@arjunkhera/atlas 0.3.51 → 0.3.52

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.3.51",
+  "version": "0.3.52",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/cli.mjs

@@ -140,6 +140,7 @@ const HELP = `atlas — the door into a repo's Atlas files
       On a GitHub plan with no rulesets, apply changes nothing and reports advisory mode.
   atlas gate ready --repo <owner/name> --pr <n>   may this pull request merge: every required check green on its head
   atlas gate audit --repo <owner/name> [--since <date>]   each merge since the date (default: one day) that came before its checks were green
+  atlas gate audit --repo <owner/name> --commit <sha>   one commit on the main branch: red when no pull request merged it, or one merged it before its checks were green
 
   atlas judge seal <tasks.md>          the fresh-agent test: check the judge's six candidates, print the seal and the three that run
   atlas judge brief <tasks.md> <id>    print the exact words for one run: the task, then the report form
@@ -180,7 +181,7 @@ export const FLAGS = Object.freeze({
   view: { product: 'value', name: 'value', out: 'value' },
   tests: { root: 'optional', halves: 'value', evidence: 'value', 'guards-from': 'value', tests: 'value', 'dry-run': 'switch', run: 'value', own: 'value', base: 'value', head: 'value', list: 'value', side: 'value', old: 'value', new: 'value', covers: 'switch', findings: 'value', repo: 'value', max: 'value', bot: 'value', since: 'value', out: 'value', text: 'switch', json: 'switch', scenario: 'value', language: 'value' },
   upkeep: { root: 'optional', event: 'value', json: 'switch' },
-  gate: { repo: 'value', root: 'optional', 'dry-run': 'switch', off: 'switch', on: 'switch', pr: 'value', since: 'value' },
+  gate: { repo: 'value', root: 'optional', 'dry-run': 'switch', off: 'switch', on: 'switch', pr: 'value', since: 'value', commit: 'value' },
   judge: { tasks: 'value', verdict: 'value', seal: 'value', runs: 'value', out: 'value', repo: 'value', budget: 'value', model: 'value' },
   install: { local: 'switch', from: 'value', 'skip-global': 'switch', yes: 'switch', cloud: 'switch' },
   upgrade: { version: 'optional', yes: 'switch' },
@@ -417,7 +418,7 @@ function upkeepVerb(chosen) {
 }
 
 function gateVerb(chosen) {
-  return gateCommand({ what: chosen._[1], repo: chosen.repo, root: rootOf(chosen), dryRun: Boolean(chosen['dry-run']), off: Boolean(chosen.off), on: Boolean(chosen.on), pr: chosen.pr, since: chosen.since }, line);
+  return gateCommand({ what: chosen._[1], repo: chosen.repo, root: rootOf(chosen), dryRun: Boolean(chosen['dry-run']), off: Boolean(chosen.off), on: Boolean(chosen.on), pr: chosen.pr, since: chosen.since, commit: chosen.commit }, line);
 }
 
 function judgeVerb(chosen) {

package/door/lib/gate.mjs

@@ -6,8 +6,8 @@
 //   2. "atlas release tags" on v* tags: no update, no delete.
 // The bypass list stays empty. --off and --on are the break glass.
 //
-// A private repo on a free GitHub plan gets no rulesets (owner, 24 October
-// 2026: "ignore pro and assume going with that check in place"). There the
+// A private repo on a free GitHub plan gets no rulesets. The owner chose on 24
+// October 2026 to stay on that plan (decision dd90d8e8). There the
 // gate is advisory: apply changes nothing and says so, `atlas gate ready`
 // says if one pull request may merge, and `atlas gate audit` names each merge
 // that came before its checks were green (design docs/design-docs/gate-advisory/).
@@ -211,7 +211,8 @@ export function readyCommand({ repo, pr }, line, gh = ghApi) {
 
 // `atlas gate audit --since <date>`: each pull request merged since the date
 // whose required checks were not all green at the moment of the merge.
-export function auditCommand({ repo, since }, line, gh = ghApi) {
+export function auditCommand({ repo, since, commit }, line, gh = ghApi) {
+  if (commit !== undefined) return commitAudit({ repo, commit }, line, gh);
   const from = since && since !== true ? since : new Date(Date.now() - 864e5).toISOString().slice(0, 10);
   if (Number.isNaN(Date.parse(from))) throw new GateError(`--since must be a date, not "${from}".`);
   const closed = gh('GET', `repos/${repo}/pulls?state=closed&sort=updated&direction=desc&per_page=100`) ?? [];
@@ -239,12 +240,46 @@ export function auditCommand({ repo, since }, line, gh = ghApi) {
   return red ? 1 : 0;
 }
 
