P0: complete the zero-config multi-host boundary wedge

.agents/skills/agents-shipgate/SKILL.md

@@ -1,3 +1,3 @@
 ---
 name: agents-shipgate
 description: Use when the user wants to run the prominent Agents Shipgate flows — `shipgate check`, `agents-shipgate verify`, or `shipgate audit --host` — for AI agent capability changes, PR release readiness, or coding-agent host grants.
@@ -18,7 +18,7 @@
 3. Before running Shipgate CLI commands, require a CLI whose `agents-shipgate contract --json` reports `minimum_control_contract_version: 14`: run `command -v agents-shipgate`, `agents-shipgate --version`, and `agents-shipgate contract --json`. If it is missing or stale, tell the user to install or upgrade `agents-shipgate`. The Codex plugin supplies workflows, not the scanner binary.
 4. Set `AGENTS_SHIPGATE_AGENT_MODE=1` before running Shipgate commands so errors include structured `next_action` JSON.
 5. Default first-time CI to advisory mode. Do not enable release-blocking CI or save a baseline until a human has reviewed current findings.
-6. For local agent control, run `shipgate check --agent codex --workspace . --format codex-boundary-json` and read the stdout `shipgate.codex_boundary_result/v2` object. Switch on `control.state`; follow only `control.next_action`, `control.allowed_next_commands`, and `control.human_review`. Treat `decision` as diagnostic context only.
+6. For local agent control, run `shipgate check --agent codex --workspace . --format agent-boundary-json` and read the stdout `shipgate.agent_boundary_result/v1` object. Switch on `control.state`; follow only `control.next_action`, `control.allowed_next_commands`, and `control.human_review`. Treat `decision` as diagnostic context only.
 7. Before editing `shipgate.yaml`, Shipgate CI, AGENTS/CLAUDE/Cursor rules, policy packs, baselines, waivers, suppressions, Codex hooks/config, Codex plugin manifests, `.mcp.json`, `.app.json`, or `SKILL.md`, plan to run `agents-shipgate verify` before completion and route trust-root review to a human when the verifier requires it.
 8. For full PR verification, read `agents-shipgate-reports/agent-handoff.json` first and switch on `control.state`, then read `verifier.json` for detailed control state, `verify-run.json` for reproducibility metadata, and `report.json` for reviewer detail; `report.json.release_decision.decision` remains the release gate.
 9. Auto-apply only high-confidence safe patches. Do not auto-assert action effect, action authority, agent bindings, approval, confirmation, idempotency, broad-scope, prohibited-action, or runtime-trace evidence.
@@ -27,7 +27,7 @@
 ## Fast Paths
 
 - CLI preflight: run `command -v agents-shipgate`, `agents-shipgate --version`, and `agents-shipgate contract --json`. Continue only when the installed CLI reports `minimum_control_contract_version: 14`; if it is missing or stale, ask the user to install or upgrade `agents-shipgate`.
-- Agent-native check: run `shipgate check --agent codex --workspace . --format codex-boundary-json`; read only the JSON result for continue/repair/stop routing.
+- Agent-native check: run `shipgate check --agent codex --workspace . --format agent-boundary-json`; read only the JSON result for continue/repair/stop routing.
 - Agent-related PR/CI diff: run `agents-shipgate verify --workspace . --config shipgate.yaml --base origin/main --head HEAD --ci-mode advisory --format json` after making the base ref available. For local uncommitted work, omit `--base`/`--head` so the working tree is scanned. `verify` never fetches.
 - Existing manifest / ongoing PR: run `agents-shipgate verify --workspace . --config shipgate.yaml --ci-mode advisory --format json`.
 - Unconfigured repo or uncertain relevance: run `agents-shipgate verify --preview --json`.
@@ -37,7 +37,7 @@
 
 - Do not claim a finding is fixed without re-running `agents-shipgate verify` and reporting the new merge verdict and release decision.
 - Do not self-approve trust-root changes; when `agents-shipgate verify` returns human review required, surface it to a human.
-- Before finishing an agent-related diff, run `shipgate check --agent codex --workspace . --format codex-boundary-json` and follow `shipgate.codex_boundary_result/v2.control.state`. Only `complete` permits completion; a human route cannot be cleared by conversation-level acknowledgement.
+- Before finishing an agent-related diff, run `shipgate check --agent codex --workspace . --format agent-boundary-json` and follow `shipgate.agent_boundary_result/v1.control.state`. Only `complete` permits completion; a human route cannot be cleared by conversation-level acknowledgement.
 - Do not bypass the verifier by suppressing findings, lowering severity, expanding baselines or waivers, removing Shipgate CI, or weakening agent instructions; verify-mode `SHIP-VERIFY-*` checks make those trust-root edits release-visible.
 - Do not silently suppress findings. Suppressions require a non-empty `reason`.
 - Do not commit generated reports.

