",
       "evidence": [
-        ".harness/scripts/ci/rag-pgvector.mjs",
-        ".harness/scripts/ci/rag-pgvector.schema.sql",
-        ".harness/scripts/ci/14-rag-index-sync.mjs"
+        "src/packages/infra-providers/src/lighthouse-evidence.provider.ts",
+        "src/packages/infra-providers/src/lighthouse-evidence.provider.spec.ts",
+        "reference/core/architecture/adrs/core/0113-nodejs-lighthouse-evidence-adapter.md"
       ],
       "validationCommands": [
-        "docker run pgvector/pgvector:pg17 + psql < rag-pgvector.schema.sql (CREATE EXTENSION vector + rag_chunks) + npm i pg; then EVOLITH_RAG_SYNC=true EVOLITH_RAG_PROVIDER=pgvector EVOLITH_RAG_PG_URL=... node 14-rag-index-sync.mjs -> LIVE receipt {provider:pgvector, durable:true, 399 chunks upserted}; verified 399 real rows in rag_chunks (2 source_files: catalog 303 + tracking 96, corpus_version b499115830db, embedding vector(1024)), metadata filtering by source_file/language/corpus_version works"
+        "cd src/packages/infra-providers && npx tsc && npx jest (13 suites, 105/105) — LighthouseEvidenceProvider emits deterministic canonical Evidence with full provenance; categories→EvidenceFinding severity; stubbed LHR (no Chrome)"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-446",
+      "id": "GT-535",
       "closedAt": "2026-07-13",
-      "closureCommit": "2c67a1aa",
+      "closureCommit": "d450d969",
       "evidence": [
-        "product/infra/kind/tracker-web.local.yaml",
-        "product/infra/docker-compose.evolith.yml"
+        "src/packages/agent-runtime/src/domain/rubrics/structural-review-rubric.ts",
+        "src/packages/agent-runtime/src/application/structural-review-provider.ts",
+        "src/packages/agent-runtime/src/application/structural-quality-gate.ts",
+        "src/packages/agent-runtime/src/adapters/skills/default-skills.ts"
       ],
       "validationCommands": [
-        "kind load docker-image evolith-tracker-web:local --name evolith-tracker; kubectl apply -f product/infra/kind/tracker-web.local.yaml (rollout 1/1) + port-forward svc/tracker-web 8088:80 -> the Evolith Tracker React SPA loads (HTTP 200, dev-auth as user AN / tenant root), the Control Tower renders governance KPIs from the live backend, and the nginx /api proxy reaches tracker-api -> real Core (/api/health 200). Objective-1 UI chain (tracker-web -> tracker-api -> core-api) verified in a browser"
+        "cd src/packages/agent-runtime && npx tsc && npx jest (16 suites, 110/110) — rubric ranked by severity; StructuralReviewProvider emits probabilistic Evidence + provenance and registers in the GT-533 registry; evaluateStructuralGate blocks high/critical; GT-424 skill-registry parity green"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Cross-repo (evolith_tracker): the M1 pilot closure — DB persistence + real Core evaluate() + Discovery gate E2E — was already met in the Tracker repo; this closes the last tail (verify the React UI in a browser) against the local Core chain. Broader per-phase UI coverage is follow-on. Core provides the stable contract (ADR-0101/0104)."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-515",
+      "id": "GT-538",
       "closedAt": "2026-07-13",
-      "closureCommit": "6ca47e4d",
+      "closureCommit": "cace6118",
       "evidence": [
-        "src/rulesets/enforcement/dependency-cruiser.cjs",
-        "src/packages/core-domain/src/application/validators/enforcement/adapters/dependency-cruiser-adapter.ts"
+        ".harness/scripts/ci/rag-pgvector.mjs",
+        ".harness/scripts/ci/rag-pgvector.schema.sql",
+        ".harness/scripts/ci/14-rag-index-sync.mjs"
       ],
       "validationCommands": [
-        "dependency-cruise --config src/rulesets/enforcement/dependency-cruiser.cjs (enhancedResolveOptions+tsConfig) over the deps-installed core-domain from 4 entry points -> 144 modules cruised, 0 couldNotResolve (the FP class), 9 REAL violations (no-circular/no-orphans); parseDependencyCruiserReport parsed all 9 1:1 -> 0 false positives on the real corpus"
+        "docker run pgvector/pgvector:pg17 + psql < rag-pgvector.schema.sql (CREATE EXTENSION vector + rag_chunks) + npm i pg; then EVOLITH_RAG_SYNC=true EVOLITH_RAG_PROVIDER=pgvector EVOLITH_RAG_PG_URL=... node 14-rag-index-sync.mjs -> LIVE receipt {provider:pgvector, durable:true, 399 chunks upserted}; verified 399 real rows in rag_chunks (2 source_files: catalog 303 + tracking 96, corpus_version b499115830db, embedding vector(1024)), metadata filtering by source_file/language/corpus_version works"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-512 restored-environment requirement met for the Node/TS runtime: the committed depcruise config + deps-installed checkout resolve every import (0 couldNotResolve), so the adapter runs against a real corpus with 0 FP."
+      "dependencyDisposition": "none"
     },
     {
       "id": "GT-539",
@@ -7613,183 +7607,174 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-524",
+      "id": "GT-540",
       "closedAt": "2026-07-13",
-      "closureCommit": "9eebcbdb",
+      "closureCommit": "40464149",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/enforcement/adapters/netarchtest-adapter.ts",
-        "src/rulesets/enforcement/enforcer-catalog.json"
+        "src/packages/agent-runtime/src/adapters/knowledge/pgvector-knowledge.adapter.ts",
+        "src/packages/agent-runtime/src/adapters/knowledge/pgvector-knowledge.adapter.spec.ts",
+        "src/apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts",
+        "reference/core/control-center/maturity-reports/maturity-assessment.md"
       ],
       "validationCommands": [
-        "dotnet 10: scaffolded a real .NET corpus (Domain/Infrastructure/ArchTests) with NetArchTest.Rules 1.3.2; DOTNET_CLI_UI_LANGUAGE=en dotnet test — a Domain->Infrastructure violation FAILS the arch test and parseNetArchTestReport parses it into 1 canonical Violation (tool=NetArchTest, error, locationless); the CLEAN corpus (no violation) PASSES and parses to 0 violations. 0 false positives on a real .NET corpus."
+        "cd src/packages/agent-runtime && npx tsc && npx jest (17 suites, 118/118) + cd src/apps/agent-runtime-api && npx nest build && npx jest (5 suites, 67/67) — PgVectorKnowledgeAdapter cosine top-k over rag_chunks with injected embedder+pg seams, ranked KnowledgeChunk + citation; runtime.factory selects pgvector via env, in-memory default preserved"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-512 restored-.NET-checkout requirement met: a real dotnet restore+build+test runs NetArchTest against a compiled corpus; the adapter parses real failures 1:1 and a clean corpus yields 0."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-512",
+      "id": "GT-541",
       "closedAt": "2026-07-13",
-      "closureCommit": "dcff9ebc",
+      "closureCommit": "24c26af1",
       "evidence": [
-        "product/infra/kind/analysis-sandbox.yaml",
-        "src/packages/core-domain/src/application/validators/enforcement/provisioning.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/shell-enforcer-adapter.ts"
+        ".github/workflows/rag-index-sync.yml",
+        "src/packages/agent-runtime/src/application/agent-runtime.service.ts",
+        "src/packages/agent-runtime/src/domain/ports/knowledge.port.ts"
       ],
       "validationCommands": [
-        "kubectl apply -f product/infra/kind/analysis-sandbox.yaml -> the sandbox Job runs as uid 65532 (non-root), rootfs READONLY, egress fails, offline compute OK; SecurityContext (caps drop/seccomp/no-privesc) + cgroup limits enforced by kind. Egress-deny NetworkPolicy is the artifact (Calico/Cilium in prod; docker run --network none verified genuine egress-deny). Real fetch verified: curl GitHub tarball + tar extract (tar present in evolith-agent-runtime image). Analyzers-run-on-restored-checkout proven by GT-515 (depcruise 0-FP) / GT-524 (NetArchTest 0-FP); PA-01..07 provisioning + cache in provisioning.ts."
+        "agent-runtime 123/123 (+2 grounding tests): a run with a seeded corpus records trace.groundedBy.corpusVersion + citations (queried BEFORE recommending), and an empty corpus grounds to empty without blocking. A reference/**/*.md commit runs 14-rag-index-sync.mjs (rag-index-sync.yml) which detects the 2 changed files and emits a delta receipt (verified). pgvector adapter now returns rag_chunks.corpus_version on the chunk."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-538 (durable pgvector store) + GT-539 (real embedder) + GT-540 (read adapter) all DONE — the workflow drives the durable delta sync and the runtime grounds against the read adapter, citing the corpus_version those produce."
     },
     {
-      "id": "GT-516",
+      "id": "GT-542",
       "closedAt": "2026-07-13",
-      "closureCommit": "806e3337",
+      "closureCommit": "56028e52",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/enforcement/policy-compiler.ts",
-        "src/rulesets/adr/adr-0002-hexagonal-architecture.rules.json",
-        "src/packages/core-domain/src/application/validators/enforcement/enforcer-subsystem.ts"
+        "src/apps/core-api/src/infrastructure/metrics/metrics.service.ts",
+        "src/apps/core-api/src/infrastructure/metrics/metrics.service.spec.ts",
+        "src/apps/core-api/src/presentation/controllers/evaluation.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/gates.controller.ts"
       ],
       "validationCommands": [
-        "End-to-end: compileRuleset(ADR-0002 HXA rules) -> 5 compiled dependency-cruiser forbidden checks (hxa-01/02/04/05/07) + HXA-06 documented native fallback; toDependencyCruiserConfig -> a real .dependency-cruiser config; a REAL depcruise spawn against a workspace where application/service.ts imports infrastructure/db reports hxa-02-application-no-infrastructure -> parseDependencyCruiserReport -> 1 canonical Violation; a clean workspace yields 0 -> 0 false positives on a real cross-runtime tool spawn."
+        "cd src/apps/core-api && npx tsc -p tsconfig.json --noEmit && npx jest metrics (3 suites, 10/10) + full 150/150 — recordGateEvaluation emits evolith_gate_evaluations_total{status,gateId,phase} + evolith_gate_evaluation_duration_seconds, wired into EvaluationController (inline/canonical/legacy) and GatesController; spec asserts the increment + duration bucket appear in /metrics output"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-512 restored-workspace/toolchain now demonstrated (the analyzer runs a real depcruise spawn resolving TS); the enforce block compiles and the round-trip is 0-FP on a live run."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-548",
+      "id": "GT-543",
       "closedAt": "2026-07-13",
-      "closureCommit": "85ff0bc7",
+      "closureCommit": "56028e52",
       "evidence": [
         "src/apps/core-api/src/infrastructure/metrics/metrics.service.ts",
-        "src/apps/agent-runtime-api/src/health/agent-metrics.service.ts",
-        "product/infra/observability/grafana/dashboards/evolith-governance.json",
-        "product/operations/slo/core-api-slo.md"
+        "src/apps/core-api/src/infrastructure/interceptors/security-audit.interceptor.ts",
+        "product/operations/alerts/prometheus-alerts.yml",
+        "product/operations/slo/core-api-slo.md",
+        "src/apps/core-api/src/infrastructure/metrics/metric-drift.spec.ts"
       ],
       "validationCommands": [
-        "core-api 152/152 (+2 bounded-tenant tests) + agent-runtime 77/77; LIVE against the local stack rebuilt with EVOLITH_METRICS_TENANT_ALLOWLIST=t-acme,local: evolith_gate_evaluations_total carries tenant=t-acme/local for allowlisted tenants and tenant=other for the rest (3 t-secret requests collapsed to other, the raw id never leaked); Governance Health dashboard has a $tenant template variable + a per-tenant panel; cap (|allowlist|+1, hard-capped 100) documented in code + SLO doc."
+        "cd src/apps/core-api && npx jest metrics metric-drift (10/10) — added evolith_http_request_duration_seconds histogram (recorded from the SecurityAudit interceptor) and reconciled prometheus-alerts.yml + core-api-slo.md/.es.md from bare http_requests_total / http_request_duration_seconds_bucket to the evolith_-prefixed emitted names; the GT-550 drift guard asserts every referenced metric is emitted"
       ],
       "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-542 (gate metric) and GT-546 (agent metric) DONE — the tenant label extends both; the per-tenant panel needs the Grafana datasource from GT-544 (DONE)."
+      "dependencyRationale": "GT-542 (gate metric emitted) and GT-550 (drift guard) both landed in the same commit; the histogram + name reconciliation are verified by the guard."
     },
     {
-      "id": "GT-518",
+      "id": "GT-544",
       "closedAt": "2026-07-13",
-      "closureCommit": "2abe60b5",
+      "closureCommit": "869f691d",
       "evidence": [
-        "src/packages/infra-providers/src/file-waiver-store.provider.ts",
-        "src/packages/infra-providers/src/file-waiver-store.provider.spec.ts",
-        "src/sdk/cli/src/commands/waiver/waiver.command.ts",
-        "src/packages/core-domain/src/evaluation/drift-gate.ts"
+        "product/infra/observability/grafana/dashboards/evolith-governance.json",
+        "product/infra/observability/grafana/dashboards/evolith-sre-red.json",
+        "product/infra/observability/grafana/dashboards/dashboards.yml",
+        "product/operations/grafana/provisioning/datasources/datasources.yml"
       ],
       "validationCommands": [
-        "FileWaiverStore infra-providers 2/2 (persists+reloads across instances, retains versions, fails closed on corrupt file); CLI smoke green; LIVE: evolith waiver request/approve/revise persists v1,v2 to JSON across separate invocations; evolith evaluate --format drift on a violating workspace exits 1 and renders a PR-comment body (Blocked, 37 blocking violations, each citing rule + CODEOWNERS owner) — the mandated fallback meets the block+comment criterion; native GitHub-App Checks-API publish is a follow-on. SARIF/evidence criterion already done."
+        "docker compose -f docker-compose.evolith.yml -f docker-compose.observability.yml up -d; curl -su admin:admin http://localhost:3009/api/search?type=dash-db -> BOTH \"Evolith — Governance Health\" and \"Evolith — Platform SRE (RED)\" provisioned; the Prometheus datasource (uid evolith-prometheus) resolves and panels render live gate/HTTP/agent series"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "The native GitHub/GitLab Checks-API publish needs a GitHub App with checks:write (owner infra); the mandated PrCommentFallbackPublisher + non-zero exit satisfy the block+comment requirement, verified live. The durable waiver store + CLI are complete."
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-542/543 (metrics emitted) and GT-545 (scrape) all DONE, so the datasource + dashboards render real series — verified live."
     },
     {
-      "id": "GT-541",
+      "id": "GT-545",
       "closedAt": "2026-07-13",
-      "closureCommit": "24c26af1",
+      "closureCommit": "869f691d",
       "evidence": [
-        ".github/workflows/rag-index-sync.yml",
-        "src/packages/agent-runtime/src/application/agent-runtime.service.ts",
-        "src/packages/agent-runtime/src/domain/ports/knowledge.port.ts"
+        "product/infra/observability/prometheus.yml",
+        "product/operations/otel/prometheus-config.yml",
+        "product/infra/docker-compose.observability.yml"
       ],
       "validationCommands": [
-        "agent-runtime 123/123 (+2 grounding tests): a run with a seeded corpus records trace.groundedBy.corpusVersion + citations (queried BEFORE recommending), and an empty corpus grounds to empty without blocking. A reference/**/*.md commit runs 14-rag-index-sync.mjs (rag-index-sync.yml) which detects the 2 changed files and emits a delta receipt (verified). pgvector adapter now returns rag_chunks.corpus_version on the chunk."
+        "curl http://localhost:9090/api/v1/targets -> core-api, mcp, agent-runtime all health=up (scraped on :3000 with the API-key Bearer credential); fixed the canonical otel/prometheus-config.yml (was a single wrong bff:8000 target) to the same 3 jobs"
       ],
       "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-538 (durable pgvector store) + GT-539 (real embedder) + GT-540 (read adapter) all DONE — the workflow drives the durable delta sync and the runtime grounds against the read adapter, citing the corpus_version those produce."
+      "dependencyRationale": "GT-547 (runnable stack) and GT-549 (guarded /metrics) DONE; the scrape authenticates against the fail-closed /metrics and all three targets are up — verified live."
     },
     {
-      "id": "GT-521",
-      "closedAt": "2026-07-14",
-      "closureCommit": "e322bd7b",
+      "id": "GT-546",
+      "closedAt": "2026-07-13",
+      "closureCommit": "56028e52",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/enforcement/adapters/import-linter-adapter.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/adapters/sarif-security-adapter.ts",
-        "src/packages/core-domain/src/domain/violation.ts",
-        "src/rulesets/enforcement/enforcer-catalog.json",
-        "product/infra/validated-tool-catalog.md"
+        "src/apps/agent-runtime-api/src/health/agent-metrics.service.ts",
+        "src/apps/agent-runtime-api/src/health/agent-metrics.service.spec.ts",
+        "src/apps/agent-runtime-api/src/agent-runtime/agent-runtime.controller.ts",
+        "src/apps/agent-runtime-api/src/agent-runtime/agent-runtime.module.ts"
       ],
       "validationCommands": [
-        "core-domain 1024/1024 (incl. import-linter-adapter.spec + sarif-security-adapter.spec + updated enforcer-catalog-parity/enforcer-subsystem anti-drift specs); core-api tsc --noEmit clean (Violation.category propagates).",
-        "import-linter (Python) LIVE-verified against a real corpus: a package whose domain imports infrastructure yields exactly 1 Violation carrying the broken import chain; a clean package yields 0 (0 FP).",
-        "Security-SARIF (Checkov/Trivy) LIVE-verified: a real Checkov SARIF over a Terraform corpus (8 findings) parses via the shared GT-515 ingestSarif to 8 Violations, ALL category='security'; a clean scan yields 0."
+        "cd src/apps/agent-runtime-api && npx tsc -p tsconfig.json --noEmit && npx jest (6 suites, 72/72) — AgentMetricsService emits evolith_agent_runs_total{engine,verdict}, evolith_agent_run_duration_seconds, evolith_skill_invocations_total{skill}, evolith_agent_core_calls_total{outcome}, evolith_hitl_approvals_total{decision} on the default registry (so the existing /metrics exposes them); recorded from the AgentRuntimeResult via the controller; spec asserts each series"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-514 (ShellEnforcerAdapter/IProcessRunner seam) + GT-515 (SARIF 2.1.0 ingester, reused wholesale by the security adapters) both DONE. Criterion #1's own gate held: import-linter (Python) + Checkov/Trivy (IaC/security) landed and were exercised against real corpora; Deptrac (PHP) / ArchUnit (JVM) / jQAssistant (Neo4j) correctly stay adapter-pending — no real repo of those runtimes exists to exercise them, so building them would be speculative and untestable per the gap's Risk/Evidence."
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "The catalog named a GT-519 noop metrics port to hang these on, but no such port exists in the agent-runtime package. Instrumented at the API/adapter boundary instead (per ADR-0102, metrics stay out of the domain), which satisfies both acceptance criteria without GT-519."
     },
     {
-      "id": "GT-519",
-      "closedAt": "2026-07-17",
-      "closureCommit": "4eb471a6",
+      "id": "GT-547",
+      "closedAt": "2026-07-13",
+      "closureCommit": "869f691d",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/ruleset-validator.types.ts",
-        "src/packages/core-domain/src/application/validators/ruleset-validator.service.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/index.ts",
-        "src/packages/core-domain/src/application/validators/enforcement/enforcer-metrics.spec.ts",
-        "src/packages/core-domain/src/index.ts"
+        "product/infra/docker-compose.observability.yml",
+        "product/infra/observability/prometheus.yml"
       ],
       "validationCommands": [
-        "core-domain 1026/1026 (+2 tests locking options.metrics threading through createCompositeEnforcerStrategy + the noop fallback); mcp 326/326; cli 969/969; core-api 152/152; tsc --noEmit clean across all four.",
-        "Public seam verified: RulesetValidatorOptions.metrics forwarded into the enforcer subsystem factory and the metrics API (IEnforcerMetrics/NoopEnforcerMetrics/RecordingEnforcerMetrics/ENFORCER_METRICS) re-exported from core-domain, so a host can construct a real Meter-backed adapter (previously the seam was permanently no-op and un-wireable through any surface)."
+        "cd product/infra && EVOLITH_API_KEY=local-dev-key docker compose -f docker-compose.evolith.yml -f docker-compose.observability.yml up -d -> one command brings up the 3 Node services + Prometheus (:9090, 3 targets up) + provisioned Grafana (:3009); the overlay is opt-in (separate compose file) and documented in its header"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Parity wiring (processRunner injected in CLI/MCP/REST) and enforcer-catalog<->tool-catalog version pins were already live (f8310fac/4b6db4d5); this closed the remaining OTel-metrics seam. Ops-only remainder stays out of scope: per-runtime composable CI images + vuln-scan/Renovate, and activating a live OTel Meter-backed IEnforcerMetrics adapter inside each surface module (host config) — the code seam is complete and importable."
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-544 (Grafana) and GT-545 (scrape) close together in the same overlay; the whole stack was brought up and exercised end-to-end."
     },
     {
-      "id": "GT-438",
-      "closedAt": "2026-07-17",
-      "closureCommit": "ff57cec6",
+      "id": "GT-548",
+      "closedAt": "2026-07-13",
+      "closureCommit": "85ff0bc7",
       "evidence": [
-        "src/packages/agent-runtime/src/domain/ports/workspace-context.port.ts",
-        "src/packages/agent-runtime/src/adapters/core/fs-workspace-context.adapter.ts",
-        "src/packages/agent-runtime/src/application/agent-runtime.service.ts",
-        "src/packages/agent-runtime/src/application/context-mapper.ts",
-        "src/apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts"
+        "src/apps/core-api/src/infrastructure/metrics/metrics.service.ts",
+        "src/apps/agent-runtime-api/src/health/agent-metrics.service.ts",
+        "product/infra/observability/grafana/dashboards/evolith-governance.json",
+        "product/operations/slo/core-api-slo.md"
       ],
       "validationCommands": [
-        "agent-runtime 131/131 (+8 workspace-context tests); agent-runtime-api 80/80 (+3 factory wiring tests); tsc --noEmit clean.",
-        "The runtime assembles the workspace and passes it inline as evaluationInput.files (the OverlayFileSystem shape the Core API already consumes), so the stateless Core no longer evaluates an empty context; a workspace outage degrades to the prior flow (never fails a run).",
-        "LIVE-VERIFIED end-to-end in kind `evolith-cluster` (2026-07-18) — and the verification EXPOSED A REGRESSION in this very change, now fixed (`e361b52b`). The wiring fell back to AGENT_RUNTIME_WORKSPACE_ROOT, a pre-existing variable the service image hard-codes (`ENV AGENT_RUNTIME_WORKSPACE_ROOT=/repo/corpus`), so whole-corpus inlining was silently ON in every containerised deployment: the runtime inlined the entire bundled corpus into one evaluate request, the Core rejected the oversized body BEFORE its audit interceptor (so nothing appeared in core-api logs, making it look like the request never arrived), and the chain died on an opaque `Core evaluation failed: HTTP 500`. Inlining is now strictly opt-in via AGENT_RUNTIME_WORKSPACE_CONTEXT_ROOT only, with the old fallback spec inverted into a regression guard. A second, independent Core defect surfaced in the same hunt and was fixed (`6c3d78d3`): the `architecture` kind 500'd for every request because ArchitectureDriftService's history WRITE was unguarded while its READ already tolerated failure. After both fixes the governed chain completes: resolve-context → ground → select-capability → policy-preflight → harness-execute → core-evaluate → policy-validate → completed, returning the correct governed `blocked` verdict with 39 findings (was `exception`). All 13 evaluation kinds return 200."
+        "core-api 152/152 (+2 bounded-tenant tests) + agent-runtime 77/77; LIVE against the local stack rebuilt with EVOLITH_METRICS_TENANT_ALLOWLIST=t-acme,local: evolith_gate_evaluations_total carries tenant=t-acme/local for allowlisted tenants and tenant=other for the rest (3 t-secret requests collapsed to other, the raw id never leaked); Governance Health dashboard has a $tenant template variable + a per-tenant panel; cap (|allowlist|+1, hard-capped 100) documented in code + SLO doc."
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "The HttpCoreEvaluationAdapter was already wired+verified in kind; this landed the last non-gated piece (real workspace-context assembly). Gated remainder stays out of scope by design: the real reasoning engine (GT-385/Hermes) and durable memory/scheduler needing external services; a Tracker-driven context assembler is a future sibling adapter behind the same IWorkspaceContextPort."
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-542 (gate metric) and GT-546 (agent metric) DONE — the tenant label extends both; the per-tenant panel needs the Grafana datasource from GT-544 (DONE)."
     },
     {
-      "id": "GT-451",
-      "closedAt": "2026-07-17",
-      "closureCommit": "fd03cf53",
+      "id": "GT-549",
+      "closedAt": "2026-07-13",
+      "closureCommit": "e99064eb",
       "evidence": [
-        "src/sdk/cli/package.json",
-        "src/sdk/cli/scripts/check-release-drift.mjs",
-        "src/sdk/cli/CHANGELOG.md",
-        "src/packages/core-domain/package.json",
-        "src/packages/mcp-server/package.json"
+        "src/apps/agent-runtime-api/src/auth/metrics-auth.guard.ts",
+        "src/apps/agent-runtime-api/src/auth/metrics-auth.guard.spec.ts",
+        "src/apps/agent-runtime-api/src/health/metrics.controller.ts",
+        "src/packages/mcp-server/src/mcp/mcp-server.service.ts"
       ],
       "validationCommands": [
-        "Verified against the LIVE npm registry: a clean `npm i @beyondnet/evolith-cli@1.1.0` in an empty project resolves the full closure from npm (agent-runtime/core-domain/infra-providers/sdk all 1.1.0) and the CLI boots — `--version` -> 1.1.0, `evaluate --help` OK, `enforce --help` OK (exercises enforcement/policy-compiler, the subpath missing from the stale 1.0.0). cli dist-tag latest: 1.1.0.",
-        "check:release-drift hardened to fail the publish when the shipped dist imports any @beyondnet/* not declared in dependencies — proven: aborts without the infra-providers dep, passes with it. npm publish --dry-run green for all 8 packages."
+        "cd src/packages/mcp-server && npx tsc && npx jest (44 suites, 326/326 — +2 HTTP tests: anon GET /metrics→401, x-api-key→200) + cd src/apps/agent-runtime-api && npx tsc && npx jest (7 suites, 77/77 — +5 MetricsAuthGuard tests) — /metrics now fail-closed on both services with a trusted-network opt-out, matching core-api MetricsAuthGuard (GT-393)"
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "The real defect was the whole @beyondnet/evolith-*@1.0.0 line being stale vs develop (CLI deep-imports subpaths absent from the 1.0.0 tarballs) plus cli@1.0.1 crashing on an undeclared infra-providers dep. Resolved by a coordinated 1.1.0 re-release of all 8 packages (owner published in dependency order); the owner-publish dependency is now satisfied and verified live."
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Catalog lists GT-545 (scrape config) as a dependency; the acceptance criterion \"scraper still succeeds with credentials\" is proven at the code/test level (the guard accepts the credential and rejects anonymous callers). Wiring the actual Prometheus scrape job with the credential is GT-545 (infra)."
     },
     {
-      "id": "GT-437",
-      "closedAt": "2026-07-17",
-      "closureCommit": "1ddbe25b",
+      "id": "GT-550",
+      "closedAt": "2026-07-13",
+      "closureCommit": "56028e52",
       "evidence": [
-        ".github/workflows/ci-cd.yml",
-        "src/apps/agent-runtime-api/Dockerfile"
+        "src/apps/core-api/src/infrastructure/metrics/metric-drift.spec.ts",
+        "product/operations/alerts/prometheus-alerts.yml",
+        "product/operations/slo/core-api-slo.md"
       ],
       "validationCommands": [
-        "ci-cd.yml parses as YAML and resolves to 3 docker-services matrix entries (core-api -> evolith-core-api, mcp-server -> evolith-mcp, agent-runtime -> evolith-agent-runtime) and 3 Coolify deploy steps; the referenced ./src/apps/agent-runtime-api/Dockerfile exists.",
-        "The gap's premise was partly stale: agent-runtime was already built/tested by ci-cd.yml (3 workspace builds). The real hole — absent from the docker-services matrix and from the deploy job on main (docker-images.yml only covered it on tags/workflow_dispatch) — is now closed; agent-runtime-api sits in the same CI/CD posture as its two sibling services."
+        "cd src/apps/core-api && npx jest metric-drift (2/2) — the guard extracts PromQL metric names from prometheus-alerts.yml + core-api-slo.md/.es.md and fails when a non-external (not node/kube/rabbitmq/opa/up) metric is emitted by no Core service; runs in the Test core-api CI job on every PR touching those files"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Workflow wiring is complete and validated declaratively (YAML parse + Dockerfile path + parity with two already-working sibling services). The deploy step uses the established fail-soft contract (unset hook warns and exits 0, never failing CD). Provisioning COOLIFY_AGENTRUNTIME_DEPLOY_HOOK / COOLIFY_API_TOKEN is owner-gated and already tracked by GT-324; the first live build+deploy runs on the next merge to main, since this job is main/tag-only and cannot be exercised from develop."
+      "dependencyDisposition": "satisfied",
+      "dependencyRationale": "GT-543 reconciled the metric names in the same commit, so the guard is green while enforcing no future drift."
     },
     {
       "id": "GT-551",
@@ -7811,23 +7796,74 @@
       "dependencyRationale": "Both halves the gap names are closed: the sidecar is now EXPOSED (Service opa-metrics port; it was pod-local and unreachable) and SCRAPED (new `opa` job whose name matches the alert scope). A third, deeper defect was found and fixed: the alert referenced a metric OPA does not emit, so scraping alone would not have made it fire. The exposure half is now LIVE-VERIFIED in a kind cluster (see validationCommands); what remains deploy-gated is only an actual Prometheus instance scraping it end-to-end; promtool was unavailable locally so the rule was validated by YAML parse + empirical series matching instead of `promtool check rules`; and the docker-compose stack does not run OPA yet, tracked by GT-547."
     },
     {
-      "id": "GT-442",
-      "closedAt": "2026-07-17",
-      "closureCommit": "fd9f56de",
+      "id": "GT-552",
+      "closedAt": "2026-07-18",
+      "closureCommit": "38db17bf",
       "evidence": [
-        "product/infra/README.md",
-        "product/infra/README.es.md",
-        "product/infra/helm/evolith-core-api/values.yaml",
-        "product/infra/helm/evolith-mcp/values.yaml",
-        "product/infra/helm/evolith-agent-runtime/values.yaml"
+        ".github/workflows/sdk-cli-release.yml"
       ],
       "validationCommands": [
-        "Secret wiring verified in all three charts: each takes credentials from a pre-created K8s Secret BY NAME, injected via secretKeyRef and gated on auth.existingSecretName — evolith-core-api -> core-api-auth/EVOLITH_API_KEY, evolith-mcp -> mcp-auth/EVOLITH_API_KEY, evolith-agent-runtime -> agent-runtime-auth/AGENT_RUNTIME_API_KEY; evolith-mcp additionally consumes opa-bundle-credentials and opa-bundle-signing-key by name. No chart embeds a literal credential.",
-        "DB-connectivity claim disproved against the code: core-api and agent-runtime-api declare ZERO database dependencies (no pg/typeorm/prisma/mongo driver or ORM) in their package.json. The `postgresql` occurrences in projects.controller.ts / core-domain.module.ts are the scaffolding generator selecting a database for the GENERATED project, not a Core runtime connection.",
-        "Consolidated the previously scattered secret configuration into product/infra/README.md and README.es.md, section 'Secrets and Data Connectivity' / 'Secretos y Conectividad de Datos', including the kubectl create secret example and the Coolify encrypted-env-var equivalent."
+        "Criterion 1: the workflow no longer references `release-please-config.json` or `.release-please-manifest.json`; both were deleted in aed33ba9 and are no longer passed to any action.",
+        "Criterion 2: the `release-please` job was replaced by a `release-gate` job, so the workflow no longer claims it can auto-cut a version.",
+        "Criterion 3, with a correction to the original write-up: the failure-notification job is NOT unreachable dead code. It RAN AND SUCCEEDED in run 29641024724, which disproves the claim that it was gated behind an output that could never be true.",
+        "Provenance of the closure commit: `git log --oneline -3 -- .github/workflows/sdk-cli-release.yml` shows 38db17bf as the commit where the file's current state landed.",
+        "Recorded honestly: the release pipeline still fails, for unrelated reasons now tracked by GT-561 (MCP smoke timeout), GT-562 (branch-coverage regression) and GT-563 (doc validation). This gap was about the broken WIRING, which is fixed."
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Both halves of the original framing were misaligned with the codebase. The secret store was substantially already wired (K8s Secrets by name via secretKeyRef across all three charts); what was genuinely missing was documentation, now consolidated bilingually. The DB half is NOT APPLICABLE to the Core: ADR-0101 makes it a stateless evaluation engine (EvaluationContext -> EvaluationResult, no persisted entities), so there is no DATABASE_URL to configure and adding one would contradict the ADR — persistence lives in the Tracker (own Postgres, tracker_governance), a separate repository whose board owns any DB-connectivity work. Remaining is owner-gated and not code: provisioning the real secret VALUES on the VPS/cluster, the same blocker already tracked by GT-324 and GT-437."
+      "dependencyDisposition": "none",
+      "dependencyRationale": "The gap has no dependencies: the defect and its fix are contained in a single workflow file. The pipeline failures that remain are separate defects with their own board rows (GT-561, GT-562, GT-563) rather than blockers on this one."
+    },
+    {
+      "id": "GT-553",
+      "closedAt": "2026-07-18",
+      "closureCommit": "35ea46e1",
+      "evidence": [
+        ".harness/scripts/ci/09-reconcile-maturity.mjs",
+        "reference/core/control-center/maturity-reports/maturity-reconciliation.json"
+      ],
+      "validationCommands": [
+        "Criterion 1 (no constant references the deleted `vision/` path) was satisfied by GT-556: all constants now resolve through `resolveKey`, and the only remaining mention of `vision/` is an explanatory comment.",
+        "Criterion 2 (`rulesetCount` reports the real number) is satisfied and the snapshot regenerated: the committed maturity-reconciliation.json now reports \"rulesetCount\": 145.",
+        "Corpus cross-check: `find src/rulesets -name \"*.rules.json\" | wc -l` -> 145, matching the regenerated figure.",
+        "Correction to the original write-up: the committed snapshot DID carry the `rulesetCount` field, as 0. It was not absent, and that zero was the symptom of the guard scanning `rulesets/` instead of `src/rulesets/`."
+      ],
+      "dependencyDisposition": "none",
+      "dependencyRationale": "The gap has no remaining dependencies. Regeneration had been recorded as gated on the maturity-evidence refresh tracked by GT-523, but the snapshot was regenerated in this closure commit, so nothing is left waiting on that gate."
+    },
+    {
+      "id": "GT-554",
+      "closedAt": "2026-07-18",
+      "closureCommit": "9a13d0d6",
+      "evidence": [
+        "CONTRIBUTING.md",
+        "CONTRIBUTING.es.md"
+      ],
+      "validationCommands": [
+        "Criterion 1: section 5.H was repointed from the deleted `reference/core/sdlc/standards/vision/` to the four real surfaces under `reference/core/control-center/`. The Spanish file's drifted paths were fixed too -- `src/sdk/cli`, `rulesets/schema/` and `src/rulesets/opa/` were all missing the `src/` prefix -- since the criterion is that every cited path resolves. 28/28 headings.",
+        "Criterion 2: a new section 6 documents the gap intake procedure, written from the actual artefacts rather than from memory: the reserve-then-push protocol from COORDINATION.md, the board row shape that 08-validate-tracking.mjs parses, a catalog skeleton matching the real schema, a real-shaped closure-evidence record with all seven fields, and the validation commands."
+      ],
+      "dependencyDisposition": "none",
+      "dependencyRationale": "The gap has no dependencies: it is a documentation change describing artefacts that already exist. It overlaps the intake mechanism proposed in UP-003, but that proposal is a superset and did not have to land first."
+    },
+    {
+      "id": "GT-555",
+      "closedAt": "2026-07-18",
+      "closureCommit": "9a13d0d6",
+      "evidence": [
+        ".github/CODEOWNERS",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/ISSUE_TEMPLATE/bug-report.yml",
+        ".github/ISSUE_TEMPLATE/feature-request.yml",
+        ".github/FUNDING.yml",
+        ".github/workflows/sdk-cli-release.yml"
+      ],
+      "validationCommands": [
+        "Added `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/config.yml` (blank issues off; contact links to Discussions, the private security advisory and CONTRIBUTING), and bug-report and feature-request templates written in plain language. `FUNDING.yml` moved from `src/sdk/cli/` to `.github/` so GitHub renders it.",
+        "Near-miss recorded: CODEOWNERS first shipped naming `@beyondnetcode/evolith-team`, copied from the release workflow's failure notifier. That team DOES NOT EXIST -- `gh api orgs/beyondnetcode/teams` returns only `evolith-core-s-development`.",
+        "Why that mattered: GitHub silently ignores an unresolvable owner, so every CODEOWNERS line would have routed nothing while the file looked correct.",
+        "Corrected to the verified team, which was also confirmed to have repository access. The same bad handle in `.github/workflows/sdk-cli-release.yml` was fixed, which means that failure notification had been at-mentioning nobody."
+      ],
+      "dependencyDisposition": "none",
+      "dependencyRationale": "The gap has no dependencies: the files are self-contained GitHub community-health files. It feeds the GitHub bridge deliverable of UP-003, but nothing had to land first for these to take effect."
     },
     {
       "id": "GT-556",
@@ -7909,121 +7945,83 @@
       "dependencyRationale": "The gap has no dependencies. Three areas are deliberately NOT encoded and are recorded as scope boundaries rather than blockers: human self-review (no ADR bars it, so there is no rule to encode), which office may ratify/waive/enforce (deferred to domain/rbac), and KI-R03's evidence gate (stays in knowledge-intake.rego). One follow-up is noted: PromotionStatus is now declared both here and in agent-runtime/src/application/automation-candidate.ts:25."
     },
     {
-      "id": "GT-445",
-      "closedAt": "2026-07-18",
-      "closureCommit": "702de08b",
-      "evidence": [
-        ".harness/scripts/ci/07-generate-inventories.mjs",
-        "reference/core/control-center/maturity-reports/inventory-summary.md",
-        "reference/core/control-center/maturity-reports/maturity-reconciliation.json",
-        "reference/core/control-center/maturity-reports/maturity-assessment.md",
-        "product/products/smart-cli/product-inventory.md",
-        "reference/core/foundations/common-rules/ai-augmented/03-tools-catalog/evolith-mcp-tools.md"
-      ],
-      "validationCommands": [
-        "All four named surfaces are regenerated. maturity-reconciliation.json was regenerated in 35ea46e1 and now reports 559 gaps / 145 rulesets / 132 ADRs / @beyondnet/evolith-cli@1.1.0.",
-        "maturity-assessment.md verified clean: no `1.1.4`, no \"32 tools\", no `@beyondnet/evolith-cli`. product-inventory.md clean at 1.1.0. evolith-mcp-tools.md regenerated to the source-derived 47-tool table in 459676aa.",
-        "The final blocker was the inventory generator itself: `07-generate-inventories.mjs` resolved the dead `rulesets/` path and reported 0, wrote to an orphaned location, and its `--check` flag WROTE FILES instead of only checking. Fixed in 702de08b.",
-        "Measured effect: the canonical `reference/core/control-center/maturity-reports/inventory-summary.md` went from a two-week-frozen 119 ADRs / 144 rulesets / 40 schemas to 132 / 145 / 44, now agreeing exactly with what `09-reconcile-maturity.mjs` derives independently.",
-        "Corpus cross-check: `find src/rulesets -name \"*.rules.json\" | wc -l` -> 145, the same figure both scripts now report."
-      ],
-      "dependencyDisposition": "none",
-      "dependencyRationale": "The gap has no remaining dependencies. Regeneration had been gated on the inventory generator producing real numbers; that generator was the last blocker and was fixed in the closure commit, so the four surfaces could be regenerated from code rather than by hand and nothing is left waiting."
-    },
-    {
-      "id": "GT-552",
-      "closedAt": "2026-07-18",
-      "closureCommit": "38db17bf",
-      "evidence": [
-        ".github/workflows/sdk-cli-release.yml"
-      ],
-      "validationCommands": [
-        "Criterion 1: the workflow no longer references `release-please-config.json` or `.release-please-manifest.json`; both were deleted in aed33ba9 and are no longer passed to any action.",
-        "Criterion 2: the `release-please` job was replaced by a `release-gate` job, so the workflow no longer claims it can auto-cut a version.",
-        "Criterion 3, with a correction to the original write-up: the failure-notification job is NOT unreachable dead code. It RAN AND SUCCEEDED in run 29641024724, which disproves the claim that it was gated behind an output that could never be true.",
-        "Provenance of the closure commit: `git log --oneline -3 -- .github/workflows/sdk-cli-release.yml` shows 38db17bf as the commit where the file's current state landed.",
-        "Recorded honestly: the release pipeline still fails, for unrelated reasons now tracked by GT-561 (MCP smoke timeout), GT-562 (branch-coverage regression) and GT-563 (doc validation). This gap was about the broken WIRING, which is fixed."
-      ],
-      "dependencyDisposition": "none",
-      "dependencyRationale": "The gap has no dependencies: the defect and its fix are contained in a single workflow file. The pipeline failures that remain are separate defects with their own board rows (GT-561, GT-562, GT-563) rather than blockers on this one."
-    },
-    {
-      "id": "GT-553",
-      "closedAt": "2026-07-18",
-      "closureCommit": "35ea46e1",
+      "id": "GT-560",
+      "closedAt": "2026-07-24",
+      "closureCommit": "729c14c1",
       "evidence": [
-        ".harness/scripts/ci/09-reconcile-maturity.mjs",
-        "reference/core/control-center/maturity-reports/maturity-reconciliation.json"
+        "src/apps/core-api/src/infrastructure/cache/in-memory-cache.module.ts",
+        "src/apps/core-api/src/app.module.ts",
+        "reference/core/foundations/common-rules/senior-architectural-assessment.md"
       ],
       "validationCommands": [
-        "Criterion 1 (no constant references the deleted `vision/` path) was satisfied by GT-556: all constants now resolve through `resolveKey`, and the only remaining mention of `vision/` is an explanatory comment.",
-        "Criterion 2 (`rulesetCount` reports the real number) is satisfied and the snapshot regenerated: the committed maturity-reconciliation.json now reports \"rulesetCount\": 145.",
-        "Corpus cross-check: `find src/rulesets -name \"*.rules.json\" | wc -l` -> 145, matching the regenerated figure.",
-        "Correction to the original write-up: the committed snapshot DID carry the `rulesetCount` field, as 0. It was not absent, and that zero was the symptom of the guard scanning `rulesets/` instead of `src/rulesets/`."
+        "grep -rn 'CircuitBreakerService|createBreaker|opossum|createCacheStore|RedisCacheModule' src/apps/core-api/src -> 0 resultados (breaker huerfano + wiring Redis muerto removidos por completo).",
+        "cd src/apps/core-api && npm run build -> nest build exit 0 (sin referencias colgantes).",
+        "cd src/apps/core-api && npm test -> 28 suites / 158 tests passed (el spec borrado del breaker era el unico test que lo referenciaba).",
+        "npm install --package-lock-only --legacy-peer-deps -> diff de package-lock.json = 3 insertions / 20 deletions, solo opossum + @types/opossum (sin sprawl); npm ci sigue consistente para el build Docker de core-api.",
+        "node .harness/scripts/ci/08-validate-tracking.mjs -> verde con este registro + el flip del contador (556/568)."
       ],
       "dependencyDisposition": "none",
-      "dependencyRationale": "The gap has no remaining dependencies. Regeneration had been recorded as gated on the maturity-evidence refresh tracked by GT-523, but the snapshot was regenerated in this closure commit, so nothing is left waiting on that gate."
+      "dependencyRationale": "GT-560 no declara dependencias. Resuelto por la rama que el propio gap ofrecia ('o pones llamadas reales tras el breaker, o dejas de puntuar resiliencia de algo que no protege nada'): el Core es un evaluador stateless (ADR-0101) que no hace llamadas salientes de DB/HTTP, y el unico candidato de cache nunca conecto a Redis, asi que la resolucion honesta es la eliminacion, no la reparacion (reparar el wiring Redis solo es estrictamente peor -- un Redis inalcanzable cuelga get/set en vez de rechazar, por eso un breaker solo se justificaria JUNTO con el). El score ya estaba corregido a 4/10; la nota se reescribe para reflejar la eliminacion. Adjacent finding (CacheMetricsService sin cablear el write-side) queda deliberadamente como item menor aparte."
     },
     {
-      "id": "GT-554",
+      "id": "GT-561",
       "closedAt": "2026-07-18",
-      "closureCommit": "9a13d0d6",
+      "closureCommit": "b408a0ef",
       "evidence": [
-        "CONTRIBUTING.md",
-        "CONTRIBUTING.es.md"
+        ".github/workflows/sdk-cli-ci.yml",
+        "src/sdk/cli/examples/mcp-test.js",
+        "package-lock.json"
       ],
       "validationCommands": [
-        "Criterion 1: section 5.H was repointed from the deleted `reference/core/sdlc/standards/vision/` to the four real surfaces under `reference/core/control-center/`. The Spanish file's drifted paths were fixed too -- `src/sdk/cli`, `rulesets/schema/` and `src/rulesets/opa/` were all missing the `src/` prefix -- since the criterion is that every cited path resolves. 28/28 headings.",
-        "Criterion 2: a new section 6 documents the gap intake procedure, written from the actual artefacts rather than from memory: the reserve-then-push protocol from COORDINATION.md, the board row shape that 08-validate-tracking.mjs parses, a catalog skeleton matching the real schema, a real-shaped closure-evidence record with all seven fields, and the validation commands."
+        "Root cause measured, not guessed: the server was never broken. The smoke spawned `node dist/main.js mcp serve` from the CLI's dist, and commit dc0b9667 (2026-06-30, \"decouple mcp-server from smart-cli\") DELETED that command -- the exact date of the last green run. The process died instantly with `error: unknown command 'mcp'`, but the stdio path piped stderr and never read it, so an instant hard failure was reported as a 5-second timeout; that misdirection is why the cause stayed opaque for 19 days.",
+        "Fix (b408a0ef): both transports repointed at the standalone gateway; a pre-flight check that fails with \"build it first\" rather than timing out; stderr and the early-exit code captured and folded into the failure message. NO assertion was weakened and NO timeout was raised -- startup measured ~1s, so the 5s limit was never implicated.",
+        "Correction to the gap's own premise: DAST was NOT a downstream cascade from E2E. The jobs are independent and DAST carried its OWN copy of the same stale `mcp serve` invocation, so fixing the smoke alone would have left it red. Its start step was repointed too, plus --allow-no-auth so ZAP scans a reachable surface.",
+        "Three follow-on commits were needed before the criteria could be OBSERVED, each layer hiding the one beneath. 6cac6cda: the SDK 2.0.0 bump had left package-lock.json desynced, so `npm ci` refused and eight jobs died on their first step, never reaching the smoke. b75d43fc: the CLI pipeline's `paths` filter did not list package.json / package-lock.json, so neither the break nor its fix triggered the pipeline they affected -- it also listed release-please-config.json, deleted in aed33ba9, a filter watching a path that cannot change. 37cbeae1: DAST still reported red on `Resource not accessible by integration` because the ZAP action files its report as a GitHub issue and the workflow grants no `issues: write`; the scan itself was clean (FAIL-NEW: 0, PASS: 146), so issue-filing was disabled rather than granting a scanner write access, the report already being uploaded as an artifact.",
+        "CI verification -- run 29665015800 (https://github.com/beyondnetcode/evolith_arch32/actions/runs/29665015800): (1) the MCP smoke completes without a timeout on `initialize`, passing on BOTH transports -- 47 tools, 11 resources, 8 prompts, both tools/call checks, stdio and HTTP; (2) the E2E Tests job is success; (3) the DAST job's `Start MCP Server` and `Wait for MCP Server` steps both succeed.",
+        "Recorded honestly: the job still shows red for reasons unrelated to this gap -- the CLI's branch-coverage gate (69.3% against a 75% threshold, tracked by GT-562) and 12 pre-existing bilingual-terminology findings in files last touched between 2026-07-04 and 2026-07-13. The pipeline is NOT green and this closure does not claim it is."
       ],
-      "dependencyDisposition": "none",
-      "dependencyRationale": "The gap has no dependencies: it is a documentation change describing artefacts that already exist. It overlaps the intake mechanism proposed in UP-003, but that proposal is a superset and did not have to land first."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-555",
-      "closedAt": "2026-07-18",
-      "closureCommit": "9a13d0d6",
+      "id": "GT-562",
+      "closedAt": "2026-07-20",
+      "closureCommit": "7cffd734",
       "evidence": [
-        ".github/CODEOWNERS",
-        ".github/ISSUE_TEMPLATE/config.yml",
-        ".github/ISSUE_TEMPLATE/bug-report.yml",
-        ".github/ISSUE_TEMPLATE/feature-request.yml",
-        ".github/FUNDING.yml",
-        ".github/workflows/sdk-cli-release.yml"
+        "src/sdk/cli/src/commands/validate/validate.composable-report.spec.ts",
+        "src/sdk/cli/src/commands/init/init.command.spec.ts",
+        "src/sdk/cli/src/commands/update/update.command.spec.ts",
+        "src/sdk/cli/src/commands/profile/profile.command.spec.ts",
+        "src/sdk/cli/src/commands/agents/agents.command.spec.ts",
+        "src/sdk/cli/src/commands/api/api.command.spec.ts",
+        "src/sdk/cli/src/commands/architecture/scaffold.command.spec.ts",
+        "src/sdk/cli/src/commands/adr/adr.command.spec.ts",
+        "src/sdk/cli/src/infrastructure/formatters/output-formatter.service.spec.ts",
+        "reference/core/control-center/gaps/gap-reference-catalog.md"
       ],
       "validationCommands": [
-        "Added `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/config.yml` (blank issues off; contact links to Discussions, the private security advisory and CONTRIBUTING), and bug-report and feature-request templates written in plain language. `FUNDING.yml` moved from `src/sdk/cli/` to `.github/` so GitHub renders it.",
-        "Near-miss recorded: CODEOWNERS first shipped naming `@beyondnetcode/evolith-team`, copied from the release workflow's failure notifier. That team DOES NOT EXIST -- `gh api orgs/beyondnetcode/teams` returns only `evolith-core-s-development`.",
-        "Why that mattered: GitHub silently ignores an unresolvable owner, so every CODEOWNERS line would have routed nothing while the file looked correct.",
-        "Corrected to the verified team, which was also confirmed to have repository access. The same bad handle in `.github/workflows/sdk-cli-release.yml` was fixed, which means that failure notification had been at-mentioning nobody."
+        "npx jest --coverage (src/sdk/cli) -> exit 0. Branches 75.54% frente al umbral global de 75%; statements 88.23%, functions 86.54%, lines 88.52%. 85 suites, 1250 tests, 0 fallos. Linea base medida al inicio de la sesion: 70.57% (1890/2678).",
+        "grep -c 'does not meet' sobre la salida de jest -> 0. Ningun umbral fue relajado: el diff no toca jest.config, solo archivos .spec.ts mas la opcion --name de agents.command.ts.",
+        "npm run build (tsc -b) -> exit 0."
       ],
       "dependencyDisposition": "none",
-      "dependencyRationale": "The gap has no dependencies: the files are self-contained GitHub community-health files. It feeds the GitHub bridge deliverable of UP-003, but nothing had to land first for these to take effect."
+      "dependencyRationale": "Sin dependencias (el catalogo declara \"Dependencies: None\"). El gap se paga completo: el criterio era cruzar el 75% sin mover el umbral, y ambas mitades estan verificadas. Se corrigen dos afirmaciones del enunciado original. (1) 'Archivos afectados: core-api' era erroneo -- el gate que fallaba es el del CLI, coherente con el propio campo Componente 'SDK CLI'. (2) La estimacion del trabajo restante ('100-140 pruebas sobre asistentes interactivos... pruebas que comprueban que se pregunto algo a un mock') describia mal las ramas que faltaban: eran las rutas no interactivas y legibles por maquina (--format json en cinco comandos, init --batch, el reporte del motor composable), que son contrato real para scripts y CI, no ceremonia de mocks. La exclusion declarada de ~100 ramas en adr/agents ya no aplica: el defecto del sobre de exito que la motivaba se arreglo antes en esta campana, y las pruebas nuevas afirman el contrato corregido de ADR-0073 de forma explicita (success = el comando corrio; el veredicto viaja dentro; el exit code lo transporta), de modo que fijan la conducta correcta en vez de congelar la equivocada. Verificacion local, no CI: el job Unit Tests debe confirmarlo en la proxima corrida."
     },
     {
-      "id": "GT-523",
+      "id": "GT-563",
       "closedAt": "2026-07-18",
-      "closureCommit": "35ea46e1",
+      "closureCommit": "c63c3eb7",
       "evidence": [
-        "reference/core/control-center/gaps/gap-tracking.md",
-        "reference/core/control-center/gaps/gap-tracking.es.md",
-        "reference/core/control-center/gaps/gap-reference-catalog.md",
-        "reference/core/control-center/gaps/gap-reference-catalog.es.md",
-        "reference/core/control-center/evidence/gap-closure-evidence.json",
-        "reference/core/control-center/maturity-reports/maturity-evidence.json",
-        ".harness/scripts/ci/08-validate-tracking.mjs",
-        ".github/workflows/docs.yml"
+        ".github/workflows/docs.yml",
+        ".harness/scripts/ci/01-validate-docs.mjs",
+        ".harness/scripts/ci/10-validate-contract-conformance.mjs",
+        "reference/core/architecture/foundations/ports-and-adapters.md"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/08-validate-tracking.mjs -- exit 0, zero ERROR lines, \"Validated 565 gaps and 530 closure records\". The ~653-error report that opened this gap is gone: EN/ES boards resync row-for-row, every board id has a catalog section in both languages, and the progress counters are re-derived from the rows the guard itself parses.",
-        "Board/registry reconciliation landed across f3f271da (EN/ES resync, GT-484 status desync), f70b98ce (six legacy closure records repaired: partial -> accepted-scope for GT-425/431/434/462, GT-463 criteria checked against evidence, GT-465 reworded to delivered scope) and e138b1d4 (records for GT-519/438/451).",
-        "ES token normalization verified: zero `HECHO` status cells remain in gap-tracking.es.md, all 13 normalized to COMPLETADO (GT-480).",
-        "Guard re-arm confirmed delivered by GT-476 (now DONE): .github/workflows/docs.yml runs 08-validate-tracking.mjs and 09-reconcile-maturity.mjs --check, so both guards are armed in CI rather than dormant.",
-        "The CI-owned remainder was paid genuinely, not by a date bump (commit 35ea46e1): all four checks in maturity-evidence.json now carry observedAt 2026-07-18 with real GitHub Actions run URLs and commits, asOf is re-synced to the board, and the observation was honest enough to INVERT three checks from PASS to BLOCKED -- MCP smoke timeout, branch coverage 62.89% against a 75% gate, and 174 doc-validation errors -- with no threshold relaxed and no stale figure carried forward.",
-        "Placeholder mapping cleared before closing: the three BLOCKED checks that had been provisionally mapped to GT-523 pending rows of their own are repointed to GT-561 (cli-baseline), GT-562 (coverage) and GT-563 (documentation), so no maturity evidence maps to a closed gap. The `release` check's pointer at the now-closed GT-552 was repointed to GT-563, the cause its own summary already named as what actually reds the gate; 09-reconcile-maturity.mjs no longer reports \"must map BLOCKED evidence to an active gap\"."
+        "node .harness/scripts/ci/01-validate-docs.mjs -> exit 0, 'Documentation validation passed for 1535 Markdown files'",
+        "node .harness/scripts/ci/01-validate-docs.mjs --render-mermaid -> 1535 files and 407 Mermaid diagrams rendered",
+        "docs.yml: triggers workflow_dispatch/pull_request/push, and the validate job carries no `if:` condition, so the workflow result now reflects the validator's verdict"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Two items are deliberately outside this closure rather than claimed. First, the guard path-fix and CI re-arm were always delegated to GT-476, which is now DONE and verified in docs.yml. Second, `09-reconcile-maturity.mjs` still reports its generated snapshot as stale: maturity-reconciliation.json has not been regenerated, and that regeneration is owned by GT-553 (the guard's dead path constants and ruleset miscount) and GT-445 (the stale doc-count surfaces), not by this gap, whose scope was the board/registry reconciliation and the fresh maturity OBSERVATION -- both of which are done. The three failures the observation exposed are not remainders of this gap either; they are independent defects now carried by GT-561, GT-562 and GT-563."
+      "dependencyDisposition": "none"
     },
     {
       "id": "GT-564",
@@ -8070,42 +8068,6 @@
       "dependencyDisposition": "accepted-scope",
       "dependencyRationale": "The suite pins the contract restored by GT-564, so the two land as a pair: GT-564 repairs the types and this gap makes them accountable to the wire. Two follow-on commits are inside the closure rather than deferred -- 1875f725 wires the suite into ci-cd.yml, and e25804dc fixes the ruleset resolution that the suite had been working around with a symlink."
     },
-    {
-      "id": "GT-561",
-      "closedAt": "2026-07-18",
-      "closureCommit": "b408a0ef",
-      "evidence": [
-        ".github/workflows/sdk-cli-ci.yml",
-        "src/sdk/cli/examples/mcp-test.js",
-        "package-lock.json"
-      ],
-      "validationCommands": [
-        "Root cause measured, not guessed: the server was never broken. The smoke spawned `node dist/main.js mcp serve` from the CLI's dist, and commit dc0b9667 (2026-06-30, \"decouple mcp-server from smart-cli\") DELETED that command -- the exact date of the last green run. The process died instantly with `error: unknown command 'mcp'`, but the stdio path piped stderr and never read it, so an instant hard failure was reported as a 5-second timeout; that misdirection is why the cause stayed opaque for 19 days.",
-        "Fix (b408a0ef): both transports repointed at the standalone gateway; a pre-flight check that fails with \"build it first\" rather than timing out; stderr and the early-exit code captured and folded into the failure message. NO assertion was weakened and NO timeout was raised -- startup measured ~1s, so the 5s limit was never implicated.",
-        "Correction to the gap's own premise: DAST was NOT a downstream cascade from E2E. The jobs are independent and DAST carried its OWN copy of the same stale `mcp serve` invocation, so fixing the smoke alone would have left it red. Its start step was repointed too, plus --allow-no-auth so ZAP scans a reachable surface.",
-        "Three follow-on commits were needed before the criteria could be OBSERVED, each layer hiding the one beneath. 6cac6cda: the SDK 2.0.0 bump had left package-lock.json desynced, so `npm ci` refused and eight jobs died on their first step, never reaching the smoke. b75d43fc: the CLI pipeline's `paths` filter did not list package.json / package-lock.json, so neither the break nor its fix triggered the pipeline they affected -- it also listed release-please-config.json, deleted in aed33ba9, a filter watching a path that cannot change. 37cbeae1: DAST still reported red on `Resource not accessible by integration` because the ZAP action files its report as a GitHub issue and the workflow grants no `issues: write`; the scan itself was clean (FAIL-NEW: 0, PASS: 146), so issue-filing was disabled rather than granting a scanner write access, the report already being uploaded as an artifact.",
-        "CI verification -- run 29665015800 (https://github.com/beyondnetcode/evolith_arch32/actions/runs/29665015800): (1) the MCP smoke completes without a timeout on `initialize`, passing on BOTH transports -- 47 tools, 11 resources, 8 prompts, both tools/call checks, stdio and HTTP; (2) the E2E Tests job is success; (3) the DAST job's `Start MCP Server` and `Wait for MCP Server` steps both succeed.",
-        "Recorded honestly: the job still shows red for reasons unrelated to this gap -- the CLI's branch-coverage gate (69.3% against a 75% threshold, tracked by GT-562) and 12 pre-existing bilingual-terminology findings in files last touched between 2026-07-04 and 2026-07-13. The pipeline is NOT green and this closure does not claim it is."
-      ],
-      "dependencyDisposition": "none"
-    },
-    {
-      "id": "GT-563",
-      "closedAt": "2026-07-18",
-      "closureCommit": "c63c3eb7",
-      "evidence": [
-        ".github/workflows/docs.yml",
-        ".harness/scripts/ci/01-validate-docs.mjs",
-        ".harness/scripts/ci/10-validate-contract-conformance.mjs",
-        "reference/core/architecture/foundations/ports-and-adapters.md"
-      ],
-      "validationCommands": [
-        "node .harness/scripts/ci/01-validate-docs.mjs -> exit 0, 'Documentation validation passed for 1535 Markdown files'",
-        "node .harness/scripts/ci/01-validate-docs.mjs --render-mermaid -> 1535 files and 407 Mermaid diagrams rendered",
-        "docs.yml: triggers workflow_dispatch/pull_request/push, and the validate job carries no `if:` condition, so the workflow result now reflects the validator's verdict"
-      ],
-      "dependencyDisposition": "none"
-    },
     {
       "id": "GT-566",
       "closedAt": "2026-07-19",
@@ -8146,192 +8108,339 @@
       "dependencyRationale": "El VPS sigue caido y NO se reparo: esta fuera de alcance por decision del owner, que opera hoy contra Docker + kind local (cluster evolith-cluster). Lo que se cierra es el defecto de CD --afirmar una entrega que no realiza y dejar un rojo permanente que nadie lee-- no la caida del host. Reactivar el despliegue cuando el VPS vuelva es un unico paso documentado en el propio workflow: gh variable set VPS_DEPLOY_ENABLED --body true. El tercer criterio (senal de caida que no dependa de que alguien mergee) queda cubierto por el mismo texto como requisito explicito para ese momento, no como trabajo hecho ahora: sin VPS en alcance no hay servicio remoto que sondear."
     },
     {
-      "id": "GT-562",
+      "id": "GT-568",
       "closedAt": "2026-07-20",
-      "closureCommit": "7cffd734",
+      "closureCommit": "92390d6d",
       "evidence": [
-        "src/sdk/cli/src/commands/validate/validate.composable-report.spec.ts",
-        "src/sdk/cli/src/commands/init/init.command.spec.ts",
-        "src/sdk/cli/src/commands/update/update.command.spec.ts",
-        "src/sdk/cli/src/commands/profile/profile.command.spec.ts",
-        "src/sdk/cli/src/commands/agents/agents.command.spec.ts",
-        "src/sdk/cli/src/commands/api/api.command.spec.ts",
-        "src/sdk/cli/src/commands/architecture/scaffold.command.spec.ts",
-        "src/sdk/cli/src/commands/adr/adr.command.spec.ts",
-        "src/sdk/cli/src/infrastructure/formatters/output-formatter.service.spec.ts",
+        "package.json",
+        ".github/workflows/sdk-cli-ci.yml",
+        "package-lock.json"
+      ],
+      "validationCommands": [
+        "npm audit --audit-level=high (desde src/sdk/cli, comando exacto del job) -> 'found 0 vulnerabilities', exit 0. Antes: 1 high (brace-expansion) en la corrida 29780735123; local ya mostraba 3 (brace-expansion high, js-yaml high, protobufjs moderate) porque el DB de avisos avanzo.",
+        "npm ls js-yaml --omit=dev -> evolith-cli -> nest-commander -> cosmiconfig -> js-yaml: confirma que js-yaml es dependencia de PRODUCCION del CLI publicado; acotar a --omit=dev lo habria ocultado, no resuelto.",
+        "npm ci -> exit 0, 'found 0 vulnerabilities'; instala js-yaml@4.3.0, brace-expansion@2.1.2, protobufjs@7.6.5. npm ci --dry-run exit 0 (lockfile consistente con package.json).",
+        "git diff --stat package-lock.json -> 1 file changed, 30 insertions(+), 18 deletions(-): diff acotado a los tres subarboles, NO regeneracion del lockfile.",
+        "npm run build (tsc -b) -> exit 0. Suites: CLI 132, core-api 168 (consumidor de @nestjs/swagger/js-yaml + grpc/protobufjs), core-domain 1174, agent-runtime 226, mcp 342 -> todas verdes, el bump minor de js-yaml no perturbo swagger ni cosmiconfig."
+      ],
+      "dependencyDisposition": "none",
+      "dependencyRationale": "Sin dependencias. El gap planteaba una decision (acotar el audit vs tomar el bump); la auditoria previa la resolvio al descubrir que la premisa 'todo dev-only' era incompleta: js-yaml (high) esta en la ruta de PRODUCCION del CLI publicado via nest-commander->cosmiconfig, asi que --omit=dev lo habria escondido. Se eligio ARREGLAR las tres (js-yaml 4.3.0, brace-expansion 2.1.2, protobufjs 7.6.5) con overrides dirigidos, no una regeneracion del lockfile (el incidente de ajv es el porque). El pin exacto 4.1.1 de @nestjs/swagger resistio el override plano y el update incremental; se resolvio con un override con alcance @nestjs/swagger + extraccion quirurgica de la entrada stale del lockfile para que dedupara al 4.3.0 top-level. El workflow ahora declara su propio alcance (criterio 2). Verificacion local + npm ci; el job Unit... perdon, el job Security Audit debe confirmarlo en la proxima corrida de CI."
+    },
+    {
+      "id": "GT-569",
+      "closedAt": "2026-07-26",
+      "closureCommit": "44fe8dd3",
+      "evidence": [
+        "src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts",
+        "src/packages/core-domain/src/application/validators/ruleset-validator.service.ts",
+        "src/packages/core-domain/src/application/validators/rule-coverage.spec.ts",
+        "src/sdk/cli/src/commands/validate/validate.command.ts",
+        "src/tests/contract/sdk-type-contract.types.ts"
+      ],
+      "validationCommands": [
+        "npm run test -w @beyondnet/evolith-core-domain -> 119 suites / 1237 tests passed (+17 new in rule-coverage.spec.ts)",
+        "npm run test -w @beyondnet/evolith-cli -> 89 suites / 1305 tests + 18 suites / 132 tests passed",
+        "npm run test:contract -> 43/43 passed after WIRE_VALIDATION_RESULT gained rulesSkipped/rulesErrored/rulesTotal/skippedRuleIds/erroredRuleIds",
+        "Falsification: the new spec run against a pristine `git archive HEAD` copy of core-domain fails 12 of 17 (errored->skipped, undefined counters, missing advisories, no threshold issue)"
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Closes the REPORTING half only, by design: the envelope now publishes checked/skipped/errored/total and an exception is no longer laundered into skipped. Widening the corpus itself (the ~240 rules with no native handler) is a separate, far larger body of work and stays open — this record must not be read as coverage having improved."
+    },
+    {
+      "id": "GT-570",
+      "closedAt": "2026-07-27",
+      "closureCommit": "9a82d9f2",
+      "evidence": [
+        ".github/workflows/npm-release.yml",
+        ".harness/scripts/release/plan-npm-release.mjs",
+        "CHANGELOG.md",
+        "src/packages/mcp-server/package.json",
+        "src/sdk/cli/package.json",
+        "src/packages/agent-runtime/package.json"
+      ],
+      "validationCommands": [
+        "gh run view 30273290417 -> conclusion=success, workflow_dispatch on main @ 9a82d9f2 with dry_run=false.",
+        "curl https://registry.npmjs.org/@beyondnet%2Fevolith-mcp -> latest 1.2.0, published 2026-07-27T14:06:39Z, dist.attestations present. Same shape for evolith-agent-runtime@1.2.0 (14:06:10), evolith-sdk@2.0.0 (14:06:24) and evolith-cli@1.2.0 (14:06:58) — timestamps confirm dependency order.",
+        "The audit finding \"0 of 8 published packages carry dist.attestations\" no longer holds: four now do, produced by GitHub Actions with id-token: write rather than by a developer machine.",
+        "Scope corrected before shipping: `git show --name-only` (not --stat, which truncates long paths) showed the security wave touches mcp (15 files), cli (7) and agent-runtime (1, the CWE-78 shell runner) — the original plan of bumping mcp alone would have left two vulnerable.",
+        "Rehearsals: run 30265298045 found no LICENSE in any of the four tarballs and repository.url auto-corrected in all eight; run 30271837941 found bin paths auto-corrected in two. All three fixed before publishing and all three would have been permanent."
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Re-scoped rather than over-claimed. Two of the three original acceptance criteria are NOT met by this closure and were moved to GT-624: deprecating the 1.1.0 versions (needs npm credentials, owner action) and a release gate that fails when a security-tagged commit is absent from the published tag. This row closes on what it was about — an installable artifact older than its own published security fixes — and the remainder is tracked, not absorbed."
+    },
+    {
+      "id": "GT-571",
+      "closedAt": "2026-07-28",
+      "closureCommit": "097cacfe",
+      "evidence": [
+        ".harness/scripts/generate-adr-rulesets.mjs",
+        "src/rulesets/adr/generated/",
+        "src/packages/core-domain/src/application/validators/rule-applicability.spec.ts",
+        "src/sdk/cli/README.md"
+      ],
+      "validationCommands": [
+        "Fresh satellite (evolith init --name my-sat --yes; evolith validate) -> exit 0, status warning, 0 BLOCKING issues, 242 not-applicable of a 387 corpus. Was 91 blocking of 230.",
+        "Same build against the Core repository -> exit 2, 111 blocking, 55 not-applicable, all 133 generated ADR rules still evaluated. The audience gate is a filter, not an off-switch.",
+        "rule-applicability.spec.ts reads the REAL generated corpus: removing audience from one ruleset turns it red; regenerating turns it green.",
+        "README quickstart executed literally: fixtures 0, init 0, docs 0, validate 2 (documented blocking verdict), evolith-mcp serve starts on stdio."
+      ],
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-572",
+      "closedAt": "2026-07-29",
+      "closureCommit": "5571f078",
+      "evidence": [
+        "src/sdk/cli/examples/mcp-test.js",
+        "src/sdk/cli/examples/gate-verdict.assert.js",
+        "src/sdk/cli/examples/gate-verdict.assert.test.mjs",
+        "src/packages/mcp-server/src/tools/gate.tools.ts",
+        "src/packages/mcp-server/src/mcp/abac-evaluator.ts",
+        "src/packages/mcp-server/src/mcp/abac-evaluator.spec.ts",
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
+        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts",
         "reference/core/control-center/gaps/gap-reference-catalog.md"
       ],
       "validationCommands": [
-        "npx jest --coverage (src/sdk/cli) -> exit 0. Branches 75.54% frente al umbral global de 75%; statements 88.23%, functions 86.54%, lines 88.52%. 85 suites, 1250 tests, 0 fallos. Linea base medida al inicio de la sesion: 70.57% (1890/2678).",
-        "grep -c 'does not meet' sobre la salida de jest -> 0. Ningun umbral fue relajado: el diff no toca jest.config, solo archivos .spec.ts mas la opcion --name de agents.command.ts.",
-        "npm run build (tsc -b) -> exit 0."
+        "npm pack the mcp-server package and install the tarball OUTSIDE the workspace (no npm-workspaces symlink, which is the GT-625 illusion), then drive it over stdio -> tools/call evolith-gate-evaluate returns a REAL verdict with the default configuration: gateId = business-sign-off, verdict = failed. The row's original '47 of 47 FORBIDDEN' did NOT reproduce.",
+        "Same tarball with NODE_ENV=production -> FORBIDDEN. Cause is packaging, not policy: policy.wasm is a gitignored build artifact written OUTSIDE the mcp-server package, so no `files` setting reaches it and a published consumer inherited a fail-closed rule it could not satisfy. EVOLITH_ABAC_POLICY_PATH makes the posture satisfiable.",
+        "node --test src/sdk/cli/examples/gate-verdict.assert.test.mjs -> the new smoke assertion is proven FALSIFIABLE three ways, including a live run against the pre-fix dist. The old assertion (envelope.success !== undefined) was observed printing 'tools/call OK' while receiving RULESET_NOT_FOUND.",
+        "jest phase-gate-validator.service.spec.ts -> findCorePath no longer resolves <repo>/src after the src/ refactor (a GT-632 sibling); corePath is now declared in the evolith-gate-evaluate inputSchema, which read it while leaving it undeclared.",
+        "node .harness/scripts/ci-runner.mjs governance -> 17 scripts, all passed in this checkout."
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "TWO residuals are recorded rather than hidden. (1) Criterion 1 is ticked against a LOCALLY PACKED tarball, not against the registry: the published 1.1.0 predates every fix here and re-publishing is GT-570. (2) Shipping the compiled policy.wasm bundle INSIDE the package remains a release-pipeline decision: documented and deliberately NOT done in this change. Until it is, a published consumer running NODE_ENV=production must set EVOLITH_ABAC_POLICY_PATH."
+    },
+    {
+      "id": "GT-573",
+      "evidence": [
+        "src/rulesets/contracts/evolith-machine-contracts.json",
+        "src/packages/contracts/src/fixtures/evaluation-contract.fixtures.ts"
+      ],
+      "validationCommands": [
+        "MACHINE_CONTRACT_SET now pins gate-evidence, output-envelope, evaluation-context and evaluation-result (was the first two only).",
+        "10-validate-contract-conformance exit 0 over 4 schemas.",
+        "The consumer half is another repository and is carved out as GT-631 with its five concrete steps, not absorbed into this closure."
+      ],
+      "closedAt": "2026-07-28",
+      "closureCommit": "b16bd9fd",
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-574",
+      "closedAt": "2026-07-26",
+      "closureCommit": "44fe8dd3",
+      "evidence": [
+        "reference/core/control-center/gaps/gap-tracking.md"
+      ],
+      "validationCommands": [
+        "gh api repos/beyondnetcode/evolith_arch32/branches/main/protection -> required contexts = [Test, Test core-domain, Test core, Test mcp-server, Test core-api, Validate documentation, CodeQL SAST] (7, up from 6); enforce_admins.enabled = TRUE (was false).",
+        "gh api repos/beyondnetcode/evolith_arch32/branches/develop/protection -> the same 7 contexts with enforce_admins.enabled = TRUE. Previously this endpoint returned 404 \"Branch not protected\", on the branch where every change lands.",
+        "The audit finding \"0 of the 6 required checks is a security check\" no longer holds: CodeQL SAST is now required on both branches.",
+        "ci-cd.yml runs on push to develop (44fe8dd3), so the engine suites now execute on the working branch rather than only after a change reaches main."
+      ],
+      "dependencyDisposition": "none",
+      "dependencyRationale": "Branch protection applied and independently re-verified against the GitHub API on 2026-07-26: enforce_admins=true and CodeQL SAST required on BOTH main and develop. Not yet demonstrated: the acceptance criterion \"a test PR with a core check red cannot be merged\", and the 30-consecutive-day clean window, which is time-based. The commands above now carry their observed output rather than being bare invocations."
+    },
+    {
+      "id": "GT-575",
+      "evidence": [
+        "src/packages/agent-runtime/src/providers/GeminiProvider.ts",
+        "src/packages/agent-runtime/README.md",
+        "src/packages/agent-runtime/src/__tests__/agentic-ai-self-conformance.spec.ts"
+      ],
+      "validationCommands": [
+        "agentic-ai-self-conformance.spec.ts -> 13/13, evaluating the repository against the nine blocking AAI-* rules it ships.",
+        "NEGATIVE FIXTURE: without agent.config.json all nine evaluate to failed.",
+        "CAVEAT recorded on the row: the spec runs in Test agent-runtime, which is NOT one of main’s seven required contexts (verified against the live branch protection). It reports; it does not govern. Making it required is an owner action."
+      ],
+      "closedAt": "2026-07-28",
+      "closureCommit": "b16bd9fd",
+      "dependencyDisposition": "none"
+    },
+    {
+      "id": "GT-576",
+      "closedAt": "2026-07-26",
+      "closureCommit": "44fe8dd3",
+      "evidence": [
+        "reference/core/control-center/maturity-reports/maturity-assessment.md",
+        "reference/core/control-center/maturity-reports/maturity-assessment.es.md",
+        ".harness/scripts/ci/09-reconcile-maturity.mjs"
+      ],
+      "validationCommands": [
+        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check -> Maturity reconciliation matches the canonical Core evidence",
+        "node .harness/scripts/ci/04-check-bilingual-parity.mjs -> Bilingual Suite (Parity & Orphans) passed",
+        "node .harness/scripts/ci-runner.mjs governance -> 17 scripts executed, exit 0"
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "The two inflated pillar STATES were corrected and the mechanical rule now blocks the class of error. The Dimension A aggregate scores were deliberately NOT recomputed: the document declares no formula that reproduces them, so recomputing would have meant inventing one. Those aggregates are therefore optimistic and are tracked as follow-on rather than silently adjusted."
+    },
+    {
+      "id": "GT-577",
+      "closedAt": "2026-07-26",
+      "closureCommit": "3004d30b",
+      "evidence": [
+        ".github/actions/evolith-validate/action.yml",
+        ".github/workflows/evolith-validate-dogfood.yml",
+        ".github/actions/evolith-validate/test/action-step.test.mjs"
+      ],
+      "validationCommands": [
+        "gh run view 30228607519 -> branch=develop, conclusion=success; jobs \"Action vs non-conforming satellite\" and \"Action contract (recorded envelopes)\" both success.",
+        "gh run view 30228607519 --log -> \"OK: 34 blocking violation(s) of 274 issue(s), agreeing with the report.\" — the counter is non-zero AND cross-checks against the report file the action writes, which is what the broken '.summary.violations' jq path made impossible.",
+        "gh run view 30228607519 --log -> \"OK: the gate blocked as expected with 34 blocking violation(s).\" — the negative half: fail-on-violation=true must fail the step.",
+        "gh run list --workflow=evolith-validate-dogfood.yml --limit 5 -> 5 consecutive success."
       ],
-      "dependencyDisposition": "none",
-      "dependencyRationale": "Sin dependencias (el catalogo declara \"Dependencies: None\"). El gap se paga completo: el criterio era cruzar el 75% sin mover el umbral, y ambas mitades estan verificadas. Se corrigen dos afirmaciones del enunciado original. (1) 'Archivos afectados: core-api' era erroneo -- el gate que fallaba es el del CLI, coherente con el propio campo Componente 'SDK CLI'. (2) La estimacion del trabajo restante ('100-140 pruebas sobre asistentes interactivos... pruebas que comprueban que se pregunto algo a un mock') describia mal las ramas que faltaban: eran las rutas no interactivas y legibles por maquina (--format json en cinco comandos, init --batch, el reporte del motor composable), que son contrato real para scripts y CI, no ceremonia de mocks. La exclusion declarada de ~100 ramas en adr/agents ya no aplica: el defecto del sobre de exito que la motivaba se arreglo antes en esta campana, y las pruebas nuevas afirman el contrato corregido de ADR-0073 de forma explicita (success = el comando corrio; el veredicto viaja dentro; el exit code lo transporta), de modo que fijan la conducta correcta en vez de congelar la equivocada. Verificacion local, no CI: el job Unit Tests debe confirmarlo en la proxima corrida."
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "The action is dogfooded and under regression, which is what this gap was about. Making the workflow a REQUIRED check is branch-protection configuration, not a code change, and is deliberately left outside this closure — a gate nobody requires is how this action rotted in the first place, so it is worth doing, just not here."
     },
     {
-      "id": "GT-568",
-      "closedAt": "2026-07-20",
-      "closureCommit": "92390d6d",
+      "id": "GT-579",
+      "closedAt": "2026-07-26",
+      "closureCommit": "44fe8dd3",
       "evidence": [
-        "package.json",
-        ".github/workflows/sdk-cli-ci.yml",
-        "package-lock.json"
+        "src/sdk/cli/src/main.ts"
       ],
       "validationCommands": [
-        "npm audit --audit-level=high (desde src/sdk/cli, comando exacto del job) -> 'found 0 vulnerabilities', exit 0. Antes: 1 high (brace-expansion) en la corrida 29780735123; local ya mostraba 3 (brace-expansion high, js-yaml high, protobufjs moderate) porque el DB de avisos avanzo.",
-        "npm ls js-yaml --omit=dev -> evolith-cli -> nest-commander -> cosmiconfig -> js-yaml: confirma que js-yaml es dependencia de PRODUCCION del CLI publicado; acotar a --omit=dev lo habria ocultado, no resuelto.",
-        "npm ci -> exit 0, 'found 0 vulnerabilities'; instala js-yaml@4.3.0, brace-expansion@2.1.2, protobufjs@7.6.5. npm ci --dry-run exit 0 (lockfile consistente con package.json).",
-        "git diff --stat package-lock.json -> 1 file changed, 30 insertions(+), 18 deletions(-): diff acotado a los tres subarboles, NO regeneracion del lockfile.",
-        "npm run build (tsc -b) -> exit 0. Suites: CLI 132, core-api 168 (consumidor de @nestjs/swagger/js-yaml + grpc/protobufjs), core-domain 1174, agent-runtime 226, mcp 342 -> todas verdes, el bump minor de js-yaml no perturbo swagger ni cosmiconfig."
+        "BEFORE: node src/sdk/cli/dist/main.js validate --format json | wc -c -> 65536 (exactly the pipe buffer); same command > file -> 121408 bytes, valid JSON",
+        "AFTER: node src/sdk/cli/dist/main.js validate --format json | node -e (parse stdin) -> PARSEABLE, 123034 bytes",
+        "npm run test -w @beyondnet/evolith-cli -> 89 suites / 1305 tests + 18 suites / 132 tests passed (the 6 e2e JSON.parse failures are gone)"
       ],
-      "dependencyDisposition": "none",
-      "dependencyRationale": "Sin dependencias. El gap planteaba una decision (acotar el audit vs tomar el bump); la auditoria previa la resolvio al descubrir que la premisa 'todo dev-only' era incompleta: js-yaml (high) esta en la ruta de PRODUCCION del CLI publicado via nest-commander->cosmiconfig, asi que --omit=dev lo habria escondido. Se eligio ARREGLAR las tres (js-yaml 4.3.0, brace-expansion 2.1.2, protobufjs 7.6.5) con overrides dirigidos, no una regeneracion del lockfile (el incidente de ajv es el porque). El pin exacto 4.1.1 de @nestjs/swagger resistio el override plano y el update incremental; se resolvio con un override con alcance @nestjs/swagger + extraccion quirurgica de la entrada stale del lockfile para que dedupara al 4.3.0 top-level. El workflow ahora declara su propio alcance (criterio 2). Verificacion local + npm ci; el job Unit... perdon, el job Security Audit debe confirmarlo en la proxima corrida de CI."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-447",
-      "closedAt": "2026-07-24",
-      "closureCommit": "0b387b44",
+      "id": "GT-581",
       "evidence": [
-        "product/infra/docker-compose.fullstack.yml"
+        "src/packages/mcp-server/src/common/tool-output-schema.ts",
+        "src/packages/mcp-server/src/mcp/tool-registry.service.ts",
+        "src/packages/mcp-server/src/mcp/tool-output-contract.spec.ts"
       ],
       "validationCommands": [
-        "cd product/infra && EVOLITH_API_KEY=local-dev-key docker compose -f docker-compose.fullstack.yml up -d --build -> 8/8 servicios healthy (redis, core-api, mcp, agent-runtime, tracker-postgres, tracker-api, tracker-gateway, tracker-web); `docker compose ps` los muestra todos (healthy).",
-        "curl -sS -X POST http://localhost:8088/api/v1/core/evaluate -H 'Content-Type: application/json' -d '{\"targetType\":\"initiative\",\"targetId\":\"gt-447-demo\",\"phase\":\"design\",\"gate\":\"design-gate\",\"topology\":\"modular-monolith\"}' -> HTTP 200, status=COMPLETED, provenance=core, coreEndpoint=/api/v1/evaluate, overallVerdict=FAIL (39 hallazgos bloqueantes sobre el workspace 'rulesets'), durationMs~533. Round-trip real al Core por el chain completo del navegador (nginx -> tracker-api -> core-api), no un mock (MockFallback=false).",
-        "curl -sS http://localhost:8088/api/v1/core-evaluation-transactions/ -> la evaluacion queda persistida en Postgres (operationId tracker-82339e85..., status=completed, decision=FAILED); confirma el camino de escritura tracker-api -> Postgres.",
-        "Navegador (http://localhost:8088): la SPA React renderiza el Control Tower via dev-bypass; el network muestra /api/v1/{auth/config,auth/session,tenants,initiatives,sdlc-executions,core-evaluation-transactions,audit-entries} todos 200, indicador 'PostgreSQL healthy'.",
-        "node .harness/scripts/ci/08-validate-tracking.mjs -> verde con este registro de cierre + el flip del contador."
+        "All 50 tools return structuredContent validating under the SDK AjvJsonSchemaValidator, including FORBIDDEN denials.",
+        "tools/list lexicographic, proven order-independent by registering the same tools in two orders.",
+        "mcp-server jest -> 432/432."
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-447 es un milestone cuyo alcance son sus 7 hijos (GT-436/438/439/440/446 en este repo + GT-437/442), todos ya COMPLETADOS. Este cierre entrega la aceptacion restante a nivel de milestone: un bring-up local full-stack de un solo comando que incluye la UI del Tracker (cross-repo), verificado end-to-end en un navegador. Los fixes de build de tracker-web viajan en la rama feature/gt-447-fullstack-local de evolith_tracker (f8b68f2). Nota: el appsettings committeado de tracker-api apunta CoreApi.BaseUrl al gateway con un path drifteado (/api/core/api/v1 vs la ruta real del gateway /api/core/evaluate) -- aqui se cableo el hop directo a core-api; se rastrea como follow-up aparte."
+      "closedAt": "2026-07-28",
+      "closureCommit": "caf5fb97",
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-560",
-      "closedAt": "2026-07-24",
-      "closureCommit": "729c14c1",
+      "id": "GT-586",
       "evidence": [
-        "src/apps/core-api/src/infrastructure/cache/in-memory-cache.module.ts",
-        "src/apps/core-api/src/app.module.ts",
-        "reference/core/foundations/common-rules/senior-architectural-assessment.md"
+        "src/packages/contracts/src/fixtures/evaluation-contract.fixtures.ts",
+        "src/packages/contracts/src/fixtures/evaluation-contract.fixtures.spec.ts",
+        "src/packages/contracts/src/index.ts"
       ],
       "validationCommands": [
-        "grep -rn 'CircuitBreakerService|createBreaker|opossum|createCacheStore|RedisCacheModule' src/apps/core-api/src -> 0 resultados (breaker huerfano + wiring Redis muerto removidos por completo).",
-        "cd src/apps/core-api && npm run build -> nest build exit 0 (sin referencias colgantes).",
-        "cd src/apps/core-api && npm test -> 28 suites / 158 tests passed (el spec borrado del breaker era el unico test que lo referenciaba).",
-        "npm install --package-lock-only --legacy-peer-deps -> diff de package-lock.json = 3 insertions / 20 deletions, solo opossum + @types/opossum (sin sprawl); npm ci sigue consistente para el build Docker de core-api.",
-        "node .harness/scripts/ci/08-validate-tracking.mjs -> verde con este registro + el flip del contador (556/568)."
+        "contracts jest -> 72/72 (was 68).",
+        "The fixtures are exported from the PACKAGE INDEX, verified by requiring dist/index.js: both symbols present.",
+        "Additivity asserted: EVALUATION_RESULT_PASS_FIXTURE carries neither field and still resolves to PASSED."
       ],
-      "dependencyDisposition": "none",
-      "dependencyRationale": "GT-560 no declara dependencias. Resuelto por la rama que el propio gap ofrecia ('o pones llamadas reales tras el breaker, o dejas de puntuar resiliencia de algo que no protege nada'): el Core es un evaluador stateless (ADR-0101) que no hace llamadas salientes de DB/HTTP, y el unico candidato de cache nunca conecto a Redis, asi que la resolucion honesta es la eliminacion, no la reparacion (reparar el wiring Redis solo es estrictamente peor -- un Redis inalcanzable cuelga get/set en vez de rechazar, por eso un breaker solo se justificaria JUNTO con el). El score ya estaba corregido a 4/10; la nota se reescribe para reflejar la eliminacion. Adjacent finding (CacheMetricsService sin cablear el write-side) queda deliberadamente como item menor aparte."
+      "closedAt": "2026-07-28",
+      "closureCommit": "e23721f5",
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-441",
-      "closedAt": "2026-07-24",
-      "closureCommit": "a299ab89",
+      "id": "GT-593",
       "evidence": [
-        "src/packages/agent-runtime/src/adapters/approval/tracker-approval.http-client.ts",
-        "src/apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts",
-        "product/infra/docker-compose.fullstack.yml"
+        "src/packages/agent-runtime/src/domain/ports/run-journal.port.ts",
+        "src/packages/agent-runtime/src/adapters/journal/file-run-journal.adapter.ts",
+        "src/packages/agent-runtime/src/__tests__/run-journal-resume.spec.ts"
       ],
       "validationCommands": [
-        "cd src/packages/agent-runtime && npm test -> 28 suites / 249 tests passed, incl. tracker-approval.http-client.spec: submit() POSTs to /runtime-approvals with x-api-key, DROPS tenantId from the body, maps the response; non-2xx throws; fed through the real adapter, an approved answer grants and a 401 denies fail-closed as unavailable.",
-        "cd src/apps/agent-runtime-api && npm test -> 7 suites / 81 tests passed; the runtime.factory approval wiring typechecks clean against the built package (tsc --noEmit -p tsconfig.json clean).",
-        "Live smoke vs the running Tracker (docker-compose.fullstack, tracker-api :5100 configured with a CoreMachine key bound to the dev tenant): client.submit() -> {status:pending, approvalId} (a real approval persisted in Postgres); adapter.requireApproval() -> {granted:false, status:pending}; a second submit with the same correlationId returns the SAME approvalId (idempotent); POST /runtime-approvals/{id}/resolve {status:rejected} as a dev-bypass human -> HTTP 200; a third submit -> {status:rejected, approver} and the adapter denies it as a tracker-decision. Full loop end to end.",
-        "node .harness/scripts/ci/08-validate-tracking.mjs -> green with this record + the counter flip (557/568)."
+        "Killed the Core mid-pipeline and re-submitted: a drifting harness is called once and grounding still cites the original corpus version after the corpus is emptied between attempts.",
+        "agent-runtime jest -> 384/384. Approvals and policy verdicts are deliberately NOT journaled and are re-decided each attempt, asserted by test."
       ],
-      "dependencyDisposition": "satisfied",
-      "dependencyRationale": "GT-441 extends GT-387 (the governed-executor approval port, done in a prior wave) and its receiving half is CD-23 on the Tracker board, shipped 2026-07-19 (RuntimeApprovalEndpoints + migration AddRuntimeApprovals) — both satisfied, so the Core-side TrackerApprovalHttpClient could finally be written against a real, agreed contract instead of a fabricated one (the exact reason it was deliberately left unimplemented before). The approve->grant path is intentionally NOT live-smoked here: granting requires a designated UMS approver (CD-31) and dev-bypass carries every permission but no authority, which the endpoint deliberately rejects ('permission is not authority'). That path is covered by the adapter unit test (approved->grant) and the Tracker's own RuntimeApprovalEndpointTests; the pending, idempotency and human-reject paths ARE live-smoked against the real Tracker."
+      "closedAt": "2026-07-28",
+      "closureCommit": "caf5fb97",
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-569",
-      "closedAt": "2026-07-26",
-      "closureCommit": "44fe8dd3",
+      "id": "GT-595",
+      "closedAt": "2026-07-29",
+      "closureCommit": "a840a45b",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts",
+        "src/packages/core-domain/src/application/validators/rule-evaluation-engine.ts",
+        "src/packages/core-domain/src/application/validators/blocking-skipped-invariant.spec.ts",
+        "src/packages/core-domain/src/application/validators/rule-corpus-triage.spec.ts",
         "src/packages/core-domain/src/application/validators/ruleset-validator.service.ts",
-        "src/packages/core-domain/src/application/validators/rule-coverage.spec.ts",
-        "src/sdk/cli/src/commands/validate/validate.command.ts",
-        "src/tests/contract/sdk-type-contract.types.ts"
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture/config-rules.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture/module-boundary-rules.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture/module-boundary-rules.spec.ts",
+        "src/packages/infra-providers/src/disk-ruleset.repository.ts",
+        "src/packages/infra-providers/src/disk-ruleset.repository.spec.ts",
+        ".harness/scripts/generate-adr-rulesets.mjs",
+        "reference/core/control-center/gaps/gap-reference-catalog.md"
       ],
       "validationCommands": [
-        "npm run test -w @beyondnet/evolith-core-domain -> 119 suites / 1237 tests passed (+17 new in rule-coverage.spec.ts)",
-        "npm run test -w @beyondnet/evolith-cli -> 89 suites / 1305 tests + 18 suites / 132 tests passed",
-        "npm run test:contract -> 43/43 passed after WIRE_VALIDATION_RESULT gained rulesSkipped/rulesErrored/rulesTotal/skippedRuleIds/erroredRuleIds",
-        "Falsification: the new spec run against a pristine `git archive HEAD` copy of core-domain fails 12 of 17 (errored->skipped, undefined counters, missing advisories, no threshold issue)"
+        "jest blocking-skipped-invariant.spec.ts -> AC2 is enforced: RuleEvaluationEngine.toValidationIssues emits a `blocking` ValidationIssue whenever a rule declared `blocking` returns `skipped`, so the combination fails the run. Deliberately NOT a thrown error: RulesetValidatorService.validate catches engine exceptions and downgrades them to logger.warn, so a throw would be silently suppressed by the only product caller. The rule's own outcome stays `skipped` on purpose -- promoting it to `failed` would move it into rulesChecked and re-inflate the coverage GT-569 made honest.",
+        "Enforcing it exposed 181 rules declared `blocking` that never execute. 96 were auto-generated ADR placeholders whose own validationQuery ends 'Concrete checks to be wired into the harness'; generate-adr-rulesets.mjs now emits blocking: false for them. Of the remaining 85, TWELVE were closed for real: 8 config-shaped (ED-R04, ED-R05, ED-R06, DAM-R05, MTN-05, GIT-08, SEC-RL-01, SEC-RL-02) and 4 module-boundary (HXA-01, HXA-02, HXA-04, HXA-05).",
+        "jest rule-corpus-triage.spec.ts -> the pin is 73, RECOMPUTED against the real corpus rather than assumed; perturbing the pin to 74 was observed FAILING, so the number is measured and not decorative.",
+        "jest disk-ruleset.repository.spec.ts -> ROOT CAUSE of the four dead HXA rules: DiskRulesetRepository.normalizeRuleset never copied the `enforce` field. The schema has accepted it since GT-516, ADR-0002 authors six blocks and the PolicyCompiler compiles them -- but normalization dropped it, so rule.enforce was always undefined and the ENTIRE enforcer subsystem was unreachable for lack of DATA, not for lack of wiring.",
+        "SECOND instance of the same pattern: rule-corpus-triage.spec.ts's own loader dropped `enforce` too, under a docstring claiming it loads 'exactly as DiskRulesetRepository does'. The measuring instrument was measuring a different corpus than the one production evaluates. Both loaders now carry the field.",
+        "node .harness/scripts/ci-runner.mjs governance -> 17 scripts, all passed in this checkout."
       ],
       "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Closes the REPORTING half only, by design: the envelope now publishes checked/skipped/errored/total and an exception is no longer laundered into skipped. Widening the corpus itself (the ~240 rules with no native handler) is a separate, far larger body of work and stays open — this record must not be read as coverage having improved."
+      "dependencyRationale": "TWO deliberate non-adoptions are recorded as part of the closure, not deferred silently. (1) dependency-cruiser was NOT adopted for the module-boundary rules: the Core is a stateless engine that reads satellites through an overlay filesystem a subprocess cannot see, and the tool's config matches node_modules/, so an UNINSTALLED satellite would yield zero violations and PASS four blocking rules. A false pass is worse than the skip it would replace. (2) OCB-02 was NOT closed: no artifact anywhere carries an `availability` marker, so the rule quantifies over the empty set and can only pass; that is recorded as three executable tests instead of prose. The residual unclaimed-blocking corpus stands at 73 and is pinned."
     },
     {
-      "id": "GT-576",
-      "closedAt": "2026-07-26",
-      "closureCommit": "44fe8dd3",
+      "id": "GT-596",
+      "closedAt": "2026-07-28",
+      "closureCommit": "6bb43cfa",
       "evidence": [
         "reference/core/control-center/maturity-reports/maturity-assessment.md",
-        "reference/core/control-center/maturity-reports/maturity-assessment.es.md",
         ".harness/scripts/ci/09-reconcile-maturity.mjs"
       ],
       "validationCommands": [
-        "node .harness/scripts/ci/09-reconcile-maturity.mjs --check -> Maturity reconciliation matches the canonical Core evidence",
-        "node .harness/scripts/ci/04-check-bilingual-parity.mjs -> Bilingual Suite (Parity & Orphans) passed",
-        "node .harness/scripts/ci-runner.mjs governance -> 17 scripts executed, exit 0"
+        "node --test .harness/scripts/reconcile-maturity.test.mjs -> 21/21, including the negative self-test proving the threshold rule goes red on a bad input. 09-reconcile-maturity --check exit 0.",
+        "ci-runner.mjs governance -> 17/17 exit 0 after the wave and its three repairs."
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "The two inflated pillar STATES were corrected and the mechanical rule now blocks the class of error. The Dimension A aggregate scores were deliberately NOT recomputed: the document declares no formula that reproduces them, so recomputing would have meant inventing one. Those aggregates are therefore optimistic and are tracked as follow-on rather than silently adjusted."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-579",
-      "closedAt": "2026-07-26",
-      "closureCommit": "44fe8dd3",
+      "id": "GT-598",
       "evidence": [
-        "src/sdk/cli/src/main.ts"
+        "src/rulesets/standards/iso-5055-mapping.json",
+        "src/rulesets/standards/iso-5055-mapping.csv"
       ],
       "validationCommands": [
-        "BEFORE: node src/sdk/cli/dist/main.js validate --format json | wc -c -> 65536 (exactly the pipe buffer); same command > file -> 121408 bytes, valid JSON",
-        "AFTER: node src/sdk/cli/dist/main.js validate --format json | node -e (parse stdin) -> PARSEABLE, 123034 bytes",
-        "npm run test -w @beyondnet/evolith-cli -> 89 suites / 1305 tests + 18 suites / 132 tests passed (the 6 e2e JSON.parse failures are gone)"
+        "381 corpus rules, each mapped to a 5055 weakness or marked no-equivalent WITH a reason; the test fails if any unmapped row lacks one.",
+        "138-weakness index extracted from OMG ATDM V2 tables; per-measure counts 74/74/18/31 match what CISQ publishes.",
+        "Adopted fraction stated against the REAL backlog: 9 of 60 outright, 8 partial. The gap premise (a large slice of 240 handlers) is refuted."
       ],
+      "closedAt": "2026-07-28",
+      "closureCommit": "caf5fb97",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-577",
-      "closedAt": "2026-07-26",
-      "closureCommit": "3004d30b",
+      "id": "GT-601",
+      "closedAt": "2026-07-28",
+      "closureCommit": "8144e79a",
       "evidence": [
-        ".github/actions/evolith-validate/action.yml",
-        ".github/workflows/evolith-validate-dogfood.yml",
-        ".github/actions/evolith-validate/test/action-step.test.mjs"
+        "src/packages/core-domain/src/evaluation/canonical-result.mapper.ts",
+        "src/packages/core-domain/src/evaluation/canonical-result.mapper.spec.ts",
+        "src/packages/core-domain/src/evaluation/sarif-exporter.spec.ts"
       ],
       "validationCommands": [
-        "gh run view 30228607519 -> branch=develop, conclusion=success; jobs \"Action vs non-conforming satellite\" and \"Action contract (recorded envelopes)\" both success.",
-        "gh run view 30228607519 --log -> \"OK: 34 blocking violation(s) of 274 issue(s), agreeing with the report.\" — the counter is non-zero AND cross-checks against the report file the action writes, which is what the broken '.summary.violations' jq path made impossible.",
-        "gh run view 30228607519 --log -> \"OK: the gate blocked as expected with 34 blocking violation(s).\" — the negative half: fail-on-violation=true must fail the step.",
-        "gh run list --workflow=evolith-validate-dogfood.yml --limit 5 -> 5 consecutive success."
+        "canonical-result.mapper.spec.ts + sarif-exporter.spec.ts -> 40/40.",
+        "MUTATION: reverting rulesExecuted to the unconditional empty array turns 10 tests RED across the mapper and the SARIF exporter.",
+        "AC2 covered on BOTH paths: resolveRuleEngine attributes .rego to opa and non-rego to native, with a rule-level override winning.",
+        "AC3: sarif-exporter derives evaluatedRules from rulesExecuted, deduped and sorted, asserted non-empty."
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "The action is dogfooded and under regression, which is what this gap was about. Making the workflow a REQUIRED check is branch-protection configuration, not a code change, and is deliberately left outside this closure — a gate nobody requires is how this action rotted in the first place, so it is worth doing, just not here."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-570",
-      "closedAt": "2026-07-27",
-      "closureCommit": "9a82d9f2",
+      "id": "GT-607",
       "evidence": [
-        ".github/workflows/npm-release.yml",
-        ".harness/scripts/release/plan-npm-release.mjs",
-        "CHANGELOG.md",
-        "src/packages/mcp-server/package.json",
-        "src/sdk/cli/package.json",
-        "src/packages/agent-runtime/package.json"
+        "src/packages/agent-runtime/src/adapters/harness/harness-process.adapter.ts"
       ],
       "validationCommands": [
-        "gh run view 30273290417 -> conclusion=success, workflow_dispatch on main @ 9a82d9f2 with dry_run=false.",
-        "curl https://registry.npmjs.org/@beyondnet%2Fevolith-mcp -> latest 1.2.0, published 2026-07-27T14:06:39Z, dist.attestations present. Same shape for evolith-agent-runtime@1.2.0 (14:06:10), evolith-sdk@2.0.0 (14:06:24) and evolith-cli@1.2.0 (14:06:58) — timestamps confirm dependency order.",
-        "The audit finding \"0 of 8 published packages carry dist.attestations\" no longer holds: four now do, produced by GitHub Actions with id-token: write rather than by a developer machine.",
-        "Scope corrected before shipping: `git show --name-only` (not --stat, which truncates long paths) showed the security wave touches mcp (15 files), cli (7) and agent-runtime (1, the CWE-78 shell runner) — the original plan of bumping mcp alone would have left two vulnerable.",
-        "Rehearsals: run 30265298045 found no LICENSE in any of the four tarballs and repository.url auto-corrected in all eight; run 30271837941 found bin paths auto-corrected in two. All three fixed before publishing and all three would have been permanent."
+        "The spawn passes an allowlisted environment; a test asserts a spawned capability cannot read the Core token and fails against the previous ...process.env.",
+        "agent-runtime 406/406 (was 384).",
+        "CAVEAT recorded on the row: this is credential denial, not sandboxing. A capability child can still open a socket; the ADR-0081 sandboxed runner remains unimplemented."
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "Re-scoped rather than over-claimed. Two of the three original acceptance criteria are NOT met by this closure and were moved to GT-624: deprecating the 1.1.0 versions (needs npm credentials, owner action) and a release gate that fails when a security-tagged commit is absent from the published tag. This row closes on what it was about — an installable artifact older than its own published security fixes — and the remainder is tracked, not absorbed."
+      "closedAt": "2026-07-28",
+      "closureCommit": "c438b801",
+      "dependencyDisposition": "none"
     },
     {
       "id": "GT-609",
@@ -8360,136 +8469,149 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-618",
-      "closedAt": "2026-07-28",
-      "closureCommit": "6bb43cfa",
+      "id": "GT-611",
       "evidence": [
-        "src/sdk/cli/src/commands/waiver/waiver.command.ts"
+        "src/sdk/cli/src/infrastructure/prompts/non-interactive-contract.spec.ts",
+        "src/sdk/cli/src/infrastructure/prompts/prompt.service.ts",
+        "src/sdk/cli/src/infrastructure/prompts/interactivity.ts"
       ],
       "validationCommands": [
-        "cd src/sdk/cli && npm run test:unit -> 92 suites / 1378 tests passed; waiver emits an ADR-0073 envelope with correlationId.",
-        "ci-runner.mjs governance -> 17/17 exit 0 after the wave and its three repairs."
+        "non-interactive-contract.spec.ts -> 19/19.",
+        "Mutation: adding a command file that imports @clack/prompts directly turns the surface scan RED, proving it covers commands written after it."
       ],
+      "closedAt": "2026-07-28",
+      "closureCommit": "e23721f5",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-619",
-      "closedAt": "2026-07-28",
-      "closureCommit": "6bb43cfa",
+      "id": "GT-612",
       "evidence": [
-        "src/sdk/cli/src/commands/chat/chat.command.ts"
+        "src/packages/agent-runtime/src/application/agent-runtime.service.ts",
+        "src/packages/agent-runtime/src/__tests__/engine-proposal-and-memory.spec.ts"
       ],
       "validationCommands": [
-        "wc -l src/sdk/cli/src/commands/chat/chat.command.ts -> 200 (was 91); grep for loop/session constructs -> 34 hits. Implemented as a REPL rather than removed.",
-        "ci-runner.mjs governance -> 17/17 exit 0 after the wave and its three repairs."
+        "engine-proposal-and-memory.spec.ts -> 12/12.",
+        "Mutation: replacing the memory.history() read with an empty array turns 3 tests RED, including \"turn 2 receives turn 1 in the plan context\"."
       ],
+      "closedAt": "2026-07-28",
+      "closureCommit": "e23721f5",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-596",
-      "closedAt": "2026-07-28",
-      "closureCommit": "6bb43cfa",
+      "id": "GT-613",
       "evidence": [
-        "reference/core/control-center/maturity-reports/maturity-assessment.md",
-        ".harness/scripts/ci/09-reconcile-maturity.mjs"
+        "src/packages/agent-runtime/src/adapters/review/heuristic-structural-reviewer.adapter.ts",
+        "src/packages/agent-runtime/src/adapters/review/heuristic-structural-reviewer.adapter.spec.ts"
       ],
       "validationCommands": [
-        "node --test .harness/scripts/reconcile-maturity.test.mjs -> 21/21, including the negative self-test proving the threshold rule goes red on a bad input. 09-reconcile-maturity --check exit 0.",
-        "ci-runner.mjs governance -> 17/17 exit 0 after the wave and its three repairs."
+        "grep -rn \"implements IStructuralReviewer\" src -> 1 hit, not a stub (was 0).",
+        "agent-runtime jest -> 384/384; the adapter test fails without the adapter."
       ],
+      "closedAt": "2026-07-28",
+      "closureCommit": "caf5fb97",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-623",
+      "id": "GT-618",
       "closedAt": "2026-07-28",
       "closureCommit": "6bb43cfa",
       "evidence": [
-        "commitlint.config.mjs",
-        ".husky/commit-msg",
-        "package.json",
-        ".harness/scripts/ci/03-validate-root-cleanliness.mjs"
+        "src/sdk/cli/src/commands/waiver/waiver.command.ts"
       ],
       "validationCommands": [
-        "sh .husky/commit-msg <valid> -> accepted; sh .husky/commit-msg <malformed> -> REJECTED. 03-validate-root-cleanliness exit 0 (32 root entries). npm install regenerated package-lock.json so npm ci is coherent again.",
+        "cd src/sdk/cli && npm run test:unit -> 92 suites / 1378 tests passed; waiver emits an ADR-0073 envelope with correlationId.",
         "ci-runner.mjs governance -> 17/17 exit 0 after the wave and its three repairs."
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-613",
+      "id": "GT-619",
+      "closedAt": "2026-07-28",
+      "closureCommit": "6bb43cfa",
       "evidence": [
-        "src/packages/agent-runtime/src/adapters/review/heuristic-structural-reviewer.adapter.ts",
-        "src/packages/agent-runtime/src/adapters/review/heuristic-structural-reviewer.adapter.spec.ts"
+        "src/sdk/cli/src/commands/chat/chat.command.ts"
       ],
       "validationCommands": [
-        "grep -rn \"implements IStructuralReviewer\" src -> 1 hit, not a stub (was 0).",
-        "agent-runtime jest -> 384/384; the adapter test fails without the adapter."
+        "wc -l src/sdk/cli/src/commands/chat/chat.command.ts -> 200 (was 91); grep for loop/session constructs -> 34 hits. Implemented as a REPL rather than removed.",
+        "ci-runner.mjs governance -> 17/17 exit 0 after the wave and its three repairs."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "caf5fb97",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-593",
+      "id": "GT-620",
+      "closedAt": "2026-07-28",
+      "closureCommit": "9a462387",
       "evidence": [
-        "src/packages/agent-runtime/src/domain/ports/run-journal.port.ts",
-        "src/packages/agent-runtime/src/adapters/journal/file-run-journal.adapter.ts",
-        "src/packages/agent-runtime/src/__tests__/run-journal-resume.spec.ts"
+        ".harness/scripts/lib/language-heuristic.mjs",
+        ".harness/scripts/ci/suites/bilingual-suite.mjs",
+        ".harness/scripts/ci/suites/bilingual-suite.test.mjs",
+        "reference/core/interfaces/using-the-cli.md"
       ],
       "validationCommands": [
-        "Killed the Core mid-pipeline and re-submitted: a drifting harness is called once and grounding still cites the original corpus version after the corpus is emptied between attempts.",
-        "agent-runtime jest -> 384/384. Approvals and policy verdicts are deliberately NOT journaled and are re-decided each attempt, asserted by test."
+        "Restoring the Spanish text into the English slot turns 04-check-bilingual-parity RED: \"the ENGLISH slot reads as Spanish (710 Spanish function words vs 71 English)\". Restoring the English guide turns it green.",
+        "node --test .harness/scripts/ci/suites/bilingual-suite.test.mjs -> 7/7: both verdicts, both refusals to judge (sample too small, majority too close), and the code/flag/link stripping trap.",
+        "Switching the heuristic on surfaced 19 further mislabelled documents, baselined BY NAME and registered as GT-628."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "caf5fb97",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-598",
+      "id": "GT-621",
+      "closedAt": "2026-07-28",
+      "closureCommit": "3c802b40",
       "evidence": [
-        "src/rulesets/standards/iso-5055-mapping.json",
-        "src/rulesets/standards/iso-5055-mapping.csv"
+        ".harness/scripts/ci/45-validate-port-inventory-honesty.mjs",
+        ".harness/scripts/ci/45-validate-port-inventory-honesty.test.mjs",
+        "reference/core/sdlc/assets/master-view.svg",
+        ".harness/scripts/lib/guard-classification.mjs"
       ],
       "validationCommands": [
-        "381 corpus rules, each mapped to a 5055 weakness or marked no-equivalent WITH a reason; the test fails if any unmapped row lacks one.",
-        "138-weakness index extracted from OMG ATDM V2 tables; per-measure counts 74/74/18/31 match what CISQ publishes.",
-        "Adopted fraction stated against the REAL backlog: 9 of 60 outright, 8 partial. The gap premise (a large slice of 240 handlers) is refuted."
+        "45-validate-port-inventory-honesty --verbose -> 19 ports declared, 11 on the hot path (7 required + 4 optional), 8 declared-not-reached, 53 adapters.",
+        "Before the fix the guard exits 1 against master-view.svg: \"publishes a port/adapter count without saying how many are actually reached\".",
+        "node --test .harness/scripts/ci/45-validate-port-inventory-honesty.test.mjs -> 9/9, including four anti-vacuous fixtures (zero ports, unparseable deps, zero adapters, missing scan corpus).",
+        "Row evidence corrected: 17/49/9 as registered vs 19/53/11 measured; the diagnostic’s \"two interaction adapters with no callers\" is six."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "caf5fb97",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-581",
+      "id": "GT-623",
+      "closedAt": "2026-07-28",
+      "closureCommit": "6bb43cfa",
       "evidence": [
-        "src/packages/mcp-server/src/common/tool-output-schema.ts",
-        "src/packages/mcp-server/src/mcp/tool-registry.service.ts",
-        "src/packages/mcp-server/src/mcp/tool-output-contract.spec.ts"
+        "commitlint.config.mjs",
+        ".husky/commit-msg",
+        "package.json",
+        ".harness/scripts/ci/03-validate-root-cleanliness.mjs"
       ],
       "validationCommands": [
-        "All 50 tools return structuredContent validating under the SDK AjvJsonSchemaValidator, including FORBIDDEN denials.",
-        "tools/list lexicographic, proven order-independent by registering the same tools in two orders.",
-        "mcp-server jest -> 432/432."
+        "sh .husky/commit-msg <valid> -> accepted; sh .husky/commit-msg <malformed> -> REJECTED. 03-validate-root-cleanliness exit 0 (32 root entries). npm install regenerated package-lock.json so npm ci is coherent again.",
+        "ci-runner.mjs governance -> 17/17 exit 0 after the wave and its three repairs."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "caf5fb97",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-424",
+      "id": "GT-624",
+      "closedAt": "2026-07-30",
+      "closureCommit": "f84fe739",
       "evidence": [
-        ".harness/scripts/ci/34-check-skill-registry-parity.mjs",
-        ".harness/scripts/ci/34-check-skill-registry-parity.test.mjs",
-        ".github/workflows/ci-cd.yml"
+        ".harness/scripts/ci/48-validate-security-publish-lag.mjs",
+        ".harness/scripts/ci/48-validate-security-publish-lag.test.mjs",
+        ".harness/scripts/lib/guard-classification.mjs",
+        ".github/workflows/ci-cd.yml",
+        "reference/core/control-center/gaps/gap-reference-catalog.md"
       ],
       "validationCommands": [
-        "34-check-skill-registry-parity -> exit 0; 9/9 executable capabilities routable (4 hand-bound, 5 synthesized), reported separately.",
-        "node --test .harness/scripts/ci/34-check-skill-registry-parity.test.mjs -> 15/15, including three negative fixtures: derivation absent, derivation uncalled, and a synthesis narrowed by one extra conjunct.",
-        "Wired into the governance-guards job in ci-cd.yml, so it is no longer inert."
+        "CRITERION (a) -- npm deprecate ran on SIX packages, not the three the row named: evolith-cli, evolith-mcp, evolith-agent-runtime, evolith-core-domain, evolith-core and evolith-infra-providers, each message naming the successor and the date the wave landed. Verified with `npm view <pkg>@1.1.0 deprecated --prefer-online`; the first read-back was empty on four of six (registry cache lag, not a failed command) which is why it was re-read rather than trusted.",
+        "TWO packages deliberately NOT deprecated, recorded rather than skipped: evolith-sdk@1.1.0 is what the published line actually RESOLVED, because cli@1.2.1 and mcp@1.2.1 declared `^1.1.0` and that package publishes 1.0.0/1.1.0/2.0.0 -- a caret cannot cross a major (registered as GT-634 and fixed in 1.2.2); evolith-contracts@1.1.0 is that package's only published version, so deprecating it offers no upgrade path.",
+        "node .harness/scripts/ci/48-validate-security-publish-lag.mjs --verbose -> 8 of 8 packages, 47 commits examined since each package's published version, 0 security-marked. CRITERIA (b): the gate exists and is wired into the Governance guards job in ci-cd.yml.",
+        "THE BOUNDARY COMES FROM THE REGISTRY, NOT FROM A TAG, and that is measured: the newest v* tag in this repository is v1.1.0 while npm serves @beyondnet/evolith-cli@1.2.2. Three releases were published without a tag, so a tag-based gate would have reported a four-release lag that does not exist and flagged every commit since 1.1.0.",
+        "TWO FALSE NEGATIVES were found and fixed while building it, each pinned by a fixture. (1) `git log -S'\"version\": \"<published>\"'` matches the commit that DELETED the string as well as the one that added it, so on a just-bumped package the boundary landed on the bump itself. (2) Taking the NEWEST commit at the published version let a later manifest edit that keeps the version -- a dependency bump -- push the boundary forward and hide the window. The boundary is now the commit where the version was SET. Denominator: 47 commits examined, against 31 for the first implementation.",
+        "The marker is STRUCTURAL, type or scope, and refuses prose on purpose: `fix(deps)!: ... the SDK that carries the security wave` is a dependency fix, and a gate that fires on any subject mentioning security gets switched off. Pinned by a unit test that asserts that exact subject is NOT a marker.",
+        "node --test .harness/scripts/ci/48-validate-security-publish-lag.test.mjs -> 12/12, over real git repositories in a sandbox rather than a mock of git archaeology.",
+        "CRITERION (c) in this repository's strong form: node .harness/scripts/ci/43-validate-guard-negative-fixtures.mjs -> 37/37 exercised guards refused the empty fixture, up from 36. The gate has been OBSERVED failing, not merely declared able to.",
+        "node .harness/scripts/ci/42-validate-guard-denominators.mjs -> 60 guards classified, 40/40 scanners refuse a zero-element scan; the new guard is registered in guard-classification.mjs with its anti-vacuous proof."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "caf5fb97",
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "What this gate does NOT do is stated rather than left to be discovered. It detects a security-marked commit that no published version contains; it cannot detect a security fix nobody marked, which is a convention problem and belongs to GT-623 (release-please derives no bump from the non-conventional `security(...)` type this repository has used twice). It also reports, but does not fail on, a package whose published version is absent from this history -- an INEXACT boundary after a history rewrite -- because scanning the whole history conservatively is better than skipping the package silently. Finally, the gate needs the network: without a registry answer the package is skipped and named, and a run where EVERY package is skipped is a failure rather than a pass."
     },
     {
       "id": "GT-625",
@@ -8510,21 +8632,18 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-571",
-      "closedAt": "2026-07-28",
-      "closureCommit": "097cacfe",
+      "id": "GT-626",
       "evidence": [
-        ".harness/scripts/generate-adr-rulesets.mjs",
-        "src/rulesets/adr/generated/",
-        "src/packages/core-domain/src/application/validators/rule-applicability.spec.ts",
-        "src/sdk/cli/README.md"
+        "src/sdk/cli/src/commands/architecture/scaffold.command.ts",
+        "src/sdk/cli/src/commands/architecture/scaffold/nx-workspace-bootstrap.ts"
       ],
       "validationCommands": [
-        "Fresh satellite (evolith init --name my-sat --yes; evolith validate) -> exit 0, status warning, 0 BLOCKING issues, 242 not-applicable of a 387 corpus. Was 91 blocking of 230.",
-        "Same build against the Core repository -> exit 2, 111 blocking, 55 not-applicable, all 133 generated ADR rules still evaluated. The audience gate is a filter, not an off-switch.",
-        "rule-applicability.spec.ts reads the REAL generated corpus: removing audience from one ruleset turns it red; regenerating turns it green.",
-        "README quickstart executed literally: fixtures 0, init 0, docs 0, validate 2 (documented blocking verdict), evolith-mcp serve starts on stdio."
+        "scaffold now bootstraps the Nx workspace init leaves absent, so it can follow init as the README implied.",
+        "The precondition stays strict for an ambiguous src/: a fast clear refusal, never a cryptic Nx crash after a long install.",
+        "CLI unit 1430/1430 (was 1382)."
       ],
+      "closedAt": "2026-07-28",
+      "closureCommit": "c438b801",
       "dependencyDisposition": "none"
     },
     {
@@ -8545,362 +8664,357 @@
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-620",
-      "closedAt": "2026-07-28",
-      "closureCommit": "9a462387",
+      "id": "GT-628",
       "evidence": [
-        ".harness/scripts/lib/language-heuristic.mjs",
         ".harness/scripts/ci/suites/bilingual-suite.mjs",
-        ".harness/scripts/ci/suites/bilingual-suite.test.mjs",
-        "reference/core/interfaces/using-the-cli.md"
+        "reference/core/interfaces/using-the-mcp.md",
+        "src/packages/mcp-server/README.md"
       ],
       "validationCommands": [
-        "Restoring the Spanish text into the English slot turns 04-check-bilingual-parity RED: \"the ENGLISH slot reads as Spanish (710 Spanish function words vs 71 English)\". Restoring the English guide turns it green.",
-        "node --test .harness/scripts/ci/suites/bilingual-suite.test.mjs -> 7/7: both verdicts, both refusals to judge (sample too small, majority too close), and the code/flag/link stripping trap.",
-        "Switching the heuristic on surfaced 19 further mislabelled documents, baselined BY NAME and registered as GT-628."
+        "LANGUAGE_BASELINE is empty and the constant deleted: every EN/ES pair in the repository is now judged with no exemptions.",
+        "04-check-bilingual-parity -> exit 0 over 1639 markdown files, 522 EN docs under reference/ checked for an ES counterpart.",
+        "01-validate-docs -> exit 0 over 1487 files: heading-count parity held through every translation."
       ],
+      "closedAt": "2026-07-28",
+      "closureCommit": "c438b801",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-611",
+      "id": "GT-629",
       "evidence": [
-        "src/sdk/cli/src/infrastructure/prompts/non-interactive-contract.spec.ts",
-        "src/sdk/cli/src/infrastructure/prompts/prompt.service.ts",
-        "src/sdk/cli/src/infrastructure/prompts/interactivity.ts"
+        ".harness/scripts/ci/08-validate-tracking.mjs",
+        ".harness/scripts/ci/08-validate-tracking.test.mjs"
       ],
       "validationCommands": [
-        "non-interactive-contract.spec.ts -> 19/19.",
-        "Mutation: adding a command file that imports @clack/prompts directly turns the surface scan RED, proving it covers commands written after it."
+        "08-validate-tracking.mjs -> \"Acceptance-criteria audit: 47 non-DONE GT row(s) checked against 605/605 EN/ES catalog sections — 0 with no criteria at all.\" exit 0.",
+        "It exited 1 on its first run against the real board, naming GT-435, GT-444 and GT-448; criteria were written for all three rather than exempting them.",
+        "node --test .harness/scripts/ci/08-validate-tracking.test.mjs -> 17/17, including the negative fixture and the vacuity floor."
       ],
       "closedAt": "2026-07-28",
-      "closureCommit": "e23721f5",
+      "closureCommit": "c438b801",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-612",
+      "id": "GT-630",
+      "closedAt": "2026-07-28",
+      "closureCommit": "63a96d09",
       "evidence": [
-        "src/packages/agent-runtime/src/application/agent-runtime.service.ts",
-        "src/packages/agent-runtime/src/__tests__/engine-proposal-and-memory.spec.ts"
+        ".harness/scripts/ci/46-validate-derived-artifact-order.mjs",
+        ".harness/scripts/ci/46-validate-derived-artifact-order.test.mjs",
+        ".github/workflows/docs.yml",
+        ".harness/scripts/lib/guard-classification.mjs"
       ],
       "validationCommands": [
-        "engine-proposal-and-memory.spec.ts -> 12/12.",
-        "Mutation: replacing the memory.history() read with an empty array turns 3 tests RED, including \"turn 2 receives turn 1 in the plan context\"."
+        "46-validate-derived-artifact-order --verbose -> 2 links, 3 artifacts, current AND at a fixed point.",
+        "node --test .harness/scripts/ci/46-validate-derived-artifact-order.test.mjs -> 8/8, including a test proving the guard leaves the real tree byte-identical after replaying in place.",
+        "Wired into docs.yml, which backs the required Validate documentation check.",
+        "Registered in guard-classification.mjs: 42 reports 58 guards classified, 43 reports 35 observed failing."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "e23721f5",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-586",
+      "id": "GT-632",
+      "closedAt": "2026-07-29",
+      "closureCommit": "64ec61e0",
       "evidence": [
-        "src/packages/contracts/src/fixtures/evaluation-contract.fixtures.ts",
-        "src/packages/contracts/src/fixtures/evaluation-contract.fixtures.spec.ts",
-        "src/packages/contracts/src/index.ts"
+        ".harness/scripts/ci/47-validate-joined-paths.mjs",
+        ".harness/scripts/ci/47-validate-joined-paths.test.mjs",
+        "src/packages/mcp-server/src/mcp/abac-evaluator.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.ts",
+        "src/packages/core-domain/src/application/upgrade/satellite-upgrade-diff.ts",
+        "src/packages/core-domain/src/application/validators/artifact-path-resolver.ts",
+        ".github/workflows/docs.yml",
+        ".harness/scripts/lib/guard-classification.mjs",
+        ".harness/scripts/compile-opa-wasm.mjs"
       ],
       "validationCommands": [
-        "contracts jest -> 72/72 (was 68).",
-        "The fixtures are exported from the PACKAGE INDEX, verified by requiring dist/index.js: both symbols present.",
-        "Additivity asserted: EVALUATION_RESULT_PASS_FIXTURE carries neither field and still resolves to PASSED."
+        "47-validate-joined-paths --verbose -> 615 files, 542 path.join calls, 89 repo-rooted, 65 resolvable, 4 fallback chains, 1 prohibition, exit 0.",
+        "First run reported 19 broken paths; only 3 were defects. The other 16 were false positives whose 'fix' would have broken working code: 6 on a base naming the customer workspace, 9 members of fallback chains, 1 prohibition whose absence IS the passing state.",
+        "node --test .harness/scripts/ci/47-validate-joined-paths.test.mjs -> 11/11, covering both anti-vacuous floors, chain and ternary grouping, variable segments, and non-root bases.",
+        "43-validate-guard-negative-fixtures OBSERVED it red: 36 of 36 guards turned red against the empty fixture. 42 reports 11 self-guarded, 39 scanning, 0 PENDING.",
+        "core-domain 1367/1367, mcp-server 434/434, core-api 179/179, CLI unit 1436/1436, all four tsc projects clean.",
+        "Wired into docs.yml, which backs the required Validate documentation check.",
+        "The guard's first CI run went RED with 8 paths that pass locally: dist/, .harness/evidence and the gitignored policy.wasm exist on a developer machine and in no clean checkout. As written it would have demanded build output be committed. Corrected to check ANCHORING, not existence — a missing segment may be generated, but its parent must be real — and re-verified against a tracked-files-only `git archive` export. Proven not to have blinded it: reintroducing the original P0 (`src/rulesets/opa/policy.wasm`) and the ADR straggler in that clean export turns it red again, because the failure is at `rulesets`, not at the generated leaf. node --test now 14/14."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "e23721f5",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-621",
-      "closedAt": "2026-07-28",
-      "closureCommit": "3c802b40",
+      "id": "GT-633",
+      "closedAt": "2026-07-29",
+      "closureCommit": "05c3f62b",
       "evidence": [
-        ".harness/scripts/ci/45-validate-port-inventory-honesty.mjs",
-        ".harness/scripts/ci/45-validate-port-inventory-honesty.test.mjs",
-        "reference/core/sdlc/assets/master-view.svg",
-        ".harness/scripts/lib/guard-classification.mjs"
+        "src/packages/core-domain/src/application/services/project-scaffolder.service.ts",
+        "src/packages/core-domain/src/application/use-cases/initialize-project.use-case.ts",
+        "src/packages/core-domain/src/application/use-cases/initialize-project.use-case.spec.ts",
+        "src/packages/infra-providers/src/rule-applicability.integration.spec.ts",
+        "src/rulesets/adr/adr-0010-multi-tenancy.rules.json",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/governance-rule.handler.ts",
+        "src/packages/core-domain/src/application/validators/rule-applicability.ts"
       ],
       "validationCommands": [
-        "45-validate-port-inventory-honesty --verbose -> 19 ports declared, 11 on the hot path (7 required + 4 optional), 8 declared-not-reached, 53 adapters.",
-        "Before the fix the guard exits 1 against master-view.svg: \"publishes a port/adapter count without saying how many are actually reached\".",
-        "node --test .harness/scripts/ci/45-validate-port-inventory-honesty.test.mjs -> 9/9, including four anti-vacuous fixtures (zero ports, unparseable deps, zero adapters, missing scan corpus).",
-        "Row evidence corrected: 17/49/9 as registered vs 19/53/11 measured; the diagnostic’s \"two interaction adapters with no callers\" is six."
+        "rule-applicability.integration.spec.ts -> 10/10. The pinned assertion moved from ['GIT-08','MTN-05'] to [] because the scaffold changed, not because the assertion was relaxed.",
+        "initialize-project.use-case.spec.ts -> 9/9, covering all three legs GIT-08 reads: config content (the seven types GIT-08 names), the merged devDependencies, and a commit-msg hook asserted to carry --no-install and to contain no else branch.",
+        "The deferral of MTN-05 is asserted over phases 0->3: excluded at 0 and 1, binding at 2 and 3. Weakening the annotation turns the test red.",
+        "Verified per-rule rather than by the suite alone: GIT-08 executes and PASSES for the typescript and python scaffolds; MTN-05 appears in notApplicableRuleIds rather than passing silently.",
+        "core-domain 1442/1442, infra-providers 129/129, src/sdk/cli 1436/1436, mcp-server init.tools 7/7.",
+        "32-validate-ruleset-schemas -> 168 passed, 0 failed, exit 0. 28-native-evaluator-parity -> 17 fixtures, 451 verdict assertions, exit 0. 01-validate-docs -> 1491 files, exit 0.",
+        "The premise did NOT reproduce on first contact: the suite resolves @beyondnet/evolith-core-domain through the workspace symlink to dist/, nine days stale and predating the GT-595 handlers, so both rules were skipped and the pinned assertion already read []. A green run in that state would have produced a false CLOSURE. Reproduced only after re-anchoring node_modules at the worktree and rebuilding -- the same untracked-build-state class as GT-625 and GT-632.",
+        "NOT done, deliberately: multi-tenancy.rego still asserts MTN-05 unconditionally. Applicability is a native-engine pre-filter by construction (GT-571) and TAX-06 already carries the same shape, so this is a pre-existing engine divergence rather than one introduced here."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "The prerequisite is satisfied and closed: GT-595 gave MTN-05 and GIT-08 real handlers, which is the only reason either failure was visible. One part is deliberately left out of scope: the parallel multi-tenancy.rego still asserts MTN-05 unconditionally. Applicability is a native-engine pre-filter by construction (GT-571) and TAX-06 already carries the same shape -- a phase annotation alongside a rego that does not read it -- so this is a pre-existing divergence between the two engines, not one introduced here, and closing it belongs to whatever unifies applicability across engines."
     },
     {
-      "id": "GT-601",
-      "closedAt": "2026-07-28",
-      "closureCommit": "8144e79a",
+      "id": "GT-634",
+      "closedAt": "2026-07-30",
+      "closureCommit": "f84fe739",
       "evidence": [
-        "src/packages/core-domain/src/evaluation/canonical-result.mapper.ts",
-        "src/packages/core-domain/src/evaluation/canonical-result.mapper.spec.ts",
-        "src/packages/core-domain/src/evaluation/sarif-exporter.spec.ts"
+        "src/sdk/cli/package.json",
+        "src/packages/mcp-server/package.json",
+        "package-lock.json",
+        "CHANGELOG.md",
+        "src/sdk/cli/scripts/check-install-smoke.mjs"
       ],
       "validationCommands": [
-        "canonical-result.mapper.spec.ts + sarif-exporter.spec.ts -> 40/40.",
-        "MUTATION: reverting rulesExecuted to the unconditional empty array turns 10 tests RED across the mapper and the SARIF exporter.",
-        "AC2 covered on BOTH paths: resolveRuleEngine attributes .rego to opa and non-rego to native, with a rule-level override winning.",
-        "AC3: sarif-exporter derives evaluatedRules from rulesExecuted, deduped and sorted, asserted non-empty."
+        "PUBLISHED AND VERIFIED AGAINST THE REGISTRY, not against a green workflow: run 30548042781 succeeded, `npm view @beyondnet/evolith-{cli,mcp} version --prefer-online` returns 1.2.2, both declare `@beyondnet/evolith-sdk: ^2.0.0`, and both carry dist.attestations with provenance.",
+        "THE CHECK THAT MATTERS: installing @beyondnet/evolith-cli@latest into a directory that has never seen this workspace resolves @beyondnet/evolith-sdk@2.0.0 and the binary boots printing 1.2.2. Before this release the same install pulled the 2026-07-18 SDK.",
+        "CRITERION 2 REFUTED THE ROW'S OWN PREMISE, and that is the finding. None of the seven security-wave commits (1b077ab6, 3a39dd03, 60bfc63a, 3f31fa64, 90eacdbc, 4f29e114, 8ad4e2de) touches src/packages/sdk-client -- zero files each, checked commit by commit. The wave's release commit 21205d24 names the three packages it affected: evolith-mcp (15 files), evolith-cli (7), evolith-agent-runtime (1). The SDK was republished alongside them, not fixed.",
+        "So sdk@1.1.0 predates the wave chronologically and carries none of it: there was no security exposure through this dependency. What was real: a caret range under 1.x cannot cross a major, so both consumers were pinned a MAJOR behind on a contract dependency (`.passed` against a payload that emits `verdict`), and package-lock.json nested the registry tarball inside each consumer where it shadowed the workspace link -- the GT-625 class.",
+        "CRITERION 3 -- npm deprecate @beyondnet/evolith-sdk@1.1.0, with a message that gives the real reason (superseded by 2.0.0, `.passed` -> `verdict`) and states explicitly that it is NOT a security advisory. Verified after `npm cache clean --force`, because a first read-back returned the previous message from cache.",
+        "A CORRECTION TO MY OWN EARLIER WORK, made rather than left standing: the GT-624 deprecations of evolith-core-domain, evolith-core and evolith-infra-providers at 1.1.0 said `Security fixes landed in 1.2.0`. The same commit-by-commit evidence refutes that -- the wave touched three packages and none of those three is among them. All three messages were rewritten to say they were republished alongside the wave, not fixed by it. A false security claim on a public registry is worse than no claim."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "TWO things are left open on purpose. (1) evolith-cli@1.2.1 and evolith-mcp@1.2.1 are NOT deprecated: they resolve the superseded SDK major, which is a stale contract and not an exposure, and deprecating a version one patch old needs an owner's call rather than mine. (2) evolith-contracts@1.1.0 remains this package's only published version, so there is still no upgrade path to point a deprecation at; it is recorded here rather than forced."
     },
     {
-      "id": "GT-629",
+      "id": "GT-635",
+      "closedAt": "2026-07-30",
+      "closureCommit": "600dd7a9",
       "evidence": [
-        ".harness/scripts/ci/08-validate-tracking.mjs",
-        ".harness/scripts/ci/08-validate-tracking.test.mjs"
+        "reference/core/control-center/evidence/gap-closure-evidence.json",
+        ".harness/scripts/ci/41-validate-evidence-commands.mjs",
+        ".github/workflows/ci-cd.yml"
       ],
       "validationCommands": [
-        "08-validate-tracking.mjs -> \"Acceptance-criteria audit: 47 non-DONE GT row(s) checked against 605/605 EN/ES catalog sections — 0 with no criteria at all.\" exit 0.",
-        "It exited 1 on its first run against the real board, naming GT-435, GT-444 and GT-448; criteria were written for all three rather than exempting them.",
-        "node --test .harness/scripts/ci/08-validate-tracking.test.mjs -> 17/17, including the negative fixture and the vacuity floor."
+        "CLOSED THE WAY THE ROW ASKED, which was the whole point: the budget was not raised to ratify the breach. `f34a10f1` migrated the recorded closure commands onto the paths this repository actually has, and `600dd7a9` then moved the budget 304 -> 40 from the count that migration produced.",
+        "node .harness/scripts/ci/41-validate-evidence-commands.mjs --strict --max-dead 40 -> 40 dead over 1045 recorded commands in 575 closures. The corpus went 309 -> 40: 269 references were REPAIRED, not exempted, which subsumes the four this row was opened for.",
+        "Governance guards (GT-578) passed on the runner for PR #288, which is the check that had been red on main for at least three consecutive runs (30482497995, 30470648146, 30466280865).",
+        "Registered by one session and closed by another within the hour. Recorded plainly: the value of the row was making a permanently red required-adjacent job visible, not owning the repair."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "c438b801",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-628",
+      "id": "GT-636",
+      "closedAt": "2026-07-29",
+      "closureCommit": "d85c6216",
       "evidence": [
-        ".harness/scripts/ci/suites/bilingual-suite.mjs",
-        "reference/core/interfaces/using-the-mcp.md",
-        "src/packages/mcp-server/README.md"
+        "package.json",
+        "package-lock.json",
+        "reference/core/architecture/adrs/core/0124-credential-secret-management-standard.es.md",
+        "reference/core/architecture/demos/level-3-components/README.es.md",
+        "reference/core/control-center/gaps/gap-tracking.es.md",
+        "reference/core/control-center/maturity-reports/maturity-assessment.es.md",
+        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
       ],
       "validationCommands": [
-        "LANGUAGE_BASELINE is empty and the constant deleted: every EN/ES pair in the repository is now judged with no exemptions.",
-        "04-check-bilingual-parity -> exit 0 over 1639 markdown files, 522 EN docs under reference/ checked for an ES counterpart.",
-        "01-validate-docs -> exit 0 over 1487 files: heading-count parity held through every translation."
+        "npm audit --audit-level=high -> real exit code 0, verified separately from the printed summary (checked with $? after redirecting to a file, since the human-readable summary was once observed stale after a fix that had already applied).",
+        "node .harness/scripts/bilingual-terminology-lint.mjs --verbose -> Bilingual terminology check passed.",
+        "npm run test:e2e --workspace src/sdk/cli (exact CI command) -> 18 suites, 132/132 passed.",
+        "core-domain: npx jest --config jest.config.js --runInBand -> 128/129 suites, 1442/1444 tests (2 pre-existing skips).",
+        "npm run test:unit --workspace src/sdk/cli -> 99/99 suites, 1436/1436 tests.",
+        "mcp-server: npx jest --config jest.config.js --runInBand -> 53/53 suites, 433/437 tests (4 pre-existing skips).",
+        "All of the above run in an isolated scratch worktree (git worktree add --detach) with a REAL, non-symlinked node_modules copied from the main checkout, after rebuilding every workspace dependency (core-domain, agent-runtime, sdk, infra-providers, core, mcp) exactly as the CI job's own \"Build workspace dependencies\" step does -- not against this session's own per-package symlink farm, which was independently confirmed to corrupt npm ls graph output."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "c438b801",
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "2 moderate npm audit findings remain, both the same root cause: a Windows-only path-traversal in @hono/node-server's serve-static (GHSA-frvp-7c67-39w9), irrelevant to this repo's Linux CI/deployment. The available fix bumps @modelcontextprotocol/sdk, a PRODUCTION dependency pinned exactly (no range) in two workspaces' package.json -- qualitatively different from the devDependency-only overrides this closure applied, and out of scope for a security-audit fix that should not also silently change a shipped runtime dependency's resolved version."
     },
     {
-      "id": "GT-626",
+      "id": "GT-637",
+      "closedAt": "2026-07-29",
+      "closureCommit": "5acb29ed",
       "evidence": [
-        "src/sdk/cli/src/commands/architecture/scaffold.command.ts",
-        "src/sdk/cli/src/commands/architecture/scaffold/nx-workspace-bootstrap.ts"
+        ".harness/scripts/ci/41-validate-evidence-commands.mjs",
+        ".harness/scripts/ci/41-validate-evidence-commands.test.mjs",
+        ".github/workflows/ci-cd.yml",
+        "reference/core/control-center/evidence/gap-closure-evidence.json"
       ],
       "validationCommands": [
-        "scaffold now bootstraps the Nx workspace init leaves absent, so it can follow init as the README implied.",
-        "The precondition stays strict for an ambiguous src/: a fast clear refusal, never a cryptic Nx crash after a long install.",
-        "CLI unit 1430/1430 (was 1382)."
+        "node --test .harness/scripts/ci/41-validate-evidence-commands.test.mjs -> 39/39, including 5 new cases: the --workspace-before-script-name fix, its negative twin (an undeclared script under that form is still caught), the gitignored-artifact classification on both the relative-binary and node <script> branches, and its negative twin (a genuinely missing, non-gitignored binary is still dead).",
+        "node .harness/scripts/ci/41-validate-evidence-commands.mjs --strict --max-dead 21 -> exit 0. Same command with --max-dead 20 -> exit 1. The budget is exact, not padded.",
+        "node .harness/scripts/ci/41-validate-evidence-commands.mjs --execute --verbose -> report mode, 21 dead, 6 executed commands fail (GT-42, GT-78, GT-79, GT-280, GT-556, GT-557) -- all pre-existing, confirmed none among the paths touched by this closure.",
+        "node .harness/scripts/ci/08-validate-tracking.mjs -> 633 gaps EN/ES, 610/610 EN/ES catalog sections, 576 closure records.",
+        "42-validate-guard-denominators, 43-validate-guard-negative-fixtures, 44-validate-adr-implementation-status, 34-check-skill-registry-parity, 45-validate-port-inventory-honesty all re-run clean in the same job.",
+        "Each of the 18 confident path renames in gap-closure-evidence.json (docker-compose.yml, review-*.test.mjs x3, roundtrip-gate-evaluate.mjs, api-throughput-baseline.js, incident-response-*.md, slo/, alerts/ x2, chaos-experiments/cpu-stress.yaml, data-store-backup-dr.md, gap-reference-catalog.md/.es.md) plus chat.command.ts verified against a real successor file present on disk before being written -- not guessed.",
+        "309 -> 78 (npmScriptOperand defined) -> 52 (--workspace-before-script-name parsing fixed) -> 22 (18 confident path renames) -> 21 (chat.command.ts) dead references, measured at each step, not assumed."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "c438b801",
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "The residual 21 dead references are genuinely retired artifacts (a consolidated .bmad-core/AGENTS.md, the retired evolith-bff gateway, the retired packages/mcp-tools, two retired k8s manifests with no path-equivalent successor, a retired sandbox app, three root-level scripts no longer declared) or prose misparsed as a path (vision/, tools/list). None were force-mapped to a plausible-looking target -- a wrong rename would corrupt the record it claims to verify. Repairing each is per-record archaeology into when and why that specific artifact was retired, which this closure deliberately did not attempt; --max-dead stays at 21 until it is."
     },
     {
-      "id": "GT-607",
+      "id": "GT-638",
+      "closedAt": "2026-07-30",
+      "closureCommit": "b75522ff",
       "evidence": [
-        "src/packages/agent-runtime/src/adapters/harness/harness-process.adapter.ts"
+        ".harness/scripts/ci/49-validate-gap-id-allocation.mjs",
+        ".harness/scripts/ci/49-validate-gap-id-allocation.test.mjs",
+        ".harness/scripts/lib/guard-classification.mjs",
+        ".github/workflows/ci-cd.yml",
+        "reference/core/control-center/gaps/gap-reference-catalog.md"
       ],
       "validationCommands": [
-        "The spawn passes an allowlisted environment; a test asserts a spawned capability cannot read the Core token and fails against the previous ...process.env.",
-        "agent-runtime 406/406 (was 384).",
-        "CAVEAT recorded on the row: this is credential denial, not sandboxing. A capability child can still open a socket; the ADR-0081 sandboxed runner remains unimplemented."
+        "node .harness/scripts/ci/49-validate-gap-id-allocation.mjs --verbose -> 515 ids on base, 515 on HEAD, 0 newly allocated, 0 collisions against origin/main.",
+        "IT FOUND A SECOND COLLISION ON ITS FIRST REAL RUN, which nobody knew about. Against origin/develop it reports GT-633: on develop that id is `evolith init` scaffolds a repository that cannot pass its own governance on the first run (c8270e48, 2026-07-29); on main it is the tautological-guard row (c3221276, 2026-07-30). Two gaps, one number, and the merge had not surfaced it yet. RESOLVED the same day by renumbering the newer row -- main's -- to GT-640, per the guard's own advice.",
+        "THE DISCRIMINATOR IS THE TITLE, deliberately. `the id already exists on base` is the normal case for 500-odd rows and says nothing; what makes it a defect is the id naming a DIFFERENT gap on each side. Evidence, status and criteria are all expected to change on a branch.",
+        "It refuses to guess which side is wrong -- a retitle and a collision are indistinguishable from outside -- so it names both titles and both refs, and says in the failure that it should not guess.",
+        "node --test .harness/scripts/ci/49-validate-gap-id-allocation.test.mjs -> 13/13, including the GT-634 collision reproduced over real git repositories rather than a mock of `git show`.",
+        "ANTI-VACUOUS: a missing catalog, a base ref that cannot be read, and a parse yielding zero ids on either side are all hard failures. `unable to answer` is not `nothing to report` -- a quiet skip is how the original collision reached main.",
+        "node .harness/scripts/ci/43-validate-guard-negative-fixtures.mjs -> 38/38 exercised guards refused the empty fixture, up from 37; this guard has been OBSERVED failing.",
+        "node .harness/scripts/ci/42-validate-guard-denominators.mjs -> 61 guards classified, none silently unprotected.",
+        "Wired into Governance guards (GT-578) with an explicit `git fetch` of the base branch: a shallow CI checkout does not have it, and a guard that failed for THAT reason would teach people to ignore it."
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "c438b801",
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "What this guard cannot see is stated rather than left to be assumed: an id allocated on a branch from which no pull request has been opened. It compares HEAD against ONE base, so two feature branches that both allocate GT-640 stay invisible to each other until the first of them merges. The `--verbose` output says so on every newly allocated id instead of implying coverage it does not have. Closing that remainder needs the open-PR claim set described in GT-639, which is why it is tracked there and not bolted on here."
     },
     {
-      "id": "GT-632",
-      "closedAt": "2026-07-29",
-      "closureCommit": "64ec61e0",
+      "id": "GT-640",
+      "closedAt": "2026-07-30",
+      "closureCommit": "29e940d4",
       "evidence": [
-        ".harness/scripts/ci/47-validate-joined-paths.mjs",
-        ".harness/scripts/ci/47-validate-joined-paths.test.mjs",
-        "src/packages/mcp-server/src/mcp/abac-evaluator.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/opa-evaluator.ts",
-        "src/packages/core-domain/src/application/upgrade/satellite-upgrade-diff.ts",
-        "src/packages/core-domain/src/application/validators/artifact-path-resolver.ts",
-        ".github/workflows/docs.yml",
-        ".harness/scripts/lib/guard-classification.mjs",
-        ".harness/scripts/compile-opa-wasm.mjs"
+        "src/rulesets/standards/capture-native-evaluability-snapshot.mjs",
+        "src/packages/core-domain/test/rule-corpus-triage.ts",
+        "src/packages/core-domain/src/application/validators/rule-corpus-triage.spec.ts",
+        "src/rulesets/standards/native-evaluability-snapshot.json",
+        "src/rulesets/standards/iso-5055-mapping.test.mjs",
+        ".harness/scripts/ci/46-validate-derived-artifact-order.mjs",
+        ".github/workflows/docs.yml"
       ],
       "validationCommands": [
-        "47-validate-joined-paths --verbose -> 615 files, 542 path.join calls, 89 repo-rooted, 65 resolvable, 4 fallback chains, 1 prohibition, exit 0.",
-        "First run reported 19 broken paths; only 3 were defects. The other 16 were false positives whose 'fix' would have broken working code: 6 on a base naming the customer workspace, 9 members of fallback chains, 1 prohibition whose absence IS the passing state.",
-        "node --test .harness/scripts/ci/47-validate-joined-paths.test.mjs -> 11/11, covering both anti-vacuous floors, chain and ternary grouping, variable segments, and non-root bases.",
-        "43-validate-guard-negative-fixtures OBSERVED it red: 36 of 36 guards turned red against the empty fixture. 42 reports 11 self-guarded, 39 scanning, 0 PENDING.",
-        "core-domain 1367/1367, mcp-server 434/434, core-api 179/179, CLI unit 1436/1436, all four tsc projects clean.",
-        "Wired into docs.yml, which backs the required Validate documentation check.",
-        "The guard's first CI run went RED with 8 paths that pass locally: dist/, .harness/evidence and the gitignored policy.wasm exist on a developer machine and in no clean checkout. As written it would have demanded build output be committed. Corrected to check ANCHORING, not existence — a missing segment may be generated, but its parent must be real — and re-verified against a tracked-files-only `git archive` export. Proven not to have blinded it: reintroducing the original P0 (`src/rulesets/opa/policy.wasm`) and the ADR straggler in that clean export turns it red again, because the failure is at `rulesets`, not at the generated leaf. node --test now 14/14."
+        "THE FAILURE MODE, which is the content worth keeping: the guard's expected value was a copy of its actual value. iso-5055-mapping.test.mjs asserted the snapshot's six class counts against six numbers typed into the test -- the same six literals native-evaluability-snapshot.json already contained -- so it passed for as long as the file was unchanged, whatever Core actually pinned. It reported an agreement it never checked.",
+        "SECOND failure mode: build-iso-5055-mapping.mjs stamps `nativeEvaluability` onto every row of the ISO/IEC 5055 mapping from that snapshot (388 rows after the recapture, 381 before), so one stale class is laundered into a derived artifact five times the size of its input and overstates the GT-598 handler backlog.",
+        "node src/rulesets/standards/capture-native-evaluability-snapshot.mjs --check -> the end-to-end re-derivation; it runs Core's real triage through ts-node rather than reimplementing the classification, because a second implementation would be the second source of truth the fix removes.",
+        "node --test src/rulesets/standards/iso-5055-mapping.test.mjs -> the documentation-job guard now reads Core's pinned counts OUT of the spec that pins them and THROWS when the literal is missing or reshaped: failing to find the source of truth must never read as agreement with it.",
+        "node .harness/scripts/ci/46-validate-derived-artifact-order.mjs -> 5 links / 7 artifacts, current AND at a fixed point. The recapture->rebuild order is data, not prose: rebuilding the mapping before recapturing the snapshot is a guard failure.",
+        "RECAPTURED: native-handler 139 -> 151, documentation-only 129 -> 136, handler backlog 60 -> 48, corpus 379 -> 386, mapping 381 -> 388 rows. Twelve handlers had been closed by GT-595 and GT-632 while the hand-maintained snapshot went on reporting them as backlog -- the defect demonstrating itself.",
+        "HOW IT LANDED, recorded because three sessions converged: the capture script and extracted triage as PR #276, the two chain links as PR #287, and a SECOND independent implementation on develop as PR #279 (an in-spec renderer). Both recaptured the same numbers, which corroborates the measurement; two generators for one artifact is this row's own defect one level up, and reconciling them is open work that blocks develop -> main."
       ],
-      "dependencyDisposition": "none"
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Closed on the implementation that is on main. The parallel implementation on develop (PR #279) is NOT reconciled here: choosing which generator survives is a design decision belonging to the sessions that wrote the two halves, and it is tracked as the blocker on develop -> main rather than resolved inside a board registration."
     },
     {
-      "id": "GT-630",
-      "closedAt": "2026-07-28",
-      "closureCommit": "63a96d09",
+      "id": "MT-A17",
+      "closedAt": "2026-06-20",
+      "closureCommit": "dadcb17",
       "evidence": [
-        ".harness/scripts/ci/46-validate-derived-artifact-order.mjs",
-        ".harness/scripts/ci/46-validate-derived-artifact-order.test.mjs",
-        ".github/workflows/docs.yml",
-        ".harness/scripts/lib/guard-classification.mjs"
+        "src/packages/core-domain/src/application/validators/ruleset-validator-architecture.spec.ts"
       ],
       "validationCommands": [
-        "46-validate-derived-artifact-order --verbose -> 2 links, 3 artifacts, current AND at a fixed point.",
-        "node --test .harness/scripts/ci/46-validate-derived-artifact-order.test.mjs -> 8/8, including a test proving the guard leaves the real tree byte-identical after replaying in place.",
-        "Wired into docs.yml, which backs the required Validate documentation check.",
-        "Registered in guard-classification.mjs: 42 reports 58 guards classified, 43 reports 35 observed failing."
+        "npm run build --workspace @beyondnet/evolith-core-domain"
       ],
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-573",
+      "id": "MT-A18",
+      "closedAt": "2026-06-20",
+      "closureCommit": "6049045",
       "evidence": [
-        "src/rulesets/contracts/evolith-machine-contracts.json",
-        "src/packages/contracts/src/fixtures/evaluation-contract.fixtures.ts"
+        "src/rulesets/topologies/serverless/serverless.rules.json",
+        "src/rulesets/topologies/serverless/serverless.rego",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
       ],
       "validationCommands": [
-        "MACHINE_CONTRACT_SET now pins gate-evidence, output-envelope, evaluation-context and evaluation-result (was the first two only).",
-        "10-validate-contract-conformance exit 0 over 4 schemas.",
-        "The consumer half is another repository and is carved out as GT-631 with its five concrete steps, not absorbed into this closure."
+        "npm --workspace @beyondnet/evolith-core-domain test -- --runInBand",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "b16bd9fd",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-575",
+      "id": "MT-A19",
+      "closedAt": "2026-06-20",
+      "closureCommit": "1ee04e6",
       "evidence": [
-        "src/packages/agent-runtime/src/providers/GeminiProvider.ts",
-        "src/packages/agent-runtime/README.md",
-        "src/packages/agent-runtime/src/__tests__/agentic-ai-self-conformance.spec.ts"
+        "src/rulesets/topologies/event-driven/event-driven.rules.json",
+        "src/rulesets/topologies/event-driven/event-driven.rego",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
       ],
       "validationCommands": [
-        "agentic-ai-self-conformance.spec.ts -> 13/13, evaluating the repository against the nine blocking AAI-* rules it ships.",
-        "NEGATIVE FIXTURE: without agent.config.json all nine evaluate to failed.",
-        "CAVEAT recorded on the row: the spec runs in Test agent-runtime, which is NOT one of main’s seven required contexts (verified against the live branch protection). It reports; it does not govern. Making it required is an owner action."
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "closedAt": "2026-07-28",
-      "closureCommit": "b16bd9fd",
       "dependencyDisposition": "none"
     },
     {
-      "id": "GT-572",
-      "closedAt": "2026-07-29",
-      "closureCommit": "5571f078",
+      "id": "MT-A20",
+      "closedAt": "2026-06-20",
+      "closureCommit": "1ee04e6",
       "evidence": [
-        "src/sdk/cli/examples/mcp-test.js",
-        "src/sdk/cli/examples/gate-verdict.assert.js",
-        "src/sdk/cli/examples/gate-verdict.assert.test.mjs",
-        "src/packages/mcp-server/src/tools/gate.tools.ts",
-        "src/packages/mcp-server/src/mcp/abac-evaluator.ts",
-        "src/packages/mcp-server/src/mcp/abac-evaluator.spec.ts",
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.ts",
-        "src/packages/core-domain/src/application/validators/phase-gate-validator.service.spec.ts",
-        "reference/core/control-center/gaps/gap-reference-catalog.md"
+        "src/rulesets/topologies/agentic-ai/agentic-ai.rules.json",
+        "src/rulesets/topologies/agentic-ai/agentic-ai.rego",
+        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture-rule.handler.ts",
+        "src/packages/core-domain/src/application/validators/evaluators/opa-input-builder.ts"
       ],
       "validationCommands": [
-        "npm pack the mcp-server package and install the tarball OUTSIDE the workspace (no npm-workspaces symlink, which is the GT-625 illusion), then drive it over stdio -> tools/call evolith-gate-evaluate returns a REAL verdict with the default configuration: gateId = business-sign-off, verdict = failed. The row's original '47 of 47 FORBIDDEN' did NOT reproduce.",
-        "Same tarball with NODE_ENV=production -> FORBIDDEN. Cause is packaging, not policy: policy.wasm is a gitignored build artifact written OUTSIDE the mcp-server package, so no `files` setting reaches it and a published consumer inherited a fail-closed rule it could not satisfy. EVOLITH_ABAC_POLICY_PATH makes the posture satisfiable.",
-        "node --test src/sdk/cli/examples/gate-verdict.assert.test.mjs -> the new smoke assertion is proven FALSIFIABLE three ways, including a live run against the pre-fix dist. The old assertion (envelope.success !== undefined) was observed printing 'tools/call OK' while receiving RULESET_NOT_FOUND.",
-        "jest phase-gate-validator.service.spec.ts -> findCorePath no longer resolves <repo>/src after the src/ refactor (a GT-632 sibling); corePath is now declared in the evolith-gate-evaluate inputSchema, which read it while leaving it undeclared.",
-        "node .harness/scripts/ci-runner.mjs governance -> 17 scripts, all passed in this checkout."
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "TWO residuals are recorded rather than hidden. (1) Criterion 1 is ticked against a LOCALLY PACKED tarball, not against the registry: the published 1.1.0 predates every fix here and re-publishing is GT-570. (2) Shipping the compiled policy.wasm bundle INSIDE the package remains a release-pipeline decision: documented and deliberately NOT done in this change. Until it is, a published consumer running NODE_ENV=production must set EVOLITH_ABAC_POLICY_PATH."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-595",
-      "closedAt": "2026-07-29",
-      "closureCommit": "a840a45b",
+      "id": "MT-A21",
+      "closedAt": "2026-06-19",
+      "closureCommit": "2010ce0",
       "evidence": [
-        "src/packages/core-domain/src/application/validators/rule-evaluation-engine.ts",
-        "src/packages/core-domain/src/application/validators/blocking-skipped-invariant.spec.ts",
-        "src/packages/core-domain/src/application/validators/rule-corpus-triage.spec.ts",
-        "src/packages/core-domain/src/application/validators/ruleset-validator.service.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture/config-rules.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture/module-boundary-rules.ts",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/architecture/module-boundary-rules.spec.ts",
-        "src/packages/infra-providers/src/disk-ruleset.repository.ts",
-        "src/packages/infra-providers/src/disk-ruleset.repository.spec.ts",
-        ".harness/scripts/generate-adr-rulesets.mjs",
-        "reference/core/control-center/gaps/gap-reference-catalog.md"
+        "src/packages/core-domain/src/application/services/topology-catalog.service.ts",
+        "src/apps/core-api/src/core-domain.module.ts"
       ],
       "validationCommands": [
-        "jest blocking-skipped-invariant.spec.ts -> AC2 is enforced: RuleEvaluationEngine.toValidationIssues emits a `blocking` ValidationIssue whenever a rule declared `blocking` returns `skipped`, so the combination fails the run. Deliberately NOT a thrown error: RulesetValidatorService.validate catches engine exceptions and downgrades them to logger.warn, so a throw would be silently suppressed by the only product caller. The rule's own outcome stays `skipped` on purpose -- promoting it to `failed` would move it into rulesChecked and re-inflate the coverage GT-569 made honest.",
-        "Enforcing it exposed 181 rules declared `blocking` that never execute. 96 were auto-generated ADR placeholders whose own validationQuery ends 'Concrete checks to be wired into the harness'; generate-adr-rulesets.mjs now emits blocking: false for them. Of the remaining 85, TWELVE were closed for real: 8 config-shaped (ED-R04, ED-R05, ED-R06, DAM-R05, MTN-05, GIT-08, SEC-RL-01, SEC-RL-02) and 4 module-boundary (HXA-01, HXA-02, HXA-04, HXA-05).",
-        "jest rule-corpus-triage.spec.ts -> the pin is 73, RECOMPUTED against the real corpus rather than assumed; perturbing the pin to 74 was observed FAILING, so the number is measured and not decorative.",
-        "jest disk-ruleset.repository.spec.ts -> ROOT CAUSE of the four dead HXA rules: DiskRulesetRepository.normalizeRuleset never copied the `enforce` field. The schema has accepted it since GT-516, ADR-0002 authors six blocks and the PolicyCompiler compiles them -- but normalization dropped it, so rule.enforce was always undefined and the ENTIRE enforcer subsystem was unreachable for lack of DATA, not for lack of wiring.",
-        "SECOND instance of the same pattern: rule-corpus-triage.spec.ts's own loader dropped `enforce` too, under a docstring claiming it loads 'exactly as DiskRulesetRepository does'. The measuring instrument was measuring a different corpus than the one production evaluates. Both loaders now carry the field.",
-        "node .harness/scripts/ci-runner.mjs governance -> 17 scripts, all passed in this checkout."
+        "npm --workspace @beyondnet/evolith-core-domain run build",
+        "npm --workspace src/apps/core-api test -- --runInBand",
+        "npm --workspace src/apps/core-api run build"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "TWO deliberate non-adoptions are recorded as part of the closure, not deferred silently. (1) dependency-cruiser was NOT adopted for the module-boundary rules: the Core is a stateless engine that reads satellites through an overlay filesystem a subprocess cannot see, and the tool's config matches node_modules/, so an UNINSTALLED satellite would yield zero violations and PASS four blocking rules. A false pass is worse than the skip it would replace. (2) OCB-02 was NOT closed: no artifact anywhere carries an `availability` marker, so the rule quantifies over the empty set and can only pass; that is recorded as three executable tests instead of prose. The residual unclaimed-blocking corpus stands at 73 and is pinned."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-633",
-      "closedAt": "2026-07-29",
-      "closureCommit": "05c3f62b",
+      "id": "MT-A24",
+      "closedAt": "2026-06-20",
+      "closureCommit": "af871fc",
       "evidence": [
-        "src/packages/core-domain/src/application/services/project-scaffolder.service.ts",
-        "src/packages/core-domain/src/application/use-cases/initialize-project.use-case.ts",
-        "src/packages/core-domain/src/application/use-cases/initialize-project.use-case.spec.ts",
-        "src/packages/infra-providers/src/rule-applicability.integration.spec.ts",
-        "src/rulesets/adr/adr-0010-multi-tenancy.rules.json",
-        "src/packages/core-domain/src/application/validators/evaluators/handlers/governance-rule.handler.ts",
-        "src/packages/core-domain/src/application/validators/rule-applicability.ts"
+        "src/packages/core/src/index.ts",
+        "src/packages/mcp-server/src/mcp/resources.service.ts",
+        "src/packages/mcp-server/src/tools/topology.tools.ts"
       ],
       "validationCommands": [
-        "rule-applicability.integration.spec.ts -> 10/10. The pinned assertion moved from ['GIT-08','MTN-05'] to [] because the scaffold changed, not because the assertion was relaxed.",
-        "initialize-project.use-case.spec.ts -> 9/9, covering all three legs GIT-08 reads: config content (the seven types GIT-08 names), the merged devDependencies, and a commit-msg hook asserted to carry --no-install and to contain no else branch.",
-        "The deferral of MTN-05 is asserted over phases 0->3: excluded at 0 and 1, binding at 2 and 3. Weakening the annotation turns the test red.",
-        "Verified per-rule rather than by the suite alone: GIT-08 executes and PASSES for the typescript and python scaffolds; MTN-05 appears in notApplicableRuleIds rather than passing silently.",
-        "core-domain 1442/1442, infra-providers 129/129, src/sdk/cli 1436/1436, mcp-server init.tools 7/7.",
-        "32-validate-ruleset-schemas -> 168 passed, 0 failed, exit 0. 28-native-evaluator-parity -> 17 fixtures, 451 verdict assertions, exit 0. 01-validate-docs -> 1491 files, exit 0.",
-        "The premise did NOT reproduce on first contact: the suite resolves @beyondnet/evolith-core-domain through the workspace symlink to dist/, nine days stale and predating the GT-595 handlers, so both rules were skipped and the pinned assertion already read []. A green run in that state would have produced a false CLOSURE. Reproduced only after re-anchoring node_modules at the worktree and rebuilding -- the same untracked-build-state class as GT-625 and GT-632.",
-        "NOT done, deliberately: multi-tenancy.rego still asserts MTN-05 unconditionally. Applicability is a native-engine pre-filter by construction (GT-571) and TAX-06 already carries the same shape, so this is a pre-existing engine divergence rather than one introduced here."
+        "npm run build --workspace @beyondnet/evolith-core",
+        "npm --workspace @beyondnet/evolith-mcp test"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "The prerequisite is satisfied and closed: GT-595 gave MTN-05 and GIT-08 real handlers, which is the only reason either failure was visible. One part is deliberately left out of scope: the parallel multi-tenancy.rego still asserts MTN-05 unconditionally. Applicability is a native-engine pre-filter by construction (GT-571) and TAX-06 already carries the same shape -- a phase annotation alongside a rego that does not read it -- so this is a pre-existing divergence between the two engines, not one introduced here, and closing it belongs to whatever unifies applicability across engines."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-637",
-      "closedAt": "2026-07-29",
-      "closureCommit": "5acb29ed",
+      "id": "MT-A25",
+      "closedAt": "2026-06-20",
+      "closureCommit": "1ee04e6",
       "evidence": [
-        ".harness/scripts/ci/41-validate-evidence-commands.mjs",
-        ".harness/scripts/ci/41-validate-evidence-commands.test.mjs",
-        ".github/workflows/ci-cd.yml",
-        "reference/core/control-center/evidence/gap-closure-evidence.json"
+        "src/apps/core-api/src/presentation/controllers/architecture.controller.ts",
+        "src/apps/core-api/src/presentation/controllers/architecture.controller.spec.ts"
       ],
       "validationCommands": [
-        "node --test .harness/scripts/ci/41-validate-evidence-commands.test.mjs -> 39/39, including 5 new cases: the --workspace-before-script-name fix, its negative twin (an undeclared script under that form is still caught), the gitignored-artifact classification on both the relative-binary and node <script> branches, and its negative twin (a genuinely missing, non-gitignored binary is still dead).",
-        "node .harness/scripts/ci/41-validate-evidence-commands.mjs --strict --max-dead 21 -> exit 0. Same command with --max-dead 20 -> exit 1. The budget is exact, not padded.",
-        "node .harness/scripts/ci/41-validate-evidence-commands.mjs --execute --verbose -> report mode, 21 dead, 6 executed commands fail (GT-42, GT-78, GT-79, GT-280, GT-556, GT-557) -- all pre-existing, confirmed none among the paths touched by this closure.",
-        "node .harness/scripts/ci/08-validate-tracking.mjs -> 633 gaps EN/ES, 610/610 EN/ES catalog sections, 576 closure records.",
-        "42-validate-guard-denominators, 43-validate-guard-negative-fixtures, 44-validate-adr-implementation-status, 34-check-skill-registry-parity, 45-validate-port-inventory-honesty all re-run clean in the same job.",
-        "Each of the 18 confident path renames in gap-closure-evidence.json (docker-compose.yml, review-*.test.mjs x3, roundtrip-gate-evaluate.mjs, api-throughput-baseline.js, incident-response-*.md, slo/, alerts/ x2, chaos-experiments/cpu-stress.yaml, data-store-backup-dr.md, gap-reference-catalog.md/.es.md) plus chat.command.ts verified against a real successor file present on disk before being written -- not guessed.",
-        "309 -> 78 (npmScriptOperand defined) -> 52 (--workspace-before-script-name parsing fixed) -> 22 (18 confident path renames) -> 21 (chat.command.ts) dead references, measured at each step, not assumed."
+        "npm --workspace core-api test",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "The residual 21 dead references are genuinely retired artifacts (a consolidated .bmad-core/AGENTS.md, the retired evolith-bff gateway, the retired packages/mcp-tools, two retired k8s manifests with no path-equivalent successor, a retired sandbox app, three root-level scripts no longer declared) or prose misparsed as a path (vision/, tools/list). None were force-mapped to a plausible-looking target -- a wrong rename would corrupt the record it claims to verify. Repairing each is per-record archaeology into when and why that specific artifact was retired, which this closure deliberately did not attempt; --max-dead stays at 21 until it is."
+      "dependencyDisposition": "none"
     },
     {
-      "id": "GT-636",
-      "closedAt": "2026-07-29",
-      "closureCommit": "d85c6216",
+      "id": "MT-A26",
+      "closedAt": "2026-06-20",
+      "closureCommit": "683c5e1",
       "evidence": [
-        "package.json",
-        "package-lock.json",
-        "reference/core/architecture/adrs/core/0124-credential-secret-management-standard.es.md",
-        "reference/core/architecture/demos/level-3-components/README.es.md",
-        "reference/core/control-center/gaps/gap-tracking.es.md",
-        "reference/core/control-center/maturity-reports/maturity-assessment.es.md",
-        "src/sdk/cli/test/e2e/cli-e2e.test.ts"
+        "reference/core/control-center/taxonomy/MASTER_INDEX.md",
+        "reference/core/control-center/taxonomy/MASTER_INDEX.es.md"
       ],
       "validationCommands": [
-        "npm audit --audit-level=high -> real exit code 0, verified separately from the printed summary (checked with $? after redirecting to a file, since the human-readable summary was once observed stale after a fix that had already applied).",
-        "node .harness/scripts/bilingual-terminology-lint.mjs --verbose -> Bilingual terminology check passed.",
-        "npm run test:e2e --workspace src/sdk/cli (exact CI command) -> 18 suites, 132/132 passed.",
-        "core-domain: npx jest --config jest.config.js --runInBand -> 128/129 suites, 1442/1444 tests (2 pre-existing skips).",
-        "npm run test:unit --workspace src/sdk/cli -> 99/99 suites, 1436/1436 tests.",
-        "mcp-server: npx jest --config jest.config.js --runInBand -> 53/53 suites, 433/437 tests (4 pre-existing skips).",
-        "All of the above run in an isolated scratch worktree (git worktree add --detach) with a REAL, non-symlinked node_modules copied from the main checkout, after rebuilding every workspace dependency (core-domain, agent-runtime, sdk, infra-providers, core, mcp) exactly as the CI job's own \"Build workspace dependencies\" step does -- not against this session's own per-package symlink farm, which was independently confirmed to corrupt npm ls graph output."
+        "node .harness/scripts/ci/01-validate-docs.mjs",
+        "node .harness/scripts/ci/08-validate-tracking.mjs"
       ],
-      "dependencyDisposition": "accepted-scope",
-      "dependencyRationale": "2 moderate npm audit findings remain, both the same root cause: a Windows-only path-traversal in @hono/node-server's serve-static (GHSA-frvp-7c67-39w9), irrelevant to this repo's Linux CI/deployment. The available fix bumps @modelcontextprotocol/sdk, a PRODUCTION dependency pinned exactly (no range) in two workspaces' package.json -- qualitatively different from the devDependency-only overrides this closure applied, and out of scope for a security-audit fix that should not also silently change a shipped runtime dependency's resolved version."
+      "dependencyDisposition": "none"
     }
   ]
 }
diff --git a/reference/core/control-center/gaps/gap-reference-catalog.es.md b/reference/core/control-center/gaps/gap-reference-catalog.es.md
index cb9021534..74e599a91 100644
--- a/reference/core/control-center/gaps/gap-reference-catalog.es.md
+++ b/reference/core/control-center/gaps/gap-reference-catalog.es.md
@@ -7855,6 +7855,71 @@ Serie histórica de gaps registrada en el antiguo `gap-analysis-core.es.md`, pre
   - [x] El tipo `security` está declarado en la config de commitlint con un mapeo explícito de salto de versión, o se deja de usar.
   - [x] Ningún hook de `.husky/` imprime un mensaje de "skipping" y sale con cero — un hook que no puede correr se borra, no se silencia.
 
