arkgate 3.0.4 → 3.1.0

package/bin/lib/ci-and-commands.mjs

@@ -417,6 +417,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 ${setupSteps ? `${setupSteps}\n` : ''}      - name: Setup Node
         uses: actions/setup-node@v4
         with:
@@ -425,6 +427,8 @@ ${nodeSetup}
       - name: Install dependencies
         run: ${pm.install}
 ${qualityBlock ? `${qualityBlock}\n` : ''}      - name: Ark architecture check
+        env:
+          ARK_POLICY_BASE_REF: \${{ github.event.pull_request.base.sha || github.event.before }}
         run: ${pm.run}
 `;
 }

package/bin/lib/codex-home.mjs

@@ -10,12 +10,21 @@ import { execCommandParts } from '../ark-shared.mjs';
 
 export const PREFERRED_CODEX_MCP_BIN = 'arkgate-mcp';
 
-/** Where Codex loads slash-command prompts ($CODEX_HOME/prompts). */
+/** Where Codex loads slash-command prompts ($CODEX_HOME/prompts) — legacy, not the skill catalog. */
 export function codexPromptsDir() {
   const base = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
   return path.join(base, 'prompts');
 }
 
+/**
+ * Where Codex loads user/home SKILL.md skills ($CODEX_HOME/skills/<name>/SKILL.md).
+ * Repo-scoped skills live at `.agents/skills/<name>/SKILL.md` (Agent Skills standard).
+ */
+export function codexSkillsDir() {
+  const base = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
+  return path.join(base, 'skills');
+}
+
 /** Where Codex loads MCP servers ($CODEX_HOME/config.toml) — global, not project-local. */
 export function codexConfigPath() {
   const base = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');

