[isc-fschwich]

Moves the quality gates from spec-gates 0.3.3 to 0.5.1 and adds the pull request check that 0.5.x ships.

Runtime (.specify/gates, .claude/hooks/gates)

• Re-projected with the release's own project.sh from gates-0.5.1.zip, after checking its sha256 and sigstore bundle. The installed extension matches the zip byte for byte.
• policy.json is unchanged. The settings added since 0.3.3 (git.block_bulk_staging, spec.cover, the hook timeout and severity) keep their defaults.
• 0.5.1 fixes the false "timeout after Ns" on accept blocks and project gates (#292 upstream). It also stops gate commands reaching the main repository from a linked worktree (#293).
• New since 0.3.3:
  • the pre-merge-commit hook
  • the staged-file secret scan
  • pr-check.sh, and project.sh for later upgrades

Pull request check (.github/workflows/gates.yml)

• A new step checks every pull request:
  • its title and description against the commit-message rules
  • the Protected-Change declarations in its commits
  • the secret and forbidden-file scan over each commit
• It runs the base branch's pr-check.sh, so a pull request can't change the code that judges it.
• This PR is the adopting one, so it runs its own copy.
• Dependabot and Renovate descriptions are skipped; their titles are still checked.
• Checkout now fetches full history, and edited re-runs the check when a title or description changes.

README

• The gate formats README.md with --ignore-path .prettierignore, but .gitignore lists /*.md, so a plain prettier --check skipped it. The tables were misaligned on master. This PR fixes the formatting only.
• The MCP registration example now quotes the whole -e "IRIS_PASSWORD=$IRIS_PASSWORD" argument. The shell reads it the same way, and the new secret scan no longer mistakes it for a hard-coded password.
• docs/getting-started.md and skills/skills/iris-cpf-merge/SKILL.md still use the old form, so the scan will flag them the next time either is committed.

Checks

• zizmor and actionlint are clean.
• The workflow tests pass (44).
• verify.sh --boundary agent and --boundary git pass.
• Doctor reports nothing missing.
• pr-check.sh passes locally over this branch's commits, with this title and description.

[isc-tdyar]

Checked the runtime against the v0.5.1 release zip (sha256 matches; all 36 projected files identical). The workflow is read-only, pinned, and runs the base revision's pr-check.sh. Approving.