@thebattlearena/corner 0.10.1-beta.78 → 0.10.1-beta.80

package/README.md

@@ -374,7 +374,7 @@ rama. El contrato para el proyecto está en `ring/skills/sparring/references/hos
 **Config del repo** (`.claude/ring.json`, opcional): `gates` (typecheck, tests por ruta con
 `{paths}`, lint), `validateCommand`, `rulebook` (por defecto el genérico del plugin),
 `protectedBranches`, `forbidAiTrailers` (por defecto `true`), `heavyCommands`, `delegation`,
-`precedents`, `monitors` (ver «Monitores del repo»), `briefGuard` (`warn`, `block` u `off`) y `agents` (modelo y esfuerzo por rol; por
+`precedents`, `monitors` (ver «Monitores del repo»), `briefGuard` (`warn`, `block` u `off`), `layers`, `layersIgnore`, `layersRequired` y `findingsNeedJudge` (ver «Gate de arquitectura»), `relayEvery`, `humanReviewEvery` (ver «Revisión humana por bloques»), `engramUrl` y `engramProject` (ver «Memoria entre peleas»), y `agents` (modelo y esfuerzo por rol; por
 defecto el luchador y el rudo en `sonnet` con esfuerzo `high` y el esquinero en `opus` con `high`,
 p. ej. `"agents": { "wrestler": { "model": "opus" } }`). Sin el archivo, `ring` usa los gates que
 detecta en `package.json`, `pyproject.toml`, `go.mod` y el `Makefile`.
@@ -397,6 +397,74 @@ decisión queda en `<combate>/brief-guard.jsonl`. Y cuando la sesión del árbit
 `compact-hook` le devuelve (en menos de 10 000 caracteres) el combate, el checklist, sus faltas y el
 «cómo reanudar» de la tarjeta.
 
