One command that decides whether the work is done

bin/check runs RSpec, RuboCop, Brakeman and dependency audits behind one entry point, and its exit code is the agreed definition of done. The agent instructions exist largely to point at it.

That matters more when a coding agent is doing the work than when a person is. An agent will hand back a plausible diff that does not run, and the gate is the only thing between that and a merge. Two constraints keep it usable: it has to run offline, because a gate needing a key gets skipped on the machine where it matters, and it has to stay under the patience threshold, because a four-minute check is one people learn to bypass. What goes in is a decision rather than an accumulation, anything slow or flaky teaches everyone that red means noise, and that lesson cannot be unlearned.

Inferred: the offline and speed constraints are my reading of why the gate is scoped as it is. The repo states the gate, not the reasoning.