+// `atlas gate audit --commit <sha>`: one commit that reached the main branch.
+// The push job runs it on each push. A commit is good when a pull request
+// merged it after that pull request's required checks were green. A commit
+// that no pull request merged was pushed past the gate, so it is red.
+function commitAudit({ repo, commit }, line, gh) {
+  if (!commit || commit === true || !/^[0-9a-f]{7,40}$/i.test(String(commit))) throw new GateError('--commit needs a commit SHA.');
+  // GitHub expands a short SHA, and names the first parent: the main branch
+  // just before this commit, whose atlas.yaml held the gate at that moment.
+  const found = gh('GET', `repos/${repo}/commits/${commit}`);
+  const sha = found?.sha;
+  if (!sha) throw new GateError(`there is no commit ${commit} in ${repo}.`);
+  const pull = (gh('GET', `repos/${repo}/commits/${sha}/pulls`) ?? []).find((each) => each.merged_at && each.merge_commit_sha === sha);
+  if (!pull) {
+    line(`- ✗ ${sha.slice(0, 7)} reached the main branch with no pull request: a push past the gate.`);
+    line('RED PUSH: look at it now; the main branch may hold an untested change.');
+    return 1;
+  }
+  const parent = found.parents?.[0]?.sha ?? pull.base.sha;
+  let checks;
+  try { checks = checksAt(gh, repo, parent); } catch (error) {
+    if (!(error instanceof GateError)) throw error;
+    line(`- atlas gate audit: ${sha.slice(0, 7)} is the merge of #${pull.number}; atlas.yaml before it listed no required_checks, so nothing to audit.`);
+    return 0;
+  }
+  const bad = checkStates(checks, checkRuns(gh, repo, pull.head.sha), pull.merged_at).filter((row) => row.state !== 'green');
+  if (bad.length) {
+    line(`- ✗ #${pull.number} merged ${pull.merged_at} before its checks were green: ${bad.map((row) => `${row.name} ${row.state}`).join(', ')}`);
+    line('RED MERGES: 1. Look at it now; the main branch may hold an untested change.');
+    return 1;
+  }
+  line(`- atlas gate audit: ${sha.slice(0, 7)} is the merge of #${pull.number}, after its ${checks.length} required check(s) were green.`);
+  return 0;
+}
+
 // `atlas gate apply|ready|audit`. Returns the exit code.
-export function gateCommand({ what, repo, root, dryRun = false, off = false, on = false, pr, since }, line, gh = ghApi) {
+export function gateCommand({ what, repo, root, dryRun = false, off = false, on = false, pr, since, commit }, line, gh = ghApi) {
   if (!['apply', 'ready', 'audit'].includes(what)) throw new GateError(`there is no gate verb "${what ?? ''}". Use apply, ready or audit.`);
   if (!repo || repo === true || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo)) throw new GateError(`atlas gate ${what} needs --repo <owner/name>.`);
   if (what === 'ready') return readyCommand({ repo, pr }, line, gh);
-  if (what === 'audit') return auditCommand({ repo, since }, line, gh);
+  if (what === 'audit') return auditCommand({ repo, since, commit }, line, gh);
   if (off && on) throw new GateError('pick --off or --on, not both.');
   const mode = off ? 'off' : on ? 'on' : 'apply';
   const facts = mode === 'apply' ? gateFacts(root) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.3.51",
+  "version": "0.3.52",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/skills/lead/SKILL.md

@@ -105,7 +105,7 @@ set. A test keeps the two lists equal.
 | `atlas design` | `folder` to learn where designs live; `check` before you show a design; `build` to make its page |
 | `atlas view` | `build --product <id>` makes the project view page of one product, when the owner asks for it or after an Atlas release changes it. Publish it with only the grant the command prints |
 | `atlas upkeep` | `check` before you ask for a merge: the docs index, dead doc links, and the tracker item a pull request names. The daily upkeep run calls it on the main branch |
-| `atlas gate` | `apply` once per repo, by the owner on his Mac, after the repo's `required_checks` exist. `--dry-run` first. `--off` and `--on` are the break glass. On a plan with no rulesets it reports advisory mode. `ready` before each merge. `audit` in the daily upkeep run |
+| `atlas gate` | `apply` once per repo, by the owner on his Mac, after the repo's `required_checks` exist. `--dry-run` first. `--off` and `--on` are the break glass. On a plan with no rulesets it reports advisory mode. `ready` before each merge. `audit` in the daily upkeep run, and with `--commit` in the push job of a repo that has one |
 | `atlas judge` | In the fresh-agent test only, as the `atlas:fresh-agent-test` skill says. `seal` after the pick, `brief` to read a sealed ask, `run` for each sealed task, `check` after the grade |
 
 A person merges every file that `atlas tooling` writes.