@shrkcrft/quality-gates 0.1.0-alpha.21 → 0.1.0-alpha.23

package/dist/gates/arch-gate.d.ts

@@ -9,9 +9,13 @@ import type { IGateResult } from '../schema/quality-gate.js';
  * This stops the gate from being a perpetual red on baseline debt the current
  * diff never introduced (an agent learns to ignore a gate that's always red).
  *
- * When no baseline is frozen (or `baselineRelative: false`), it preserves the
- * legacy behavior — fail on ANY error — so nothing regresses for projects that
- * never opted in, and a clean-tree CI demand stays expressible.
+ * When no baseline is frozen, errors are reported as `warn` (not `fail`) so the
+ * gate isn't a perpetual red on inherited debt the current diff never
+ * introduced — an agent learns to ignore a gate that's always red. `--strict`
+ * still escalates the warn to a failure for CI, and freezing a baseline switches
+ * on NEW-only gating. When `baselineRelative: false` (the `--arch-all` opt-in),
+ * the gate fails on ANY error regardless of the baseline, keeping a clean-tree
+ * CI demand expressible.
  *
  * Warnings never fail the gate; they are reported as `warn`.
  */

package/dist/gates/arch-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arch-gate.d.ts","sourceRoot":"","sources":["../../src/gates/arch-gate.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,WAAW,CA6FzF"}
+{"version":3,"file":"arch-gate.d.ts","sourceRoot":"","sources":["../../src/gates/arch-gate.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,WAAW,CA+GzF"}

package/dist/gates/arch-gate.js

@@ -8,9 +8,13 @@ import { ArchReportStore, diffSnapshots, runArchCheck, snapshotFromReport, viola
  * This stops the gate from being a perpetual red on baseline debt the current
  * diff never introduced (an agent learns to ignore a gate that's always red).
  *
- * When no baseline is frozen (or `baselineRelative: false`), it preserves the
- * legacy behavior — fail on ANY error — so nothing regresses for projects that
- * never opted in, and a clean-tree CI demand stays expressible.
+ * When no baseline is frozen, errors are reported as `warn` (not `fail`) so the
+ * gate isn't a perpetual red on inherited debt the current diff never
+ * introduced — an agent learns to ignore a gate that's always red. `--strict`
+ * still escalates the warn to a failure for CI, and freezing a baseline switches
+ * on NEW-only gating. When `baselineRelative: false` (the `--arch-all` opt-in),
+ * the gate fails on ANY error regardless of the baseline, keeping a clean-tree
+ * CI demand expressible.
  *
  * Warnings never fail the gate; they are reported as `warn`.
  */
@@ -71,16 +75,34 @@ export function archGate(projectRoot, options = {}) {
             durationMs: Date.now() - start,
         };
     }
-    // No baseline (or baseline-relative disabled): fail on any error (legacy), but
-    // hint how to opt into NEW-only gating.
+    // No baseline available: either none is frozen (the default state of a fresh
+    // repo) or the caller disabled baseline-relative gating via `--arch-all`.
     if (errors > 0) {
+        if (options.baselineRelative === false) {
+            // Explicit opt-in (`--arch-all`): fail on TOTAL errors so a clean-tree CI
+            // demand stays expressible.
+            return {
+                id: 'arch',
+                label: 'Architecture',
+                status: 'fail',
+                message: `${errors} architecture error(s).`,
+                details: { errors, warnings, kinds: report.countsByKind },
+                nextCommands: ['shrk arch check', 'shrk arch baseline write'],
+                durationMs: Date.now() - start,
+            };
+        }
+        // Default: no baseline frozen. Don't hard-fail on pre-existing debt the
+        // current diff never introduced — warn (so the signal stays visible) and
+        // point at freezing a baseline to switch on NEW-only gating. `--strict`
+        // still turns this warn into a hard failure for CI, and `--arch-all` fails
+        // on the total.
         return {
             id: 'arch',
             label: 'Architecture',
-            status: 'fail',
-            message: `${errors} architecture error(s).`,
-            details: { errors, warnings, kinds: report.countsByKind },
-            nextCommands: ['shrk arch check', 'shrk arch baseline write'],
+            status: 'warn',
+            message: `${errors} architecture error(s), no baseline frozen — not failing the gate (freeze one with \`shrk arch baseline write\` to track regressions; use \`--arch-all\` or \`--strict\` to fail).`,
+            details: { errors, warnings, kinds: report.countsByKind, noBaseline: true },
+            nextCommands: ['shrk arch baseline write', 'shrk arch check'],
             durationMs: Date.now() - start,
         };
     }

