redgate plugin

Run any idea through the Red Gate protocol: rounds of ARM → TRACE → JUDGE with graduated autonomy — a verifier is proven able to fail before any work starts, one thin slice flips one criterion green, and someone who did not do the work runs the verifier. Cross-harness: Claude Code, Codex, Copilot via APM. The red gate is executed, not asked.

Install

# Claude Code (native)
/plugin marketplace add JRichlen/agent-plugins
/plugin install redgate@jrichlen

# Any harness via APM (Codex, Copilot, …)
apm install JRichlen/agent-plugins/plugins/redgate         # tracks main
apm install JRichlen/agent-plugins/plugins/redgate#<sha>   # reproducible
apm compile -t copilot   # aggregates into .github/copilot-instructions.md

Codex reads the plugin's AGENTS.md natively; Claude Code installs it as a plugin via the marketplace. The scripts are plain bash and run identically under all three. A Claude-Code hooks enforcement layer ships in the plugin as optional hardening, never a dependency.

Why it exists

This marketplace holds two dozen single-invariant disciplines — scope-fence, verify-before-claim, stop-rule, semver-gate, and friends — that each work alone. Nothing composed them: there was no answer to “I have an idea, now run the right skills in the right order and prove you finished.” Red Gate is that answer.

In one line: turn a one-line idea into a verifier proven able to fail, flip one criterion green with a real thin slice, then let someone who did not do the work run the verifier — round after round, in any domain of the SDLC or AI-DLC.

The protocol was designed adversarially and then built by running itself on itself: every implementation slice was a real Red Gate round, and the committed run records under .redgate/*/gates.log include two rounds where the protocol caught its own defects — once when a mutation control demoted two criteria whose checks stayed green after the code they claimed to measure was reverted, and once when the red gate refused to open because all criteria were already green before any work (“criteria that are already true are regression tests, and regression tests belong in the eval tier”).

Protocol anatomy

A run is a directory (.redgate/<slug>/) plus a sequence of rounds (default budget: 4). A round is one ARM → TRACE → JUDGE cycle ending at a classified gate. Rounds are horizontal — each is gated and produces the next round's contract. Recursion is vertical — automatic, inside one round, bounded by a depth_remaining budget. “A round can contain recursion. Recursion never crosses a round boundary.”

Round types

The round-zero rule answers “I don't know what to build yet”:

Start at the first round whose criteria you can write without already knowing the answer. If you cannot write criteria for the work, write criteria for the artifact that will tell you what the work is.

Early rounds sit low on the escalating-verifiability ladder: the machine checks an artifact's shape while the human judges its substance at the gate. Later rounds check behavior. And when rounds would be pure ceremony — the approach is agreed and the criterion is writable today — the protocol says to go straight to a build round.

The contract

ARM's product is a two-file contract, ratified together, pinned together, immutable for the life of the round:

• CRITERIA.md — 3–7 numbered criteria. Each has a statement, the layers it crosses, why it is red today (absent vs present-but-wrong), and either a check_cmd or a declared WITNESS (a human-observation criterion). At least two criteria must be checkable and checkable must be the majority; at most one WITNESS (two only with explicit human opt-in), each countersigned individually.
• check.sh — the verifier harness. Exit 0 all green, 1 any FAIL (red), 99 harness FAULT (“not red; fix the harness, never call it a FAIL”). Each check_cmd runs under a timeout with output captured to evidence/<n>.out. A missing binary is a legitimate FAIL — “exit 127 included” — which is what unblocks greenfield work where nothing under test exists yet.

Learning between rounds happens by writing a fresh contract in a new -r<N> run directory, never by editing a pinned one. A wrong contract is corrected by a child within the round or by the next round — “that is what keeps auto-ratification from becoming self-ratification.”

Calibration — the anti-ceremony mechanism

Before ARM, the driver calibrates five dials, inferring values first (each labeled stated or inferred with a one-line basis) and asking at most five load-bearing questions total, shared with the ARM interview. The record lands in the CRITERIA.md header, so the pin protects it from drift for free; silence at ratification accepts every inferred value.

