arkgate 3.0.3 → 3.0.5

package/bin/lib/skill-install.mjs

@@ -3,7 +3,8 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { codexPromptsDir } from './codex-home.mjs';
+import { arkCommand } from '../ark-shared.mjs';
+import { codexPromptsDir, codexSkillsDir } from './codex-home.mjs';
 import { __packageRoot, isCompactRouterAgentsContent, readJson } from './gate-files.mjs';
 
 export function normalizeToolsList(tools) {
@@ -43,10 +44,11 @@ export function detectActiveAgentHost(env = process.env) {
     .toLowerCase();
   if (explicit) return explicit;
 
-  // Grok / xAI Build
+  // Grok / xAI Build (include GROK_AGENT — common session signal missing in older detect)
   if (
     envTruthy(env.GROK_BUILD) ||
     envTruthy(env.XAI_GROK) ||
+    envTruthy(env.GROK_AGENT) ||
     env.GROK_WORKSPACE_ROOT ||
     env.GROK_SESSION_ID
   ) {
@@ -143,13 +145,19 @@ export const KNOWN_TOOLS = [
 ];
 
 // One canonical markdown per skill (templates/skills/*.md, shipped in the npm
-// package); installed into each tool's slash-command location. The YAML
-// frontmatter (name/description) is understood or harmlessly ignored by every
-// host. Kiro has no command mechanism — its steering rule file is the only gate.
+// package); installed into each tool's slash-command / skill-catalog location.
+// The YAML frontmatter (name/description) is understood or harmlessly ignored
+// by every host. Kiro has no command mechanism — its steering rule file is the
+// only gate.
+//
+// Codex: discovers Agent Skills directories with SKILL.md — repo path is the
+// official `.agents/skills/<name>/SKILL.md` (not dead `.codex/prompts/*.md`).
+// Home install uses `$CODEX_HOME/skills/<name>/SKILL.md` via --codex-home.
 export const SKILL_TOOL_TARGETS = {
   claude: (name) => `.claude/skills/${name}/SKILL.md`,
   cursor: (name) => `.cursor/commands/${name}.md`,
-  codex: (name) => `.codex/prompts/${name}.md`,
+  // Official Codex REPO skill scope (Agent Skills standard).
+  codex: (name) => `.agents/skills/${name}/SKILL.md`,
   // Grok Build: project skills at .grok/skills/<name>/SKILL.md (slash-invocable).
   grok: (name) => `.grok/skills/${name}/SKILL.md`,
   windsurf: (name) => `.windsurf/workflows/${name}.md`,
@@ -253,6 +261,122 @@ export function skillTemplateNames() {
     .map((entry) => path.basename(entry.name, '.md'));
 }
 