package/dist/gates/impact-gate.d.ts

@@ -4,12 +4,24 @@ export interface IImpactGateOptions {
     sinceRef?: string;
     /** Risk levels that fail the gate. Default ['critical']. */
     failOn?: readonly ('high' | 'critical')[];
+    /**
+     * Explicit changed-file set to analyze. Used by `--changed-only` / `--staged`
+     * / `--files` when no `sinceRef` gitref is given. Ignored when `sinceRef` is
+     * set (the gitref diff wins). An empty array yields the `skipped` path.
+     */
+    files?: readonly string[];
 }
 /**
- * Impact-engine gate. Reads `git diff --name-only` against `sinceRef`
- * (default 'main') and runs `analyzeGraphImpact`. Fails when the
- * computed risk is in `failOn`. Skipped when no files changed or the
- * graph isn't indexed.
+ * Impact-engine gate. Analyzes the changeset and runs `analyzeGraphImpact`.
+ * When `files` is provided (and no `sinceRef`), the given changed-file set is
+ * analyzed directly; otherwise `git diff --name-only` is run against `sinceRef`
+ * (default 'main').
+ *
+ * Failure is THRESHOLD-based, not exact set-membership: the gate ranks
+ * low<medium<high<critical and fails when the computed risk is at least as
+ * severe as the *least* severe entry in `failOn`. So `--fail-on high` also
+ * fails a `critical` change. With the default `['critical']`, `critical` fails
+ * and `high` warns. Skipped when no files changed or the graph isn't indexed.
  */
 export declare function impactGate(projectRoot: string, options?: IImpactGateOptions): IGateResult;
 //# sourceMappingURL=impact-gate.d.ts.map

package/dist/gates/impact-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impact-gate.d.ts","sourceRoot":"","sources":["../../src/gates/impact-gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,WAAW,CA+C7F"}
+{"version":3,"file":"impact-gate.d.ts","sourceRoot":"","sources":["../../src/gates/impact-gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAC1C;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAcD;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,WAAW,CAyD7F"}

