@arjunkhera/atlas 0.3.51 → 0.4.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.3.51",
+  "version": "0.4.0",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/cli.mjs

@@ -140,6 +140,7 @@ const HELP = `atlas — the door into a repo's Atlas files
       On a GitHub plan with no rulesets, apply changes nothing and reports advisory mode.
   atlas gate ready --repo <owner/name> --pr <n>   may this pull request merge: every required check green on its head
   atlas gate audit --repo <owner/name> [--since <date>]   each merge since the date (default: one day) that came before its checks were green
+  atlas gate audit --repo <owner/name> --commit <sha>   one commit on the main branch: red when no pull request merged it, or one merged it before its checks were green
 
   atlas judge seal <tasks.md>          the fresh-agent test: check the judge's six candidates, print the seal and the three that run
   atlas judge brief <tasks.md> <id>    print the exact words for one run: the task, then the report form
@@ -180,7 +181,7 @@ export const FLAGS = Object.freeze({
   view: { product: 'value', name: 'value', out: 'value' },
   tests: { root: 'optional', halves: 'value', evidence: 'value', 'guards-from': 'value', tests: 'value', 'dry-run': 'switch', run: 'value', own: 'value', base: 'value', head: 'value', list: 'value', side: 'value', old: 'value', new: 'value', covers: 'switch', findings: 'value', repo: 'value', max: 'value', bot: 'value', since: 'value', out: 'value', text: 'switch', json: 'switch', scenario: 'value', language: 'value' },
   upkeep: { root: 'optional', event: 'value', json: 'switch' },
-  gate: { repo: 'value', root: 'optional', 'dry-run': 'switch', off: 'switch', on: 'switch', pr: 'value', since: 'value' },
+  gate: { repo: 'value', root: 'optional', 'dry-run': 'switch', off: 'switch', on: 'switch', pr: 'value', since: 'value', commit: 'value' },
   judge: { tasks: 'value', verdict: 'value', seal: 'value', runs: 'value', out: 'value', repo: 'value', budget: 'value', model: 'value' },
   install: { local: 'switch', from: 'value', 'skip-global': 'switch', yes: 'switch', cloud: 'switch' },
   upgrade: { version: 'optional', yes: 'switch' },
@@ -417,7 +418,7 @@ function upkeepVerb(chosen) {
 }
 
 function gateVerb(chosen) {
-  return gateCommand({ what: chosen._[1], repo: chosen.repo, root: rootOf(chosen), dryRun: Boolean(chosen['dry-run']), off: Boolean(chosen.off), on: Boolean(chosen.on), pr: chosen.pr, since: chosen.since }, line);
+  return gateCommand({ what: chosen._[1], repo: chosen.repo, root: rootOf(chosen), dryRun: Boolean(chosen['dry-run']), off: Boolean(chosen.off), on: Boolean(chosen.on), pr: chosen.pr, since: chosen.since, commit: chosen.commit }, line);
 }
 
 function judgeVerb(chosen) {

package/door/kit-releases.json

@@ -1,5 +1,5 @@
 {
-  "note": "Every kit of the folder tests/ that a release of Atlas shipped, as the kit hash of its manifest (the sha256 of the sorted lines of path and file hash). The kit of this package is always accepted and need not be listed. When a release changes anything in tests/, add the kit hash of the release before it here. atlas tests check reads this list; git history is never read.",
+  "note": "Every kit of the folder tests/ that a release of Atlas shipped, as the kit hash of its manifest (the sha256 of the sorted lines of path and file hash). The kit of this package is always accepted and need not be listed. When a release changes anything in tests/, add the kit hash of the release before it here. atlas tests check reads this list; git history is never read. Since 24 October 2026 the release picks the version after the merge, so a new row names no first_package. The row of kit 1e62be9a names none either: it was built as 0.3.28, and npm never held 0.3.28.",
   "releases": [
     {
       "kit_sha256": "ae0f32b8c6694fbffb8bdacd8bd919d27c1c1da6281a46779e521dfea2341565",
@@ -22,8 +22,7 @@
       "first_package": "0.3.26"
     },
     {
-      "kit_sha256": "1e62be9a3fb632161c593d44ac7ad404ef04186fe2fbcd108645fbe1559bf860",
-      "first_package": "0.3.28"
+      "kit_sha256": "1e62be9a3fb632161c593d44ac7ad404ef04186fe2fbcd108645fbe1559bf860"
     },
     {
       "kit_sha256": "08c868aa39e6c9f471da2571e9a1d5939932a59856cea9c4176e3173f93454db",

