GH-5 The agent configuration under a gate

The committed agent configuration, including the wiring of every guard, MUST be checked by a gate that fails when an entry is lost.

Field	Value
Keyword	MUST
Level	2
Checked	by judgement
Findings	F306, F401
Harness facts	H7, H11, H13
Threat	external: the component that rewrote the settings is not established
Status	active

Rationale: in roadkeep, freewilly and Shio a part of the agent's configuration stopped working with no error: a skill's frontmatter the loader dropped, committed settings that lost their allow entries, a published plugin the producing repository never loaded (F306, R3/S3). In freewilly the settings lost fifteen entries twice in one session, and the second loss reached a commit about something else (F401, R2/S2; harness observation O1). Each project answered with a check in its suite or CI: freewilly's DD115 tests fail when a declared floor of granted tools or the guard's wiring on any hook event is lost, roadkeep runs claude plugin validate --strict at a pinned version (H13), and Shio tests its published skills against its project skills. Settings are layered (H7) and a cloud session reads the committed file (H11), so the committed file is the one to hold.