+**Gate de arquitectura**: `ring/scripts/arch-gate.mjs check <worktree> --range A..B` revisa los
+imports que el rango **agrega** contra las capas del repo y, si el repo tiene dependency-cruiser
+(`.dependency-cruiser.cjs` y el paquete instalado), también lo corre, con su lista de violaciones
+conocidas cuando la tiene. Cada violación es un hallazgo que cita P14. El esquinero lo corre en cada
+modo y `mask-guard` en cada push a la rama del PR; la deuda que ya estaba no bloquea. Las capas van
+en `.claude/ring.json`:
+
+```json
+"layers": [
+  { "name": "domain", "paths": ["packages/contexts/*/domain/**"], "mayImport": [],
+    "forbid": ["^@nestjs/", "^typeorm$"] },
+  { "name": "application", "paths": ["apps/public-api/src/**/application/**"],
+    "mayImport": ["domain"] },
+  { "name": "infrastructure",
+    "paths": ["apps/public-api/src/**/typeorm/**", "apps/public-api/src/**/controllers/**"],
+    "mayImport": ["application", "domain"] }
+]
+```
+
+Cuenta la **primera** capa cuya ruta coincide: van primero las más específicas (una
+`infrastructure/` anidada dentro de una `application/` es infraestructura). Con `layersRequired`
+(globs, p. ej. `["apps/public-api/src/**"]`) todo archivo **nuevo** bajo esas rutas tiene que caer en
+alguna capa: el que no, es hallazgo, porque ninguna regla de dependencias lo alcanza. Si el worktree
+de la pelea no tiene `.claude/ring.json` (un repo que lo guarda sin versionar), el gate usa el del
+checkout principal del mismo repo. Los globs usan `**` y `*` (sin llaves `{a,b}`: una ruta por entrada). Las pruebas (`*.spec.*`, `*.test.*`, `__tests__/`, `test/`) quedan fuera por default: pueden armar un adaptador a propósito (`layersIgnore` cambia la lista). Los alias de `tsconfig.json` (`@arena/*`) se resuelven solos. Un repo sin capas ni dependency-cruiser
+recibe un aviso al abrir la pelea (`judges-card open`). Y un hallazgo que cita una regla de
+`findingsNeedJudge` (por defecto `["P14"]`; una pelea de limpieza agrega R6, R11, R12, R19 y R22) no
+se manda a ticket ni se descarta sin `--judge "<lo que dijo el humano>"`.
+
+**Un luchador nuevo por concepto, y el relevo del árbitro**: cuando el esquinero aprueba un
+concepto, `judges-card.mjs concept <pr> "<concepto>" --range A..B` lo registra y retira a los
+luchadores que lo cargaron; el siguiente concepto va a uno nuevo (`brief.mjs wrestler <pr> --mode
+resume`), y `brief-guard` avisa (o bloquea) un `SendMessage` a uno retirado. Cada `relayEvery`
+conceptos (4 por default, `null` lo apaga) el árbitro reescribe el «cómo reanudar» de la tarjeta, que
+tiene que nombrar el último concepto, y corre `judges-card.mjs relay <pr>`; hasta entonces
+`brief.mjs` no le arma instrucciones al siguiente luchador. Eso es lo que la sesión recupera al
+compactarse. Y `judges-card.mjs close` no cierra mientras una propuesta de «For the rulebook /
+precedents» (los `X0` incluidos) no tenga decisión: `judges-card.mjs proposal <pr> <n>
+accept|reject --why "<lo que dijo el humano>"`.
+
+**Revisión humana por bloques (PR Review Lab)**: cada punto del plan técnico es un bloque (`B<n>` es
+el punto n). `judges-card.mjs plan <pr> estimate <n> --minutes <m> [--priority 1-4]` le pone estimado y
+prioridad. Al pasar a «en curso» se anotan el inicio y el autor (el `user.email` de git del worktree),
+y al pasar a «espera al juez» el fin y el rango (`--range A..B` lo fija a mano); todo va en
+`plan.jsonl`, que es lo que lee el modo «Pelea del ring» de PR Review Lab. Cuando `humanReviewEvery`
+bloques (2 por default, `null` lo apaga) esperan al juez, suena la campana en PR Review Lab y
+`brief.mjs` no le arma instrucciones al siguiente luchador hasta que el humano revise ese corte en un
+solo diff y firme un veredicto con Tape. PR Review Lab lo escribe en `<combate>/review-verdicts.jsonl`
+y el ring lo lee en el siguiente brief o `summary`: si pasa, los bloques quedan en «hecho»; si no
+pasa, vuelven a «en curso» con el feedback y el Tape como rebote, que el brief del siguiente luchador
+trae al principio. Cada veredicto queda en `decisions.md` como decisión del juez (y en Engram).
+
+**Memoria entre peleas (Engram, opcional)**: si en `engramUrl` (por default
+`http://127.0.0.1:7437`) contesta un [Engram](https://github.com/Gentleman-Programming/engram)
+(`engram serve`), los scripts le mandan lo que cada pelea aprendió: las faltas, las respuestas y
+decisiones del juez, los precedentes aceptados, los hallazgos `X0` (con su estado) y el estado de la
+pelea (cómo reanudar, plan y conceptos, que se actualiza en el mismo registro). Lo mandan
+`judges-card.mjs` y `findings.mjs` después de cada comando, sin repetir nada (cada envío lleva un id
+de operación sacado de su contenido, y los enviados quedan en `<combate>/engram-sent.json`). De
+vuelta, `brief.mjs` agrega al brief, después de las decisiones y antes de las reglas, lo aprendido en
+otras peleas del repo sobre los archivos del rango, y `judges-card.mjs summary` las faltas y veredictos
+recientes del repo. Las reglas nunca van a Engram: siguen en archivos y el brief las trae completas;
+lo que viene de Engram es contexto, no regla. Sin Engram (o con `engramUrl: null`) todo sigue igual.
+`engram.mjs status` dice si contesta, `engram.mjs sync --all` sube las peleas que ya existían del repo
+y `engram.mjs recall <pr> [--files a,b]` muestra lo que leería un brief. El proyecto es el nombre del
+repo (`engramProject` lo cambia) y `RING_ENGRAM_URL` gana sobre el archivo (`off` lo apaga; así
+corren las pruebas del plugin).
+
 **Delegación y precedentes**: con `delegation: "referee"` (el default) el árbitro decide él mismo
 las dudas de diseño con el reglamento y los precedentes, anota por qué en `decisions.md` y sigue;
 sólo te llega una lista corta (merges y bases, flags y variables de entorno, cambios visibles para