package/door/lib/gate.mjs

@@ -6,8 +6,8 @@
 //   2. "atlas release tags" on v* tags: no update, no delete.
 // The bypass list stays empty. --off and --on are the break glass.
 //
-// A private repo on a free GitHub plan gets no rulesets (owner, 24 October
-// 2026: "ignore pro and assume going with that check in place"). There the
+// A private repo on a free GitHub plan gets no rulesets. The owner chose on 24
+// October 2026 to stay on that plan (decision dd90d8e8). There the
 // gate is advisory: apply changes nothing and says so, `atlas gate ready`
 // says if one pull request may merge, and `atlas gate audit` names each merge
 // that came before its checks were green (design docs/design-docs/gate-advisory/).
@@ -211,7 +211,8 @@ export function readyCommand({ repo, pr }, line, gh = ghApi) {
 
 // `atlas gate audit --since <date>`: each pull request merged since the date
 // whose required checks were not all green at the moment of the merge.
-export function auditCommand({ repo, since }, line, gh = ghApi) {
+export function auditCommand({ repo, since, commit }, line, gh = ghApi) {
+  if (commit !== undefined) return commitAudit({ repo, commit }, line, gh);
   const from = since && since !== true ? since : new Date(Date.now() - 864e5).toISOString().slice(0, 10);
   if (Number.isNaN(Date.parse(from))) throw new GateError(`--since must be a date, not "${from}".`);
   const closed = gh('GET', `repos/${repo}/pulls?state=closed&sort=updated&direction=desc&per_page=100`) ?? [];
@@ -239,12 +240,46 @@ export function auditCommand({ repo, since }, line, gh = ghApi) {
   return red ? 1 : 0;
 }
 
