feat(compile): replace Python gate evaluator with bundled TypeScript gate.js

.github/workflows/ado-script.yml

@@ -0,0 +1,81 @@
+name: ado-script Workspace
+
+on:
+  pull_request:
+    paths:
+      - "scripts/ado-script/**"
+      - "src/compile/filter_ir.rs"
+      - "src/compile/extensions/trigger_filters.rs"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/ado-script.yml"
+  # Also run on pushes to main so any drift that slips through (e.g. a
+  # merge that bypassed PR CI, or a force-push) is caught loudly the
+  # moment it lands. If this fails on main, file a fix-drift issue and
+  # land a PR to regenerate `src/shared/types.gen.ts` and re-bundle —
+  # the workflow itself does not auto-PR.
+  push:
+    branches: [main]
+    paths:
+      - "scripts/ado-script/**"
+      - "src/compile/filter_ir.rs"
+      - "src/compile/extensions/trigger_filters.rs"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/ado-script.yml"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  ado-script:
+    name: Build, Test & Drift-Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: scripts/ado-script/package-lock.json
+
+      - name: Install workspace dependencies
+        working-directory: scripts/ado-script
+        run: npm ci
+
+      - name: Regenerate types from Rust IR (codegen)
+        working-directory: scripts/ado-script
+        run: npm run codegen
+
+      - name: Verify generated TypeScript is up to date
+        run: |
+          if ! git diff --exit-code -- scripts/ado-script/src/shared/types.gen.ts; then
+            echo ""
+            echo "::error::types.gen.ts is out of date with the Rust IR."
+            echo "Run 'cd scripts/ado-script && npm run codegen' and commit the result."
+            exit 1
+          fi
+
+      - name: Run TypeScript tests
+        working-directory: scripts/ado-script
+        run: npm test
+
+      - name: Type-check
+        working-directory: scripts/ado-script
+        run: npm run typecheck
+
+      - name: Build bundle (gate.js)
+        working-directory: scripts/ado-script
+        run: npm run build
+
+      - name: Smoke-test bundle
+        working-directory: scripts/ado-script
+        run: npx vitest run -c vitest.config.smoke.ts
+
+      - name: E2E gate test
+        run: cargo test --test gate_e2e -- --ignored --nocapture

.github/workflows/release.yml

@@ -55,11 +55,25 @@ jobs:
           set -euo pipefail
           cp target/release/ado-aw target/release/ado-aw-linux-x64
 
-      - name: Package scripts bundle
+      - name: Set up Node.js for ado-script bundle
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: scripts/ado-script/package-lock.json
+
+      - name: Build ado-script TypeScript bundle (gate.js)
+        working-directory: scripts/ado-script
+        run: |
+          npm ci
+          npm run build
+        # `npm run build` runs codegen + ncc and outputs dist/gate/index.js.
+
+      - name: Package ado-script bundle
         run: |
           set -euo pipefail
           cd scripts
-          zip -r ../scripts.zip .
+          zip -r ../ado-script.zip ado-script/dist
 
       - name: Upload release assets
         env:
@@ -68,7 +82,7 @@ jobs:
           TAG="${{ needs.release-please.outputs.tag_name || github.event.inputs.tag_name }}"
           gh release upload "$TAG" \
             target/release/ado-aw-linux-x64 \
-            scripts.zip \
+            ado-script.zip \
             --clobber
 
   build-windows:
@@ -158,13 +172,13 @@ jobs:
           TAG="${{ needs.release-please.outputs.tag_name || github.event.inputs.tag_name }}"
           gh release download "$TAG" \
             --pattern "ado-aw-*" \
-            --pattern "scripts.zip" \
+            --pattern "ado-script.zip" \
             --repo "${{ github.repository }}"
           test -f ado-aw-linux-x64 || { echo "Missing ado-aw-linux-x64"; exit 1; }
           test -f ado-aw-windows-x64.exe || { echo "Missing ado-aw-windows-x64.exe"; exit 1; }
           test -f ado-aw-darwin-arm64 || { echo "Missing ado-aw-darwin-arm64"; exit 1; }
-          test -f scripts.zip || { echo "Missing scripts.zip"; exit 1; }
-          sha256sum ado-aw-linux-x64 ado-aw-windows-x64.exe ado-aw-darwin-arm64 scripts.zip > checksums.txt
+          test -f ado-script.zip || { echo "Missing ado-script.zip"; exit 1; }
+          sha256sum ado-aw-linux-x64 ado-aw-windows-x64.exe ado-aw-darwin-arm64 ado-script.zip > checksums.txt
 
       - name: Upload checksums
         env:

.gitignore

@@ -1,4 +1,5 @@
 target
 examples/sample-agent.yml
+scripts/gate.js
 *.pyc
 __pycache__/

AGENTS.md

@@ -156,8 +156,8 @@ Every compiled pipeline runs as three sequential jobs:
 │   ├── update-ado-agentic-workflow.md # Guide for modifying an existing agentic pipeline
 │   └── debug-ado-agentic-workflow.md  # Guide for troubleshooting a failing agentic pipeline
 ├── scripts/              # Supporting scripts shipped as release artifacts
-│   ├── gate-eval.py      # Python gate evaluator (data-driven filter evaluation)
-│   └── gate-spec.schema.json # JSON Schema for gate spec (generated from Rust types)
+│   ├── ado-script/       # TypeScript workspace for bundled gate.js (and future bundles)
+│   └── gate.js           # Bundled gate evaluator (built from scripts/ado-script/, see docs/ado-script.md)
 ├── tests/                # Integration tests and fixtures
 ├── docs/                 # Per-concept reference documentation (see index below)
 ├── Cargo.toml            # Rust dependencies
@@ -169,6 +169,7 @@ Every compiled pipeline runs as three sequential jobs:
 - **Language**: Rust (2024 edition) - Note: Rust 2024 edition exists and is the edition used by this project
 - **CLI Framework**: clap v4 with derive macros
 - **Error Handling**: anyhow for ergonomic error propagation
+- **Bundled scripts**: TypeScript + ncc (`scripts/ado-script/`) — compiled gate evaluator and future internal helpers; see [`docs/ado-script.md`](docs/ado-script.md).
 - **Async Runtime**: tokio with full features
 - **YAML Parsing**: serde_yaml
 - **MCP Server**: rmcp with server and transport-io features
@@ -235,6 +236,9 @@ index to jump to the right page.
   framework: detection-based transformations, automatic source
   rewrite on breaking-change updates, contributor workflow for
   adding codemods.
+- [`docs/ado-script.md`](docs/ado-script.md) — `ado-script` workspace
+  (`scripts/ado-script/`): the bundled TypeScript runtime helpers (today:
+  `gate.js`), schemars-driven type codegen, and the A2 design decision.
 - [`docs/local-development.md`](docs/local-development.md) — local development
   setup notes.