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thebattlearena/corner",
-  "version": "0.10.1-beta.78",
+  "version": "0.10.1-beta.80",
   "description": "Corner: tu esquina de Battle Arena en Claude Code (el plugin `battlearena`). Hooks de tracking, objetivo del turno, plan de batalla /battlearena:conquer, Ringside (el panel de tu día), el ring y la radio. Zero-dependency.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   "scripts": {
     "bundle:skill": "node -e \"const{cpSync,rmSync,mkdirSync}=require('fs');const out='plugin/skills';rmSync(out,{recursive:true,force:true});mkdirSync(out,{recursive:true});for(const s of ['arena-objective','arena-self-review','execution-coach','scope-technical-task','pr-review-loop','conquer'])cpSync('../../.claude/skills/'+s,out+'/'+s,{recursive:true,dereference:true})\"",
     "prepack": "npm run bundle:skill",
-    "test": "node --test test/*.test.mjs",
+    "test": "RING_ENGRAM_URL=off node --test test/*.test.mjs",
     "preview:ring": "node scripts/ring-preview.mjs"
   },
   "engines": {

package/ring/agents/cornerman.md

@@ -53,6 +53,13 @@ clean:** sort-imports or prettier is not installed (`missing`), so the files in
 checked. Report it as its own line, `format — NO VERIFICADO — falta <missing> — <files>`, never as
 "no findings".
 
+**Architecture, in every mode:** `node "<ring>/scripts/arch-gate.mjs" check <wt> --range <A>..<B>`
+(read-only). It checks the imports the range adds against the repo's layers (`layers` in
+`.claude/ring.json`) and runs the repo's dependency-cruiser when it has one. Each line it prints is
+already a finding citing P14 (`<file:line> — P14 — <layer> imports <layer> … — …`): report it as
+it is, as a BLOCKER (P14). Exit 2 means the repo has no gate: no finding, but say in one line that
+layers were reviewed only by eye. A layer the gate does not know is still yours to read (lens 1).
+
 ## Mode: concept
 
 A deep review when a concept closes. The brief lists the commits with what each claims to do and a

package/ring/hooks/hooks.json

@@ -11,7 +11,7 @@
         ]
       },
       {
-        "matcher": "Agent|Task",
+        "matcher": "Agent|Task|SendMessage",
         "hooks": [
           {
             "type": "command",