+// `atlas gate audit --commit <sha>`: one commit that reached the main branch.
+// The push job runs it on each push. A commit is good when a pull request
+// merged it after that pull request's required checks were green. A commit
+// that no pull request merged was pushed past the gate, so it is red.
+function commitAudit({ repo, commit }, line, gh) {
+  if (!commit || commit === true || !/^[0-9a-f]{7,40}$/i.test(String(commit))) throw new GateError('--commit needs a commit SHA.');
+  // GitHub expands a short SHA, and names the first parent: the main branch
+  // just before this commit, whose atlas.yaml held the gate at that moment.
+  const found = gh('GET', `repos/${repo}/commits/${commit}`);
+  const sha = found?.sha;
+  if (!sha) throw new GateError(`there is no commit ${commit} in ${repo}.`);
+  const pull = (gh('GET', `repos/${repo}/commits/${sha}/pulls`) ?? []).find((each) => each.merged_at && each.merge_commit_sha === sha);
+  if (!pull) {
+    line(`- ✗ ${sha.slice(0, 7)} reached the main branch with no pull request: a push past the gate.`);
+    line('RED PUSH: look at it now; the main branch may hold an untested change.');
+    return 1;
+  }
+  const parent = found.parents?.[0]?.sha ?? pull.base.sha;
+  let checks;
+  try { checks = checksAt(gh, repo, parent); } catch (error) {
+    if (!(error instanceof GateError)) throw error;
+    line(`- atlas gate audit: ${sha.slice(0, 7)} is the merge of #${pull.number}; atlas.yaml before it listed no required_checks, so nothing to audit.`);
+    return 0;
+  }
+  const bad = checkStates(checks, checkRuns(gh, repo, pull.head.sha), pull.merged_at).filter((row) => row.state !== 'green');
+  if (bad.length) {
+    line(`- ✗ #${pull.number} merged ${pull.merged_at} before its checks were green: ${bad.map((row) => `${row.name} ${row.state}`).join(', ')}`);
+    line('RED MERGES: 1. Look at it now; the main branch may hold an untested change.');
+    return 1;
+  }
+  line(`- atlas gate audit: ${sha.slice(0, 7)} is the merge of #${pull.number}, after its ${checks.length} required check(s) were green.`);
+  return 0;
+}
+
 // `atlas gate apply|ready|audit`. Returns the exit code.
-export function gateCommand({ what, repo, root, dryRun = false, off = false, on = false, pr, since }, line, gh = ghApi) {
+export function gateCommand({ what, repo, root, dryRun = false, off = false, on = false, pr, since, commit }, line, gh = ghApi) {
   if (!['apply', 'ready', 'audit'].includes(what)) throw new GateError(`there is no gate verb "${what ?? ''}". Use apply, ready or audit.`);
   if (!repo || repo === true || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo)) throw new GateError(`atlas gate ${what} needs --repo <owner/name>.`);
   if (what === 'ready') return readyCommand({ repo, pr }, line, gh);
-  if (what === 'audit') return auditCommand({ repo, since }, line, gh);
+  if (what === 'audit') return auditCommand({ repo, since, commit }, line, gh);
   if (off && on) throw new GateError('pick --off or --on, not both.');
   const mode = off ? 'off' : on ? 'on' : 'apply';
   const facts = mode === 'apply' ? gateFacts(root) : null;

package/door/lib/install.mjs

@@ -14,6 +14,7 @@ import { tmpdir } from 'node:os';
 import { join, relative } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { readConnection } from '../../work/mcp.mjs';
+import { VERSION_FILES, stampVersion } from './releases.mjs';
 
 export const CATALOG_NAME = 'atlas';
 export const PLUGIN_ID = 'atlas@atlas';
@@ -169,38 +170,95 @@ function filesUnder(root, skip = () => false) {
   return out;
 }
 
-// Is `sha` a commit of the master branch itself? A run's branch name is not
-// enough: a tag named "master" gives a run the same name.
+// Is `sha` in master's history now? A tag named "master" gives a run the
+// branch name too, so the run's branch name is not enough.
 export function onMaster(gh, repo, sha) {
   const compare = gh(['api', '--method', 'GET', `repos/${repo}/compare/${sha}...refs/heads/master`]);
   return ['ahead', 'identical'].includes(compare.status);
 }
 
