feat(cb-z719.1): a project declares its navigator gates, and the launcher refuses a gate it does not know

[rmstdope]

Bead cb-z719.1, first child of the navigator-gates epic cb-z719.

.cerebro/project.conf gains navigator_gates, any subset of plan, review and merge in any order; absent means none, which is today's behaviour. scripts/launch-preflight validates it for the producer and bugfixer policies and refuses a launch under a word it does not know, naming the three valid ones, because a misspelt gate would gate nothing and say nothing. Interactive roles are never checked. templates/project.conf documents the key under a new "The navigator" block.

Tests in tests/launch-preflight.sh: a valid set launches, no key launches, a misspelt word refuses a producer and a bugfixer with the words named, and a UX agent is never checked. What the gates do is the next child, cb-z719.2.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GKiLr59caM9f6DxkrsDYR8

[Copilot]

Copilot review overview

🟢 Approval recommended

The change is a small, convention-consistent validation plus documentation with comprehensive test coverage and no unchanged-path behavioural impact.

Review effort: Balanced
Findings: None

What changed in this PR

This PR is the first child (cb-z719.1) of the navigator-gates epic (cb-z719). It introduces a new navigator_gates declaration in a consumer's .cerebro/project.conf — any subset of plan, review, and merge — and makes scripts/launch-preflight validate it before starting a builder (producer or bugfixer), refusing a launch with exit 2 when it encounters an unknown word and naming the three valid gates. Interactive roles are deliberately not checked. This is validation-and-documentation only; the behaviour the gates drive is deferred to cb-z719.2.

Changes:

• Added a validation loop in scripts/launch-preflight (inside the existing producer/bugfixer block) that reads navigator_gates via project-conf and refuses any word other than plan/review/merge.
• Documented the new key under a new "The navigator" block in templates/project.conf.
• Added test coverage in tests/launch-preflight.sh for a valid set, an absent key, a misspelt word (producer and bugfixer), and the UX role being unchecked.

File	Description
scripts/​launch-preflight	Validates navigator_gates for builder policies, refusing unknown words with exit 2 and the launch-refused message; follows the existing gate_fast refusal pattern.
templates/​project.conf	Documents the optional navigator_gates key and its plan/review/merge values.
tests/​launch-preflight.sh	Adds five assertions covering valid, absent, misspelt (producer + bugfixer), and never-checked-UX cases; suite still ends with suite_passed.

Notes verified during review:

• The unquoted for gate in $navigator_gates word-splitting matches the codebase's own convention (project-conf uses for script in $scripts / for target in $targets).
• Each refusal calls launch-refused (which exits 0) followed by an explicit exit 2, consistent with the existing gate_fast refusal.
• project-conf reads arbitrary keys and exits 0 with the value or empty, so the read and || navigator_gates="" fallback behave as expected.
• The error grep plan, review, merge\|plan review merge uses GNU BRE alternation, which is fine on the ubuntu-latest CI target.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.