forge-gatekeeperlisted

# forge-gatekeeper `forge-review` asks "is this good code?". This skill asks the only question that matters at release time: **if this ships tonight, what breaks, leaks, or cannot be rolled back?** It is deliberately narrow — security and operability, nothing else — and deliberately binary: `SHIP` or `HOLD`, never "advisory". Trust model: the gate raises the floor, it does not certify the ceiling. It catches what a careful release manager and an AppSec reviewer would catch from the repo alone. It does not replace a penetration test, does not see infrastructure outside the repo, and reports what it could **not** verify so a human can decide. ## Argument - `<PR number | URL>`, `<branch>`, or nothing (working diff vs `main`) — same scope resolution as `forge-review`. `--base <ref>` overrides the diff base. - `--all` — release audit: step 0 runs over every tracked file, and the agent walks every trust boundary in `architecture.md`, not only the ones the diff touches. Slow; run before a major release or after adopting the skill. - `--focus=security|prod` — only that half of the checklist. ## Preconditions Reads `context/architecture.md` (or `.forge/`). Two sections drive the review and are added by `forge-init` from v0.53: **Trust Boundaries** and **Production Constraints**. If either is missing, the skill still runs, reports `GK-000` (architecture silent on boundaries/constraints, Important), and reviews from what the code reveals — but tell the user to fill them in;