package/dist/gates/impact-gate.js

@@ -1,19 +1,42 @@
 import { analyzeGraphImpact } from '@shrkcrft/impact-engine';
+/** low < medium < high < critical — used for threshold comparison. */
+const RISK_RANK = {
+    low: 0,
+    medium: 1,
+    high: 2,
+    critical: 3,
+};
+function rankOf(risk) {
+    return RISK_RANK[risk] ?? 0;
+}
 /**
- * Impact-engine gate. Reads `git diff --name-only` against `sinceRef`
- * (default 'main') and runs `analyzeGraphImpact`. Fails when the
- * computed risk is in `failOn`. Skipped when no files changed or the
- * graph isn't indexed.
+ * Impact-engine gate. Analyzes the changeset and runs `analyzeGraphImpact`.
+ * When `files` is provided (and no `sinceRef`), the given changed-file set is
+ * analyzed directly; otherwise `git diff --name-only` is run against `sinceRef`
+ * (default 'main').
+ *
+ * Failure is THRESHOLD-based, not exact set-membership: the gate ranks
+ * low<medium<high<critical and fails when the computed risk is at least as
+ * severe as the *least* severe entry in `failOn`. So `--fail-on high` also
+ * fails a `critical` change. With the default `['critical']`, `critical` fails
+ * and `high` warns. Skipped when no files changed or the graph isn't indexed.
  */
 export function impactGate(projectRoot, options = {}) {
     const start = Date.now();
+    const failOn = options.failOn && options.failOn.length > 0 ? options.failOn : ['critical'];
+    const failThreshold = Math.min(...failOn.map((f) => rankOf(f)));
+    // Scope: an explicit changed-file set (when no gitref is given) is analyzed
+    // directly; otherwise diff against the gitref (default 'main').
+    const useFiles = !options.sinceRef && options.files !== undefined;
     const sinceRef = options.sinceRef ?? 'main';
-    const failOn = new Set(options.failOn ?? ['critical']);
-    const analysis = analyzeGraphImpact({ kind: 'gitref', ref: sinceRef }, { projectRoot });
+    const label = useFiles ? 'Impact (changed files)' : 'Impact (since ' + sinceRef + ')';
+    const analysis = useFiles
+        ? analyzeGraphImpact({ kind: 'files', files: options.files ?? [] }, { projectRoot })
+        : analyzeGraphImpact({ kind: 'gitref', ref: sinceRef }, { projectRoot });
     if (analysis.diagnostics.some((d) => d.includes('code-graph store missing'))) {
         return {
             id: 'impact',
-            label: 'Impact (since ' + sinceRef + ')',
+            label,
             status: 'skipped',
             message: 'Skipped — graph index missing.',
             nextCommands: ['shrk graph index'],
@@ -23,13 +46,13 @@ export function impactGate(projectRoot, options = {}) {
     if (analysis.normalizedTargets.length === 0) {
         return {
             id: 'impact',
-            label: 'Impact (since ' + sinceRef + ')',
+            label,
             status: 'skipped',
-            message: `No files changed since ${sinceRef}.`,
+            message: useFiles ? 'No files changed.' : `No files changed since ${sinceRef}.`,
             durationMs: Date.now() - start,
         };
     }
-    const status = failOn.has(analysis.risk) ? 'fail' : analysis.risk === 'high' ? 'warn' : 'pass';
+    const status = rankOf(analysis.risk) >= failThreshold ? 'fail' : analysis.risk === 'high' ? 'warn' : 'pass';
     const message = status === 'fail'
         ? `Risk: ${analysis.risk}. ${analysis.directDependents.length} direct dependents.`
         : status === 'warn'
@@ -37,7 +60,7 @@ export function impactGate(projectRoot, options = {}) {
             : `Risk: ${analysis.risk}. Looks safe.`;
     return {
         id: 'impact',
-        label: 'Impact (since ' + sinceRef + ')',
+        label,
         status,
         message,
         details: {

package/dist/gates/knowledge-symbol-gate.d.ts

@@ -0,0 +1,27 @@
+import { type ISharkcraftInspection } from '@shrkcrft/inspector';
+import type { IGateResult } from '../schema/quality-gate.js';
+export interface IKnowledgeSymbolGateOptions {
+    /**
+     * Pre-loaded inspection (knowledge entries + project root). Loading the
+     * inspection is async, so the caller (the gate command) builds it and
+     * injects it here. The gate is skipped when omitted.
+     */
+    inspection?: ISharkcraftInspection;
+    /** Restrict to entries whose references touch one of these changed files. */
+    changedFiles?: readonly string[];
+    /**
+     * When true (default), a moved / renamed / missing symbol or file ref fails
+     * the gate; otherwise it warns.
+     */
+    failOnStale?: boolean;
+}
+/**
+ * Knowledge symbol-ref integrity gate. Walks every knowledge entry's symbol
+ * and file references and verifies each still resolves. Resolution is
+ * graph-backed: when the code graph is indexed it is passed to the stale-check
+ * so a *moved* symbol (now declared in a different file) is detected as stale
+ * rather than silently passing — single-file AST cannot see that. Skipped when
+ * no inspection is supplied or there are no symbol/file references in scope.
+ */
+export declare function knowledgeSymbolGate(projectRoot: string, options?: IKnowledgeSymbolGateOptions): IGateResult;
+//# sourceMappingURL=knowledge-symbol-gate.d.ts.map

package/dist/gates/knowledge-symbol-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"knowledge-symbol-gate.d.ts","sourceRoot":"","sources":["../../src/gates/knowledge-symbol-gate.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAK7D,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,2BAAgC,GACxC,WAAW,CA0Eb"}