+#### GT-639
+
+**Title:** Nada hace visible el trabajo en vuelo entre ramas, así que el mismo gap se arregla dos veces
+
+- **Purpose:** Que un gap que ya se está trabajando sea descubrible ANTES de que una segunda sesión lo empiece, y no en el merge.
+- **Evidence:** **El 2026-07-30 el mismo trabajo se hizo dos veces, en tres ocasiones distintas, por sesiones que no podían verse.** (1) [`GT-640`](./gap-reference-catalog.es.md#gt-640) — registrado como GT-633 hasta la renumeración de abajo — se arregló dos veces: un script de captura aterrizó en `main` como #276 y un renderer independiente dentro del spec aterrizó en `develop` como #279. Los dos eran correctos, los dos recapturaron los mismos números — y dos generadores para un artefacto es el defecto del propio GT-633 un nivel más arriba, así que una TERCERA sesión gastó una reconciliación entera (#294, #295, #296, #297) en dejar un solo renderer. (2) El parser del guard de evidencias se arregló dos veces: `d1ea72a3` en `main` ("stop the evidence guard blaming the evidence for two parser defects") y `5acb29ed` en `develop` ("the ratchet was stuck by two bugs in itself"). (3) Un id de GT se asignó dos veces, forzando la renumeración que registra [`GT-638`](./gap-reference-catalog.es.md#gt-638). **El coste no es el conflicto de merge.** Es el trabajo duplicado que ocurrió antes de que nadie llegara al conflicto, más la reconciliación que hizo falta después — y esa reconciliación introdujo un defecto propio (una comparación sensible al orden que reescribía la fecha de captura en cada corrida, invisible durante un día porque ambas estampaban la misma fecha). Tres duplicaciones, una sesión de reparación y un bug nuevo: ésa es la factura real. **Por qué el tablero no lo ve hoy:** una fila lleva estado (`PENDIENTE`, `EN-PROGRESO`) pero no QUIÉN la trabaja ni DÓNDE. Dos sesiones pueden leer ambas `GT-640 · PENDIENTE` (registrado como GT-633 entonces) y empezar ambas, correctamente. `08-validate-tracking` valida dentro de un único árbol de trabajo por construcción, así que no puede saber que existe otra rama. **Esto no es una convención que falte — la convención existe.** La regla de un solo driver para las olas de gaps es práctica establecida; lo que falta es cualquier mecanismo que la haga observable, así que en un día cargado se degrada en silencio y nadie se entera hasta el merge. Direcciones de arreglo: exigir una reclamación (rama o PR) en la fila que pasa a `EN-PROGRESO`, y derivar el conjunto de reclamaciones de los PR abiertos para que no pueda quedarse rancio; después, fallar en PR cuando un id `GT-*` esté reclamado por más de una rama abierta, nombrando a las dos. **CERRADO el 2026-07-30 — y en su primera corrida real encontró una SEGUNDA colisión que nadie conocía.** `49-validate-gap-id-allocation` compara el **Title:** de cada id en HEAD contra el título que ese mismo id lleva en la rama base: ausente en base es id nuevo, presente con el mismo título es el mismo gap editado, presente con título DISTINTO es un número nombrando dos gaps. El título es el discriminador a propósito — "el id ya existe en base" es el caso normal de 500 y pico filas y no dice nada. Corrido contra `origin/develop` reporta **`GT-633`**: en develop es "`evolith init` scaffolds a repository that cannot pass its own governance on the first run" (`c8270e48`, 2026-07-29) y en main es la fila del guard tautológico (`c3221276`, 2026-07-30). Dos gaps, un número, y el merge todavía no lo había sacado a la luz. **RESUELTO el 2026-07-30 renumerando la fila más nueva —la de main— a [`GT-640`](./gap-reference-catalog.es.md#gt-640)**, según el propio consejo del guard. Hacerlo a mano es el coste que esta fila existe para describir: hubo que cambiar el id en la fila del tablero, el ancla del catálogo, el registro de evidencia de cierre, las referencias cruzadas de otras dos filas en los dos idiomas y tres comentarios de código — y los mensajes de commit y cuerpos de PR que nombran GT-633 no se pueden cambiar. **El guard se niega a adivinar qué lado está mal** — un retítulo y una colisión se ven igual desde fuera —, así que nombra los dos y lo dice. Cableado en `Governance guards (GT-578)` con un `git fetch` explícito de la base, porque un checkout superficial de CI no la tiene y un guard que fallara por ESO enseñaría a ignorarlo. Observado en rojo por `43-validate-guard-negative-fixtures` (38/38). **Lo que sigue sin ver, dicho y no insinuado:** un número asignado en una rama de la que nadie ha abierto PR. La salida `--verbose` lo advierte en cada id recién asignado en vez de dejar que el lector suponga una cobertura que no tiene.
+- **Component:** `Governance` · **Criticality:** P2 · **Complexity:** M
+- **Provenance:** Registrado el 2026-07-30 a partir de tres instancias observadas en un solo día, todas en el merge `develop` → `main` que las hizo visibles. Relacionado pero distinto de [`GT-638`](./gap-reference-catalog.es.md#gt-638): aquella fila trata de asignar un NOMBRE dos veces, ésta de hacer el TRABAJO dos veces. La misma carencia de coordinación produce ambas, y la colisión de id es su síntoma más barato.
+- **Acceptance criteria:**
+  - [ ] Un gap que se está trabajando es descubrible desde el tablero junto con la rama o el PR que lo reclama, antes de que el trabajo aterrice.
+  - [ ] Una comprobación falla en pull request cuando un id `GT-*` está reclamado por más de una rama abierta, nombrando a ambos reclamantes.
+  - [ ] La reclamación se DERIVA de los pull requests abiertos y no se escribe a mano, para que no pueda quedarse rancia en la dirección que importa.
+  - [ ] Incluye una fixture negativa OBSERVADA en rojo, no sólo declarada capaz de fallar.
+
+#### GT-638
+
+**Title:** El tablero no tiene asignador de ids, así que dos ramas paralelas reparten el mismo número GT
+
+- **Purpose:** Que un id de gap sea único por construcción y no por que quien registró el último leyera la rama correcta.
+- **Evidence:** **Un id de gap se elige leyendo el `GT-*` más alto de la rama en la que uno está, y nada lo contrasta con ninguna otra rama.** Así que dos sesiones en paralelo asignan el mismo número, y una se entera en el merge. Ya ha pasado: `8449af3d` en `develop` lleva el mensaje *"chore(board): renumber the ratchet fix GT-634 -> GT-637, ID collision with develop"* — esa fila y [`GT-634`](./gap-reference-catalog.es.md#gt-634) en `main` recibieron el mismo id con horas de diferencia, por sesiones que no podían verse. **La renumeración es manual y con pérdidas**, que es lo que cuesta más que el choque: un id aparece en la fila del tablero, en el ancla del catálogo, en el registro de evidencia de cierre, en referencias cruzadas desde otras filas en los dos idiomas, en mensajes de commit y en cuerpos de PR — y sólo los tres primeros son comprobables mecánicamente. `08-validate-tracking` no puede ayudar, y no por falta de ganas: valida paridad EN/ES, registros de cierre y contadores **dentro de un único árbol de trabajo**, y las ramas quedan fuera de su mundo por construcción. **Por qué merece fila y no una convención:** el tablero es la única fuente de verdad de 635 gaps, y un id que significa dos cosas distintas en dos ramas vuelve ambigua toda referencia a él — incluidas las de `gap-closure-evidence.json`, que son datos validados por máquina. Tampoco es un desliz aislado: en el merge `develop` → `main` del 2026-07-30 el mismo patrón de duplicación convergente aparece **tres veces**: GT-640 (entonces GT-633) se arregló dos veces por dos sesiones, el parser del guard de evidencias se arregló dos veces, y este id se asignó dos veces. Arreglo: asignar ids desde algo que no se pueda leer rancio — una marca de agua reservada y commiteada en la rama por defecto, o una comprobación en PR que falle cuando una rama introduce un id que ya existe en su base o en otro PR abierto, nombrando a ambos usuarios.
+- **Component:** `Governance` · **Criticality:** P2 · **Complexity:** S
+- **Provenance:** Registrado el 2026-07-30 tras la colisión que describe, que obligó a renumerar en `develop`. El id de ESTA fila se asignó tomando la unión de ids entre `main` y `develop` en vez del máximo de una — que es justo el apaño que el arreglo debería volver innecesario.
+- **Acceptance criteria:**
+  - [x] Registrar una fila en una rama no puede reutilizar en silencio un id que ya existe en la rama base — `49-validate-gap-id-allocation` compara los títulos por id contra la base y falla si difieren.
+  - [x] La comprobación corre en los pull requests y nombra el id en conflicto junto con los dos sitios donde se usa, para que resolverlo no sea una búsqueda — cableada en `Governance guards (GT-578)`, con la base traída explícitamente porque un checkout superficial no la tiene.
+  - [x] Incluye fixtures negativas OBSERVADAS en rojo — 13, entre ellas la colisión de GT-634 reproducida sobre historia real de git y tres suelos anti-vacuos, y `43-validate-guard-negative-fixtures` la cuenta en 38/38.
+
+#### GT-635
+
+**Title:** El ratchet de referencias muertas está por encima del presupuesto en main desde el 2026-07-28, así que el job de gobernanza está en rojo permanente
+
+- **Purpose:** Que un ratchet incumplido o se respete o se vuelva a medir — un gate que nadie puede satisfacer enseña a la gente a ignorarlo.
+- **Evidence:** **`Governance guards (GT-578)` falla en `main` mismo, y lleva al menos tres corridas consecutivas así.** `41-validate-evidence-commands --strict --max-dead 305` reporta **309 referencias muertas en un checkout limpio**, así que el job sale 1 en cada corrida de `ci-cd.yml`. Observado en las corridas `30482497995` (2026-07-29 19:00Z), `30470648146` (16:25Z) y `30466280865` (15:31Z) — todas en `main`, ninguna con cambios sin mergear. El presupuesto se fijó en 305 en `4a1b92d6` (2026-07-28) con el mensaje "put the ratchet back where it was measured"; **desde entonces diez commits han editado `gap-closure-evidence.json`**, cada uno añadiendo `validationCommands`, y la cuenta se fue por encima del número que se midió. Las cuatro referencias muertas de más no son atribuibles a ninguno en concreto solo por la cuenta. **Por qué es más que contabilidad:** el propósito entero del ratchet es que las referencias muertas no CREZCAN, y ahora mismo está reportando exactamente eso mientras se lo ignora, porque un job en rojo permanente se lee como ruido de fondo — el mismo modo de fallo que [`GT-622`](./gap-reference-catalog.es.md#gt-622) registra para la configuración huérfana de CodeQL. Además implica que el próximo cambio que añada de verdad una referencia muerta será indistinguible de las cuatro que ya están. **Lo que NO hay que hacer:** subir el presupuesto a 309 y seguir. Eso convierte un ratchet incumplido en un ratchet ratificado, que es exactamente cómo se llegó a un corpus de 309 referencias muertas. Las dos opciones honestas son arreglar las cuatro (reapuntar los comandos a referentes que existen) o volver a medir y declarar, en el commit, qué se aceptó y por qué. **CERRADO el 2026-07-30, y no subiendo el presupuesto — que es justo lo que la fila pedía no hacer.** `f34a10f1` migró los comandos de cierre registrados a las rutas que este repositorio tiene de verdad, y `600dd7a9` movió después el presupuesto **304 → 40** desde la cuenta que produjo esa migración. El corpus pasó de 309 referencias muertas a 40 sobre 1045 comandos registrados: 269 se REPARARON, no se eximieron, lo que subsume las cuatro por las que se abrió la fila. `Governance guards (GT-578)` pasó en el runner en el PR #288. Registrada por una sesión y cerrada por otra en menos de una hora — vale la pena decirlo, porque el valor de la fila era hacer visible el incumplimiento, no quedarse el arreglo.
+- **Component:** `Governance` · **Criticality:** P2 · **Complexity:** S
+- **Provenance:** Encontrado el 2026-07-29 diagnosticando cuatro checks en rojo del PR #277. Tres de los cuatro eran preexistentes en `main`; este es el que traía el número idéntico (309 vs 305) en ambos lados, y eso es lo que probó que el PR no lo había causado.
+- **Acceptance criteria:**
+  - [x] `Governance guards (GT-578)` pasa en `main` sin haber subido el presupuesto para dar cabida a referencias que ya estaban muertas — se BAJÓ, 304 → 40, tras reparar el corpus.
+  - [x] Cada una de las cuatro referencias añadidas desde `4a1b92d6` queda reparada o nombrada en el commit que la acepta, con el motivo — subsumido: 269 de las 309 se repararon de golpe con la migración de rutas.
+  - [x] El guard reporta la base del ratchet sobre un checkout limpio, para que el presupuesto no vuelva a calibrarse contra una máquina que resulta tener algo construido.
+
+#### GT-634
+
+**Title:** El CLI y el MCP publicados resuelven una build del SDK anterior a la ola de seguridad, porque un rango caret bajo 1.x la fija
+
+- **Purpose:** Que `npm install @beyondnet/evolith-cli@latest` deje de arrastrar una dependencia publicada antes de los fixes que anuncia su propio CHANGELOG.
+- **Evidence:** **`@beyondnet/evolith-cli@1.2.1` y `@beyondnet/evolith-mcp@1.2.1` declaran ambos `@beyondnet/evolith-sdk: ^1.1.0`, y eso resuelve EXACTAMENTE `1.1.0`.** El SDK publica `1.0.0`, `1.1.0` y `2.0.0` y nada en medio, así que un rango caret bajo 1.x no puede alcanzar 2.0.0 — un caret está acotado por el siguiente mayor. Las fechas son el hallazgo: `sdk@1.1.0` se publicó el **2026-07-18**, `sdk@2.0.0` el **2026-07-27** como parte de la release que cerró [`GT-570`](./gap-reference-catalog.es.md#gt-570), y `cli@1.2.1` / `mcp@1.2.1` el **2026-07-28** — *después* de que 2.0.0 existiera, y seguían apuntando a la línea 1.x. Así que la exposición que GT-570 declaró cerrada para "quien instale `latest`" no está cerrada para esta dependencia: el `latest` de ambas superficies instala un SDK construido antes de la ola del 2026-07-23. **Dicho con precisión, porque la afirmación fuerte no está verificada aquí:** lo medido son las fechas y la resolución, no el contenido — esta fila no afirma que `sdk@1.1.0` cargue una vulnerabilidad concreta, solo que es anterior a la ola y que la release que la trajo fue un mayor al que los consumidores no llegan. Verificar qué fixes hay en `sdk@2.0.0` es parte de cerrarla. **Encontrado porque bloqueaba otra cosa:** deprecar `sdk@1.1.0` para [`GT-624`](./gap-reference-catalog.es.md#gt-624) habría impreso un aviso en cada instalación limpia de la línea actual sin ningún sucesor 1.x que ofrecer, y eso es lo que dejó el rango a la vista. Arreglo: reapuntar ambos rangos a `^2.0.0` (un salto mayor de dependencia, así que exige revisar los breaking changes del SDK contra ambos call sites) o publicar un `sdk@1.2.x` con los fixes, y entonces deprecar `sdk@1.1.0` y cerrar de verdad el primer criterio de GT-624. **RANGOS REAPUNTADOS el 2026-07-29, y hacerlo demostró que la fila se quedaba corta.** `package-lock.json` no sólo registraba el rango — fijaba el tarball del registry de `sdk@1.1.0` en `src/sdk/cli/node_modules/@beyondnet/evolith-sdk` **y** en `src/packages/mcp-server/node_modules/@beyondnet/evolith-sdk`, con hashes de integridad. Así que un `npm ci` en checkout limpio descargaba el SDK anterior a la ola y lo anidaba dentro de cada consumidor, donde **tapa el enlace del workspace**: el symlink de primer nivel al 2.0.0 local es lo que lee todo el mundo, y el 1.1.0 anidado es lo que resuelve de verdad una instalación fresca. Es la misma clase que [`GT-625`](./gap-reference-catalog.es.md#gt-625) — el workspace tapando lo que hace una instalación real — y es la razón de que nada lo cazara. Ambas entradas anidadas desaparecieron al mover el rango a `^2.0.0`, porque entonces el propio 2.0.0 del workspace lo satisface; el diff del lockfile son exactamente dos cadenas de rango y esas dos eliminaciones, sin deriva colateral, y se usó `npm install --package-lock-only` para confirmar que escribe byte a byte lo mismo que la edición a mano en vez de fiarse de ella. La superficie del SDK que ambos consumidores usan de verdad es estrecha — sólo `EvolithRestClient` — así que el breaking change de 2.0.0 (tipos de payload re-exportados de `core-domain`, `.passed` → `.verdict`, severidad `'info'` retirada) no toca ninguno de los dos call sites. Verificado contra 2.0.0: CLI **1436/1436** en 99 suites, mcp-server **433/433** en 53. **1.2.2 está en `main` (PR #285) y NO publicada.** La fila sigue ABIERTA y ése es justo el punto: un rango en el repositorio no es un rango en el registry, y el criterio 1 sólo se cumple cuando npm lo sirve. Hasta entonces el `latest` publicado de ambas superficies sigue instalando el SDK del 2026-07-18. **CERRADO el 2026-07-30, y el marco de seguridad de esta fila era ERRÓNEO — se registra en vez de retirarlo en silencio.** 1.2.2 está publicada con provenance y una instalación limpia de `@beyondnet/evolith-cli@latest` resuelve ya `@beyondnet/evolith-sdk@2.0.0`, con el binario arrancando. Pero el criterio 2 obligó a hacer la pregunta que esta fila había dejado abierta a propósito, y la respuesta refuta su premisa: **ninguno de los siete commits de la ola de seguridad (`1b077ab6`, `3a39dd03`, `60bfc63a`, `3f31fa64`, `90eacdbc`, `4f29e114`, `8ad4e2de`) toca `src/packages/sdk-client` — cero ficheros.** El propio commit de release de la ola, `21205d24`, nombra los tres paquetes afectados: `evolith-mcp` (15 ficheros), `evolith-cli` (7) y `evolith-agent-runtime` (1). El SDK se republicó con ellos, no se arregló. Así que `sdk@1.1.0` es cronológicamente anterior a la ola y no carga nada de ella; no había exposición por esta dependencia. **Lo que sí era real, y es lo que la fila debió decir:** un rango caret bajo 1.x no cruza un mayor, así que ambos consumidores quedaban fijados un MAYOR por detrás en una dependencia de contrato — `.passed` contra un payload que emite `verdict` — y el lockfile anidaba el tarball del registry dentro de cada consumidor, tapando el enlace del workspace. Un defecto de contrato rancio y de sombra en el lockfile (la clase de [`GT-625`](./gap-reference-catalog.es.md#gt-625)), no de seguridad. La cautela que se escribió en la fila al abrirla — que medía fechas y resolución, no contenidos — es lo que abarató la corrección.
+- **Component:** `Infra` · **Criticality:** P1 · **Complexity:** S
+- **Provenance:** Encontrado el 2026-07-29 ejecutando el criterio de deprecación de GT-624. Registrado en vez de sorteado: saltarse la deprecación en silencio habría dejado el rango — y la instalación — exactamente como están.
+- **Acceptance criteria:**
+  - [x] `npm view @beyondnet/evolith-cli@latest dependencies` muestra un rango de SDK que resuelve a una versión publicada el 2026-07-27 o después, e igual `evolith-mcp` — ambos publican `^2.0.0` en 1.2.2, y una instalación limpia resuelve `sdk@2.0.0` con el binario arrancando.
+  - [x] Los fixes que reclama la ola de seguridad del 2026-07-23 se verifican presentes en la versión del SDK que el CLI y el MCP resuelven de verdad, en vez de asumirse por el número de versión — y la verificación REFUTÓ la premisa: ninguno de los siete commits de la ola toca `src/packages/sdk-client`, así que no hay fixes de la ola en el SDK que puedan estar o faltar.
+  - [x] `@beyondnet/evolith-sdk@1.1.0` queda deprecada en cuanto exista un sucesor al que sus consumidores puedan llegar — hecho el 2026-07-30, con un mensaje que da el motivo real (superseded por 2.0.0, `.passed` → `verdict`) y dice explícitamente que no es un aviso de seguridad.
+
+#### GT-640
+
+**Title:** Un guard cuyo valor esperado era una copia de su valor real, sobre una entrada que se blanquea en un artefacto cinco veces mayor
+
+- **Purpose:** Eliminar dos clases de fallo que trascienden este archivo — un guard que lee su expectativa del artefacto que vigila, y un generador que estampa un campo mantenido a mano sobre todo lo que va detrás de él.
+- **Evidence:** **El guard comparaba el snapshot contra seis números copiados del propio snapshot, así que solo podía pasar — y el archivo que no estaba vigilando se estampa en 388 filas de un artefacto mayor.** `native-evaluability-snapshot.json` declaraba en su propia cabecera que era "un SNAPSHOT CAPTURADO, no la fuente de verdad". **No existía ningún script de captura.** Se mantenía a mano y derivó: fijaba `documentation-only: 129` mientras Core fijaba 136, y seguía llamando `unimplemented-native` a reglas que ya tenían handler. Su guard en `iso-5055-mapping.test.mjs` asertaba los seis conteos de clase del snapshot contra seis números escritos a mano en el test — los mismos seis literales que el snapshot ya contenía. **El valor esperado y el valor real eran copias el uno del otro**, así que la aserción se sostenía mientras el archivo no cambiara, fijara Core lo que fijara; informaba de una concordancia que nunca comprobó, lo cual es peor que no tener guard, porque la fila que protege se lee como verificada. **La deriva no se queda donde empieza.** `build-iso-5055-mapping.mjs` estampa `nativeEvaluability` en TODAS las filas del mapeo ISO/IEC 5055 desde ese archivo — 388 tras la recaptura, 381 antes — así que una sola clase rancia se blanquea en un artefacto derivado cinco veces mayor que su entrada, y sobredimensiona el backlog de handlers que es el entregable entero de [`GT-598`](./gap-reference-catalog.es.md#gt-598) en tantas reglas como Core haya cerrado desde entonces. El orden que marca la diferencia (recapturar y DESPUÉS reconstruir) no estaba escrito en ningún sitio, y el guard del propio mapeo no corría en **ningún workflow**. **Corregido el 2026-07-29** (rama `claude/fervent-cohen-08ea01`): `capture-native-evaluability-snapshot.mjs` ejecuta el triage REAL de Core vía `ts-node` en vez de reimplementar la clasificación — una segunda implementación aquí sería una segunda fuente de verdad, que es justo el defecto que se está quitando — y para que el triage fuera alcanzable fuera de jest se movió del spec a `src/packages/core-domain/test/rule-corpus-triage.ts`; esa inalcanzabilidad es precisamente la razón de que el snapshot se mantuviera a mano. Tres comprobaciones sustituyen a la tautología, cada una en el job que puede permitírsela: `rule-corpus-triage.spec.ts` asserta el snapshot commiteado contra un triage RECIÉN CALCULADO, en ambas direcciones; el guard del job de documentación, que no tiene `node_modules`, lee los conteos que Core fija LEYENDO el spec que los fija y **lanza excepción** cuando el literal falta o cambia de forma, de modo que no encontrar la fuente de verdad jamás pueda leerse como acuerdo con ella; y `--check` es la re-derivación de extremo a extremo. **Recapturado el 2026-07-29 tras mergear el fix en la línea actual, y la deriva había crecido mientras estaba en vuelo:** `native-handler` 139 → 151, `documentation-only` 129 → 136, el backlog de handlers 60 → **48**, corpus 379 → 386, mapeo 381 → 388 filas. Doce de esos handlers los cerraron [`GT-595`](./gap-reference-catalog.es.md#gt-595) y [`GT-632`](./gap-reference-catalog.es.md#gt-632) mientras el snapshot mantenido a mano seguía reportándolos como backlog — el defecto demostrándose una vez más. El merge además arrastraba una segunda instancia del patrón que registró GT-595: el `test/rule-corpus-triage.ts` extraído había perdido el campo `enforce`, así que el instrumento de medida habría vuelto a medir un corpus distinto del que evalúa producción; queda restaurado. Ambos pasos son ya eslabones de la cadena de artefactos derivados de [`GT-630`](./gap-reference-catalog.es.md#gt-630), que exige el orden recaptura→reconstrucción como datos y no como prosa. **Cómo aterrizó de verdad, registrado porque convergieron tres sesiones:** el script de captura y el triage extraído llegaron a `main` como PR #276, los dos links del chain como PR #287, y una SEGUNDA implementación independiente del mismo fix llegó a `develop` como PR #279 — un renderer dentro del spec accionado por `UPDATE_EVALUABILITY_SNAPSHOT=1` en vez de un script aparte. Ambas recapturaron los mismos números, lo cual corrobora la medición; pero dos generadores para un artefacto es el defecto de esta misma fila reproducido un nivel más arriba, y reconciliarlos es trabajo abierto que bloquea `develop` → `main`.
+- **Component:** `Governance` · **Criticality:** P1 · **Complexity:** S
+- **Provenance:** Defecto derivado de [`GT-598`](./gap-reference-catalog.es.md#gt-598), encontrado el 2026-07-29 al extender su mapeo: el snapshot sobre el que GT-598 se construyó no lo capturaba nada, y el guard que lo cubría era tautológico. Se registra aparte porque el hallazgo es una clase de diseño de guards, no una corrección al mapeo de GT-598.
+- **Acceptance criteria:**
+  - [x] El snapshot lo produce un script que ejecuta el triage propio de Core en lugar de mantenerse a mano, y `capture-native-evaluability-snapshot.mjs --check` lo re-deriva de extremo a extremo.
+  - [x] Ningún guard sobre el snapshot toma su valor esperado del snapshot: uno recalcula el triage y el otro lee los conteos de Core del spec que los fija, fallando ruidosamente cuando no los encuentra.
+  - [x] El orden recaptura→reconstrucción se exige como datos — ambos eslabones están declarados en la cadena de `46-validate-derived-artifact-order` — y el guard del mapeo corre en un workflow, cuando no corría en ninguno.
 #### GT-636
 
