arkgate 3.0.4 → 3.1.0

package/bin/lib/weakest-link.mjs

@@ -48,6 +48,30 @@ export function detectPreCommitArk(root) {
   return { present, arkAware, path: hit };
 }
 
+/**
+ * Classify ark-check flags in a workflow or package script body.
+ * CLI: `--strict` and `--strict-merge` both set strictConfig + requireGates (fail-closed).
+ * `--strict-config` alone does not require gate files.
+ *
+ * @param {string} text
+ * @returns {{ hasFailClosedFlag: boolean, hasStrictConfigOnly: boolean, hasStrictFlag: boolean }}
+ */
+export function classifyArkCheckFlags(text) {
+  if (!text || typeof text !== 'string') {
+    return { hasFailClosedFlag: false, hasStrictConfigOnly: false, hasStrictFlag: false };
+  }
+  const hasStrictMerge = /--strict-merge\b/.test(text);
+  const hasRequireGates = /--require-gates\b/.test(text);
+  // Bare --strict (alias of --strict-merge), not --strict-config / already-matched merge.
+  const withoutLong = text.replace(/--strict-merge\b/g, ' ').replace(/--strict-config\b/g, ' ');
+  const hasBareStrict = /--strict\b/.test(withoutLong);
+  const hasFailClosedFlag = hasStrictMerge || hasRequireGates || hasBareStrict;
+  const hasStrictConfig = /--strict-config\b/.test(text);
+  const hasStrictConfigOnly = hasStrictConfig && !hasFailClosedFlag;
+  const hasStrictFlag = hasFailClosedFlag || hasStrictConfigOnly;
+  return { hasFailClosedFlag, hasStrictConfigOnly, hasStrictFlag };
+}
+
 /**
  * @param {string} root
  * @returns {{
@@ -56,6 +80,9 @@ export function detectPreCommitArk(root) {
  *   arkWorkflowFiles: string[],
  *   hasArkCheckWorkflow: boolean,
  *   hasStrictFlag: boolean,
+ *   hasFailClosedFlag: boolean,
+ *   hasStrictConfigOnly: boolean,
+ *   failClosed: boolean,
  *   hasArchitectureJobName: boolean,
  * }}
  */
@@ -67,6 +94,9 @@ export function detectCiEnforcement(root) {
     arkWorkflowFiles: [],
     hasArkCheckWorkflow: false,
     hasStrictFlag: false,
+    hasFailClosedFlag: false,
+    hasStrictConfigOnly: false,
+    failClosed: false,
     hasArchitectureJobName: false,
   };
   if (!out.hasWorkflowsDir) return out;
@@ -77,6 +107,19 @@ export function detectCiEnforcement(root) {
     return out;
   }
   out.workflowFiles = files;
+
+  let checkArchScript = '';
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    checkArchScript =
+      typeof pkg?.scripts?.['check:architecture'] === 'string'
+        ? pkg.scripts['check:architecture']
+        : '';
+  } catch {
+    checkArchScript = '';
+  }
+  const scriptFlags = classifyArkCheckFlags(checkArchScript);
+
   for (const f of files) {
     let text = '';
     try {
@@ -92,9 +135,19 @@ export function detectCiEnforcement(root) {
     if (mentionsArk) {
       out.hasArkCheckWorkflow = true;
       out.arkWorkflowFiles.push(`.github/workflows/${f}`);
-      if (/--strict\b/.test(text) || /check:architecture/.test(text)) {
+      const flags = classifyArkCheckFlags(text);
+      const viaScript = /check:architecture/.test(text) && scriptFlags.hasFailClosedFlag;
+      if (flags.hasFailClosedFlag || viaScript) {
+        out.hasFailClosedFlag = true;
+        out.failClosed = true;
+        out.hasStrictFlag = true;
+      } else if (flags.hasStrictConfigOnly) {
+        out.hasStrictConfigOnly = true;
+        out.hasStrictFlag = true;
+      } else if (flags.hasStrictFlag) {
         out.hasStrictFlag = true;
       }
+      // check:architecture without fail-closed flags in the script is NOT fail-closed.
       if (/architecture|ark-check|arkgate-check/i.test(f) || /name:\s*.*ark/i.test(text)) {
         out.hasArchitectureJobName = true;
       }
@@ -339,18 +392,14 @@ export function collectWeakestLinkGaps(root, opts = {}) {
         'CI workflows exist but none run ark-check / arkgate-check / check:architecture',
       fix: arkCommand(root, 'ark-check', '--install-agent-gates'),
     });
-  } else if (
-    adopted &&
-    !isProducer &&
-    ci.hasArkCheckWorkflow &&
-    !ci.hasStrictFlag
-  ) {
+  } else if (adopted && !isProducer && ci.hasArkCheckWorkflow && !ci.failClosed) {
     gaps.push({
-      id: 'enforcement-ci-not-strict',
-      severity: 'info',
-      message:
-        'Architecture CI job found but does not pass --strict / check:architecture (weaker than recommended)',
-      fix: 'Add --strict (or npm run check:architecture) to the architecture workflow step',
+      id: 'enforcement-ci-not-fail-closed',
+      severity: 'warn',
+      message: ci.hasStrictConfigOnly
+        ? 'Architecture CI uses --strict-config only (config coverage without gate-file presence). Prefer the fail-closed profile.'
+        : 'Architecture CI job found but does not use the fail-closed profile (--strict-merge / --strict / --require-gates)',
+      fix: 'ark-check --root . --config ark.config.json --strict-merge --baseline .ark-baseline.json',
     });
   }
 