package/dist/gates/knowledge-symbol-gate.js

@@ -0,0 +1,80 @@
+import { loadGraphApiCached } from '@shrkcrft/graph';
+import { buildKnowledgeStaleReport, ReferenceCheckOutcome, } from '@shrkcrft/inspector';
+/** Reference kinds this gate is responsible for (symbol-ref integrity). */
+const SCOPED_REF_KINDS = new Set(['symbol', 'file']);
+/**
+ * Knowledge symbol-ref integrity gate. Walks every knowledge entry's symbol
+ * and file references and verifies each still resolves. Resolution is
+ * graph-backed: when the code graph is indexed it is passed to the stale-check
+ * so a *moved* symbol (now declared in a different file) is detected as stale
+ * rather than silently passing — single-file AST cannot see that. Skipped when
+ * no inspection is supplied or there are no symbol/file references in scope.
+ */
+export function knowledgeSymbolGate(projectRoot, options = {}) {
+    const start = Date.now();
+    const inspection = options.inspection;
+    if (!inspection) {
+        return {
+            id: 'knowledge-symbol',
+            label: 'Knowledge symbol refs',
+            status: 'skipped',
+            message: 'Skipped — no knowledge inspection supplied.',
+            durationMs: Date.now() - start,
+        };
+    }
+    if (inspection.knowledgeEntries.length === 0) {
+        return {
+            id: 'knowledge-symbol',
+            label: 'Knowledge symbol refs',
+            status: 'skipped',
+            message: 'No knowledge entries — nothing to verify.',
+            durationMs: Date.now() - start,
+        };
+    }
+    // Graph-resolved when available; null falls the stale-check back to AST.
+    const graph = loadGraphApiCached(projectRoot) ?? undefined;
+    const report = buildKnowledgeStaleReport(inspection, {
+        ...(options.changedFiles ? { changedFiles: options.changedFiles } : {}),
+        ...(graph ? { graph } : {}),
+    });
+    const scoped = report.referenceChecks.filter((c) => SCOPED_REF_KINDS.has(c.reference.kind));
+    const evaluated = scoped.length;
+    if (evaluated === 0) {
+        return {
+            id: 'knowledge-symbol',
+            label: 'Knowledge symbol refs',
+            status: 'skipped',
+            message: 'No symbol/file references in scope — nothing evaluated.',
+            details: { evaluated: 0, graphResolved: Boolean(graph) },
+            durationMs: Date.now() - start,
+        };
+    }
+    const broken = scoped.filter((c) => c.outcome === ReferenceCheckOutcome.Stale || c.outcome === ReferenceCheckOutcome.Missing);
+    if (broken.length === 0) {
+        return {
+            id: 'knowledge-symbol',
+            label: 'Knowledge symbol refs',
+            status: 'pass',
+            message: `${evaluated} symbol/file reference(s) resolve.`,
+            details: { evaluated, graphResolved: Boolean(graph) },
+            durationMs: Date.now() - start,
+        };
+    }
+    const samples = broken.slice(0, 8).map((c) => {
+        const target = c.reference.symbol
+            ? `symbol \`${c.reference.symbol}\``
+            : (c.reference.path ?? '?');
+        const where = c.reference.path && c.reference.symbol ? ` (${c.reference.path})` : '';
+        return `${c.entryId}: ${target}${where} — ${c.message}`;
+    });
+    const failOnStale = options.failOnStale ?? true;
+    return {
+        id: 'knowledge-symbol',
+        label: 'Knowledge symbol refs',
+        status: failOnStale ? 'fail' : 'warn',
+        message: `${broken.length}/${evaluated} symbol/file reference(s) stale or missing (moved/renamed).`,
+        details: { evaluated, broken: broken.length, samples, graphResolved: Boolean(graph) },
+        nextCommands: ['shrk knowledge audit', 'shrk doctor'],
+        durationMs: Date.now() - start,
+    };
+}