.agents/skills/agents-shipgate/references/recipes.md

@@ -1,3 +1,3 @@
 # Agents Shipgate Recipes
 
 Use these recipes after the `agents-shipgate` skill triggers. The prominent
@@ -26,7 +26,7 @@
 ```
 
 Do not report the task complete until the CLI exists and reports runtime
-contract 14. Local boundary checks emit `shipgate.codex_boundary_result/v2`;
+contract 14. Local boundary checks emit `shipgate.agent_boundary_result/v1`;
 legacy v1 fixtures are retained only for older protocol integrations.
 
 ## Local Agent Check
@@ -35,7 +35,7 @@
 
 ```bash
 AGENTS_SHIPGATE_AGENT_MODE=1 shipgate check \
-  --agent codex --workspace . --format codex-boundary-json
+  --agent codex --workspace . --format agent-boundary-json
 ```
 
 Read only stdout JSON. Switch on `control.state`, follow

.claude-plugin/marketplace.json

@@ -9,8 +9,8 @@
     {
       "name": "agents-shipgate",
       "source": "./plugins/claude-code",
-      "description": "Run Agents Shipgate Tool-Use Readiness workflows from Claude Code: detect whether Shipgate applies, bootstrap the advisory gate, verify agent-capability PRs, and triage findings without fabricating human approval. Requires the agents-shipgate CLI (pipx install agents-shipgate, runtime contract 14).",
-      "version": "0.16.0b3",
+      "description": "Run Agents Shipgate Tool-Use Readiness workflows from Claude Code: detect whether Shipgate applies, bootstrap the advisory gate, verify agent-capability PRs, and triage findings without fabricating human approval. Requires the agents-shipgate CLI (pipx install agents-shipgate, runtime contract 15).",
+      "version": "0.16.0b4",
       "author": {
         "name": "Three Moons Lab",
         "url": "https://threemoonslab.com/"

.claude/commands/shipgate.md

@@ -1,3 +1,3 @@
 ---
 description: "Run the prominent Agents Shipgate flows: check, verify, or audit --host"
 ---
@@ -31,7 +31,7 @@
 
 ```bash
 AGENTS_SHIPGATE_AGENT_MODE=1 shipgate check \
-  --agent claude-code --workspace . --format codex-boundary-json
+  --agent claude-code --workspace . --format agent-boundary-json
 AGENTS_SHIPGATE_AGENT_MODE=1 agents-shipgate verify \
   --workspace . --config shipgate.yaml \
   --base origin/main --head HEAD \
@@ -51,7 +51,7 @@
 3. For verifier runs, parse `agents-shipgate-reports/agent-handoff.json` first,
    then `verifier.json`, `verify-run.json`, and
    `report.json.release_decision.decision` as the release gate.
-4. For check runs, parse stdout as `shipgate.codex_boundary_result/v2` and
+4. For check runs, parse stdout as `shipgate.agent_boundary_result/v1` and
    switch on `control.state`; follow `control.next_action`,
    `control.allowed_next_commands`, and `control.human_review`. Treat
    `decision` as diagnostic context only.

.cursor/rules/agents-shipgate.mdc

@@ -1,3 +1,3 @@
 ---
 description: Run Agents Shipgate as the deterministic merge gate for AI-generated agent capability changes.
 globs:
@@ -37,10 +37,10 @@
 
 For local agent control, run:
 
-  shipgate check --agent cursor --workspace . --format codex-boundary-json
+  shipgate check --agent cursor --workspace . --format agent-boundary-json
 
 Read the check stdout JSON only. It is
-`shipgate.codex_boundary_result/v2`; switch on `control.state`, then follow
+`shipgate.agent_boundary_result/v1`; switch on `control.state`, then follow
 `control.next_action`, `control.allowed_next_commands`, and
 `control.human_review`. Treat `decision` as diagnostic context, not as the
 operational control signal. Do not infer control from prose.

.github/workflows/ci.yml

@@ -1,3 +1,3 @@
 name: CI
 
 on:
@@ -55,6 +55,12 @@
         # Binding is a separate trust dimension from effect and authority.
         # Keep these exact outcomes visible before the aggregate coverage run.
 
