feat(ci): reconcile advisory PR trust policy from current evidence - #383

* feat(ci): add the agent trust verification gate

`npm run agent-verify` is the local completion gate. It runs the agent
trust guards, the Vite+ and TypeScript checks, every workspace build and
test, the OpenAPI generation drift check, and the offline MCP protocol
smoke.

- bin/check-agent-trust.mjs keeps skills/agent-trust/feature-map.json in
  sync with the MCP tools registered in server.ts, the SDK package
  exports, and the MCP and SDK docs navigation. It also checks the
  vite-plus toolchain pins, the ordered workspace build, and that no
  workspace has its own Vite config.
- bin/check-openapi-types.mjs regenerates the SDK types, the SDK filter
  reference, and the MCP filter schemas from docs/openapi.json in a
  temporary checkout and fails on any drift.
- The feature map covers main as it is now: 14 tools (whoami included)
  and the Gemini and Antigravity setup guides.
- The guard skips the TypeScript build-info file when the SDK compiles
  incrementally or as a composite project. Before this, that file
  failed the dist check.
- CI runs the guards and the drift check as a new step in the toolchain
  job. The existing check, test, and build steps stay as they are.

Rebuilt on current main from #384's branch (head 4241fb6). The
/containers/{id}/route OpenAPI path, its schemas, and its reference page
are left out. Main removed those docs in 2792425.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(sdk): compile consumers against the generated container contract

Type-checks small consumer programs against the generated OpenAPI types.
A container payload with type "container" compiles. An account
discriminant is rejected with TS2322.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: keep the list filter reference SEO metadata in its generator

#421 edited the title and description in the generated list-filters.mdx
but not in the script that generates it. The next regeneration (#418)
put the old metadata back. This change moves #421's metadata into
generate-filter-types.mjs and regenerates the page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: Auto-generate Postman collection from openapi.json [skip ci]

* feat(ci): reconcile advisory PR trust policy from current evidence (#383)

* feat(ci): reconcile advisory PR trust policy from current evidence

Add an advisory trust-policy controller that classifies changed paths by
risk, checks current-head human writer approvals and exact-attempt CI
evidence, and writes risk labels and summaries. It never authorizes a
merge; native branch protection stays the merge authority.

- trust-policy.yml, shadow-risk.yml and trust-review-signal.yml run
  trusted default-branch code only.
- scripts/ci holds the classifier, the shadow scorer, the read-only
  branch-protection checker and the reconciler, with regression tests.
- CODEOWNERS names owners for every high-risk path.
- npm test and agent-verify now run the policy tests.

Rebuilt from the reviewed history at 6b5f819 on top of the rebuilt
agent-trust base; the Postman bot commit is not carried over.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: add the trust-policy installation guide and GitHub trial

Keep the maintainer guides with the agent-trust skill and link them from
the paved path, so maintainers run the GitHub verification trial before
they change merge protection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ci): own every agent-trust verifier and drop moved guide paths

bin/check-openapi-types.test.mjs was classified medium risk and had no
CODEOWNERS entry, unlike the other verifier tests. The new test derives
the verifier list from bin/, so a future verifier cannot miss either.

The docs/risk-gates*.md entries pointed at guides that now live under
skills/agent-trust/, which the existing prefix rules already cover.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: Auto-generate Postman collection from openapi.json [skip ci]

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* chore: Auto-generate Postman collection from openapi.json [skip ci]

* chore: keep main's generated Postman collection

The generator assigns random request IDs and enum example values, so
each rerun rewrites about 640 lines of the collection from an unchanged
docs/openapi.json. This branch does not change the spec, so it carries
main's collection and the PR diff has no generated churn.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ci): hold aliased MCP registerTool calls to the feature map

The registration inventory only counted calls whose receiver was the
identifier `server`, so `const alias = server; alias.registerTool(...)`
or a reassigned receiver registered a tool the feature map never saw.

Every `<receiver>.registerTool(...)` call in server.ts now counts as a
registration whatever the receiver is. Any other use of `registerTool`
(destructuring, `.bind`, a computed key held in a variable) fails with
the source line, so a registration cannot hide behind an unsupported
form.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ci): skip node_modules when expanding workspace globs

The toolchain guard appended /package.json to each root workspace pattern
and globbed it as-is, so a recursive pattern such as sdks/** also matched
installed dependency manifests (sdks/typescript-sdk/node_modules/*/package.json)
and failed on their missing toolchain pins. npm ignores **/node_modules/**
when it maps workspaces; the guard now does the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ci): give each trust reconciliation a 60s deadline

The advisory sweep awaited every PR in sequence, so one stalled GitHub
request could hold the job until its 20-minute timeout and starve every
later PR. Each PR now runs under an AbortController deadline. When it
fires, the PR is reported as failed, its in-flight direct request is
aborted, any later label write for that PR is rejected before it is sent,
and the sweep moves on to the next PR.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ci): keep timed-out PRs out of the trust job summary

A PR that hit its deadline could still finish later (a stalled paginated
call is not aborted) and append its report to the shared job summary,
next to the failure that said it timed out. Each PR now writes into its
own buffer, and only a PR that finishes within its deadline flushes it to
the job summary.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>