package/dist/gates/policy-lint-gate.d.ts

@@ -0,0 +1,25 @@
+import type { IPolicyRule } from '@shrkcrft/core';
+import type { IGateResult } from '../schema/quality-gate.js';
+export interface IPolicyLintGateOptions {
+    /** The project's policy rules (from `sharkcraft.config.ts` `policyRules[]`). */
+    rules?: readonly IPolicyRule[];
+    /** Restrict to rules whose globs match one of these (project-relative) changed files. */
+    changedFiles?: readonly string[];
+    /** When true, only run rules touched by `changedFiles`. */
+    changedOnly?: boolean;
+    /**
+     * Set when the project config could not be loaded/validated. The gate surfaces
+     * it (warn) instead of silently skipping — a malformed config must not quietly
+     * disable the policy plane.
+     */
+    configError?: string;
+}
+/**
+ * The "policy plane" gate: runs the project's data-defined policy-lint rules
+ * (template / markup / stylesheet / AOT-invisible TS surfaces that tsc cannot
+ * see). Skipped — never red — when no rules are configured, so it's inert for
+ * projects that don't opt in. Honors the loud-zero contract: rules that exist
+ * but fall out of the changed-only scope report `skipped`, never a silent pass.
+ */
+export declare function policyLintGate(projectRoot: string, options?: IPolicyLintGateOptions): IGateResult;
+//# sourceMappingURL=policy-lint-gate.d.ts.map

package/dist/gates/policy-lint-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-lint-gate.d.ts","sourceRoot":"","sources":["../../src/gates/policy-lint-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC/B,yFAAyF;IACzF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,2DAA2D;IAC3D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B,GAAG,WAAW,CA2ErG"}

package/dist/gates/policy-lint-gate.js

@@ -0,0 +1,80 @@
+import { runPolicyLint } from '@shrkcrft/boundaries';
+/**
+ * The "policy plane" gate: runs the project's data-defined policy-lint rules
+ * (template / markup / stylesheet / AOT-invisible TS surfaces that tsc cannot
+ * see). Skipped — never red — when no rules are configured, so it's inert for
+ * projects that don't opt in. Honors the loud-zero contract: rules that exist
+ * but fall out of the changed-only scope report `skipped`, never a silent pass.
+ */
+export function policyLintGate(projectRoot, options = {}) {
+    const start = Date.now();
+    if (options.configError) {
+        return {
+            id: 'policy',
+            label: 'Policy lint',
+            status: 'warn',
+            message: `Config could not be loaded — policy rules not evaluated: ${options.configError}`,
+            nextCommands: ['shrk doctor'],
+            durationMs: Date.now() - start,
+        };
+    }
+    const rules = options.rules ?? [];
+    if (rules.length === 0) {
+        return {
+            id: 'policy',
+            label: 'Policy lint',
+            status: 'skipped',
+            message: 'No policy rules configured (sharkcraft.config.ts policyRules[]).',
+            durationMs: Date.now() - start,
+        };
+    }
+    const report = runPolicyLint(projectRoot, rules, {
+        ...(options.changedOnly ? { changedOnly: true, changedFiles: options.changedFiles ?? [] } : {}),
+    });
+    // Loud zero case: rules exist but none actually scanned a file (their globs
+    // matched no files — e.g. a `style` rule in a project with no stylesheets — or
+    // `--changed-only` filtered them all out). Surface it as skipped rather than a
+    // silent green pass.
+    if (report.rules.length === 0 || report.evaluated === 0) {
+        return {
+            id: 'policy',
+            label: 'Policy lint',
+            status: 'skipped',
+            message: 'No policy rules in scope — nothing evaluated.',
+            details: { evaluated: 0 },
+            durationMs: Date.now() - start,
+        };
+    }
+    const errors = report.findings.filter((f) => f.severity === 'error').length;
+    const warnings = report.findings.filter((f) => f.severity === 'warning').length;
+    const samples = report.findings
+        .slice(0, 8)
+        .map((f) => `${f.ruleId}: ${f.match} (${f.file}:${f.line})`);
+    const diagnostics = report.diagnostics;
+    if (report.verdict === 'pass') {
+        return {
+            id: 'policy',
+            label: 'Policy lint',
+            status: 'pass',
+            message: `${report.rules.length} policy rule(s) — no violations.`,
+            details: { rules: report.rules.length, evaluated: report.evaluated },
+            durationMs: Date.now() - start,
+        };
+    }
+    const misconfig = diagnostics.length > 0 ? `, ${diagnostics.length} misconfigured rule(s)` : '';
+    return {
+        id: 'policy',
+        label: 'Policy lint',
+        status: report.verdict === 'errors' ? 'fail' : 'warn',
+        message: `${errors} error(s), ${warnings} warning(s)${misconfig}: policy violation(s).`,
+        details: {
+            errors,
+            warnings,
+            samples,
+            evaluated: report.evaluated,
+            ...(diagnostics.length > 0 ? { diagnostics } : {}),
+        },
+        nextCommands: ['shrk policy-lint'],
+        durationMs: Date.now() - start,
+    };
+}

