arkgate 2.10.0 → 2.11.0

package/dist/{types-D6Q8WHes.d.cts → types-BZ17b9i5.d.cts}

@@ -941,7 +941,11 @@ interface WorkflowStep<P extends SagaContext = SagaContext> {
     onEvent?: IntentName;
     retry?: RetryPolicy;
     timeoutMs?: number;
-    execute: (payload: P, bus: EventBus) => MaybePromise<Partial<P> | void>;
+    /**
+     * Execute one step. The signal is aborted when `timeoutMs` elapses; implementations
+     * performing I/O must pass it to the underlying client for cooperative cancellation.
+     */
+    execute: (payload: P, bus: EventBus, signal: AbortSignal) => MaybePromise<Partial<P> | void>;
     compensate?: (payload: P, bus: EventBus, error?: unknown) => MaybePromise<void>;
 }
 interface WorkflowStartTrigger<P extends SagaContext = SagaContext> {

package/dist/{types-D6Q8WHes.d.ts → types-BZ17b9i5.d.ts}

@@ -941,7 +941,11 @@ interface WorkflowStep<P extends SagaContext = SagaContext> {
     onEvent?: IntentName;
     retry?: RetryPolicy;
     timeoutMs?: number;
-    execute: (payload: P, bus: EventBus) => MaybePromise<Partial<P> | void>;
+    /**
+     * Execute one step. The signal is aborted when `timeoutMs` elapses; implementations
+     * performing I/O must pass it to the underlying client for cooperative cancellation.
+     */
+    execute: (payload: P, bus: EventBus, signal: AbortSignal) => MaybePromise<Partial<P> | void>;
     compensate?: (payload: P, bus: EventBus, error?: unknown) => MaybePromise<void>;
 }
 interface WorkflowStartTrigger<P extends SagaContext = SagaContext> {

package/docs/agent-guide.md

@@ -176,7 +176,7 @@ reference, and explanation for the full path (recommend → init → gallery →
 3. Run `ark init --archetype <id> --yes`, `--apply-policy-pack enthusiast-<preset>`, or `ark init --preset <preset> --yes` when no `ark.config.json` exists.
 4. Optional: `--write-plan` for `ark-adoption-plan.json`; copy a gallery starter from `examples/README.md`.
 5. Use `/ark-place` or `ark_place` for individual files after the contract exists.
-6. Verify with `ark-check --root . --config ark.config.json --strict-config`.
+6. Verify with `ark-check --root . --config ark.config.json --strict`.
 
 ### Write protocol (2.10+ / Track W)
 

package/docs/ai-gates.md

@@ -153,7 +153,7 @@ Layers:
   - PersistenceAdapters: src/adapters/persistence/**
 Rules: 10 denied layer edge(s). Full contract: ark://manifest MCP resource.
 Baseline: 3 frozen violation(s) — only NEW violations fail; do not add to them.
-After edits run: npx ark-check --root . --config ark.config.json --strict-config
+After edits run: npx ark-check --root . --config ark.config.json --strict
 ```
 
 The hook belongs in the **project's** `.claude/settings.json` (that's what
@@ -390,9 +390,27 @@ Prefer keeping editor + CI on the same `ark.config.json` — do not maintain a p
 Whatever the agent side does, gate the merge:
 
 ```yaml
-- run: npx ark-check --root . --config ark.config.json --strict-config
+- run: npx ark-check --root . --config ark.config.json --strict
 ```
 
+The `--strict` profile also requires the generated CI/write gates and fails on safety
+diagnostics. Configure reviewed exceptions explicitly:
+
+```json
+{
+  "dynamicImportAllowlist": ["src/plugins/loader.ts"],
+  "safety": {
+    "maxTsSuppressions": 0,
+    "maxAnyCasts": 0,
+    "allowInMemory": false,
+    "allowDisabledPeerIsolation": false
+  }
+}
+```
+
+`ark-check --doctor --json` reports counts under `doctor.safety`. An `any` cast is
+reported as lost static assurance; it does not imply that a runtime schema was bypassed.
+
 Adopting Ark on an existing codebase with violations? Freeze them once and ratchet down:
 
 ```bash

package/docs/package-surface.md

@@ -16,10 +16,10 @@ This document is the consumer contract for **what is stable** vs **what is opt-i
 |---------|----------------|-----------------|
 | **CLI** | `arkgate` / `arkgate-check` (aliases `ark` / `ark-check`) | Flags and human text may improve; **JSON output shapes** for `--json` (check, doctor, plan, coverage, recommend) are stable within a major. Additive fields OK; removals/renames are major. |
 | **MCP tools** | `arkgate-mcp` / `ark://…` resources | Tool names and primary argument shapes are stable within a major. |
-| **`ark.config.json`** | Layer globs, rules, include/exclude, forbiddenGlobals, intent prefixes | Schema fields documented in playbooks/examples are stable; new optional fields may appear. |
+| **`ark.config.json`** | Layer globs, rules, include/exclude, forbiddenGlobals, intent prefixes, `peerIsolation`, `dynamicImportAllowlist`, `safety` thresholds | Schema fields documented in playbooks/examples are stable; new optional fields may appear. |
 | **Agent skills** | `/ark-*` templates installed by `--install-agent-gates` | Skill *names* and “default flow” are stable; internal skill prose may evolve. |
 | **ESLint subpath** | `arkgate/eslint` | Config-driven layer/import rules; loads consumer `ark.config.json`. |
-| **GitHub Action** | `pedroknigge/arkgate` (see `action.yml`) | Inputs for running the check stay stable within a major. |
+| **GitHub Action** | `pedroknigge/arkgate` (see `action.yml`) | The `uses:` tag/SHA selects the checker source; `version` remains an optional exact npm compatibility override. |
 
 Gates need **no application code imports**. Most projects only use the CLI + MCP + config.
 

package/docs/production-hardening.md

@@ -37,6 +37,11 @@ When implementing Ark store interfaces in production, cover these guarantees exp
 - Observability: failed writes and dispatches are visible to operators.
 - Migration: schema changes for stored records are versioned.
 
+Workflow `timeoutMs` uses cooperative cancellation: ArkGate aborts the `AbortSignal`
+passed as the third `execute` argument, but JavaScript cannot stop an operation that
+ignores that signal. Production steps must pass it to network/database clients and keep
+external effects idempotent; otherwise work may finish after the workflow was marked failed.
+
 ## Interface Targets
 
 | Concern | Interface |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkgate",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "ArkGate — architecture co-pilot for AI TypeScript (write gate, CI gate, plan/loop)",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -66,9 +66,11 @@
     "dev": "tsup --watch",
     "test": "vitest",
     "test:run": "vitest run",
+    "test:coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
     "typecheck": "tsc --noEmit",
     "security:audit": "npm audit --omit=dev --audit-level=high",
-    "check:architecture": "node bin/ark-check.mjs --root . --config ark.config.json --strict-config",
+    "check:architecture": "node bin/ark-check.mjs --root . --config ark.config.json --strict",
+    "check:js": "node scripts/check-js-syntax.mjs",
     "generate:layer-match": "node scripts/generate-layer-match.mjs",
     "check:layer-match": "node scripts/generate-layer-match.mjs --check",
     "generate:cli-pure": "node scripts/generate-cli-pure.mjs",
@@ -111,6 +113,7 @@
   "devDependencies": {
     "@nestjs/common": "^11.1.27",
     "@types/node": "^20.14.0",
+    "@vitest/coverage-v8": "^3.2.6",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "tsup": "^8.1.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/pedroknigge/arkgate",
     "source": "github"
   },
-  "version": "2.10.0",
+  "version": "2.11.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "arkgate",
-      "version": "2.10.0",
+      "version": "2.11.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"