 **Title:** Tres checks de CI en el PR #275 estaban en rojo — los tres eran defectos reales y arreglables, no deuda aceptada
@@ -8020,6 +8085,6 @@ Serie histórica de gaps registrada en el antiguo `gap-analysis-core.es.md`, pre
 - **Componente:** `Infra` · **Criticidad:** P1 · **Complejidad:** S
 - **Procedencia:** Extraído de GT-570 el 2026-07-27, al cerrarlo. Dos de sus tres criterios originales no se cumplían con la publicación de 1.2.0; se registran aquí en vez de darse por buenos.
 - **Criterios de aceptación:**
-  - [ ] `npm view @beyondnet/evolith-mcp@1.1.0` reporta la versión como deprecada, e igual cli y agent-runtime.
-  - [ ] Un gate de CI falla cuando un commit cuyo tipo o scope lo marca como de seguridad no está en el último tag publicado.
-  - [ ] El gate lleva una fixture negativa que lo pone rojo, para que no sea otro guard que nadie ha visto fallar.
+  - [x] `npm view @beyondnet/evolith-mcp@1.1.0` reporta la versión como deprecada, e igual cli y agent-runtime — y también core-domain, core e infra-providers. `evolith-sdk@1.1.0` y `evolith-contracts@1.1.0` NO se deprecan a propósito, por los motivos registrados arriba en vez de omitidos.
+  - [x] Un gate de CI falla cuando un commit cuyo tipo o scope lo marca como de seguridad no está en la última versión publicada. `48-validate-security-publish-lag`, cableado en `Governance guards (GT-578)`. Pregunta al registry y no a los tags de git, porque el tag `v*` más nuevo es `v1.1.0` mientras npm sirve `1.2.2`.
+  - [x] El gate lleva fixtures negativas que lo ponen rojo — 12, entre ellas los suelos anti-vacuos y una regresión por cada uno de los dos falsos negativos encontrados al construirlo — y `43-validate-guard-negative-fixtures` lo ha OBSERVADO rechazando la fixture vacía (37/37).
diff --git a/reference/core/control-center/gaps/gap-reference-catalog.md b/reference/core/control-center/gaps/gap-reference-catalog.md
index 9794889c7..c7bd95f09 100644
--- a/reference/core/control-center/gaps/gap-reference-catalog.md
+++ b/reference/core/control-center/gaps/gap-reference-catalog.md
@@ -7950,6 +7950,71 @@ Historical gap series tracked in the former `gap-analysis-core.md`, preserved fo
   - [x] The `security` type is either declared in the commitlint config with an explicit version-bump mapping, or removed from use.
   - [x] No hook in `.husky/` prints a "skipping" message and exits zero — a hook that cannot run is deleted, not silenced.
 
