feat: add Pawl to the Zero State portfolio (rebased; supersedes #60)

.github/workflows/pawl.yml

@@ -0,0 +1,71 @@
+# Pawl ratchet gate. Make the "pawl" job a required status check on main.
+# Actions are pinned by commit SHA. Dependabot keeps the pins current.
+name: pawl
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pawl-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pawl:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      pull-requests: write
+    env:
+      BASE_REF: ${{ github.base_ref }}
+      EVENT: ${{ github.event_name }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Install Pawl (hash-pinned, own venv)
+        run: |
+          python -m venv "$RUNNER_TEMP/pawl-venv"
+          cat > "$RUNNER_TEMP/pawl-requirements.txt" <<'REQ'
+          pawl-gate==0.2.0 \
+              --hash=sha256:5daa5a256c79bfedc8b7d6ecd0c44d32ecaafb6473859e5b28939614ae2b7ddd \
+              --hash=sha256:29ef49ad3737004bfb58c4455e1bb89a35ef6b95310a38fd243c38d020ce4d1c
+          REQ
+          "$RUNNER_TEMP/pawl-venv/bin/python" -m pip install --require-hashes --no-deps \
+            --only-binary :all: -r "$RUNNER_TEMP/pawl-requirements.txt"
+          echo "PAWL=$RUNNER_TEMP/pawl-venv/bin/pawl" >> "$GITHUB_ENV"
+      - name: Install the project
+        run: |
+          python -m pip install --upgrade pip
+          if [ -f pyproject.toml ]; then pip install -e .; fi
+      - name: Pawl check (gate definition from the base branch)
+        run: |
+          if [ "$EVENT" = "pull_request" ]; then
+            "$PAWL" check --ci --trusted-ref "origin/$BASE_REF"
+          else
+            "$PAWL" check --ci
+          fi
+      - name: Pawl guard (tamper detection and test replay)
+        if: always() && github.event_name == 'pull_request'
+        run: |
+          "$PAWL" guard --ci --replay --base "origin/$BASE_REF"
+      - name: Post the report on the pull request
+        if: always() && github.event_name == 'pull_request'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          "$PAWL" report --format md > pawl-report.md
+          gh pr comment "$PR_NUMBER" --body-file pawl-report.md --edit-last \
+            || gh pr comment "$PR_NUMBER" --body-file pawl-report.md

.gitignore

@@ -3,3 +3,5 @@ node_modules/
 coverage/
 work/
 npm-debug.log*
+.pawl/
+pawl-test-results.xml

PAWL_DEBT.md

@@ -0,0 +1,9 @@
+# Pawl debt log
+
+Append-only record of every baseline change, newest last. Pawl writes this
+file. A human reviews every entry marked LOOSENED.
+
+
+## 2026-10-08 22:30 MDT: update (tightened)
+
+- tightened site-validation: recorded 0 failing, 1 collected (1 order(s))

README.md

@@ -29,6 +29,7 @@ Public product pages map to org repositories:
 | Hollersports | [Zero-State-LLC/Hollersports](https://github.com/Zero-State-LLC/Hollersports) |
 | Marigold Market | [Zero-State-LLC/Marigold-Market](https://github.com/Zero-State-LLC/Marigold-Market) |
 | Noema | [noema.guru](https://noema.guru) |
+| Pawl | [pypi.org/project/pawl-gate](https://pypi.org/project/pawl-gate/) |
 
 ### Clients
 
@@ -78,6 +79,10 @@ npm test
 
 `npm test` runs deterministic site validation (pages, assets, internal links, product posture, identity-motion constraints). Dev server: `http://localhost:8080`.
 
+Pawl ratchets that validation in CI. Locally, run `/path/to/pawl check` after
+installing `pawl-gate==0.2.0`; the gate records the canonical `npm test` result
+without exposing the private product repositories.
+
 ## Social preview
 
 `assets/og-image.png` (1200×630) is referenced by Open Graph and Twitter Card meta on the home page.

intent/2026-10-08-pawl-portfolio-entry.md

@@ -0,0 +1,45 @@
+# Intent — Pawl portfolio entry
+
+## Problem
+
+Pawl is publicly available on PyPI but is not represented in the Zero State
+portfolio. The site needs a project entry and a supporting hero graphic that
+match the existing product-page system without exposing the private GitHub
+repository as a public destination.
+
+## Proposed outcome
+
+Add Pawl as a product entry with a dark product page, a generated hero asset,
+an entry on the official home portfolio map, and the corresponding manifest,
+README, and sitemap records. Link publicly to PyPI only.
+
+## Evidence
+
+- OBSERVED: Danny's email dated 2026-10-08 identifies Pawl as a ratchet gate
+  for agent coding work.
+- OBSERVED: PyPI destination is `https://pypi.org/project/pawl-gate/` and the
+  email states the current release is `0.2.0`.
+- OBSERVED: The email states Pawl is free and open under Apache-2.0, tested on
+  Linux and macOS, with Windows untested.
+- OBSERVED: Danny supplied the website copy and reported 20 of 21 agent cheats
+  caught and 0 of 8 clean changes blocked.
+- NOT_READY: The GitHub repository remains private and must not be linked from
+  the public site.
+
+## Constraints
+
+- Preserve the existing Zero State dark product-page format.
+- Do not claim Windows support or link the private repository.
+- Keep the supplied evaluation numbers attributed as reported evidence, not a
+  general guarantee.
+- Do not deploy or publish without explicit human approval.
+
+## Source
+
+Danny Meyer, “Pawl: links, how to use it, and website copy,” received
+2026-10-08 via `prabu.openclaw@gmail.com`.
+
+## Status
+
+Implementation authorized by the owner's direct request; deployment remains
+human-controlled per `AGENTS.md`.