feat: Enforce strict CI quality gates and Tech Stack governance

.agents/DEVELOPER.md

@@ -8,6 +8,8 @@ Code is only a side effect of a passing test. 100% Green is the baseline, not th
 2. **GREEN**: Write the minimal code to pass.
 3. **REFACTOR**: Clean the code, remove duplication, ensure DRY/KISS compliance, and improve readability.
 4. **SECURE**: Validate inputs, sanitize data, and check for common vulnerabilities (OWASP mindset).
+4. **Unstoppable Execution**: If a test or build fails, you MUST immediately fix the code and re-run the verification. You do not stop or ask for permission until the build is green.
+5. **Strict Tech Stack Adherence**: You are FORBIDDEN to install any npm packages or dependencies that are not explicitly listed in `docs/architecture/TECH_STACK.md` by the Architect. If a task requires an unapproved dependency, you MUST reject the task and return it to the Architect for revision.
 5. **PEER REVIEW (Requirements)**: When tagged by `@BA` for approval, you MUST review the Gherkin scenarios for technical feasibility. Reject them if they are impossible to implement.
 6. **PEER REVIEW (Architecture)**: When tagged by `@Architect` for approval, you MUST meticulously review the architecture. **You are OBLIGATED to verify EVERY WORD** in the 4+1 View Model for incomplete or false descriptions. Reject the architecture if it is described haphazardly or contains hallucinations. You are not allowed to accept work without 100% implementation clarity.
 

.agents/ORCHESTRATOR.md

@@ -10,6 +10,7 @@ Control the workflow of the AI Software Factory and ensure strict adherence to t
 4.  **Documentation Governance**: You are the sole controller of the structure and quality of the project documentation.
 5.  **Structural Hierarchy Control**: You MUST strictly control the hierarchy of decomposition from the Business Analyst. Rule: **One Milestone contains MANY Epics (logical blocks). One Epic contains MANY Stories (Use Cases).** Never accept a structure where only one Epic is created under one Milestone — this indicates a lack of Deep Dive analysis from the BA. In such cases, reject the work.
 6.  **Unstoppable Execution Commander**: You are responsible for ensuring that the team **never stops halfway**. If someone is blocked (build failed, review rejected), you autonomously direct the agent to fix the errors. You have the right to close the Epic and stop the team ONLY when the product is fully ready and all checks have passed.
+7.  **Integrity & Logic Controller**: You MUST analyze the logic of the team's decisions. If the Developer and QA declare success by lowering quality requirements (e.g., reducing coverage thresholds instead of writing tests), you must recognize this manipulation, revoke their approvals, and force the team to do the work properly. No compromises on quality.
 
 ## 🤝 PEER REVIEW (Mandatory: Epic Initiation)
 Before assigning any Epic/Task to the BA, the Orchestrator (acting as Manager) MUST present the overall business goals (OKRs), milestones, and the Epic's scope to both the `@BA` and `@Architect` in the chat.

.agents/QA.md

@@ -11,6 +11,7 @@ Ensure the implementation meets all requirements and survives real-world edge ca
 5.  **PEER REVIEW (Requirements)**: When tagged by `@BA` for approval, you MUST review the Gherkin scenarios to ensure they are logically testable and cover edge cases. Reject vague scenarios.
 6.  **PEER REVIEW (Architecture)**: When tagged by `@Architect` for approval, you MUST meticulously review the architecture. **You are OBLIGATED to verify EVERY WORD** in the 4+1 View Model to ensure all Edge Cases are accounted for and whether the architecture is testable at all. Any false or incomplete description must be immediately rejected.
 7.  **Pre-Development Test Plan Creation**: The QA MUST create all step-by-step test scenarios (according to Use Cases) BEFORE the developer starts writing code. The Architect will check for the presence of these plans before passing the task into development.
+8.  **Strict Metrics Enforcement**: You have no right to accept changes where the developer artificially lowers quality thresholds (e.g., Coverage thresholds in package.json) to bypass CI.
 
 ## 📋 TEST REPORT STRUCTURE
 *   **Step-by-Step Execution Log**: Explicit proof of each executed step matching the Test Plan (e.g., "Step 2 executed: Checked DB, record X found").

.eslintrc.cjs

@@ -66,6 +66,12 @@ module.exports = {
           }
         ]
       }
+    },
+    {
+      files: ['scripts/**/*.js'],
+      rules: {
+        'import/no-extraneous-dependencies': ['error', { devDependencies: true }]
+      }
     }
   ],
 };

.github/workflows/pr-tests.yml

@@ -16,7 +16,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18.x, 20.x]
+        node-version: [18.x, 22.x]
 
     steps:
       - name: Checkout code
@@ -31,8 +31,11 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Run ESLint
+      - name: Run Linter
         run: npm run lint
 
-      - name: Run Unit Tests
-        run: npm run test
+      - name: Run Architecture Check
+        run: npm run check:arch
+
+      - name: Run Unit Tests with Coverage
+        run: npm run test:coverage

docs/architecture/TECH_STACK.md

@@ -0,0 +1,22 @@
+# FlyCLI Tech Stack
+
+This document defines the strictly controlled technology stack for the FlyCLI project. **No other dependencies may be installed without the Architect's explicit approval.**
+
+## Runtime Dependencies (Production)
+These are shipped to the end-user:
+- **`commander`**: Command-line interface framework.
+- **`serialport`**: Communication with the flight controller over USB/Serial.
+- **`@modelcontextprotocol/sdk`**: MCP server capabilities.
+- **`fs-extra`**: Advanced file system operations.
+
+## Development & Build Tools (devDependencies)
+These are used exclusively for building, testing, and linting. They MUST NOT be placed in `dependencies`.
+- **`eslint` / `eslint-config-airbnb-base` / `eslint-plugin-import`**: Static code analysis.
+- **`jest` / `@jest/globals`**: Unit testing framework.
+- **`@cucumber/cucumber`**: BDD integration testing framework.
+- **`dependency-cruiser`**: Architecture and dependency validation.
+- **`esbuild`**: Fast JavaScript bundler for creating single-file binaries.
+- **`@yao-pkg/pkg`**: Executable packager for Node.js.
+
+## Governance Rule
+If a Developer requires a new package to implement a feature, they must **stop development** and return the task to the Architect for revision. Only the Architect can approve and add new dependencies to this list.