feat: fleet governance adapter (SPEC-1b-2) — mcpDeny policy + gateway registration

.github/workflows/ci.yml

@@ -24,6 +24,8 @@ jobs:
       - name: "Checkout armory-todo (file dep companion)"
         working-directory: ${{ github.workspace }}
         run: git clone --depth 1 https://github.com/getpipher/armory-todo.git ../armory-todo
+      - name: Clone armory-gateway sibling (contract-test dependency)
+        run: git clone --depth 1 https://x-access-token:${{ secrets.SIBLINGS_PAT }}@github.com/getpipher/armory-gateway.git ../armory-gateway
       - run: pnpm install --frozen-lockfile
       - run: pnpm typecheck
       - run: pnpm test:run

README.md

@@ -444,6 +444,34 @@ Small-backlog batch (issues #57/#63/#64/#65):
 - **Panel Escape semantics documented + dead code removed (#63)** — Escape always cancels the active panel flow; defaults are accepted via Enter-on-blank. (Also fixed: ctrl+c could trigger the never-documented "escape accepts default" callbacks.)
 - **README example tier names fixed (#65)** — the `ship-feature` example now uses real tier names (`economy`/`standard`).
 
+## MCP governance (armory-gateway integration)
+
+When [armory-gateway](https://github.com/getpipher/armory-gateway) is resolvable, fleet
+registers an MCP governance provider at session start: every MCP call made through the
+gateway passes fleet's `mcpDeny` policy before it executes.
+
+`~/.pi/agent/fleet/settings.json` (global) and `<cwd>/.pi/fleet/settings.json` (project,
+wins per-field):
+
+```json
+{
+  "mcpDeny": [
+    "github__delete_repo",
+    "internal-tools"
+  ]
+}
+```
+
+- Entries: bare `server` (deny the whole server) or `server__tool` (deny one exact tool).
+- Invalid entries produce an actionable warning and are dropped; valid entries stay enforced.
+- Policy is re-read per call — edits take effect immediately.
+- Gateway absent (the default for public fleet installs)? Nothing changes: registration
+  is skipped silently and fleet behaves exactly as before. Check the gateway's `status`
+  output — `interceptors governance=✗` means standalone.
+- Deliberately deferred to later slices: per-call cost accounting, per-agent/per-run policy
+  scoping, and child-session MCP access (see `docs/SPEC-1b-2-fleet-governance-adapter.md` §15
+  for the rationale and revival conditions).
+
 ## Dogfood reliability (v0.14.0)
 
 Four fixes from dogfooding the fleet on itself (issues #58–#61):

package.json

@@ -48,18 +48,19 @@
     "test:run": "node --import tsx --test --test-timeout=30000 test/*.test.mts"
   },
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "^0.81.1",
-    "@earendil-works/pi-tui": "^0.81.1",
-    "@earendil-works/pi-ai": "^0.81.1",
-    "@getpipher/armory-todo": "^0.5.4",
+    "@earendil-works/pi-ai": "^0.84.4",
+    "@earendil-works/pi-coding-agent": "^0.84.4",
+    "@earendil-works/pi-tui": "^0.84.4",
     "@getpipher/armory-memory": "^0.1.1",
-    "@getpipher/vision": "^0.5.2",
+    "@getpipher/armory-todo": "^0.5.4",
+    "@getpipher/vision": "^0.5.3",
     "typebox": "^1.1.38",
     "yaml": "^2.5.0"
   },
   "devDependencies": {
+    "@getpipher/armory-gateway": "file:../armory-gateway",
+    "@types/node": "^22.0.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.6.0",
-    "@types/node": "^22.0.0"
+    "typescript": "^5.6.0"
   }
 }