arkgate 2.10.0 → 2.11.0

package/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to ArkGate (`arkgate`; formerly `ark-runtime-kernel`) are do
 
 ## Unreleased
 
+## 2.11.0 — 2026-07-10
+
+Fail-closed enforcement hardening: `--strict` now combines contract coverage, installed-gate
+checks, write-hook presence, and bypass diagnostics in one CI profile. The GitHub Action runs
+the exact checked-out revision by default, and runtime workflows cancel timed-out work
+cooperatively.
+
+### Added
+
+- **Strict CI profile:** `arkgate-check --strict` enables strict config validation, requires
+  generated gates plus a PreToolUse write hook, and fails on configured safety diagnostics.
+- **Bypass diagnostics:** new `dynamicImportAllowlist` and `safety` config fields detect
+  non-literal dynamic imports, TypeScript suppression directives, explicit `any` casts,
+  production InMemory defaults, and disabled or omitted peer isolation. `--doctor --json`
+  exposes the same evidence under `doctor.safety`.
+- **Release-quality CI:** JavaScript syntax validation, enforced coverage thresholds, and a
+  Node 18/20/22/24 compatibility matrix now run before merge.
+
+### Changed
+
+- **Pinned GitHub Action execution:** `uses: pedroknigge/arkgate@<tag-or-SHA>` now runs that
+  checked-out ArkGate source. The `version` input remains available only as an explicit exact
+  npm compatibility override.
+- **Complete MCP contract:** `ark://manifest` exposes every configured file layer separately
+  from runtime intent layers, plus reviewed dynamic-import and safety policy.
+- **Workflow cancellation contract:** workflow steps receive an `AbortSignal` as their third
+  argument. `timeoutMs` aborts that signal, clears the active step, and rejects duplicate step
+  names before execution can corrupt compensation order.
+- **Filesystem confinement:** source scans follow internal symlinks once and reject symlinks
+  that escape the project root.
+
+### Fixed
+
+- **Baseline duplicate honesty:** repeated violations now receive stable per-occurrence keys,
+  so adding a second identical violation is new debt instead of being hidden by one baseline
+  entry.
+- **Write-hook duplicate honesty:** proposed writes compare violation counts, preventing a new
+  duplicate from being mistaken for an already-existing violation.
+- **CLI argument safety:** unknown flags and missing flag values fail with usage guidance
+  instead of silently weakening enforcement or throwing an internal error.
+- **Action gate detection:** repositories using the ArkGate composite Action satisfy the CI
+  gate check without needing a separate literal `ark-check` command.
+
 ## 2.10.0 — 2026-07-10
 
 Track W — **Constrained write → verified repair**: write-boundary autoPatch, prepare_write,

package/README.md

@@ -190,6 +190,9 @@ ark.config.json
 - **Brownfield:** baseline ratchet, refuse to freeze a wrong contract, `/ark-adopt` for mature trees.
 - **Agents:** skills install into Claude / Cursor / Codex / Grok; `ark start` freezes an origin report under `.ark/reports/`.
 - **Write protocol (2.10 / Track W):** mechanical-safe **autoPatch** on the write gate (`import type`); MCP **`ark_prepare_write`** (place + validate + patch + judgmentBrief); opt-in hook **`--hook-repair`** (`ARK_REPAIR_JSON`); doctor **`writePath`** (repair vs reject-only); loop-cost eval (`npm run eval:loop-cost`). Port-proof inject is **judgment** (arity change), not silent auto-apply.
+- **Fail-closed CI (2.11):** `--strict` combines config coverage, required CI/MCP/write gates,
+  PreToolUse hook presence, and bypass diagnostics for dynamic imports, TypeScript suppressions,
+  explicit `any` casts, InMemory runtime defaults, and disabled peer isolation.
 - **TypeScript:** project compilers 5.x / 6.x / 7.x — gate falls back to a nested JS-API TypeScript when TS 7’s main export is version-only ([docs/typescript-support.md](docs/typescript-support.md)).
 
