CC-518: Add immutable gate scope manifests

CHANGELOG.md

@@ -10,6 +10,18 @@ Versions follow [Semantic Versioning](https://semver.org/).
 
 ### Added
 
+- **Immutable gate scope manifest (CC-518).** `pmctl gate run` now creates a
+  content-addressed `gate_scope_manifest_v1` before reviewer dispatch, bound to
+  the immutable gate subject and linked from `gate_assurance_v3`. It declares
+  changed/renamed/untracked paths, hunk ranges, paired tests, sensitive
+  signals, surface flags, and bounded peer/call-site/shared-helper hints.
+  Sequential and parallel reviewers receive the same manifest digest.
+  Budget omissions stop as `INCOMPLETE` unless explicitly accepted with
+  `--accept-scope-truncation`; accepted truncation remains recorded with exact
+  omitted counts and reasons. Named v3 consumers now require verified linked
+  scope evidence; historical v3 envelopes with unavailable scope remain
+  readable only through non-authorizing artifact inspection.
+
 - **Immutable gate subject and shared three-axis verification (CC-515).**
   Current gate producers emit `gate_assurance_v3` with a stable Git
   common-directory repository key, provenance-only observed root, base/head

cli/commands.tsv

@@ -38,7 +38,7 @@ task review	Record a task review result.	pmctl task review <id> [options]	experi
 safe bash	Run a shell command through guard policy.	pmctl safe bash --role <role> --runtime <runtime> [--] <command>	experimental	false	true	--role, --runtime, --	pmctl safe bash --role reviewer --runtime codex -- "git diff --check"
 validate brief	Validate a dispatch brief.	pmctl validate brief <path> [options]	experimental	false	false	--schema	pmctl validate brief /tmp/brief.md
 decision add	Append a structured decision.	pmctl decision add --date <date> --title <title> --path <path> [options]	experimental	true	true	--date, --title, --path, --closes, --tags, --evidence, --json	pmctl decision add --date 2026-01-01 --title "Example" --path DECISIONS.md
-gate run	Start the pull-request gate.	pmctl gate run [options]	experimental	false	true	--executor, --test-cmd, --cd	pmctl gate run --executor codex
+gate run	Start the pull-request gate.	pmctl gate run [options]	experimental	false	true	--executor, --test-cmd, --accept-scope-truncation, --cd	pmctl gate run --executor codex
 gate verify	Assess artifact validity, subject freshness, and consumer applicability.	pmctl gate verify <result-file> [--cd <repo>] [--consumer embedded|generic|maintainer|publish] [--json]	experimental	true	false	--cd,--consumer,--json	pmctl gate verify .gate-results/result.md --cd . --json
 gate wait	Wait for a detached gate run.	pmctl gate wait <gate-id> [options]	experimental	false	true	--cd, --timeout	pmctl gate wait gate-123 --cd .
 gate cancel	Stop the verified gate producer process tree, then cancel only its recorded child runs; partial termination stays indeterminate.	pmctl gate cancel <operation-id> --cd <dir> [--grace <seconds>]	experimental	false	true	--cd, --grace	pmctl gate cancel op-20260724T000000Z-abcdef --cd .

commands/pr-gate.md

@@ -1,6 +1,6 @@
 ---
 description: Run the tiered pre-PR review pipeline on the current branch.
-argument-hint: "[express|standard|full] [--targeted r1,r2 --initial-result path] [--scope context] [--mode sequential|parallel]"
+argument-hint: "[express|standard|full] [--targeted r1,r2 --initial-result path] [--scope context] [--mode sequential|parallel] [--accept-scope-truncation]"
 ---
 
 Run the PR gate via `pmctl gate run`. The `runtime/bin/pr-gate.sh` script is the
@@ -30,6 +30,7 @@ but does not treat it as a downgrade.
 | Conserve reviewer-session token usage | `--mode sequential` |
 | Request independent reviewer sessions | `--mode parallel` |
 | Request a specific tier | `express` / `standard` / `full` (cannot lower the policy floor) |
+| Continue after declared-scope budgets omit entries | `--accept-scope-truncation` (only after inspecting the manifest) |
 
 A tier or reviewer-coverage policy rejection happens before reviewer dispatch
 and is an execution/policy failure, not a `Final: NO-GO` reviewer verdict.
@@ -39,6 +40,15 @@ plus in-scope untracked content, so an approval cannot be replayed after a
 same-shape content change. `.gate-overrides.md` only supplies reviewer finding
 context and cannot lower policy.
 
+Before dispatch, the gate writes one immutable-subject-bound
+`gate_scope_manifest_v1` containing changed/renamed/untracked paths, hunk
+ranges, paired tests, sensitive signals, explicit surface flags, and bounded
+adjacent review hints. Every selected reviewer receives the same manifest
+digest. If a budget omits entries, the default outcome is `INCOMPLETE` before
+dispatch. `--accept-scope-truncation` permits the run to continue while
+recording `accepted_truncation`, omitted counts, and reasons; it does not claim
+complete semantic or call-graph coverage.
+
 ## Step 1 - Invoke pmctl directly
 
 Call the bare `pmctl` command with no resolution preamble — an installed
@@ -102,6 +112,7 @@ SCOPE_TOKENS=()
 GATE_MODE=""
 GATE_EXECUTOR="<gate_executor>"
 GATE_MODEL=""
+ACCEPT_SCOPE_TRUNCATION=false
 
 if [[ -n "$RAW_ARGS" ]]; then
   read -r -a TOKENS <<< "$RAW_ARGS"
@@ -166,6 +177,9 @@ while [[ "$idx" -lt "${#TOKENS[@]}" ]]; do
       GATE_MODEL="${TOKENS[$idx]:-}"
       [[ -n "$GATE_MODEL" ]] || { echo "error: --model requires a value" >&2; exit 2; }
       ;;
+    --accept-scope-truncation)
+      ACCEPT_SCOPE_TRUNCATION=true
+      ;;
     *)
       SCOPE_TOKENS+=("$tok")
       ;;
@@ -204,6 +218,7 @@ GATE_ARGS=(--cd "<work_dir>" --executor "$GATE_EXECUTOR" --policy generic)
 [[ -n "$TARGETED_REVIEWERS" ]] && GATE_ARGS+=(--targeted "$TARGETED_REVIEWERS" --initial-result "$INITIAL_RESULT")
 [[ -n "$SCOPE" ]] && GATE_ARGS+=(--scope "$SCOPE")
 [[ -n "$GATE_MODE" ]] && GATE_ARGS+=(--mode "$GATE_MODE")
+[[ "$ACCEPT_SCOPE_TRUNCATION" == true ]] && GATE_ARGS+=(--accept-scope-truncation)
 
 # Launch detached: this call is inline (NOT run_in_background) and returns in
 # well under a second once the supervisor is forked -- stdout prints exactly

core/README.md

@@ -22,6 +22,10 @@ Gate assurance definitions are split deliberately:
 - `schema/gate-assurance.schema.json` defines the portable envelope that records
   resolved coordinates, policy resolution, immutable subject, and linked
   evidence.
+- `schema/gate-scope-manifest.schema.json` defines the content-addressed,
+  immutable-subject-bound scope declaration shared by every selected reviewer.
+  It records exact changed inputs, bounded review hints, and explicit
+  truncation rather than claiming a complete call graph.
 - `schema/gate-verification.schema.json` defines the shared three-axis
   assessment returned to gate consumers.