markkirby125/kirby-governor-mcp

Zero-trust Model Context Protocol (MCP) governance server implementing Felix Rieseberg's 4-pillar engineering workflow (Altitude, Depth, Range, Resources / Grounding Triad) and decoupled Cross-Model Adversarial Diff Verification.
### 🪄 The Magic Prompt
Copy and paste this into any AI coding app (Cursor, Windsurf, Claude Code, Grok, Kimi, Reasonix):
markdown
@agent Install the Kirby Autonomous Engineering Governor MCP skill from: https://github.com/markkirby125/kirby-governor-mcp
1. Read SKILL.md and references/ from the repository.
2. Place into your environment's skills/rules directory preserving the dispatcher structure.
3. Build the MCP server (npm install && npm run build) and register dist/server.js under mcpServers.kirby-governor-mcp.
4. Confirm when installation is complete.
## Tools Exposed
1. compileexecutioncontract: Locks an outcome-anchored contract (Altitude + 4-Part Depth + Empirical Proof Command + basesha) to .governor/contracts/ .json with circuit-breaker immutability protection.
2. inspectsystemtelemetry: Implements the Grounding Triad (crashandlogs with stack deduplication & symlink-escape blocking, versioncommitmap, and reproduceandtest).
3. verifyadversarialdiff: Runs the deterministic proofcommand pre-gate (blocking inline eval flags), extracts a lockfile-free & secret-redacted git diff (preserving git index state for untracked files), short-circuits on matching verifiedtreehash, and sends unverified diffs to a cross-model outside judge chain: zcode first (diff attached as a file, because zcode -p ignores stdin), then reasonix with deepseek-flash as failover (diff over stdin), then codex and claude. A judge that exits with empty output hands the diff to the next one. The chain ends in JUDGEUNAVAILABLE only when every judge fails. A 3-strike ESCALATETOHUMAN circuit breaker applies.
4. orchestraterangecrew: Reframes nouns into human-outcome verbs and executes a sequential multi-disciplinary specialist review pipeline with bounded context windows. Its judge step uses the same outside judge chain, with a 90-second timeout per judge.
## Outside Judge Chain
verifyadversarialdiff sends unverified diffs to an outside judge CLI from a different model family than the primary agent. Candidates run in this order:
1. zcode (zcode-cli): the diff is written to a payload file under .governor/judge/ and passed with --attach, because zcode -p ignores stdin. It runs as zcode -p --mode build --attach . The file is deleted after the call.
2. reasonix (reasonix-cli): runs as reasonix -p --model deepseek-flash --output-format text, with the diff on stdin.
3. codex (codex-cli): runs as codex exec -, with the diff on stdin.
4. claude (claude-cli): runs as claude -p -, with the diff on stdin.
Unless KIRBYGOVERNORJUDGECMD is set, only CLIs found on PATH are used. A candidate from the same model family as the primary agent is tried last.
The chain moves on to the next judge when a judge produces empty stdout. That covers a non-zero exit with no output, a spawn error, and a failure to write the zcode payload file. It also covers a 120-second timeout: a judge killed for timing out is skipped even if it printed partial output. The first judge that finishes in time and writes stdout is used. If every judge fails, the tool returns JUDGEUNAVAILABLE with each attempt's reason.