package/dist/gates/wiring-gate.d.ts

@@ -0,0 +1,23 @@
+import type { IWiringRule } from '@shrkcrft/core';
+import type { IGateResult } from '../schema/quality-gate.js';
+export interface IWiringGateOptions {
+    /** The project's wiring rules (from `sharkcraft.config.ts` `wiringRules[]`). */
+    rules?: readonly IWiringRule[];
+    /** Restrict to rules touched by these (project-relative) changed files. */
+    changedFiles?: readonly string[];
+    /** When true, only run rules touched by `changedFiles`. */
+    changedOnly?: boolean;
+    /**
+     * Set when the project config could not be loaded/validated. The gate surfaces
+     * it (warn) instead of silently skipping — a malformed config must not quietly
+     * disable the wiring plane.
+     */
+    configError?: string;
+}
+/**
+ * The "completeness plane" gate: runs the project's data-defined wiring rules
+ * (declared token set ⊆ registered token set). Skipped — never red — when no
+ * rules are configured, so it's inert for projects that don't opt in.
+ */
+export declare function wiringGate(projectRoot: string, options?: IWiringGateOptions): IGateResult;
+//# sourceMappingURL=wiring-gate.d.ts.map

package/dist/gates/wiring-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wiring-gate.d.ts","sourceRoot":"","sources":["../../src/gates/wiring-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,2DAA2D;IAC3D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,WAAW,CAwE7F"}

package/dist/gates/wiring-gate.js

@@ -0,0 +1,75 @@
+import { runWiring } from '@shrkcrft/boundaries';
+/**
+ * The "completeness plane" gate: runs the project's data-defined wiring rules
+ * (declared token set ⊆ registered token set). Skipped — never red — when no
+ * rules are configured, so it's inert for projects that don't opt in.
+ */
+export function wiringGate(projectRoot, options = {}) {
+    const start = Date.now();
+    if (options.configError) {
+        return {
+            id: 'wiring',
+            label: 'Wiring (completeness)',
+            status: 'warn',
+            message: `Config could not be loaded — wiring rules not evaluated: ${options.configError}`,
+            nextCommands: ['shrk doctor'],
+            durationMs: Date.now() - start,
+        };
+    }
+    const rules = options.rules ?? [];
+    if (rules.length === 0) {
+        return {
+            id: 'wiring',
+            label: 'Wiring (completeness)',
+            status: 'skipped',
+            message: 'No wiring rules configured (sharkcraft.config.ts wiringRules[]).',
+            durationMs: Date.now() - start,
+        };
+    }
+    const report = runWiring(projectRoot, rules, {
+        ...(options.changedOnly ? { changedOnly: true, changedFiles: options.changedFiles ?? [] } : {}),
+    });
+    // Loud zero case: rules exist but none actually ran a comparison (their globs
+    // matched no files, or `--changed-only` filtered them all out). Surface it as
+    // skipped rather than a silent green pass.
+    if (report.rules.length === 0 || report.evaluated === 0) {
+        return {
+            id: 'wiring',
+            label: 'Wiring (completeness)',
+            status: 'skipped',
+            message: 'No wiring rules in scope — nothing evaluated.',
+            details: { evaluated: 0 },
+            durationMs: Date.now() - start,
+        };
+    }
+    const errors = report.violations.filter((v) => v.severity === 'error').length;
+    const warnings = report.violations.filter((v) => v.severity === 'warning').length;
+    const samples = report.violations.slice(0, 8).map((v) => `${v.ruleId}: ${v.token} (${v.file}:${v.line})`);
+    const diagnostics = report.diagnostics;
+    if (report.verdict === 'pass') {
+        return {
+            id: 'wiring',
+            label: 'Wiring (completeness)',
+            status: 'pass',
+            message: `${report.rules.length} wiring rule(s) — every declared token is wired.`,
+            details: { rules: report.rules.length, evaluated: report.evaluated },
+            durationMs: Date.now() - start,
+        };
+    }
+    const misconfig = diagnostics.length > 0 ? `, ${diagnostics.length} misconfigured rule(s)` : '';
+    return {
+        id: 'wiring',
+        label: 'Wiring (completeness)',
+        status: report.verdict === 'errors' ? 'fail' : 'warn',
+        message: `${errors} error(s), ${warnings} warning(s)${misconfig}: declared but not wired.`,
+        details: {
+            errors,
+            warnings,
+            samples,
+            evaluated: report.evaluated,
+            ...(diagnostics.length > 0 ? { diagnostics } : {}),
+        },
+        nextCommands: ['shrk check wiring'],
+        durationMs: Date.now() - start,
+    };
+}