+#### GT-639
+
+**Title:** Nothing makes in-flight work visible across branches, so the same gap gets fixed twice
+
+- **Purpose:** Make a gap that is already being worked discoverable BEFORE a second session starts it, rather than at merge time.
+- **Evidence:** **On 2026-07-30 the same work was done twice, three separate times, by sessions that could not see each other.** (1) [`GT-640`](./gap-reference-catalog.md#gt-640) — registered as GT-633 until the renumber below — was fixed twice: a standalone capture script landed on `main` as #276, and an independent in-spec renderer landed on `develop` as #279. Both were correct, both recaptured the same numbers — and two generators for one artifact is GT-633's own defect one level up, so a THIRD session spent a full reconciliation (#294, #295, #296, #297) collapsing them to one renderer. (2) The evidence guard's parser was fixed twice: `d1ea72a3` on `main` ("stop the evidence guard blaming the evidence for two parser defects") and `5acb29ed` on `develop` ("the ratchet was stuck by two bugs in itself"). (3) A GT id was allocated twice, forcing the renumber recorded in [`GT-638`](./gap-reference-catalog.md#gt-638). **The cost is not the merge conflict.** It is the duplicated work that happened before anyone reached the conflict, plus the reconciliation it then required — and that reconciliation introduced a defect of its own (an order-sensitive comparison that rewrote the capture date on every run, invisible for a day because both runs stamped the same date). Three duplications, one repair session, one new bug: that is the real bill. **Why the board cannot see it today:** a row carries a status (`PENDING`, `IN-PROGRESS`) but not WHO is working it or WHERE. Two sessions can both read `GT-640 · PENDING` (registered as GT-633 at the time) and both start, correctly. `08-validate-tracking` validates within one working tree by construction, so it cannot know another branch exists. **This is not a missing convention — the convention exists.** The single-driver rule for gap waves is already established practice; what is missing is any mechanism that makes it observable, so on a busy day it degrades silently and nobody learns until the merge. Fix directions: require a claim (branch or PR) on a row that moves to `IN-PROGRESS`, and derive the claim set from open PRs so it cannot go stale; then fail at PR time when one GT id is claimed by more than one open branch, naming both.
+- **Component:** `Governance` · **Criticality:** P2 · **Complexity:** M
+- **Provenance:** Registered 2026-07-30 from three observed instances in a single day, all of them in the `develop` → `main` merge that made them visible. Related but distinct from [`GT-638`](./gap-reference-catalog.md#gt-638): that row is about allocating a NAME twice, this one about doing the WORK twice. The same coordination gap produces both, and the id collision is the cheapest symptom of it.
+- **Acceptance criteria:**
+  - [ ] A gap being worked is discoverable from the board together with the branch or PR that claims it, before the work lands.
+  - [ ] A check fails at pull-request time when one `GT-*` id is claimed by more than one open branch, naming both claimants.
+  - [ ] The claim is DERIVED from open pull requests rather than hand-written, so it cannot be stale in the direction that matters.
+  - [ ] It ships with a negative fixture that has been OBSERVED red, not merely declared able to fail.
+
+#### GT-638
+
+**Title:** The board has no id allocator, so two parallel branches hand out the same GT number
+
+- **Purpose:** Make a gap id unique by construction rather than by whoever registered it last reading the right branch.
+- **Evidence:** **A gap id is chosen by reading the highest `GT-*` on the branch you happen to be on, and nothing checks that against any other branch.** So two sessions working in parallel allocate the same number, and one of them finds out at merge time. It has already happened: `8449af3d` on `develop` carries the message *"chore(board): renumber the ratchet fix GT-634 -> GT-637, ID collision with develop"* — that row and [`GT-634`](./gap-reference-catalog.md#gt-634) on `main` were allocated the same id within hours of each other, by sessions that could not see each other. **The renumber is manual and lossy**, which is the part that costs more than the clash: an id appears in the board row, the catalog anchor, the closure-evidence record, cross-references from other rows in both languages, commit messages and PR bodies — and only the first three are mechanically checkable. `08-validate-tracking` cannot help, and not for want of trying: it validates EN/ES parity, closure records and counters **within one working tree**, and branches are outside its world by construction. **Why it is worth a row rather than a convention:** the board is the single source of truth for 635 gaps, and an id that means two different things in two branches makes every reference to it ambiguous — including the ones in `gap-closure-evidence.json`, which is machine-validated data. This is also not an isolated slip. In the `develop` → `main` merge of 2026-07-30 the same convergent-duplication pattern appears **three times**: GT-640 (then GT-633) was fixed twice by two sessions, the evidence guard's parser was fixed twice, and this id was allocated twice. Fix: allocate ids from something that cannot be read stale — a reserved high-water mark committed on the default branch, or a PR-time check that fails when a branch introduces an id already present on its base or in another open PR, naming both users of it. **CLOSED 2026-07-30 — and on its first real run it found a SECOND collision nobody knew about.** `49-validate-gap-id-allocation` compares every id's **Title:** on HEAD against the title the same id carries on the base branch: absent on base means newly allocated, present with the same title means the same gap edited, present with a DIFFERENT title means one number naming two gaps. The title is the discriminator on purpose — "the id exists on base" is the normal case for 500-odd rows and says nothing. Run against `origin/develop` it reports **`GT-633`**: on develop it is "`evolith init` scaffolds a repository that cannot pass its own governance on the first run" (`c8270e48`, 2026-07-29), on main it is the tautological-guard row (`c3221276`, 2026-07-30). Two gaps, one number, and the merge had not surfaced it yet. **RESOLVED 2026-07-30 by renumbering the newer row — main's — to [`GT-640`](./gap-reference-catalog.md#gt-640)**, per this guard's own advice. Doing it by hand is the cost this row exists to describe: the id had to be changed in the board row, the catalog anchor, the closure-evidence record, cross-references from two other rows in both languages and three source comments — and the commit messages and PR bodies that name GT-633 cannot be changed at all. **The guard refuses to guess which side is wrong** — a retitle and a collision look identical from the outside — so it names both and says so. Wired into `Governance guards (GT-578)` with an explicit `git fetch` of the base, because a shallow CI checkout does not have it and a guard that failed for THAT reason would teach people to ignore it. Observed red by `43-validate-guard-negative-fixtures` (38/38). **What it still cannot see, stated rather than implied:** a number allocated on a branch nobody has opened a PR from. The `--verbose` output says so on every newly allocated id instead of leaving the reader to assume coverage it does not have.
+- **Component:** `Governance` · **Criticality:** P2 · **Complexity:** S
+- **Provenance:** Registered 2026-07-30 after the collision it describes forced a renumber on `develop`. The id for THIS row was allocated by taking the union of ids across `main` and `develop` rather than the maximum on one — which is the workaround the fix should make unnecessary.
+- **Acceptance criteria:**
+  - [x] Registering a row on a branch cannot silently reuse an id that already exists on the base branch — `49-validate-gap-id-allocation` compares titles per id against the base and fails on a mismatch.
+  - [x] The check runs on pull requests and names the colliding id together with both places it is used, so the resolution is not a search — wired into `Governance guards (GT-578)`, with the base fetched explicitly because a shallow checkout does not have it.
+  - [x] It ships with negative fixtures that have been OBSERVED red — 13 of them, including the GT-634 collision reproduced over real git history and three anti-vacuous floors, and `43-validate-guard-negative-fixtures` counts it at 38/38.
+
+#### GT-635
+
+**Title:** The dead-reference ratchet has been over budget on main since 2026-07-28, so the governance job is permanently red
+
+- **Purpose:** Make a ratchet that has been breached either hold or be re-measured — a gate nobody can satisfy trains people to ignore it.
+- **Evidence:** **`Governance guards (GT-578)` fails on `main` itself, and has for at least three consecutive runs.** `41-validate-evidence-commands --strict --max-dead 305` reports **309 dead references on a clean checkout**, so the job exits 1 on every run of `ci-cd.yml`. Observed on runs `30482497995` (2026-07-29 19:00Z), `30470648146` (16:25Z) and `30466280865` (15:31Z) — all on `main`, none carrying an unmerged change. The budget was set to 305 in `4a1b92d6` (2026-07-28) with the message "put the ratchet back where it was measured"; **ten commits have since edited `gap-closure-evidence.json`**, each adding `validationCommands`, and the count drifted past the number that was measured. The four extra dead references are not attributable to any single one of them from the count alone. **Why this is more than bookkeeping:** the ratchet's whole purpose is that dead references must not GROW, and it is currently reporting exactly that while being ignored, because a permanently red job reads as background noise — the same failure mode [`GT-622`](./gap-reference-catalog.md#gt-622) records for the orphaned CodeQL configuration. It also means the next change that genuinely adds a dead reference will be indistinguishable from the four already there. **What NOT to do:** raise the budget to 309 and move on. That converts a breached ratchet into a ratified one, which is how a corpus of 309 dead references was reached in the first place. The two honest options are to fix the four (retarget the commands at referents that exist) or to re-measure and state, in the commit, what was accepted and why. **CLOSED 2026-07-30, and not by raising the budget — which is what the row said not to do.** `f34a10f1` migrated the recorded closure commands onto the paths this repository actually has, and `600dd7a9` then moved the budget **304 → 40** from the count that migration produced. The corpus went from 309 dead references to 40 over 1045 recorded commands: 269 were REPAIRED, not exempted, which subsumes the four this row was opened for. `Governance guards (GT-578)` passed on the runner for PR #288. Registered by one session and closed by another within the hour — worth noting, because the value of the row was making the breach visible, not owning the fix.
+- **Component:** `Governance` · **Criticality:** P2 · **Complexity:** S
+- **Provenance:** Found on 2026-07-29 while diagnosing four red checks on PR #277. Three of the four were pre-existing on `main`; this is the one whose number was identical (309 vs 305) on both sides, which is what proved the PR had not caused it.
+- **Acceptance criteria:**
+  - [x] `Governance guards (GT-578)` passes on `main` without the budget being raised to accommodate references that are already dead — it was LOWERED, 304 → 40, after the corpus was repaired.
+  - [x] Each of the four references added since `4a1b92d6` is either repaired or named in the commit that accepts it, with the reason — subsumed: 269 of the 309 were repaired wholesale by the path migration.
+  - [x] The guard reports the ratchet basis on a clean checkout, so the budget can never again be calibrated against a machine that happens to have built something.
+
+#### GT-634
+
+**Title:** The published CLI and MCP resolve an SDK build that predates the security wave, because a caret range under 1.x pins it
+
+- **Purpose:** Make `npm install @beyondnet/evolith-cli@latest` stop pulling a dependency published before the fixes its own CHANGELOG announces.
+- **Evidence:** **`@beyondnet/evolith-cli@1.2.1` and `@beyondnet/evolith-mcp@1.2.1` both declare `@beyondnet/evolith-sdk: ^1.1.0`, and that resolves to EXACTLY `1.1.0`.** The SDK publishes `1.0.0`, `1.1.0` and `2.0.0` and nothing in between, so a caret range under 1.x cannot reach 2.0.0 — a caret is bounded by the next major. The dates are the finding: `sdk@1.1.0` was published **2026-07-18**, `sdk@2.0.0` on **2026-07-27** as part of the release that closed [`GT-570`](./gap-reference-catalog.md#gt-570), and `cli@1.2.1` / `mcp@1.2.1` on **2026-07-28** — *after* 2.0.0 existed, still pointing at the 1.x line. So the exposure GT-570 declared closed for "anyone installing `latest`" is not closed for this dependency: `latest` of both surfaces installs an SDK built before the 2026-07-23 wave. **Stated precisely, because the stronger claim is not verified here:** what is measured is the dates and the resolution, not the contents — this row does not assert that `sdk@1.1.0` carries a specific vulnerability, only that it predates the wave and that the release which shipped the wave was a major the consumers cannot reach. Verifying which fixes are in `sdk@2.0.0` is part of closing it. **Found because it blocked something else:** deprecating `sdk@1.1.0` for [`GT-624`](./gap-reference-catalog.md#gt-624) would have printed a warning on every fresh install of the current line with no 1.x successor to offer, which is what exposed the range. Fix: retarget both ranges to `^2.0.0` (a major bump of a dependency, so it needs the SDK's breaking changes reviewed against both call sites) or publish an `sdk@1.2.x` carrying the fixes, then deprecate `sdk@1.1.0` and close GT-624's first criterion for real. **RANGES RETARGETED 2026-07-29, and doing it proved the row understated the defect.** `package-lock.json` did not merely record the range — it pinned the registry tarball of `sdk@1.1.0` at `src/sdk/cli/node_modules/@beyondnet/evolith-sdk` **and** `src/packages/mcp-server/node_modules/@beyondnet/evolith-sdk`, with integrity hashes. So `npm ci` on a clean checkout fetched the pre-wave SDK and nested it inside each consumer, where it **shadows the workspace link**: the top-level symlink to the local 2.0.0 is what every developer reads, and the nested 1.1.0 is what a fresh install actually resolves. That is the same class as [`GT-625`](./gap-reference-catalog.md#gt-625) — the workspace hiding what a real install does — and it is why nothing caught this. Both nested entries disappeared once the range moved to `^2.0.0`, because the workspace's own 2.0.0 then satisfies it; the lockfile diff is exactly two range strings and those two removals, with no collateral drift, and `npm install --package-lock-only` was used to confirm it writes byte-for-byte what the hand edit did rather than trusting the edit. The SDK surface both consumers actually use is narrow — `EvolithRestClient` only — so the 2.0.0 breaking change (payload types re-exported from `core-domain`, `.passed` → `.verdict`, `'info'` severity retired) touches neither call site. Verified against 2.0.0: CLI **1436/1436** in 99 suites, mcp-server **433/433** in 53. **1.2.2 is on `main` (PR #285) and NOT published.** The row stays OPEN and that is the point: a range in the repository is not a range on the registry, and criterion 1 is met only when npm serves it. Until then the published `latest` of both surfaces still installs the 2026-07-18 SDK. **CLOSED 2026-07-30, and the security framing of this row was WRONG — recorded rather than quietly dropped.** 1.2.2 is published with provenance and a clean install of `@beyondnet/evolith-cli@latest` now resolves `@beyondnet/evolith-sdk@2.0.0`, with the binary booting. But criterion 2 forced the question this row had deliberately left open, and the answer refutes its premise: **not one of the seven security-wave commits (`1b077ab6`, `3a39dd03`, `60bfc63a`, `3f31fa64`, `90eacdbc`, `4f29e114`, `8ad4e2de`) touches `src/packages/sdk-client` — zero files.** The wave's own release commit `21205d24` names the three packages it affected: `evolith-mcp` (15 files), `evolith-cli` (7) and `evolith-agent-runtime` (1). The SDK was republished alongside them, not fixed. So `sdk@1.1.0` predates the wave chronologically and carries none of it; there was no exposure through this dependency. **What was real, and is what the row should have said:** a caret range under 1.x cannot cross a major, so both consumers were pinned a MAJOR behind on a contract dependency — `.passed` against a payload that emits `verdict` — and the lockfile nested the registry tarball inside each consumer where it shadowed the workspace link. A stale-contract and lockfile-shadowing defect (the [`GT-625`](./gap-reference-catalog.md#gt-625) class), not a security one. The hedge written into this row when it was opened — that it measured dates and resolution, not contents — is what made the correction cheap.
+- **Component:** `Infra` · **Criticality:** P1 · **Complexity:** S
+- **Provenance:** Found on 2026-07-29 while executing GT-624's deprecation criterion. Registered rather than worked around: skipping the deprecation quietly would have left the range — and the install — exactly as they are.
+- **Acceptance criteria:**
+  - [x] `npm view @beyondnet/evolith-cli@latest dependencies` shows an SDK range that resolves to a version published on or after 2026-07-27, likewise `evolith-mcp` — both publish `^2.0.0` at 1.2.2, and a clean install resolves `sdk@2.0.0` with the binary booting.
+  - [x] The fixes claimed by the 2026-07-23 security wave are verified present in the SDK version the CLI and MCP actually resolve, rather than assumed from the version number — and the verification REFUTED the premise: none of the seven wave commits touches `src/packages/sdk-client`, so there are no wave fixes in the SDK to be present or absent.
+  - [x] `@beyondnet/evolith-sdk@1.1.0` is deprecated once a successor its consumers can reach exists — done 2026-07-30, with a message that states the real reason (superseded by 2.0.0, `.passed` → `verdict`) and says explicitly it is not a security advisory.
+
+#### GT-640
+
+**Title:** A guard whose expected value was a copy of its actual value, over an input laundered into an artifact five times its size
+
+- **Purpose:** Remove two failure classes that generalise well beyond this file — a guard that reads its expectation from the artifact it is guarding, and a generator that stamps a hand-maintained field onto everything downstream of it.
+- **Evidence:** **The guard compared the snapshot against six numbers copied out of the snapshot, so it could only ever pass — and the file it was failing to guard is stamped onto 388 rows of a larger artifact.** `native-evaluability-snapshot.json` declared in its own header that it was "a CAPTURED SNAPSHOT, not the source of truth". **No capture script existed.** It was hand-maintained and it drifted: it pinned `documentation-only: 129` while Core pinned 136, and went on calling rules `unimplemented-native` after they had handlers. Its guard in `iso-5055-mapping.test.mjs` asserted the snapshot's six class counts against six numbers typed into the test — the same six literals the snapshot already contained. **Expected value and actual value were copies of each other**, so the assertion held for as long as the file was unchanged, whatever Core actually pinned; it reported an agreement it never checked, which is worse than no guard, because the row it protects reads as verified. **The drift does not stay where it starts.** `build-iso-5055-mapping.mjs` stamps `nativeEvaluability` onto EVERY row of the ISO/IEC 5055 mapping from that file — 388 rows after the recapture, 381 before — so one stale class is laundered into a derived artifact five times the size of its input, and overstates the handler backlog that is [`GT-598`](./gap-reference-catalog.md#gt-598)'s entire deliverable by however many rules Core has since closed. The order that makes the difference (recapture, THEN rebuild) was written down nowhere, and the mapping's own guard ran in **no workflow at all**. **Fixed on 2026-07-29** (branch `claude/fervent-cohen-08ea01`): `capture-native-evaluability-snapshot.mjs` runs Core's REAL triage through `ts-node` rather than reimplementing the classification — a second implementation here would be a second source of truth, which is the defect being removed — and to make the triage reachable outside jest it moved from the spec into `src/packages/core-domain/test/rule-corpus-triage.ts`; that unreachability is precisely why the snapshot was maintained by hand in the first place. Three checks replace the tautology, each in the job that can afford it: `rule-corpus-triage.spec.ts` asserts the committed snapshot against a FRESHLY COMPUTED triage in both directions; the documentation-job guard, which has no `node_modules`, reads Core's pinned counts OUT of the spec that pins them and **throws** when the literal is missing or reshaped, so failing to find the source of truth can never read as agreement with it; and `--check` is the end-to-end re-derivation. **Recaptured on 2026-07-29 after merging the fix into the current line, and the drift had grown while it was in flight:** `native-handler` 139 → 151, `documentation-only` 129 → 136, the handler backlog 60 → **48**, corpus 379 → 386, mapping 381 → 388 rows. Twelve of those handlers were closed by [`GT-595`](./gap-reference-catalog.md#gt-595) and [`GT-632`](./gap-reference-catalog.md#gt-632) while the hand-maintained snapshot went on reporting them as backlog — the defect demonstrating itself one more time. The merge also carried a second instance of the pattern GT-595 recorded: the extracted `test/rule-corpus-triage.ts` had dropped the `enforce` field, so the measuring instrument would again have measured a different corpus than production evaluates; it is restored. Both steps are now links in the [`GT-630`](./gap-reference-catalog.md#gt-630) derived-artifact chain, which enforces the recapture→rebuild order as data instead of prose. **How it actually landed, recorded because three sessions converged on it:** the capture script and the extracted triage reached `main` as PR #276, the two chain links as PR #287, and a SECOND, independent implementation of the same fix reached `develop` as PR #279 — an in-spec renderer driven by `UPDATE_EVALUABILITY_SNAPSHOT=1` rather than a standalone script. Both recaptured the same numbers, which is mutual corroboration of the measurement; but two generators for one artifact is the defect of this very row reproduced one level up, and reconciling them is open work that blocks `develop` → `main`.
+- **Component:** `Governance` · **Criticality:** P1 · **Complexity:** S
+- **Provenance:** Follow-on defect from [`GT-598`](./gap-reference-catalog.md#gt-598), found on 2026-07-29 while extending its mapping: the snapshot GT-598 built on was never captured by anything, and the guard over it was tautological. Registered separately because the finding is a guard-design class, not a correction to GT-598's mapping.
+- **Acceptance criteria:**
+  - [x] The snapshot is produced by a script that runs Core's own triage instead of by hand, and `capture-native-evaluability-snapshot.mjs --check` re-derives it end to end.
+  - [x] No guard over the snapshot takes its expected value from the snapshot: one recomputes the triage, the other reads Core's counts out of the spec that pins them and fails loudly when it cannot find them.
+  - [x] The recapture→rebuild order is enforced as data — both links are declared in the `46-validate-derived-artifact-order` chain — and the mapping guard runs in a workflow, having run in none.
 #### GT-636
 
 **Title:** Three CI checks on PR #275 were red — all three were real, fixable defects, not accepted debt
@@ -8115,6 +8180,6 @@ Historical gap series tracked in the former `gap-analysis-core.md`, preserved fo
 - **Component:** `Infra` · **Criticality:** P1 · **Complexity:** S
 - **Provenance:** Carved out of GT-570 on 2026-07-27 as it closed. Two of its three original criteria were not met by shipping 1.2.0; they are recorded here rather than assumed.
 - **Acceptance criteria:**
-  - [ ] `npm view @beyondnet/evolith-mcp@1.1.0` reports the version as deprecated, likewise cli and agent-runtime.
-  - [ ] A CI gate fails when a commit whose type or scope marks it as security is absent from the latest published tag.
-  - [ ] The gate ships with a negative fixture that turns it red, so it is not another guard nobody has seen fail.
+  - [x] `npm view @beyondnet/evolith-mcp@1.1.0` reports the version as deprecated, likewise cli and agent-runtime — and also core-domain, core and infra-providers. `evolith-sdk@1.1.0` and `evolith-contracts@1.1.0` are deliberately NOT deprecated, for reasons recorded in the evidence above rather than skipped.
+  - [x] A CI gate fails when a commit whose type or scope marks it as security is absent from the latest published version. `48-validate-security-publish-lag`, wired into `Governance guards (GT-578)`. It asks the registry rather than git tags, because the newest `v*` tag is `v1.1.0` while npm serves `1.2.2`.
+  - [x] The gate ships with negative fixtures that turn it red — 12 of them, including the anti-vacuous floors and a regression for each of the two false negatives found while building it — and `43-validate-guard-negative-fixtures` has OBSERVED it refuse the empty fixture (37/37).
diff --git a/reference/core/control-center/gaps/gap-tracking.es.md b/reference/core/control-center/gaps/gap-tracking.es.md
index 884b0c3a3..feef4d09d 100644
--- a/reference/core/control-center/gaps/gap-tracking.es.md
+++ b/reference/core/control-center/gaps/gap-tracking.es.md
@@ -13,8 +13,13 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida
 
