Whole-Stack CI Governance Gate

One deterministic verdict over the WHOLE agent stack

Every other AgentSmack gate is shallow or single-surface: the prompt-check gate only knows prompt readiness, and the CLI gate can block on exactly ONE scorer surface at a time. None render a single verdict over the whole agent stack. This is that flagship capability — the CI Governance Gate packaging mode. It consumes the same cross-surface findings envelope every scan emits and evaluates a versioned, declarative policy server-side: a severity ceiling, a total cap, independent per-severity caps, blocked surfaces, must-be-clean surfaces, and a block on a confirmed kill-chain. It renders ONE ordered, deterministic pass / fail decision with a CI exit code the gate consumes verbatim — severity sourced from the same cross-surface remediation generator, the chain from the same kill-chain correlator, so the closed vocabulary cannot drift. It adds no new surface and no new scorecard dimension — it CONSUMES the existing bridges. The prompt-check gate keeps its own path; this covers the cross-surface stack. Load a sample to watch the gate decide with no live infra.