package/ring/scripts/arch-gate.mjs

@@ -0,0 +1,407 @@
+#!/usr/bin/env node
+// The architecture gate: which layer may import which, checked on what a range adds. Zero-dependency.
+//
+//   node arch-gate.mjs check  <worktree> --range <A>..<B> [--json]   exit 0 clean, 1 violations,
+//                                                                       2 nothing configured
+//   node arch-gate.mjs status <worktree>                               what the repo has, and how to
+//                                                                       add what it lacks
+//
+// Two sources, both when the repo has them:
+// - ring's own scanner, from `layers` in `.claude/ring.json`: each layer has `paths` (globs) and
+//   `mayImport` (the layers it may depend on; its own is always allowed), and may `forbid` packages
+//   by regex (`"forbid": ["^@nestjs/", "^typeorm$"]` for a domain layer). Only imports on lines the
+//   range ADDS count: what was already there is debt, not this range's.
+// - the repo's dependency-cruiser, when it has a config (`.dependency-cruiser.{js,cjs,mjs,json}`) and
+//   the binary: run on the files the range changed, with the repo's known-violations baseline when
+//   it keeps one (`--ignore-known`). Its `error` rules count; warnings are reported, not counted.
+// Every violation is a finding that cites P14 (the host's rules are not the referee's decisions).
+// mask-guard runs the same check on every push to the PR branch; `judges-card open` warns when a
+// repo has neither source.
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, normalize, posix } from 'node:path';
+
+import { isMain, loadConfig } from './config.mjs';
+import { globToRegExp } from './contract.mjs';
+
+const CODE = /\.(?:[cm]?[jt]sx?)$/;
+const IMPORT =
+  /(?:\bimport\s+(?:type\s+)?(?:[\w*{}\s,$]+\s+from\s+)?|\bexport\s+(?:type\s+)?[\w*{}\s,$]+\s+from\s+|\bimport\s*\(\s*|\brequire\s*\(\s*)['"]([^'"\n]+)['"]/g;
+const DEPCRUISE_CONFIGS = [
+  '.dependency-cruiser.js',
+  '.dependency-cruiser.cjs',
+  '.dependency-cruiser.mjs',
+  '.dependency-cruiser.json',
+];
+const KNOWN_VIOLATIONS = '.dependency-cruiser-known-violations.json';
+
+const git = (root, args) =>
+  execFileSync('git', ['-C', root, ...args], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: 1 << 26,
+  });
+
+/** The module specifiers a file imports, with their line (1-based). PURE. */
+export function importSpecs(text) {
+  const out = [];
+  const lineAt = (index) => text.slice(0, index).split('\n').length;
+  for (const match of String(text).matchAll(IMPORT))
+    out.push({ spec: match[1], line: lineAt(match.index) });
+  return out;
+}
+
+/** The new-side line numbers a `git diff -U0` of one file adds. PURE. */
+export function addedLines(diff) {
+  const added = new Set();
+  for (const hunk of String(diff).matchAll(
+    /^@@ -\S+ \+(\d+)(?:,(\d+))? @@/gm,
+  )) {
+    const start = Number(hunk[1]);
+    const count = hunk[2] === undefined ? 1 : Number(hunk[2]);
+    for (let i = 0; i < count; i += 1) added.add(start + i);
+  }
+  return added;
+}
+
+const stripJsonComments = (text) =>
+  String(text)
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/(^|[^:"'])\/\/.*$/gm, '$1')
+    .replace(/,(\s*[}\]])/g, '$1');
+
+/** The path aliases of a tsconfig: [{prefix, targets}] with repo-relative targets. PURE. */
+export function tsAliases(tsconfigText) {
+  try {
+    const { compilerOptions = {} } = JSON.parse(
+      stripJsonComments(tsconfigText),
+    );
+    const base = compilerOptions.baseUrl ?? '.';
+    return Object.entries(compilerOptions.paths ?? {}).map(
+      ([key, targets]) => ({
+        prefix: key.replace(/\*$/, ''),
+        exact: !key.endsWith('*'),
+        targets: targets.map((target) =>
+          posix.normalize(posix.join(base, target.replace(/\*$/, ''))),
+        ),
+      }),
+    );
+  } catch {
+    return [];
+  }
+}
+
+/** Where a specifier points inside the repo (repo-relative), or null for a package. PURE. */
+export function resolveSpec(fromFile, spec, aliases = []) {
+  if (spec.startsWith('.'))
+    return posix.normalize(posix.join(posix.dirname(fromFile), spec));
+  const alias = aliases.find(({ prefix, exact }) =>
+    exact ? spec === prefix : spec.startsWith(prefix),
+  );
+  if (!alias) return null;
+  return posix
+    .normalize(
+      `${alias.targets[0].replace(/\/$/, '')}/${spec.slice(alias.prefix.length)}`,
+    )
+    .replace(/\/$/, '');
+}
+
+/** The first layer whose globs hold `path` (a file or a module without extension), or null. PURE. */
+export function layerOf(path, layers) {
+  return (
+    layers.find(({ paths }) =>
+      paths.some((glob) => {
+        const re = globToRegExp(glob.replace(/^\.\//, ''));
+        return (
+          re.test(path) || re.test(`${path}.ts`) || re.test(`${path}/index.ts`)
+        );
+      }),
+    ) ?? null
+  );
+}
+
+/** The violations of one file's added imports. PURE. */
+export function fileViolations({ file, text, added, layers, aliases }) {
+  const from = layerOf(file, layers);
+  if (!from) return [];
+  const out = [];
+  for (const { spec, line } of importSpecs(text)) {
+    if (!added.has(line)) continue;
+    const target = resolveSpec(file, spec, aliases);
+    if (target === null) {
+      const banned = (from.forbid ?? []).find((pattern) =>
+        new RegExp(pattern).test(spec),
+      );
+      if (banned)
+        out.push({
+          file,
+          line,
+          spec,
+          from: from.name,
+          to: spec,
+          why: `the ${from.name} layer may not depend on ${spec} (forbid ${banned})`,
+        });
+      continue;
+    }
+    const to = layerOf(target, layers);
+    if (!to || to.name === from.name) continue;
+    if ((from.mayImport ?? []).includes(to.name)) continue;
+    out.push({
+      file,
+      line,
+      spec,
+      from: from.name,
+      to: to.name,
+      why: `${from.name} imports ${to.name} (${spec}); ${from.name} may import only ${(from.mayImport ?? []).join(', ') || 'itself'}`,
+    });
+  }
+  return out;
+}
+
+/** A violation as a finding line. PURE. */
+export const findingLine = (v) =>
+  `${v.file}:${v.line} — P14 — ${v.why} — ${
+    v.spec === null
+      ? 'move it into the layer its job belongs to (domain, application or infrastructure)'
+      : 'depend on a port the inner layer owns, or move the code to the layer that may import it'
+  }`;
+
+const depcruiseConfig = (root) =>
+  DEPCRUISE_CONFIGS.find((name) => existsSync(join(root, name))) ?? null;
+const depcruiseBin = (root) =>
+  [join(root, 'node_modules', '.bin', 'depcruise')].find(existsSync) ?? null;
+
+/** What the repo has for the gate, and what to add when it has nothing. */
+export function archStatus(root, config) {
+  const layers = config.layers ?? [];
+  const cruiser = depcruiseConfig(root);
+  const bin = depcruiseBin(root);
+  return {
+    layers: layers.length,
+    dependencyCruiser: Boolean(cruiser && bin),
+    dependencyCruiserConfig: cruiser,
+    dependencyCruiserBinary: Boolean(bin),
+    configured: layers.length > 0 || Boolean(cruiser && bin),
+  };
+}
+
+export const SETUP_HINT =
+  'add "layers" to .claude/ring.json (each with "name", "paths" and "mayImport"; see the ring README, «Gate de arquitectura») or a dependency-cruiser config (.dependency-cruiser.cjs) with the package installed';
+
+/** Files the layer check leaves out: tests by default (they may wire adapters on purpose). */
+export const DEFAULT_LAYERS_IGNORE = [
+  '**/*.spec.*',
+  '**/*.test.*',