package/bin/lib/doctor-plan.mjs

@@ -14,6 +14,8 @@ import {
 import {
   collectAdoptionGaps,
   detectSkillGaps,
+  detectCodexHomeGap,
+  codexConcernIsActive,
   detectWritePathCapabilities,
   missingGates,
   staleRunnerGateFiles,
@@ -405,8 +407,6 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
     ? [...baseline.keys].filter((key) => !currentKeys.has(key)).length
     : 0;
   const activeCount = violations.length - suppressed;
-  const missingSkills = skillGaps.reduce((sum, gap) => sum + gap.missing, 0);
-  const staleSkills = skillGaps.reduce((sum, gap) => sum + gap.stale, 0);
   const designSmells = detectDesignSmells(root, config, files, cov);
   const designFitness = summarizeDesignFitness(designSmells, {
     activeViolations: activeCount,
@@ -491,6 +491,7 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
               capabilities: writePath.capabilities,
               capabilityEvidence: writePath.capabilityEvidence,
               inventory: writePath.inventory,
+              enforcementLadder: writePath.enforcementLadder,
               mode: writePath.mode,
               prepareWrite: writePath.prepareWrite,
               autoPatch: writePath.autoPatch,
@@ -738,17 +739,19 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
   line(' ', `Active host: ${writePath.activeHost}`);
   line(' ', `Supported profile: ${writePath.supportSummary}`);
   line(wpMark, `Mode: ${writePath.mode} — ${writePathLabels[writePath.mode] || writePath.mode}`);
+  const ladder = writePath.enforcementLadder;
+  const state = (value) => value === true ? 'yes' : value === false ? 'no' : String(value);
   line(
-    capabilities['hard-write'] ? ok : warn,
-    `Hard write boundary: ${capabilities['hard-write'] ? 'yes' : 'no'}`
+    ladder.localWrite.installed ? ok : warn,
+    `Hard hook — supported: ${state(ladder.localWrite.supported)} · installed: ${state(ladder.localWrite.installed)} · active/trusted: ${state(ladder.localWrite.active)} · bypassable: ${state(ladder.localWrite.bypassable)}`
   );
   line(
     warn,
-    `Advisory write tools (MCP): ${capabilities['advisory-write'] ? 'yes' : 'no'}`
+    `Advisory MCP — supported: ${state(ladder.advisoryMcp.supported)} · installed: ${state(ladder.advisoryMcp.installed)} · active: ${state(ladder.advisoryMcp.active)} · bypassable: ${state(ladder.advisoryMcp.bypassable)}`
   );
   line(
     capabilities['merge-gate'] ? ok : bad,
-    `CI check (--strict-merge): ${capabilities['merge-gate'] ? 'yes' : 'no'} (merge blocking requires a required status)`
+    `Merge gate — supported: ${state(ladder.ciMerge.supported)} · installed: ${state(ladder.ciMerge.installed)} · active: ${state(ladder.ciMerge.active)} · bypassable: ${state(ladder.ciMerge.bypassable)} · required status: ${state(ladder.ciMerge.requiredStatus)}`
   );
   line(
     capabilities['repair-payload'] ? ok : warn,
@@ -769,11 +772,36 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
     line(bad, `Missing gates: ${gatesMissing.join(', ')}`);
     actions.push(`install gates (${arkCommand(root, 'ark-check', '--install-agent-gates')})`);
   }
-  if (missingSkills + staleSkills === 0) line(ok, '/ark-* skills current for detected tools');
-  else {
-    line(warn, `${missingSkills} missing / ${staleSkills} outdated /ark-* skill(s) for ${skillGaps.map((g) => g.tool).join(', ')}`);
+  // Report Codex legacy prompts and other-host missing/stale independently (never exclusive).
+  const legacyCodex = skillGaps.some((g) => g.tool === 'codex' && g.legacyPromptsOnly);
+  const remainingGaps = skillGaps.filter((g) => !(g.tool === 'codex' && g.legacyPromptsOnly));
+  const remMiss = remainingGaps.reduce((s, g) => s + g.missing, 0);
+  const remStale = remainingGaps.reduce((s, g) => s + g.stale, 0);
+  if (remMiss + remStale === 0 && !legacyCodex) line(ok, '/ark-* skills current for detected tools');
+  if (legacyCodex) {
+    line(warn, 'Codex: legacy flat .codex/prompts only (not a loadable skill catalog)');
+    actions.push('install Codex SKILL.md catalog (--install-agent-gates --skills-only --tools codex --force)');
+  }
+  if (remMiss + remStale > 0) {
+    line(warn, `${remMiss} missing / ${remStale} outdated /ark-* skill(s) for ${remainingGaps.map((g) => g.tool).join(', ')}`);
     actions.push('refresh /ark-* skills (--install-agent-gates --skills-only --force)');
   }
+  const codexHomeGap = detectCodexHomeGap(root);
+  if (codexHomeGap) {
+    const parts = [
+      codexHomeGap.legacyPromptsOnly ? 'legacy-prompts-only' : null,
+      codexHomeGap.missing > 0 ? `${codexHomeGap.missing} missing` : null,
+      codexHomeGap.stale > 0 ? `${codexHomeGap.stale} outdated` : null,
+    ].filter(Boolean);
+    const deferred = !codexConcernIsActive();
+    // Deferred home debt is dim/info (not warn) so non-Codex sessions are not "incomplete".
+    if (deferred) {
+      line(color.dim('·'), color.dim(`Codex home skills ${parts.join(', ')} (deferred — not on Codex session)`));
+    } else {
+      line(warn, `Codex home skills ${parts.join(', ')}`);
+      actions.push('refresh Codex home skills (--install-agent-gates --skills-only --codex-home --force)');
+    }
+  }
 
   console.log('');
   console.log(color.bold('Baseline'));