package/dist/index.d.ts

@@ -9,6 +9,9 @@ export * from './gates/graph-unresolved-gate.js';
 export * from './gates/impact-baseline-gate.js';
 export * from './gates/structural-patterns-gate.js';
 export * from './gates/intent-classifier-gate.js';
+export * from './gates/wiring-gate.js';
+export * from './gates/policy-lint-gate.js';
+export * from './gates/knowledge-symbol-gate.js';
 export * from './runner/run-gates.js';
 export * from './runner/report-store.js';
 export * from './runner/render-markdown.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC"}

package/dist/index.js

@@ -9,6 +9,9 @@ export * from "./gates/graph-unresolved-gate.js";
 export * from "./gates/impact-baseline-gate.js";
 export * from "./gates/structural-patterns-gate.js";
 export * from "./gates/intent-classifier-gate.js";
+export * from "./gates/wiring-gate.js";
+export * from "./gates/policy-lint-gate.js";
+export * from "./gates/knowledge-symbol-gate.js";
 export * from "./runner/run-gates.js";
 export * from "./runner/report-store.js";
 export * from "./runner/render-markdown.js";

package/dist/runner/run-gates.d.ts

@@ -6,6 +6,9 @@ import { type IImpactGateOptions } from '../gates/impact-gate.js';
 import { type IImpactBaselineGateOptions } from '../gates/impact-baseline-gate.js';
 import { type IIntentClassifierGateOptions } from '../gates/intent-classifier-gate.js';
 import { type IStructuralPatternsGateOptions } from '../gates/structural-patterns-gate.js';
+import { type IWiringGateOptions } from '../gates/wiring-gate.js';
+import { type IPolicyLintGateOptions } from '../gates/policy-lint-gate.js';
+import { type IKnowledgeSymbolGateOptions } from '../gates/knowledge-symbol-gate.js';
 import { type IQualityGateReport } from '../schema/quality-gate.js';
 export interface IRunGatesOptions {
     projectRoot: string;
@@ -28,6 +31,15 @@ export interface IRunGatesOptions {
     structuralPatterns?: IStructuralPatternsGateOptions;
     /** Optional intent-classifier gate config. */
     intentClassifier?: IIntentClassifierGateOptions;
+    /** Optional wiring gate config (the project's wiringRules + change scope). */
+    wiring?: IWiringGateOptions;
+    /** Optional policy-lint gate config (the project's policyRules + change scope). */
+    policy?: IPolicyLintGateOptions;
+    /**
+     * Optional knowledge symbol-ref gate config. When omitted, the gate is
+     * skipped — the inspection (async to load) is what opts a project in.
+     */
+    knowledgeSymbol?: IKnowledgeSymbolGateOptions;
     /** Disable specific gates by id. */
     disable?: readonly string[];
 }