-// The master run of release.yml that built this version, or null.
-export function findReleaseRun({ gh, repo, version }) {
-  const runs = gh(['api', '--method', 'GET', `repos/${repo}/actions/workflows/release.yml/runs?event=push&status=success&per_page=100`]).workflow_runs ?? [];
-  for (const run of runs) {
-    if (!/^[0-9a-f]{40}$/.test(run.head_sha ?? '')) continue;
-    let named;
-    try {
-      const file = gh(['api', '--method', 'GET', `repos/${repo}/contents/packages/atlas/package.json?ref=${run.head_sha}`]);
-      named = JSON.parse(Buffer.from(file.content, 'base64').toString('utf8')).version;
-    } catch { continue; }
-    if (named !== version) continue;
-    if (!onMaster(gh, repo, run.head_sha)) continue;
-    return run;
+// Was `sha` once the tip of master, through a merge or a normal push? A commit
+// that reached master only as the second parent of a merge was never the tip,
+// so the run that built it ran on another branch. A force push does not count:
+// with onMaster it would let in code that left master's history. It reads the
+// newest 100 changes of master, the one page this proxy lets through (its
+// next-page links use a path it refuses); an older release is refused.
+const TIP_KINDS = new Set(['pr_merge', 'push', 'merge_queue_merge']);
+export function wasTip(gh, repo, sha) {
+  const rows = gh(['api', '--method', 'GET', `repos/${repo}/activity?ref=refs/heads/master&direction=desc&per_page=100`]);
+  return Array.isArray(rows) && rows.some((row) => row.after === sha && TIP_KINDS.has(row.activity_type));
+}
+
+// The commit that the tag v<version> names, or null. The release job tags the
+// master commit it built (tracker item 339538d3): the commit no longer names
+// the version, because the release picks it after the merge.
+export function tagCommit(gh, repo, version) {
+  // Only "not found" means no tag. Any other failure is GitHub not
+  // answering, and the caller must say so, not refuse on a guess.
+  const read = (path) => {
+    try { return gh(['api', '--method', 'GET', path]).object; } catch (error) {
+      if (/HTTP 404|Not Found/i.test(`${error.stderr ?? ''}${error.message ?? ''}`)) return null;
+      throw error;
+    }
+  };
+  let object = read(`repos/${repo}/git/ref/tags/v${version}`);
+  if (object?.type === 'tag') object = read(`repos/${repo}/git/tags/${object.sha}`);
+  return object?.type === 'commit' && /^[0-9a-f]{40}$/.test(object.sha ?? '') ? object.sha : null;
+}
+
+// The name of the record that a master release run keeps for each version
+// it publishes. Only a run of the tip of master makes one (release.yml). If
+// GitHub stops listing a name once its file expires (90 days), an upgrade to
+// that release is refused, never let through.
+export const recordName = (version, sha256) => `atlas-release-${version}-${sha256}`;
+
+// The release of this version. The tag is only a hint to find the commit: the
+// proof is the record of a successful push run of release.yml on that master
+// commit, which names this version and the sha256 of this exact tarball. The
+// commit must once have been the tip of master. A tag that a person made or
+// moved finds no record, so the upgrade refuses. With no sha256 (a loaded
+// copy has no tarball), any record of this version counts, and the byte
+// compare of every file does the rest.
+export function findRelease({ gh, repo, version, sha256 }) {
+  const commit = tagCommit(gh, repo, version);
+  if (!commit) return { problem: `no tag v${version} names a commit` };
+  if (!onMaster(gh, repo, commit)) return { problem: `the tag v${version} names commit ${commit.slice(0, 12)}, which is not on master` };
+  if (!wasTip(gh, repo, commit)) return { problem: `the tag v${version} names commit ${commit.slice(0, 12)}, which was never the tip of master through a merge or a push` };
+  const runs = gh(['api', '--method', 'GET', `repos/${repo}/actions/workflows/release.yml/runs?event=push&status=success&head_sha=${commit}&per_page=100`]).workflow_runs ?? [];
+  const prefix = recordName(version, '');
+  const named = (name) => (sha256 ? name === recordName(version, sha256) : name.startsWith(prefix) && /^[0-9a-f]{64}$/.test(name.slice(prefix.length)));
+  // A tag named "master" gives a run on another commit the branch name too;
+  // the tip check above rules that out, and these fields rule out the rest.
+  const ours = (row) => row.head_sha === commit && row.event === 'push' && row.head_branch === 'master' && row.path === '.github/workflows/release.yml';
+  for (const run of runs.filter(ours)) {
+    const artifacts = gh(['api', '--method', 'GET', `repos/${repo}/actions/runs/${run.id}/artifacts?per_page=100`]).artifacts ?? [];
+    if (artifacts.some((artifact) => named(artifact.name ?? ''))) return { run, commit };
   }
-  return null;
+  return { problem: `no successful release run on master commit ${commit.slice(0, 12)} recorded ${version}${sha256 ? ' with this tarball' : ''}` };
+}
+
+// The blob ids that the version files of the tarball must have: the files of
+// the commit with the stamp of the target version. So the stamp may change the
+// version line and nothing else.
+export function stampedBlobs({ gh, repo, commit, version }) {
+  const out = new Map();
+  for (const path of VERSION_FILES) {
+    const file = gh(['api', '--method', 'GET', `repos/${repo}/contents/packages/atlas/${path}?ref=${commit}`]);
+    out.set(path, blobSha(Buffer.from(stampVersion(Buffer.from(file.content, 'base64').toString('utf8'), version))));
+  }
+  return out;
 }
 
