Local-first control plane: deterministic eval suites, compare gates,
local guard/runtime review, audit replay, and publish hygiene.