Phase 4: Trust + Policy + Cost + Anomaly governance

gpp-trust: SQLite agent scores, reviewed-outcome Bayesian scoring,
status transitions (auto-merge/review-required/sandboxed/blocked),
global + module overrides, event log.

gpp-policy: .policy TOML parser, regex content rules + changeset rules,
block/warn/audit severities, built-in secrets-scan/pci-dss/soc2
templates.

gpp-cost: per-changeset cost records (micro-dollars), time/agent
roll-ups, breakdown, weekly budgets+alerts, cost-per-survived-line.

gpp-anomaly: large-changeset/unusual-scope/burst-activity detection,
event log, resolution workflow, tunable thresholds.

gpp-cli: trust/policy/cost/anomaly/audit commands; gpp promote now
enforces content policies (block aborts pre-changeset) and records
trust/cost/anomaly signals. ROADMAP Phase 4 marked done.

97 workspace tests pass; clippy + rustfmt clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mahabubul470

Cargo.lock

@@ -69,6 +69,9 @@ walkdir = "2"
 # Diff
 similar = "2"
 
+# Regex (policy pattern rules)
+regex = "1"
+
 # Tree-sitter
 tree-sitter = "0.24"
 

Cargo.toml

@@ -4,6 +4,13 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
-description = "gpp-anomaly (stub — not yet implemented; see docs/ROADMAP.md)"
+description = "gpp agent behavior pattern detection & alerting"
 
 [dependencies]
+rusqlite.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true