package/bin/lib/write-path-capabilities.mjs

@@ -25,6 +25,66 @@ export const WRITE_CAPABILITY_NAMES = [
   'repair-payload',
 ];
 
+function boundaryState({ supported, evidence, active, bypassable, hard = false, extra = {} }) {
+  return {
+    supported,
+    installed: evidence.length > 0,
+    active,
+    bypassable,
+    hard,
+    evidence: [...evidence],
+    ...extra,
+  };
+}
+
+function operationCovered(profile, operation) {
+  if (!profile || typeof operation !== 'string') return false;
+  const normalized = operation.trim().toLowerCase();
+  return profile.hookOperations.some((candidate) => candidate.toLowerCase() === normalized);
+}
+
+function buildEnforcementLadder(activeHost, support, evidence, attempt) {
+  const localInstalled = evidence['hard-write'].length > 0;
+  const observedPreTool = attempt?.boundary === 'pre-tool';
+  const covered = observedPreTool && operationCovered(support, attempt.operation);
+  const hard = Boolean(
+    support?.capabilities['hard-write'] && (localInstalled || observedPreTool) && covered
+  );
+  const inferredActive = (installed) => (installed ? 'unverified' : false);
+  return {
+    schemaVersion: '1.0',
+    activeHost,
+    localWrite: boundaryState({
+      supported: Boolean(support?.capabilities['hard-write']),
+      evidence: evidence['hard-write'],
+      active: observedPreTool ? covered : inferredActive(localInstalled),
+      bypassable: !hard,
+      hard,
+      extra: {
+        installed: localInstalled || observedPreTool,
+        completePatch: Boolean(covered && attempt?.completePatch),
+        coverage: covered && attempt?.completePatch ? 'complete-patch' : support?.hookSurface ?? null,
+        ...(observedPreTool
+          ? { operation: attempt.operation, operationCovered: covered }
+          : { operationCovered: 'unverified' }),
+      },
+    }),
+    advisoryMcp: boundaryState({
+      supported: Boolean(support?.capabilities['advisory-write']),
+      evidence: evidence['advisory-write'],
+      active: inferredActive(evidence['advisory-write'].length > 0),
+      bypassable: true,
+    }),
+    ciMerge: boundaryState({
+      supported: true,
+      evidence: evidence['merge-gate'],
+      active: inferredActive(evidence['merge-gate'].length > 0),
+      bypassable: 'unknown',
+      extra: { requiredStatus: 'unverified' },
+    }),
+  };
+}
+
 const KNOWN_HOSTS = HOST_SUPPORT_HOSTS;
 
