Stage Gate

Description

DSH stage-gate host plugin: the stage_gate / gates_list model tools validate task-workspace artifacts against the nine security presets' gate schemas (structural checks, v1), append verdicts to gate-log.md, and list each mode's canonical gate files v1.2.0 adds the intent ledger: operation_intent registers a direction with a mandatory evidence anchor (boot exemption / criterion / scope / current-session finding / chain node — cross-store validators with format-check degrade), operation_progress closes intents (done/blocked/dropped, reason required for terminal states). v1.3.0 adds the constraints layer (operation_constraints: deny/allow with optional match keywords — keyword-bearing deny entries feed deterministic bash/fetch interception) and conservative scope auto-derivation (operation_goal returns a host-precise scope draft extracted from goal/criteria text, model confirms before registering). v1.4.0 mode-aware decomposition: DECOMPOSITION per-mode theory injected into operation_goal/scope/constraints renders (session mode resolved at execute time), and deriveScopeDraft grows per-mode extractors (audit file/route paths, binary sample hashes, cloud account/region/ARN, ad CIDR; av/ctf/redteam registration-only).