 ### Why not only ESLint / dependency-cruiser / Nx?
@@ -214,6 +217,7 @@ ark.config.json
 npx arkgate start                         # guided setup + plan + origin report
 npx arkgate-check --doctor                # health + Adoption gaps (not just fitness)
 npx arkgate-check --doctor --json         # machine-readable doctor.adoption
+npx arkgate-check --strict                # fail-closed CI + installed-gate/safety checks
 npx arkgate-check --plan                  # safe-to-auto-fix vs your call
 npx arkgate-check --coverage              # Governed: N%
 npx arkgate-check --report ark-report.html  # showcase HTML + Adoption card + origin/latest
@@ -224,8 +228,8 @@ npx arkgate upgrade                       # package + gates/skills + MCP/Codex n
 CI (example):
 
 ```yaml
-- run: npx arkgate-check --root . --config ark.config.json --strict-config
-# or: uses: pedroknigge/arkgate@main
+- run: npx arkgate-check --root . --config ark.config.json --strict
+# or: uses: pedroknigge/arkgate@<tag-or-SHA>  # runs that checked-out revision
 ```
 
 ---

package/SECURITY.md

@@ -28,10 +28,9 @@ a private security contact without including exploit details.
 ArkGate releases are GitHub-first:
 
 1. Changes land on GitHub and must pass CI plus the dedicated security workflow.
-2. A GitHub Release is created from an annotated `vX.Y.Z` tag. Tag verification is
-   **fail-closed** by default for unsigned tags unless
-   `ARK_ALLOW_UNSIGNED_RELEASE_TAG=true` is set (CI publish sets this until GPG signing is
-   wired). Signed tags can later require `ARK_REQUIRE_SIGNED_RELEASE_TAG=true`.
+2. A GitHub Release is created from a signed `vX.Y.Z` tag (`git tag -s`). The publish
+   workflow verifies the signature and fails closed for unsigned tags. The local override
+   exists only for explicit emergency use and is not enabled in CI.
 3. The manual `Publish npm` workflow verifies the tag, requires the GitHub Release to
    exist, reruns release checks, publishes npm with provenance, and uploads a SHA-256
    checksum for the npm tarball to the GitHub Release.