 function unique(values) {
@@ -121,7 +181,9 @@ function hostRecord(hard, advisory, repair, merge) {
 }
 
 export function detectWritePathInventory(root) {
-  const merge = detectCiEnforcement(root).arkWorkflowFiles;
+  // Merge-gate evidence only when CI uses the fail-closed profile (not bare ark-check).
+  const ci = detectCiEnforcement(root);
+  const merge = ci.failClosed ? ci.arkWorkflowFiles : [];
   const claudeHook = hookEvidence(root, '.claude/settings.json');
   const grokHook = hookEvidence(root, '.grok/hooks/ark-write-gate.json');
   const hosts = {
@@ -162,7 +224,7 @@ export function detectWritePathInventory(root) {
   };
 }
 
-export function buildWritePathCapabilityModel(root, explicitHost) {
+export function buildWritePathCapabilityModel(root, explicitHost, attempt) {
   const inventory = detectWritePathInventory(root);
   const detectedHost = explicitHost ?? detectActiveAgentHost();
   const activeHost = KNOWN_HOSTS.includes(detectedHost) ? detectedHost : 'unknown';
@@ -181,6 +243,12 @@ export function buildWritePathCapabilityModel(root, explicitHost) {
     support: getHostSupportProfile(activeHost),
     capabilities: capabilityMap(capabilityEvidence),
     capabilityEvidence,
+    enforcementLadder: buildEnforcementLadder(
+      activeHost,
+      getHostSupportProfile(activeHost),
+      capabilityEvidence,
+      attempt
+    ),
     inventory,
   };
 }

package/bin/lib/write-path-detect.mjs

@@ -15,9 +15,9 @@ function installToolsForHost(activeHost) {
     : activeHost;
 }
 
-export function detectWritePathCapabilities(root, explicitHost) {
-  const model = buildWritePathCapabilityModel(root, explicitHost);
-  const { activeHost, support, capabilities, capabilityEvidence, inventory } = model;
+export function detectWritePathCapabilities(root, explicitHost, attempt) {
+  const model = buildWritePathCapabilityModel(root, explicitHost, attempt);
+  const { activeHost, support, capabilities, capabilityEvidence, enforcementLadder, inventory } = model;
   const hardWrite = capabilities['hard-write'];
   const advisoryWrite = capabilities['advisory-write'];
   const repairPayload = capabilities['repair-payload'];
@@ -72,17 +72,23 @@ export function detectWritePathCapabilities(root, explicitHost) {
       ),
     };
   } else if (mode === 'mcp-only') {
+    const codexHonesty =
+      activeHost === 'codex'
+        ? 'Codex local write is advisory (MCP + best-effort hooks.json — not a hard boundary; ' +
+          'not equivalent to Claude/Grok PreToolUse hard-write + repair). ' +
+          'The hard merge backstop is CI --strict-merge plus a required status check.'
+        : `Active host ${activeHost} has advisory prepare-write/autoPatch tools, ` +
+          'but no hard write boundary; the CI check can still reject the change before merge.';
     gap = {
       id: 'write-path-mcp-only',
       severity: 'info',
-      message:
-        `Active host ${activeHost} has advisory prepare-write/autoPatch tools, ` +
-        'but no hard write boundary; the CI check can still reject the change before merge.',
-      fix: arkCommand(
-        root,
-        'ark-check',
-        `--install-agent-gates --tools ${tools}`
-      ),
+      host: activeHost,
+      message: codexHonesty,
+      fix:
+        activeHost === 'codex'
+          ? 'Keep CI on --strict-merge and require the ark-check status on the default branch; ' +
+            `refresh Codex MCP/skills with ${arkCommand(root, 'ark-check', '--install-agent-gates --tools codex')}`
+          : arkCommand(root, 'ark-check', `--install-agent-gates --tools ${tools}`),
     };
   }
 
@@ -92,6 +98,7 @@ export function detectWritePathCapabilities(root, explicitHost) {
     supportSummary: formatHostSupportSummary(support),
     capabilities,
     capabilityEvidence,
+    enforcementLadder,
     inventory,
     // Compatibility projection for existing doctor/API consumers.
     mode,