feat: add repo verification gate

COMMANDS.md

@@ -186,6 +186,7 @@ fable-agent plinius godmode "improve explanation quality"
   - `-d, --domain <domain>`
 - `fable5 models`
 - `fable5 verify <task>`
+  - `--repo <path>`
 - `fable5 goal <text>`
   - `-i, --iterations <n>`
   - `-s, --min-score <n>`

src/index.ts

@@ -1487,7 +1487,39 @@ fable
 fable
   .command("verify <task>")
   .description("Run independent verifier against a task")
-  .action(async (task: string) => {
+  .option("--repo <path>", "Also run the repo verification gate at this path")
+  .action(async (task: string, opts: { repo?: string }) => {
+    if (opts.repo) {
+      const { spawnSync } = await import("node:child_process");
+      const repo = path.resolve(opts.repo);
+      const checks: Array<[string, string[]]> = [
+        ["npm", ["run", "-s", "test"]],
+        ["npm", ["run", "-s", "build"]],
+        ["npm", ["run", "-s", "docs:check"]],
+        ["npx", ["tsc", "--noEmit"]],
+        [process.execPath, [process.argv[1], "security", "scan", repo]],
+      ];
+
+      console.log(`
+  Repo Verification Gate: ${repo}`);
+      for (const [cmd, args] of checks) {
+        console.log(`
+  $ ${[cmd, ...args].join(" ")}`);
+        // ponytail: Windows npm/npx shims need cmd.exe; commands are fixed, no user shell input.
+        const check = process.platform === "win32" && (cmd === "npm" || cmd === "npx")
+          ? spawnSync("cmd.exe", ["/d", "/s", "/c", [cmd, ...args].join(" ")], { cwd: repo, stdio: "inherit" })
+          : spawnSync(cmd, args, { cwd: repo, stdio: "inherit" });
+        if (check.status !== 0) {
+          console.error(`
+  ✗ Repo verification failed`);
+          process.exit(check.status ?? 1);
+        }
+      }
+      console.log(`
+  ✓ Repo verification passed
+`);
+    }
+
     const { IndependentVerifier } = await import("./fable5/independent-verifier.js");
     const verifier = new IndependentVerifier();