 | ID | Gap | Qué significa | Ejemplo | Componente | Fase | Criticidad | Complejidad | Estado |
 |---|---|---|---|:---:|:---:|:---:|:---:|:---:|
-| [`GT-636`](./gap-reference-catalog.es.md#gt-636) | **Tres checks de CI estaban en rojo en el PR #275 — `Security Audit`, `E2E Tests`, `Evolith Core Validation` — y los tres eran defectos reales y arreglables, no la deuda aceptada que cualquiera de ellos parecía al principio.** `Evolith Core Validation` fallaba en `Bilingual Terminology Lint` (2 de 5 términos marcados eran prosa genuinamente sin traducir; los otros 3 eran celdas de tabla/cita donde traducir solo el término marcado habría hecho el documento menos consistente). `E2E Tests` fallaba en 1 de 132 tests que llamaba a dos flags de CLI (`--architecture --arch-level F1`) que nunca existieron — el flag real es `-a, --arch`. `Security Audit` reportaba 31 hallazgos de `npm audit` (29 high, 2 moderate); la investigación los trazó a UNA SOLA causa raíz — un aviso de DoS en `brace-expansion` (`GHSA-mh99-v99m-4gvg`, que afecta toda versión `<=5.0.7`, parcheado solo en `5.0.8`, publicado DESPUÉS de que el `overrides.brace-expansion: "2.1.2"` ya existente en este repo se fijara) que propaga severidad hacia arriba por todo el toolchain de devDependencies jest/eslint/`@nestjs/cli`, más un hallazgo independiente de `fast-uri`. **CERRADO el 2026-07-29, los tres.** Terminología y E2E arreglados como describe su propia nota de cierre anterior. `Security Audit`: el `overrides.brace-expansion` de la raíz subido de `2.1.2` a `5.0.8`, más un `overrides.fast-uri: "3.1.4"` nuevo (dentro del rango que el propio `ajv` declara, `^3.0.1`) — un diff de `package.json` de 2 líneas. Llegar ahí exigió forense real: un `npm install` plano dejaba 4 de las 10 posiciones del árbol fijadas a una versión OBSOLETA registrada en el lockfile sin importar el override nuevo, así que hubo que borrar esas entradas específicas de `package-lock.json` antes de que un `npm install` fresco respetara el override; un override anidado y con ALCANCE (`"eslint": {"brace-expansion": ...}`) empeoraba el arreglo, no lo mejoraba — en cuanto un paquete tiene un objeto de override anidado para AUNQUE SEA una sola dependencia no relacionada (`ajv`), npm deja de dejar que la regla general de la raíz, sin alcance, se propague dentro de ese subárbol en absoluto, así que el arreglo que funciona es el override plano de nivel superior SIN ninguna entrada anidada compitiendo por el mismo paquete. 0 high / 0 critical confirmado con el comando exacto de CI (`npm audit --audit-level=high`, exit 0) en un entorno limpio aislado (un worktree de scratch con un `node_modules` real, no-symlinked, ya que la propia granja de symlinks por paquete que esta sesión armó antes quedó confirmada corrompiendo el tooling de grafo de dependencias). Quedan 2 moderados, deliberadamente no perseguidos: un path-traversal solo-Windows en el `serve-static` de `@hono/node-server`, irrelevante para el CI/despliegue Linux de este repo, cuyo arreglo exige subir una dependencia de PRODUCCIÓN con pin EXACTO (`@modelcontextprotocol/sdk`) en vez de un override de devDependency. Verificado más allá del audit: las suites completas de `core-domain` (1442/1442), unit de CLI (1436/1436) y E2E (132/132, reconstruyendo primero cada dependencia de workspace, exactamente como hace el propio job de CI) y `mcp-server` (433/437, 4 skips preexistentes) todas en verde contra el árbol arreglado. |  |  | `Cross` | Cross | P2 | S  | `COMPLETADO` |
+| [`GT-640`](./gap-reference-catalog.es.md#gt-640) | **El guard comparaba el snapshot contra seis números copiados del propio snapshot, así que solo podía pasar — y el archivo que no estaba vigilando se estampa en 388 filas de un artefacto mayor.** `native-evaluability-snapshot.json` declaraba en su propia cabecera que era "un SNAPSHOT CAPTURADO, no la fuente de verdad". **No existía ningún script de captura.** Se mantenía a mano y derivó: fijaba `documentation-only: 129` mientras Core fijaba 136, y seguía llamando `unimplemented-native` a reglas que ya tenían handler. Su guard en `iso-5055-mapping.test.mjs` asertaba los seis conteos de clase del snapshot contra seis números escritos a mano en el test — los mismos seis literales que el snapshot ya contenía. **El valor esperado y el valor real eran copias el uno del otro**, así que la aserción se sostenía mientras el archivo no cambiara, fijara Core lo que fijara; informaba de una concordancia que nunca comprobó, lo cual es peor que no tener guard, porque la fila que protege se lee como verificada. **La deriva no se queda donde empieza.** `build-iso-5055-mapping.mjs` estampa `nativeEvaluability` en TODAS las filas del mapeo ISO/IEC 5055 desde ese archivo — 388 tras la recaptura, 381 antes — así que una sola clase rancia se blanquea en un artefacto derivado cinco veces mayor que su entrada, y sobredimensiona el backlog de handlers que es el entregable entero de [`GT-598`](./gap-reference-catalog.es.md#gt-598). El orden recaptura→reconstrucción no estaba escrito en ningún sitio, y el guard del propio mapeo no corría en **ningún workflow**. **CORREGIDO el 2026-07-29:** un script de captura que ejecuta el triage REAL de Core vía `ts-node` en vez de reimplementar la clasificación, la medición extraída del spec de jest a `test/rule-corpus-triage.ts` para que un script pueda alcanzarla — esa inalcanzabilidad es la razón de que el archivo se mantuviera a mano —, aserciones snapshot-contra-triage-fresco en ambas direcciones, un guard del job de documentación que lee los conteos que Core fija LEYENDO el spec y **lanza excepción** cuando el literal falta o cambia de forma, y ambos pasos declarados como eslabones de la cadena de artefactos derivados de [`GT-630`](./gap-reference-catalog.es.md#gt-630). **Recapturado el 2026-07-29 tras mergear el fix en la línea actual, y la deriva había crecido mientras estaba en vuelo:** `native-handler` 139 → 151, `documentation-only` 129 → 136, el backlog de handlers 60 → **48**, corpus 379 → 386, mapeo 381 → 388 filas. Doce de esos handlers los cerraron [`GT-595`](./gap-reference-catalog.es.md#gt-595) y [`GT-632`](./gap-reference-catalog.es.md#gt-632) mientras el snapshot mantenido a mano seguía reportándolos como backlog — el defecto demostrándose una vez más, sobre números que nadie escribió dos veces. **RENUMERADA GT-633 -> GT-640 el 2026-07-30**, después de que `49-validate-gap-id-allocation` detectara que `GT-633` ya nombraba otro gap en `develop` (el scaffolding de `evolith init`, `c8270e48`, registrado un día antes). Se mueve la fila más nueva, según el propio consejo del guard. |  |  | `Governance` | Cross | P1 | S | `COMPLETADO` |
+| [`GT-639`](./gap-reference-catalog.es.md#gt-639) | **Nada hace visible el trabajo en vuelo entre ramas, así que el mismo gap se arregla dos veces.** El 2026-07-30 el mismo trabajo se hizo dos veces, en tres ocasiones distintas, por sesiones que no podían verse: [`GT-640`](./gap-reference-catalog.es.md#gt-640) (registrado como GT-633 entonces) arreglado por un script de captura en `main` (#276) Y por un renderer independiente dentro del spec en `develop` (#279) — los dos correctos, los dos recapturando los mismos números, y dos generadores para un artefacto es el defecto del propio GT-640 un nivel más arriba, así que una tercera sesión gastó una reconciliación entera en dejar uno; el parser del guard de evidencias arreglado dos veces (`d1ea72a3` en main, `5acb29ed` en develop); y un id de GT asignado dos veces, forzando la renumeración que hay detrás de [`GT-638`](./gap-reference-catalog.es.md#gt-638). **El coste no es el conflicto de merge** — es el trabajo duplicado antes de que nadie llegara a él, más la reconciliación, que introdujo un defecto propio (una comparación sensible al orden que reescribía la fecha de captura en cada corrida, invisible un día porque ambas estampaban la misma fecha). Una fila lleva estado pero no QUIÉN la trabaja ni DÓNDE, así que dos sesiones pueden leer ambas `PENDIENTE` y empezar ambas, correctamente. **La convención de un solo driver ya existe; lo que falta es un mecanismo que la haga observable**, así que en un día cargado se degrada en silencio. |  |  | `Governance` | Cross | P2 | M | `PENDIENTE` |
+| [`GT-638`](./gap-reference-catalog.es.md#gt-638) | **El tablero no tiene asignador de ids, así que dos ramas paralelas reparten el mismo número GT.** Un id se elige leyendo el `GT-*` más alto de la rama en la que uno está, y nada lo contrasta con otra rama — así que dos sesiones en paralelo asignan el mismo número y una se entera en el merge. Ya pasó: `8449af3d` en `develop` dice *"renumber the ratchet fix GT-634 -> GT-637, ID collision with develop"*; esa fila y [`GT-634`](./gap-reference-catalog.es.md#gt-634) en `main` tomaron el mismo id con horas de diferencia, desde sesiones que no podían verse. **La renumeración es manual y con pérdidas**, que cuesta más que el choque: un id vive en la fila del tablero, el ancla del catálogo, el registro de evidencia de cierre, referencias cruzadas en dos idiomas, mensajes de commit y cuerpos de PR — y sólo los tres primeros son comprobables mecánicamente. `08-validate-tracking` no puede ayudar por construcción: valida dentro de un único árbol de trabajo, y las ramas quedan fuera de su mundo. Tampoco es un desliz aislado — en el merge `develop` → `main` del 2026-07-30 el mismo patrón de duplicación convergente aparece tres veces: GT-640 (entonces GT-633) arreglado dos veces, el parser del guard de evidencias arreglado dos veces, este id asignado dos veces. **CERRADO el 2026-07-30 — y en su primera corrida real encontró una SEGUNDA colisión que nadie conocía.** `49-validate-gap-id-allocation` compara el **Title:** de cada id en HEAD contra el título que ese id lleva en la rama base; un título distinto para el mismo id es un número nombrando dos gaps. Contra `origin/develop` reportó **`GT-633`**: allí es "`evolith init` scaffolds a repository that cannot pass its own governance on the first run" (`c8270e48`, 2026-07-29) y en main era la fila del guard tautológico (`c3221276`, 2026-07-30), renumerada después a `GT-640`. El merge no lo había sacado a la luz. Se niega a adivinar qué lado está mal — un retítulo y una colisión se ven igual desde fuera —, así que nombra los dos. Cableado en `Governance guards (GT-578)` con un `git fetch` explícito de la base, porque un checkout superficial de CI no la tiene. Observado en rojo por `43-validate-guard-negative-fixtures` (38/38). Sigue sin ver un id asignado en una rama sin PR abierto, y su salida `--verbose` lo advierte en cada id nuevo. |  |  | `Governance` | Cross | P2 | S | `COMPLETADO` |
 | [`GT-637`](./gap-reference-catalog.es.md#gt-637) | **El ratchet de referencias muertas de GT-578 estaba atascado en 305 por dos bugs reales en el propio GUARD, no por el tamaño del backlog de registros que decía medir.** Al cerrar el PR de `GT-633` apareció un fallo en `Governance guards (GT-578)` y, al investigarlo, un refactor sin commitear y sin terminar que ya estaba en el árbol de trabajo: `resolveCommand` llamaba a `npmScriptOperand(...)`, una función que nunca se definió, así que el guard crasheaba con `ReferenceError` en cada invocación — incluso en modo reporte plano. Reparar esa función (restaurar su comportamiento y luego corregirlo) bajó el conteo de 309 a 78, lo que destapó el segundo bug: el corpus usa `npm run --workspace <ruta> <script>` en todo el corpus — el flag `--workspace` ANTES del nombre del script, una forma válida que `npm` acepta — y la búsqueda del nombre de script del resolver no sabía que `--workspace` consume el siguiente token, así que confundía la propia ruta del workspace con el nombre del script y la reportaba como no declarada. Ambos bugs eran preexistentes; solo se volvieron VISIBLES juntos, porque antes del primer arreglo el guard nunca llegaba tan lejos como para tropezar con el segundo. **CERRADO el 2026-07-29.** Ambos bugs arreglados, bajando 309 → 52. Las ~290 rutas anteriores al refactor `src/` y a la mudanza a `product/` que el propio docstring de este job nombra (`sdk/cli`, `apps/core-api`, `packages/*`, `reference/infrastructure/`, `reference/operations/`, el scope retirado `@evolith/*`) eran una migración de DATOS, no un arreglo de código, y ya estaban parcialmente hechas en el estado sin commitear encontrado en el árbol; el resto se completó de la misma forma — 18 sustituciones más, cada una verificada contra un fichero sucesor real en disco antes de escribirse, nunca adivinada. Eso bajó 52 → 22. Uno más, `chat.command.ts`, era un `wc -l` real al que solo le faltaba el prefijo de directorio (`src/sdk/cli/src/commands/chat/chat.command.ts`), confirmado existente, cerrando 22 → 21. Por el camino se encontró y arregló un tercer defecto, no relacionado: `.harness/bin/opa` (15 de las 309 originales) está gitignored y se descarga en un paso de CI separado — mismo hallazgo que `GT-632` sobre el guard 47, un artefacto gitignored ausente en un checkout limpio confundido con una ruta equivocada — así que `resolveCommand` ahora reporta `unchecked`, no `dead`, para cualquier ruta bajo `.harness/bin/` o `dist/`. `--max-dead` pasó de 305 a **21**, probado exacto observando que el guard falla en 20. El residual de 21 es genuinamente retirado o narrativo, no un renombre: un `.bmad-core/AGENTS.md` consolidado que reemplazó los ficheros por agente (2 registros), la puerta de enlace `evolith-bff` retirada (3), el paquete retirado `packages/mcp-tools` (2), dos manifiestos k8s retirados cuyos sucesores tienen contenido completamente distinto en vez de una ruta movida (3), una app sandbox retirada (1), tres invocaciones `npm test`/`npm run info`/`npm run test:cov` a nivel de raíz de antes de que existieran los workspaces, sin sucesor a nivel raíz (7), y tres registros donde `vision/` o `tools/list` — un nombre de método JSON-RPC de MCP, no una ruta de fichero — son prosa que describe historia, mal parseada como token con forma de ruta (3). Ninguno de estos se forzó hacia un destino plausible; un renombre equivocado habría sido peor que un residual honesto. 39/39 self-tests del guard pasan, incluida cobertura nueva para ambos bugs y sus gemelos negativos (la verificación de script con `--workspace` sigue cazando un script genuinamente no declarado; un binario ausente no-gitignored sigue siendo `dead`), de modo que el arreglo no puede cegar al guard, que es justo lo que no debía pasar. `08-validate-tracking`, `42`–`45` del mismo job, y una corrida completa `--execute --verbose` (modo reporte, fallos preexistentes en 6 registros no relacionados, ninguno entre las rutas tocadas aquí) confirmaron todo limpio. |  |  | `.harness` | Cross | P1 | S  | `COMPLETADO` |
+| [`GT-636`](./gap-reference-catalog.es.md#gt-636) | **Tres checks de CI estaban en rojo en el PR #275 — `Security Audit`, `E2E Tests`, `Evolith Core Validation` — y los tres eran defectos reales y arreglables, no la deuda aceptada que cualquiera de ellos parecía al principio.** `Evolith Core Validation` fallaba en `Bilingual Terminology Lint` (2 de 5 términos marcados eran prosa genuinamente sin traducir; los otros 3 eran celdas de tabla/cita donde traducir solo el término marcado habría hecho el documento menos consistente). `E2E Tests` fallaba en 1 de 132 tests que llamaba a dos flags de CLI (`--architecture --arch-level F1`) que nunca existieron — el flag real es `-a, --arch`. `Security Audit` reportaba 31 hallazgos de `npm audit` (29 high, 2 moderate); la investigación los trazó a UNA SOLA causa raíz — un aviso de DoS en `brace-expansion` (`GHSA-mh99-v99m-4gvg`, que afecta toda versión `<=5.0.7`, parcheado solo en `5.0.8`, publicado DESPUÉS de que el `overrides.brace-expansion: "2.1.2"` ya existente en este repo se fijara) que propaga severidad hacia arriba por todo el toolchain de devDependencies jest/eslint/`@nestjs/cli`, más un hallazgo independiente de `fast-uri`. **CERRADO el 2026-07-29, los tres.** Terminología y E2E arreglados como describe su propia nota de cierre anterior. `Security Audit`: el `overrides.brace-expansion` de la raíz subido de `2.1.2` a `5.0.8`, más un `overrides.fast-uri: "3.1.4"` nuevo (dentro del rango que el propio `ajv` declara, `^3.0.1`) — un diff de `package.json` de 2 líneas. Llegar ahí exigió forense real: un `npm install` plano dejaba 4 de las 10 posiciones del árbol fijadas a una versión OBSOLETA registrada en el lockfile sin importar el override nuevo, así que hubo que borrar esas entradas específicas de `package-lock.json` antes de que un `npm install` fresco respetara el override; un override anidado y con ALCANCE (`"eslint": {"brace-expansion": ...}`) empeoraba el arreglo, no lo mejoraba — en cuanto un paquete tiene un objeto de override anidado para AUNQUE SEA una sola dependencia no relacionada (`ajv`), npm deja de dejar que la regla general de la raíz, sin alcance, se propague dentro de ese subárbol en absoluto, así que el arreglo que funciona es el override plano de nivel superior SIN ninguna entrada anidada compitiendo por el mismo paquete. 0 high / 0 critical confirmado con el comando exacto de CI (`npm audit --audit-level=high`, exit 0) en un entorno limpio aislado (un worktree de scratch con un `node_modules` real, no-symlinked, ya que la propia granja de symlinks por paquete que esta sesión armó antes quedó confirmada corrompiendo el tooling de grafo de dependencias). Quedan 2 moderados, deliberadamente no perseguidos: un path-traversal solo-Windows en el `serve-static` de `@hono/node-server`, irrelevante para el CI/despliegue Linux de este repo, cuyo arreglo exige subir una dependencia de PRODUCCIÓN con pin EXACTO (`@modelcontextprotocol/sdk`) en vez de un override de devDependency. Verificado más allá del audit: las suites completas de `core-domain` (1442/1442), unit de CLI (1436/1436) y E2E (132/132, reconstruyendo primero cada dependencia de workspace, exactamente como hace el propio job de CI) y `mcp-server` (433/437, 4 skips preexistentes) todas en verde contra el árbol arreglado. |  |  | `Cross` | Cross | P2 | S  | `COMPLETADO` |
+| [`GT-635`](./gap-reference-catalog.es.md#gt-635) | **El ratchet de referencias muertas está por encima del presupuesto en main desde el 2026-07-28, así que el job de gobernanza está en rojo permanente.** `41-validate-evidence-commands --strict --max-dead 305` reporta **309 referencias muertas en un checkout limpio**, así que `Governance guards (GT-578)` sale 1 en cada corrida de `ci-cd.yml` — observado en las corridas `30482497995`, `30470648146` y `30466280865`, todas en `main` y sin nada por mergear. El presupuesto se fijó en `4a1b92d6` "donde se midió"; desde entonces diez commits han editado `gap-closure-evidence.json`, cada uno añadiendo `validationCommands`, y la cuenta se fue por encima. El propósito entero del ratchet es que las referencias muertas no CREZCAN, y está reportando exactamente eso mientras se lo ignora, porque un job en rojo permanente se lee como ruido de fondo — el mismo modo de fallo que [`GT-622`](./gap-reference-catalog.es.md#gt-622) registra para la configuración huérfana de CodeQL. El próximo cambio que añada de verdad una referencia muerta será indistinguible de las cuatro que ya están. **Lo que no hay que hacer:** subir el presupuesto a 309, que convierte un ratchet incumplido en uno ratificado. |  |  | `Governance` | Cross | P2 | S | `COMPLETADO` |
+| [`GT-634`](./gap-reference-catalog.es.md#gt-634) | **El CLI y el MCP publicados resuelven una build del SDK anterior a la ola de seguridad, porque un rango caret bajo 1.x la fija.** `@beyondnet/evolith-cli@1.2.1` y `@beyondnet/evolith-mcp@1.2.1` declaran ambos `@beyondnet/evolith-sdk: ^1.1.0`, y eso resuelve **exactamente `1.1.0`** — el SDK publica `1.0.0`, `1.1.0` y `2.0.0` y nada en medio, y un caret no cruza un mayor. Las fechas son el hallazgo: `sdk@1.1.0` se publicó el 2026-07-18, `sdk@2.0.0` el 2026-07-27 como parte de la release que cerró [`GT-570`](./gap-reference-catalog.es.md#gt-570), y ambos consumidores el 2026-07-28 — **después** de que 2.0.0 existiera, y seguían en la línea 1.x. Así que la exposición que GT-570 declaró cerrada para "quien instale `latest`" no está cerrada para esta dependencia. Dicho con precisión, porque la afirmación fuerte no está verificada aquí: lo medido son las fechas y la resolución, no el contenido — esta fila no afirma que `sdk@1.1.0` cargue una vulnerabilidad concreta. Encontrado ejecutando el criterio de deprecación de [`GT-624`](./gap-reference-catalog.es.md#gt-624), que es lo que dejó el rango a la vista: deprecar `sdk@1.1.0` avisaría en cada instalación limpia de la línea actual sin ningún sucesor 1.x que ofrecer.  **CERRADO el 2026-07-30 — 1.2.2 está publicada, y el marco de seguridad de esta fila era ERRÓNEO.** Una instalación limpia de `@beyondnet/evolith-cli@latest` resuelve ya `@beyondnet/evolith-sdk@2.0.0` con el binario arrancando. Pero verificar el criterio 2 refutó la premisa: **ninguno de los siete commits de la ola toca `src/packages/sdk-client` — cero ficheros** — y el propio commit de release de la ola nombra los tres paquetes afectados (mcp, cli, agent-runtime). El SDK se republicó con ellos, no se arregló. Lo real es un MAYOR rancio fijado por un caret bajo 1.x más un lockfile que anidaba el tarball del registry tapando el enlace del workspace — la clase de `GT-625`, no una exposición de seguridad. La cautela escrita al abrir la fila es lo que abarató la corrección. |  |  | `Infra` | Cross | P1 | S | `COMPLETADO` |
 | [`GT-633`](./gap-reference-catalog.es.md#gt-633) | **`evolith init` producía un repositorio que suspende su propio primer `evolith validate`, y solo los handlers de GT-595 lo hicieron visible.** Con `MTN-05` y `GIT-08` dotados de handler real por la ola de reglas con forma de configuración, un satélite recién scaffoldeado reportaba dos hallazgos bloqueantes que eran veredictos REALES, no el invariante bloqueante-y-saltada de GT-595: el scaffold no declaraba `spec.boundedContexts`, y no escribía configuración de commitlint en absoluto. La segunda es la más afilada — el corpus EXIGE Conventional Commits (`GIT-08`, `MUST`, `blocking`) y el propio comando de arranque del producto entregaba un repositorio donde nada los hacía cumplir. Ambas estaban fijadas por nombre en `rule-applicability.integration.spec.ts` justamente para que cerrarlas se viera. **CERRADO el 2026-07-29, y las dos mitades se cerraron por medios OPUESTOS, porque no son el mismo tipo de defecto.** `GIT-08` era un hueco del scaffold y nada más: Conventional Commits obliga desde el primer commit y el corpus ya enuncia la convención y sus siete tipos literalmente, así que no había nada que decidir ni nada que inventar. `init` emite ahora las tres patas que lee el handler — `commitlint.config.mjs`, los paquetes de commitlint en `devDependencies` y (con `--features hooks`) un `.husky/commit-msg` que ejecuta `npx --no-install commitlint`, de modo que la ausencia de la herramienta es un ERROR y no el salto silencioso que encontró `GT-623`. Sin `hooks` la configuración se escribe igual y el resultado lleva un warning diciendo que nada la ejecuta, en vez de dejar un fichero que parece enforcement sin serlo. Es independiente del runtime a propósito: commitlint es una herramienta Node, así que un satélite .NET o Python recibe un `package.json` solo de tooling — que es lo que esos repositorios llevan en la práctica y lo que el handler realmente lee; emitir solo la configuración habría dejado la regla suspendiendo para todo runtime que no sea Node. **`MTN-05` NO era un hueco del scaffold, y emitir un bloque `spec.boundedContexts` habría sido el arreglo equivocado.** La propia descripción de la regla dice que la estrategia DEBE definirse "antes de la Fase 2 Diseño", y un scaffold en fase-0 no tiene contextos acotados que declarar; satisfacerla en el `init` habría supuesto escribir una decisión de persistencia INVENTADA en cada repositorio nuevo, tras lo cual `MTN-05` pasaría por un motivo que nadie eligió. Peor: según la nota del propio handler los dos vocabularios son irreconciliables — `evolith-yaml.schema.json` restringe `persistence` a un enum de motor de base de datos bajo `additionalProperties: false` — así que cualquier valor escrito o rompe el esquema del contrato o no puede casar con la regla tal como está redactada. Lleva `appliesFromSdlcPhase: 2` en su lugar, que es el hecho de aplicabilidad que la regla siempre enunció en prosa, y sigue el precedente de `TAX-06` (anotación más un rego paralelo). La regla queda DIFERIDA, no debilitada, y eso se afirma en vez de suponerse: un test recorre las fases 0→3 y exige que vuelva a obligar en Diseño. **Un hallazgo metodológico que vale más que el arreglo.** La premisa no se reprodujo al primer contacto: la suite resuelve `@beyondnet/evolith-core-domain` por el symlink del workspace hacia `dist/`, que llevaba nueve días obsoleto, así que ambas reglas se reportaban `skipped` y la aserción fijada YA decía `[]`. Una corrida verde en ese estado habría "demostrado" el gap cerrado antes de escribir una línea — la misma clase que `GT-625` y `GT-632`, un pase que depende de estado de build sin versionar. Solo se reprodujo tras reanclar `node_modules` en el worktree y reconstruir, y entonces cada regla se verificó individualmente y no a través de la suite: `GIT-08` se ejecuta y PASA (typescript y python), `MTN-05` se reporta `notApplicable` en vez de pasar en silencio. |  |  | `Core Domain` | Cross | P1 | S  | `COMPLETADO` |
 | [`GT-632`](./gap-reference-catalog.es.md#gt-632) | **El MCP denegaba todas sus herramientas en producción por una ruta mal escrita, y la prueba de que funcionaba era estado local sin versionar.** `abac-evaluator.ts:322` resolvía la política compilada en `<core>/sdk/cli/rulesets/opa/policy.wasm` — la ruta ANTERIOR al refactor `src/`. El fichero vive en `src/sdk/cli/…`. Cuando el stat falla, el evaluador deniega fail-closed en producción, así que en un checkout limpio con `NODE_ENV=production` la política compilada nunca se carga y TODA herramienta MCP se rechaza. Parecía verde porque `policy.wasm` está gitignorado: un fichero rancio dejado en la ruta vieja por una época anterior hacía que la carga funcionara en local, y el test que lo cubre pasaba contra un artefacto que ningún checkout fresco tendría. Misma forma que `GT-625` — un verde que dependía de estado no versionado — pero en el camino de autorización. Encontrado el 2026-07-29 investigando por qué `abac-rego-parity.spec.ts` se había puesto rojo; el rego era correcto (`opa eval` devuelve `allow: true` para un arquitecto en producción). **`40-validate-path-literals` no puede ver esta clase:** barre literales de cadena, y esto es una construcción `path.join(corePath, 'sdk', 'cli', …)`. Sobreviven doce joins así en `src/**` — los otros once están en `opa-input-builder.ts` y `cli-release-rule.handler.ts`, donde una ruta equivocada produce un falso NEGATIVO en un evaluador en vez de una denegación, que es más silencioso y no menos incorrecto. **CORREGIDO para el camino de autorización el 2026-07-29:** el evaluador prueba ahora ambas ubicaciones, la nueva primero — no es dejadez, es lo que mantiene funcionando una imagen ya desplegada mientras se corrige la ruta. Revertir el arreglo pone `abac-rego-parity.spec.ts` en rojo (1 de 11); con él, mcp-server va 434/434. Quedan los otros once joins y el punto ciego del guard. **Criterio 2 CERRADO el 2026-07-29 — y dos de las once estaban mal de una forma que el prefijo por sí solo no arreglaba.** Ocho eran supervivientes simples del movimiento a `src/` y admitieron el prefijo. Las otras tres eran peores: dos apuntaban a `sdk/cli/src/core/mcp/server.ts`, un fichero que salió del CLI por completo cuando mcp-server pasó a ser su propio paquete (hoy `src/packages/mcp-server/src/mcp/mcp-server.service.ts`); y una exigía un `package-lock.json` por paquete, cosa que los WORKSPACES de npm impiden — hay exactamente un lockfile, en la raíz, así que esa comprobación solo podía ser falsa. Una regla que nadie puede satisfacer no es una regla más estricta. **Las specs y las fixtures de paridad también codificaban el layout viejo** (`cli-release-readiness.fixture.json`, `mcp.fixture.json`), y por eso llevaban tiempo en verde sobre rutas que no existen: la fixture y el código coincidían entre sí y ninguno coincidía con el repositorio. Ambas corregidas. core-domain 1367/1367, `28-native-evaluator-parity` exit 0. **Criterio 3 CERRADO el 2026-07-29 — la primera corrida del guard estuvo casi toda equivocada, que es el hallazgo.** `47-validate-joined-paths` reportó 19 rutas rotas; solo 3 eran defectos. Cada una de las otras 16 habría empeorado el código: seis tenían base `root`, un PARÁMETRO que nombra el workspace del cliente, así que corregirlas rompería la evaluación de todos los satélites; nueve eran miembros de CADENAS DE FALLBACK correctas cuando uno de cuatro layouts resuelve, y la forma natural de callarlas es borrar los fallbacks, rompiendo imágenes desplegadas; una era una PROHIBICIÓN cuya ausencia ES el estado que aprueba, así que corregirla habría invertido la regla. Las cadenas se detectan ahora estructuralmente (hermanos de array, o las ramas de un ternario); las prohibiciones no pueden, y llevan razón escrita. Los tres defectos reales: `opa-evaluator.ts` resolvía `policy.wasm` y los esquemas de entrada sin el prefijo `src/`, misma clase fail-closed que el P0 de arriba; `satellite-upgrade-diff.ts` sondeaba `rulesets` detrás de un return temprano, reportando cero cambios de rulesets en cada upgrade de satélite; `artifact-path-resolver.ts` nombraba un `adr-matrix.json` que no existe en ningún layout. 11 fixtures negativas, los dos suelos anti-vacuos, y `43-validate-guard-negative-fixtures` lo OBSERVÓ en rojo sobre 36 guards. Una indulgencia conocida (dos joins como argumentos hermanos) queda anotada en su cabecera en vez de escondida. |  |  | `MCP Server` | Cross | P0 | M  | `COMPLETADO` |
 | [`GT-631`](./gap-reference-catalog.es.md#gt-631) | **Extraído de [`GT-573`](./gap-reference-catalog.es.md#gt-573) para que su mitad cross-repo se siga en vez de absorberse en un cierre.** La mitad del Core del tercer criterio de GT-573 está hecha: `evaluation-context` y `evaluation-result` están fijados en `MACHINE_CONTRACT_SET` junto a `gate-evidence` y `output-envelope`, así que un cambio en cualquiera de esas formas ya rompe `10-validate-contract-conformance` en vez de llegar en silencio a los consumidores. Lo que queda está en otro repositorio y no se puede hacer desde aquí: el **Tracker** debe re-fijar esos dos esquemas en su propio `contracts/evolith-core-contracts.json` con su sha256, enlazar las tres fixtures publicadas (`EVALUATION_RESULT_PASS/FAIL/OPA_GATE_FAIL`) en un test de binding de DTOs, quitar o documentar `resolvedTopology` (que el resultado canónico nunca llevó), renombrar su `phase` de gate a `phaseId`, y eliminar su caída a `SKIPPED` para un payload que trae un `overallVerdict` no vacío. Hasta entonces, un cambio de forma del lado Core se caza aquí y sigue sorprendiendo al consumidor. |  |  | `Evolith Tracker` | Cross | P1 | S | `PENDIENTE` |
@@ -24,7 +29,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida
 | [`GT-627`](./gap-reference-catalog.es.md#gt-627) | **El corpus de conformidad de ADR commiteado estaba siete rulesets por detrás de su propio generador, y seis de los siete son estándares de seguridad.** Descubierto el 2026-07-28 al regenerar para `GT-571`: `generate-adr-rulesets.mjs` escribió 133 rulesets donde el repositorio tenía 126. Los que faltaban son ADR-0118 más **ADR-0119 (endurecimiento de configuración de seguridad de API), ADR-0120 (prevención de SSRF), ADR-0121 (validación y saneamiento de entrada), ADR-0122 (seguridad en ejecución de shell), ADR-0123 (comparación en tiempo constante) y ADR-0124 (gestión de credenciales y secretos)** — decisiones aceptadas sin ningún ruleset de conformidad en el corpus, porque nadie volvió a ejecutar el generador tras aceptarlas. Nada lo detectó: el generador imprime una cifra de cobertura pero no se ejecuta con `--check` en CI, así que el corpus podía derivar del conjunto de ADRs indefinidamente. Es la misma forma que `GT-424` (un registro que deriva porque solo se verifica una dirección) y `GT-607` (ADRs Aceptados sin código que los implemente), y es la razón de que se moviera el snapshot fijado de triaje de `GT-595`: de 143 no ejecutables a 150, y de 126 reglas de conformidad de ADR a 133. **CERRADO el 2026-07-28.** El generador soportaba `--check` desde que se escribió; nadie lo ejecutaba nunca, y ese era el gap entero — la misma forma que `GT-424`, donde el guard existía y no se exigía. Ahora corre en `Validate documentation`, un check REQUERIDO, así que un ADR aceptado sin ruleset generado bloquea el merge en vez de esperar a que alguien regenere a mano. Por el camino se repararon dos cosas. **El autotest del propio generador estaba rojo y llevaba tiempo así**, por dos rutas que perdieron el prefijo `src/` en el refactor — uno de los ocho fallos preexistentes que catalogó el verificador de la ola 2; ahora va 8/8 y corre en el mismo job requerido. **`--check` podía reportar un pase sobre nada**: `drift === 0` sobre un árbol de ADRs vacío no es "sin deriva", es "no se comparó nada", así que ahora falla ante un barrido de cero ADRs e imprime el denominador que comparó (`--check passed: 140 ADR(s), no drift`). La fixture negativa borra un ruleset generado real, comprueba que el check se pone rojo y restaura el árbol — un guard que nadie ha visto fallar es el defecto que este tablero no para de encontrarse a sí mismo. |  |  | `Governance` | Cross | P1 | S | `COMPLETADO` |
 | [`GT-626`](./gap-reference-catalog.es.md#gt-626) | **El quickstart del propio README no completa, y los dos comandos discrepan sobre lo que produce `init`.** Medido el 2026-07-28 contra el `@beyondnet/evolith-cli@1.2.1` publicado, ejecutando la secuencia del README literalmente en un directorio limpio. El paso 5, `evolith scaffold --phase 1`, sale con 1 y `<proj>/src exists but is not an Nx workspace (no nx.json/package.json). Run \`evolith-cli init\` first to scaffold the base workspace.` — pero `init` ya se había ejecutado en el paso 2, y es quien creó ese `src/`. `scaffold.command.ts:296-305` resuelve el workspace al directorio `src/` y exige un `nx.json` o `package.json` DENTRO de él; `init` escribe `package.json` en la RAÍZ del proyecto y deja `src/` vacío. El consejo del mensaje de error es por tanto circular: le dice al usuario que ejecute el comando que acaba de ejecutar. `scaffold` no acepta `--dir`, así que no hay rodeo dentro de la secuencia documentada. Extraído de `GT-571` al ejecutar su primer criterio de aceptación en vez de asumirlo. **Seguimiento de la ola 2, 2026-07-28 — dos de tres criterios cumplidos, y el tercero es el de fondo.** La mitad de las banderas está corregida: `--phase` estaba declarada, documentada y se preguntaba INCONDICIONALMENTE, así que se descartaba en silencio en la ruta humana mientras `--frontend` y `--orm`, justo encima, sí se respetaban — por eso pasar banderas no hacía el comando ejecutable en un script. Ahora toda bandera declarada manda, la fase pasa por la misma canonicalización `toProgressivePhase` que la ruta JSON, y los valores con default DOCUMENTADO (`--api-name`, `--web-app-name`, `--host-name`, `--remotes`) resuelven a ese default en no-TTY en vez de rehusar: el exit 3 debe significar "esta ejecución necesita una decisión", nunca "no reescribiste un valor por defecto". Las decisiones reales sin default siguen rehusando, correctamente. **La precondición se corrigió en dirección contraria a mi primer intento, que estaba mal.** Primero la hice permisiva, y el resultado fue convertir un rechazo rápido y claro en un crash críptico de Nx (`Cannot read properties of null (reading 'useInferencePlugins')`) tras minutos instalando dependencias. `NxWorkspaceStrategy` ejecuta `npm` y `nx` dentro de `<cwd>/src`, así que ese directorio debe ser de verdad un workspace Nx; el guard ahora exige `nx.json` ahí — aceptar solo `package.json` era un falso positivo — y su mensaje nombra algo que sí lo crea, en vez de nombrar `init`, el comando que el usuario acaba de ejecutar. **El criterio 2 NO se cumple y es el alcance restante:** `init` y `scaffold` siguen sin coincidir, porque nada en el producto crea ese workspace Nx. Quién debería hacerlo — `init`, el propio `scaffold`, o un paso explícito — es una decisión de diseño, no algo que adivinar dentro de una precondición. Ambos READMEs ya lo dicen en vez de documentar un paso que no puede seguir al anterior. **CERRADO el 2026-07-28.** Aterrizó el criterio 2: `scaffold` ahora arranca el workspace Nx que necesita, así que puede ir detrás de `init` como el README siempre dio a entender. La precondición NO se hizo permisiva a propósito — un intento anterior lo hizo y convirtió un rechazo rápido y claro en un crash críptico de Nx tras minutos instalando dependencias; un `src/` ambiguo sigue ganándose el rechazo rápido. El sobre informa de si la ejecución creó el workspace o lo encontró, para que un consumidor máquina distinga un andamiaje sobre un workspace preexistente de uno que arrancó el suyo. |  |  | `Evolith CLI` | Cross | P1 | S | `COMPLETADO` |
 | [`GT-625`](./gap-reference-catalog.es.md#gt-625) | **El artefacto publicado no es instalable, y lo que lo tapa es el workspace.** Descubierto al PROBAR el criterio de aceptación de GT-571 contra el registro en vez de asumirlo. `npm i @beyondnet/evolith-cli@1.2.0` en un directorio limpio instala, y entonces `evolith-cli --version` muere con `MODULE_NOT_FOUND` en `@beyondnet/evolith-core-domain/application/paths/rulesets-location` — un import de subruta profunda que el `@beyondnet/evolith-core-domain` publicado no expone. En este repositorio ese mismo import resuelve, porque el symlink del workspace apunta al árbol de fuentes y no a lo que se empaquetó. Toda comprobación que hacemos es por tanto ciega a esto: la suite del CLI (1382 tests), la suite e2e y el tester exploratorio corren dentro del workspace. 1 de 36 especificadores `@beyondnet/*` que importa el `dist` publicado no resuelve en una instalación limpia; `src/sdk/cli/scripts/check-install-smoke.mjs`, escrito durante la Ola 2, es lo que lo detecta. Es la misma clase que el hallazgo de la auditoría de madurez de que un verde local no es evidencia — aquí el mecanismo de ocultación son los workspaces de npm y no un `dist` rancio o un directorio en gitignore. **CERRADO el 2026-07-28.** `core-domain@1.2.0`, `core@1.2.0`, `infra-providers@1.2.0`, `mcp@1.2.1` y `cli@1.2.1` están en el registro, los cinco con attestations. Verificado contra el REGISTRO, no contra un exit code: el tarball de core-domain contiene `application/paths/rulesets-location`, y en un directorio que jamás ha visto este workspace `cli --version` imprime 1.2.1 y el MCP arranca. **La puerta se pagó sola en su primer uso real**: paró la release antes de publicar el MCP y destapó un SEGUNDO paquete publicado roto que la auditoría no vio — `evolith-mcp@1.2.0` revienta al arrancar con `PatternCatalogService is not a constructor`, porque `evolith-core@1.1.0` no lo exporta. Dos paquetes publicados rotos por una sola causa; este se detectó antes de enviar, no cuatro días después. Se registra también porque cambia lo que es cierto: publicar core-domain@1.2.0 repara retroactivamente `cli@1.2.0`, cuyo rango `^1.1.0` ahora resuelve al hermano corregido — que es justo por lo que se estrecharon los rangos a `^1.2.0`, para que un resolutor no pueda volver a elegir 1.1.0. |  |  | `Evolith CLI` | Cross | P0 | M | `COMPLETADO` |
-| [`GT-624`](./gap-reference-catalog.es.md#gt-624) | **Extraído de [`GT-570`](./gap-reference-catalog.es.md#gt-570) para que su remanente quede registrado y no absorbido en un cierre.** 1.2.0 se publicó el 2026-07-27 con provenance y la exposición está cerrada para quien instale `latest` — pero dos de los tres criterios originales de GT-570 no se cumplen con eso, y fingir lo contrario es el patrón que este tablero lleva pillándose a sí mismo (GT-12, GT-568, GT-254, GT-424). **(a) Las versiones 1.1.0 no están deprecadas.** `npm install @beyondnet/evolith-mcp@1.1.0` sigue resolviendo la build anterior a la ola de seguridad del 2026-07-23, en silencio, y el CHANGELOG público nombra los ficheros vulnerables. Deprecar es un comando por paquete pero exige credenciales de npm, así que es acción del dueño: `npm deprecate @beyondnet/evolith-mcp@1.1.0 "Security fixes in 1.2.0 — see CHANGELOG"`, e igual para `evolith-cli@1.1.0` y `evolith-agent-runtime@1.1.0`. **(b) Ningún gate de release falla cuando un commit etiquetado de seguridad no está en el tag publicado.** Esa ausencia es exactamente lo que permitió que la ola siguiera sin publicar del 2026-07-23 al 2026-07-27 mientras `SECURITY.md` declaraba la línea 1.1.x "actively patched". No lo detectó nada; lo detectó una auditoría. Relacionado: `GT-623` — release-please deriva los saltos de versión de los mensajes de commit, y el tipo `security(...)` que usan 2 de los últimos 60 commits no es un tipo de Conventional Commits, así que no aporta nada al bump. Los dos defectos dejan que un cambio de seguridad no llegue a una versión, por caminos distintos. |  |  | `Infra` | Cross | P1 | S | `PENDIENTE` |
+| [`GT-624`](./gap-reference-catalog.es.md#gt-624) | **Extraído de [`GT-570`](./gap-reference-catalog.es.md#gt-570) para que su remanente quede registrado y no absorbido en un cierre.** 1.2.0 se publicó el 2026-07-27 con provenance y la exposición está cerrada para quien instale `latest` — pero dos de los tres criterios originales de GT-570 no se cumplen con eso, y fingir lo contrario es el patrón que este tablero lleva pillándose a sí mismo (GT-12, GT-568, GT-254, GT-424). **(a) Las versiones 1.1.0 no están deprecadas.** `npm install @beyondnet/evolith-mcp@1.1.0` sigue resolviendo la build anterior a la ola de seguridad del 2026-07-23, en silencio, y el CHANGELOG público nombra los ficheros vulnerables. Deprecar es un comando por paquete pero exige credenciales de npm, así que es acción del dueño: `npm deprecate @beyondnet/evolith-mcp@1.1.0 "Security fixes in 1.2.0 — see CHANGELOG"`, e igual para `evolith-cli@1.1.0` y `evolith-agent-runtime@1.1.0`. **(b) Ningún gate de release falla cuando un commit etiquetado de seguridad no está en el tag publicado.** Esa ausencia es exactamente lo que permitió que la ola siguiera sin publicar del 2026-07-23 al 2026-07-27 mientras `SECURITY.md` declaraba la línea 1.1.x "actively patched". No lo detectó nada; lo detectó una auditoría. Relacionado: `GT-623` — release-please deriva los saltos de versión de los mensajes de commit, y el tipo `security(...)` que usan 2 de los últimos 60 commits no es un tipo de Conventional Commits, así que no aporta nada al bump. Los dos defectos dejan que un cambio de seguridad no llegue a una versión, por caminos distintos. **CERRADO el 2026-07-30 — y la mitad que importaba era el gate, no las deprecaciones.** Criterio (a): `1.1.0` queda deprecada en seis paquetes (`evolith-cli`, `evolith-mcp`, `evolith-agent-runtime`, `evolith-core-domain`, `evolith-core`, `evolith-infra-providers`), con mensaje que nombra al sucesor; dos se dejaron aparte a propósito y el motivo es un hallazgo, no un recorte de alcance — `evolith-sdk@1.1.0` es lo que la línea publicada RESOLVÍA de verdad (ver `GT-634` (registrado aparte)) y `evolith-contracts@1.1.0` es la única versión de ese paquete. Criterios (b) y (c): `48-validate-security-publish-lag` le pregunta al **registry** qué está publicado — el tag `v*` más nuevo aquí es `v1.1.0` mientras npm sirve `1.2.2`, así que un gate basado en tags habría reportado un retraso inexistente —, localiza el commit donde se FIJÓ la versión publicada de cada paquete y falla ante cualquier commit posterior cuyo **tipo o scope** lo marque como seguridad. Rechaza la prosa a propósito: `fix(deps)!: … the security wave` es un arreglo de dependencias, y un gate que grita lobo se acaba apagando. **Se encontraron y corrigieron dos falsos negativos al construirlo, cada uno fijado con una fixture:** `git log -S` casaba también el commit que BORRÓ la cadena de versión, y tomar el commit MÁS NUEVO con la versión publicada permitía que un bump de dependencia posterior empujara la frontera y escondiera la ventana. El denominador corregido es 47 commits examinados en 8 paquetes, frente a 31 de la primera implementación. Observado en rojo por `43-validate-guard-negative-fixtures` (37/37), así que es una fixture que este repositorio ha VISTO fallar. |  |  | `Infra` | Cross | P1 | S | `COMPLETADO` |
 | [`GT-623`](./gap-reference-catalog.es.md#gt-623) | **El hook existe, está cableado, y no puede aplicar nada.** `.husky/commit-msg` ejecuta `npx --no -- commitlint --version`; cuando falla imprime `commitlint is not installed — skipping commit message lint` y sale con **éxito**. Verificado: `commitlint` no aparece ni en `dependencies` ni en `devDependencies` del `package.json` raíz, no hay `commitlint.config.*` ni `.commitlintrc*`, y no existe clave `commitlint` en `package.json`. Así que la rama `else` es la única que se ejecuta, en cada commit. Observado en vivo el 2026-07-27 al mergear `develop` en una rama de trabajo. **Qué depende de la convención que no aplica:** `CONTRIBUTING.md` y `.github/pull_request_template.md` exigen Conventional Commits en tres sitios, y —la parte que cuesta dinero— **release-please deriva los saltos de versión de los mensajes de commit**, cableado en `sdk-cli-release.yml` y `sdk-cli-ci.yml`. **Ya está derivando, y con consecuencia:** 2 de los últimos 60 commits no-merge usan el tipo `security(...)` (`security(fase-7): add Docker/K8s hardening checklist`, `security(fase-6): add executable security rulesets`), que no es un tipo de Conventional Commits. release-please no lo reconoce, así que **un commit que se anuncia como cambio de seguridad no aporta nada al salto de versión** — el mismo modo de fallo que [`GT-570`](./gap-reference-catalog.es.md#gt-570), donde una ola de seguridad sigue sin publicarse. Fix: instalar y configurar commitlint para que el hook tome su rama real, o borrar el hook y dejar de reclamar la convención. Fallar abierto es la peor de las tres opciones, porque produce la apariencia de enforcement. Si se quiere el tipo `security`, declararlo en la config y mapearlo a un bump — no dejarlo a un linter que nunca corre. **COMPLETADO (ola 2026-07-28).** commitlint está instalado, configurado y el hook toma su rama real — verificado en ambos sentidos: un mensaje `feat:` válido se acepta y uno malformado se **rechaza**. El tipo `security(...)` que usan commits reales aquí queda DECLARADO en la config con su significado de bump, en vez de dejarlo fallar el lint o ignorarse en silencio. **Este aterrizaje rompió el repositorio de tres formas antes de funcionar**, todas por respetar el agente correctamente sus paths: `package.json` ganó las dependencias y `package-lock.json` no, así que `npm ci` falló en todo el repo; el hook falló CERRADO sin commitlint, bloqueando cualquier commit; y `03-validate-root-cleanliness` rechazó el fichero nuevo en la raíz. Los tres reparados en la misma ola. La lección es sobre la ola, no sobre el fix: **quien pueda editar `package.json` debe poder editar también el lockfile**. |  |  | `Governance` | Cross | P2 | S | `COMPLETADO` |
 | [`GT-622`](./gap-reference-catalog.es.md#gt-622) | **Cada pull request arrastra un check `CodeQL` en rojo que dice "1 configuration not found", y no es un hallazgo de seguridad — es contabilidad huérfana.** GitHub conserva **82 análisis de code scanning** en `refs/heads/main` bajo la clave `.github/workflows/ci.yml:codeql`. Esa configuración existió de verdad: el commit `87f50ce3` añadió un job `codeql` a `ci.yml`, y `f50030cd` lo quitó el 2026-06-06 al vaciar ese workflow — el último análisis bajo esa clave es de ese mismo día. Como la configuración sigue *registrada* en `main` pero nada la produce, GitHub la reporta como ausente en cada PR. Lleva así 51 días. Verificado: `code-scanning/analyses?ref=refs/heads/main` devuelve tres claves — `ci.yml:codeql` (82, último 2026-06-06), `sdk-cli-ci.yml:codeql-analysis` (159, al día) y `sdk-cli-ci.yml:trivy-scan` (159, al día). El escaneo que importa está sano; `CodeQL SAST` pasa y es check requerido. **El workflow muerto ya está eliminado** (corría un job `Disabled` que sólo hacía `echo`, en cada PR y push a `main` y `develop`); borrar el fichero NO limpia la configuración registrada, y por eso existe esta fila. **La acción restante queda deliberadamente sin automatizar:** eliminar los 82 análisis vía `DELETE /repos/{owner}/{repo}/code-scanning/analyses/{id}` es irreversible y destruye historial de code scanning de una rama protegida. Su valor histórico es nulo —describen una configuración muerta desde junio— pero tirar historial de escaneo de seguridad es decisión del dueño, no de la herramienta. **Por qué importa más allá del ruido:** un check permanentemente rojo enseña a los revisores a descontar los checks rojos, y `CodeQL SAST` —que comparte el nombre CodeQL y SÍ es requerido— es precisamente el check que nadie se puede permitir aprender a ignorar. |  |  | `Infra` | Cross | P2 | XS | `PENDIENTE` |
 | [`GT-609`](./gap-reference-catalog.es.md#gt-609) | **Fuga de autorización en la superficie de descubrimiento.** `mcp-cache.service.ts:8` declara `toolsList: 'mcp:tools:list'` — una única clave literal, sin principal, tenant ni scope — y la lista se cachea ANTES de aplicar el filtro de scope. Así que el primer llamador que calienta la caché decide el inventario que ven todos los siguientes durante el TTL: un admin que la caliente publica el inventario con capacidad de escritura a los lectores. **Verificado aquí contra el código.** Fix: indexar la caché por principal (hash de scopes + tenant), o eliminarla — una superficie de descubrimiento que responde con la vista de otro principal es peor que una sin caché. Origen: hallazgo 4.2 del diagnóstico de producto (https://github.com/beyondnetcode/why-architecture/blob/main/docs/evolith-diagnostico-es.md). **COMPLETADO (ola 2026-07-28).** La caché de tools/list ya no responde con la vista de otro principal. Verificado con el test que importa y no con el formato de la clave: calentar como principal privilegiado, leer como uno sin privilegios, y asertar que el segundo sólo ve su inventario. mcp-server 409/409. |  |  | `MCP Server` | Cross | P0 | S | `COMPLETADO` |
@@ -64,7 +69,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida
 | [`GT-576`](./gap-reference-catalog.es.md#gt-576) | **La autoevaluación que un comprador lee primero es falsificable en diez minutos, y el documento se autoincrimina.** `maturity-assessment.md` define *Validated (Weight 1.0) — Passing all quality gates, tests, and active in CI/CD*, y acto seguido marca **Pillar 1 Security "Level 4 (Managed) / Validated"** citando Row-Level Security multi-tenant (ADR-0010) y audit trails inmutables vía CDC (ADR-0016): `grep -rniE 'row.level.security\|current_setting\(\|debezium\|change data capture'` sobre `src` devuelve **CERO ficheros**, y core-api no declara driver de base de datos ni ORM. El **Pillar 4** está marcado Level 4 / Validated citando "builds deterministas de monorepo vía Nx" — no existe `nx.json` ni dependencia `nx`. También afirma paridad dual-engine 8/8 mientras el gate cubre 3 topologías y el paquete publicado trae políticas para 5. (La cita obsoleta de `opossum` en Pillar 3 es otro asunto — ese pilar está honestamente marcado `Designed`.) Fix: degradar Pillar 1 a `Designed` con los ADRs listados como intención, borrar la cita de Nx, reportar paridad contra el artefacto publicado, y añadir una regla mecánica a `09-reconcile-maturity.mjs`: una capacidad solo puede marcarse `Validated` si su lista de evidencia contiene al menos una referencia `file:line` o un job de CI, nunca un ADR solo. **COMPLETADO (`44fe8dd3`):** cada afirmación del enunciado se re-verificó contra el árbol y todas se sostuvieron. Pillar 1 (Security) y Pillar 4 bajaron de `Validated` a `Designed` con sus ADRs listados como intención, la cita de Nx eliminada, y la paridad reportada contra el artefacto publicado — en AMBOS idiomas, estructuralmente idénticos. La clase de error queda mecánicamente bloqueada: `09-reconcile-maturity.mjs` rechaza cualquier capacidad `Validated` cuya evidencia no contenga `file:line` ni job de CI, y esa regla lleva un auto-test negativo que prueba que se pone roja ante una entrada deliberadamente mala. Verificado: `09-reconcile-maturity.mjs --check` ✅, `04-check-bilingual-parity.mjs` ✅, gobernanza 17/17. |  |  | `Governance` | Cross | P1 | S | `COMPLETADO` |
 | [`GT-577`](./gap-reference-catalog.es.md#gt-577) | **El artefacto que un cliente cablearía a su CI se lee como una herramienta rota aunque el gate funcione.** `.github/actions/evolith-validate/action.yml` lee `jq -r '.summary.violations // 0'`, pero el envelope real del CLI tiene claves de primer nivel `[success, data, meta]` con `data = {status, rulesChecked, issues, coreRef, timestamp}` — no existe `.summary`. Lo mismo aplica al fichero `--output` (`validate.command.ts:353-361` escribe el mismo `createSuccessEnvelope`). **Matiz importante: la action sí bloquea correctamente** — captura `EXIT_CODE`, pone `compliance-status=non-compliant` y sale 1 cuando `fail-on-violation=true`; lo roto es el contador y el texto del resumen del PR, que renderiza literalmente "Non-compliant -- 0 violation(s) found". Y `grep -rn 'evolith-validate' .github/` solo coincide dentro del propio README de la action: cero consumidores en los 12 workflows, así que no hay regresión posible. Fix: cambiar el path jq a `.data.issues \| map(select(.blocking)) \| length` y añadir un workflow en este repositorio que ejecute la action contra un satélite fixture no conforme, de modo que quede dogfooded y con test de regresión. **EN-PROGRESO (`44fe8dd3`):** el path `jq` ahora cuenta issues blocking del envelope ADR-0073 real en vez de leer una clave `.summary` que nunca existió, y `.github/workflows/evolith-validate-dogfood.yml` ejecuta la action contra un satélite fixture deliberadamente no conforme, de modo que la action queda por fin dogfooded. Validado por parseo YAML y ejecutando los scripts de sus steps localmente contra el CLI construido. **NO cerrado:** el workflow nunca se ha ejecutado en un runner de GitHub, así que por el estándar de esta propia auditoría el gate aún no está probado — un gate que nadie ha visto fallar es el defecto del que trata toda esta ola. Cerrarlo tras su primera corrida verde. Aparte, no está en el conjunto de checks requeridos, que es la acción de dueño de `GT-574`. **COMPLETADO (verificado contra la corrida de CI 30228607519, `develop`, 2026-07-27T00:56:37Z):** ambos jobs verdes — `Action contract (recorded envelopes)` y `Action vs non-conforming satellite`. El cierre NO es "el workflow está verde": el log lleva las dos aserciones que antes eran imposibles, `OK: 34 blocking violation(s) of 274 issue(s), agreeing with the report.` y `OK: the gate blocked as expected with 34 blocking violation(s).` Es decir, el contador es distinto de cero, concuerda con el fichero de reporte que escribe la action, `compliance-status` es `non-compliant`, y la mitad negativa — `fail-on-violation: true` DEBE hacer fallar el step — se ejercita en cada corrida. Cinco corridas verdes consecutivas. La action queda dogfooded y bajo regresión, que era la mitad más importante de este gap. Pendiente y registrado en otro sitio: el workflow no está en el conjunto de checks requeridos, que es configuración de branch protection. |  |  | `Infra` | Cross | P2 | XS | `COMPLETADO` |
 | [`GT-578`](./gap-reference-catalog.es.md#gt-578) | **Las dos causas raíz sistémicas detrás de la mayoría de hallazgos de la auditoría 2026-07-26, atacadas en el mecanismo y no instancia por instancia.** (a) *Literales de ruta*: la migración a `src/` movió código e imports pero no los cientos de cadenas de ruta en scripts de CI, pasos `run:` de workflows, constantes de evaluadores y values de Helm — el compilador detecta un módulo movido, nada detecta un fichero movido referenciado por una cadena, y una ruta que no resuelve produce silencio. Instancias vivas: `OpaEvaluator` hardcodeando `<corePath>/rulesets/opa/policy.wasm` (el motor OPA entero es no funcional contra el layout del Core); `upgrade` diffeando contra un `<corePath>/rulesets` inexistente; el config de fronteras del CLI guardando `src/domain`, `src/application`, `src/core`, ninguno de los cuales ha existido nunca; `sdk-cli-ci.yml:467` invocando un script inexistente cuyo homólogo real apunta a una ruta pre-refactor, así que "Winston Agentic Review" está muerto dos veces y reporta `success`. (b) *Pase vacuo*: el patrón ya existe en `34-boundary-guard-repository.mjs:57-73` ("A zero-file scan must never be reported as boundary guard passed") y como auto-test negativo en el gate de contrato del Tracker — está aplicado a 2 guards de ~46. Fix: un guard de ~40 líneas que resuelva contra disco todo literal de ruta; que cada guard publique su denominador y salga 1 ante un escaneo de cero elementos; que cada guard lleve una fixture deliberadamente mala que DEBE ponerlo rojo en CI; y que CI ejecute todos los `validationCommand` de `gap-closure-evidence.json`. **COMPLETADO (`44fe8dd3`):** `40-validate-path-literals.mjs` escanea scripts del harness, pasos `run:` de workflows y values de Helm, resuelve cada literal contra disco, publica su denominador (109 literales en 197 ficheros) y sale 1 ante un escaneo vacuo — obedece la disciplina que impone, con una fixture negativa en `node --test` (15 tests). Los dos defectos vivos que encontró están reparados: `sdk-cli-ci.yml:467` invocaba un `.harness/scripts/ci/13-agentic-code-review.mjs` inexistente (la ruta real está bajo `ci/agentic/`) y el argv de ese script apuntaba a un `packages/mcp-server/dist/main.js` pre-refactor — que es la razón por la que "Winston Agentic Review" reportaba `success` durante meses sin llegar nunca al servidor. Con ambos arreglados, el guard pasó de `--report` a su modo ESTRICTO por defecto en `ci-runner.mjs`, así que un literal muerto nuevo ahora FALLA la corrida de gobernanza. La mitad anti-vacua queda impuesta para este guard; extender el patrón a los otros ~45 guards queda como trabajo posterior. **NO cerrado:** dos de sus tres criterios siguen sin cumplirse — el patrón anti-pase-vacuo está impuesto solo para ESTE guard (faltan ~45), y los `validationCommands` del tablero todavía no se ejecutan en CI. El guard de literales de ruta sí está estricto, cableado y verde. **+2026-07-26 (ola 3) — aterrizaron dos guards nuevos; los criterios 2 y 3 avanzaron, ninguno cerró.** `42-validate-guard-denominators.mjs` clasifica los **54** guards de CI y asserta que ninguno puede pasar en silencio un escaneo de cero elementos (8/8 tests, exit 0). `41-validate-evidence-commands.mjs` por fin EJECUTA los `validationCommands` del tablero en vez de sólo comprobar que sean cadenas no vacías (27/27 tests), y reporta su denominador con honestidad: sobre **937 comandos registrados en 544 registros de cierre encuentra 290 referencias muertas**, e imprime `THIS IS NOT A PASS` en vez de salir verde con una cifra así. Está cableado en modo reporte con un trinquete `--max-dead 290` para que el conteo sólo pueda bajar. **Sigue abierto:** el criterio 3 exige muertas == 0, que es una migración de datos del fichero de evidencia (propiedad del tablero), no un cambio de guard; el criterio 2 exige una fixture negativa por guard, y clasificar no sustituye a eso. Las 290 referencias muertas son en sí un hallazgo: son el tamaño medido de la causa raíz C5 — un tablero que registra intención en vez de resultado. Ola 2: el criterio 2 pasa a exigirse por EJECUCIÓN — `43-validate-guard-negative-fixtures.mjs` apunta cada guard de barrido a un único árbol deliberadamente vacío y 32/32 se pusieron en rojo, 0 reportaron pase. Una fixture compartida en vez de 34 a medida, derivada de la clasificación de 42, así que el siguiente guard se ejercita el día que aterriza. Dos clases de falso-MUERTO en 41 reparadas y el ratchet vuelto independiente de la máquina (ahora imprime su propia base: 303, coincidente entre un portátil y el runner pese a diferir 15 en el conteo bruto). 43, 44 y 34 cableados en ci-cd.yml; ratchet bajado de 305 a 303. **AC3 intacto:** 288 referencias muertas, 198 nombrando workspaces previos al refactor — una migración de datos del fichero de evidencia. |  |  | `Governance` | Cross | P1 | M | `EN-PROGRESO` |
-| [`GT-580`](./gap-reference-catalog.es.md#gt-580) | `grep -rno "process.exit([0-9]*)" src/sdk/cli/src` devuelve **20 × `process.exit(1)` más 2 `process.exit()` sin argumento** — un único valor de fallo para un veredicto FAIL, un flag mal escrito, un fichero ausente o una caída de infraestructura, así que ningún consumidor puede ramificar por causa. Los diagnósticos comparten el canal máquina: **341 `console.log` frente a 115 `console.error`**. Y no hay salida incremental — no existe `--format ndjson` — así que un `validate` largo es opaco hasta que termina. Un harness de agente, un hook de pre-commit y un paso de CI tienen exactamente un primitivo en común (el código de salida del proceso) y el CLI hoy renuncia a usarlo. Fix: taxonomía publicada (`0` PASS · `2` error de uso · `3` **veredicto FAIL** · `1` fallo de infraestructura · `4` HITL requerido), todo diagnóstico a stderr, un stream de eventos NDJSON versionado, y la taxonomía gobernada por un ruleset propio con paridad Rego para que un comando nuevo no pueda romperla. **+ola 2026-07-28 — la taxonomía existe y su rotura de contrato está propagada.** `0` pasa · `1` fallo de herramienta · `2` bloqueado · `3` entrada inválida, impuesto centralmente en `BaseEvolithCommand.handleError` más un guard jest que rompe la build ante cualquier literal de salida fuera del conjunto. **La propagación se auditó en vez de suponerse:** un barrido de todo el repo no encontró NADA que interpretara `1` como "gate falló", así que no había rotura viva aquí — pero la composite action colapsaba todo lo no-cero en `non-compliant`, lo que **afirmaba que el repositorio de un cliente era no conforme cuando el CLI simplemente había reventado o se le había invocado mal**. Eso es el inverso de un gate que reporta verde sobre un repo sin evaluar, y es igual de falso. La action ahora reporta `error` / `invalid-input`, expone `exit-code`, falla el paso ante un no-veredicto ignorando `fail-on-violation`, y su resumen de PR dice "Not evaluated — esto no es un hallazgo sobre este repositorio". Sus tests pasaron de 11 a 13, reclasificados y no aflojados: cuatro casos eran veredictos bloqueados (ahora exit 2) y dos eran fallos de herramienta genuinos (siguen en exit 1, ahora `error`). Ambas guías publican la tabla de cuatro valores. **NO cerrado:** la disciplina stdout/stderr está intacta (341 `console.log` frente a 115 `console.error`), no hay flujo de eventos `--format ndjson`, y el tercer criterio pide un ruleset de paridad Rego mientras lo que aterrizó es un guard jest que sólo cubre este paquete. **Follow-up fuera de este repositorio:** el Tracker invoca el CLI y puede ramificar por su código de salida — no verificable desde aquí, hay que revisarlo en `evolith_tracker`. **Criterio 1 marcado el 2026-07-28 tras verificarlo:** `exit-code-taxonomy.spec.ts` publica exactamente cuatro códigos, separa un veredicto bloqueante de un Core inalcanzable y — la parte que sostiene el criterio — BARRE las fuentes de los comandos y comprueba que ninguna nombra un exit code fuera de `0`, `1`, `2` o `3`, con protección anti-vacua para que un verde sobre un barrido vacío no cuente como verde. 21/21. Quedan los criterios 2 y 3: no hay test que afirme que `--format json`/`ndjson` escribe datos solo en stdout con todo diagnóstico en stderr, ni un par ruleset+Rego que exija la taxonomía como gobierno en vez de como barrido de jest. |  |  | `Evolith CLI` | Cross | P1 | M | `EN-PROGRESO` |
+| [`GT-580`](./gap-reference-catalog.es.md#gt-580) | `grep -rno "process.exit([0-9]*)" src/sdk/cli/src` devuelve **20 × `process.exit(1)` más 2 `process.exit()` sin argumento** — un único valor de fallo para un veredicto FAIL, un flag mal escrito, un fichero ausente o una caída de infraestructura, así que ningún consumidor puede ramificar por causa. Los diagnósticos comparten el canal máquina: **341 `console.log` frente a 115 `console.error`**. Y no hay salida incremental — no existe `--format ndjson` — así que un `validate` largo es opaco hasta que termina. Un harness de agente, un hook de pre-commit y un paso de CI tienen exactamente un primitivo en común (el código de salida del proceso) y el CLI hoy renuncia a usarlo. Fix: taxonomía publicada (`0` PASS · `2` error de uso · `3` **veredicto FAIL** · `1` fallo de infraestructura · `4` HITL requerido), todo diagnóstico a stderr, un stream de eventos NDJSON versionado, y la taxonomía gobernada por un ruleset propio con paridad Rego para que un comando nuevo no pueda romperla. **+ola 2026-07-28 — la taxonomía existe y su rotura de contrato está propagada.** `0` pasa · `1` fallo de herramienta · `2` bloqueado · `3` entrada inválida, impuesto centralmente en `BaseEvolithCommand.handleError` más un guard jest que rompe la build ante cualquier literal de salida fuera del conjunto. **La propagación se auditó en vez de suponerse:** un barrido de todo el repo no encontró NADA que interpretara `1` como "gate falló", así que no había rotura viva aquí — pero la composite action colapsaba todo lo no-cero en `non-compliant`, lo que **afirmaba que el repositorio de un cliente era no conforme cuando el CLI simplemente había reventado o se le había invocado mal**. Eso es el inverso de un gate que reporta verde sobre un repo sin evaluar, y es igual de falso. La action ahora reporta `error` / `invalid-input`, expone `exit-code`, falla el paso ante un no-veredicto ignorando `fail-on-violation`, y su resumen de PR dice "Not evaluated — esto no es un hallazgo sobre este repositorio". Sus tests pasaron de 11 a 13, reclasificados y no aflojados: cuatro casos eran veredictos bloqueados (ahora exit 2) y dos eran fallos de herramienta genuinos (siguen en exit 1, ahora `error`). Ambas guías publican la tabla de cuatro valores. **NO cerrado:** la disciplina stdout/stderr está intacta (341 `console.log` frente a 115 `console.error`), no hay flujo de eventos `--format ndjson`, y el tercer criterio pide un ruleset de paridad Rego mientras lo que aterrizó es un guard jest que sólo cubre este paquete. **Follow-up fuera de este repositorio:** el Tracker invoca el CLI y puede ramificar por su código de salida — no verificable desde aquí, hay que revisarlo en `evolith_tracker`. **Criterio 1 marcado el 2026-07-28 tras verificarlo:** `exit-code-taxonomy.spec.ts` publica exactamente cuatro códigos, separa un veredicto bloqueante de un Core inalcanzable y — la parte que sostiene el criterio — BARRE las fuentes de los comandos y comprueba que ninguna nombra un exit code fuera de `0`, `1`, `2` o `3`, con protección anti-vacua para que un verde sobre un barrido vacío no cuente como verde. 21/21. Quedan los criterios 2 y 3: no hay test que afirme que `--format json`/`ndjson` escribe datos solo en stdout con todo diagnóstico en stderr, ni un par ruleset+Rego que exija la taxonomía como gobierno en vez de como barrido de jest. **+ola 2026-07-29 — criterios 2 y 3 cerrados para el canal JSON; un barrido reforzado encontró cuatro roturas más, miembros de la taxonomía pero incorrectas.** Criterio 2: `machine-channel.registry-sweep.spec.ts` le pregunta al propio registro de commander del CLI qué comandos declaran `--format` (no una lista a mano) y comprueba que los 32 encontrados escriben exactamente un documento JSON parseable en stdout con los diagnósticos en stderr — 32/32 limpios. Esto cierra la mitad de pureza stdout/stderr del criterio 2; el streaming `--format ndjson`, el cuarto pilar del fix original, sigue sin construirse. Criterio 3: la taxonomía ahora está gobernada por `src/rulesets/cli/exit-code-taxonomy.rules.json` con paridad Rego (`src/rulesets/opa/cli-exit-code-taxonomy.rego`, `opa test` 7/7) y un evaluador nativo (`cli-exit-taxonomy-rule.handler.ts`, 28/28 junto con `rule-corpus-triage.spec.ts`) — un comando nuevo ya no puede romper la taxonomía sin que falle un ruleset. **Reforzar el barrido sacó a la luz justo la clase de bug para la que existe:** al sumar `envelope.success === (status === 0)` junto a la pertenencia a la taxonomía aparecieron CUATRO comandos que eran miembros válidos de la taxonomía mientras contradecían su propio envelope — `sdlc gate-status` salía con 0 sobre un envelope `INTERNAL_ERROR` (un consumidor que ramifica por código lo lee como PASS), `alias` salía con 1 en vez de 3 ante un error de uso, el catch-all de `init-wizard` colapsaba un `NonInteractiveError` a `INTERNAL_ERROR`/1 antes de que llegara a `resolveExitCode`, y la rama JSON de `sdlc generate` hacía `return` antes de llegar a la asignación de `process.exitCode` que tenía debajo. Los cuatro se corrigieron enrutando por los helpers ya existentes `exitCodeForErrorCode`/`resolveExitCode`/`carriesCliExitCode` en vez de un literal fijo, y el barrido ahora exige esa coherencia para todo comando de aquí en más. Verificado: suite del CLI 101 suites/1446 tests, handler+triage de core-domain 28/28, `opa test` 7/7, `tsc --noEmit` limpio. [PR #278](https://github.com/beyondnetcode/evolith_arch32/pull/278). **Sigue abierto:** el flujo de eventos `--format ndjson`, y el seguimiento cross-repo del Tracker señalado arriba (no verificable desde este repo). |  |  | `Evolith CLI` | Cross | P1 | M | `EN-PROGRESO` |
 | [`GT-581`](./gap-reference-catalog.es.md#gt-581) | `grep -rn "outputSchema\\|structuredContent" src/packages/mcp-server/src` devuelve **0**, e igual `annotations` — sobre **50 tools anunciadas**, con el SDK `1.29.0`, que soporta las tres cosas. Todo llamante recibe por tanto un bloque de texto y debe reconstruir su forma por ingeniería inversa, y ningún cliente puede distinguir una tool de solo lectura (`evolith-adr-list`) de una destructiva (`evolith-satellite-create`) antes de invocarla. El draft de la especificación además relajó `inputSchema`/`outputSchema` para aceptar cualquier keyword de JSON Schema 2020-12 (SEP-2106) y pide a los servidores devolver `tools/list` en orden determinista para mejorar el acierto de caché de cliente y de prompt — dos ganancias gratis en la misma pasada. Fix: derivar `outputSchema` por tool desde `@beyondnet/evolith-contracts`, emitir `structuredContent`, añadir annotations `readOnlyHint`/`destructiveHint`/`idempotentHint`, y hacer determinista el orden de `tools/list`. Ola 2: las 50 herramientas declaran `outputSchema` y devuelven `structuredContent` que valida con el propio validador del SDK — incluso en las denegaciones FORBIDDEN, que es el resultado que un agente más necesita leer mecánicamente. Se genera de forma central desde la versión del sobre, así que no se puede registrar una herramienta sin contrato. **Salvedad que se arrastra, no se oculta:** la rama `data` queda declarada-pero-abierta en las 50; estrecharla exige esquemas por operación, que es GT-583. |  |  | `MCP Server` | Cross | P1 | M | `COMPLETADO` |
 | [`GT-582`](./gap-reference-catalog.es.md#gt-582) | Verificado directamente contra la especificación viva el 2026-07-26, no tomado de una fuente secundaria. La revisión **actual** del protocolo es `2025-11-25`; el **draft** elimina las sesiones a nivel de protocolo y la cabecera `Mcp-Session-Id` (SEP-2567), elimina el handshake `initialize`/`notifications/initialized` en favor de `_meta` por petición (SEP-2575), hace obligatorio `server/discover` (SEP-2575), sustituye las peticiones iniciadas por el servidor con el patrón **MRTR** — `InputRequiredResult`, un `resultType` obligatorio, e `inputResponses` en un reintento de la petición original (SEP-2322) —, deprecia Roots/Sampling/Logging (SEP-2577) y deprecia el Dynamic Client Registration en favor de Client ID Metadata Documents. En este repositorio: SDK `1.29.0`, **7 sitios con `sessionId`** bajo `src/packages/mcp-server/src`, y `grep -rn "well-known\\|oauth-protected-resource" src` devuelve 2 coincidencias no relacionadas, así que tampoco se sirve documento de metadatos de recurso protegido. MRTR importa más allá de la conformidad: es *la aprobación como protocolo*, y es la única forma en que el gate HITL sobrevive a la desaparición de las sesiones. **Corrección al documento origen, que esta fila registra en vez de repetir:** el documento etiqueta esta revisión como `2026-07-28` y la plantea como una emergencia a 3 días. Esa fecha no pudo confirmarse — la propia página de versionado de la especificación sigue nombrando `2025-11-25` como actual, describe la negociación como parte de `initialize`, y no publica fecha de release para el draft. El contenido técnico es real y está confirmado; la urgencia no. Esto es trabajo preparatorio contra un draft, a revisar en cada revisión de la especificación. |  |  | `MCP Server` | Cross | P1 | L | `PENDIENTE` |
 | [`GT-583`](./gap-reference-catalog.es.md#gt-583) | `TOOL_SCHEMAS` es un mapa escrito a mano en `src/sdk/cli/src/commands/api/api.catalog.ts:81`, las tools MCP declaran sus propios input schemas inline en código, y `buildCapabilityManifest` (GT-513) publica solo `evaluationKinds`, `engines`, `surfaces`, `supportedConsumers` y un `sha256` — **ningún esquema de entrada o salida por operación**. Así que "un registro genera las tres superficies" se afirma en prosa y se mantiene a mano. Aparte, **los 154 ficheros `*.schema.json` declaran `http://json-schema.org/draft-07/schema#`**, mientras el draft de MCP espera keywords de 2020-12 en los esquemas de tool — lo que convierte el pin en un bloqueo para GT-581 y no en una elección neutral. Fix: extender el manifiesto con `inputSchema`/`outputSchema` por operación, generar `TOOL_SCHEMAS` y los registros MCP desde él, y migrar el meta-esquema a 2020-12 compilando con el entry point 2020 de ajv. |  |  | `Evolith Core` | Cross | P1 | L | `PENDIENTE` |
@@ -650,7 +655,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida
 | [`GT-246`](./gap-reference-catalog.es.md#gt-246) | Implementar experimentos Chaos Mesh/Litmus |  |  | `QA` | Cross | P3 | L | `COMPLETADO` |
 