+  '**/__tests__/**',
+  '**/test/**',
+];
+
+const ignored = (file, globs) =>
+  globs.some((glob) => globToRegExp(glob).test(file));
+
+function ownScan(root, range, config) {
+  const layers = config.layers ?? [];
+  if (!layers.length) return [];
+  const ignore = config.layersIgnore ?? DEFAULT_LAYERS_IGNORE;
+  const aliases = existsSync(join(root, 'tsconfig.json'))
+    ? tsAliases(readFileSync(join(root, 'tsconfig.json'), 'utf8'))
+    : [];
+  const head = range.split('..')[1] || 'HEAD';
+  const files = git(root, ['diff', '--name-only', '--diff-filter=ACMR', range])
+    .split('\n')
+    .filter(
+      (file) =>
+        CODE.test(file) && !ignored(file, ignore) && layerOf(file, layers),
+    );
+  const imports = files.flatMap((file) =>
+    fileViolations({
+      file,
+      text: git(root, ['show', `${head}:${file}`]),
+      added: addedLines(git(root, ['diff', '-U0', range, '--', file])),
+      layers,
+      aliases,
+    }),
+  );
+  const created = git(root, ['diff', '--name-only', '--diff-filter=A', range])
+    .split('\n')
+    .filter(Boolean);
+  return [...imports, ...placementViolations(created, config)];
+}
+
+/**
+ * The new files that fall in no layer although a `layersRequired` glob covers them: code that
+ * lives outside the architecture is invisible to the rest of the gate. Tests and the
+ * `layersIgnore` files are left out. PURE.
+ */
+export function placementViolations(created, config) {
+  const required = config.layersRequired ?? [];
+  if (!required.length) return [];
+  const layers = config.layers ?? [];
+  const ignore = config.layersIgnore ?? DEFAULT_LAYERS_IGNORE;
+  return created
+    .filter(
+      (file) =>
+        CODE.test(file) &&
+        !ignored(file, ignore) &&
+        required.some((glob) => globToRegExp(glob).test(file)) &&
+        !layerOf(file, layers),
+    )
+    .map((file) => ({
+      file,
+      line: 1,
+      spec: null,
+      from: null,
+      to: null,
+      why: `a new file outside the layers (${layers.map((layer) => layer.name).join(', ')}), so no dependency rule reaches it`,
+    }));
+}
+
+function cruise(root, range) {
+  const cruiser = depcruiseConfig(root);
+  const bin = depcruiseBin(root);
+  if (!cruiser || !bin) return { ran: false, errors: [], warnings: [] };
+  const files = git(root, ['diff', '--name-only', '--diff-filter=ACMR', range])
+    .split('\n')
+    .filter((file) => CODE.test(file) && existsSync(join(root, file)));
+  if (!files.length) return { ran: true, errors: [], warnings: [] };
+  const known = existsSync(join(root, KNOWN_VIOLATIONS))
+    ? ['--ignore-known', KNOWN_VIOLATIONS]
+    : [];
+  const run = spawnSync(
+    bin,
+    ['--config', cruiser, ...known, '--output-type', 'json', ...files],
+    { cwd: root, encoding: 'utf8', maxBuffer: 1 << 26 },
+  );
+  let violations = [];
+  try {
+    violations = JSON.parse(run.stdout).summary?.violations ?? [];
+  } catch {
+    return { ran: false, errors: [], warnings: [], failure: run.stderr.trim() };
+  }
+  const toFinding = (v) => ({
+    file: v.from,
+    line: 1,
+    spec: v.to,
+    from: v.rule?.name ?? 'dependency-cruiser',
+    to: v.to,
+    why: `dependency-cruiser ${v.rule?.name}: ${v.from} → ${v.to}`,
+  });
+  return {
+    ran: true,
+    errors: violations
+      .filter((v) => v.rule?.severity === 'error')
+      .map(toFinding),
+    warnings: violations
+      .filter((v) => v.rule?.severity !== 'error')
+      .map(toFinding),
+  };
+}
+
+/** The gate on a range: { status, violations, warnings, notes }. */
+export function archCheck(root, range, config) {
+  const status = archStatus(root, config);
+  if (!status.configured)
+    return { status, violations: [], warnings: [], notes: [SETUP_HINT] };
+  const own = ownScan(root, range, config);
+  const repo = cruise(root, range);
+  return {
+    status,
+    violations: [...own, ...repo.errors],
+    warnings: repo.warnings,
+    notes: repo.failure
+      ? [`dependency-cruiser did not run: ${repo.failure}`]
+      : [],
+  };
+}
+
+/**
+ * The config the gate reads for a checkout: its own `.claude/ring.json`, or, when it has none (a
+ * bout's worktree of a repo that keeps the file untracked), the main checkout's of the same repo.
+ */
+export function archConfig(root, venue = 'backend') {
+  const read = (dir) => loadConfig(dir, { contract: false, venue }).config;
+  if (existsSync(join(root, '.claude', 'ring.json'))) return read(root);
+  try {
+    const common = git(root, [
+      'rev-parse',
+      '--path-format=absolute',
+      '--git-common-dir',
+    ]).trim();
+    const main = posix.dirname(common);
+    if (main !== root && existsSync(join(main, '.claude', 'ring.json')))
+      return read(main);
+  } catch {
+    // Not a git checkout: its own config, defaults included.
+  }
+  return read(root);
+}
+
+/** The gate for a push to a bout's PR branch: { refusal } (null when it passes or is not configured). */
+export function boutArchGate(state, sha) {
+  const root = state.worktree;
+  const config = archConfig(root, state.venue ?? 'backend');
+  if (!archStatus(root, config).configured) return { refusal: null };
+  const baseRef = [`origin/${state.base}`, state.base].find((ref) => {
+    try {
+      git(root, ['rev-parse', '--verify', '-q', `${ref}^{commit}`]);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  if (!baseRef) return { refusal: null };
+  const base = git(root, ['merge-base', baseRef, sha]).trim();
+  const { violations } = archCheck(root, `${base}..${sha}`, config);
+  return {
+    refusal: violations.length
+      ? `${violations.length} architecture violation(s) the range adds (P14):\n${violations.map(findingLine).join('\n')}\nFix them, or take the human's decision to the hard list.`
+      : null,
+  };
+}
+
+function flags(argv) {
+  const values = {};
+  const rest = [];
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === '--json') values.json = true;
+    else if (argv[i].startsWith('--')) values[argv[i].slice(2)] = argv[++i];
+    else rest.push(argv[i]);
+  }
+  return { values, rest };
+}
+
+if (isMain(import.meta.url)) {
+  const [command, ...argv] = process.argv.slice(2);
+  const { values, rest } = flags(argv);
+  const root = rest[0] ? normalize(rest[0]) : process.cwd();
+  try {
+    const config = archConfig(root);
+    if (command === 'status') {
+      const status = archStatus(root, config);
+      console.log(JSON.stringify(status, null, 2));
+      if (!status.configured)
+        console.error(`arch-gate: nothing configured; ${SETUP_HINT}`);
+      process.exit(status.configured ? 0 : 2);
+    }
+    if (command !== 'check' || !values.range)
+      throw new Error(
+        'usage: arch-gate.mjs check <worktree> --range <A>..<B> [--json] | status <worktree>',
+      );
+    const result = archCheck(root, values.range, config);
+    if (values.json) console.log(JSON.stringify(result, null, 2));
+    else if (!result.status.configured)
+      console.log(`arch — NO VERIFICADO — ${SETUP_HINT}`);
+    else {
+      for (const v of result.violations) console.log(findingLine(v));
+      for (const w of result.warnings) console.log(`(warning) ${w.why}`);
+      for (const note of result.notes) console.log(`(note) ${note}`);
+      if (!result.violations.length) console.log('arch: clean');
+    }
+    process.exit(
+      !result.status.configured ? 2 : result.violations.length ? 1 : 0,
+    );
+  } catch (error) {
+    console.error(`arch-gate: ${error.message}`);
+    process.exit(3);
+  }
+}

