Module pack 

The pack contract (ticket .kranz/tickets/pack-contract-gates-prompts.md, KRZ-313 series): a pack — a directory with a pack.toml — declares DETERMINISTIC gates, role prompts, checklists, and artefact-store adapters that kranz validates at load and wires into the mission surfaces.

This module carries the repo’s IP boundary: kranz core stays domain-free, and domain knowledge (house standards, review lenses, evidence stores) ships in private packs. The contract EXTENDS the existing pack concept (packaging/gascity/pack.toml, schema 2, docs/gascity-citizenship.md) rather than adding a second mechanism: the schema-2 base manifest ([pack] name + schema) is a valid pack that simply registers nothing, and schema 3 adds the declaration sections below.

WHY validation fails closed: every consuming surface (the final gate, the role-prompt builders, kranz pack lint) loads through the same strict path, and ANY violation — an unknown field, a wrong type, a missing required key, an empty gate command, a duplicate name, a model-judged gate kind, an engine-reserved gate name — is a load error naming the offending field, never a silently-skipped section. A pack the operator configured but kranz cannot fully account for must not quietly degrade back to pack-less behavior: the operator believes its gates run.

WHY gates compose AFTER the engine floor: a pack can add to the floor, never lower, reorder, or replace it. At the final gate the orchestrator registers the engine floor gates (crate::contract_gates) into ONE crate::gate::GatePipeline FIRST and pack gates after — registration order IS the evaluation order within the deterministic section (gate.rs), so the composition is the guarantee, not a convention. This module closes the one remaining hole: a pack gate NAMED like an engine floor gate (which would be indistinguishable in reports) is refused at load against RESERVED_GATE_NAMES. Model-judged gates stay engine-only in this slice — a pack declaring kind = "model-judged" is refused at load.

WHY checklists and artefact stores are declaration-only: this slice validates their declarations at load and reports them (lint, run-start decision) but never EXECUTES them — no checklist is checked and no artefact adapter is invoked. Declaring the shapes now means the future slices that consume them need no schema rework; executing them is deliberately out of scope.

WHY PackGate carries a pre-computed outcome: Gate::evaluate is synchronous by design (gates capture everything they need at construction), while the engine’s bounded shell runner (crate::command_exec::run_shell_command_sandboxed) is async. The orchestrator therefore runs each pack gate’s command at REGISTRATION time — same cleared contract env, same active root as the contract assertions — and the gate captures the outcome; the pipeline still owns ordering and reporting, so a pack gate flows through it exactly like a live evaluation. This mirrors crate::merge_gate::MergeSuiteGate’s capture-at-construction contract.

No pack configured ⇒ load_for_config returns Ok(None) and every surface behaves byte-identically to a pack-less engine.

Modules

projection

Flight Rules stage projections (KRZ-345, design D-D/D-F/D-G/D-J): the compact, stage-filtered renderings of the ONE approval-pinned manifest — the planning seed, the bounded plan-revision delta, and the worker/scrutiny/functional session prompts — plus the hard projection budget approval fails closed against. Flight Rules stage projections (ticket .kranz/tickets/flight-rules-workflow-projection.md, KRZ-345; design docs/scoping/flight-rules-engineering-standards.md, decisions D-D, D-F, D-G, and D-J): the ONE approval-pinned standards manifest feeds every consumer through a compact, stage-filtered projection — the planning seed, the bounded plan-revision turns, and the worker/scrutiny/functional session prompts.

resolution

Flight Rules resolution, approval pinning, and drift refusal (KRZ-342, design D-D/D-E/D-G): the deterministic applicability predicate over a loaded corpus, the engine-authored standardsManifest plan pin, and the final-validation/merge drift checks that consume only the pin and the trusted base. Flight Rules deterministic resolution, approval pinning, and drift refusal (ticket .kranz/tickets/flight-rules-resolution-pin.md, KRZ-342; design docs/scoping/flight-rules-engineering-standards.md, decisions D-D, D-E, and D-G over the KRZ-341 schema-4 corpus).

standards

The Flight Rules standards corpus (KRZ-341): the additive schema-4 [standards] root, its strict RFC/rule loader, the normalized manifest + content digest, and the lifecycle transition lint. The Flight Rules standards corpus (ticket .kranz/tickets/flight-rules-pack-contract.md, KRZ-341; design docs/scoping/flight-rules-engineering-standards.md, decisions D-A through D-C, D-F, and D-J): an ADDITIVE schema-4 extension of the pack contract. A pack declaring [standards] root = "..." carries a corpus of RFC and rule Markdown files that this module loads into ONE normalized, stable-sorted manifest plus a sha256 content digest, and whose lifecycle transitions kranz standards lint --against <ref> checks against the trusted base.

Structs

Pack

A validated pack: the manifest’s declarations, load-resolved (prompt textFiles already read) and ready for the consuming surfaces.

PackArtefactStore

One declared artefact-store adapter. DECLARATION-ONLY in this slice: validated at load, never invoked.

PackChecklist

One declared checklist. DECLARATION-ONLY in this slice: validated at load, never executed.

PackGate

A pack-declared deterministic gate adapted to the first-class crate::gate::Gate interface, registered into the final gate’s shared pipeline AFTER the engine floor gates. The outcome is captured at construction (see the module docs for the async/sync bridge); the gate is boolean-only — it reports no confidence score.

PackGateDecl

One declared deterministic gate. Runs at the final gate (advisory, like the engine floor gates) against the active tree.

PackPrompt

One declared prompt: text appended to the target role’s rendered prompt.

Enums

PromptSource

How a prompt’s text was declared.

Constants

PACK_MANIFEST

The manifest file name inside a pack directory.

RESERVED_GATE_NAMES

Engine gate names a pack gate may never claim. The first four are the contract-defect floor gates (crate::contract_gates); merge-gate-suite is the repo-owned merge gate (crate::merge_gate::MergeSuiteGate). Sharing a name would make a pack verdict indistinguishable from a floor verdict in every report — the one way a pack could appear to displace the floor — so it fails closed at load.

SCHEMA_BASE

The pre-existing base manifest version (packaging/gascity): [pack] name + schema only. A valid pack that registers nothing by convention (declaration sections are honored uniformly if present).

SCHEMA_CONTRACT

The current contract version: the base manifest plus the [[gate]], [[prompt]], [[checklist]], and [[artefact_store]] sections.

SCHEMA_STANDARDS

The Flight Rules standards version (KRZ-341): the contract sections plus the optional [standards] root = "..." key. A [standards] section at schema 2/3 is a load error naming the field — the corpus loads only where its lifecycle can be reasoned about.

Functions

load_for_config

Load the pack a mission config points at (packDir, repo-relative when not absolute). No key ⇒ Ok(None) — the byte-identical pack-less path. A key pointing at a non-directory or a non-pack is a misconfiguration and fails closed, exactly like an invalid manifest.

render_lint

The multi-line lint report: what the pack registered, with the posture of each section stated (advisory gates, declaration-only sections).

role_target_name

The pack-facing name of a prompt role target (the manifest vocabulary).