 
-**Progreso:** 595 / 635 completados · 14 en progreso · 22 pendientes · 4 diferidos
+**Progreso:** 600 / 640 completados · 14 en progreso · 22 pendientes · 4 diferidos
 
 **Oleada 2026-06-23 (auditoría profunda de Winston III):** Añadidos 14 gaps nuevos `GT-212`…`GT-225` del Winston Audit Playbook que cubren: higiene de estado ADR (GT-212), metadata + presupuestos operativos + corpus de guías por topología (GT-213, GT-217, GT-219), observabilidad + OpenAPI en controladores REST (GT-214, GT-215), paridad de input-schemas OPA + densidad de tests por topología (GT-216, GT-222), plantillas de rollback + on-call de Fase 05 (GT-218), cobertura de ramas CLI + paridad de envelope --format + limpieza de skip-list (GT-220, GT-224, GT-225), audit logging HTTP de MCP (GT-221), y tests e2e de paridad cross-surface (GT-223).
 
diff --git a/reference/core/control-center/gaps/gap-tracking.md b/reference/core/control-center/gaps/gap-tracking.md
index c79ae94ec..27fb9fcc4 100644
--- a/reference/core/control-center/gaps/gap-tracking.md
+++ b/reference/core/control-center/gaps/gap-tracking.md
@@ -13,8 +13,13 @@ This board is the single source of truth for technical debt, gaps, opportunities
 
 | ID | Gap | What it means | Example | Component | Phase | Criticality | Complexity | Status |
 |---|---|---|---|:---:|:---:|:---:|:---:|:---:|
-| [`GT-636`](./gap-reference-catalog.md#gt-636) | **Three CI checks were red on PR #275 — `Security Audit`, `E2E Tests`, `Evolith Core Validation` — and all three were real, fixable defects, not the accepted debt any of them first looked like.** `Evolith Core Validation` failed at `Bilingual Terminology Lint` (2 of 5 flagged terms were genuine untranslated prose; the other 3 were table/citation cells where translating only the flagged term would have made the document less consistent). `E2E Tests` failed on 1 of 132 tests calling two CLI flags (`--architecture --arch-level F1`) that never existed — the real flag is `-a, --arch`. `Security Audit` reported 31 `npm audit` findings (29 high, 2 moderate); investigation traced them to a SINGLE root cause — a `brace-expansion` DoS advisory (`GHSA-mh99-v99m-4gvg`, affecting every version `<=5.0.7`, patched only in `5.0.8`, published after this repo's existing `overrides.brace-expansion: "2.1.2"` was set) propagating severity up through the entire jest/eslint/`@nestjs/cli` devDependency toolchain, plus one independent `fast-uri` finding. **CLOSED 2026-07-29, all three.** Terminology and E2E fixed as described in their own prior closure note. `Security Audit`: root `overrides.brace-expansion` bumped `2.1.2` → `5.0.8`, plus a new `overrides.fast-uri: "3.1.4"` (in-range of `ajv`'s own `^3.0.1`) — a 2-line `package.json` diff. Getting there required real forensics: a plain `npm install` left 4 of the 10 tree positions pinned to a STALE lockfile-recorded version regardless of the new override, requiring the specific `packages` entries to be deleted from `package-lock.json` before a fresh `npm install` would honor the override at all; a SCOPED nested override (`"eslint": {"brace-expansion": ...}`) made the fix WORSE, not better — once a package has a nested override object for even one unrelated dependency (`ajv`), npm stops the ROOT-level unscoped rule from cascading into that subtree at all, so the working fix is the plain top-level override with NO nested entry competing for the same package. 0 high / 0 critical confirmed with the exact CI command (`npm audit --audit-level=high`, exit 0) in an isolated clean environment (a scratch worktree with a real, non-symlinked `node_modules`, since this session's own earlier per-package symlink farm was independently confirmed to corrupt dependency-graph tooling). 2 moderate remain, deliberately not chased: a Windows-only path-traversal in `@hono/node-server`'s `serve-static`, irrelevant to this repo's Linux CI/deployment, whose fix requires bumping an EXACT-PINNED production dependency (`@modelcontextprotocol/sdk`) rather than a devDependency override. Verified beyond the audit: full `core-domain` (1442/1442), CLI unit (1436/1436) and E2E (132/132, rebuilding every workspace dependency first, exactly as CI's own job does) and `mcp-server` (433/437, 4 pre-existing skips) suites all green against the fixed tree. |  |  | `Cross` | Cross | P2 | S  | `DONE` |
+| [`GT-640`](./gap-reference-catalog.md#gt-640) | **The guard compared the snapshot against six numbers copied out of the snapshot, so it could only ever pass — and the file it was failing to guard is stamped onto 388 rows of a larger artifact.** `native-evaluability-snapshot.json` declared in its own header that it was "a CAPTURED SNAPSHOT, not the source of truth". **No capture script existed.** It was hand-maintained and it drifted: it pinned `documentation-only: 129` while Core pinned 136, and went on calling rules `unimplemented-native` after they had handlers. Its guard in `iso-5055-mapping.test.mjs` asserted the snapshot's six class counts against six numbers typed into the test — the same six literals the snapshot already contained. **Expected value and actual value were copies of each other**, so the assertion held for as long as the file was unchanged, whatever Core actually pinned; it reported an agreement it never checked, which is worse than no guard, because the row it protects reads as verified. **The drift does not stay where it starts.** `build-iso-5055-mapping.mjs` stamps `nativeEvaluability` onto EVERY row of the ISO/IEC 5055 mapping from that file — 388 rows after the recapture, 381 before — so one stale class is laundered into a derived artifact five times the size of its input, and overstates the handler backlog that is [`GT-598`](./gap-reference-catalog.md#gt-598)'s entire deliverable. The recapture→rebuild order was written down nowhere, and the mapping's own guard ran in **no workflow at all**. **FIXED 2026-07-29:** a capture script that runs Core's REAL triage through `ts-node` instead of reimplementing the classification, the measurement extracted out of the jest spec into `test/rule-corpus-triage.ts` so a script can reach it — that unreachability is why the file was maintained by hand — snapshot-vs-fresh-triage assertions in both directions, a documentation-job guard that reads Core's pinned counts OUT of the spec and **throws** when the literal is missing or reshaped, and both steps declared as links in the [`GT-630`](./gap-reference-catalog.md#gt-630) derived-artifact chain. **Recaptured on 2026-07-29 after merging the fix into the current line, and the drift had grown while it was in flight:** `native-handler` 139 → 151, `documentation-only` 129 → 136, the handler backlog 60 → **48**, corpus 379 → 386, mapping 381 → 388 rows. Twelve of those handlers were closed by [`GT-595`](./gap-reference-catalog.md#gt-595) and [`GT-632`](./gap-reference-catalog.md#gt-632) while the hand-maintained snapshot went on reporting them as backlog — the defect demonstrating itself one more time, on numbers nobody typed twice. **RENUMBERED GT-633 -> GT-640 on 2026-07-30**, after `49-validate-gap-id-allocation` found that `GT-633` already named a different gap on `develop` (`evolith init` scaffolding, `c8270e48`, registered a day earlier). The newer row moves, per the guard's own advice. |  |  | `Governance` | Cross | P1 | S | `DONE` |
+| [`GT-639`](./gap-reference-catalog.md#gt-639) | **Nothing makes in-flight work visible across branches, so the same gap gets fixed twice.** On 2026-07-30 the same work was done twice, three separate times, by sessions that could not see each other: [`GT-640`](./gap-reference-catalog.md#gt-640) (registered as GT-633 at the time) fixed by a standalone capture script on `main` (#276) AND by an independent in-spec renderer on `develop` (#279) — both correct, both recapturing the same numbers, and two generators for one artifact is GT-640's own defect one level up, so a third session spent a full reconciliation collapsing them; the evidence guard's parser fixed twice (`d1ea72a3` on main, `5acb29ed` on develop); and a GT id allocated twice, forcing the renumber behind [`GT-638`](./gap-reference-catalog.md#gt-638). **The cost is not the merge conflict** — it is the duplicated work before anyone reached it, plus the reconciliation, which itself introduced a defect (an order-sensitive comparison that rewrote the capture date every run, invisible for a day because both runs stamped the same date). A row carries a status but not WHO is working it or WHERE, so two sessions can both read `PENDING` and both start, correctly. **The single-driver convention already exists; what is missing is any mechanism that makes it observable**, so on a busy day it degrades silently. |  |  | `Governance` | Cross | P2 | M | `PENDING` |
+| [`GT-638`](./gap-reference-catalog.md#gt-638) | **The board has no id allocator, so two parallel branches hand out the same GT number.** An id is chosen by reading the highest `GT-*` on the branch you happen to be on, and nothing contrasts that with any other branch — so two sessions in parallel allocate the same number and one finds out at merge time. It already happened: `8449af3d` on `develop` reads *"renumber the ratchet fix GT-634 -> GT-637, ID collision with develop"*; that row and [`GT-634`](./gap-reference-catalog.md#gt-634) on `main` took the same id within hours, from sessions that could not see each other. **The renumber is manual and lossy**, which costs more than the clash: an id lives in the board row, the catalog anchor, the closure-evidence record, cross-references in both languages, commit messages and PR bodies — and only the first three are mechanically checkable. `08-validate-tracking` cannot help by construction: it validates within one working tree, and branches are outside its world. Not an isolated slip either — in the 2026-07-30 `develop` → `main` merge the same convergent-duplication pattern appears three times: GT-640 (then GT-633) fixed twice, the evidence guard's parser fixed twice, this id allocated twice. **CLOSED 2026-07-30 — and on its first real run it found a SECOND collision nobody knew about.** `49-validate-gap-id-allocation` compares every id's **Title:** on HEAD against the title the same id carries on the base branch; a different title on the same id is one number naming two gaps. Against `origin/develop` it reported **`GT-633`**: there it is "`evolith init` scaffolds a repository that cannot pass its own governance on the first run" (`c8270e48`, 2026-07-29), on main it was the tautological-guard row (`c3221276`, 2026-07-30), since renumbered to `GT-640`. The merge had not surfaced it. It refuses to guess which side is wrong — a retitle and a collision look identical from outside — so it names both. Wired into `Governance guards (GT-578)` with an explicit `git fetch` of the base, since a shallow CI checkout lacks it. Observed red by `43-validate-guard-negative-fixtures` (38/38). Still cannot see an id allocated on a branch with no open PR, and its `--verbose` output says so on every newly allocated id. |  |  | `Governance` | Cross | P2 | S | `DONE` |
 | [`GT-637`](./gap-reference-catalog.md#gt-637) | **The GT-578 dead-reference ratchet was stuck at 305 by two real bugs in the GUARD, not by the size of the evidence-record backlog it claimed to measure.** Fixing the PR that closed `GT-633` surfaced a `Governance guards (GT-578)` failure and, investigating it, an uncommitted, unfinished refactor already sitting in the working tree: `resolveCommand` called `npmScriptOperand(...)`, a function that was never defined, so the guard crashed with a `ReferenceError` on every invocation — even in plain report mode. Repairing that function (restoring, then correcting its behaviour) dropped the count from 309 to 78, which exposed the second bug: the corpus uses `npm run --workspace <path> <script>` throughout — the `--workspace` flag BEFORE the script name, a valid form `npm` accepts — and the resolver's script-name search had no notion that `--workspace` consumes the next token, so it mistook the workspace path itself for the script name and reported it undeclared. Both bugs were pre-existing; they were only VISIBLE together, because before the first fix the guard never got far enough to reach the second. **CLOSED 2026-07-29.** Both bugs fixed, dropping 309 → 52. The remaining ~290 pre-`src/`-refactor and pre-`product/`-move paths this job's own docstring names (`sdk/cli`, `apps/core-api`, `packages/*`, `reference/infrastructure/`, `reference/operations/`, the retired `@evolith/*` scope) were a DATA migration, not a code fix, and were already partially done in the uncommitted state found in the tree; the rest were completed the same way — 18 further substitutions, each verified against a real successor file on disk before being written, never guessed. That took 52 → 22. One more, `chat.command.ts`, was a real `wc -l` missing only its directory prefix (`src/sdk/cli/src/commands/chat/chat.command.ts`), confirmed to exist and closing 22 → 21. A third, unrelated defect was found and fixed on the way: `.harness/bin/opa` (15 of the original 309) is gitignored and downloaded by a separate CI step — same finding as `GT-632` on guard 47, a gitignored artifact absent on a clean checkout being mistaken for a wrong path — so `resolveCommand` now reports it `unchecked`, not `dead`, for any path under `.harness/bin/` or `dist/`. `--max-dead` moved from 305 to **21**, proven exact by observing the guard fail at 20. The residual 21 is genuinely retired or narrative, not a rename: a consolidated `.bmad-core/AGENTS.md` replacing per-agent files (2 records), the retired `evolith-bff` gateway (3), the retired `packages/mcp-tools` (2), two retired k8s manifests whose successors have different content entirely rather than a moved path (3), a retired sandbox app (1), three root-level `npm test`/`npm run info`/`npm run test:cov` invocations from before workspaces existed with no root-level successor (7), and three records where `vision/` or `tools/list` — an MCP JSON-RPC method name, not a filesystem path — are prose describing history, misparsed as path-shaped tokens (3). None of these were force-mapped to a plausible-looking target; a wrong rename would have been worse than an honest residual. 39/39 guard self-tests pass, including new coverage for both bugs and both negative twins (`--workspace` script-check still catches a truly undeclared script; a non-gitignored missing binary is still `dead`) so the fix cannot blind the guard the way it was meant not to. `08-validate-tracking`, `42`–`45` in the same job, and a full `--execute --verbose` run (report mode, pre-existing failures on 6 unrelated records, none among the paths touched here) all confirmed clean. |  |  | `.harness` | Cross | P1 | S  | `DONE` |
+| [`GT-636`](./gap-reference-catalog.md#gt-636) | **Three CI checks were red on PR #275 — `Security Audit`, `E2E Tests`, `Evolith Core Validation` — and all three were real, fixable defects, not the accepted debt any of them first looked like.** `Evolith Core Validation` failed at `Bilingual Terminology Lint` (2 of 5 flagged terms were genuine untranslated prose; the other 3 were table/citation cells where translating only the flagged term would have made the document less consistent). `E2E Tests` failed on 1 of 132 tests calling two CLI flags (`--architecture --arch-level F1`) that never existed — the real flag is `-a, --arch`. `Security Audit` reported 31 `npm audit` findings (29 high, 2 moderate); investigation traced them to a SINGLE root cause — a `brace-expansion` DoS advisory (`GHSA-mh99-v99m-4gvg`, affecting every version `<=5.0.7`, patched only in `5.0.8`, published after this repo's existing `overrides.brace-expansion: "2.1.2"` was set) propagating severity up through the entire jest/eslint/`@nestjs/cli` devDependency toolchain, plus one independent `fast-uri` finding. **CLOSED 2026-07-29, all three.** Terminology and E2E fixed as described in their own prior closure note. `Security Audit`: root `overrides.brace-expansion` bumped `2.1.2` → `5.0.8`, plus a new `overrides.fast-uri: "3.1.4"` (in-range of `ajv`'s own `^3.0.1`) — a 2-line `package.json` diff. Getting there required real forensics: a plain `npm install` left 4 of the 10 tree positions pinned to a STALE lockfile-recorded version regardless of the new override, requiring the specific `packages` entries to be deleted from `package-lock.json` before a fresh `npm install` would honor the override at all; a SCOPED nested override (`"eslint": {"brace-expansion": ...}`) made the fix WORSE, not better — once a package has a nested override object for even one unrelated dependency (`ajv`), npm stops the ROOT-level unscoped rule from cascading into that subtree at all, so the working fix is the plain top-level override with NO nested entry competing for the same package. 0 high / 0 critical confirmed with the exact CI command (`npm audit --audit-level=high`, exit 0) in an isolated clean environment (a scratch worktree with a real, non-symlinked `node_modules`, since this session's own earlier per-package symlink farm was independently confirmed to corrupt dependency-graph tooling). 2 moderate remain, deliberately not chased: a Windows-only path-traversal in `@hono/node-server`'s `serve-static`, irrelevant to this repo's Linux CI/deployment, whose fix requires bumping an EXACT-PINNED production dependency (`@modelcontextprotocol/sdk`) rather than a devDependency override. Verified beyond the audit: full `core-domain` (1442/1442), CLI unit (1436/1436) and E2E (132/132, rebuilding every workspace dependency first, exactly as CI's own job does) and `mcp-server` (433/437, 4 pre-existing skips) suites all green against the fixed tree. |  |  | `Cross` | Cross | P2 | S  | `DONE` |
+| [`GT-635`](./gap-reference-catalog.md#gt-635) | **The dead-reference ratchet has been over budget on main since 2026-07-28, so the governance job is permanently red.** `41-validate-evidence-commands --strict --max-dead 305` reports **309 dead references on a clean checkout**, so `Governance guards (GT-578)` exits 1 on every run of `ci-cd.yml` — observed on runs `30482497995`, `30470648146` and `30466280865`, all on `main` with nothing unmerged. The budget was set in `4a1b92d6` "where it was measured"; ten commits have edited `gap-closure-evidence.json` since, each adding `validationCommands`, and the count drifted past it. The ratchet's whole purpose is that dead references must not GROW, and it is reporting exactly that while being ignored, because a permanently red job reads as background noise — the same failure mode [`GT-622`](./gap-reference-catalog.md#gt-622) records for the orphaned CodeQL configuration. The next change that genuinely adds a dead reference will be indistinguishable from the four already there. **What not to do:** raise the budget to 309, which converts a breached ratchet into a ratified one. |  |  | `Governance` | Cross | P2 | S | `DONE` |
+| [`GT-634`](./gap-reference-catalog.md#gt-634) | **The published CLI and MCP resolve an SDK build that predates the security wave, because a caret range under 1.x pins it.** `@beyondnet/evolith-cli@1.2.1` and `@beyondnet/evolith-mcp@1.2.1` both declare `@beyondnet/evolith-sdk: ^1.1.0`, and that resolves to **exactly `1.1.0`** — the SDK publishes `1.0.0`, `1.1.0` and `2.0.0` and nothing in between, and a caret cannot cross a major. The dates are the finding: `sdk@1.1.0` was published 2026-07-18, `sdk@2.0.0` on 2026-07-27 as part of the release that closed [`GT-570`](./gap-reference-catalog.md#gt-570), and both consumers on 2026-07-28 — **after** 2.0.0 existed, still on the 1.x line. So the exposure GT-570 declared closed for "anyone installing `latest`" is not closed for this dependency. Stated precisely, because the stronger claim is unverified here: what is measured is the dates and the resolution, not the contents — this row does not assert that `sdk@1.1.0` carries a specific vulnerability. Found while executing [`GT-624`](./gap-reference-catalog.md#gt-624)'s deprecation criterion, which is what exposed the range: deprecating `sdk@1.1.0` would warn on every fresh install of the current line with no 1.x successor to offer.  **CLOSED 2026-07-30 — 1.2.2 is published, and the security framing of this row was WRONG.** A clean install of `@beyondnet/evolith-cli@latest` now resolves `@beyondnet/evolith-sdk@2.0.0` with the binary booting. But verifying criterion 2 refuted the premise: **none of the seven security-wave commits touches `src/packages/sdk-client` — zero files** — and the wave's own release commit names the three packages it affected (mcp, cli, agent-runtime). The SDK was republished alongside them, not fixed. What was real is a stale MAJOR pinned by a caret under 1.x plus a lockfile that nested the registry tarball where it shadowed the workspace link — the `GT-625` class, not a security exposure. The hedge written in when the row was opened is what made the correction cheap. |  |  | `Infra` | Cross | P1 | S | `DONE` |
 | [`GT-633`](./gap-reference-catalog.md#gt-633) | **`evolith init` produced a repository that fails its own first `evolith validate`, and only the GT-595 handlers made it visible.** With `MTN-05` and `GIT-08` given real handlers by the config-shaped slice, a freshly scaffolded satellite reported two blocking findings that were REAL verdicts rather than the GT-595 blocking-and-skipped invariant: the scaffold declared no `spec.boundedContexts`, and it wrote no commitlint configuration at all. The second is the sharper one — the corpus MANDATES Conventional Commits (`GIT-08`, `MUST`, `blocking`) and the product's own bootstrap command shipped a repository where nothing enforced them. Both were pinned by name in `rule-applicability.integration.spec.ts` precisely so that closing them would be visible. **CLOSED 2026-07-29, and the two halves were closed by OPPOSITE means, because they are not the same kind of defect.** `GIT-08` was a scaffold gap and nothing else: Conventional Commits bind from the first commit and the corpus already states the convention and its seven types verbatim, so there was nothing to decide and nothing to invent. `init` now emits all three legs the handler reads — `commitlint.config.mjs`, the commitlint packages in `devDependencies`, and (with `--features hooks`) a `.husky/commit-msg` running `npx --no-install commitlint`, so a missing tool is an ERROR rather than the silent skip `GT-623` found. Without `hooks` the config is still written and the result carries a warning saying nothing runs it, rather than leaving a file that looks like enforcement and is not. It is runtime-independent on purpose: commitlint is a Node tool, so a .NET or Python satellite gets a tooling-only `package.json` — which is what such repositories carry in practice and what the handler actually reads; emitting the config alone would have left the rule failing for every non-Node runtime. **`MTN-05` was NOT a scaffold gap, and emitting a `spec.boundedContexts` stanza would have been the wrong fix.** The rule's own description says the strategy MUST be defined "before Phase 2 Design", and a phase-0 scaffold has no bounded contexts to declare; satisfying it at `init` would have meant writing an INVENTED persistence decision into every new repository, after which `MTN-05` would pass for a reason nobody chose. Worse, per the handler's own note the two vocabularies are irreconcilable — `evolith-yaml.schema.json` restricts `persistence` to a database-engine enum under `additionalProperties: false` — so any value written either breaks the contract schema or cannot match the rule as worded. It carries `appliesFromSdlcPhase: 2` instead, which is the applicability fact the rule always stated in prose, and follows the `TAX-06` precedent (annotation plus a parallel rego). The rule is DEFERRED, not weakened, and that is asserted rather than assumed: a test walks phases 0→3 and requires it to bind again at Design. **A methodological finding worth more than the fix.** The premise did not reproduce on first contact: the suite resolves `@beyondnet/evolith-core-domain` through the workspace symlink to `dist/`, which was nine days stale, so both rules were reported `skipped` and the pinned assertion ALREADY read `[]`. A green run in that state would have "proved" the gap closed before a line was written — the same class as `GT-625` and `GT-632`, a pass that depends on untracked build state. It was reproduced only after re-anchoring `node_modules` at the worktree and rebuilding, and each rule was then verified individually rather than through the suite: `GIT-08` executes and PASSES (typescript and python), `MTN-05` is reported `notApplicable` rather than silently passing. |  |  | `Core Domain` | Cross | P1 | S  | `DONE` |
 | [`GT-632`](./gap-reference-catalog.md#gt-632) | **The MCP denied every tool in production from a path typo, and the evidence that it worked was untracked local state.** `abac-evaluator.ts:322` resolved the compiled policy at `<core>/sdk/cli/rulesets/opa/policy.wasm` — the PRE-`src/`-refactor path. The file lives at `src/sdk/cli/…`. When the stat fails the evaluator denies fail-closed in production, so on a clean checkout with `NODE_ENV=production` the compiled policy never loads and EVERY MCP tool is refused. It looked green because `policy.wasm` is gitignored: a stale file left at the old path by an earlier era made the load succeed locally, and the test that covers it passed against an artifact no fresh checkout would have. Same shape as `GT-625` — a green that depended on untracked state — but on the authorization path. Found on 2026-07-29 while investigating why `abac-rego-parity.spec.ts` had gone red; the rego itself was correct (`opa eval` returns `allow: true` for an architect in production). **`40-validate-path-literals` cannot see this class:** it scans string literals, and this is a `path.join(corePath, 'sdk', 'cli', …)` construction. Twelve such joins survive the refactor across `src/**` — the other eleven are in `opa-input-builder.ts` and `cli-release-rule.handler.ts`, where a wrong path produces a false NEGATIVE in an evaluator rather than a denial, which is quieter and no less wrong. **FIXED for the authorization path on 2026-07-29:** the evaluator now tries both locations, newest first — not sloppiness, but what keeps an already-deployed image working while the path is corrected. Reverting the fix turns `abac-rego-parity.spec.ts` red (1 of 11); with it, mcp-server is 434/434. The other eleven joins and the guard blind spot remain. **Criterion 2 CLOSED 2026-07-29 — and two of the eleven were wrong in a way the prefix alone would not have fixed.** Eight were plain survivors of the `src/` move and took the prefix. The other three were worse: two pointed at `sdk/cli/src/core/mcp/server.ts`, a file that left the CLI entirely when mcp-server became its own package (now `src/packages/mcp-server/src/mcp/mcp-server.service.ts`); and one asserted a per-package `package-lock.json`, which npm WORKSPACES forbids — there is exactly one lockfile, at the root, so that check could only ever be false. A rule nobody can satisfy is not a stricter rule. **The specs and parity fixtures encoded the old layout too** (`cli-release-readiness.fixture.json`, `mcp.fixture.json`), which is why they had stayed green over paths that do not exist: the fixture and the code agreed with each other and neither agreed with the repository. Both are corrected. core-domain 1367/1367, `28-native-evaluator-parity` exit 0. **Criterion 3 CLOSED 2026-07-29 — the guard's first run was mostly wrong, which is the finding.** `47-validate-joined-paths` reported 19 broken paths; only 3 were defects. The other 16 would each have been made WORSE by a fix: six had base `root`, a PARAMETER naming the customer workspace under evaluation, so correcting them would break evaluation for every satellite; nine were members of FALLBACK CHAINS that are correct when one of four layouts resolves, and the natural way to silence those is to delete the fallbacks, breaking deployed images; one was a PROHIBITION whose absence IS the passing state, so correcting it would have inverted the rule. Chains are now detected structurally (array siblings, or the arms of a ternary); prohibitions cannot be, so they carry a written reason. The three real defects: `opa-evaluator.ts` resolved `policy.wasm` and the input schemas without the `src/` prefix, same fail-closed class as the P0 above; `satellite-upgrade-diff.ts` probed `rulesets` behind an early return, reporting zero ruleset changes on every satellite upgrade; `artifact-path-resolver.ts` named an `adr-matrix.json` present in no layout. 11 negative fixtures, both anti-vacuous floors, and `43-validate-guard-negative-fixtures` OBSERVED it red across 36 guards. A known leniency (two joins as sibling arguments) is recorded in its header rather than hidden. |  |  | `MCP Server` | Cross | P0 | M  | `DONE` |
 | [`GT-631`](./gap-reference-catalog.md#gt-631) | **Carved out of [`GT-573`](./gap-reference-catalog.md#gt-573) so its cross-repo half is tracked rather than absorbed into a closure.** The Core half of GT-573's third criterion is done: `evaluation-context` and `evaluation-result` are pinned in `MACHINE_CONTRACT_SET` alongside `gate-evidence` and `output-envelope`, so a change to either shape now fails `10-validate-contract-conformance` instead of silently reaching consumers. What remains is in another repository and cannot be done from here: the **Tracker** must re-pin those two schemas in its own `contracts/evolith-core-contracts.json` with their sha256, bind the three published fixtures (`EVALUATION_RESULT_PASS/FAIL/OPA_GATE_FAIL`) in a DTO binding test, drop or document `resolvedTopology` (which the canonical result never carried), rename its gate `phase` to `phaseId`, and delete its fall-through to `SKIPPED` for a payload carrying a non-blank `overallVerdict`. Until it does, a Core-side shape change is caught here and still surprises the consumer. |  |  | `Evolith Tracker` | Cross | P1 | S | `PENDING` |
@@ -24,7 +29,7 @@ This board is the single source of truth for technical debt, gaps, opportunities
 | [`GT-627`](./gap-reference-catalog.md#gt-627) | **The committed ADR-conformance corpus was seven rulesets behind its own generator, and six of the seven are security standards.** Found on 2026-07-28 while regenerating for `GT-571`: `generate-adr-rulesets.mjs` wrote 133 rulesets where the repository had 126. The missing ones are ADR-0118 plus **ADR-0119 (API security configuration hardening), ADR-0120 (SSRF prevention), ADR-0121 (input validation and sanitization), ADR-0122 (shell execution safety), ADR-0123 (timing-safe comparison) and ADR-0124 (credential and secret management)** — accepted decisions with no conformance ruleset in the corpus at all, because nobody re-ran the generator after they were accepted. Nothing detected it: the generator prints a coverage figure but is not run with a `--check` in CI, so the corpus could drift from the ADR set indefinitely. This is the same shape as `GT-424` (a registry that drifts because only one direction is enforced) and `GT-607` (Accepted ADRs with no implementing code), and it is why `GT-595`'s pinned triage snapshot moved: 143 non-executable to 150, 126 ADR-conformance rules to 133. **CLOSED 2026-07-28.** The generator had supported `--check` since it was written; nothing ever ran it, which is the whole gap — the same shape as `GT-424`, where a guard existed and was not enforced. It now runs in `Validate documentation`, a REQUIRED check, so an accepted ADR without a generated ruleset blocks the merge instead of waiting for someone to regenerate by hand. Two things were repaired on the way. **The generator's own self-test was red and had been for some time**, on two paths that lost their `src/` prefix in the refactor — one of the eight pre-existing failures the wave-2 verifier catalogued; it is 8/8 now and runs in the same required job. **`--check` could report a pass over nothing**: `drift === 0` across an empty ADR tree is not "no drift", it is "nothing was compared", so it now fails on a zero-ADR scan and prints the denominator it compared (`--check passed: 140 ADR(s), no drift`). The negative fixture removes a real generated ruleset, asserts the check goes red, and restores the tree — a guard nobody has seen fail is the defect this board keeps finding in itself. |  |  | `Governance` | Cross | P1 | S | `DONE` |
 | [`GT-626`](./gap-reference-catalog.md#gt-626) | **The README's own quickstart does not complete, and the two commands disagree about what `init` produces.** Measured 2026-07-28 against the published `@beyondnet/evolith-cli@1.2.1`, running the README sequence literally in a clean directory. Step 5, `evolith scaffold --phase 1`, exits 1 with `<proj>/src exists but is not an Nx workspace (no nx.json/package.json). Run \`evolith-cli init\` first to scaffold the base workspace.` — but `init` had already run at step 2, and it is what created that `src/`. `scaffold.command.ts:296-305` resolves the workspace to the `src/` directory and requires an `nx.json` or `package.json` INSIDE it; `init` writes `package.json` at the project ROOT and leaves `src/` bare. The advice in the error message is therefore circular: it tells the user to run the command they just ran. `scaffold` accepts no `--dir`, so there is no workaround from the documented sequence. Carved out of `GT-571` when its first acceptance criterion was executed rather than assumed. **Wave 2 follow-up, 2026-07-28 — two of three criteria met, and the third is the real one.** The flag half is fixed: `--phase` was declared, documented and prompted for UNCONDITIONALLY, so it was silently discarded on the human path while `--frontend` and `--orm` directly above it were honoured — which is why supplying flags did not make the command scriptable. Every declared flag is now authoritative, the phase goes through the same `toProgressivePhase` canonicalisation as the JSON path, and values with a DOCUMENTED default (`--api-name`, `--web-app-name`, `--host-name`, `--remotes`) resolve to that default on a non-TTY instead of refusing: exit 3 should mean "this run needs a decision", never "you did not retype a default". Genuine choices with no default still refuse, correctly. **The precondition was corrected in the opposite direction to my first attempt, which was wrong.** I first made it permissive, and the result was that a fast, clear refusal became a cryptic Nx crash (`Cannot read properties of null (reading 'useInferencePlugins')`) after a minutes-long dependency install. `NxWorkspaceStrategy` runs `npm` and `nx` inside `<cwd>/src`, so that directory must genuinely be an Nx workspace; the guard now requires `nx.json` there — `package.json` alone was a false accept — and its message names something that actually creates one instead of naming `init`, the command the user just ran. **Criterion 2 is NOT met and is the remaining scope:** `init` and `scaffold` still disagree, because nothing in the product creates that Nx workspace. Who should — `init`, `scaffold` itself, or an explicit step — is a design decision, not something to guess at inside a precondition. Both READMEs now say so instead of documenting a step that cannot follow the previous one. **CLOSED 2026-07-28.** Criterion 2 landed: `scaffold` now bootstraps the Nx workspace it needs, so it can follow `init` as the README always implied. The precondition was deliberately NOT made permissive — an earlier attempt did that and turned a fast, clear refusal into a cryptic Nx crash after a minutes-long dependency install; an ambiguous `src/` still earns the fast refusal. The envelope reports whether the run created the workspace or found it, so a machine consumer can tell a scaffold into a pre-existing workspace from one that bootstrapped its own. |  |  | `Evolith CLI` | Cross | P1 | S | `DONE` |
 | [`GT-625`](./gap-reference-catalog.md#gt-625) | **The published artifact is not installable, and the workspace is what hides it.** Found by GT-571's acceptance criterion being TESTED against the registry instead of assumed. `npm i @beyondnet/evolith-cli@1.2.0` in a clean directory installs, and then `evolith-cli --version` dies with `MODULE_NOT_FOUND` on `@beyondnet/evolith-core-domain/application/paths/rulesets-location` — a deep subpath import that the published `@beyondnet/evolith-core-domain` does not expose. In this repository the same import resolves, because the workspace symlink points at the source tree rather than at what was packed. Every check we run is therefore blind to it: the CLI suite (1382 tests), the e2e suite and the exploratory tester all run inside the workspace. 1 of 36 `@beyondnet/*` specifiers imported by the shipped `dist` fails to resolve on a clean install; `src/sdk/cli/scripts/check-install-smoke.mjs`, written during Wave 2, is what detects it. This is the same class as the maturity audit's finding that a green local run is not evidence — here the hiding mechanism is npm workspaces rather than a stale `dist` or a gitignored directory. **CLOSED 2026-07-28.** `core-domain@1.2.0`, `core@1.2.0`, `infra-providers@1.2.0`, `mcp@1.2.1` and `cli@1.2.1` are on the registry, all five with attestations. Verified against the REGISTRY, not an exit code: the core-domain tarball contains `application/paths/rulesets-location`, and in a directory that has never seen this workspace `cli --version` prints 1.2.1 and the MCP boots. **The gate paid for itself on its first real run**: it stopped the release before publishing the MCP and exposed a SECOND broken published package the audit had missed — `evolith-mcp@1.2.0` crashes at boot with `PatternCatalogService is not a constructor`, because `evolith-core@1.1.0` does not export it. Two published packages were broken by one cause; this one was caught before shipping instead of four days after. Also recorded because it changes what is true: publishing core-domain@1.2.0 retroactively repairs `cli@1.2.0`, whose `^1.1.0` range now resolves to the fixed sibling — which is exactly why the ranges were tightened to `^1.2.0`, so a resolver can never pick 1.1.0 again. |  |  | `Evolith CLI` | Cross | P0 | M | `DONE` |
-| [`GT-624`](./gap-reference-catalog.md#gt-624) | **Carved out of [`GT-570`](./gap-reference-catalog.md#gt-570) so its remainder is tracked rather than absorbed into a closure.** 1.2.0 shipped on 2026-07-27 with provenance and the exposure is closed for anyone installing `latest` — but two of GT-570's three original criteria are not met by that, and pretending otherwise is the pattern this board keeps catching in itself (GT-12, GT-568, GT-254, GT-424). **(a) The 1.1.0 versions are not deprecated.** `npm install @beyondnet/evolith-mcp@1.1.0` still resolves the build that predates the 2026-07-23 security wave, silently, and the public CHANGELOG names the vulnerable files. Deprecating is one command per package but requires npm credentials, so it is an owner action: `npm deprecate @beyondnet/evolith-mcp@1.1.0 "Security fixes in 1.2.0 — see CHANGELOG"`, likewise for `evolith-cli@1.1.0` and `evolith-agent-runtime@1.1.0`. **(b) No release gate fails when a security-tagged commit is absent from the published tag.** That absence is exactly what let the wave sit unpublished from 2026-07-23 to 2026-07-27 while `SECURITY.md` declared the 1.1.x line "actively patched". Nothing detected it; an audit did. Related: `GT-623` — release-please derives version bumps from commit messages, and the `security(...)` type used by 2 of the last 60 commits is not a Conventional Commits type, so it contributes nothing to a bump. Both defects let a security change fail to reach a version, by different routes. |  |  | `Infra` | Cross | P1 | S | `PENDING` |
+| [`GT-624`](./gap-reference-catalog.md#gt-624) | **Carved out of [`GT-570`](./gap-reference-catalog.md#gt-570) so its remainder is tracked rather than absorbed into a closure.** 1.2.0 shipped on 2026-07-27 with provenance and the exposure is closed for anyone installing `latest` — but two of GT-570's three original criteria are not met by that, and pretending otherwise is the pattern this board keeps catching in itself (GT-12, GT-568, GT-254, GT-424). **(a) The 1.1.0 versions are not deprecated.** `npm install @beyondnet/evolith-mcp@1.1.0` still resolves the build that predates the 2026-07-23 security wave, silently, and the public CHANGELOG names the vulnerable files. Deprecating is one command per package but requires npm credentials, so it is an owner action: `npm deprecate @beyondnet/evolith-mcp@1.1.0 "Security fixes in 1.2.0 — see CHANGELOG"`, likewise for `evolith-cli@1.1.0` and `evolith-agent-runtime@1.1.0`. **(b) No release gate fails when a security-tagged commit is absent from the published tag.** That absence is exactly what let the wave sit unpublished from 2026-07-23 to 2026-07-27 while `SECURITY.md` declared the 1.1.x line "actively patched". Nothing detected it; an audit did. Related: `GT-623` — release-please derives version bumps from commit messages, and the `security(...)` type used by 2 of the last 60 commits is not a Conventional Commits type, so it contributes nothing to a bump. Both defects let a security change fail to reach a version, by different routes. **CLOSED 2026-07-30 — and the half that mattered was the gate, not the deprecations.** Criterion (a): `1.1.0` is deprecated on six packages (`evolith-cli`, `evolith-mcp`, `evolith-agent-runtime`, `evolith-core-domain`, `evolith-core`, `evolith-infra-providers`), each message naming the successor; two were deliberately left alone and the reason is a finding rather than a scope cut — `evolith-sdk@1.1.0` is what the published line actually RESOLVED (see `GT-634` (registered separately)) and `evolith-contracts@1.1.0` is that package's only version. Criteria (b) and (c): `48-validate-security-publish-lag` asks the **registry** what is published — the newest `v*` tag here is `v1.1.0` while npm serves `1.2.2`, so a tag-based gate would have reported a lag that does not exist — finds the commit where each package's published version was SET, and fails on any later commit whose **type or scope** marks it as security. It refuses prose on purpose: `fix(deps)!: … the security wave` is a dependency fix, and a gate that cries wolf gets switched off. **Two false negatives were found and fixed while building it, each pinned by a fixture:** `git log -S` matched the commit that DELETED a version string as well as the one that added it, and taking the NEWEST commit at the published version let a later dependency bump push the boundary forward and hide the window. The corrected denominator is 47 commits examined across 8 packages, against 31 for the first implementation. Observed red by `43-validate-guard-negative-fixtures` (37/37), so the fixture is one this repository has SEEN fail. |  |  | `Infra` | Cross | P1 | S | `DONE` |
 | [`GT-623`](./gap-reference-catalog.md#gt-623) | **The hook exists, is wired, and cannot enforce anything.** `.husky/commit-msg` runs `npx --no -- commitlint --version`; when that fails it prints `commitlint is not installed — skipping commit message lint` and exits **successfully**. Verified: `commitlint` appears in neither `dependencies` nor `devDependencies` of the root `package.json`, there is no `commitlint.config.*` or `.commitlintrc*`, and no `commitlint` key in `package.json`. So the else-branch is the only branch that ever runs, on every commit. Observed live on 2026-07-27 while merging `develop` into a feature branch. **What depends on the convention it does not enforce:** `CONTRIBUTING.md` and `.github/pull_request_template.md` mandate Conventional Commits in three places, and — the part that costs money — **release-please derives version bumps from commit messages**, wired into `sdk-cli-release.yml` and `sdk-cli-ci.yml`. **It is already drifting, with a consequence:** 2 of the last 60 non-merge commits use the type `security(...)` (`security(fase-7): add Docker/K8s hardening checklist`, `security(fase-6): add executable security rulesets`), which is not a Conventional Commits type. release-please does not recognise it, so **a commit that announces itself as a security change contributes nothing to the version bump** — which is the same failure mode as [`GT-570`](./gap-reference-catalog.md#gt-570), where a security wave sits unpublished. Fix: install and configure commitlint so the hook takes its real branch, or delete the hook and stop claiming the convention. Failing open is the worst of the three options, because it produces the appearance of enforcement. If the `security` type is wanted, declare it in the config and map it to a bump — do not leave it to a linter that never runs. **DONE (wave 2026-07-28).** commitlint is installed, configured and the hook takes its real branch — verified in both directions: a valid `feat:` message is accepted and a malformed one is **rejected**. The `security(...)` type used by real commits here is DECLARED in the config with its intended bump meaning rather than left to fail lint or be silently ignored. **This landing broke the repository three ways before it worked**, all from the agent correctly refusing to leave its owned paths: `package.json` gained the dependencies while `package-lock.json` did not, so `npm ci` failed repo-wide; the hook failed CLOSED with commitlint absent, blocking every commit; and `03-validate-root-cleanliness` rejected the new root file. All three repaired in the same wave. The lesson is about the wave, not the fix: **whoever may edit `package.json` must also be able to edit the lockfile**. |  |  | `Governance` | Cross | P2 | S | `DONE` |
 | [`GT-622`](./gap-reference-catalog.md#gt-622) | **Every pull request carries a red `CodeQL` check reading "1 configuration not found", and it is not a security finding — it is orphaned bookkeeping.** GitHub still has **82 code-scanning analyses** on `refs/heads/main` under the analysis key `.github/workflows/ci.yml:codeql`. That configuration was real: commit `87f50ce3` added a `codeql` job to `ci.yml`, and `f50030cd` removed it on 2026-06-06 while gutting that workflow — the last analysis under the key is from that same day. Because the configuration is still *recorded* on `main` but nothing produces it, GitHub reports it missing on every PR. It has done so for 51 days. Verified: `code-scanning/analyses?ref=refs/heads/main` returns three analysis keys — `ci.yml:codeql` (82, last 2026-06-06), `sdk-cli-ci.yml:codeql-analysis` (159, current) and `sdk-cli-ci.yml:trivy-scan` (159, current). The scanning that matters is healthy; `CodeQL SAST` passes and is a required check. **The dead workflow itself is already deleted** (it ran a no-op `Disabled` job on every PR and push to `main` and `develop`); deleting the file does NOT clear the recorded configuration, which is why this row exists. **The remaining action is deliberately not automated:** removing the 82 analyses via `DELETE /repos/{owner}/{repo}/code-scanning/analyses/{id}` is irreversible and destroys code-scanning history on a protected branch. Their historical value is nil — they describe a configuration dead since June — but discarding security-scan history is an owner decision, not a tooling one. **Why it matters beyond the noise:** a permanently red check trains reviewers to discount red checks, and `CodeQL SAST` — which shares the CodeQL name and IS required — is exactly the check nobody can afford to learn to ignore. |  |  | `Infra` | Cross | P2 | XS | `PENDING` |
 | [`GT-609`](./gap-reference-catalog.md#gt-609) | **Authorization leak in the discovery surface.** `mcp-cache.service.ts:8` declares `toolsList: 'mcp:tools:list'` — a single literal key, with no principal, tenant or scope in it — and the list is cached BEFORE the scope filter runs. So the first caller to warm the cache decides the inventory every subsequent caller sees for the TTL: an admin warming it publishes the write-capable inventory to readers. **Verificado aquí contra el código.** Fix: key the cache by principal (a hash of scopes + tenant), or delete the cache — a discovery surface that answers from another principal's view is worse than an uncached one. Origin: finding 4.2 of the product diagnostic (https://github.com/beyondnetcode/why-architecture/blob/main/docs/evolith-diagnostico-es.md). **DONE (wave 2026-07-28).** The tools/list cache no longer answers from another principal's view. Verified by the test that matters rather than by key format: warm the cache as a high-privilege principal, read as a low-privilege one, assert the second sees only its own inventory. mcp-server 409/409. |  |  | `MCP Server` | Cross | P0 | S | `DONE` |
@@ -64,7 +69,7 @@ This board is the single source of truth for technical debt, gaps, opportunities
 | [`GT-576`](./gap-reference-catalog.md#gt-576) | **The self-assessment a buyer reads first is falsifiable in ten minutes, and the document incriminates itself.** `maturity-assessment.md` defines *Validated (Weight 1.0) — Passing all quality gates, tests, and active in CI/CD*, then marks **Pillar 1 Security "Level 4 (Managed) / Validated"** citing multi-tenant Row-Level Security (ADR-0010) and immutable audit trails via CDC (ADR-0016): `grep -rniE 'row.level.security\|current_setting\(\|debezium\|change data capture'` over `src` returns **ZERO files**, and core-api declares no database driver or ORM. **Pillar 4** is marked Level 4 / Validated citing "deterministic monorepo builds via Nx" — no `nx.json` and no `nx` dependency exist. It also claims dual-engine 8/8 parity while the gate covers 3 topologies and the published package ships policies for 5. (Pillar 3's stale `opossum` citation is a different matter — that pillar is honestly marked `Designed`.) Fix: downgrade Pillar 1 to `Designed` with the ADRs listed as intent, delete the Nx citation, report parity against the published artifact, and add a mechanical rule to `09-reconcile-maturity.mjs`: a capability may only be marked `Validated` if its evidence list contains at least one `file:line` reference or CI job, never an ADR alone. **DONE (`44fe8dd3`):** every claim in the statement was re-verified against the tree and all held. Pillar 1 (Security) and Pillar 4 dropped from `Validated` to `Designed` with their ADRs listed as intent, the Nx citation deleted, and parity reported against the published artifact — in BOTH languages, structurally identical. The class of error is now mechanically blocked: `09-reconcile-maturity.mjs` rejects any `Validated` capability whose evidence contains no `file:line` and no CI job, and that rule ships with a negative self-test that proves it goes red on a deliberately bad input. Verified: `09-reconcile-maturity.mjs --check` ✅, `04-check-bilingual-parity.mjs` ✅, governance 17/17. |  |  | `Governance` | Cross | P1 | S | `DONE` |
 | [`GT-577`](./gap-reference-catalog.md#gt-577) | **The artifact a customer would wire into their CI reads as a broken tool even though the gate works.** `.github/actions/evolith-validate/action.yml` reads `jq -r '.summary.violations // 0'`, but the real CLI envelope has top-level keys `[success, data, meta]` with `data = {status, rulesChecked, issues, coreRef, timestamp}` — there is no `.summary`. The same applies to the `--output` file (`validate.command.ts:353-361` writes the same `createSuccessEnvelope`). **Important nuance: the action does block correctly** — it captures `EXIT_CODE`, sets `compliance-status=non-compliant` and exits 1 when `fail-on-violation=true`; what is broken is the counter and the PR summary text, which renders literally "Non-compliant -- 0 violation(s) found". And `grep -rn 'evolith-validate' .github/` matches only inside the action's own README: zero consumers across the 12 workflows, so no regression is possible. Fix: change the jq path to `.data.issues \| map(select(.blocking)) \| length` and add a workflow in this repository that runs the action against a non-conforming satellite fixture, so it is dogfooded and regression-tested. **IN-PROGRESS (`44fe8dd3`):** the `jq` path now counts blocking issues from the real ADR-0073 envelope instead of reading a `.summary` key that never existed, and `.github/workflows/evolith-validate-dogfood.yml` runs the action against a deliberately non-conforming satellite fixture so the action is finally dogfooded. Validated by YAML parse and by executing the action's step scripts locally against the built CLI. **NOT closed:** the workflow has never executed on a GitHub runner, so by this audit's own standard the gate is not yet proven — a gate that has never been seen failing is the defect this whole wave is about. Close it after its first green run. Separately, it is not in the required-checks set, which is the `GT-574` owner action. **DONE (verified against CI run 30228607519, `develop`, 2026-07-27T00:56:37Z):** both jobs green — `Action contract (recorded envelopes)` and `Action vs non-conforming satellite`. The closure is NOT "the workflow is green": the log carries the two assertions that were impossible before, `OK: 34 blocking violation(s) of 274 issue(s), agreeing with the report.` and `OK: the gate blocked as expected with 34 blocking violation(s).` So the counter is non-zero, it agrees with the report file the action writes, `compliance-status` is `non-compliant`, and the negative half — `fail-on-violation: true` MUST fail the step — is exercised on every run. Five consecutive green runs. The action is now dogfooded and under regression, which was the more important half of this gap. Remaining and tracked elsewhere: the workflow is not in the required-checks set, which is branch-protection configuration. |  |  | `Infra` | Cross | P2 | XS | `DONE` |
 | [`GT-578`](./gap-reference-catalog.md#gt-578) | **The two systemic root causes behind most findings of the 2026-07-26 audit, addressed at the mechanism rather than instance by instance.** (a) *Path literals*: the move to `src/` migrated code and imports but not the hundreds of path strings in CI scripts, workflow `run:` steps, evaluator constants and Helm values — the compiler catches a moved module, nothing catches a moved file referenced by a string, and a path that does not resolve produces silence. Live instances: `OpaEvaluator` hardcoding `<corePath>/rulesets/opa/policy.wasm` (the whole OPA engine is non-functional against the Core layout); `upgrade` diffing against a nonexistent `<corePath>/rulesets`; the CLI boundary config guarding `src/domain`, `src/application`, `src/core`, none of which has ever existed; `sdk-cli-ci.yml:467` invoking a nonexistent script whose real counterpart points at a pre-refactor path, so "Winston Agentic Review" is dead twice and reports `success`. (b) *Anti-vacuous pass*: the pattern already exists at `34-boundary-guard-repository.mjs:57-73` ("A zero-file scan must never be reported as boundary guard passed") and as a negative self-test in the Tracker contract gate — it is applied to 2 guards of ~46. Fix: a ~40-line guard resolving every path literal against disk; every guard publishes its denominator and exits 1 on a zero-element scan; every guard ships a deliberately bad fixture that MUST turn it red in CI; and CI executes every `validationCommand` in `gap-closure-evidence.json`. **DONE (`44fe8dd3`):** `40-validate-path-literals.mjs` scans harness scripts, workflow `run:` steps and Helm values, resolves each literal against disk, publishes its denominator (109 literals across 197 files) and exits 1 on a vacuous scan — it obeys the discipline it enforces, with a negative fixture in `node --test` (15 tests). Both live defects it found are repaired: `sdk-cli-ci.yml:467` invoked a nonexistent `.harness/scripts/ci/13-agentic-code-review.mjs` (real path under `ci/agentic/`) and that script's argv targeted a pre-refactor `packages/mcp-server/dist/main.js` — which is why "Winston Agentic Review" reported `success` for months while never reaching the server. With both fixed, the guard was flipped from `--report` to its default STRICT mode in `ci-runner.mjs`, so a new dead literal now FAILS the governance run. The anti-vacuous half is enforced for this guard; extending the pattern to the other ~45 guards remains follow-on work. **NOT closed:** two of its three criteria remain unmet — the anti-vacuous-pass pattern is enforced for THIS guard only (~45 others to go), and the board's `validationCommands` are still not executed in CI. The path-literal guard itself is strict, wired and green. **+2026-07-26 (wave 3) — two new guards landed; criteria 2 and 3 advanced, neither closed.** `42-validate-guard-denominators.mjs` classifies all **54** CI guards and asserts none can pass a zero-element scan silently (8/8 unit tests, exit 0). `41-validate-evidence-commands.mjs` finally EXECUTES the board's `validationCommands` instead of only checking they are non-empty strings (27/27 unit tests), and it reports its denominator honestly: over **937 recorded commands across 544 closure records it finds 290 dead references**, and it prints `THIS IS NOT A PASS` rather than exiting green on a number that large. It is wired in report mode with a `--max-dead 290` ratchet so the count can only go down. **Still open:** criterion 3 needs dead == 0, which is a data migration of the board-owned evidence file, not a guard change; criterion 2 needs a negative fixture per guard, which classification does not substitute for. The 290 dead references are themselves a finding: they are the measured size of root cause C5 — a board that records intent rather than result. Wave 2: criterion 2 is now enforced by EXECUTION — `43-validate-guard-negative-fixtures.mjs` points every scanning guard at one deliberately empty tree and 32/32 turned red, 0 reported a pass. One shared fixture rather than 34 bespoke ones, derived from 42’s classification, so the next guard is exercised the day it lands. Two false-DEAD classes in 41 repaired and the ratchet made machine-independent (it now prints its own basis: 303, agreed between a laptop and the runner despite raw counts differing by 15). 43, 44 and 34 wired into ci-cd.yml, ratchet lowered 305→303. **AC3 untouched:** 288 dead references, 198 naming pre-refactor workspaces — a data migration of the evidence file. |  |  | `Governance` | Cross | P1 | M | `IN-PROGRESS` |
-| [`GT-580`](./gap-reference-catalog.md#gt-580) | `grep -rno "process.exit([0-9]*)" src/sdk/cli/src` returns **20 × `process.exit(1)` plus 2 bare `process.exit()`** — one single failure value for a FAIL verdict, a bad flag, a missing file and an infra crash alike, so no consumer can branch on the cause. Diagnostics share the machine channel: **341 `console.log` against 115 `console.error`**. And there is no incremental output — no `--format ndjson` — so a long `validate` is opaque until it terminates. An agent harness, a pre-commit hook and a CI step all have exactly one primitive in common (the process exit code) and the CLI currently declines to use it. Fix: a published taxonomy (`0` PASS · `2` usage error · `3` **verdict FAIL** · `1` infra failure · `4` HITL required), every diagnostic to stderr, a versioned NDJSON event stream, and the taxonomy governed by its own ruleset with Rego parity so a new command cannot regress it. **+wave 2026-07-28 — the taxonomy exists and its contract break is propagated.** `0` pass · `1` tool failure · `2` blocked · `3` invalid input, enforced centrally in `BaseEvolithCommand.handleError` plus a jest guard that fails the build on any exit literal outside the set. **The propagation was audited rather than assumed:** a repo-wide sweep found NOTHING branching on `1` as "gate failed", so there was no live break here — but the composite action collapsed every non-zero onto `non-compliant`, which **asserted a customer's repository was non-compliant when the CLI had merely crashed or been invoked wrongly**. That is the inverse of a gate reporting green over an unevaluated repo, and it is just as false. The action now reports `error` / `invalid-input`, exposes `exit-code`, fails the step for a non-verdict regardless of `fail-on-violation`, and its PR summary says "Not evaluated — this is not a finding about this repository". Its tests went 11 → 13, reclassified rather than loosened: four cases were blocked verdicts (now exit 2) and two were genuine tool failures (still exit 1, now `error`). Both language guides publish the four-value table. **NOT closed:** stdout/stderr discipline is untouched (341 `console.log` vs 115 `console.error`), there is no `--format ndjson` event stream, and the third criterion asks for a Rego-parity ruleset while what shipped is a jest guard covering only this package. **Follow-up outside this repository:** the Tracker invokes the CLI and may branch on its exit code — unverifiable from here and must be checked in `evolith_tracker`. **Criterion 1 ticked on 2026-07-28 after verification:** `exit-code-taxonomy.spec.ts` publishes exactly four codes, separates a blocked verdict from an unreachable Core, and — the load-bearing part — SCANS the command sources and asserts none names an exit code outside `0`, `1`, `2` or `3`, with an anti-vacuous guard so a green from an empty scan is not a green. 21/21. Criteria 2 and 3 remain: there is no test asserting that `--format json`/`ndjson` writes data only to stdout with every diagnostic on stderr, and no ruleset+Rego pair enforcing the taxonomy as governance rather than as a jest scan. |  |  | `Evolith CLI` | Cross | P1 | M | `IN-PROGRESS` |
+| [`GT-580`](./gap-reference-catalog.md#gt-580) | `grep -rno "process.exit([0-9]*)" src/sdk/cli/src` returns **20 × `process.exit(1)` plus 2 bare `process.exit()`** — one single failure value for a FAIL verdict, a bad flag, a missing file and an infra crash alike, so no consumer can branch on the cause. Diagnostics share the machine channel: **341 `console.log` against 115 `console.error`**. And there is no incremental output — no `--format ndjson` — so a long `validate` is opaque until it terminates. An agent harness, a pre-commit hook and a CI step all have exactly one primitive in common (the process exit code) and the CLI currently declines to use it. Fix: a published taxonomy (`0` PASS · `2` usage error · `3` **verdict FAIL** · `1` infra failure · `4` HITL required), every diagnostic to stderr, a versioned NDJSON event stream, and the taxonomy governed by its own ruleset with Rego parity so a new command cannot regress it. **+wave 2026-07-28 — the taxonomy exists and its contract break is propagated.** `0` pass · `1` tool failure · `2` blocked · `3` invalid input, enforced centrally in `BaseEvolithCommand.handleError` plus a jest guard that fails the build on any exit literal outside the set. **The propagation was audited rather than assumed:** a repo-wide sweep found NOTHING branching on `1` as "gate failed", so there was no live break here — but the composite action collapsed every non-zero onto `non-compliant`, which **asserted a customer's repository was non-compliant when the CLI had merely crashed or been invoked wrongly**. That is the inverse of a gate reporting green over an unevaluated repo, and it is just as false. The action now reports `error` / `invalid-input`, exposes `exit-code`, fails the step for a non-verdict regardless of `fail-on-violation`, and its PR summary says "Not evaluated — this is not a finding about this repository". Its tests went 11 → 13, reclassified rather than loosened: four cases were blocked verdicts (now exit 2) and two were genuine tool failures (still exit 1, now `error`). Both language guides publish the four-value table. **NOT closed:** stdout/stderr discipline is untouched (341 `console.log` vs 115 `console.error`), there is no `--format ndjson` event stream, and the third criterion asks for a Rego-parity ruleset while what shipped is a jest guard covering only this package. **Follow-up outside this repository:** the Tracker invokes the CLI and may branch on its exit code — unverifiable from here and must be checked in `evolith_tracker`. **Criterion 1 ticked on 2026-07-28 after verification:** `exit-code-taxonomy.spec.ts` publishes exactly four codes, separates a blocked verdict from an unreachable Core, and — the load-bearing part — SCANS the command sources and asserts none names an exit code outside `0`, `1`, `2` or `3`, with an anti-vacuous guard so a green from an empty scan is not a green. 21/21. Criteria 2 and 3 remain: there is no test asserting that `--format json`/`ndjson` writes data only to stdout with every diagnostic on stderr, and no ruleset+Rego pair enforcing the taxonomy as governance rather than as a jest scan. **+wave 2026-07-29 — criteria 2 and 3 closed for the JSON channel; a strengthened sweep then found four more taxonomy-membership-but-wrong breaks.** Criterion 2: `machine-channel.registry-sweep.spec.ts` asks the CLI's own commander registry which of its commands declare `--format` (not a hand-picked list) and asserts every one of the 32 found writes exactly one parseable JSON document to stdout with diagnostics on stderr — 32/32 clean. This closes the stdout/stderr purity half of criterion 2; `--format ndjson` streaming, the fourth pillar of the original fix, is still unbuilt. Criterion 3: the taxonomy is now governed by `src/rulesets/cli/exit-code-taxonomy.rules.json` with Rego parity (`src/rulesets/opa/cli-exit-code-taxonomy.rego`, `opa test` 7/7) and a native evaluator (`cli-exit-taxonomy-rule.handler.ts`, 28/28 with `rule-corpus-triage.spec.ts`) — a new command can no longer regress the taxonomy without a ruleset failure. **Strengthening the sweep surfaced exactly the class of bug it exists to catch:** adding `envelope.success === (status === 0)` alongside taxonomy-membership found FOUR commands that were valid taxonomy members while contradicting their own envelope — `sdlc gate-status` exited 0 on an `INTERNAL_ERROR` envelope (a branching consumer reads that as a PASS), `alias` exited 1 instead of 3 on a usage error, `init-wizard`'s own catch-all collapsed a `NonInteractiveError` to `INTERNAL_ERROR`/1 before it ever reached `resolveExitCode`, and `sdlc generate`'s JSON branch `return`ed before reaching the `process.exitCode` assignment below it. All four fixed by routing through the existing `exitCodeForErrorCode`/`resolveExitCode`/`carriesCliExitCode` helpers rather than a hardcoded literal, and the sweep now asserts this agreement for every command going forward. Verified: CLI suite 101 suites/1446 tests, core-domain handler+triage 28/28, `opa test` 7/7, `tsc --noEmit` clean. [PR #278](https://github.com/beyondnetcode/evolith_arch32/pull/278). **Still open:** the `--format ndjson` event stream, and the Tracker cross-repo follow-up noted above (unverifiable from this repo). |  |  | `Evolith CLI` | Cross | P1 | M | `IN-PROGRESS` |
 | [`GT-581`](./gap-reference-catalog.md#gt-581) | `grep -rn "outputSchema\\|structuredContent" src/packages/mcp-server/src` returns **0**, and so does `annotations` — across **50 announced tools**, on SDK `1.29.0`, which supports all three. Every caller therefore receives a text block and must reverse-engineer its shape, and no client can tell a read-only tool (`evolith-adr-list`) from a destructive one (`evolith-satellite-create`) before invoking it. The specification draft additionally loosened `inputSchema`/`outputSchema` to accept any JSON Schema 2020-12 keyword (SEP-2106) and asks servers to return `tools/list` in a deterministic order to improve client and prompt-cache hit rates — both free wins on the same pass. Fix: derive `outputSchema` per tool from `@beyondnet/evolith-contracts`, emit `structuredContent`, add `readOnlyHint`/`destructiveHint`/`idempotentHint` annotations, and make `tools/list` ordering deterministic. Wave 2: all 50 tools declare an outputSchema and return structuredContent that validates under the SDK’s own validator — including on FORBIDDEN denials, the result an agent most needs to read mechanically. Generated centrally from the envelope version, so a new tool cannot be registered without a contract. **Caveat carried, not hidden:** the `data` branch is declared-but-open for all 50; narrowing it needs per-operation schemas, which is GT-583. |  |  | `MCP Server` | Cross | P1 | M | `DONE` |
 | [`GT-582`](./gap-reference-catalog.md#gt-582) | Verified directly against the live specification on 2026-07-26, not taken from a secondary source. The **current** protocol revision is `2025-11-25`; the **draft** removes protocol-level sessions and the `Mcp-Session-Id` header (SEP-2567), removes the `initialize`/`notifications/initialized` handshake in favour of per-request `_meta` (SEP-2575), makes `server/discover` mandatory (SEP-2575), replaces server-initiated requests with the **MRTR** pattern — `InputRequiredResult`, a required `resultType`, and `inputResponses` on a retry of the original request (SEP-2322) — deprecates Roots/Sampling/Logging (SEP-2577) and deprecates Dynamic Client Registration in favour of Client ID Metadata Documents. In this repository: SDK `1.29.0`, **7 `sessionId` sites** under `src/packages/mcp-server/src`, and `grep -rn "well-known\\|oauth-protected-resource" src` returns 2 unrelated matches, so no protected-resource metadata document is served either. MRTR matters beyond conformance: it is *approval as a protocol*, and it is the only way the HITL gate survives the removal of sessions. **Correction to the source document, which this row records rather than repeats:** the document labels this revision `2026-07-28` and frames it as a 3-day emergency. That date could not be confirmed — the specification's own versioning page still names `2025-11-25` as current, describes negotiation as happening during `initialize`, and publishes no release date for the draft. The technical content is real and confirmed; the urgency is not. This is tracked preparatory work against a draft, to be re-checked at each spec revision. |  |  | `MCP Server` | Cross | P1 | L | `PENDING` |
 | [`GT-583`](./gap-reference-catalog.md#gt-583) | `TOOL_SCHEMAS` is a hand-written map at `src/sdk/cli/src/commands/api/api.catalog.ts:81`, the MCP tools declare their own input schemas inline in code, and `buildCapabilityManifest` (GT-513) publishes only `evaluationKinds`, `engines`, `surfaces`, `supportedConsumers` and a `sha256` — **no per-operation input or output schema at all**. So "one registry generates the three surfaces" is asserted in prose and maintained by hand. Separately, **all 154 `*.schema.json` files declare `http://json-schema.org/draft-07/schema#`**, while the MCP draft expects 2020-12 keywords in tool schemas — which makes the pin a blocker for GT-581 rather than a neutral choice. Fix: extend the manifest with per-operation `inputSchema`/`outputSchema`, generate `TOOL_SCHEMAS` and the MCP registrations from it, and migrate the meta-schema to 2020-12 compiling under ajv's 2020 entry point. |  |  | `Evolith Core` | Cross | P1 | L | `PENDING` |
@@ -650,7 +655,7 @@ This board is the single source of truth for technical debt, gaps, opportunities
 | [`GT-246`](./gap-reference-catalog.md#gt-246) | Implement Chaos Mesh/Litmus experiments |  |  | `QA` | Cross | P3 | L | `DONE` |
 