package/bin/ark-check.mjs

@@ -43,6 +43,7 @@ import {
   arkPackageVersion,
   REQUIRED_GATE_FILES,
   codexPromptsDir,
+  detectWritePathCapabilities,
 } from './lib/agent-gates.mjs';
 import { syncBaselineIntoCheckSurfaces } from './lib/field-install.mjs';
 import {
@@ -64,6 +65,7 @@ import {
 import { runRatchetCores } from './lib/core-ratchet.mjs';
 import {
   baselineKey,
+  baselineOccurrenceKeys,
   readBaseline,
   summarizeViolations,
   writeBaseline,
@@ -99,6 +101,7 @@ function parseArgs(argv) {
     printConfig: undefined,
     tsconfig: undefined,
     json: false,
+    strict: false,
     strictConfig: false,
     requireGates: false,
     init: false,
@@ -122,13 +125,25 @@ function parseArgs(argv) {
     version: false,
     help: false,
   };
+  const requireValue = (flag, index) => {
+    const value = argv[index + 1];
+    if (value === undefined || value.startsWith('-')) {
+      throw new Error(`Missing value for ${flag}. Run ark-check --help for usage.`);
+    }
+    return value;
+  };
   for (let i = 2; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === '--json') args.json = true;
+    else if (arg === '--strict') {
+      args.strict = true;
+      args.strictConfig = true;
+      args.requireGates = true;
+    }
     else if (arg === '--strict-config') args.strictConfig = true;
     else if (arg === '--require-gates') args.requireGates = true;
     else if (arg === '--init') args.init = true;
-    else if (arg === '--preset') args.preset = argv[++i];
+    else if (arg === '--preset') args.preset = requireValue(arg, i++);
     else if (arg === '--install-agent-gates') args.installAgentGates = true;
     else if (arg === '--tools') {
       // Consume the next arg only when it isn't another flag (same rule as --baseline),
@@ -152,7 +167,7 @@ function parseArgs(argv) {
     else if (arg === '--recommend') args.recommend = true;
     else if (arg === '--write-plan') args.writePlan = true;
     else if (arg === '--list-policy-packs') args.listPolicyPacks = true;
-    else if (arg === '--apply-policy-pack') args.applyPolicyPack = argv[++i];
+    else if (arg === '--apply-policy-pack') args.applyPolicyPack = requireValue(arg, i++);
     else if (arg === '--suggest-include') args.suggestInclude = true;
     else if (arg === '--adopt-contract') args.adoptContract = true;
     else if (arg === '--ratchet-cores') args.ratchetCores = true;
@@ -174,13 +189,14 @@ function parseArgs(argv) {
       const next = argv[i + 1];
       args.baseline = next && !next.startsWith('-') ? argv[++i] : '.ark-baseline.json';
     }
-    else if (arg === '--root') args.root = path.resolve(argv[++i]);
-    else if (arg === '--config') args.config = argv[++i];
-    else if (arg === '--manifest') args.manifest = argv[++i];
-    else if (arg === '--print-config') args.printConfig = argv[++i];
-    else if (arg === '--tsconfig') args.tsconfig = argv[++i];
+    else if (arg === '--root') args.root = path.resolve(requireValue(arg, i++));
+    else if (arg === '--config') args.config = requireValue(arg, i++);
+    else if (arg === '--manifest') args.manifest = requireValue(arg, i++);
+    else if (arg === '--print-config') args.printConfig = requireValue(arg, i++);
+    else if (arg === '--tsconfig') args.tsconfig = requireValue(arg, i++);
     else if (arg === '--help' || arg === '-h') args.help = true;
     else if (arg === '--version' || arg === '-V') args.version = true;
+    else throw new Error(`Unknown argument: ${arg}. Run ark-check --help for usage.`);
   }
   return args;
 }
@@ -198,7 +214,7 @@ function usage() {
   return [
     'Usage: arkgate-check | ark-check  (identical bins; product name ArkGate)',
     '       ark-check --version',
-    '       ark-check --root <project> --config <ark.config.json> [--manifest <ark.manifest.json>] [--tsconfig <tsconfig.json>] [--strict-config] [--require-gates] [--json] [--baseline [file]] [--report [file.html]] [--no-cache]',
+    '       ark-check --root <project> --config <ark.config.json> [--manifest <ark.manifest.json>] [--tsconfig <tsconfig.json>] [--strict | --strict-config] [--require-gates] [--json] [--baseline [file]] [--report [file.html]] [--no-cache]',
     '       ark-check --coverage [--json]          per-layer file counts + full unclassified list (report only, exit 0)',
     '       ark-check --plan [--json]              classified remediation plan (mechanical-safe / judgment / deferred) + goal; report only',
     '       ark-check --recommend [--json] [--write-plan]  application-shape plan; --write-plan emits ark-adoption-plan.json',
@@ -251,6 +267,8 @@ function usage() {
     '',
     'Config warnings are advisory by default and are included in JSON output.',
     'Use --strict-config to make config warnings fail the check.',
+    'Use --strict for the fail-closed CI profile: --strict-config + --require-gates',
+    'plus the security diagnostics surfaced by doctor.',
     '',
     '--require-gates fails the check when AGENTS.md, .mcp.json, or the generated CI',
     'workflow is missing, so "installed but never configured" is a red CI. Combine it',
@@ -301,6 +319,10 @@ function readConfig(root, configPath) {
     ...(raw.exclude ? { exclude: raw.exclude } : {}),
     ...(raw.excludeGenerated !== undefined ? { excludeGenerated: raw.excludeGenerated } : {}),
     ...(raw.cyclePolicy ? { cyclePolicy: raw.cyclePolicy } : {}),
+    ...(raw.dynamicImportAllowlist
+      ? { dynamicImportAllowlist: raw.dynamicImportAllowlist }
+      : {}),
+    ...(raw.safety ? { safety: raw.safety } : {}),
   };
 }
 