package/ring/scripts/brief-guard.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Hook on PreToolUse (Agent|Task). In a session registered in a bout, a wrestler or a cornerman is
+// Hook on PreToolUse (Agent|Task|SendMessage). In a session registered in a bout, a wrestler or a cornerman is
 // launched with a brief brief.mjs generated, never one written by hand. Zero-dependency.
 //
 // - The referee launches with `prompt: "ring-brief: <path>"`: the guard reads the file, checks its
@@ -8,7 +8,9 @@
 // - A prompt that is the brief itself is checked the same way and only gets the model and effort.
 // - A brief that does not hold: `briefGuard: "warn"` (the default) lets the launch through and tells
 //   the referee why; `"block"` refuses it with the command that generates one; `"off"` does nothing.
-// Every decision goes to `<bout dir>/brief-guard.jsonl`.
+// Every decision goes to `<bout dir>/brief-guard.jsonl`. A SendMessage to a wrestler that
+// `judges-card.mjs concept` retired is warned (or blocked) the same way: the next concept goes to a
+// fresh wrestler.
 //
 // Sessions that are not the bout's, agents that are not the ring's and the rudo are left alone.
 // It never fails a tool call by accident: any error of its own ends in exit 0 with no output.
@@ -94,9 +96,51 @@ export function answer({ input, brief, problem, mode, role, pr, launch }) {
   };
 }
 