 
-**Progress:** 595 / 635 done · 14 in progress · 22 pending · 4 deferred
+**Progress:** 600 / 640 done · 14 in progress · 22 pending · 4 deferred
 
 **Wave 2026-06-23 (Winston deep audit III):** Added 14 new gaps `GT-212`…`GT-225` from the Winston Audit Playbook covering: ADR status hygiene (GT-212), topology manifest metadata + operational budgets + guidance corpus (GT-213, GT-217, GT-219), REST controller observability + OpenAPI (GT-214, GT-215), OPA input-schema parity + per-topology test density (GT-216, GT-222), SDLC Phase 05 rollback + on-call templates (GT-218), CLI branch coverage + envelope format coverage + skip-list cleanup (GT-220, GT-224, GT-225), MCP HTTP audit logging (GT-221), and cross-surface parity e2e tests (GT-223).
 
diff --git a/reference/core/control-center/maturity-reports/executive-summary.es.md b/reference/core/control-center/maturity-reports/executive-summary.es.md
index ed8783f56..6297e8edf 100644
--- a/reference/core/control-center/maturity-reports/executive-summary.es.md
+++ b/reference/core/control-center/maturity-reports/executive-summary.es.md
@@ -27,9 +27,9 @@ La forma correcta de usar este resumen es simple: si necesitas contexto, abre so
 |---:|---|---|---|
 | 1 | Bloqueadores P0 | Impiden afirmar readiness productivo o release mayor. | [GT-602](../gaps/gap-reference-catalog.es.md#gt-602), [GT-603](../gaps/gap-reference-catalog.es.md#gt-603), [GT-604](../gaps/gap-reference-catalog.es.md#gt-604), [GT-435](../gaps/gap-reference-catalog.es.md#gt-435) |
 | 2 | Área de mayor riesgo | `Evolith Core` tiene la mayor carga ponderada abierta. | [GT-583](../gaps/gap-reference-catalog.es.md#gt-583), [GT-589](../gaps/gap-reference-catalog.es.md#gt-589), [GT-614](../gaps/gap-reference-catalog.es.md#gt-614), [GT-587](../gaps/gap-reference-catalog.es.md#gt-587), [GT-591](../gaps/gap-reference-catalog.es.md#gt-591), [GT-590](../gaps/gap-reference-catalog.es.md#gt-590), +2 |
-| 3 | Ganancias rápidas | Alta criticidad con complejidad XS/S. | [GT-597](../gaps/gap-reference-catalog.es.md#gt-597), [GT-624](../gaps/gap-reference-catalog.es.md#gt-624), [GT-631](../gaps/gap-reference-catalog.es.md#gt-631) |
-| 4 | Ola P1 | Endurecimiento siguiente después de limpiar P0. | [GT-597](../gaps/gap-reference-catalog.es.md#gt-597), [GT-624](../gaps/gap-reference-catalog.es.md#gt-624), [GT-631](../gaps/gap-reference-catalog.es.md#gt-631), [GT-324](../gaps/gap-reference-catalog.es.md#gt-324), [GT-578](../gaps/gap-reference-catalog.es.md#gt-578), [GT-580](../gaps/gap-reference-catalog.es.md#gt-580), [GT-584](../gaps/gap-reference-catalog.es.md#gt-584), [GT-605](../gaps/gap-reference-catalog.es.md#gt-605), +7 |
-| 5 | P2/P3 | Solo después de estabilizar seguridad, CI, reglas y contratos. | [GT-622](../gaps/gap-reference-catalog.es.md#gt-622), [GT-444](../gaps/gap-reference-catalog.es.md#gt-444), [GT-464](../gaps/gap-reference-catalog.es.md#gt-464), [GT-614](../gaps/gap-reference-catalog.es.md#gt-614), [GT-616](../gaps/gap-reference-catalog.es.md#gt-616), [GT-617](../gaps/gap-reference-catalog.es.md#gt-617), +12 |
+| 3 | Ganancias rápidas | Alta criticidad con complejidad XS/S. | [GT-597](../gaps/gap-reference-catalog.es.md#gt-597), [GT-631](../gaps/gap-reference-catalog.es.md#gt-631) |
+| 4 | Ola P1 | Endurecimiento siguiente después de limpiar P0. | [GT-597](../gaps/gap-reference-catalog.es.md#gt-597), [GT-631](../gaps/gap-reference-catalog.es.md#gt-631), [GT-324](../gaps/gap-reference-catalog.es.md#gt-324), [GT-578](../gaps/gap-reference-catalog.es.md#gt-578), [GT-580](../gaps/gap-reference-catalog.es.md#gt-580), [GT-584](../gaps/gap-reference-catalog.es.md#gt-584), [GT-605](../gaps/gap-reference-catalog.es.md#gt-605), [GT-606](../gaps/gap-reference-catalog.es.md#gt-606), +6 |
+| 5 | P2/P3 | Solo después de estabilizar seguridad, CI, reglas y contratos. | [GT-622](../gaps/gap-reference-catalog.es.md#gt-622), [GT-444](../gaps/gap-reference-catalog.es.md#gt-444), [GT-464](../gaps/gap-reference-catalog.es.md#gt-464), [GT-614](../gaps/gap-reference-catalog.es.md#gt-614), [GT-616](../gaps/gap-reference-catalog.es.md#gt-616), [GT-617](../gaps/gap-reference-catalog.es.md#gt-617), +13 |
 
 ## Bloqueadores Actuales
 
@@ -45,23 +45,23 @@ La forma correcta de usar este resumen es simple: si necesitas contexto, abre so
 | Indicador | Valor |
 |---|---:|
 | Fecha canónica del tablero | 2026-07-26 |
-| Gaps totales | 635 |
-| Gaps cerrados | 595 |
+| Gaps totales | 640 |
+| Gaps cerrados | 600 |
 | Gaps pendientes | 40 |
 | P0 abiertos | 4 |
-| P1 abiertos | 15 |
-| P2 abiertos | 18 |
-| Cierre total | 93.7% |
-| Registros de evidencia de cierre | 577 |
+| P1 abiertos | 14 |
+| P2 abiertos | 19 |
+| Cierre total | 93.8% |
+| Registros de evidencia de cierre | 582 |
 | Readiness registrado | 4 PASS |
 
 | Área | Pendientes | P0 | P1 | Primeros IDs |
 |---|---:|---:|---:|---|
 | `Evolith Core` | 8 | 0 | 2 | [GT-583](../gaps/gap-reference-catalog.es.md#gt-583), [GT-589](../gaps/gap-reference-catalog.es.md#gt-589), [GT-614](../gaps/gap-reference-catalog.es.md#gt-614), [GT-587](../gaps/gap-reference-catalog.es.md#gt-587), +4 |
-| `Infra` | 5 | 0 | 3 | [GT-597](../gaps/gap-reference-catalog.es.md#gt-597), [GT-624](../gaps/gap-reference-catalog.es.md#gt-624), [GT-324](../gaps/gap-reference-catalog.es.md#gt-324), [GT-622](../gaps/gap-reference-catalog.es.md#gt-622), +1 |
 | `Cross` | 2 | 1 | 1 | [GT-435](../gaps/gap-reference-catalog.es.md#gt-435), [GT-448](../gaps/gap-reference-catalog.es.md#gt-448) |
 | `Evolith MCP` | 2 | 1 | 1 | [GT-602](../gaps/gap-reference-catalog.es.md#gt-602), [GT-606](../gaps/gap-reference-catalog.es.md#gt-606) |
 | `Evolith Suite` | 2 | 1 | 1 | [GT-604](../gaps/gap-reference-catalog.es.md#gt-604), [GT-605](../gaps/gap-reference-catalog.es.md#gt-605) |
+| `Evolith Tracker` | 2 | 1 | 1 | [GT-603](../gaps/gap-reference-catalog.es.md#gt-603), [GT-631](../gaps/gap-reference-catalog.es.md#gt-631) |
 
 ## Fuente y Regla de Actualización
 
diff --git a/reference/core/control-center/maturity-reports/executive-summary.md b/reference/core/control-center/maturity-reports/executive-summary.md
index d51deeb10..690e9f5a3 100644
--- a/reference/core/control-center/maturity-reports/executive-summary.md
+++ b/reference/core/control-center/maturity-reports/executive-summary.md
@@ -27,9 +27,9 @@ Use this summary with a simple rule: if you need context, open only the linked I
 |---:|---|---|---|
 | 1 | P0 blockers | They prevent production-readiness or major-release confidence. | [GT-602](../gaps/gap-reference-catalog.md#gt-602), [GT-603](../gaps/gap-reference-catalog.md#gt-603), [GT-604](../gaps/gap-reference-catalog.md#gt-604), [GT-435](../gaps/gap-reference-catalog.md#gt-435) |
 | 2 | Highest-risk area | `Evolith Core` has the largest weighted open load. | [GT-583](../gaps/gap-reference-catalog.md#gt-583), [GT-589](../gaps/gap-reference-catalog.md#gt-589), [GT-614](../gaps/gap-reference-catalog.md#gt-614), [GT-587](../gaps/gap-reference-catalog.md#gt-587), [GT-591](../gaps/gap-reference-catalog.md#gt-591), [GT-590](../gaps/gap-reference-catalog.md#gt-590), +2 |
-| 3 | Quick wins | High criticality with XS/S complexity. | [GT-597](../gaps/gap-reference-catalog.md#gt-597), [GT-624](../gaps/gap-reference-catalog.md#gt-624), [GT-631](../gaps/gap-reference-catalog.md#gt-631) |
-| 4 | P1 wave | Next hardening after P0 is cleared. | [GT-597](../gaps/gap-reference-catalog.md#gt-597), [GT-624](../gaps/gap-reference-catalog.md#gt-624), [GT-631](../gaps/gap-reference-catalog.md#gt-631), [GT-324](../gaps/gap-reference-catalog.md#gt-324), [GT-578](../gaps/gap-reference-catalog.md#gt-578), [GT-580](../gaps/gap-reference-catalog.md#gt-580), [GT-584](../gaps/gap-reference-catalog.md#gt-584), [GT-605](../gaps/gap-reference-catalog.md#gt-605), +7 |
-| 5 | P2/P3 | Only after security, CI, rules, and contracts stabilize. | [GT-622](../gaps/gap-reference-catalog.md#gt-622), [GT-444](../gaps/gap-reference-catalog.md#gt-444), [GT-464](../gaps/gap-reference-catalog.md#gt-464), [GT-614](../gaps/gap-reference-catalog.md#gt-614), [GT-616](../gaps/gap-reference-catalog.md#gt-616), [GT-617](../gaps/gap-reference-catalog.md#gt-617), +12 |
+| 3 | Quick wins | High criticality with XS/S complexity. | [GT-597](../gaps/gap-reference-catalog.md#gt-597), [GT-631](../gaps/gap-reference-catalog.md#gt-631) |
+| 4 | P1 wave | Next hardening after P0 is cleared. | [GT-597](../gaps/gap-reference-catalog.md#gt-597), [GT-631](../gaps/gap-reference-catalog.md#gt-631), [GT-324](../gaps/gap-reference-catalog.md#gt-324), [GT-578](../gaps/gap-reference-catalog.md#gt-578), [GT-580](../gaps/gap-reference-catalog.md#gt-580), [GT-584](../gaps/gap-reference-catalog.md#gt-584), [GT-605](../gaps/gap-reference-catalog.md#gt-605), [GT-606](../gaps/gap-reference-catalog.md#gt-606), +6 |
+| 5 | P2/P3 | Only after security, CI, rules, and contracts stabilize. | [GT-622](../gaps/gap-reference-catalog.md#gt-622), [GT-444](../gaps/gap-reference-catalog.md#gt-444), [GT-464](../gaps/gap-reference-catalog.md#gt-464), [GT-614](../gaps/gap-reference-catalog.md#gt-614), [GT-616](../gaps/gap-reference-catalog.md#gt-616), [GT-617](../gaps/gap-reference-catalog.md#gt-617), +13 |
 
 ## Current Blockers
 
@@ -45,23 +45,23 @@ Use this summary with a simple rule: if you need context, open only the linked I
 | Indicator | Value |
 |---|---:|
 | Canonical board date | 2026-07-26 |
-| Total gaps | 635 |
-| Closed gaps | 595 |
+| Total gaps | 640 |
+| Closed gaps | 600 |
 | Open gaps | 40 |
 | Open P0 | 4 |
-| Open P1 | 15 |
-| Open P2 | 18 |
-| Total closure | 93.7% |
-| Closure evidence records | 577 |
+| Open P1 | 14 |
+| Open P2 | 19 |
+| Total closure | 93.8% |
+| Closure evidence records | 582 |
 | Recorded readiness | 4 PASS |
 
 | Area | Open | P0 | P1 | First IDs |
 |---|---:|---:|---:|---|
 | `Evolith Core` | 8 | 0 | 2 | [GT-583](../gaps/gap-reference-catalog.md#gt-583), [GT-589](../gaps/gap-reference-catalog.md#gt-589), [GT-614](../gaps/gap-reference-catalog.md#gt-614), [GT-587](../gaps/gap-reference-catalog.md#gt-587), +4 |
-| `Infra` | 5 | 0 | 3 | [GT-597](../gaps/gap-reference-catalog.md#gt-597), [GT-624](../gaps/gap-reference-catalog.md#gt-624), [GT-324](../gaps/gap-reference-catalog.md#gt-324), [GT-622](../gaps/gap-reference-catalog.md#gt-622), +1 |
 | `Cross` | 2 | 1 | 1 | [GT-435](../gaps/gap-reference-catalog.md#gt-435), [GT-448](../gaps/gap-reference-catalog.md#gt-448) |
 | `Evolith MCP` | 2 | 1 | 1 | [GT-602](../gaps/gap-reference-catalog.md#gt-602), [GT-606](../gaps/gap-reference-catalog.md#gt-606) |
 | `Evolith Suite` | 2 | 1 | 1 | [GT-604](../gaps/gap-reference-catalog.md#gt-604), [GT-605](../gaps/gap-reference-catalog.md#gt-605) |
+| `Evolith Tracker` | 2 | 1 | 1 | [GT-603](../gaps/gap-reference-catalog.md#gt-603), [GT-631](../gaps/gap-reference-catalog.md#gt-631) |
 
 ## Source and Refresh Rule
 
diff --git a/reference/core/control-center/maturity-reports/inventory-summary.es.md b/reference/core/control-center/maturity-reports/inventory-summary.es.md
index c16996e6f..d7f8b3dc9 100644
--- a/reference/core/control-center/maturity-reports/inventory-summary.es.md
+++ b/reference/core/control-center/maturity-reports/inventory-summary.es.md
@@ -8,7 +8,7 @@ Este es el conteo automatizado del inventario de la arquitectura de referencia c
 | Tipo de Artefacto | Conteo | Ubicación |
 |---|:---:|---|
 | **Architecture Decision Records (ADR)** | 139 | `reference/core/architecture/adrs/` |
-| **Rulesets Legibles por Máquina** | 167 | `src/rulesets/` (en 20 categorías) |
+| **Rulesets Legibles por Máquina** | 175 | `src/rulesets/` (en 20 categorías) |
 | **Schemas de Phase-Gates** | 45 | `src/rulesets/schema/` |
 
-*Última Actualización: 2026-07-28*
+*Última Actualización: 2026-07-29*
diff --git a/reference/core/control-center/maturity-reports/inventory-summary.md b/reference/core/control-center/maturity-reports/inventory-summary.md
index 06211375d..a39afefd2 100644
--- a/reference/core/control-center/maturity-reports/inventory-summary.md
+++ b/reference/core/control-center/maturity-reports/inventory-summary.md
@@ -8,7 +8,7 @@ This is the automated inventory tally of the core reference architecture and gov
 | Artifact Type | Count | Location |
 |---|:---:|---|
 | **Architecture Decision Records (ADR)** | 139 | `reference/core/architecture/adrs/` |
-| **Machine-Readable Rulesets** | 167 | `src/rulesets/` (across 20 categories) |
+| **Machine-Readable Rulesets** | 175 | `src/rulesets/` (across 20 categories) |
 | **Phase-Gate Schemas** | 45 | `src/rulesets/schema/` |
 
-*Last Updated: 2026-07-28*
+*Last Updated: 2026-07-29*
diff --git a/reference/core/control-center/maturity-reports/maturity-reconciliation.json b/reference/core/control-center/maturity-reports/maturity-reconciliation.json
index 97d99234e..578821fe4 100644
--- a/reference/core/control-center/maturity-reports/maturity-reconciliation.json
+++ b/reference/core/control-center/maturity-reports/maturity-reconciliation.json
@@ -3,17 +3,17 @@
   "scope": "evolith-core",
   "asOf": "2026-07-26",
   "gaps": {
-    "total": 635,
-    "done": 595,
+    "total": 640,
+    "done": 600,
     "pending": 22,
     "inProgress": 14,
     "deferred": 4
   },
   "evidence": {
-    "closureRecords": 577,
+    "closureRecords": 582,
     "cliPackage": "@beyondnet/evolith-cli@1.2.2",
     "adrCount": 139,
-    "rulesetCount": 174,
+    "rulesetCount": 175,
     "schemaCount": 45
   },
   "readiness": [
diff --git a/src/packages/core-domain/src/application/validators/evaluators/handlers/cli-exit-taxonomy-rule.handler.spec.ts b/src/packages/core-domain/src/application/validators/evaluators/handlers/cli-exit-taxonomy-rule.handler.spec.ts
new file mode 100644
index 000000000..ce3163f44
--- /dev/null
+++ b/src/packages/core-domain/src/application/validators/evaluators/handlers/cli-exit-taxonomy-rule.handler.spec.ts
@@ -0,0 +1,173 @@
+import * as path from 'path';
+import { CliExitTaxonomyRuleHandler } from './cli-exit-taxonomy-rule.handler';
+import { IFileSystem } from '../../../../domain/interfaces';
+import { NormalizedRule } from '../../../../domain/models/normalized-rule';
+
+/**
+ * GT-580 — the rule must be SEEN failing.
+ *
+ * Every scenario below plants a scratch CLI tree and asks the handler for a
+ * verdict. The one that matters is `an out-of-taxonomy exit`: a command file
+ * carrying `process.exit(7)` has to come back `failed`, because an assertion
+ * that cannot fail is the defect this backlog is about.
+ */
+
+const CORE = '/core';
+const CTX = { satellitePath: '/sat', corePath: CORE };
+const CLI_SRC = path.join(CORE, 'src', 'sdk', 'cli', 'src');
+
+/** The real `exit-codes.ts` shape, so CLI-EXIT-03 parses something authentic. */
+const EXIT_CODES_TS = `
+export const CLI_EXIT_CODES = {
+  OK: 0,
+  TOOL_FAILURE: 1,
+  BLOCKED: 2,
+  INVALID_INPUT: 3,
+} as const;
+`;
+
+/**
+ * An in-memory tree: `files` maps an absolute path to its contents, and every
+ * directory on the way is derived rather than declared, so a scenario cannot
+ * forget one and accidentally scan nothing.
+ */
+function treeFs(files: Record<string, string>): IFileSystem {
+  const dirs = new Map<string, Set<string>>();
+  for (const file of Object.keys(files)) {
+    let current = file;
+    for (;;) {
+      const parent = path.dirname(current);
+      if (parent === current) break;
+      if (!dirs.has(parent)) dirs.set(parent, new Set());
+      dirs.get(parent)!.add(path.basename(current));
+      current = parent;
+    }
+  }
+
+  return {
+    exists: jest.fn(async (p: string) => p in files || dirs.has(p)),
+    readFile: jest.fn(async (p: string) => files[p] ?? ''),
+    readdirNames: jest.fn(async (p: string) => [...(dirs.get(p) ?? [])]),
+    stat: jest.fn(async (p: string) => ({
+      isDirectory: () => dirs.has(p) && !(p in files),
+      isFile: () => p in files,
+    })),
+  } as unknown as IFileSystem;
+}
+
+function rule(id: string): NormalizedRule {
+  return {
+    id,
+    severity: 'MUST',
+    category: 'cli-exit-taxonomy',
+    title: 't',
+    description: 'd',
+    blocking: true,
+    sourceFile: 'cli/exit-code-taxonomy.rules.json',
+  };
+}
+
+/** A CLI tree that obeys the taxonomy. */
+function compliantTree(extra: Record<string, string> = {}): Record<string, string> {
+  return {
+    [path.join(CLI_SRC, 'infrastructure', 'cli', 'exit-codes.ts')]: EXIT_CODES_TS,
+    [path.join(CLI_SRC, 'commands', 'gate', 'gate.command.ts')]:
+      'if (blocked) process.exit(2);\nprocess.exitCode = 0;\n',
+    [path.join(CLI_SRC, 'main.ts')]: 'process.exit(1);\n',
+    ...extra,
+  };
+}
+
+describe('GT-580 · CliExitTaxonomyRuleHandler', () => {
+  it('claims the CLI-EXIT- family and nothing else', () => {
+    const handler = new CliExitTaxonomyRuleHandler(treeFs(compliantTree()));
+    expect(handler.canHandle(rule('CLI-EXIT-01'))).toBe(true);
+    expect(handler.canHandle(rule('CLI-EXIT-03'))).toBe(true);
+    expect(handler.canHandle(rule('CLI-RR-01'))).toBe(false);
+    expect(handler.canHandle(rule('DEP-01'))).toBe(false);
+  });
+
+  it('passes all three rules on a CLI that obeys the taxonomy', async () => {
+    const handler = new CliExitTaxonomyRuleHandler(treeFs(compliantTree()));
+    for (const id of ['CLI-EXIT-01', 'CLI-EXIT-02', 'CLI-EXIT-03']) {
+      const result = await handler.evaluate(rule(id), CTX);
+      expect({ id, result: result.result }).toEqual({ id, result: 'passed' });
+    }
+  });
+
+  // ---- the red -----------------------------------------------------------
+
+  it('FAILS CLI-EXIT-01 on a command that exits outside the taxonomy', async () => {
+    const rogue = path.join(CLI_SRC, 'commands', 'rogue', 'rogue.command.ts');
+    const handler = new CliExitTaxonomyRuleHandler(
+      treeFs(compliantTree({ [rogue]: 'export function boom(): void {\n  process.exit(7);\n}\n' })),
+    );
+
+    const result = await handler.evaluate(rule('CLI-EXIT-01'), CTX);
+
+    expect(result.result).toBe('failed');
+    // The finding must name the offender: "1 rule failed" sends nobody anywhere.
+    expect(result.message).toContain('commands/rogue/rogue.command.ts');
+    expect(result.message).toContain('process.exit(7)');
+  });
+
+  it('FAILS CLI-EXIT-01 on `process.exitCode = 64` too, not only on process.exit()', async () => {
+    const rogue = path.join(CLI_SRC, 'commands', 'rogue', 'other.command.ts');
+    const handler = new CliExitTaxonomyRuleHandler(
+      treeFs(compliantTree({ [rogue]: 'process.exitCode = 64;\n' })),
+    );
+
+    const result = await handler.evaluate(rule('CLI-EXIT-01'), CTX);
+    expect(result.result).toBe('failed');
+    expect(result.message).toContain('process.exitCode = 64');
+  });
+
+  it('ignores test sources, which legitimately name codes outside the taxonomy', async () => {
+    // Including the negative fixtures that prove this very rule can fail — if
+    // they counted, the rule could never be green anywhere.
+    const handler = new CliExitTaxonomyRuleHandler(
+      treeFs(
+        compliantTree({
+          [path.join(CLI_SRC, 'commands', 'rogue', 'rogue.spec.ts')]: 'process.exit(9);\n',
+          [path.join(CLI_SRC, 'commands', 'rogue', 'rogue.test.ts')]: 'process.exit(77);\n',
+        }),
+      ),
+    );
+
+    expect((await handler.evaluate(rule('CLI-EXIT-01'), CTX)).result).toBe('passed');
+  });
+
+  it('FAILS CLI-EXIT-02 when the scan reads nothing', async () => {
+    // The source root exists but holds no `.ts` — the shape a moved directory
+    // produces, and the one that would otherwise report perfect compliance.
+    const handler = new CliExitTaxonomyRuleHandler(
+      treeFs({ [path.join(CLI_SRC, 'README.md')]: '# not a source' }),
+    );
+
+    const result = await handler.evaluate(rule('CLI-EXIT-02'), CTX);
+    expect(result.result).toBe('failed');
+    expect(result.message).toContain('0 sources');
+  });
+
+  it('FAILS rather than skips when the CLI source root is absent', async () => {
+    // `skipped` on a blocking rule is the silent pass this rule exists against.
+    const handler = new CliExitTaxonomyRuleHandler(treeFs({ '/elsewhere/file.ts': '' }));
+    for (const id of ['CLI-EXIT-01', 'CLI-EXIT-02', 'CLI-EXIT-03']) {
+      const result = await handler.evaluate(rule(id), CTX);
+      expect({ id, result: result.result }).toEqual({ id, result: 'failed' });
+    }
+  });
+
+  it('FAILS CLI-EXIT-03 when the taxonomy is widened to absorb the offender', async () => {
+    // The escape hatch: declare 7 legal and CLI-EXIT-01 goes quiet. This is the
+    // rule that stops that from being a fix.
+    const widened = EXIT_CODES_TS.replace('} as const;', '  ROGUE: 7,\n} as const;');
+    const handler = new CliExitTaxonomyRuleHandler(
+      treeFs(compliantTree({ [path.join(CLI_SRC, 'infrastructure', 'cli', 'exit-codes.ts')]: widened })),
+    );
+
+    const result = await handler.evaluate(rule('CLI-EXIT-03'), CTX);
+    expect(result.result).toBe('failed');
+    expect(result.message).toContain('[0, 1, 2, 3, 7]');
+  });
+});
diff --git a/src/packages/core-domain/src/application/validators/evaluators/handlers/cli-exit-taxonomy-rule.handler.ts b/src/packages/core-domain/src/application/validators/evaluators/handlers/cli-exit-taxonomy-rule.handler.ts
new file mode 100644
index 000000000..3582f2285
--- /dev/null
+++ b/src/packages/core-domain/src/application/validators/evaluators/handlers/cli-exit-taxonomy-rule.handler.ts
@@ -0,0 +1,183 @@
+import * as path from 'path';
+import { IFileSystem } from '../../../../domain/interfaces';
+import { NormalizedRule } from '../../../../domain/models/normalized-rule';
+import { WorkspaceEvaluationContext, RuleEvaluationResult } from '../evaluator.interface';
+import { INativeRuleHandler } from './rule-handler.interface';
+
+/**
+ * GT-580 — the native half of `src/rulesets/cli/exit-code-taxonomy.rules.json`.
+ *
+ * The exit code is the only control primitive an agent harness, a pre-commit
+ * hook and a CI step have in common, and it only carries meaning while every
+ * command draws from one published set: `0` pass, `1` tool failure, `2` blocked,
+ * `3` invalid input. A jest scan inside the CLI package already refuses a source
+ * that names anything else — but that is a unit test of one package. It cannot
+ * be evaluated against a repository, it produces no finding, and it has no Rego
+ * parity, so a governance consumer has no way to ask the question at all.
+ *
+ * This handler is that missing half. `evolith validate` on the Core now
+ * evaluates CLI-EXIT-01/02/03 like any other rule, they are `blocking: true`, so
+ * a command that exits outside the taxonomy makes the run BLOCK (exit 2) rather
+ * than merely failing somebody's unit tests.
+ *
+ * PARITY. `src/rulesets/opa/cli-exit-code-taxonomy.rego` decides the same three
+ * ids from the fact document that `src/sdk/cli/scripts/exit-code-taxonomy-facts.mjs`
+ * emits. The scan below is the same scan: same file filter, same literal regex,
+ * same taxonomy. Rego receives facts and this handler produces them, which is
+ * why the duplication is a boundary rather than a fork — core-domain cannot
+ * import a script out of the CLI package without inverting the dependency.
+ */
+export class CliExitTaxonomyRuleHandler implements INativeRuleHandler {
+  /** The published taxonomy. Mirrored from `sdk/cli/src/infrastructure/cli/exit-codes.ts`. */
+  private static readonly TAXONOMY: readonly number[] = [0, 1, 2, 3];
+
+  /** `process.exit(N)` / `process.exitCode = N` with a numeric literal. */
+  private static readonly EXIT_LITERAL = /process\.exit\(\s*(-?\d+)\s*\)|process\.exitCode\s*=\s*(-?\d+)/g;
+
+  constructor(private readonly fs: IFileSystem) {}
+
+  canHandle(rule: NormalizedRule): boolean {
+    return rule.id.startsWith('CLI-EXIT-');
+  }
+
+  async evaluate(rule: NormalizedRule, ctx: WorkspaceEvaluationContext): Promise<RuleEvaluationResult> {
+    if (rule.id === 'CLI-EXIT-01') return this.evalNoOffenders(rule, ctx);
+    if (rule.id === 'CLI-EXIT-02') return this.evalNonVacuousScan(rule, ctx);
+    if (rule.id === 'CLI-EXIT-03') return this.evalTaxonomyNotWidened(rule, ctx);
+
+    return { rule, result: 'skipped', message: 'Unhandled CLI-EXIT rule' };
+  }
+
+  /** CLI-EXIT-01 — every exit literal in the CLI is a member of the taxonomy. */
+  private async evalNoOffenders(rule: NormalizedRule, ctx: WorkspaceEvaluationContext): Promise<RuleEvaluationResult> {
+    const root = this.cliSourceRoot(ctx);
+    if (!(await this.fs.exists(root))) {
+      // A missing tree is not compliance. Reported as failed rather than
+      // skipped, because `skipped` on a blocking rule is precisely the silent
+      // pass this rule exists to prevent.
+      return { rule, result: 'failed', message: `CLI source root not found: ${root}` };
+    }
+
+    const scan = await this.scan(root);
+    if (scan.offenders.length === 0) {
+      return { rule, result: 'passed' };
+    }
+
+    const named = scan.offenders
+      .map((o) => `${o.file}: ${o.snippet}`)
+      .join('; ');
+    return {
+      rule,
+      result: 'failed',
+      message:
+        `${scan.offenders.length} CLI source(s) exit outside the published taxonomy ` +
+        `{${CliExitTaxonomyRuleHandler.TAXONOMY.join(', ')}} — ${named}`,
+    };
+  }
+
+  /** CLI-EXIT-02 — a scan that read nothing found no offenders, which is not compliance. */
+  private async evalNonVacuousScan(rule: NormalizedRule, ctx: WorkspaceEvaluationContext): Promise<RuleEvaluationResult> {
+    const root = this.cliSourceRoot(ctx);
+    if (!(await this.fs.exists(root))) {
+      return { rule, result: 'failed', message: `CLI source root not found: ${root}` };
+    }
+
+    const scan = await this.scan(root);
+    if (scan.scanned === 0) {
+      return {
+        rule,
+        result: 'failed',
+        message: `the exit-code taxonomy scan covered 0 sources under ${root} — an empty scan is not a pass`,
+      };
+    }
+    return { rule, result: 'passed' };
+  }
+
+  /**
+   * CLI-EXIT-03 — the taxonomy has not been widened to absorb an offender.
+   *
+   * Read out of the CLI's own `exit-codes.ts` rather than trusted: the cheap way
+   * to silence CLI-EXIT-01 is to add the offending code to `CLI_EXIT_CODES`, and
+   * that makes the consumer's problem worse rather than better.
+   */
+  private async evalTaxonomyNotWidened(rule: NormalizedRule, ctx: WorkspaceEvaluationContext): Promise<RuleEvaluationResult> {
+    const file = path.join(this.cliSourceRoot(ctx), 'infrastructure', 'cli', 'exit-codes.ts');
+    if (!(await this.fs.exists(file))) {
+      return { rule, result: 'failed', message: `exit-code taxonomy not declared: ${file} not found` };
+    }
+
+    const source = await this.fs.readFile(file);
+    const block = /CLI_EXIT_CODES\s*=\s*\{([\s\S]*?)\}\s*as const/.exec(source);
+    if (!block) {
+      return { rule, result: 'failed', message: `could not read CLI_EXIT_CODES out of ${file}` };
+    }
+
+    const declared = [...block[1].matchAll(/:\s*(-?\d+)\s*,/g)]
+      .map((m) => Number(m[1]))
+      .sort((a, b) => a - b);
+
+    const expected = [...CliExitTaxonomyRuleHandler.TAXONOMY];
+    if (declared.length === expected.length && declared.every((v, i) => v === expected[i])) {
+      return { rule, result: 'passed' };
+    }
+    return {
+      rule,
+      result: 'failed',
+      message:
+        `the CLI declares exit codes [${declared.join(', ')}]; the published taxonomy is exactly ` +
+        `[${expected.join(', ')}] and widening it is a governance decision, not a fix`,
+    };
+  }
+
+  private cliSourceRoot(ctx: WorkspaceEvaluationContext): string {
+    return path.join(ctx.corePath, 'src', 'sdk', 'cli', 'src');
+  }
+
+  private async scan(root: string): Promise<{ scanned: number; offenders: Array<{ file: string; code: number; snippet: string }> }> {
+    const files = await this.sourceFiles(root);
+    const offenders: Array<{ file: string; code: number; snippet: string }> = [];
+
+    for (const file of files) {
+      const source = await this.fs.readFile(file);
+      // `matchAll` on a `/g` regex consumes it; a fresh instance per file keeps
+      // `lastIndex` from carrying between reads.
+      const pattern = new RegExp(CliExitTaxonomyRuleHandler.EXIT_LITERAL.source, 'g');
+      for (const match of source.matchAll(pattern)) {
+        const code = Number(match[1] ?? match[2]);
+        if (!CliExitTaxonomyRuleHandler.TAXONOMY.includes(code)) {
+          offenders.push({ file: path.relative(root, file), code, snippet: match[0] });
+        }
+      }
+    }
+
+    return { scanned: files.length, offenders };
+  }
+
+  /**
+   * Every non-test `.ts` source under the CLI.
+   *
+   * Tests are excluded because they legitimately stub and assert on exit codes
+   * outside the taxonomy — including the negative fixtures that prove this very
+   * rule can fail.
+   */
+  private async sourceFiles(dir: string, depth = 0): Promise<string[]> {
+    if (depth > 10) return [];
+    const out: string[] = [];
+    const entries = await this.fs.readdirNames(dir);
+
+    for (const entry of entries) {
+      if (entry === 'node_modules' || entry === '__mocks__') continue;
+      const full = path.join(dir, entry);
+      const stat = await this.fs.stat(full);
+      if (stat.isDirectory()) {
+        out.push(...(await this.sourceFiles(full, depth + 1)));
+        continue;
+      }
+      if (!entry.endsWith('.ts')) continue;
+      if (entry.endsWith('.spec.ts') || entry.endsWith('.test.ts')) continue;
+      out.push(full);
+    }
+
+    return out;
+  }
+}
diff --git a/src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts b/src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts
index 8f5bf74cb..955bdf3c7 100644
--- a/src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts
+++ b/src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts
@@ -4,6 +4,7 @@ import { IRuleEvaluatorStrategy, WorkspaceEvaluationContext, RuleEvaluationResul
 import { INativeRuleHandler } from './handlers/rule-handler.interface';
 import { EvidenceRuleHandler } from './handlers/evidence-rule.handler';
 import { CliReleaseRuleHandler } from './handlers/cli-release-rule.handler';
+import { CliExitTaxonomyRuleHandler } from './handlers/cli-exit-taxonomy-rule.handler';
 import { McpRuleHandler } from './handlers/mcp-rule.handler';
 import { DependencyRuleHandler } from './handlers/dependency-rule.handler';
 import { TaxonomyRuleHandler } from './handlers/taxonomy-rule.handler';
@@ -29,6 +30,10 @@ export class NativeEvaluator implements IRuleEvaluatorStrategy {
     this.handlers = [
       new EvidenceRuleHandler(fs),
       new CliReleaseRuleHandler(fs),
+      // GT-580: CLI-EXIT-01/02/03 — the published exit-code taxonomy, evaluated
+      // against the CLI source tree so a command that exits outside it BLOCKS a
+      // run instead of only failing the CLI package's own unit tests.
+      new CliExitTaxonomyRuleHandler(fs),
       new McpRuleHandler(fs),
       new DependencyRuleHandler(fs),
       new TaxonomyRuleHandler(fs),
diff --git a/src/packages/core-domain/src/application/validators/rule-corpus-triage.spec.ts b/src/packages/core-domain/src/application/validators/rule-corpus-triage.spec.ts
index 14b819cb1..e9e303066 100644
--- a/src/packages/core-domain/src/application/validators/rule-corpus-triage.spec.ts
+++ b/src/packages/core-domain/src/application/validators/rule-corpus-triage.spec.ts
@@ -35,10 +35,10 @@ import { REPO_ROOT, RULESETS_ROOT, triageCorpus, renderSnapshot } from '../../..
 // meant jest was the only thing that could run them — and that is why
 // `native-evaluability-snapshot.json` was maintained by hand and drifted.
 //
-// GT-633 RECONCILIATION: the renderer in particular had two implementations, one
+// GT-640 (registered as GT-633) RECONCILIATION: the renderer in particular had two implementations, one
 // here and one in `capture-native-evaluability-snapshot.mjs`, written in parallel
 // by sessions that could not see each other. Two generators for one artifact is
-// the defect GT-633 exists to remove, one level up: whichever ran last would win
+// the defect GT-640 exists to remove, one level up: whichever ran last would win
 // and the other's `--check` would go red for no visible reason. There is now ONE
 // renderer, and this suite is its PIN rather than a second copy of it.
 const TRIAGE = triageCorpus();
@@ -54,7 +54,7 @@ const { corpus: CORPUS, classified: CLASSIFIED, summary: SUMMARY, claims } = TRI
  * passing. Restoring it is what a reconciliation that deleted it owes back.
  */
 const PINNED_CLASS_COUNTS: Readonly<Record<RuleEvaluability, number>> = {
-  'native-handler': 151,
+  'native-handler': 154,
   'documentation-only': 136,
   'unimplemented-native': 48,
   'needs-external-system': 20,
@@ -153,7 +153,7 @@ describe('GT-595 · the published breakdown, with its denominator', () => {
     // Asserted against the SINGLE declaration above, not against a second inline
     // copy of the same six numbers. There used to be two — this constant, read by
     // the dependency-free guard in `src/rulesets/standards`, and a literal here —
-    // which is GT-633's own defect in miniature: two copies of one fact, and
+    // which is GT-640's own defect in miniature: two copies of one fact, and
     // editing either leaves the other silently disagreeing.
     expect(SUMMARY.byClass).toEqual(PINNED_CLASS_COUNTS);
   });
diff --git a/src/packages/core-domain/test/parity-fixtures/cli-exit-code-taxonomy.fixture.json b/src/packages/core-domain/test/parity-fixtures/cli-exit-code-taxonomy.fixture.json
new file mode 100644
index 000000000..dec7e6a1e
--- /dev/null
+++ b/src/packages/core-domain/test/parity-fixtures/cli-exit-code-taxonomy.fixture.json
@@ -0,0 +1,106 @@
+{
+  "domain": "cli-exit-code-taxonomy",
+  "description": "GT-580 — CLI exit-code taxonomy parity. The same three rule ids decided by src/rulesets/opa/cli-exit-code-taxonomy.rego over the fact document, and by CliExitTaxonomyRuleHandler over the source tree that produces it. The `rogue-exit-code` scenario is the criterion itself: a command exiting 7 must fail the gate.",
+  "rules": [
+    { "id": "CLI-EXIT-01", "severity": "MUST", "category": "cli-exit-taxonomy", "title": "No CLI Command May Exit Outside The Published Taxonomy", "description": "Every exit literal must be 0, 1, 2 or 3", "blocking": true, "sourceFile": "cli/exit-code-taxonomy.rules.json" },
+    { "id": "CLI-EXIT-02", "severity": "MUST", "category": "cli-exit-taxonomy", "title": "The Taxonomy Scan Must Be Non-Vacuous", "description": "A scan that reads nothing is not compliance", "blocking": true, "sourceFile": "cli/exit-code-taxonomy.rules.json" },
+    { "id": "CLI-EXIT-03", "severity": "MUST", "category": "cli-exit-taxonomy", "title": "The Published Taxonomy Must Not Be Widened", "description": "CLI_EXIT_CODES must declare exactly 0, 1, 2, 3", "blocking": true, "sourceFile": "cli/exit-code-taxonomy.rules.json" }
+  ],
+  "scenarios": {
+    "compliant": {
+      "filesystem": {
+        "existing": [
+          "/core/src/sdk/cli/src",
+          "/core/src/sdk/cli/src/main.ts",
+          "/core/src/sdk/cli/src/infrastructure",
+          "/core/src/sdk/cli/src/infrastructure/cli",
+          "/core/src/sdk/cli/src/infrastructure/cli/exit-codes.ts"
+        ],
+        "directories": [
+          "/core/src/sdk/cli/src",
+          "/core/src/sdk/cli/src/infrastructure",
+          "/core/src/sdk/cli/src/infrastructure/cli"
+        ],
+        "dirs": {
+          "/core/src/sdk/cli/src": ["main.ts", "infrastructure"],
+          "/core/src/sdk/cli/src/infrastructure": ["cli"],
+          "/core/src/sdk/cli/src/infrastructure/cli": ["exit-codes.ts"]
+        },
+        "files": {
+          "/core/src/sdk/cli/src/main.ts": "process.exit(1);\n",
+          "/core/src/sdk/cli/src/infrastructure/cli/exit-codes.ts": "export const CLI_EXIT_CODES = {\n  OK: 0,\n  TOOL_FAILURE: 1,\n  BLOCKED: 2,\n  INVALID_INPUT: 3,\n} as const;\n"
+        }
+      },
+      "context": { "satellitePath": "/sat", "corePath": "/core" },
+      "expectedResults": [
+        { "ruleId": "CLI-EXIT-01", "result": "passed" },
+        { "ruleId": "CLI-EXIT-02", "result": "passed" },
+        { "ruleId": "CLI-EXIT-03", "result": "passed" }
+      ]
+    },
+    "rogue-exit-code": {
+      "filesystem": {
+        "existing": [
+          "/core/src/sdk/cli/src",
+          "/core/src/sdk/cli/src/main.ts",
+          "/core/src/sdk/cli/src/rogue.command.ts",
+          "/core/src/sdk/cli/src/infrastructure",
+          "/core/src/sdk/cli/src/infrastructure/cli",
+          "/core/src/sdk/cli/src/infrastructure/cli/exit-codes.ts"
+        ],
+        "directories": [
+          "/core/src/sdk/cli/src",
+          "/core/src/sdk/cli/src/infrastructure",
+          "/core/src/sdk/cli/src/infrastructure/cli"
+        ],
+        "dirs": {
+          "/core/src/sdk/cli/src": ["main.ts", "rogue.command.ts", "infrastructure"],
+          "/core/src/sdk/cli/src/infrastructure": ["cli"],
+          "/core/src/sdk/cli/src/infrastructure/cli": ["exit-codes.ts"]
+        },
+        "files": {
+          "/core/src/sdk/cli/src/main.ts": "process.exit(1);\n",
+          "/core/src/sdk/cli/src/rogue.command.ts": "export function boom(): void {\n  process.exit(7);\n}\n",
+          "/core/src/sdk/cli/src/infrastructure/cli/exit-codes.ts": "export const CLI_EXIT_CODES = {\n  OK: 0,\n  TOOL_FAILURE: 1,\n  BLOCKED: 2,\n  INVALID_INPUT: 3,\n} as const;\n"
+        }
+      },
+      "context": { "satellitePath": "/sat", "corePath": "/core" },
+      "expectedResults": [
+        { "ruleId": "CLI-EXIT-01", "result": "failed" },
+        { "ruleId": "CLI-EXIT-02", "result": "passed" },
+        { "ruleId": "CLI-EXIT-03", "result": "passed" }
+      ]
+    },
+    "widened-taxonomy": {
+      "filesystem": {
+        "existing": [
+          "/core/src/sdk/cli/src",
+          "/core/src/sdk/cli/src/main.ts",
+          "/core/src/sdk/cli/src/infrastructure",
+          "/core/src/sdk/cli/src/infrastructure/cli",
+          "/core/src/sdk/cli/src/infrastructure/cli/exit-codes.ts"
+        ],
+        "directories": [
+          "/core/src/sdk/cli/src",
+          "/core/src/sdk/cli/src/infrastructure",
+          "/core/src/sdk/cli/src/infrastructure/cli"
+        ],
+        "dirs": {
+          "/core/src/sdk/cli/src": ["main.ts", "infrastructure"],
+          "/core/src/sdk/cli/src/infrastructure": ["cli"],
+          "/core/src/sdk/cli/src/infrastructure/cli": ["exit-codes.ts"]
+        },
+        "files": {
+          "/core/src/sdk/cli/src/main.ts": "process.exit(7);\n",
+          "/core/src/sdk/cli/src/infrastructure/cli/exit-codes.ts": "export const CLI_EXIT_CODES = {\n  OK: 0,\n  TOOL_FAILURE: 1,\n  BLOCKED: 2,\n  INVALID_INPUT: 3,\n  ROGUE: 7,\n} as const;\n"
+        }
+      },
+      "context": { "satellitePath": "/sat", "corePath": "/core" },
+      "expectedResults": [
+        { "ruleId": "CLI-EXIT-01", "result": "failed" },
+        { "ruleId": "CLI-EXIT-02", "result": "passed" },
+        { "ruleId": "CLI-EXIT-03", "result": "failed" }
+      ]
+    }
+  }
+}
diff --git a/src/packages/core-domain/test/rule-corpus-triage.ts b/src/packages/core-domain/test/rule-corpus-triage.ts
index 3b6522e87..73727e28d 100644
--- a/src/packages/core-domain/test/rule-corpus-triage.ts
+++ b/src/packages/core-domain/test/rule-corpus-triage.ts
@@ -168,16 +168,16 @@ export function triageCorpus(rulesetsRoot: string = RULESETS_ROOT): CorpusTriage
 // ---------------------------------------------------------------------------
 