 // Every file of the tarball must be the file at that commit, and every file of
-// packages/atlas at that commit must be in the tarball.
-export function matchTree({ tree, files }) {
+// packages/atlas at that commit must be in the tarball. `stamped` holds the
+// blob ids that replace the commit's own for the version files.
+export function matchTree({ tree, files, stamped = new Map() }) {
   const wanted = new Map((tree ?? []).filter((row) => row.type === 'blob' && row.path.startsWith('packages/atlas/')).map((row) => [row.path.slice('packages/atlas/'.length), row.sha]));
+  for (const [path, sha] of stamped) if (wanted.has(path)) wanted.set(path, sha);
   const problems = [];
   for (const [path, bytes] of files) {
     if (!wanted.has(path)) problems.push(`${path} is in the tarball and not in the commit`);
-    else if (wanted.get(path) !== blobSha(bytes)) problems.push(`${path} differs from the commit`);
+    else if (wanted.get(path) !== blobSha(bytes)) problems.push(`${path} differs from the commit${stamped.has(path) ? ' with the version stamped' : ''}`);
   }
   for (const path of wanted.keys()) if (!files.has(path)) problems.push(`${path} is in the commit and not in the tarball`);
   return problems;
@@ -222,14 +280,19 @@ export function proveCopy({ packageRoot, exec = defaultExec }) {
     const { version } = packageJson(packageRoot);
     const repo = repoOf(packageRoot);
     const gh = (args) => JSON.parse(exec('gh', args));
-    let run;
-    try { run = findReleaseRun({ gh, repo, version }); } catch (error) { return { state: 'not checked', reason: `GitHub did not answer: ${firstLines(error)}` }; }
-    if (!run) return { state: 'unproven', reason: `no successful release run on a commit of master built ${version}. It may have been published from a branch.` };
+    let release;
+    try { release = findRelease({ gh, repo, version }); } catch (error) { return { state: 'not checked', reason: `GitHub did not answer: ${firstLines(error)}` }; }
+    if (release.problem) return { state: 'unproven', reason: `${release.problem}. It may have been published from a branch.` };
+    const { run, commit } = release;
     let tree;
-    try { tree = gh(['api', '--method', 'GET', `repos/${repo}/git/trees/${run.head_sha}?recursive=1`]).tree; } catch (error) { return { state: 'not checked', reason: `GitHub did not give the file tree: ${firstLines(error)}` }; }
+    let stamped;
+    try {
+      tree = gh(['api', '--method', 'GET', `repos/${repo}/git/trees/${commit}?recursive=1`]).tree;
+      stamped = stampedBlobs({ gh, repo, commit, version });
+    } catch (error) { return { state: 'not checked', reason: `GitHub did not give the files of the commit: ${firstLines(error)}` }; }
     const files = filesUnder(packageRoot, (path) => COPY_MARKER.test(path));
-    const problems = matchTree({ tree, files });
-    const found = { run: run.id, commit: run.head_sha };
+    const problems = matchTree({ tree, files, stamped });
+    const found = { run: run.id, commit };
     return problems.length ? { state: 'differs', ...found, problems: problems.slice(0, 20) } : { state: 'match', ...found, files: files.size };
   } catch (error) {
     return { state: 'not checked', reason: `the proof stopped: ${firstLines(error)}` };
@@ -246,9 +309,6 @@ export async function upgrade({ packageRoot, options = {}, line = console.log, e
   const integrity = exec('npm', ['view', `${name}@${target}`, 'dist.integrity']).trim();
 
