Dogfood: run Gatekeep on this repo's PRs

Add .github/workflows/gatekeep-pr.yml with uses: ./ and
OPENROUTER_API_KEY from secrets. Forge-agnostic API helper for Gitea.

defaults/benchmarks.json

@@ -0,0 +1,15 @@
+{
+  "enabled": true,
+  "thresholds": {
+    "startup_ms_max": 15000,
+    "memory_mb_max": 1024,
+    "fps_min": 30
+  },
+  "notes": "Caller-configured verify-layer thresholds. Agent discovers how to run benches from README/package.json/Makefile; architecture-level perf debt is out of scope. Set a metric to null to skip it.",
+  "commands": {
+    "hint": "Optional explicit overrides. Empty = discover only.",
+    "benchmark": "",
+    "startup": "",
+    "memory": ""
+  }
+}

defaults/models.json

@@ -0,0 +1,11 @@
+{
+  "_deprecated": "Use providers.json. Kept only so old config-dir copies still resolve; resolve-providers.py migrates this shape.",
+  "models": [
+    "meta-llama/llama-3.3-70b-instruct:free",
+    "google/gemma-3-27b-it:free"
+  ],
+  "openrouter_base_url": "https://openrouter.ai/api/v1",
+  "agreement_min": 2,
+  "temperature": 0,
+  "max_tokens": 4096
+}

defaults/policy.json

@@ -0,0 +1,30 @@
+{
+  "medium_path_globs": [
+    "**/package-lock.json",
+    "**/pnpm-lock.yaml",
+    "**/yarn.lock",
+    "src/**",
+    "lib/**",
+    "server/**",
+    "packages/**"
+  ],
+  "high_path_globs": [
+    ".github/workflows/**",
+    ".github/actions/**",
+    "**/Dockerfile*",
+    "**/*secret*",
+    "**/*credential*",
+    "**/auth/**",
+    "**/billing/**",
+    "**/payment/**",
+    "**/.env*",
+    "**/security/**",
+    "scripts/release/**"
+  ],
+  "low_max_files": 8,
+  "low_max_diff_lines": 200,
+  "force_high_labels": ["security", "do-not-automerge", "high-risk", "gatekeep:high"],
+  "force_medium_labels": ["needs-human", "medium-risk", "gatekeep:medium"],
+  "do_not_automerge_labels": ["do-not-automerge", "gatekeep:no-automerge"],
+  "security_agreement": "require_agreement_unless_scan_hard_fail"
+}

defaults/providers.json

@@ -0,0 +1,16 @@
+{
+  "_deprecated": "Use providers.yaml.",
+  "agreement_min": 2,
+  "providers": {
+    "openrouter": {
+      "key": "OPENROUTER_API_KEY",
+      "protocol": "openai",
+      "models": [
+        "google/gemma-4-31b-it:free",
+        "google/gemma-4-26b-a4b-it:free",
+        "cohere/north-mini-code:free",
+        "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free"
+      ]
+    }
+  }
+}

defaults/providers.yaml

@@ -0,0 +1,17 @@
+# Bundled defaults — only providers you actually use.
+# `key` is a FREE-FORM secret / env var name (no required gatekeep_ prefix).
+# Put that name in the workflow step env, e.g. env: { OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} }
+
+agreement_min: 2
+temperature: 0
+max_tokens: 4096
+
+providers:
+  openrouter:
+    key: OPENROUTER_API_KEY
+    protocol: openai
+    models:
+      - google/gemma-4-31b-it:free
+      - google/gemma-4-26b-a4b-it:free
+      - cohere/north-mini-code:free
+      - nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free