[EPIC] Full-enforcement parity across every harness + no-gaps integration (Pi-parity → MCP reach)

[richard-devbot]

Goal

Make RStack's governance as strong on every supported harness as it is on Pi, keeping the extension/plugin model as the primary integration path — then extend reach to MCP-native hosts (Hermes and beyond). Grounded in the 2026-07-13 feasibility audit (docs/audits/2026-07-13-feasibility-standalone-vs-extensions.md).

Strategic decision (Richardson, 2026-07-13): do not rebuild RStack as a standalone coding agent with an embedded LLM. The closest open competitor (ai-sdlc-framework/ai-sdlc) is a convergent design that also delegates execution to Claude Code/Codex — the frontier is govern the loop, delegate execution. RStack's moat is governance enforced in code; this epic closes the holes in that moat and makes "100% integrated with every harness" true. A thin standalone executor may later ship as a fifth adapter on the Claude Agent SDK (its can_use_tool → PermissionResultDeny(reason) maps directly onto our guard) — tracked separately, after this epic.

The enforcement matrix today

Mechanism	Pi	Claude Code	Tau	Operator	Hermes
Destructive-action gate	✅	✅	✅	✅	❌ (not wired)
Self-approval forgery blocked	❌ #369	❌ #369	❌ #369	❌ #369	—
Classifier completeness	⚠️ #370	⚠️ #370	⚠️ #370	⚠️ #370	—
Guard fails safe (not open)	n/a	❌ #371	❌ #371	❌ #371	—
Validator read-only sandbox	✅	❌ #372	❌ #372	❌ #372	❌
Attempt/telemetry budgets	✅	❌ #373	❌ #373	❌ #373	❌
Reachable at all	✅	✅	✅	✅	❌ #374 #375

Children (sequenced)

Wave 1 — close the moat's holes (do first; cross-harness):

• [P0][security] Self-approval bypass: forge approvals.json via bash redirect defeats the destructive gate on every harness #369 🔴 P0 Self-approval bypass (bash redirect forges approvals.json; forged non-dashboard record passes audit)
• [P1][security] Destructive classifier blind spots: git checkout/restore/clean, curl|bash, chmod -R #370 🟠 P1 Destructive classifier blind spots (git checkout/restore/clean, curl|bash, chmod -R)
• [P1][security] Enforcement guard fails open when it cannot load (npx exit != 2 treated as allow) #371 🟠 P1 Guard fails open when it can't load

Wave 2 — Pi-parity on every extension harness ("no gaps"):

• [P1][harness] Validator read-only sandbox is Pi-only — stamp validator context on Claude Code / Tau / Operator #372 P1 Validator-context stamping on Claude Code / Tau / Operator
• [P1][harness] Attempt/telemetry budgets are Pi-only — guard must enforce budgets on bridge/guard harnesses #373 P1 Guard consults attempt/telemetry budgets on bridge/guard harnesses

Wave 3 — reach every MCP host (next; extensions stay primary):

• [P2][mcp] Native MCP server exposing the 18 sdlc_* tools (reaches Claude Code, Cursor, Codex, Hermes, enterprise) #374 P2 Native MCP server for the 18 sdlc_* tools (incl. prompt/skill/model: exposure design)
• [P2][harness] Integrate Hermes as an RStack host via MCP/ACP — map approvals to ACP request_permission #375 P2 Integrate Hermes via MCP/ACP (approvals ↔ ACP request_permission)

Definition of done

• The enforcement matrix above is all ✅ for Pi, Claude Code, Tau, Operator (Waves 1–2).
• doctor --framework <fw> truthfully reports guard resolvability, validator stamping, and budget enforcement for each harness.
• No governance policy is duplicated per harness — all paths funnel through the single classifier + audit + claim-gate.
• Wave 3 delivers MCP reach with the same enforcement, no second policy engine.

Issues before branches (per project rule). Claude solo per Richardson's 2026-07-13 directive; backend logic stays in place.