 /**
- * GT-633 reconciliation: this function had TWO implementations.
+ * GT-640 (registered as GT-633) reconciliation: this function had TWO implementations.
  *
- * The fix for GT-633 was written twice, in parallel, by sessions that could not
+ * The fix for GT-640 was written twice, in parallel, by sessions that could not
  * see each other. One shipped a standalone capture script (`capture-native-
  * evaluability-snapshot.mjs`, reachable by the derived-artifact chain guard and
  * by the documentation job); the other rendered the document inside
  * `rule-corpus-triage.spec.ts`, where jest can pin it byte-for-byte. Both were
  * right about their half, and both recaptured the same numbers.
  *
- * But two generators for one artifact is EXACTLY the defect GT-633 exists to
+ * But two generators for one artifact is EXACTLY the defect GT-640 exists to
  * remove, reproduced one level up: whichever ran last would win, and the other's
  * `--check` would go red for no reason a reader could see.
  *
diff --git a/src/rulesets/cli/README.es.md b/src/rulesets/cli/README.es.md
index d24a1c9c7..b8f0bdec5 100644
--- a/src/rulesets/cli/README.es.md
+++ b/src/rulesets/cli/README.es.md
@@ -10,6 +10,7 @@ Reglas legibles por máquina para preparación de release del Evolith Evolith CL
 |---|---|
 | [Preparación de Release del CLI](./release-readiness.rules.json) | Define evidencia mínima de build, pruebas, paquete y smoke MCP antes de liberar el CLI. |
 | [Paridad CLI/Core](./core-parity.rules.json) | Exige que cada capacidad de regla Core sea trazable a CLI, MCP, pruebas y estado de evidencia. |
+| [Taxonomía de Exit Codes del CLI](./exit-code-taxonomy.rules.json) | Exige que todo comando del CLI salga con un código de la taxonomía publicada (`0` pass, `1` fallo de herramienta, `2` bloqueado, `3` entrada inválida), sobre un escaneo no vacío y sin ensanchar la taxonomía para absorber al infractor. Paridad Rego en [`opa/cli-exit-code-taxonomy.rego`](../opa/cli-exit-code-taxonomy.rego). |
 
 ## Intención de Validación
 
diff --git a/src/rulesets/cli/README.md b/src/rulesets/cli/README.md
index bcc0591da..4c67665ac 100644
--- a/src/rulesets/cli/README.md
+++ b/src/rulesets/cli/README.md
@@ -10,6 +10,7 @@ Machine-readable rules for Evolith Evolith CLI release readiness and parity with
 |---|---|
 | [CLI Release Readiness](./release-readiness.rules.json) | Defines minimum build, test, package, and MCP smoke evidence before CLI release. |
 | [CLI/Core Parity](./core-parity.rules.json) | Requires every Core rule capability to be traced to CLI, MCP, tests, and evidence status. |
+| [CLI Exit-Code Taxonomy](./exit-code-taxonomy.rules.json) | Requires every CLI command to exit with a code drawn from the published taxonomy (`0` pass, `1` tool failure, `2` blocked, `3` invalid input), over a non-vacuous scan, without widening the taxonomy to absorb an offender. Rego parity in [`opa/cli-exit-code-taxonomy.rego`](../opa/cli-exit-code-taxonomy.rego). |
 
 ## Validation Intent
 
diff --git a/src/rulesets/cli/exit-code-taxonomy.rules.json b/src/rulesets/cli/exit-code-taxonomy.rules.json
new file mode 100644
index 000000000..6d12b3ceb
--- /dev/null
+++ b/src/rulesets/cli/exit-code-taxonomy.rules.json
@@ -0,0 +1,51 @@
+{
+  "$schema": "../schema/ruleset-standard.schema.json",
+  "$id": "https://evolith.dev/rulesets/cli/exit-code-taxonomy.rules.json",
+  "title": "CLI Exit-Code Taxonomy Rules",
+  "description": "GT-580 — the exit code is the only control primitive an agent harness, a pre-commit hook and a CI step have in common. This ruleset governs it: every command must exit with a code drawn from the published taxonomy (0 pass, 1 tool failure, 2 blocked, 3 invalid input), the scan that proves it must be non-vacuous, and the taxonomy itself must not be widened to make an offender disappear.",
+  "version": "1.0.0",
+  "effectiveDate": "2026-07-29",
+  "scope": "core-cli",
+  "category": "exit-code-taxonomy",
+  "audience": "core",
+  "rules": [
+    {
+      "id": "CLI-EXIT-01",
+      "severity": "MUST",
+      "category": "cli-exit-taxonomy",
+      "title": "No CLI Command May Exit Outside The Published Taxonomy",
+      "description": "Every exit code named by a CLI source MUST be a member of the published taxonomy: 0 pass, 1 tool failure, 2 blocked, 3 invalid input. A command that exits with anything else is unreadable to the consumer the code exists for — an agent cannot tell a blocked gate from a crashed tool, which is the difference between a blocked merge and a retry.",
+      "validationQuery": "Scan every non-test .ts source under src/sdk/cli/src for `process.exit(N)` and `process.exitCode = N` with a numeric literal, and require every N to be one of 0, 1, 2, 3.",
+      "evidenceRequired": [
+        "offending file and exit literal, per offender",
+        "number of sources scanned"
+      ],
+      "blocking": true
+    },
+    {
+      "id": "CLI-EXIT-02",
+      "severity": "MUST",
+      "category": "cli-exit-taxonomy",
+      "title": "The Taxonomy Scan Must Be Non-Vacuous",
+      "description": "The scan behind CLI-EXIT-01 MUST cover a non-empty set of CLI sources. A scan that reads nothing also finds no offenders, so a moved or mistyped source root would report perfect compliance while checking an empty directory. The denominator is part of the verdict, not a diagnostic.",
+      "validationQuery": "Require the number of CLI sources scanned by the exit-code taxonomy scan to be greater than zero.",
+      "evidenceRequired": [
+        "number of sources scanned",
+        "source root the scan resolved to"
+      ],
+      "blocking": true
+    },
+    {
+      "id": "CLI-EXIT-03",
+      "severity": "MUST",
+      "category": "cli-exit-taxonomy",
+      "title": "The Published Taxonomy Must Not Be Widened",
+      "description": "The declared taxonomy MUST be exactly {0, 1, 2, 3}. Without this, CLI-EXIT-01 has a trivial escape hatch: adding the offending code to the taxonomy makes the violation disappear while the consumer's problem — an exit code carrying no agreed meaning — gets worse. Widening the taxonomy is a governance decision, so it must fail the gate rather than pass it silently.",
+      "validationQuery": "Require the taxonomy declared by src/sdk/cli/src/infrastructure/cli/exit-codes.ts to be exactly the four codes 0, 1, 2 and 3.",
+      "evidenceRequired": [
+        "declared taxonomy values"
+      ],
+      "blocking": true
+    }
+  ]
+}
diff --git a/src/rulesets/opa/cli-exit-code-taxonomy.rego b/src/rulesets/opa/cli-exit-code-taxonomy.rego
new file mode 100644
index 000000000..78361f1c8
--- /dev/null
+++ b/src/rulesets/opa/cli-exit-code-taxonomy.rego
@@ -0,0 +1,78 @@
+# GT-580 — the CLI exit-code taxonomy, as policy.
+#
+# Rego parity for `src/rulesets/cli/exit-code-taxonomy.rules.json`: the same three
+# rule ids, the same verdicts, evaluated over the fact document produced by
+# `src/sdk/cli/scripts/exit-code-taxonomy-facts.mjs --json` and mounted at
+# `input.core.cli.exitCodes`.
+#
+# The policy deliberately does NOT re-implement the file scan. A policy that
+# walked a source tree would be a second scanner drifting away from the first;
+# facts in, verdict out is the whole point of keeping the producer separate.
+#
+# Published taxonomy: 0 pass · 1 tool failure · 2 blocked · 3 invalid input.
+package evolith.cli_exit_code_taxonomy
+
+import rego.v1
+
+facts := input.core.cli.exitCodes
+
+# CLI-EXIT-01 — a command that exits outside the taxonomy fails the gate.
+#
+# One violation per offender, so the message names the file and the literal
+# rather than reporting an anonymous count somebody then has to go hunting for.
+violations contains {
+	"id": "CLI-EXIT-01",
+	"message": sprintf(
+		"%s exits with %d, which is outside the published CLI exit-code taxonomy {0,1,2,3} (%s)",
+		[offender.file, offender.code, offender.snippet],
+	),
+} if {
+	some offender in facts.offenders
+}
+
+# CLI-EXIT-02 — a scan that read nothing is not compliance.
+#
+# Without this, a moved source root turns CLI-EXIT-01 into a rule that can never
+# fire: no files scanned means no offenders found, and the gate reports green
+# over an empty directory.
+violations contains {
+	"id": "CLI-EXIT-02",
+	"message": sprintf(
+		"the exit-code taxonomy scan covered %d CLI sources — a scan that reads nothing finds no offenders, which is not compliance",
+		[facts.scanned],
+	),
+} if {
+	facts.scanned == 0
+}
+
+# CLI-EXIT-03 — the taxonomy itself may not be widened.
+#
+# The cheap way to make CLI-EXIT-01 green is to declare the offending code part
+# of the taxonomy. That makes the consumer's problem worse, not better, so it
+# fails here instead of passing silently.
+violations contains {
+	"id": "CLI-EXIT-03",
+	"message": sprintf(
+		"the CLI declares exit codes %v; the published taxonomy is exactly [0, 1, 2, 3] and widening it is a governance decision, not a fix",
+		[facts.declared],
+	),
+} if {
+	facts.declared != [0, 1, 2, 3]
+}
+
+# Absence of facts is not compliance either: a consumer that forgot to attach the
+# fact document must not read as a pass.
+#
+# Scoped to `input.core.cli` on purpose. This ruleset is `audience: core` — it
+# addresses the Evolith monorepo's own CLI — and `main.rego` aggregates it, so an
+# unscoped rule would fire on every satellite evaluation, where the CLI source
+# tree does not exist and the fact document is meaningless. Declaring
+# `input.core.cli` is the caller saying "I am evaluating the Core CLI"; having
+# said it, omitting the facts is a defect rather than a non-applicable rule.
+violations contains {
+	"id": "CLI-EXIT-02",
+	"message": "no exit-code taxonomy facts were supplied at input.core.cli.exitCodes — the rule cannot be evaluated, and an unevaluated blocking rule is not a pass",
+} if {
+	input.core.cli
+	not input.core.cli.exitCodes
+}
diff --git a/src/rulesets/opa/cli-exit-code-taxonomy.test.rego b/src/rulesets/opa/cli-exit-code-taxonomy.test.rego
new file mode 100644
index 000000000..0b5da48b3
--- /dev/null
+++ b/src/rulesets/opa/cli-exit-code-taxonomy.test.rego
@@ -0,0 +1,78 @@
+# GT-580 — executable tests for the CLI exit-code taxonomy policy.
+#
+# The negative cases are the point. A guard nobody has ever seen fail is not a
+# guard, and this board has repeatedly caught exactly that. Each test below moves
+# ONE field of a known-compliant fact document and names the rule it expects.
+package evolith.cli_exit_code_taxonomy_test
+
+import rego.v1
+
+import data.evolith.cli_exit_code_taxonomy
+
+# The real shape emitted by `exit-code-taxonomy-facts.mjs --json`, with the
+# numbers measured against the CLI on 2026-07-29.
+compliant_input := {"core": {"cli": {"exitCodes": {
+	"schemaVersion": "1.0.0",
+	"declared": [0, 1, 2, 3],
+	"observed": [0, 1, 2, 3],
+	"scanned": 152,
+	"offenders": [],
+	"compliant": true,
+}}}}
+
+test_compliant_cli_has_no_violations if {
+	violations := cli_exit_code_taxonomy.violations with input as compliant_input
+	count(violations) == 0
+}
+
+# The criterion, stated as a test: a command that exits outside {0,1,2,3} fails.
+test_command_exiting_outside_the_taxonomy_is_rejected if {
+	i := json.patch(compliant_input, [{
+		"op": "replace",
+		"path": "/core/cli/exitCodes/offenders",
+		"value": [{"file": "commands/rogue/rogue.command.ts", "code": 7, "snippet": "process.exit(7)"}],
+	}])
+	violations := cli_exit_code_taxonomy.violations with input as i
+	violations[_].id == "CLI-EXIT-01"
+}
+
+test_every_offender_is_named_individually if {
+	i := json.patch(compliant_input, [{
+		"op": "replace",
+		"path": "/core/cli/exitCodes/offenders",
+		"value": [
+			{"file": "commands/rogue/a.command.ts", "code": 7, "snippet": "process.exit(7)"},
+			{"file": "commands/rogue/b.command.ts", "code": 64, "snippet": "process.exitCode = 64"},
+		],
+	}])
+	violations := cli_exit_code_taxonomy.violations with input as i
+	count(violations) == 2
+}
+
+test_a_vacuous_scan_is_rejected if {
+	i := json.patch(compliant_input, [{"op": "replace", "path": "/core/cli/exitCodes/scanned", "value": 0}])
+	violations := cli_exit_code_taxonomy.violations with input as i
+	violations[_].id == "CLI-EXIT-02"
+}
+
+test_missing_facts_are_rejected_rather_than_read_as_a_pass if {
+	violations := cli_exit_code_taxonomy.violations with input as {"core": {"cli": {"mcpServerSource": "x"}}}
+	violations[_].id == "CLI-EXIT-02"
+}
+
+# The mirror image, and the reason the rule above is scoped: `main.rego`
+# aggregates this policy, so a satellite evaluation — which has no Core CLI tree
+# and no fact document — must produce nothing at all rather than three blocking
+# violations about a source tree it does not contain.
+test_a_satellite_evaluation_is_silent if {
+	violations := cli_exit_code_taxonomy.violations with input as {"satellite": {"contracts": {"phase": 2}}}
+	count(violations) == 0
+}
+
+# The escape hatch: declaring 7 part of the taxonomy would silence CLI-EXIT-01.
+# It must not silence the gate.
+test_widening_the_taxonomy_is_rejected if {
+	i := json.patch(compliant_input, [{"op": "replace", "path": "/core/cli/exitCodes/declared", "value": [0, 1, 2, 3, 7]}])
+	violations := cli_exit_code_taxonomy.violations with input as i
+	violations[_].id == "CLI-EXIT-03"
+}
diff --git a/src/rulesets/opa/main.rego b/src/rulesets/opa/main.rego
index 98372778d..aedf947a3 100644
--- a/src/rulesets/opa/main.rego
+++ b/src/rulesets/opa/main.rego
@@ -8,6 +8,7 @@ import data.evolith.capability_source_interface.violations as csi_violations
 import data.evolith.ci_cd.violations as ci_cd_violations
 import data.evolith.cicd_quality_gates.violations as cicd_qg_violations
 import data.evolith.cli_core_parity.violations as cli_cp_violations
+import data.evolith.cli_exit_code_taxonomy.violations as cli_exit_violations
 import data.evolith.cli_readiness.violations as cli_violations
 import data.evolith.cli_release_readiness.violations as cli_rr_violations
 import data.evolith.compliance_baseline.violations as cb_violations
@@ -157,3 +158,9 @@ violations contains v if {
 violations contains v if {
 	v := pg_violations[_]
 }
+
+# GT-580 — the exit-code taxonomy. Silent unless the caller declares
+# `input.core.cli`, so a satellite evaluation is unaffected.
+violations contains v if {
+	v := cli_exit_violations[_]
+}
diff --git a/src/rulesets/standards/capture-native-evaluability-snapshot.mjs b/src/rulesets/standards/capture-native-evaluability-snapshot.mjs
index c1386f19d..d36871326 100644
--- a/src/rulesets/standards/capture-native-evaluability-snapshot.mjs
+++ b/src/rulesets/standards/capture-native-evaluability-snapshot.mjs
@@ -119,9 +119,9 @@ function resolveTsNodeRegister() {
  * them is a process, not a module resolution problem worth solving.
  */
 function runTriage(capturedOn) {
-  // GT-633 RECONCILIATION: this script used to BUILD the document itself, while
+  // GT-640 (registered as GT-633) RECONCILIATION: this script used to BUILD the document itself, while
   // `rule-corpus-triage.spec.ts` built a second copy of it. Two generators for one
-  // artifact is the defect GT-633 exists to remove, one level up — whichever ran
+  // artifact is the defect GT-640 exists to remove, one level up — whichever ran
   // last would win and the other's `--check` would go red for no visible reason.
   //
   // The renderer now lives once, in `test/rule-corpus-triage.ts`, and this script
diff --git a/src/rulesets/standards/iso-5055-mapping.csv b/src/rulesets/standards/iso-5055-mapping.csv
index 1ceda804f..9a122a84b 100644
--- a/src/rulesets/standards/iso-5055-mapping.csv
+++ b/src/rulesets/standards/iso-5055-mapping.csv
@@ -196,6 +196,9 @@ CLI-PAR-01,cli/core-parity.rules.json,platform-surface,,,none,no,unimplemented-n
 CLI-PAR-02,cli/core-parity.rules.json,platform-surface,,,none,no,unimplemented-native
 CLI-PAR-03,cli/core-parity.rules.json,platform-surface,,,none,no,needs-runtime
 CLI-PAR-04,cli/core-parity.rules.json,platform-surface,,,none,no,unimplemented-native
+CLI-EXIT-01,cli/exit-code-taxonomy.rules.json,platform-surface,,,none,no,native-handler
+CLI-EXIT-02,cli/exit-code-taxonomy.rules.json,platform-surface,,,none,no,native-handler
+CLI-EXIT-03,cli/exit-code-taxonomy.rules.json,platform-surface,,,none,no,native-handler
 CLI-RR-01,cli/release-readiness.rules.json,platform-surface,,,none,no,native-handler
 CLI-RR-02,cli/release-readiness.rules.json,platform-surface,,,none,no,native-handler
 CLI-RR-03,cli/release-readiness.rules.json,platform-surface,,,none,no,native-handler
diff --git a/src/rulesets/standards/iso-5055-mapping.json b/src/rulesets/standards/iso-5055-mapping.json
index 94113ed27..b3341157b 100644
--- a/src/rulesets/standards/iso-5055-mapping.json
+++ b/src/rulesets/standards/iso-5055-mapping.json
@@ -12,21 +12,21 @@
     "weaknessCount": 138
   },
   "corpus": {
-    "rulesetFiles": 174,
-    "rules": 388,
+    "rulesetFiles": 175,
+    "rules": 391,
     "note": "Files that carry gate definitions or topology recommendations rather than conformance rules contribute no rows: architecture/topology-recommendation.rules.json and sdlc/phase-gates.rules.json."
   },
   "summary": {
-    "rules": 388,
+    "rules": 391,
     "mappedToIso5055": 37,
     "mappedDirect": 8,
     "mappedPartial": 29,
-    "noInternationalEquivalent": 351,
-    "adoptedFraction": 0.0954,
+    "noInternationalEquivalent": 354,
+    "adoptedFraction": 0.0946,
     "analyserAdoptable": 42,
     "analyserAdoptablePartial": 23,
-    "analyserAdoptableFraction": 0.1082,
-    "analyserAdoptableFractionIncludingPartial": 0.1675,
+    "analyserAdoptableFraction": 0.1074,
+    "analyserAdoptableFractionIncludingPartial": 0.1662,
     "byClass": {
       "architecture-decision": {
         "rules": 162,
@@ -59,7 +59,7 @@
         "adoptable": 0
       },
       "platform-surface": {
-        "rules": 14,
+        "rules": 17,
         "mapped": 0,
         "adoptable": 0
       },
@@ -168,7 +168,7 @@
         "adoptablePartialRuleIds": []
       },
       "native-handler": {
-        "rules": 151,
+        "rules": 154,
         "mappedToIso5055": 19,
         "analyserAdoptable": 28,
         "analyserAdoptablePartial": 11,
@@ -4150,6 +4150,63 @@
       "nativeEvaluability": "unimplemented-native",
       "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it."
     },
+    {
+      "ruleId": "CLI-EXIT-01",
+      "sourceFile": "cli/exit-code-taxonomy.rules.json",
+      "title": "No CLI Command May Exit Outside The Published Taxonomy",
+      "severity": "MUST",
+      "ruleClass": "platform-surface",
+      "iso5055": {
+        "cwes": [],
+        "weaknesses": [],
+        "measures": [],
+        "strength": "none"
+      },
+      "analyser": {
+        "adoptable": "no",
+        "examples": []
+      },
+      "nativeEvaluability": "native-handler",
+      "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it."
+    },
+    {
+      "ruleId": "CLI-EXIT-02",
+      "sourceFile": "cli/exit-code-taxonomy.rules.json",
+      "title": "The Taxonomy Scan Must Be Non-Vacuous",
+      "severity": "MUST",
+      "ruleClass": "platform-surface",
+      "iso5055": {
+        "cwes": [],
+        "weaknesses": [],
+        "measures": [],
+        "strength": "none"
+      },
+      "analyser": {
+        "adoptable": "no",
+        "examples": []
+      },
+      "nativeEvaluability": "native-handler",
+      "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it."
+    },
+    {
+      "ruleId": "CLI-EXIT-03",
+      "sourceFile": "cli/exit-code-taxonomy.rules.json",
+      "title": "The Published Taxonomy Must Not Be Widened",
+      "severity": "MUST",
+      "ruleClass": "platform-surface",
+      "iso5055": {
+        "cwes": [],
+        "weaknesses": [],
+        "measures": [],
+        "strength": "none"
+      },
+      "analyser": {
+        "adoptable": "no",
+        "examples": []
+      },
+      "nativeEvaluability": "native-handler",
+      "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it."
+    },
     {
       "ruleId": "CLI-RR-01",
       "sourceFile": "cli/release-readiness.rules.json",
diff --git a/src/rulesets/standards/native-evaluability-snapshot.json b/src/rulesets/standards/native-evaluability-snapshot.json
index 942fce717..bb7ca24f0 100644
--- a/src/rulesets/standards/native-evaluability-snapshot.json
+++ b/src/rulesets/standards/native-evaluability-snapshot.json
@@ -3,7 +3,7 @@
   "title": "Native-engine evaluability class per rule (snapshot)",
   "description": "Per-rule evaluability class as computed by the Core native evaluator triage. This is a GENERATED CAPTURE, not the source of truth: the authority is src/packages/core-domain/src/application/validators/rule-evaluability.ts and the handler set registered in native-evaluator.ts. It is recorded here so the ISO/IEC 5055 mapping can be scoped to the real handler backlog without src/rulesets depending on a package it does not own. Do not hand-edit — regenerate.",
   "version": "1.1.0",
-  "capturedOn": "2026-07-30",
+  "capturedOn": "2026-07-29",
   "capturedFrom": [
     "src/packages/core-domain/src/application/validators/rule-evaluability.ts (RULE_TRIAGE, classifyRule, ADR_CONFORMANCE_CATEGORY)",
     "src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts (registered handler set)",
@@ -11,11 +11,11 @@
     "src/packages/core-domain/test/rule-corpus-triage.ts (corpus loader, classification and this renderer)"
   ],
   "regenerateWith": "node src/rulesets/standards/capture-native-evaluability-snapshot.mjs",
-  "validation": "Rendered by test/rule-corpus-triage.ts from the live triage, written by capture-native-evaluability-snapshot.mjs and pinned byte-for-byte by rule-corpus-triage.spec.ts, so a divergence between this file and Core is a failing test rather than silent drift (corpus 386; native-handler 151, documentation-only 136, unimplemented-native 48, needs-external-system 20, needs-runtime 17, underspecified 14).",
-  "corpusSize": 386,
-  "distinctRuleIds": 386,
+  "validation": "Rendered by test/rule-corpus-triage.ts from the live triage, written by capture-native-evaluability-snapshot.mjs and pinned byte-for-byte by rule-corpus-triage.spec.ts, so a divergence between this file and Core is a failing test rather than silent drift (corpus 389; native-handler 154, documentation-only 136, unimplemented-native 48, needs-external-system 20, needs-runtime 17, underspecified 14).",
+  "corpusSize": 389,
+  "distinctRuleIds": 389,
   "counts": {
-    "native-handler": 151,
+    "native-handler": 154,
     "documentation-only": 136,
     "unimplemented-native": 48,
     "needs-external-system": 20,
@@ -220,6 +220,9 @@
     "CLI-PAR-02": "unimplemented-native",
     "CLI-PAR-03": "needs-runtime",
     "CLI-PAR-04": "unimplemented-native",
+    "CLI-EXIT-01": "native-handler",
+    "CLI-EXIT-02": "native-handler",
+    "CLI-EXIT-03": "native-handler",
     "CLI-RR-01": "native-handler",
     "CLI-RR-02": "native-handler",
     "CLI-RR-03": "native-handler",
diff --git a/src/sdk/cli/src/commands/alias/alias.command.ts b/src/sdk/cli/src/commands/alias/alias.command.ts
index 6ca978087..31f566028 100644
--- a/src/sdk/cli/src/commands/alias/alias.command.ts
+++ b/src/sdk/cli/src/commands/alias/alias.command.ts
@@ -5,6 +5,7 @@ import { randomUUID } from 'node:crypto';
 import { AliasService } from '../../config/alias.service';
 import { createSuccessEnvelope, createErrorEnvelope, OUTPUT_ENVELOPE_SCHEMA_VERSION } from '@beyondnet/evolith-core-domain/domain/gate-evidence';
 import { BaseEvolithCommand } from '../../infrastructure/cli/base-command';
+import { exitCodeForErrorCode } from '../../infrastructure/cli/exit-codes';
 
 interface AliasCommandOptions {
   add?: string;
@@ -38,7 +39,7 @@ export class AliasCommand extends BaseEvolithCommand {
         if (!alias || !cmd) {
           const message = 'Usage: evolith alias --add <alias>=<command>';
           if (json) {
-            process.exitCode = 1;
+            process.exitCode = exitCodeForErrorCode('VALIDATION_FAILED');
             console.log(JSON.stringify(createErrorEnvelope('VALIDATION_FAILED', message, { ...meta, durationMs: Date.now() - startedAt }), null, 2));
           } else {
             this.promptService.showError(message);
@@ -94,7 +95,7 @@ export class AliasCommand extends BaseEvolithCommand {
         }
       } else {
         if (json) {
-          process.exitCode = 1;
+          process.exitCode = exitCodeForErrorCode('VALIDATION_FAILED');
           console.log(JSON.stringify(createErrorEnvelope('VALIDATION_FAILED', 'Use --add, --remove, or --list', { ...meta, durationMs: Date.now() - startedAt }), null, 2));
         } else {
           this.promptService.showInfo('Use --add, --remove, or --list.');
diff --git a/src/sdk/cli/src/commands/init/init.wizard.ts b/src/sdk/cli/src/commands/init/init.wizard.ts
index a9639659b..231880286 100644
--- a/src/sdk/cli/src/commands/init/init.wizard.ts
+++ b/src/sdk/cli/src/commands/init/init.wizard.ts
@@ -6,8 +6,9 @@ import { PromptService } from '../../infrastructure/prompts/prompt.service';
 import { CatalogLoader } from '../../infrastructure/catalog/catalog-loader';
 import { Inject } from '@nestjs/common';
 import { IFileSystem } from '@beyondnet/evolith-core-domain/domain/interfaces';
-import { createSuccessEnvelope, createErrorEnvelope, OUTPUT_ENVELOPE_SCHEMA_VERSION } from '@beyondnet/evolith-core-domain/domain/gate-evidence';
+import { createSuccessEnvelope, createErrorEnvelope, OUTPUT_ENVELOPE_SCHEMA_VERSION, type ErrorCode } from '@beyondnet/evolith-core-domain/domain/gate-evidence';
 import { InitializeProjectUseCase } from '@beyondnet/evolith-core-domain/application/services';
+import { carriesCliExitCode, resolveExitCode } from '../../infrastructure/cli/exit-codes';
 
 interface WizardInitOptions {
   wizard?: boolean;
@@ -192,8 +193,15 @@ export class InitWizardCommand extends BaseEvolithCommand {
       }
       const message = error instanceof Error ? error.message : String(error);
       if (json) {
-        process.exitCode = 1;
-        console.log(JSON.stringify(createErrorEnvelope('INTERNAL_ERROR', message, { ...meta, durationMs: Date.now() - startedAt }), null, 2));
+        // GT-580: a carrier error (e.g. `NonInteractiveError` on a non-TTY)
+        // already knows its taxonomy classification — collapsing it to
+        // INTERNAL_ERROR here would lose that and make the envelope disagree
+        // with the exit code.
+        const code: ErrorCode = carriesCliExitCode(error) && error.envelopeErrorCode
+          ? (error.envelopeErrorCode as ErrorCode)
+          : 'INTERNAL_ERROR';
+        process.exitCode = resolveExitCode(error);
+        console.log(JSON.stringify(createErrorEnvelope(code, message, { ...meta, durationMs: Date.now() - startedAt }), null, 2));
       } else {
         throw error;
       }
diff --git a/src/sdk/cli/src/commands/sdlc/gate-status.command.ts b/src/sdk/cli/src/commands/sdlc/gate-status.command.ts
index 55c696370..a115c6ada 100644
--- a/src/sdk/cli/src/commands/sdlc/gate-status.command.ts
+++ b/src/sdk/cli/src/commands/sdlc/gate-status.command.ts
@@ -13,6 +13,7 @@ import {
 } from '@beyondnet/evolith-core-domain/domain/gate-evidence';
 import { BaseEvolithCommand } from '../../infrastructure/cli/base-command';
 import { resolveCoreOverride } from '../../infrastructure/paths/core-resolver';
+import { exitCodeForErrorCode } from '../../infrastructure/cli/exit-codes';
 
 function ratingBadge(rating: DoraRating): string {
   switch (rating) {
@@ -76,6 +77,7 @@ export class GateStatusCommand extends BaseEvolithCommand {
       }
       if (json) {
         const msg = error instanceof Error ? error.message : String(error);
+        process.exitCode = exitCodeForErrorCode('INTERNAL_ERROR');
         console.log(JSON.stringify(createErrorEnvelope('INTERNAL_ERROR', msg, { ...meta, durationMs: Date.now() - startedAt }), null, 2));
         return;
       }
diff --git a/src/sdk/cli/src/commands/sdlc/generate-domain.command.ts b/src/sdk/cli/src/commands/sdlc/generate-domain.command.ts
index 913857513..05632f5f7 100644
--- a/src/sdk/cli/src/commands/sdlc/generate-domain.command.ts
+++ b/src/sdk/cli/src/commands/sdlc/generate-domain.command.ts
@@ -11,6 +11,7 @@ import {
   OUTPUT_ENVELOPE_SCHEMA_VERSION,
 } from '@beyondnet/evolith-core-domain/domain/gate-evidence';
 import { BaseEvolithCommand } from '../../infrastructure/cli/base-command';
+import { exitCodeForErrorCode } from '../../infrastructure/cli/exit-codes';
 
 @SubCommand({
   name: 'generate',
@@ -38,6 +39,11 @@ export class GenerateDomainCommand extends BaseEvolithCommand {
     };
 
     if (!target || !fromFile) {
+      // A missing required arg is a user-input error, not an exceptional
+      // condition: render the guidance, mark the run failed, and return
+      // gracefully. Throwing here would re-render the error and emit a stack
+      // trace via BaseEvolithCommand.handleError, and reject command.run().
+      process.exitCode = exitCodeForErrorCode('VALIDATION_FAILED');
       if (json) {
         const msg = 'Both a generation target and a source file must be specified.';
         console.log(JSON.stringify(
@@ -49,11 +55,6 @@ export class GenerateDomainCommand extends BaseEvolithCommand {
       }
       this.promptService.showError('Both a generation target and a source file must be specified.');
       this.promptService.showInfo(chalk.yellow('Example: evolith sdlc generate domain --from ddd-model.md'));
-      // A missing required arg is a user-input error, not an exceptional
-      // condition: render the guidance, mark the run failed, and return
-      // gracefully. Throwing here would re-render the error and emit a stack
-      // trace via BaseEvolithCommand.handleError, and reject command.run().
-      process.exitCode = 1;
       return;
     }
 
diff --git a/src/sdk/cli/src/commands/topology/phase-artifacts.command.spec.ts b/src/sdk/cli/src/commands/topology/phase-artifacts.command.spec.ts
index 9e16b6e2d..958ea5699 100644
--- a/src/sdk/cli/src/commands/topology/phase-artifacts.command.spec.ts
+++ b/src/sdk/cli/src/commands/topology/phase-artifacts.command.spec.ts
@@ -201,14 +201,15 @@ describe('PhaseArtifactsCommand', () => {
       },
     );
 
-    it('reports an invalid phase as an INVALID_PHASE envelope with exit code 1 in JSON mode', async () => {
+    it('reports an invalid phase as an INVALID_PHASE envelope with exit code 3 in JSON mode', async () => {
       // JSON mode must not throw — but it must not look successful either.
       await command.executeCommand([], { phase: 'nope' as never, core: corpusRoot, format: 'json' });
 
       const envelope = JSON.parse(stdout());
       expect(envelope.error.code).toBe('INVALID_PHASE');
       expect(envelope.success).not.toBe(true);
-      expect(process.exitCode).toBe(1);
+      // GT-580: INVALID_PHASE is an invalid-input error, not a tool failure.
+      expect(process.exitCode).toBe(3);
     });
 
     it.each(['construction', 'quality', 'deployment'] as const)('accepts the downstream phase %s', async (phase) => {
diff --git a/src/sdk/cli/src/commands/topology/phase-artifacts.command.ts b/src/sdk/cli/src/commands/topology/phase-artifacts.command.ts
index 87d3af368..b9cb1c74e 100644
--- a/src/sdk/cli/src/commands/topology/phase-artifacts.command.ts
+++ b/src/sdk/cli/src/commands/topology/phase-artifacts.command.ts
@@ -17,6 +17,7 @@ import {
 } from '@beyondnet/evolith-core-domain/domain/gate-evidence';
 import { BaseEvolithCommand } from '../../infrastructure/cli/base-command';
 import { resolveRulesets } from '../../infrastructure/paths/rulesets-resolver';
+import { exitCodeForErrorCode } from '../../infrastructure/cli/exit-codes';
 
 const DOWNSTREAM_PHASES: readonly DownstreamPhase[] = ['construction', 'quality', 'deployment'];
 
@@ -72,7 +73,7 @@ export class PhaseArtifactsCommand extends BaseEvolithCommand {
     if (!phase || !DOWNSTREAM_PHASES.includes(phase)) {
       const message = `--phase must be one of: ${DOWNSTREAM_PHASES.join(', ')}`;
       if (json) {
-        process.exitCode = 1;
+        process.exitCode = exitCodeForErrorCode('INVALID_PHASE');
         console.log(JSON.stringify(createErrorEnvelope('INVALID_PHASE', message, { ...meta, durationMs: Date.now() - startedAt }), null, 2));
         return;
       }
diff --git a/src/sdk/cli/src/infrastructure/cli/exit-code-taxonomy-ruleset.spec.ts b/src/sdk/cli/src/infrastructure/cli/exit-code-taxonomy-ruleset.spec.ts
new file mode 100644
index 000000000..058f46975
--- /dev/null
+++ b/src/sdk/cli/src/infrastructure/cli/exit-code-taxonomy-ruleset.spec.ts
@@ -0,0 +1,215 @@
+/**
+ * GT-580 criterion 3, end to end — the RULESET fails a command that exits
+ * outside the taxonomy.
+ *
+ * Three artifacts have to agree for the criterion to be met, and each one alone
+ * proves nothing:
+ *
+ *   src/rulesets/cli/exit-code-taxonomy.rules.json   the authored rule
+ *   src/rulesets/opa/cli-exit-code-taxonomy.rego     its Rego parity
+ *   src/sdk/cli/scripts/exit-code-taxonomy-facts.mjs the facts it decides over
+ *
+ * `opa test` already exercises the policy against hand-written fact documents,
+ * and `CliExitTaxonomyRuleHandler` already scans a tree. Neither answers the
+ * question this spec asks: does a REAL out-of-taxonomy exit, in a REAL file on
+ * disk, travel through the REAL producer and come out of the REAL policy as a
+ * blocking violation? A hand-written fixture cannot answer that — it asserts
+ * that the policy handles the input somebody imagined the producer emits.
+ *
+ * So each case below plants a scratch CLI tree, runs the committed producer over
+ * it, and feeds the result to the committed `.rego` through the pinned OPA
+ * binary. The `rogue command` case is the criterion stated literally.
+ *
+ * WHY A MISSING OPA IS RED, NOT SKIPPED. The binary is resolved through the
+ * repository's own `ensureOpa`, which fetches and pins it — the same path every
+ * OPA gate in CI takes. A spec that skipped itself when the runtime were absent
+ * would be green on exactly the machine where nothing was verified, which is the
+ * failure mode this board keeps finding.
+ */
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+const CLI_ROOT = path.resolve(__dirname, '..', '..', '..');
+const REPO_ROOT = path.resolve(CLI_ROOT, '..', '..', '..');
+const FACTS_SCRIPT = path.join(CLI_ROOT, 'scripts', 'exit-code-taxonomy-facts.mjs');
+const POLICY = path.join(REPO_ROOT, 'src', 'rulesets', 'opa', 'cli-exit-code-taxonomy.rego');
+const OPA_RUNTIME = path.join(REPO_ROOT, '.harness', 'scripts', 'opa-runtime.mjs');
+const CLI_SRC = path.join(CLI_ROOT, 'src');
+
+/** The published taxonomy, as the CLI's own `exit-codes.ts` declares it. */
+const TAXONOMY_TS = [
+  'export const CLI_EXIT_CODES = {',
+  '  OK: 0,',
+  '  TOOL_FAILURE: 1,',
+  '  BLOCKED: 2,',
+  '  INVALID_INPUT: 3,',
+  '} as const;',
+  '',
+].join('\n');
+
+// A possible one-off OPA download on a cold machine.
+jest.setTimeout(300_000);
+
+interface Violation {
+  id: string;
+  message: string;
+}
+
+/**
+ * Resolve the pinned OPA binary through the repository's own runtime helper.
+ *
+ * Done in a subprocess because `opa-runtime.mjs` is ESM and this suite is
+ * transpiled to CJS; shelling out keeps the helper as the single source of the
+ * pinned version instead of hard-coding a path that would drift from it.
+ */
+function resolveOpaBinary(): string {
+  const probe = spawnSync(
+    process.execPath,
+    [
+      '--input-type=module',
+      '-e',
+      `import { ensureOpa } from ${JSON.stringify(OPA_RUNTIME)};` +
+        `const opa = await ensureOpa(${JSON.stringify(REPO_ROOT)});` +
+        `process.stdout.write(opa.binary);`,
+    ],
+    { encoding: 'utf8', cwd: REPO_ROOT },
+  );
+  if (probe.status !== 0) {
+    throw new Error(`could not resolve the pinned OPA binary:\n${probe.stderr}`);
+  }
+  return probe.stdout.trim();
+}
+
+/** Run the committed fact producer over a source tree. */
+function collectFacts(root: string): Record<string, unknown> {
+  const probe = spawnSync(
+    process.execPath,
+    [
+      '--input-type=module',
+      '-e',
+      `import { collectExitCodeFacts } from ${JSON.stringify(FACTS_SCRIPT)};` +
+        `process.stdout.write(JSON.stringify(collectExitCodeFacts(${JSON.stringify(root)})));`,
+    ],
+    { encoding: 'utf8' },
+  );
+  if (probe.status !== 0) throw new Error(`fact producer failed:\n${probe.stderr}`);
+  return JSON.parse(probe.stdout) as Record<string, unknown>;
+}
+
+/** Ask the committed policy for its verdict on those facts. */
+function evaluatePolicy(opa: string, facts: Record<string, unknown>, workdir: string): Violation[] {
+  const inputFile = path.join(workdir, 'input.json');
+  fs.writeFileSync(inputFile, JSON.stringify({ core: { cli: { exitCodes: facts } } }));
+
+  const run = spawnSync(
+    opa,
+    [
+      'eval',
+      '--format', 'json',
+      '--data', POLICY,
+      '--input', inputFile,
+      'data.evolith.cli_exit_code_taxonomy.violations',
+    ],
+    { encoding: 'utf8' },
+  );
+  if (run.status !== 0) throw new Error(`opa refused the policy:\n${run.stderr}`);
+
+  const parsed = JSON.parse(run.stdout) as {
+    result?: Array<{ expressions?: Array<{ value?: Violation[] }> }>;
+  };
+  return parsed.result?.[0]?.expressions?.[0]?.value ?? [];
+}
+
+describe('GT-580 · the exit-code ruleset, from a real source tree to a Rego verdict', () => {
+  let opa: string;
+  let workdir: string;
+
+  beforeAll(() => {
+    opa = resolveOpaBinary();
+    expect(fs.existsSync(POLICY)).toBe(true);
+    expect(fs.existsSync(FACTS_SCRIPT)).toBe(true);
+    workdir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'gt580-ruleset-')));
+  });
+
+  afterAll(() => {
+    fs.rmSync(workdir, { recursive: true, force: true });
+  });
+
+  /** A scratch CLI tree with a declared taxonomy and whatever else is asked for. */
+  function plant(name: string, sources: Record<string, string>): string {
+    const root = path.join(workdir, name);
+    const all = {
+      'infrastructure/cli/exit-codes.ts': TAXONOMY_TS,
+      ...sources,
+    };
+    for (const [rel, contents] of Object.entries(all)) {
+      const full = path.join(root, rel);
+      fs.mkdirSync(path.dirname(full), { recursive: true });
+      fs.writeFileSync(full, contents);
+    }
+    return root;
+  }
+
+  it('clears the REAL CLI source tree, over a non-empty scan', () => {
+    const facts = collectFacts(CLI_SRC);
+
+    // The denominator first: a scan that read nothing also finds no offenders.
+    expect(facts.scanned as number).toBeGreaterThan(80);
+    expect(evaluatePolicy(opa, facts, workdir)).toEqual([]);
+  });
+
+  it('FAILS on a command that exits outside the taxonomy', () => {
+    // The criterion, stated as an experiment: force an out-of-taxonomy exit in a
+    // scratch fixture and require the ruleset to go red.
+    const root = plant('rogue', {
+      'commands/rogue/rogue.command.ts': 'export function boom(): void {\n  process.exit(7);\n}\n',
+    });
+
+    const violations = evaluatePolicy(opa, collectFacts(root), workdir);
+
+    expect(violations.map((v) => v.id)).toEqual(['CLI-EXIT-01']);
+    expect(violations[0].message).toContain('commands/rogue/rogue.command.ts');
+    expect(violations[0].message).toContain('process.exit(7)');
+  });
+
+  it('FAILS on `process.exitCode = 64` as well — the other spelling', () => {
+    const root = plant('rogue-assignment', {
+      'commands/rogue/other.command.ts': 'process.exitCode = 64;\n',
+    });
+
+    const violations = evaluatePolicy(opa, collectFacts(root), workdir);
+    expect(violations.map((v) => v.id)).toEqual(['CLI-EXIT-01']);
+    expect(violations[0].message).toContain('process.exitCode = 64');
+  });
+
+  it('does NOT let the taxonomy be widened to silence the offender', () => {
+    // The cheapest way to make the violation above disappear is to declare 7
+    // legal. CLI-EXIT-03 is the rule that stops that from counting as a fix, so
+    // the tree that tries it fails on BOTH counts.
+    const root = plant('widened', {
+      'commands/rogue/rogue.command.ts': 'process.exit(7);\n',
+      'infrastructure/cli/exit-codes.ts': TAXONOMY_TS.replace('} as const;', '  ROGUE: 7,\n} as const;'),
+    });
+
+    const facts = collectFacts(root);
+    // The producer reads the taxonomy from its own module, so the widening is
+    // injected here to exercise the policy rule rather than the producer's
+    // hard-coded mirror of the CLI constant.
+    (facts as { declared: number[] }).declared = [0, 1, 2, 3, 7];
+
+    const ids = evaluatePolicy(opa, facts, workdir).map((v) => v.id).sort();
+    expect(ids).toEqual(['CLI-EXIT-01', 'CLI-EXIT-03']);
+  });
+
+  it('refuses a vacuous scan rather than reporting it as compliance', () => {
+    const root = path.join(workdir, 'empty');
+    fs.mkdirSync(root, { recursive: true });
+    fs.writeFileSync(path.join(root, 'README.md'), '# no sources here');
+
+    const facts = collectFacts(root);
+    expect(facts.scanned).toBe(0);
+    expect(evaluatePolicy(opa, facts, workdir).map((v) => v.id)).toEqual(['CLI-EXIT-02']);
+  });
+});
diff --git a/src/sdk/cli/src/infrastructure/cli/machine-channel.registry-sweep.spec.ts b/src/sdk/cli/src/infrastructure/cli/machine-channel.registry-sweep.spec.ts
new file mode 100644
index 000000000..50d91d776
--- /dev/null
+++ b/src/sdk/cli/src/infrastructure/cli/machine-channel.registry-sweep.spec.ts
@@ -0,0 +1,290 @@
+/**
+ * GT-580 criterion 2 — `--format json` writes DATA ONLY to stdout, for EVERY
+ * command that offers the flag.
+ *
+ * WHY A SWEEP AND NOT A SAMPLE. `machine-channel.subprocess.spec.ts` already
+ * pipes two hand-picked commands (`scaffold`, `init`) and parses their stdout.
+ * That proves the guard works where it was pointed; it says nothing about the
+ * thirty other commands that accept `--format json`, and nothing at all about
+ * the command somebody adds next week. A machine consumer does not pipe the two
+ * commands we happened to test — it pipes whichever one it needs, and one stray
+ * progress line makes `JSON.parse` throw on the first byte while the command
+ * still exits 0.
+ *
+ * WHY THE ENUMERATION COMES FROM THE REGISTRY. A hand-written list of commands
+ * is a second source of truth that silently stops covering the CLI the moment a
+ * command is added. This spec asks commander — the CLI's own registry, built
+ * from the real `AppModule` — which commands declare a `--format` option, and
+ * sweeps exactly those. A new `--format json` command is therefore in the sweep
+ * on the day it is registered, without anybody remembering to add it.
+ *
+ * WHY THE DENOMINATOR IS ASSERTED. A sweep over an empty enumeration passes and
+ * proves nothing — this board has repeatedly caught guards that had never once
+ * been observed to fail. If the registry walk ever returns nothing (a changed
+ * commander internal, a broken module graph), the floor assertion turns this
+ * spec RED instead of letting it report a vacuous green.
+ *
+ * WHAT COUNTS AS CONFORMANCE. For each command: stdout must be exactly one
+ * parseable JSON document — not "mostly JSON", not "JSON after a banner" — and
+ * the exit status must be a member of the published taxonomy. Most invocations
+ * here land on a FAILURE path (no satellite, no TTY, no required flag), which is
+ * deliberate: the failure path is where prose leaks, and it is the path an agent
+ * harness most needs to parse.
+ *
+ * OBSERVED RED. Commenting out `installMachineChannelGuard()` in `main.ts` and
+ * re-running this sweep on 2026-07-29 turned `agents` (`┌  Evolith …`, a
+ * `@clack/prompts` banner) and `init-wizard` (`Starting Evolith …`) DIRTY while
+ * the other thirty stayed clean. The guard is what makes this spec green, and
+ * removing it is caught.
+ */
+import { spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { CommandFactory } from 'nest-commander';
+import { Commander } from 'nest-commander/src/constants';
+import { CLI_EXIT_CODES, CLI_EXIT_CODE_VALUES, exitCodeForErrorCode } from './exit-codes';
+
+const CLI_ROOT = path.resolve(__dirname, '..', '..', '..');
+const REPO_ROOT = path.resolve(CLI_ROOT, '..', '..', '..');
+const TS_NODE_BIN = path.join(REPO_ROOT, 'node_modules', 'ts-node', 'dist', 'bin.js');
+const CLI_ENTRY = path.join(CLI_ROOT, 'src', 'main.ts');
+const TS_CONFIG = path.join(CLI_ROOT, 'tsconfig.test.json');
+
+/**
+ * The floor the enumeration may not fall through.
+ *
+ * 32 commands declared `--format` when this spec was written. The floor sits
+ * just below so that adding commands never breaks the spec, while losing the
+ * enumeration entirely — the failure mode that would make the sweep vacuous —
+ * fails it immediately.
+ */
+const MIN_FORMAT_COMMANDS = 28;
+
+/** Six cold ts-node boots at a time; the whole sweep is ~30 process starts. */
+const CONCURRENCY = 6;
+jest.setTimeout(900_000);
+
+/**
+ * Positional arguments for the commands whose `<action>` is required.
+ *
+ * These exist so the invocation reaches the command's own code instead of
+ * stopping at commander's arity check. The values are read-only actions on
+ * purpose: the sweep must not mutate anything, and a command that refuses the
+ * argument is still a valid observation — its refusal must be a JSON document.
+ */
+const REQUIRED_ARGS: Readonly<Record<string, readonly string[]>> = {
+  'patterns get': ['no-such-pattern'],
+  'patterns for-topology': ['modular-monolith'],
+  gate: ['status'],
+  phase: ['status'],
+  profile: ['show'],
+  enforce: ['status'],
+};
+
+interface RegisteredCommand {
+  /** Space-joined path as typed, e.g. `topology recommend`. */
+  readonly path: string;
+  readonly formatFlags: string;
+}
+
+/**
+ * Ask the CLI's own commander registry which commands accept `--format`.
+ *
+ * Built from the real `AppModule`, so this is the same graph `main.ts` boots —
+ * not a directory listing of `commands/`, which would also count files that
+ * register nothing.
+ */
+async function enumerateFormatCommands(): Promise<RegisteredCommand[]> {
+  const { AppModule } = await import('../../app.module');
+  const app = await CommandFactory.createWithoutRunning(AppModule, { logger: false });
+  try {
+    // Structural access: the root workspace hoists a different major of
+    // `commander` than nest-commander runs on, so its typings are not the
+    // contract here (the same reasoning as `applyProgramName` in main.ts).
+    const program = app.get<CommanderLike>(Commander, { strict: false });
+    const found: RegisteredCommand[] = [];
+
+    const walk = (command: CommanderLike, prefix: readonly string[]): void => {
+      const trail = [...prefix, command.name()];
+      const format = (command.options ?? []).find((option) => option.long === '--format');
+      if (format) found.push({ path: trail.join(' '), formatFlags: format.flags });
+      for (const child of command.commands ?? []) walk(child, trail);
+    };
+
+    for (const child of program.commands ?? []) walk(child, []);
+    return found;
+  } finally {
+    await app.close();
+  }
+}
+
+interface CommanderLike {
+  name(): string;
+  readonly options?: ReadonlyArray<{ long?: string; flags: string }>;
+  readonly commands?: readonly CommanderLike[];
+}
+
+interface CliRun {
+  readonly command: string;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly status: number | null;
+}
+
+function runCli(command: RegisteredCommand): Promise<CliRun> {
+  return new Promise((resolve, reject) => {
+    // A fresh empty cwd per command: none of these may depend on, or touch, the
+    // repository they are being tested from.
+    const cwd = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'gt580-sweep-')));
+    // The jest setup sets EVOLITH_FORCE_INTERACTIVE for in-process specs. A
+    // piped subprocess is the machine case by definition and must not inherit it.
+    const env: NodeJS.ProcessEnv = { ...process.env, NO_COLOR: '1' };
+    delete env.EVOLITH_FORCE_INTERACTIVE;
+
+    const argv = [
+      TS_NODE_BIN,
+      '--transpile-only',
+      '--project',
+      TS_CONFIG,
+      CLI_ENTRY,
+      ...command.path.split(' '),
+      ...(REQUIRED_ARGS[command.path] ?? []),
+      '--format',
+      'json',
+    ];
+
+    // `pipe` on both is the whole point: the two channels must be observed apart.
+    const child = spawn(process.execPath, argv, { cwd, stdio: ['ignore', 'pipe', 'pipe'], env });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk: string) => (stdout += chunk));
+    child.stderr.on('data', (chunk: string) => (stderr += chunk));
+    child.on('error', reject);
+    child.on('close', (status) => {
+      fs.rmSync(cwd, { recursive: true, force: true });
+      resolve({ command: command.path, stdout, stderr, status });
+    });
+  });
+}
+
+async function runAll(commands: readonly RegisteredCommand[]): Promise<CliRun[]> {
+  const pending = [...commands];
+  const runs: CliRun[] = [];
+  const worker = async (): Promise<void> => {
+    for (let next = pending.shift(); next; next = pending.shift()) {
+      runs.push(await runCli(next));
+    }
+  };
+  await Promise.all(Array.from({ length: CONCURRENCY }, worker));
+  return runs;
+}
+
+/** The classification, stated once so both assertions read the same way. */
+function classify(run: CliRun): string {
+  const text = run.stdout.trim();
+  if (text.length === 0) return 'EMPTY (no document for a machine consumer to read)';
+  try {
+    const parsed: unknown = JSON.parse(text);
+    if (parsed === null || typeof parsed !== 'object') return 'NOT-A-DOCUMENT (bare scalar)';
+    return 'JSON';
+  } catch (error) {
+    const preview = text.slice(0, 60).replace(/\n/g, '\\n');
+    return `DIRTY (${(error as Error).message}) first bytes: ${preview}`;
+  }
+}
+
+describe('GT-580 · every `--format json` command in the registry pipes cleanly', () => {
+  let commands: RegisteredCommand[];
+  let runs: CliRun[];
+
+  beforeAll(async () => {
+    // A missing runner must be a RED test, never a skipped one.
+    expect(fs.existsSync(TS_NODE_BIN)).toBe(true);
+    commands = await enumerateFormatCommands();
+    runs = await runAll(commands);
+  });
+
+  it('enumerates the `--format` commands from the CLI registry, and finds many', () => {
+    // Guards the denominator: everything below is vacuous if this is empty.
+    expect(commands.length).toBeGreaterThanOrEqual(MIN_FORMAT_COMMANDS);
+    // Spot-check the walk actually descends into sub-commands rather than
+    // listing only top-level ones.
+    const paths = commands.map((c) => c.path);
+    expect(paths).toEqual(expect.arrayContaining(['validate', 'evaluate', 'topology recommend', 'patterns list']));
+    expect(runs).toHaveLength(commands.length);
+  });
+
+  it('writes exactly one JSON document to stdout, for every one of them', () => {
+    const offenders = runs
+      .map((run) => ({ command: run.command, verdict: classify(run) }))
+      .filter((entry) => entry.verdict !== 'JSON');
+
+    // Reported as a list so a regression names every command it broke, not just
+    // the first one jest happened to reach.
+    expect(offenders).toEqual([]);
+  });
+
+  it('exits from the published taxonomy, for every one of them', () => {
+    const offenders = runs
+      .filter((run) => !CLI_EXIT_CODE_VALUES.includes(run.status ?? -1))
+      .map((run) => ({ command: run.command, status: run.status }));
+
+    expect(offenders).toEqual([]);
+  });
+
+  it('the envelope and the exit code agree, for every one of them', () => {
+    // Membership in the taxonomy is necessary but not sufficient: a command
+    // that exits 0 with `success: false` still hands a consumer branching on
+    // the exit code the wrong verdict, and the "member of the taxonomy"
+    // assertion above cannot see it because 0 is a valid member. But
+    // `success: true` does NOT imply exit 0 — `validate`/`evaluate` legitimately
+    // pair a successful, well-formed result with exit 2 when the VERDICT
+    // itself blocks (`validate.command.ts` emits `createSuccessEnvelope` then
+    // separately `exitWith(CLI_EXIT_CODES.BLOCKED)`): the tool did not fail,
+    // it did its job and reported a blocking verdict. So the rule is:
+    //   success: true  → exit is OK or BLOCKED (never a TOOL_FAILURE/INVALID_INPUT
+    //                     that success itself denies happened)
+    //   success: false → exit is never OK, and where the envelope names an
+    //                     ADR-0073 `error.code`, the exit must match what
+    //                     `exitCodeForErrorCode` — the taxonomy's own mapping,
+    //                     also used by `BaseEvolithCommand.handleError` — says
+    //                     that code means.
+    const offenders: Array<{ command: string; status: number | null; success: unknown; errorCode?: unknown }> = [];
+    for (const run of runs) {
+      let envelope: unknown;
+      try {
+        envelope = JSON.parse(run.stdout.trim());
+      } catch {
+        continue; // already reported by the "writes exactly one JSON document" assertion
+      }
+      if (envelope === null || typeof envelope !== 'object' || !('success' in envelope)) continue;
+      const { success } = envelope as { success: unknown };
+      const status = run.status;
+
+      if (success === true) {
+        if (status !== CLI_EXIT_CODES.OK && status !== CLI_EXIT_CODES.BLOCKED) {
+          offenders.push({ command: run.command, status, success });
+        }
+      } else if (success === false) {
+        const errorCode = (envelope as { error?: { code?: unknown } }).error?.code;
+        const expected = typeof errorCode === 'string' ? exitCodeForErrorCode(errorCode) : undefined;
+        if (status === CLI_EXIT_CODES.OK || (expected !== undefined && status !== expected)) {
+          offenders.push({ command: run.command, status, success, errorCode });
+        }
+      }
+    }
+
+    expect(offenders).toEqual([]);
+  });
+
+  it('keeps diagnostics on stderr rather than deleting them', () => {
+    // The guard must be a channel rule, not a blunt silencer: the cheap "fix"
+    // for a dirty stdout is to stop printing, and that would pass the two
+    // assertions above while destroying every diagnostic a human needs.
+    const withDiagnostics = runs.filter((run) => run.stderr.trim().length > 0);
+    expect(withDiagnostics.length).toBeGreaterThan(0);
+  });
+});