feat: implement Phase 3.1B blocker architecture

.github/workflows/phase31b.yml

@@ -0,0 +1,91 @@
+name: Phase 3.1B Gate
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main, 'feat/**']
+
+permissions:
+  contents: read
+
+jobs:
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+
+  page-unit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - name: Prepare validated Phase 3.1 filter cache
+        run: npm run phase31:sync
+      - run: npm run build:full
+      - run: npm run test:page
+      - run: npm run test:unit
+
+  build-integrity-security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - name: Run canonical Phase 3.1B evidence gates
+        run: npm run phase31:sync && ADAPT_PHASE31_OFFLINE=1 npm run verify:phase31b
+
+  autonomy-fast:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - name: Prepare validated Phase 3.1 filter cache
+        run: npm run phase31:sync
+      - run: ADAPT_PHASE31_OFFLINE=1 npm run verify:phase31b
+      - run: ADAPT_PHASE31_OFFLINE=1 npm run verify:autonomy
+
+  autonomy-live:
+    runs-on: ubuntu-latest
+    needs: autonomy-fast
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - name: Prepare validated Phase 3.1 filter cache
+        run: npm run phase31:sync
+      - run: ADAPT_PHASE31_OFFLINE=1 ADAPT_LIVE_PROFILE=full npm run verify:autonomy:live
+
+  release-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - name: Pack release artifact (no baked AI) and verify it in a clean Chrome profile
+        run: npm run pack && npm run verify:packaged

.gitignore

@@ -36,3 +36,12 @@ test-results/
 # Logs
 *.log
 npm-debug.log*
+
+# Dev-only baked AI credential (generated, never commit)
+src/background/ai/dev-defaults.ts
+
+# Tool session state (machine-local)
+.zcode/
+
+# Built release zips (distributed via GitHub Releases)
+release/