Governance gate commands

Verify the repo satisfies every claim declared in claims.yml. Prints one line per claim; exits non-zero if any drifted. Claims are deterministic pins — grep patterns, file presence/absence, or byte-identity between two files — that keep load-bearing facts from eroding. See the claims.yml schema.

Diff the live GitHub branch-protection ruleset against branch-protection.json; exits non-zero on any drift. Reads the required review count from governance.config.yml (autonomy is authoritative — it overrides whatever count the JSON declares).

Apply branch-protection.json to the live ruleset — create it if absent, update it if present. The write counterpart of branch-protection-check.

Verify GitHub repo settings (e.g. merge options) match governance.config.yml. Reports an unreadable admin field as ⚠ UNVERIFIABLE (fail-closed), never a phantom drift — so a field your token can't read fails honest rather than green-or-wrong.

Apply the verify: true repo settings from governance.config.yml to GitHub.

Snapshot the repo's current whole-tree gate findings into a per-occurrence baseline — grandfather existing debt so the gates block only on new findings (the new-code adoption mode). Refuses to write if regenerating would grow any count.