+      - name: Multi-host boundary safety canaries (48+ exact outcomes)
+        run: python -m pytest tests/test_agent_boundary.py -q
+        # Cross-host boundary completeness is a separate trust dimension.
+        # Keep false-complete, input-integrity, and secret-redaction failures
+        # visible before the aggregate coverage run.
+
       - name: Test
         # v0.21 (E7): bumped from 75 → 85. Actual aggregate coverage on
         # current main is ~88%, so the gate is +10pp tighter with ~3pp

.pre-commit-hooks.yaml

@@ -8,8 +8,8 @@
 #
 # Scope: the `files:` regex below covers every **path-based** trigger from
 # `docs/triggers.json` — manifest, MCP/OpenAPI/Swagger exports, static tool
-# inventories, Codex repo config, Codex plugin package files,
-# prompts/policies, AND the Shipgate CI workflow files.
+# inventories, coding-agent host configuration/instructions, plugin package
+# files, prompts/policies, AND GitHub workflow files.
 # Diff-only triggers (`TRIGGER-FUNCTION-TOOL-DECORATOR` and
 # `TRIGGER-FRAMEWORK-VERSION-BUMP`) are not covered by the regex pre-gate —
 # pre-commit's `files:` regex is purely path-based and cannot inspect diff
@@ -32,11 +32,17 @@
   always_run: false
   stages: [pre-commit, pre-push]
   files: |
-    (?x)^(
+    (?ix)^(
       shipgate\.yaml|
       .*tools.*\.json|
       .*mcp.*\.json|
-      (.*/)?\.codex/(config\.toml|hooks\.json)|
+      (.*/)?\.codex/(config\.toml|hooks\.json|requirements\.toml)|
+      (.*/)?\.claude/(settings(\.local)?\.json|commands/.*)|
+      (.*/)?\.cursor/(cli\.json|mcp\.json|rules/.*)|
+      (.*/)?\.vscode/mcp\.json|
+      (.*/)?\.shipgate/agent-contract\.json|
+      (AGENTS(\.override)?|CLAUDE)\.md|
+      \.(agents|claude)/skills/.*|
       .*\.codex-plugin/.*|
       .*\.agents/plugins/.*|
       .*\.app\.json|
@@ -46,7 +52,7 @@
       \.agents-shipgate/.*\.json|
       prompts/.*|
       policies/.*|
-      \.github/workflows/agents-shipgate\.(yaml|yml)
+      (.*/)?\.github/workflows/.*\.(yaml|yml)
     )$
   minimum_pre_commit_version: "3.0.0"
 
@@ -62,11 +68,17 @@
   always_run: false
   stages: [pre-push]
   files: |
-    (?x)^(
+    (?ix)^(
       shipgate\.yaml|
       .*tools.*\.json|
       .*mcp.*\.json|
-      (.*/)?\.codex/(config\.toml|hooks\.json)|
+      (.*/)?\.codex/(config\.toml|hooks\.json|requirements\.toml)|
+      (.*/)?\.claude/(settings(\.local)?\.json|commands/.*)|
+      (.*/)?\.cursor/(cli\.json|mcp\.json|rules/.*)|
+      (.*/)?\.vscode/mcp\.json|
+      (.*/)?\.shipgate/agent-contract\.json|
+      (AGENTS(\.override)?|CLAUDE)\.md|
+      \.(agents|claude)/skills/.*|
       .*\.codex-plugin/.*|
       .*\.agents/plugins/.*|
       .*\.app\.json|
@@ -76,7 +88,7 @@
       \.agents-shipgate/.*\.json|
       prompts/.*|
       policies/.*|
-      \.github/workflows/agents-shipgate\.(yaml|yml)
+      (.*/)?\.github/workflows/.*\.(yaml|yml)
     )$
   minimum_pre_commit_version: "3.0.0"
 