package/dist/runner/run-gates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-gates.d.ts","sourceRoot":"","sources":["../../src/runner/run-gates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAElF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAmB,KAAK,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE9F,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,sDAAsD;IACtD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,yCAAyC;IACzC,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,6CAA6C;IAC7C,eAAe,CAAC,EAAE,2BAA2B,CAAC;IAC9C,4CAA4C;IAC5C,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,gDAAgD;IAChD,kBAAkB,CAAC,EAAE,8BAA8B,CAAC;IACpD,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,4BAA4B,CAAC;IAChD,oCAAoC;IACpC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,kBAAkB,CAkD7E"}
+{"version":3,"file":"run-gates.d.ts","sourceRoot":"","sources":["../../src/runner/run-gates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAElF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAmB,KAAK,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE9F,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAkB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,sDAAsD;IACtD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,yCAAyC;IACzC,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,6CAA6C;IAC7C,eAAe,CAAC,EAAE,2BAA2B,CAAC;IAC9C,4CAA4C;IAC5C,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,gDAAgD;IAChD,kBAAkB,CAAC,EAAE,8BAA8B,CAAC;IACpD,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,4BAA4B,CAAC;IAChD,8EAA8E;IAC9E,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,mFAAmF;IACnF,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC;;;OAGG;IACH,eAAe,CAAC,EAAE,2BAA2B,CAAC;IAC9C,oCAAoC;IACpC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,kBAAkB,CA2D7E"}

package/dist/runner/run-gates.js

@@ -7,6 +7,9 @@ import { impactGate } from "../gates/impact-gate.js";
 import { impactBaselineGate, } from "../gates/impact-baseline-gate.js";
 import { intentClassifierGate, } from "../gates/intent-classifier-gate.js";
 import { structuralPatternsGate, } from "../gates/structural-patterns-gate.js";
+import { wiringGate } from "../gates/wiring-gate.js";
+import { policyLintGate } from "../gates/policy-lint-gate.js";
+import { knowledgeSymbolGate, } from "../gates/knowledge-symbol-gate.js";
 import { QUALITY_GATE_SCHEMA, } from "../schema/quality-gate.js";
 /**
  * Run the quality-gate aggregator over a project.
@@ -60,6 +63,15 @@ export function runQualityGates(options) {
     if (!disabled.has('intent-classifier')) {
         gates.push(intentClassifierGate(options.projectRoot, options.intentClassifier ?? {}));
     }
+    if (!disabled.has('wiring')) {
+        gates.push(wiringGate(options.projectRoot, options.wiring ?? {}));
+    }
+    if (!disabled.has('policy')) {
+        gates.push(policyLintGate(options.projectRoot, options.policy ?? {}));
+    }
+    if (!disabled.has('knowledge-symbol') && options.knowledgeSymbol) {
+        gates.push(knowledgeSymbolGate(options.projectRoot, options.knowledgeSymbol));
+    }
     if (!disabled.has('api-diff') && options.apiDiff) {
         gates.push(apiDiffGate(options.projectRoot, options.apiDiff));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shrkcrft/quality-gates",
-  "version": "0.1.0-alpha.21",
+  "version": "0.1.0-alpha.23",
   "description": "SharkCraft quality gates: single aggregator that runs the code-intelligence checks (graph index, boundaries, architecture, impact summary) and emits one pass/fail report. The pre-merge gate for AI-agent-authored changes.",
   "license": "MIT",
   "author": "SharkCraft contributors",
@@ -43,14 +43,15 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@shrkcrft/core": "^0.1.0-alpha.21",
-    "@shrkcrft/graph": "^0.1.0-alpha.21",
-    "@shrkcrft/architecture-guard": "^0.1.0-alpha.21",
-    "@shrkcrft/impact-engine": "^0.1.0-alpha.21",
-    "@shrkcrft/api-surface-diff": "^0.1.0-alpha.21",
-    "@shrkcrft/boundaries": "^0.1.0-alpha.21",
-    "@shrkcrft/structural-search": "^0.1.0-alpha.21",
-    "@shrkcrft/context-planner": "^0.1.0-alpha.21"
+    "@shrkcrft/core": "^0.1.0-alpha.23",
+    "@shrkcrft/graph": "^0.1.0-alpha.23",
+    "@shrkcrft/architecture-guard": "^0.1.0-alpha.23",
+    "@shrkcrft/impact-engine": "^0.1.0-alpha.23",
+    "@shrkcrft/api-surface-diff": "^0.1.0-alpha.23",
+    "@shrkcrft/boundaries": "^0.1.0-alpha.23",
+    "@shrkcrft/structural-search": "^0.1.0-alpha.23",
+    "@shrkcrft/context-planner": "^0.1.0-alpha.23",
+    "@shrkcrft/inspector": "^0.1.0-alpha.23"
   },
   "publishConfig": {
     "access": "public"