+/**
+ * The answer to a SendMessage to a wrestler a concept close retired: it carries the old concept's
+ * context, and the next concept belongs to a fresh one. PURE.
+ */
+export function retiredAnswer({ to, retired, mode, pr }) {
+  if (!to || !(retired ?? []).includes(to)) return null;
+  const why = `wrestler ${to} closed its concept and was retired; the next concept goes to a fresh wrestler: brief.mjs wrestler ${pr} --mode resume --vars <file with nextConcept>`;
+  return mode === 'block'
+    ? {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: 'deny',
+          permissionDecisionReason: `brief-guard: ${why}.`,
+        },
+      }
+    : {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          additionalContext: `brief-guard (warn): ${why}.`,
+        },
+      };
+}
+
+function guardMessage(input) {
+  const bout = findBout({ cwd: input.cwd, hint: input.tool_input?.summary });
+  if (!bout || !sessionRegistered(bout, input.session_id)) return null;
+  const state = readState(bout);
+  const { config } = loadConfig(projectDir(process.env, input.cwd), {
+    contract: false,
+    venue: state.venue ?? 'backend',
+  });
+  const mode = config.briefGuard ?? 'warn';
+  if (mode === 'off') return null;
+  return retiredAnswer({
+    to: input.tool_input?.to,
+    retired: state.retiredWrestlers,
+    mode,
+    pr: state.pr,
+  });
+}
+
 /** The guard on one hook input; returns what to print (null for nothing). */
 export function guard(input) {
   if (input?.hook_event_name !== 'PreToolUse') return null;
+  if (input.tool_name === 'SendMessage') return guardMessage(input);
   if (!AGENT_TOOLS.includes(input.tool_name)) return null;
   const role = ROLE[classifyAgent(input.tool_input)];
   if (!role) return null;