+/**
+ * Count present / stale / legacy-only skill files for one catalog root.
+ * @param {string[]} skillNames
+ * @param {(name: string) => string} skillFile path builder
+ * @param {string|null} packageVersion
+ * @param {{ legacyFile?: (name: string) => string }} [opts]
+ */
+export function assessSkillCatalogParity(skillNames, skillFile, packageVersion, opts = {}) {
+  const expectedCount = skillNames.length;
+  const present = [];
+  let stale = 0;
+  for (const name of skillNames) {
+    const file = skillFile(name);
+    if (!fs.existsSync(file)) continue;
+    present.push(name);
+    if (packageVersion) {
+      const installed = installedSkillVersion(file);
+      if (installed === null || isVersionOlder(installed, packageVersion)) stale += 1;
+    }
+  }
+  let legacyCount = 0;
+  if (typeof opts.legacyFile === 'function') {
+    for (const name of skillNames) {
+      if (fs.existsSync(opts.legacyFile(name))) legacyCount += 1;
+    }
+  }
+  const presentCount = present.length;
+  const missing = expectedCount - presentCount;
+  const legacyPromptsOnly = presentCount === 0 && legacyCount > 0;
+  const hasLegacyPrompts = legacyCount > 0;
+  const ok = missing === 0 && stale === 0 && !legacyPromptsOnly;
+  return {
+    ok,
+    missing,
+    stale,
+    presentCount,
+    expectedCount,
+    packageVersion: packageVersion ?? null,
+    legacyPromptsOnly,
+    hasLegacyPrompts,
+    legacyCount,
+  };
+}
+
+/**
+ * Repo + home Codex skill parity against the shipping package skill set.
+ * Producer trees (templates/skills) and projects without AGENTS.md return null.
+ *
+ * @param {string} root
+ * @returns {null | {
+ *   packageVersion: string|null,
+ *   expectedCount: number,
+ *   repo: object,
+ *   home: object,
+ *   skillsDir: string,
+ *   promptsDir: string,
+ *   needsAttention: boolean,
+ *   homeNeedsAttention: boolean,
+ *   repoNeedsAttention: boolean,
+ * }}
+ */
+export function assessCodexSkillParity(root) {
+  if (!fs.existsSync(path.join(root, 'AGENTS.md'))) return null;
+  if (fs.existsSync(path.join(root, 'templates', 'skills'))) return null;
+  const skillNames = skillTemplateNames();
+  if (skillNames.length === 0) return null;
+
+  const packageVersion = arkPackageVersion();
+  const skillsDir = codexSkillsDir();
+  const promptsDir = codexPromptsDir();
+  const repoSkill = (name) => path.join(root, SKILL_TOOL_TARGETS.codex(name));
+  const repoLegacy = (name) => path.join(root, '.codex', 'prompts', `${name}.md`);
+  const homeSkill = (name) => path.join(skillsDir, name, 'SKILL.md');
+  const homeLegacy = (name) => path.join(promptsDir, `${name}.md`);
+
+  const repo = assessSkillCatalogParity(skillNames, repoSkill, packageVersion, {
+    legacyFile: repoLegacy,
+  });
+  const home = assessSkillCatalogParity(skillNames, homeSkill, packageVersion, {
+    legacyFile: homeLegacy,
+  });
+
+  // Repo catalog matters when .codex is present (Codex host adopted) or repo skills/prompts exist.
+  const repoInPlay =
+    fs.existsSync(path.join(root, '.codex')) ||
+    repo.presentCount > 0 ||
+    repo.hasLegacyPrompts;
+  // Home is "in play" only when ark skills or legacy prompts were actually installed there
+  // (empty $CODEX_HOME/skills is optional multi-project — not debt).
+  const homeInPlay = home.presentCount > 0 || home.hasLegacyPrompts;
+
+  if (!repoInPlay && !homeInPlay) return null;
+
+  const repoNeedsAttention =
+    repoInPlay && (repo.missing > 0 || repo.stale > 0 || repo.legacyPromptsOnly);
+  const homeNeedsAttention =
+    homeInPlay && (home.missing > 0 || home.stale > 0 || home.legacyPromptsOnly);
+
+  return {
+    packageVersion,
+    expectedCount: skillNames.length,
+    repo: { ...repo, inPlay: repoInPlay },
+    home: {
+      ...home,
+      inPlay: homeInPlay,
+      skillsDir,
+      promptsDir,
+    },
+    skillsDir,
+    promptsDir,
+    repoNeedsAttention,
+    homeNeedsAttention,
+    needsAttention: repoNeedsAttention || homeNeedsAttention,
+  };
+}
+
 // A normal ark-check run is the reliable discovery point for new /ark-* skills.
 // Ark ships no install lifecycle script (a postinstall banner would be blocked by
 // modern package managers' script-approval policy anyway, so careful users never
@@ -262,24 +386,94 @@ export function skillTemplateNames() {
 // Advisory only — never affects the exit code. Copilot has no reliable directory