package/bin/lib/host-support-matrix.mjs

@@ -6,11 +6,12 @@
  * reported separately by write-path-capabilities.mjs.
  */
 
-function hostProfile(label, hookPath, hookSurface, hardWrite, repairPayload) {
+function hostProfile(label, hookPath, hookSurface, hookOperations, hardWrite, repairPayload) {
   return Object.freeze({
     label,
     hookPath,
     hookSurface,
+    hookOperations: Object.freeze(hookOperations),
     capabilities: Object.freeze({
       'hard-write': hardWrite,
       'advisory-write': true,
@@ -25,6 +26,7 @@ export const HOST_SUPPORT_MATRIX = Object.freeze({
     'Claude Code',
     '.claude/settings.json',
     'PreToolUse `Write` / `Edit` / `MultiEdit`',
+    ['Write', 'Edit', 'MultiEdit'],
     true,
     true
   ),
@@ -32,14 +34,16 @@ export const HOST_SUPPORT_MATRIX = Object.freeze({
     'Grok Build',
     '.grok/hooks/ark-write-gate.json',
     'PreToolUse `write` / `search_replace` (plus aliases)',
+    ['write', 'search_replace'],
     true,
     true
   ),
-  cursor: hostProfile('Cursor', null, null, false, false),
+  cursor: hostProfile('Cursor', null, null, [], false, false),
   codex: hostProfile(
     'OpenAI Codex',
     '.codex/hooks.json',
     'Best-effort PreToolUse `apply_patch`; Code Mode hosts may bypass the event',
+    ['apply_patch'],
     false,
     false
   ),

package/bin/lib/install-migrate.mjs

@@ -12,6 +12,7 @@ import {
 } from '../ark-shared.mjs';
 import {
   codexPromptsDir,
+  codexSkillsDir,
   codexConfigPath,
   isTempOrUpgradeRoot,
   usesDefaultCodexHome,
@@ -52,6 +53,7 @@ import {
   isVersionOlder,
   detectSkillGaps,
   arkPackageVersion,
+  verifyHostSkillCatalog,
 } from './skill-install.mjs';
 import { detectDeployPathQuality } from './deploy-path.mjs';
 import {
@@ -383,15 +385,15 @@ export function runInstallAgentGates(args) {
     console.log(`    ${arkCommand(root, 'ark-check', '--install-agent-gates --skills-only --force')}`);
   }
 