.well-known/agents-shipgate.json

@@ -3,7 +3,7 @@
   "name": "agents-shipgate",
   "display_name": "Agents Shipgate",
   "tagline": "The deterministic merge gate for AI-generated agent capability changes",
-  "version": "0.16.0b3",
+  "version": "0.16.0b4",
   "license": "Apache-2.0",
   "publisher": {
     "name": "Three Moons Lab",
@@ -84,19 +84,19 @@
     "agents-shipgate",
     "shipgate"
   ],
-  "quickstart": "shipgate check --agent codex --workspace . --format codex-boundary-json",
+  "quickstart": "shipgate check --agent codex --workspace . --format agent-boundary-json",
   "primary_commands": {
-    "check_codex": "shipgate check --agent codex --workspace . --format codex-boundary-json",
-    "check_claude_code": "shipgate check --agent claude-code --workspace . --format codex-boundary-json",
-    "check_cursor": "shipgate check --agent cursor --workspace . --format codex-boundary-json",
+    "check_codex": "shipgate check --agent codex --workspace . --format agent-boundary-json",
+    "check_claude_code": "shipgate check --agent claude-code --workspace . --format agent-boundary-json",
+    "check_cursor": "shipgate check --agent cursor --workspace . --format agent-boundary-json",
     "verify_pr": "agents-shipgate verify --workspace . --config shipgate.yaml --base origin/main --head HEAD --ci-mode advisory --json",
     "host_audit": "shipgate audit --host --json --out agents-shipgate-reports/host-grants.json"
   },
   "commands": {
-    "agent_check": "shipgate check --agent codex --workspace . --format codex-boundary-json",
-    "agent_check_codex": "shipgate check --agent codex --workspace . --format codex-boundary-json",
-    "agent_check_claude_code": "shipgate check --agent claude-code --workspace . --format codex-boundary-json",
-    "agent_check_cursor": "shipgate check --agent cursor --workspace . --format codex-boundary-json",
+    "agent_check": "shipgate check --agent codex --workspace . --format agent-boundary-json",
+    "agent_check_codex": "shipgate check --agent codex --workspace . --format agent-boundary-json",
+    "agent_check_claude_code": "shipgate check --agent claude-code --workspace . --format agent-boundary-json",
+    "agent_check_cursor": "shipgate check --agent cursor --workspace . --format agent-boundary-json",
     "preflight": "agents-shipgate preflight --workspace . --config shipgate.yaml --plan - --json",
     "preview": "agents-shipgate verify --preview --json",
     "install_ai_coding_workflow": "agents-shipgate init --workspace . --write --json",
@@ -170,16 +170,18 @@
   ],
   "codex_boundary_result_schema_version": "shipgate.codex_boundary_result/v2",
   "codex_boundary_result_schema_path": "docs/codex-boundary-result-schema.v2.json",
+  "agent_boundary_result_schema_version": "shipgate.agent_boundary_result/v1",
+  "agent_boundary_result_schema_path": "docs/agent-boundary-result-schema.v1.json",
   "report_schema_version": "0.32",
   "packet_schema_version": "0.10",
   "verifier_schema_version": "0.3",
   "verify_run_schema_version": "shipgate.verify_run/v2",
   "agent_handoff_schema_version": "shipgate.agent_handoff/v3",
   "agent_handoff_schema_path": "docs/agent-handoff-schema.v3.json",
   "agent_handoff_artifact": "agents-shipgate-reports/agent-handoff.json",
-  "contract_version": "14",
+  "contract_version": "15",
   "minimum_control_contract_version": "14",
-  "local_agent_contract_schema_version": "3",
+  "local_agent_contract_schema_version": "4",
   "inputs": [
     "mcp",
     "openapi",
@@ -246,7 +248,10 @@
   "attestation_schema_version": "0.4",
   "registry_schema_version": "0.3",
   "org_evidence_bundle_schema_version": "shipgate.org_evidence_bundle/v1",
-  "host_grants_inventory_schema_version": "0.1",
+  "host_grants_inventory_schema_version": "0.2",
+  "host_grants_baseline_schema_version": "0.2",
+  "host_grants_drift_schema_version": "0.2",
+  "trigger_catalog_schema_version": "0.2",
   "capability_standard_version": "0.4",
   "governance_benchmark_catalog_schema_version": "0.2",
   "governance_benchmark_result_schema_version": "0.2",
@@ -272,6 +277,9 @@
     "org_governance",
     "org_evidence_bundle",
     "host_grants_inventory",
+    "host_grants_baseline",
+    "host_grants_drift",
+    "agent_boundary_result",
     "governance_benchmark_catalog",
     "governance_benchmark_result"
   ],
@@ -390,6 +398,7 @@
     "manifest": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/manifest-v0.1.json",
     "report": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/report-schema.v0.32.json",
     "agent_result": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/agent-result-schema.v2.json",
+    "agent_boundary_result": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/agent-boundary-result-schema.v1.json",
     "codex_boundary_result": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/codex-boundary-result-schema.v2.json",
     "verifier": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/verifier-schema.v0.3.json",
     "verify_run": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/verify-run-schema.v2.json",
@@ -405,7 +414,9 @@
     "org_governance": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/org-governance-schema.v0.1.json",
     "org_evidence_bundle": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/org-evidence-bundle-schema.v1.json",
     "registry": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/registry-schema.v0.3.json",
-    "host_grants_inventory": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/host-grants-inventory-schema.v0.1.json",
+    "host_grants_inventory": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/host-grants-inventory-schema.v0.2.json",
+    "host_grants_baseline": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/host-grants-baseline-schema.v0.2.json",
+    "host_grants_drift": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/host-grants-drift-schema.v0.2.json",
     "scenario": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/scenario-schema.v0.1.json",
     "checks_catalog": "https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/checks.json"
   },