@@ -316,7 +338,7 @@ function detectConfig(root) {
 
   for (const entry of DEFAULT_INTENT_PREFIXES) {
     const directories = (DEFAULT_LAYER_DIRECTORIES[entry.layer] ?? []).filter(
-      (directory) => walk(path.join(root, srcDir, directory)).length > 0
+      (directory) => walk(path.join(root, srcDir, directory), [], { root }).length > 0
     );
     if (directories.length === 0) continue;
     layers.push({
@@ -784,7 +806,7 @@ function runInit(args) {
     }
     // The starter profile only governs src/. Existing source elsewhere would make the
     // gate silently green, so surface it instead of pretending the project is covered.
-    const outside = walk(args.root)
+    const outside = walk(args.root, [], { root: args.root })
       .map((file) => normalize(path.relative(args.root, file)))
       .filter((rel) => !rel.startsWith('src/') && !rel.split('/').some((s) => s.startsWith('.')));
     if (outside.length > 0) {
@@ -956,6 +978,9 @@ async function main() {
 
   if (args.requireGates) {
     const missing = missingGates(args.root);
+    if (args.strict && !detectWritePathCapabilities(args.root).hookPresent) {
+      missing.push('PreToolUse write hook');
+    }
     if (missing.length > 0) {
       const payload = {
         ok: false,
@@ -1032,7 +1057,7 @@ async function main() {
     );
   }
 
-  const { violations, warnings } = runArchitectureScan({
+  const { violations, warnings, safety } = runArchitectureScan({
     root,
     config,
     manifest,
@@ -1046,6 +1071,7 @@ async function main() {
     runDoctor(root, config, files, rules, violations, args.json, {
       configPath: path.isAbsolute(args.config) ? args.config : path.join(root, args.config),
       configMissing: !fs.existsSync(path.isAbsolute(args.config) ? args.config : path.join(root, args.config)),
+      safety,
     });
     return;
   }
@@ -1118,11 +1144,10 @@ async function main() {
   if (args.baseline) {
     const baseline = readBaseline(root, args.baseline);
     if (baseline.exists) {
-      suppressed = violations.filter((violation) => baseline.keys.has(baselineKey(violation)));
-      activeViolations = violations.filter(
-        (violation) => !baseline.keys.has(baselineKey(violation))
-      );
-      const currentKeys = new Set(violations.map(baselineKey));
+      const occurrenceKeys = baselineOccurrenceKeys(violations);
+      suppressed = violations.filter((_, index) => baseline.keys.has(occurrenceKeys[index]));
+      activeViolations = violations.filter((_, index) => !baseline.keys.has(occurrenceKeys[index]));
+      const currentKeys = new Set(occurrenceKeys);
       staleBaselineKeys = [...baseline.keys].filter((key) => !currentKeys.has(key)).length;
     } else {
       warnings.push(

package/bin/ark-mcp.mjs

@@ -48,6 +48,7 @@ import {
   DEFAULT_LAYER_DIRECTORIES,
   DEFAULT_RULES,
   arkCommand,
+  globToRegExp,
   layerForFile,
   shouldShowNewHereNudge,
   detectWorkspaces,
@@ -273,18 +274,23 @@ function runHook(gate, config, args, ts) {
   // line numbers (edits shift them); simpler than full baselineKey (no file/layer fields
   // needed — this file is fixed).
   const violationKey = (violation) => `${violation.ruleId}|${violation.target ?? violation.message}`;
-  let existingKeys = new Set();
+  let existingCounts = new Map();
   try {
     const current = fs.readFileSync(filePath, 'utf8');
-    existingKeys = new Set(
-      gate.validate(current, { layer, filePath }).violations.map(violationKey)
-    );
+    for (const violation of gate.validate(current, { layer, filePath }).violations) {
+      const key = violationKey(violation);
+      existingCounts.set(key, (existingCounts.get(key) ?? 0) + 1);
+    }
   } catch {
     // New file: nothing pre-exists, every violation is new.
   }
-  const newViolations = (result.violations ?? []).filter(
-    (violation) => !existingKeys.has(violationKey(violation))
-  );
+  const newViolations = (result.violations ?? []).filter((violation) => {
+    const key = violationKey(violation);
+    const remaining = existingCounts.get(key) ?? 0;
+    if (remaining === 0) return true;
+    existingCounts.set(key, remaining - 1);
+    return false;
+  });
   if (newViolations.length === 0) return;
 