-  // --codex-home writes the canonical skills straight to $CODEX_HOME/prompts.
-  // Codex reads prompts from there (not the repo), so this is the only way to
-  // refresh them for a repo that isn't itself configured for Codex. It writes to
-  // the user's home dir, hence explicit opt-in rather than part of a normal run.
+  // --codex-home writes SKILL.md skills to $CODEX_HOME/skills/<name>/SKILL.md.
+  // Codex's real catalog loads skill directories (not flat $CODEX_HOME/prompts).
+  // Repo installs already write `.agents/skills/<name>/SKILL.md` when `codex` is
+  // selected; home install is for multi-project / non-repo-local refresh.
   const homeResults = [];
   if (args.codexHome) {
-    const dir = codexPromptsDir();
+    const dir = codexSkillsDir();
     console.log('');
-    console.log(`Codex home skills (${dir}):`);
+    console.log(`Codex home skills (${dir}/<name>/SKILL.md):`);
     try {
       fs.mkdirSync(dir, { recursive: true });
     } catch (error) {
@@ -400,23 +402,25 @@ export function runInstallAgentGates(args) {
     }
     if (homeResults.length === 0) {
       for (const [name, content] of skills) {
-        const file = path.join(dir, `${name}.md`);
+        const skillDir = path.join(dir, name);
+        const file = path.join(skillDir, 'SKILL.md');
         if (fs.existsSync(file) && !args.force) {
           const installed = installedSkillVersion(file);
           const behind = installed === null || (version && isVersionOlder(installed, version));
           const note = behind
             ? `  (stale: ${installed ?? 'no stamp'} < ${version}; use --force)`
             : '  (up to date)';
-          console.log(`  ${'skipped'.padEnd(7)} ${name}.md${note}`);
+          console.log(`  ${'skipped'.padEnd(7)} ${name}/SKILL.md${note}`);
           homeResults.push({ status: 'skipped' });
           continue;
         }
         try {
+          fs.mkdirSync(skillDir, { recursive: true });
           fs.writeFileSync(file, content);
-          console.log(`  ${'wrote'.padEnd(7)} ${name}.md`);
+          console.log(`  ${'wrote'.padEnd(7)} ${name}/SKILL.md`);
           homeResults.push({ status: 'written' });
         } catch (error) {
-          console.log(`  ${'FAILED'.padEnd(7)} ${name}.md (${error.message})`);
+          console.log(`  ${'FAILED'.padEnd(7)} ${name}/SKILL.md (${error.message})`);
           homeResults.push({ status: 'failed' });
         }
       }
@@ -429,18 +433,15 @@ export function runInstallAgentGates(args) {
   // home-dir merge instead. Fires whenever Codex is in play so `ark://manifest` is live
   // without a manual copy step.
   //
-  // Skip home-dir mutation when the project root is a temp/upgrade scratch *and*
-  // CODEX_HOME resolves to the default (~/.codex). Codex itself may export that exact
-  // path, so presence alone does not prove isolation. Fixtures must not rewrite the
-  // developer's real config. A genuinely redirected CODEX_HOME or explicit
-  // --codex-home still wires as requested.
+  // Skip home MCP mutation when the project root is a temp/upgrade scratch *and*
+  // CODEX_HOME is the default (~/.codex). Fixtures and agent smokes must not rewrite
+  // the developer's real config.toml with a temp --root. --codex-home still refreshes
+  // home *skills* below; MCP binding of a temp root into default home is never safe.
+  // A redirected CODEX_HOME (tests/isolation) may still wire as requested.
   let codexMcp = null;
   const wantCodexWire = !args.compact && (tools.has('codex') || args.codexHome);
   const skipHomeWire =
-    wantCodexWire &&
-    isTempOrUpgradeRoot(root) &&
-    !args.codexHome &&
-    usesDefaultCodexHome();