   line(`Atlas ${installed} → ${target}`);
-  const run = findReleaseRun({ gh, repo, version: target });
-  if (!run) { line(`Refused: no successful release run on a commit of master built ${target}. It may have been published from a branch.`); return 1; }
-  line(`  built by release run ${run.id}, on master commit ${run.head_sha.slice(0, 12)}`);
 
   const work = mkdtempSync(join(tmpdir(), 'atlas-upgrade-'));
   try {
@@ -257,12 +317,17 @@ export async function upgrade({ packageRoot, options = {}, line = console.log, e
     if (!tarball) throw new Error('npm pack wrote no tarball');
     const bytes = readFileSync(join(work, tarball));
     if (sha512Integrity(bytes) !== integrity) { line('Refused: the tarball does not match the integrity npm records.'); return 1; }
+    const { run, commit, problem } = findRelease({ gh, repo, version: target, sha256: createHash('sha256').update(bytes).digest('hex') });
+    if (problem) { line(`Refused: ${problem}. It may have been published from a branch.`); return 1; }
+    line(`  tag v${target}, recorded by release run ${run.id}, on master commit ${commit.slice(0, 12)}`);
     const unpacked = join(work, 'unpacked');
     mkdirSync(unpacked);
     exec('tar', ['-xzf', join(work, tarball), '-C', unpacked]);
     const files = filesUnder(join(unpacked, 'package'));
-    const tree = gh(['api', '--method', 'GET', `repos/${repo}/git/trees/${run.head_sha}?recursive=1`]).tree;
-    const problems = matchTree({ tree, files });
+    const tree = gh(['api', '--method', 'GET', `repos/${repo}/git/trees/${commit}?recursive=1`]).tree;
+    let stamped;
+    try { stamped = stampedBlobs({ gh, repo, commit, version: target }); } catch (error) { line(`Refused: the version files of that commit cannot take the stamp: ${error.message}`); return 1; }
+    const problems = matchTree({ tree, files, stamped });
     if (problems.length) {
       line('Refused: the tarball is not the commit that run built.');
       for (const problem of problems.slice(0, 20)) line(`  ${problem}`);

package/door/lib/releases.mjs

@@ -15,7 +15,9 @@ export function readReleases(packageRoot) {
   const list = JSON.parse(readFileSync(join(packageRoot, RELEASES_PATH), 'utf8'));
   if (!Array.isArray(list.releases) || !list.releases.length) throw new Error(`${RELEASES_PATH} lists no release`);
   for (const row of list.releases) {
-    if (!Number.isInteger(row.check_version) || !/^[0-9a-f]{64}$/.test(row.sha256 ?? '') || typeof row.first_package !== 'string') {
+    // A row from before 24 October 2026 names its first package. A newer row
+    // names none, because the release picks the version after the merge.
+    if (!Number.isInteger(row.check_version) || !/^[0-9a-f]{64}$/.test(row.sha256 ?? '') || !['string', 'undefined'].includes(typeof row.first_package)) {
       throw new Error(`${RELEASES_PATH} holds a malformed row: ${JSON.stringify(row)}`);
     }
   }
@@ -40,3 +42,18 @@ export function packagedCheck(packageRoot) {
   const fingerprint = sha256(text);
   return { text, sha256: fingerprint, releases, ...placeOf(releases, fingerprint) };
 }
+
+// The release picks the version (tracker item 339538d3). The release job
+// writes the number into these two files of its own checkout, and into nothing
+// else, and never commits it. `atlas upgrade` makes the same stamp on the
+// files of the tagged commit, so the stamp can change the version and nothing
+// more.
+export const VERSION_FILES = Object.freeze(['package.json', '.claude-plugin/plugin.json']);
+const VERSION_LINE = /^ {2}"version": "[^"\n]*"(,?)$/gm;
+
+export function stampVersion(text, version) {
+  if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error(`"${version}" is not an exact version`);
+  const found = [...text.matchAll(VERSION_LINE)].length;
+  if (found !== 1) throw new Error(`a version file must hold exactly one top-level "version" line, and this one holds ${found}`);
+  return text.replace(VERSION_LINE, (_, comma) => `  "version": "${version}"${comma}`);
+}

package/door/lib/status.mjs

@@ -22,6 +22,10 @@ import { kitHashOf } from '../../tests/link-check.mjs';
 
 export const STATES = Object.freeze(['current', 'behind', 'unknown', 'missing']);
 