   const lines = newViolations.map(
@@ -368,8 +374,14 @@ function runArkCheckJsonFromRoot(root, config, extraArgs, manifest) {
   const result = spawnSync(
     process.execPath,
     [arkCheckBin, '--root', root, '--config', config, ...manifestArgs, '--json', ...extraArgs],
-    { encoding: 'utf8' }
+    { encoding: 'utf8', timeout: 120_000, maxBuffer: 20 * 1024 * 1024 }
   );
+  if (result.error) {
+    return {
+      data: null,
+      raw: `ark-check failed to execute: ${result.error.message}`,
+    };
+  }
   const stdout = result.stdout ?? '';
   try {
     return { data: JSON.parse(stdout), raw: stdout };
@@ -544,6 +556,18 @@ async function main() {
       name: layer.name,
       patterns: layer.patterns,
     })),
+    allowNonLiteralDynamicImport: (filePath) => {
+      if (!filePath || !Array.isArray(config.dynamicImportAllowlist)) return false;
+      const rel = path.relative(args.root, path.resolve(args.root, filePath)).split(path.sep).join('/');
+      return config.dynamicImportAllowlist.some((pattern) => {
+        if (typeof pattern !== 'string') return false;
+        try {
+          return globToRegExp(pattern).test(rel);
+        } catch {
+          return false;
+        }
+      });
+    },
   });
 
   if (args.hook) {
@@ -706,7 +730,10 @@ async function main() {
   // DomainModel there would tell the agent to create a second layer for the same
   // prefix, making longest-prefix resolution ambiguous.
   function suggestedLayers() {
-    const activeNames = new Set(profile.layers.map((layer) => layer.name));
+    const activeNames = new Set([
+      ...configLayers.map((layer) => layer.name),
+      ...profile.layers.map((layer) => layer.name),
+    ]);
     const claimedPrefixes = new Set(
       profile.layers.flatMap((layer) =>
         (layer.prefixes ?? []).map((p) => (p.endsWith('.') ? p : `${p}.`))
@@ -732,13 +759,30 @@ async function main() {
       );
     }
     const suggestions = suggestedLayers();
+    const contractLayers = usedProjectConfig
+      ? configLayers.map((layer) => ({
+          ...layer,
+          prefixes: Array.isArray(layer.intentPrefixes) ? layer.intentPrefixes : [],
+        }))
+      : profile.layers;
     return JSON.stringify(
       {
         source: profile === ark.elevenLayerProfile ? 'strictDefaultElevenLayerProfile' : 'project',
         name: profile.name,
-        layers: profile.layers,
+        // File placement contract: every configured layer, including layers that do not
+        // own intent prefixes (e.g. Tooling / FrameworkAdapters).
+        layers: contractLayers,
+        // Runtime/intent resolution profile kept explicit so consumers never have to infer
+        // why a prefix-less file layer is absent from intent resolution.
+        intentLayers: profile.layers,
         rules: profile.rules,
         ...(Object.keys(forbiddenGlobals).length > 0 ? { forbiddenGlobals } : {}),
+        ...(Array.isArray(config.dynamicImportAllowlist)
+          ? { dynamicImportAllowlist: config.dynamicImportAllowlist }
+          : {}),
+        ...(config.safety && typeof config.safety === 'object'
+          ? { safety: config.safety }
+          : {}),
         ...(suggestions.length > 0
           ? {
               suggestedLayers: suggestions,

package/bin/ark.mjs

@@ -32,22 +32,33 @@ function parseArgs(argv) {
     strict: true,
     install: true,
     help: false,
+    version: false,
+  };
+
+  const requireValue = (flag, index) => {
+    const value = argv[index + 1];
+    if (value === undefined || value.startsWith('-')) {
+      throw new Error(`Missing value for ${flag}. Run ark --help for usage.`);
+    }
+    return value;
   };
 