 // signal, so it is not auto-detected (explicit --tools only), matching resolveTools.
 export function detectCodexHomeGap(root) {
-  if (!fs.existsSync(path.join(root, 'AGENTS.md'))) return null;
-  if (fs.existsSync(path.join(root, 'templates', 'skills'))) return null;
-  const skillNames = skillTemplateNames();
-  if (skillNames.length === 0) return null;
-  const dir = codexPromptsDir();
-  if (!fs.existsSync(dir)) return null;
-  const present = skillNames.filter((name) => fs.existsSync(path.join(dir, `${name}.md`)));
-  if (present.length === 0) return null; // Codex home never set up for Ark — don't nag.
-  const version = arkPackageVersion();
-  const missing = skillNames.length - present.length;
-  let stale = 0;
-  if (version) {
-    for (const name of present) {
-      const installed = installedSkillVersion(path.join(dir, `${name}.md`));
-      if (installed === null || isVersionOlder(installed, version)) stale += 1;
+  const parity = assessCodexSkillParity(root);
+  if (!parity || !parity.homeNeedsAttention) return null;
+  const { home, packageVersion, expectedCount, skillsDir } = parity;
+  return {
+    missing: home.missing,
+    stale: home.stale,
+    legacyPromptsOnly: Boolean(home.legacyPromptsOnly),
+    hasLegacyPrompts: Boolean(home.hasLegacyPrompts),
+    presentCount: home.presentCount,
+    expectedCount,
+    packageVersion,
+    skillsDir,
+  };
+}
+
+/**
+ * Repo-side Codex gaps: missing/stale .agents/skills or legacy .codex/prompts only.
+ * @param {string} root
+ * @returns {null | { missing: number, stale: number, legacyPromptsOnly: boolean, hasLegacyPrompts: boolean, presentCount: number, expectedCount: number, packageVersion: string|null }}
+ */
+export function detectCodexRepoSkillGap(root) {
+  const parity = assessCodexSkillParity(root);
+  if (!parity || !parity.repoNeedsAttention) return null;
+  const { repo, packageVersion, expectedCount } = parity;
+  return {
+    missing: repo.missing,
+    stale: repo.stale,
+    legacyPromptsOnly: Boolean(repo.legacyPromptsOnly),
+    hasLegacyPrompts: Boolean(repo.hasLegacyPrompts),
+    presentCount: repo.presentCount,
+    expectedCount,
+    packageVersion,
+  };
+}
+
+/**
+ * Skill names referenced as `/ark-*` in AGENTS.md (or any instruction text).
+ * @param {string} text
+ * @returns {string[]}
+ */
+export function agentsMdSkillRefs(text) {
+  if (!text || typeof text !== 'string') return [];
+  const refs = new Set();
+  const re = /\/(ark-[a-z0-9-]+)/g;
+  let match;
+  while ((match = re.exec(text)) !== null) refs.add(match[1]);
+  return [...refs].sort();
+}
+
+/**
+ * Verify that every `/ark-*` skill referenced by AGENTS.md (and known to this
+ * package) is present in each selected host's skill catalog path.
+ *
+ * Compact routers intentionally omit `/ark-*` — they verify as ok with no checks.
+ *
+ * @param {string} root
+ * @param {Iterable<string>} tools
+ * @param {{ skillNames?: string[], agentsText?: string }} [options]
+ * @returns {{ ok: boolean, missing: Array<{ tool: string, name: string, path: string }>, referenced: string[], checkedTools: string[], compact?: boolean }}
+ */
+export function verifyHostSkillCatalog(root, tools, options = {}) {
+  const skillNames = new Set(options.skillNames ?? skillTemplateNames());
+  let agentsText = options.agentsText;
+  if (agentsText == null) {
+    try {
+      agentsText = fs.readFileSync(path.join(root, 'AGENTS.md'), 'utf8');
+    } catch {
+      return { ok: true, missing: [], referenced: [], checkedTools: [] };
+    }
+  }
+  if (isCompactRouterAgentsContent(agentsText)) {
+    return { ok: true, missing: [], referenced: [], checkedTools: [], compact: true };
+  }
+  const referenced = agentsMdSkillRefs(agentsText).filter((name) => skillNames.has(name));
+  const missing = [];
+  const checkedTools = [];
+  for (const tool of tools) {
+    const target = SKILL_TOOL_TARGETS[tool];
+    if (!target) continue;
+    checkedTools.push(tool);
+    for (const name of referenced) {
+      const relativePath = target(name);
+      if (!fs.existsSync(path.join(root, relativePath))) {
+        missing.push({ tool, name, path: relativePath });
+      }
     }
   }
-  return missing > 0 || stale > 0 ? { missing, stale } : null;
+  return { ok: missing.length === 0, missing, referenced, checkedTools };
 }
 
