source-gate Local-first source/gate layer for self-hosted services: source trace, human gate decisions, receipts, and reproducible Nix deployment.