+// A row after 24 October 2026 names no package, because the release picks
+// the version after the merge.
+const from = (row) => (row.first_package ? `, first in Atlas ${row.first_package}` : '');
+
 export function status({ root, packageRoot }) {
   const pkg = packagedCheck(packageRoot);
   const latest = pkg.releases[pkg.releases.length - 1];
@@ -35,10 +39,10 @@ export function status({ root, packageRoot }) {
   const { row, latest: isLatest } = placeOf(pkg.releases, fingerprint);
   const copy = { sha256: fingerprint, check_version: row?.check_version ?? checkStamps(text).check_version, first_package: row?.first_package ?? null };
   if (row && isLatest) {
-    return { root, path: CHECK_PATH, state: 'current', packaged, copy, why: `the copy is check version ${row.check_version}, the newest one Atlas has released (first in Atlas ${row.first_package}).` };
+    return { root, path: CHECK_PATH, state: 'current', packaged, copy, why: `the copy is check version ${row.check_version}, the newest one Atlas has released${from(row)}.` };
   }
   if (row) {
-    return { root, path: CHECK_PATH, state: 'behind', packaged, copy, why: `the copy is check version ${row.check_version}, first released in Atlas ${row.first_package}. The newest is check version ${latest.check_version}, from Atlas ${latest.first_package}. "atlas tooling pr" refreshes it.` };
+    return { root, path: CHECK_PATH, state: 'behind', packaged, copy, why: `the copy is check version ${row.check_version}${from(row)}. The newest is check version ${latest.check_version}${from(latest)}. "atlas tooling pr" refreshes it.` };
   }
   return { root, path: CHECK_PATH, state: 'unknown', packaged, copy, why: `the copy's fingerprint, sha256 ${fingerprint.slice(0, 12)}…, is in no release of the check. Someone edited it, or it came from an unreleased package. "atlas tooling pr --replace-unknown" shows the difference and replaces it.` };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.3.51",
+  "version": "0.4.0",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/skills/lead/SKILL.md

@@ -105,7 +105,7 @@ set. A test keeps the two lists equal.
 | `atlas design` | `folder` to learn where designs live; `check` before you show a design; `build` to make its page |
 | `atlas view` | `build --product <id>` makes the project view page of one product, when the owner asks for it or after an Atlas release changes it. Publish it with only the grant the command prints |
 | `atlas upkeep` | `check` before you ask for a merge: the docs index, dead doc links, and the tracker item a pull request names. The daily upkeep run calls it on the main branch |
-| `atlas gate` | `apply` once per repo, by the owner on his Mac, after the repo's `required_checks` exist. `--dry-run` first. `--off` and `--on` are the break glass. On a plan with no rulesets it reports advisory mode. `ready` before each merge. `audit` in the daily upkeep run |
+| `atlas gate` | `apply` once per repo, by the owner on his Mac, after the repo's `required_checks` exist. `--dry-run` first. `--off` and `--on` are the break glass. On a plan with no rulesets it reports advisory mode. `ready` before each merge. `audit` in the daily upkeep run, and with `--commit` in the push job of a repo that has one |
 | `atlas judge` | In the fresh-agent test only, as the `atlas:fresh-agent-test` skill says. `seal` after the pick, `brief` to read a sealed ask, `run` for each sealed task, `check` after the grade |
 
 A person merges every file that `atlas tooling` writes.