 export function detectSkillGaps(root) {
@@ -324,7 +518,94 @@ export function detectSkillGaps(root) {
         if (installed === null || isVersionOlder(installed, version)) stale += 1;
       }
     }
-    if (missing > 0 || stale > 0) gaps.push({ tool, missing, stale });
+    let legacyPromptsOnly = false;
+    let hasLegacyPrompts = false;
+    if (tool === 'codex') {
+      const legacyCount = skillNames.filter((name) =>
+        fs.existsSync(path.join(root, '.codex', 'prompts', `${name}.md`))
+      ).length;
+      hasLegacyPrompts = legacyCount > 0;
+      // Flat prompts without any SKILL.md catalog entries are not loadable.
+      legacyPromptsOnly = hasLegacyPrompts && missing === skillNames.length;
+    }
+    if (missing > 0 || stale > 0 || legacyPromptsOnly) {
+      gaps.push({
+        tool,
+        missing,
+        stale,
+        ...(legacyPromptsOnly ? { legacyPromptsOnly: true } : {}),
+        ...(hasLegacyPrompts ? { hasLegacyPrompts: true } : {}),
+      });
+    }
   }
   return gaps;
 }
+
+/**
+ * Human-facing skill / Codex catalog gap lines for ark-check (non-JSON).
+ * @param {string} root
+ * @param {{ skillGaps: object[], codexHomeGap: object|null, codexRepoSkillGap: object|null, codexSessionActive: boolean, color: { dim: Function, yellow: Function } }} opts
+ */
+export function printSkillAndCodexGapHints(root, opts) {
+  const { skillGaps, codexHomeGap, codexRepoSkillGap, codexSessionActive, color } = opts;
+  if (skillGaps?.length > 0) {
+    const legacyCodex = skillGaps.some((gap) => gap.tool === 'codex' && gap.legacyPromptsOnly);
+    // Report Codex legacy separately; never suppress missing/stale for other hosts.
+    const remaining = skillGaps.filter((gap) => !(gap.tool === 'codex' && gap.legacyPromptsOnly));
+    const missingTotal = remaining.reduce((sum, gap) => sum + gap.missing, 0);
+    const staleTotal = remaining.reduce((sum, gap) => sum + gap.stale, 0);
+    const tools = remaining.map((gap) => gap.tool).join(', ');
+    if (legacyCodex) {
+      console.log(
+        color.yellow(
+          'Codex has legacy flat .codex/prompts/ark-*.md only — those are not loadable as skills. ' +
+            `Install the real catalog: ${arkCommand(root, 'ark-check', '--install-agent-gates --skills-only --tools codex --force')}`
+        )
+      );
+    }
+    if (missingTotal > 0) {
+      console.log(
+        color.dim(
+          `${missingTotal} /ark-* skill(s) not installed for ${tools} (this Ark version ships them). ` +
+            `Install: ${arkCommand(root, 'ark-check', '--install-agent-gates')}`
+        )
+      );
+    }
+    if (staleTotal > 0) {
+      console.log(
+        color.dim(
+          `${staleTotal} /ark-* skill(s) outdated for ${tools} (this Ark ships newer versions). ` +
+            `Refresh: ${arkCommand(root, 'ark-check', '--install-agent-gates --skills-only --force')}`
+        )
+      );
+    }
+  }
+  if (codexHomeGap) {
+    const parts = [];
+    if (codexHomeGap.legacyPromptsOnly) parts.push('legacy-prompts-only');
+    if (codexHomeGap.missing > 0) parts.push(`${codexHomeGap.missing} missing`);
+    if (codexHomeGap.stale > 0) parts.push(`${codexHomeGap.stale} outdated`);
+    const deferred = !codexSessionActive;
+    const deferredNote = deferred
+      ? ' Deferred unless you use Codex — not a blocker for Grok/Claude/Cursor. '
+      : ' ';
+    const msg =
+      `Codex home skill catalog (${codexSkillsDir()}) behind this Ark (${parts.join(', ')}).` +
+      deferredNote +
+      `Catalog is $CODEX_HOME/skills/<name>/SKILL.md (not flat prompts). ` +
+      `When using Codex: ${arkCommand(root, 'ark-check', '--install-agent-gates --skills-only --codex-home --force')}`;
+    console.log(deferred ? color.dim(msg) : color.yellow(msg));
+  }
+  if (codexRepoSkillGap && codexSessionActive) {
+    const parts = [];
+    if (codexRepoSkillGap.legacyPromptsOnly) parts.push('legacy-prompts-only');
+    if (codexRepoSkillGap.missing > 0) parts.push(`${codexRepoSkillGap.missing} missing`);
+    if (codexRepoSkillGap.stale > 0) parts.push(`${codexRepoSkillGap.stale} outdated`);
+    console.log(
+      color.yellow(
+        `Codex repo skill catalog (.agents/skills) needs refresh (${parts.join(', ')}). ` +
+          `Fix: ${arkCommand(root, 'ark-check', '--install-agent-gates --skills-only --tools codex --force')}`
+      )
+    );
+  }
+}