   // Scan from the first user token (index 2) so a leading flag like `ark --help` is
   // recognized: the command is the first NON-dash argument, not blindly argv[2].
   for (let i = 2; i < argv.length; i += 1) {
     const arg = argv[i];
-    if (arg === '--root') args.root = path.resolve(argv[++i]);
+    if (arg === '--root') args.root = path.resolve(requireValue(arg, i++));
     else if (arg === '--yes' || arg === '-y') args.yes = true;
     else if (arg === '--force') args.force = true;
     else if (arg === '--no-strict') args.strict = false;
     else if (arg === '--no-install') args.install = false;
-    else if (arg === '--preset') args.preset = argv[++i];
-    else if (arg === '--archetype') args.archetype = argv[++i];
-    else if (arg === '--tools') args.tools = argv[++i];
+    else if (arg === '--preset') args.preset = requireValue(arg, i++);
+    else if (arg === '--archetype') args.archetype = requireValue(arg, i++);
+    else if (arg === '--tools') args.tools = requireValue(arg, i++);
     else if (arg === '--help' || arg === '-h' || arg === 'help') args.help = true;
+    else if (arg === '--version' || arg === '-V') args.version = true;
     else if (!arg.startsWith('-') && args.command === undefined) args.command = arg;
+    else throw new Error(`Unknown argument: ${arg}. Run ark --help for usage.`);
   }
 
   return args;
@@ -88,6 +99,15 @@ Non-interactive (no TTY): uses the same defaults as --yes — never calls readli
 `;
 }
 
+function cliVersion() {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(here, '..', 'package.json'), 'utf8'));
+    return typeof pkg.version === 'string' ? pkg.version : 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
 // The package-manager command that adds arkgate as a dev dependency.
 // Prefer an explicit version/range when pin already chose one (avoid pin=^2.9.0 then
 // `npm i arkgate@latest` rewriting package.json to a different range).
@@ -627,7 +647,17 @@ async function start(args) {
 }
 
 async function main() {
-  const args = parseArgs(process.argv);
+  let args;
+  try {
+    args = parseArgs(process.argv);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 2;
+  }
+  if (args.version) {
+    console.log(cliVersion());
+    return 0;
+  }
   if (args.help || !args.command) {
     console.log(usage());
     return 0;

package/bin/lib/agent-gates.mjs

@@ -22,7 +22,7 @@ import {
   createElevenLayerConfig,
   applyFrameworkLayoutOverlays,
 } from '../ark-shared.mjs';
-import { CORE_LAYER_NAMES } from './core-ratchet.mjs';
+import { CORE_LAYER_NAMES } from './core-layers.mjs';
 import { falseGreenAdoptionGap } from './field-install.mjs';
 import {
   assessCodexHomeMcp,
@@ -184,7 +184,11 @@ export function hasArkWorkflow(root) {
     .some((file) => {
       try {
         const content = fs.readFileSync(path.join(workflowsDir, file), 'utf8');
-        return /\bark-check\b/.test(content) || /\bcheck:architecture\b/.test(content);
+        return (
+          /\bark-check\b/.test(content) ||
+          /\bcheck:architecture\b/.test(content) ||
+          /\buses\s*:\s*['"]?[^'"\s#]+\/arkgate@/i.test(content)
+        );
       } catch {
         return false;
       }
@@ -362,8 +366,8 @@ export function checkArgsForRoot(root, { requireGates = false } = {}) {
   const baselineFlag = fs.existsSync(path.join(root, '.ark-baseline.json'))
     ? ' --baseline .ark-baseline.json'
     : '';
-  const gatesFlag = requireGates ? ' --require-gates' : '';
-  return `--root . --config ark.config.json --strict-config${baselineFlag}${gatesFlag}`;
+  const profile = requireGates ? '--strict' : '--strict-config';
+  return `--root . --config ark.config.json ${profile}${baselineFlag}`;
 }
 
 // Field-install helpers live in field-install.mjs (keep agent-gates scannable).
@@ -2122,4 +2126,4 @@ export function runInstallAgentGates(args) {
     }
   }
   warnLockfileConflict(root);
-}
+}

package/bin/lib/architecture-scan.mjs

@@ -34,6 +34,7 @@ import {
 } from './config-warnings.mjs';
 import { detectCycles } from './graph-cycles.mjs';
 import { normalize } from './scan-files.mjs';
+import { collectSafetyDiagnostics } from './safety-diagnostics.mjs';
 import {
   createCompilerOptionsLookup,
   createModuleResolutionHost,
@@ -187,6 +188,8 @@ export function runArchitectureScan({ root, config, manifest, rules, files, ts,
 
   const violations = [];
   const warnings = collectConfigWarnings(root, config, files, rules, manifest);
+  const safety = collectSafetyDiagnostics(ts, root, config, files);
+  warnings.push(...safety.warnings);
   const cacheKey = args.noCache ? undefined : scanCacheKey(root, args);
   const cachedFiles = cacheKey ? loadScanCache(root, cacheKey) : undefined;
   const nextCacheFiles = {};
@@ -326,5 +329,5 @@ export function runArchitectureScan({ root, config, manifest, rules, files, ts,
     }
   }
 
-  return { violations, warnings };
+  return { violations, warnings, safety: safety.report };
 }

package/bin/lib/baseline-key.mjs

@@ -21,3 +21,20 @@ export function baselineKey(violation) {
         violation.target ?? '',
     ].join('|');
 }
+/**
+ * Stable per-occurrence keys for a list of violations.
+ *
+ * The first occurrence keeps the historical v1 key so existing baselines remain
+ * compatible. Repeated violations with the same identity gain a `#N` suffix;
+ * adding a second identical violation is therefore new debt instead of being
+ * silently suppressed by the first occurrence's key.
+ */
+export function baselineOccurrenceKeys(violations) {
+    const counts = new Map();
+    return violations.map((violation) => {
+        const base = baselineKey(violation);
+        const occurrence = (counts.get(base) ?? 0) + 1;
+        counts.set(base, occurrence);
+        return occurrence === 1 ? base : `${base}#${occurrence}`;
+    });
+}

package/bin/lib/config-warnings.mjs

@@ -55,6 +55,28 @@ export function configWarning(ruleId, message, extra = {}) {
 
 export function collectConfigWarnings(root, config, files, rules, manifest) {
   const warnings = [];
+  if (
+    config.dynamicImportAllowlist !== undefined &&
+    (!Array.isArray(config.dynamicImportAllowlist) ||
+      config.dynamicImportAllowlist.some((entry) => typeof entry !== 'string'))
+  ) {
+    warnings.push(
+      configWarning(
+        'CONFIG_INVALID_DYNAMIC_IMPORT_ALLOWLIST',
+        'dynamicImportAllowlist must be an array of file globs.'
+      )
+    );
+  }
+  if (config.safety !== undefined && (config.safety === null || typeof config.safety !== 'object' || Array.isArray(config.safety))) {
+    warnings.push(configWarning('CONFIG_INVALID_SAFETY', 'safety must be an object.'));
+  } else if (config.safety) {
+    for (const key of ['maxTsSuppressions', 'maxAnyCasts']) {
+      const value = config.safety[key];
+      if (value !== undefined && (!Number.isInteger(value) || value < 0)) {
+        warnings.push(configWarning('CONFIG_INVALID_SAFETY_THRESHOLD', `safety.${key} must be a non-negative integer.`));
+      }
+    }
+  }
   const layers = Array.isArray(config.layers) ? config.layers : [];
   const manifestLayers = Array.isArray(manifest?.architecture?.layers)
     ? manifest.architecture.layers