+    wantCodexWire && isTempOrUpgradeRoot(root) && usesDefaultCodexHome();
   if (wantCodexWire && !skipHomeWire) {
     codexMcp = wireCodexMcp(root, args.force);
     console.log('');
@@ -498,13 +499,68 @@ export function runInstallAgentGates(args) {
     if (codexMcp && codexMcp.status !== 'failed') {
       console.log(`  Codex: ark MCP registered in ${codexMcp.file} — restart Codex so \`ark://manifest\` loads.`);
     }
+    if (tools.has('codex') && !args.compact) {
+      console.log('  Codex write path (honest):');
+      console.log('    - Local: advisory MCP + best-effort .codex/hooks.json (not a hard boundary).');
+      console.log('    - Hard merge backstop: CI --strict-merge + required status check.');
+      console.log('    - Not equivalent to Claude/Grok PreToolUse hard-write + repair.');
+    }
     if (args.codexHome) {
-      console.log(`  Codex: refreshed the /ark-* skills in ${codexPromptsDir()} — Codex loads them from there.`);
-    } else if (skills.length > 0) {
-      console.log('  Codex loads slash-command prompts from $CODEX_HOME/prompts (~/.codex/prompts),');
-      console.log('  not the repo. Install the /ark-* skills there with:');
-      console.log(`    ${arkCommand(root, 'ark-check', '--install-agent-gates --codex-home')}`);
-      console.log('  (writes to your home dir; agents driving this setup should offer to run it).');
+      console.log(
+        `  Codex: refreshed home skills under ${codexSkillsDir()}/<name>/SKILL.md (Codex skill catalog).`
+      );
+    } else if (tools.has('codex') && skills.length > 0 && !args.compact) {
+      console.log(
+        '  Codex: project skills at `.agents/skills/<name>/SKILL.md` (Agent Skills REPO scope).'
+      );
+      console.log(
+        `  Optional multi-project home copy: ${arkCommand(root, 'ark-check', '--install-agent-gates --codex-home')}`
+      );
+      console.log(
+        `  (writes $CODEX_HOME/skills; legacy flat prompts at ${codexPromptsDir()} are not the skill catalog).`
+      );
+      // Best-effort note when dead prompts still sit under the repo.
+      try {
+        const promptDir = path.join(root, '.codex', 'prompts');
+        if (fs.existsSync(promptDir)) {
+          const legacy = fs.readdirSync(promptDir).filter((n) => /^ark-[a-z0-9-]+\.md$/.test(n));
+          if (legacy.length > 0) {
+            console.log(
+              `  Note: ignoring ${legacy.length} legacy .codex/prompts/ark-*.md file(s) — not loadable as Codex skills.`
+            );
+          }
+        }
+      } catch {
+        // ignore
+      }
+    }
+  }
+
+  // Post-install: AGENTS.md /ark-* refs must exist in each selected host catalog.
+  // Compact routers intentionally omit those refs (package/MCP is the router).
+  if (!args.compact && skills.length > 0) {
+    const catalog = verifyHostSkillCatalog(root, tools, {
+      skillNames: skills.map(([name]) => name),
+    });
+    if (!catalog.ok) {
+      console.log('');
+      console.error(
+        `Skill catalog verification failed: ${catalog.missing.length} AGENTS.md /ark-* reference(s) missing from host catalogs.`
+      );
+      for (const miss of catalog.missing.slice(0, 12)) {
+        console.error(`  missing ${miss.tool}: ${miss.path}`);
+      }
+      if (catalog.missing.length > 12) {
+        console.error(`  …and ${catalog.missing.length - 12} more`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+    if (catalog.checkedTools.length > 0 && catalog.referenced.length > 0) {
+      console.log('');
+      console.log(
+        `Skill catalog verified: ${catalog.referenced.length} AGENTS.md /ark-* skill(s) present for ${catalog.checkedTools.join(', ')}.`
+      );
     }
   }
   warnLockfileConflict(root);