package/bin/lib/weakest-link.mjs

@@ -48,6 +48,30 @@ export function detectPreCommitArk(root) {
   return { present, arkAware, path: hit };
 }
 
+/**
+ * Classify ark-check flags in a workflow or package script body.
+ * CLI: `--strict` and `--strict-merge` both set strictConfig + requireGates (fail-closed).
+ * `--strict-config` alone does not require gate files.
+ *
+ * @param {string} text
+ * @returns {{ hasFailClosedFlag: boolean, hasStrictConfigOnly: boolean, hasStrictFlag: boolean }}
+ */
+export function classifyArkCheckFlags(text) {
+  if (!text || typeof text !== 'string') {
+    return { hasFailClosedFlag: false, hasStrictConfigOnly: false, hasStrictFlag: false };
+  }
+  const hasStrictMerge = /--strict-merge\b/.test(text);
+  const hasRequireGates = /--require-gates\b/.test(text);
+  // Bare --strict (alias of --strict-merge), not --strict-config / already-matched merge.
+  const withoutLong = text.replace(/--strict-merge\b/g, ' ').replace(/--strict-config\b/g, ' ');
+  const hasBareStrict = /--strict\b/.test(withoutLong);
+  const hasFailClosedFlag = hasStrictMerge || hasRequireGates || hasBareStrict;
+  const hasStrictConfig = /--strict-config\b/.test(text);
+  const hasStrictConfigOnly = hasStrictConfig && !hasFailClosedFlag;
+  const hasStrictFlag = hasFailClosedFlag || hasStrictConfigOnly;
+  return { hasFailClosedFlag, hasStrictConfigOnly, hasStrictFlag };
+}
+
 /**
  * @param {string} root
  * @returns {{
@@ -56,6 +80,9 @@ export function detectPreCommitArk(root) {
  *   arkWorkflowFiles: string[],
  *   hasArkCheckWorkflow: boolean,
  *   hasStrictFlag: boolean,
+ *   hasFailClosedFlag: boolean,
+ *   hasStrictConfigOnly: boolean,
+ *   failClosed: boolean,
  *   hasArchitectureJobName: boolean,
  * }}
  */
@@ -67,6 +94,9 @@ export function detectCiEnforcement(root) {
     arkWorkflowFiles: [],
     hasArkCheckWorkflow: false,
     hasStrictFlag: false,
+    hasFailClosedFlag: false,
+    hasStrictConfigOnly: false,
+    failClosed: false,
     hasArchitectureJobName: false,
   };
   if (!out.hasWorkflowsDir) return out;
@@ -77,6 +107,19 @@ export function detectCiEnforcement(root) {
     return out;
   }
   out.workflowFiles = files;
+
+  let checkArchScript = '';
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    checkArchScript =
+      typeof pkg?.scripts?.['check:architecture'] === 'string'
+        ? pkg.scripts['check:architecture']
+        : '';
+  } catch {
+    checkArchScript = '';
+  }
+  const scriptFlags = classifyArkCheckFlags(checkArchScript);
+
   for (const f of files) {
     let text = '';
     try {
@@ -92,9 +135,19 @@ export function detectCiEnforcement(root) {
     if (mentionsArk) {
       out.hasArkCheckWorkflow = true;
       out.arkWorkflowFiles.push(`.github/workflows/${f}`);
-      if (/--strict\b/.test(text) || /check:architecture/.test(text)) {
+      const flags = classifyArkCheckFlags(text);
+      const viaScript = /check:architecture/.test(text) && scriptFlags.hasFailClosedFlag;
+      if (flags.hasFailClosedFlag || viaScript) {
+        out.hasFailClosedFlag = true;
+        out.failClosed = true;
+        out.hasStrictFlag = true;
+      } else if (flags.hasStrictConfigOnly) {
+        out.hasStrictConfigOnly = true;
+        out.hasStrictFlag = true;
+      } else if (flags.hasStrictFlag) {
         out.hasStrictFlag = true;
       }
+      // check:architecture without fail-closed flags in the script is NOT fail-closed.
       if (/architecture|ark-check|arkgate-check/i.test(f) || /name:\s*.*ark/i.test(text)) {
         out.hasArchitectureJobName = true;
       }
@@ -339,18 +392,14 @@ export function collectWeakestLinkGaps(root, opts = {}) {
         'CI workflows exist but none run ark-check / arkgate-check / check:architecture',
       fix: arkCommand(root, 'ark-check', '--install-agent-gates'),
     });
-  } else if (
-    adopted &&
-    !isProducer &&
-    ci.hasArkCheckWorkflow &&
-    !ci.hasStrictFlag
-  ) {
+  } else if (adopted && !isProducer && ci.hasArkCheckWorkflow && !ci.failClosed) {
     gaps.push({
-      id: 'enforcement-ci-not-strict',
-      severity: 'info',
-      message:
-        'Architecture CI job found but does not pass --strict / check:architecture (weaker than recommended)',
-      fix: 'Add --strict (or npm run check:architecture) to the architecture workflow step',
+      id: 'enforcement-ci-not-fail-closed',
+      severity: 'warn',
+      message: ci.hasStrictConfigOnly
+        ? 'Architecture CI uses --strict-config only (config coverage without gate-file presence). Prefer the fail-closed profile.'
+        : 'Architecture CI job found but does not use the fail-closed profile (--strict-merge / --strict / --require-gates)',
+      fix: 'ark-check --root . --config ark.config.json --strict-merge --baseline .ark-baseline.json',
     });
   }
 