package/bin/lib/core-layers.mjs

@@ -0,0 +1,7 @@
+/** Core layers whose optionality matters once they match files. */
+export const CORE_LAYER_NAMES = new Set([
+  'DomainModel',
+  'ApplicationOrchestration',
+  'PresentationAdapters',
+  'PersistenceAdapters',
+]);

package/bin/lib/core-ratchet.mjs

@@ -6,18 +6,14 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { arkCommand } from '../ark-shared.mjs';
 import { computeCoverage } from './doctor-plan.mjs';
+import { CORE_LAYER_NAMES } from './core-layers.mjs';
+
+export { CORE_LAYER_NAMES } from './core-layers.mjs';
 
 /**
  * Core layers whose optionality matters once they match files (presets share these names).
  * Used by doctor adoption gaps and `--ratchet-cores`.
  */
-export const CORE_LAYER_NAMES = new Set([
-  'DomainModel',
-  'ApplicationOrchestration',
-  'PresentationAdapters',
-  'PersistenceAdapters',
-]);
-
 /**
  * Plan a ratchet of optional→required for core layers that already match files.
  * Empty cores stay optional (avoids false ENFORCE theatre). Pure — does not write disk.

package/bin/lib/doctor-plan.mjs

@@ -19,7 +19,7 @@ import {
   staleRunnerGateFiles,
 } from './agent-gates.mjs';
 import {
-  baselineKey,
+  baselineOccurrenceKeys,
   readBaseline,
   summarizeViolations,
   violationEdge,
@@ -272,9 +272,10 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
   // Prefer writePath from adoption (same detector); recompute only if missing (tests/stubs).
   const writePath = adoption.writePath ?? detectWritePathCapabilities(root);
   const baseline = readBaseline(root, '.ark-baseline.json');
-  const currentKeys = new Set(violations.map(baselineKey));
+  const occurrenceKeys = baselineOccurrenceKeys(violations);
+  const currentKeys = new Set(occurrenceKeys);
   const suppressed = baseline.exists
-    ? violations.filter((v) => baseline.keys.has(baselineKey(v))).length
+    ? occurrenceKeys.filter((key) => baseline.keys.has(key)).length
     : 0;
   const staleBaseline = baseline.exists
     ? [...baseline.keys].filter((key) => !currentKeys.has(key)).length
@@ -347,6 +348,7 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
                 : { gap: null }),
             },
             adoption,
+            safety: options.safety,
             newHere: showNewHere
               ? {
                   show: true,
@@ -592,11 +594,33 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
     line(ok, 'Origin architecture snapshot present (.ark/reports/origin.json)');
   }
 
+  console.log('');
+  console.log(color.bold('Safety / bypass resistance'));
+  const safety = options.safety;
+  if (!safety) {
+    line(warn, 'Safety diagnostics unavailable');
+  } else {
+    const rows = [
+      ['Non-literal dynamic imports', safety.nonLiteralDynamicImports],
+      ['@ts-ignore / @ts-nocheck', safety.tsSuppressions],
+      ['Explicit any casts', safety.anyCasts],
+      ['InMemory stores in production source', safety.inMemoryProductionStores],
+      ['Rules with peerIsolation: false', safety.disabledPeerIsolationRules],
+    ];
+    for (const [label, entries] of rows) {
+      line(entries.length === 0 ? ok : warn, `${label}: ${entries.length}`);
+    }
+    if (rows.some(([, entries]) => entries.length > 0)) {
+      actions.push('resolve strict safety diagnostics before treating CI as enforcement');
+    }
+  }
+
   console.log('');
   if (actions.length === 0) {
     console.log(color.green('✔ Healthy — nothing to do.'));
   } else {
-    console.log(color.bold(`Top actions (${actions.length}):`));
-    actions.forEach((action, index) => console.log(`  ${index + 1}. ${action}`));
+    const uniqueActions = [...new Set(actions.filter(Boolean))];
+    console.log(color.bold(`Top actions (${uniqueActions.length}):`));
+    uniqueActions.forEach((action, index) => console.log(`  ${index + 1}. ${action}`));
   }
 }