package/bin/lib/mcp-adoption.mjs

@@ -143,6 +143,14 @@ export function collectAdoptionGaps(root, config, coverage) {
         extras: [['.cursor/mcp.json', 'MCP config']],
         toolsFlag: 'cursor',
       },
+      {
+        host: 'codex',
+        dir: '.codex',
+        // Official Codex REPO skill catalog (Agent Skills standard) — not .codex/prompts.
+        skill: (n) => path.join(root, '.agents', 'skills', n, 'SKILL.md'),
+        extras: [['.codex/hooks.json', 'hooks']],
+        toolsFlag: 'codex',
+      },
     ];
     for (const h of hostChecks) {
       if (!fs.existsSync(path.join(root, h.dir))) continue;

package/bin/lib/policy-delta-io.mjs

@@ -0,0 +1,161 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { analyzePolicyDelta } from './analysis-engine.mjs';
+
+function readJsonFile(filePath, label) {
+  if (!fs.existsSync(filePath)) throw new Error(`${label} not found: ${filePath}`);
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch (error) {
+    throw new Error(
+      `${label} is not valid JSON (${filePath}): ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
+function runGit(cwd, args) {
+  return spawnSync('git', ['-C', cwd, ...args], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+}
+
+function safeRef(value) {
+  return (
+    typeof value === 'string' &&
+    /^[A-Za-z0-9][A-Za-z0-9._/-]{0,200}$/.test(value) &&
+    !value.includes('..')
+  );
+}
+
+export function normalizePolicyBaseRef(value) {
+  const ref = typeof value === 'string' ? value.trim() : '';
+  return /^0{40,64}$/.test(ref) ? '' : ref;
+}
+
+function repositoryRoot(root) {
+  const result = runGit(root, ['rev-parse', '--show-toplevel']);
+  return result.status === 0 ? result.stdout.trim() : null;
+}
+
+function discoverLocalBaseRef(root) {
+  const top = repositoryRoot(root);
+  if (!top) return null;
+  const remoteHead = runGit(top, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
+  const candidates = [
+    remoteHead.status === 0 ? remoteHead.stdout.trim() : null,
+    'origin/main',
+    'origin/master',
+  ].filter(Boolean);
+  const current = runGit(top, ['branch', '--show-current']);
+  const currentBranch = current.status === 0 ? current.stdout.trim() : '';
+
+  for (const candidate of candidates) {
+    if (!safeRef(candidate)) continue;
+    const exists = runGit(top, ['rev-parse', '--verify', `${candidate}^{commit}`]);
+    if (exists.status !== 0) continue;
+    if (currentBranch && candidate === `origin/${currentBranch}`) return null;
+    const mergeBase = runGit(top, ['merge-base', 'HEAD', candidate]);
+    if (mergeBase.status === 0 && safeRef(mergeBase.stdout.trim())) return mergeBase.stdout.trim();
+  }
+  return null;
+}
+
+function configPathInRepository(root, configPath, top) {
+  const requested = path.isAbsolute(configPath) ? configPath : path.resolve(root, configPath);
+  const absolute = fs.realpathSync(requested);
+  const canonicalTop = fs.realpathSync(top);
+  const relative = path.relative(canonicalTop, absolute).split(path.sep).join('/');
+  if (!relative || relative === '..' || relative.startsWith('../') || path.isAbsolute(relative)) {
+    throw new Error(`Policy config must be inside the Git repository: ${absolute}`);
+  }
+  return relative;
+}
+
+export function resolvePolicyBaseConfig({
+  root,
+  configPath,
+  basePath,
+  baseRef,
+  env = process.env,
+}) {
+  if (basePath) {
+    const absolute = path.isAbsolute(basePath) ? basePath : path.resolve(root, basePath);
+    return { config: readJsonFile(absolute, 'Policy base'), source: absolute, ref: null };
+  }
+
+  const envRef = normalizePolicyBaseRef(env.ARK_POLICY_BASE_REF);
+  const githubBase = typeof env.GITHUB_BASE_REF === 'string' ? env.GITHUB_BASE_REF.trim() : '';
+  const requestedRef = baseRef || envRef || (githubBase ? `origin/${githubBase}` : '');
+  const ref = requestedRef || discoverLocalBaseRef(root);
+  if (!ref) return null;
+  if (!safeRef(ref)) throw new Error(`Unsafe policy base ref: ${ref}`);
+
+  const top = repositoryRoot(root);
+  if (!top) {
+    // GitHub and ARK_POLICY_BASE_REF describe the process workspace, which may
+    // be different from an explicitly checked nested/temporary project root.
+    // Only the CLI flag is an unambiguous request to resolve this exact root.
+    if (baseRef) throw new Error(`Cannot resolve policy base ref outside a Git repository: ${ref}`);
+    return null;
+  }
+  const relativeConfig = configPathInRepository(root, configPath, top);
+  const result = runGit(top, ['show', `${ref}:${relativeConfig}`]);
+  if (result.status !== 0) {
+    const refExists = runGit(top, ['rev-parse', '--verify', `${ref}^{commit}`]);
+    // A newly adopted contract has no predecessor to weaken. CI-provided and
+    // auto-discovered bases may therefore omit the config; an explicit CLI ref
+    // remains fail-closed because the caller asked to compare that exact input.
+    if (refExists.status === 0 && !baseRef) return null;
+    if (requestedRef) {
+      throw new Error(
+        `Cannot read policy base ${ref}:${relativeConfig}: ${result.stderr.trim() || 'git show failed'}`
+      );
+    }
+    return null;
+  }
+  try {
+    return {
+      config: JSON.parse(result.stdout),
+      source: `git:${ref}:${relativeConfig}`,
+      ref,
+    };
+  } catch (error) {
+    throw new Error(
+      `Policy base ${ref}:${relativeConfig} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
+export function readPolicyAcknowledgement(root, acknowledgementPath) {
+  if (!acknowledgementPath) return undefined;
+  const absolute = path.isAbsolute(acknowledgementPath)
+    ? acknowledgementPath
+    : path.resolve(root, acknowledgementPath);
+  return readJsonFile(absolute, 'Policy acknowledgement');
+}
+
+export function analyzePolicyTransition({
+  root,
+  configPath,
+  candidateConfig,
+  strictMerge,
+  basePath,
+  baseRef,
+  acknowledgementPath,
+}) {
+  if (!strictMerge && !basePath && !baseRef && !acknowledgementPath) return undefined;
+  const base = resolvePolicyBaseConfig({ root, configPath, basePath, baseRef });
+  if (!base && (basePath || baseRef || acknowledgementPath)) {
+    throw new Error('Policy delta was requested but no policy base could be resolved.');
+  }
+  if (!base) return undefined;
+  return analyzePolicyDelta({
+    baseConfig: base.config,
+    candidateConfig,
+    acknowledgement: readPolicyAcknowledgement(root, acknowledgementPath),
+    baseSource: base.source,
+    candidateSource: path.isAbsolute(configPath) ? configPath : path.join(root, configPath),
+  });
+}