package/bin/lib/write-path-capabilities.mjs

@@ -121,7 +121,9 @@ function hostRecord(hard, advisory, repair, merge) {
 }
 
 export function detectWritePathInventory(root) {
-  const merge = detectCiEnforcement(root).arkWorkflowFiles;
+  // Merge-gate evidence only when CI uses the fail-closed profile (not bare ark-check).
+  const ci = detectCiEnforcement(root);
+  const merge = ci.failClosed ? ci.arkWorkflowFiles : [];
   const claudeHook = hookEvidence(root, '.claude/settings.json');
   const grokHook = hookEvidence(root, '.grok/hooks/ark-write-gate.json');
   const hosts = {

package/bin/lib/write-path-detect.mjs

@@ -30,21 +30,32 @@ export function detectWritePathCapabilities(root, explicitHost) {
 
   const tools = installToolsForHost(activeHost);
   let gap = null;
+  // Repo inventory (any host) can show hard/advisory write while activeHost is
+  // unknown (plain shell / `npx ark-check --report` outside an agent session).
+  // Session projection stays mode=none (other hosts' hooks are not a guarantee for
+  // this process) — but do not open an adoption gap: gates exist on disk.
+  const inventoryHasWriteBoundary =
+    Boolean(inventory?.capabilities?.['hard-write']) ||
+    Boolean(inventory?.capabilities?.['advisory-write']);
   if (mode === 'none') {
-    gap = {
-      id: 'write-path-none',
-      severity: 'warn',
-      message:
-        `Active host ${activeHost} has no hard write boundary or advisory Ark MCP. ` +
-        (capabilities['merge-gate']
-          ? 'The CI check remains separate and does not block local writes.'
-          : 'No Ark CI check was detected either.'),
-      fix: arkCommand(
-        root,
-        'ark-check',
-        `--install-agent-gates --tools ${tools}`
-      ),
-    };
+    if (activeHost === 'unknown' && inventoryHasWriteBoundary) {
+      gap = null;
+    } else {
+      gap = {
+        id: 'write-path-none',
+        severity: 'warn',
+        message:
+          `Active host ${activeHost} has no hard write boundary or advisory Ark MCP. ` +
+          (capabilities['merge-gate']
+            ? 'The CI check remains separate and does not block local writes.'
+            : 'No Ark CI check was detected either.'),
+        fix: arkCommand(
+          root,
+          'ark-check',
+          `--install-agent-gates --tools ${tools}`
+        ),
+      };
+    }
   } else if (mode === 'reject-only') {
     gap = {
       id: 'write-path-reject-only',
@@ -61,17 +72,23 @@ export function detectWritePathCapabilities(root, explicitHost) {
       ),
     };
   } else if (mode === 'mcp-only') {
+    const codexHonesty =
+      activeHost === 'codex'
+        ? 'Codex local write is advisory (MCP + best-effort hooks.json — not a hard boundary; ' +
+          'not equivalent to Claude/Grok PreToolUse hard-write + repair). ' +
+          'The hard merge backstop is CI --strict-merge plus a required status check.'
+        : `Active host ${activeHost} has advisory prepare-write/autoPatch tools, ` +
+          'but no hard write boundary; the CI check can still reject the change before merge.';
     gap = {
       id: 'write-path-mcp-only',
       severity: 'info',
-      message:
-        `Active host ${activeHost} has advisory prepare-write/autoPatch tools, ` +
-        'but no hard write boundary; the CI check can still reject the change before merge.',
-      fix: arkCommand(
-        root,
-        'ark-check',
-        `--install-agent-gates --tools ${tools}`
-      ),
+      host: activeHost,
+      message: codexHonesty,
+      fix:
+        activeHost === 'codex'
+          ? 'Keep CI on --strict-merge and require the ark-check status on the default branch; ' +
+            `refresh Codex MCP/skills with ${arkCommand(root, 'ark-check', '--install-agent-gates --tools codex')}`
+          : arkCommand(root, 'ark-check', `--install-agent-gates --tools ${tools}`),
     };
   }
 

