mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-06 17:04:27 +01:00
A repository with no .gstack/pregate.json now gets a warn (PREGATE_NO_POLICY) with a starter policy printed, instead of PREGATE_NO_LANE on every touched file; gstack-pregate init remains the explicit write. The policy gains an allowlist for benign secrets/pii findings (env.value and secret never allowlistable). Checks that cannot run because of the machine report PREGATE_ENVIRONMENT (incomplete, with kind and evidence) apart from diff failures. Every run writes its scratch under the state root, per run id. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>