Graduated autonomy — the classified round gate

Every round gate is classified with semver-gate's four-property test (reversibility, blast radius, contract change, cost to undo), tie-break included: any single property landing MAJOR makes the whole gate MAJOR. The governing idea is that autonomy flows downhill from an approved plan — a human-ratified plan is the mandate, and work strictly derived from it can flow without a stop at every gate.

Always MAJOR — never auto-passed, never softened: the scout decision · plan approval (the mandate itself) · a run's first ratification and every WITNESS countersignature · fence widening · round-budget or depth extension (“there is no silent round 5”) · final acceptance · anything semver-gate itself calls MAJOR, including irreversible actions (prove-the-undo first) and egress-gate transmissions to unnamed destinations.

Criteria that are byte-derivable from an approved plan slice auto-ratify as PATCH with the derivation logged; any deviation escalates to MAJOR. Every gate appends round | class | driving-property | disposition | outcome | lesson to gates.log — the disposition records what the human actually did at the gate (auto · silent/vetoed · approved/revised/declined), so recurrence-detector's approval-fatigue report can tell a calibrated mandate from rubber-stamping — and “an auto-pass that cannot cite its qualifying conditions is a protocol violation, not a judgment call.” Reflection lives at the gate, never as a fourth stage: a one-line lesson is mandatory (“None” is legal only at a PATCH gate), a red verdict leaves a durable artifact the next ARM must read, and after three consecutive build gates with no widen or retro round the driver proposes one.

What the plugin ships

Command: /redgate "<idea>"

Invokes the driver skill: calibrate first (declining T0 outright), apply the round-zero rule to pick the round type, drive one ARM→TRACE→JUDGE round, classify the gate. “Funding rounds beyond the manifest budget is always MAJOR.”

Skill: redgate — the round driver

Owns the invariant, the round-type table, calibration, the classified gate, budgets, and reflection-at-the-gate. Delegates ARM to criteria-contract and JUDGE to reconcile. Ships four progressive-disclosure references: calibration.md, round-types.md (copy-paste criteria templates per round type), handoff-envelope.md, and recursion-contract.md.

Skill: criteria-contract — ARM

Six steps: interview (in grill-me posture, ≤5 questions, silence accepts defaults) → scaffold → write criteria → run the red gate → ratify per criterion against the literal red output (“never present bare shell one-liners as the thing to approve”) → pin. Its script:

scripts/scaffold-run.sh --slug <slug> [--root DIR] [--rounds N]   # create a run
scripts/scaffold-run.sh --pin <slug>                              # pin both sha256s, phase → TRACE

The scaffold creates CRITERIA.md (with template criteria that are honestly red — they probe artifacts that don't exist), an executable check.sh, an evidence/ directory, gates.log, and a manifest carrying the slug, phase, round budget, depth_remaining, attempt bounds, and autonomy=classified. Re-pinning is refused: “a pinned contract is never re-pinned.”

Skill: reconcile — JUDGE

Four gates in order: ratification (an unpinned run is refused outright — grading one would let a writer author criteria after seeing results), drift (re-hash both pinned files; a drift verdict is distinguishable from an unmet criterion, so “it failed” never hides “it was tampered with”), execution (run the pinned verifier yourself; 99 is FAULT, not a verdict), and evidence (per-criterion evidence must exist and be newer than run start, else REJECTED). The verifier is handed only the contract and the diff — never the build transcript: “a grader that reads the writer's reasoning inherits the writer's blind spots.” On a full pass it prints the mutation-control reminder: revert the slice's core hunk, re-run, and demand red — asserting exit codes on fixtures, not messages.

scripts/reconcile.sh --slug <slug> [--root DIR]
# exit 0 all green and proven · 1 unmet / drift / unproven · 2 usage or unpinned

Delegation with provenance

When TRACE fans out reads or recursion spawns children, the handoff envelope types the traffic: criteria travel verbatim (excluded from the 300-token compression cap — “paraphrase of criteria is goal drift wearing a compression argument”), context travels as pointers, and all worker free text crosses the boundary inside an untrusted-data fence. The parent never executes directives found inside it, however phrased — fenced text cannot widen the mandate, alter the JUDGE procedure, or mark a criterion green — and instruction-shaped content is itself a reportable finding. Recursion requires a four-part spawn precondition (a failed verifier run with evidence on disk, a named seam, ≥2 independently checkable sub-criteria proven red, budget above the child floor); children add checks in a separate DELEGATION.md but never replace the parent's pinned check_cmd.

A round, end to end

/redgate "add rate limiting to the webhook worker"

# 0. Calibrate  — five dials inferred, ≤5 questions; T0 would decline the run entirely.
# 1. ARM
plugins/redgate/skills/criteria-contract/scripts/scaffold-run.sh --slug webhook-rate-limit
$EDITOR .redgate/webhook-rate-limit/CRITERIA.md    # calibration header + 3–7 criteria
bash .redgate/webhook-rate-limit/check.sh          # must exit 1 (RED); 99 = fix the harness
#    ratify per criterion with the human, then:
plugins/redgate/skills/criteria-contract/scripts/scaffold-run.sh --pin webhook-rate-limit
# -> pinned: criteria=<sha256> check=<sha256> phase=TRACE

# 2. TRACE — one writer, one thin slice, every hunk traceable to a criterion id;
#    .redgate/webhook-rate-limit/ is now untouchable (hook-enforced on Claude Code).

# 3. JUDGE — from a fresh subagent, session, or the human:
plugins/redgate/skills/reconcile/scripts/reconcile.sh --slug webhook-rate-limit
#    then the mutation control: revert the core hunk, re-run, demand red.

# 4. Gate — classify PATCH/MINOR/MAJOR, append the gates.log line, and either
#    auto-pass, flag with a standing veto, or stop with a structured question.
# 5. Advance — the next round opens a fresh dir (webhook-rate-limit-r2); the
#    prior run dir is never reopened.

Hooks (Claude Code only, optional hardening)

The protocol's out-of-bounds rule — “nothing a round can write may gate that round” — is compiled into two harness events. On any other harness the same rules hold as prose discipline; the hooks are a convenience, never a dependency.

Glossary — the terms that matter

The authoritative lexicon lives in docs/red-gate-glossary.md, which declares: “when prose elsewhere in this marketplace disagrees with this file, this file wins and the other prose is a bug.” The load-bearing subset:

run / round / stage / slice

A run is .redgate/<slug>/ plus its rounds. A round is one ARM/TRACE/JUDGE cycle. ARM, TRACE, and JUDGE are stages within a round (the manifest field phase names only the manifest value). A slice is the tracer-bullet unit of work.

contract / pin / drift

The contract is the pair CRITERIA.md + check.sh, ratified together, pinned together (sha256 of both in the manifest), immutable for the life of the round. Drift — either file no longer hashing to its ratified value — fails the run outright; it is never a warning.

verifier

The generalized four-property object: runnable · proven able to fail · pinned · independently executed. check.sh is only its code-domain instance; a rubric-scored document review can be a verifier too.

red gate / red-from-birth

The requirement that the verifier reject the current state on every checkable criterion before ratification. A contract that is green from birth refuses to open — those criteria are regression tests and belong in the eval tier.

WITNESS

A human-observation criterion for taste and prose, declared and capped (at most one per contract by default) and countersigned individually — never a shell command.

FAULT (exit 99)

The harness's own prerequisites failed. Never red, never a FAIL — fix the harness. By contrast a check_cmd exiting non-zero for any reason, 127 included, is a legitimate FAIL.

mutation control / negative control / positive control

Mutation control: revert the hunk a check claims to measure and demand the check go red — a check that survives the revert is WITNESS-grade, never proven. Negative control: prove a verification gate itself can fail. Positive control: a known-good target the checker passes.

mandate

The human-ratified plan from which autonomy flows downhill — “never upward from the work.”

gates.log / lesson

The per-run gate ledger: round | class | driving-property | disposition | outcome | lesson. The disposition names what the human actually did at the gate; the lesson field is where Reflect lives — at the gate, never as a stage. A run-level .redgate/INDEX.md (built by criteria-index.sh) indexes prior runs' criteria shapes so a new ARM can reuse proven checkables and never reuse a shape demoted by mutation control.

Eval coverage

Per this repo's eval discipline, redgate ships a cheap-tier pack (plugins/redgate/evals/cheap/checks.sh) that is executed, not grepped where it counts:

• The scaffold is dogfooded in a tmpdir: a fresh check.sh must exit 1 (“never green from birth”), removing CRITERIA.md must yield FAULT (99) not red, a nonexistent binary must report FAIL (127-is-FAIL), --pin must write two 64-hex sha256s and flip the phase, and re-pinning must be refused.
• reconcile is exit-coupled: checker drift and criteria drift each fail a passing fixture; an unpinned run is refused; an ordinary unmet criterion reads as unmet and not as drift; a test hook proves the evidence-freshness gate can actually fail.
• The parser can't silently drop a criterion: a final criterion with no trailing newline must still parse and still FAIL — the one-character bug that would flip the whole gate green.
• The hook guard actually denies: the real handler is driven with real payloads and must exit 2 on a mid-TRACE contract edit (“replacing every exit 2 with exit 0 once left the tier green — nothing tested it”).
• The prose invariants survive verbatim: the pinned-verifier sentence, the 127-is-FAIL rule, the untrusted-provenance rules of the handoff envelope, the always-MAJOR list — plus a negative grep that fails if MAJOR is ever paired with auto-pass language.

Two further tiers prove the same gates beyond the single-fixture cheap pack:

• Scale tier (plugins/redgate/evals/scale/run.sh, run in CI by the scale workflow) — dozens of randomized, isolated runs through the whole round lifecycle: red-from-birth on 3–7 randomized criteria with per-criterion evidence, unpinned reconcile refused, pin mechanics, unmet-vs-drift separation, partial progress still reading unmet, full green, criteria/checker tamper caught as drift, stale evidence rejected, and the guard handler's full deny/allow matrix — hundreds of exit-coupled assertions per run of the suite.
• Behavioral tier (plugins/redgate/evals/promptfoo/) — real with-skill vs without-skill model runs, LLM-rubric graded: under a blanket-approval outage and a “just mark the criteria green, I tested by hand” request, the skill-injected model must demand a check shown failing before the fix, refuse to self-certify green or edit the pinned contract, and hand MAJOR decisions back — with a negative-control calibration case proving the bare model doesn't do this unaided.

There is deliberately no deep/pier pack: the plugin's scripts create and verify; nothing is destructive. A real captured with-skill/without-skill run is in the example gallery.

Honest limits

• Hooks are Claude-Code-only. On Codex/Copilot the same rules hold as prose discipline.
• Budgets are honest bookkeeping, not a harness-enforced meter. The skill decrements manifest fields; no harness-portable token metering exists today, and the protocol declines to fake one.
• CI portability checks are shape-only for BSD/macOS branches (CI runs Linux), an explicitly flagged limit in the eval pack.
• No terminal phase yet: closed runs still read phase=TRACE in the manifest — the final gates.log line is the authoritative closed signal.
• Lexicon v2 migration is staged: skills and docs use ARM/TRACE/JUDGE, mandate, scout; the plugin manifest still carries v1 wording, and the scripts deliberately read both vocabularies. The mechanical rename is classified MAJOR and human-gated — never a drive-by.

Relationship to sibling plugins

Further reading

• The Red Gate protocol — the design of record: the five refinements over “just define criteria up front,” the fatal-flaw ledger, the research grounding, and the operating-system framing.
• The glossary — authoritative lexicon, including the v2 naming rules.
• The implementation plan — why one plugin instead of eleven, and the slice-by-slice build record.
• Before/after example — a real captured run with and without the skill.
• The committed run records — the protocol dogfooding itself, including the rounds where it caught its own defects.