package/dist/index.cjs

@@ -50,7 +50,7 @@ __export(gate_exports, {
 module.exports = __toCommonJS(gate_exports);
 
 // src/version.ts
-var version = "3.0.3";
+var version = "3.0.5";
 
 // src/domain/adapterContract.ts
 var ARK_ANALYSIS_RESULT_SCHEMA_VERSION = "1.0";

package/dist/index.d.cts

@@ -2,7 +2,7 @@ import { a as ArkConfigRule, b as ArkConfigLayer, A as ArkConfig, c as ArkConfig
 export { d as ARK_CONFIG_SCHEMA, e as ARK_CONFIG_SCHEMA_VERSION, l as loadArkConfigContract, p as parseArkConfigJson } from './configContract-BxSIwVRo.cjs';
 
 /** ArkGate library version — single source of truth. */
-declare const version = "3.0.3";
+declare const version = "3.0.5";
 
 /** Versioned public result contract shared by every ArkGate enforcement adapter. */
 declare const ARK_ANALYSIS_RESULT_SCHEMA_VERSION: "1.0";

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import { a as ArkConfigRule, b as ArkConfigLayer, A as ArkConfig, c as ArkConfig
 export { d as ARK_CONFIG_SCHEMA, e as ARK_CONFIG_SCHEMA_VERSION, l as loadArkConfigContract, p as parseArkConfigJson } from './configContract-BxSIwVRo.js';
 
 /** ArkGate library version — single source of truth. */
-declare const version = "3.0.3";
+declare const version = "3.0.5";
 
 /** Versioned public result contract shared by every ArkGate enforcement adapter. */
 declare const ARK_ANALYSIS_RESULT_SCHEMA_VERSION: "1.0";

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var version = "3.0.3";
+var version = "3.0.5";
 
 // src/domain/adapterContract.ts
 var ARK_ANALYSIS_RESULT_SCHEMA_VERSION = "1.0";

package/docs/agent-guide.md

@@ -307,7 +307,7 @@ npx arkgate-check --install-agent-gates --tools claude,cursor,codex,grok
 |------|-----------------|-------------|
 | Claude Code | `.claude/settings.json` hook + `.mcp.json` / `claude mcp add` | `.claude/skills/<name>/SKILL.md` |
 | Cursor | `.cursor/mcp.json` + `.cursor/rules/ark.mdc` | `.cursor/commands/` |
-| OpenAI Codex | `$CODEX_HOME/config.toml` (global; absolute `--root`; multi-project → secondary `ark_<slug>` unless `--force`; doctor defers non-temp home gaps when session host ≠ Codex — see [ai-gates.md](ai-gates.md)) | `$CODEX_HOME/prompts` (`--codex-home`; fix when using Codex) |
+| OpenAI Codex | `$CODEX_HOME/config.toml` (global; absolute `--root`; multi-project → secondary `ark_<slug>` unless `--force`; doctor defers non-temp home gaps when session host ≠ Codex — see [ai-gates.md](ai-gates.md)) | **Repo:** `.agents/skills/<name>/SKILL.md`; **home:** `$CODEX_HOME/skills/<name>/SKILL.md` (`--codex-home`) |
 | **Grok Build** | `.grok/hooks/ark-write-gate.json` + `.grok/config.toml` / `.mcp.json` | `.grok/skills/<name>/SKILL.md` |
 
 This is a path reference, not a guarantee table. Full copy-paste setups: