feat: Enterprise Architecture — 9-Layer Pipeline, Isolation, Sandbox, Resilience

.github/workflows/behavioros-merge-gate.yml

@@ -0,0 +1,49 @@
+name: BehaviorOS Merge Gate
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  merge-gate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build core packages
+        run: pnpm build
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Lint check
+        run: pnpm lint:check
+
+      - name: Run core tests
+        run: pnpm --filter @behavioros/core test
+
+      - name: Validate DNA
+        run: npx @behavioros/cli validate
+
+      - name: Block merge on failure
+        if: failure()
+        run: |
+          echo "::error::Merge gate failed — one or more checks did not pass."
+          exit 1

.github/workflows/behavioros-quality-gate.yml

@@ -0,0 +1,46 @@
+name: BehaviorOS Quality Gate
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality-gate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build core packages
+        run: pnpm build
+
+      - name: EAARG pipeline validation
+        run: npx @behavioros/cli eaarg start
+        continue-on-error: true
+        id: eaarg
+
+      - name: Fallback — DNA validate
+        if: steps.eaarg.outcome == 'failure'
+        run: npx @behavioros/cli validate
+
+      - name: Block merge on failure
+        if: failure()
+        run: |
+          echo "::error::Quality gate failed — EAARG pipeline did not pass."
+          exit 1

.github/workflows/ci.yml

@@ -42,7 +42,6 @@ jobs:
 
       - name: Typecheck
         run: pnpm typecheck
-        continue-on-error: true
 
       - name: Build web app
         run: pnpm --filter @behavioros/web build

.github/workflows/security.yml

@@ -0,0 +1,48 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Audit dependencies
+        run: pnpm audit --audit-level=high
+
+      - name: Check for secrets in code
+        run: |
+          echo "Checking for hardcoded secrets..."
+          if grep -rn "password\s*=\s*['\"]" packages/ --include="*.ts" --include="*.js" 2>/dev/null | grep -v "test\|mock\|fake\|example\|placeholder"; then
+            echo "WARNING: Potential hardcoded secrets found"
+            exit 1
+          fi
+          echo "No hardcoded secrets detected"
+
+      - name: Check for .env files
+        run: |
+          if find . -name ".env" -not -path "*/node_modules/*" -not -path "*/.env.example" 2>/dev/null | grep -q .; then
+            echo "WARNING: .env files detected in repository"
+            exit 1
+          fi
+          echo "No .env files detected"

.opencode/agents/orchestrator.md

@@ -3,8 +3,17 @@ description: Central coordinator that delegates tasks to specialized agents, man
 mode: subagent
 temperature: 0.1
 permission:
-  edit: allow
-  bash: allow
+  edit: deny
+  bash:
+    "*": deny
+    "git status*": allow
+    "git log*": allow
+    "git diff*": allow
+    "git branch*": allow
+    "pnpm build*": allow
+    "pnpm test*": allow
+    "pnpm lint*": allow
+    "pnpm typecheck*": allow
   webfetch: allow
   websearch: allow
   skill:

AGENTS.md

@@ -27,7 +27,7 @@ DNA Layer (YAML)    → Personas, governance rules, quality gates, patterns, wor
 | `@behavioros/sdk` | High-level TypeScript SDK (`BehaviorOS` class) |
 | `@behavioros/cli` | CLI: init, compile, validate, status, version |
 | `@behavioros/dnas` | Pre-built DNA YAML pattern catalog |
-| `@behavioros/mcp-server` | MCP server (8 tools + 5 resources, stdio transport) |
+| `@behavioros/mcp-server` | MCP server (36 tools + 5 resources, stdio transport) |
 | `@behavioros/web` | Next.js 15 dashboard (apps/web) |
 
 ## Dev Commands
@@ -67,10 +67,10 @@ DNA packages define behavioral patterns in YAML with these sections:
 ## MCP Server Tools
 
 The `@behavioros/mcp-server` exposes these tools to AI agents:
-- `create_mission`, `list_missions`, `update_progress`
-- `list_agents`, `get_status`
-- `evaluate_governance`, `run_audit`
-- `record_learning`
+- `create-mission`, `list-missions`, `update-progress`
+- `list-agents`, `get-status`
+- `evaluate-governance`, `run-audit`
+- `record-learning`
 
 ## Agent Team — BehaviorOS DNA Wiring