arkgate 4.1.0 → 4.1.1

package/CHANGELOG.md

@@ -5,7 +5,51 @@ in the immutable pre-2.0 archive linked below.
 
 ## Unreleased
 
-## 4.1.0 — 2026-07-25 (prepared)
+## 4.1.1 — 2026-07-25 (prepared)
+
+**Patch** over 4.1.0. Phase EH — enforcement evidence modeling + documentation truth (field Codex
+feedback + public-lane claims audit). Honesty and doctor/CI evidence taxonomy; first-push-safe CI
+base-ref; report `.gitignore` coverage without defeating `!` exceptions. **No required config
+migration.** Does not invent hard-write for Codex/Cursor/OpenCode. Does not close Z09 / RB-11.
+**Status: prepared** (not on npm until publish).
+
+### Added
+
+- **Doctor readiness split (EH05):** `productHonesty` separates contract/project readiness from
+  permanent soft-write host posture. Soft-write alone no longer forces global `Not finished`;
+  evidence keeps `soft-write-host` under `environmentResidualIds` with composite headline
+  (e.g. “Architecture contract ready; Codex local writes are advisory”) and an actionable
+  `primaryNextAction` pointing at the required GitHub status context.
+- **Fields:** `contractReadiness`, `localWriteBoundary`, `architectureReasonIds`,
+  `environmentResidualIds` / `environmentResiduals` on `productHonesty` (additive JSON).
+- **Provider policy reason (EH06):** GitHub Free/private branch-protection HTTP 403 →
+  `provider-policy-unavailable-plan` / `unavailable-plan` (not only generic
+  `provider-enforcement-unverified`).
+- **CI runtime observation (EH06):** successful Actions runs can set `runtimeObserved: true`
+  independent of branch-protection API; `hard: false` when status is not required.
+- **Repair envelope vs reinjection (EH07):** host matrix capabilities
+  `repair-envelope-emitted` / `repair-reinjection-guaranteed`; Codex emits envelope
+  (`--hook-repair`) without reinjection guarantee; minimum ops coverage
+  (`apply_patch` / `shell` / `pre-commit` → hard=false).
+- **Claims matrix refresh (EH01):** `docs/audit/claims-matrix.md` dated 2026-07-25.
+
+### Fixed
+
+- **Report `.gitignore` (EH03):** recognizes `.ark/*`, `/.ark/*`, `.ark/reports/` as coverage;
+  never appends broad `.ark/` after a narrower policy with `!` exceptions
+  (e.g. `!/.ark/golden-pattern.json`).
+- **First-push CI base-ref (EH04):** generated workflow + Action clear all-zero
+  `github.event.before` and only pass `--fail-on-new-smells --base-ref` when
+  `git cat-file -e "${REF}^{commit}"` succeeds; otherwise full `--strict-merge` without delta.
+
+### Improved
+
+- **CLI vs status context copy (EH07):** user-facing text distinguishes `arkgate-check` /
+  `ark-check` CLI from the GitHub **required status context** name.
+- **Public lanes (EH02/EH08):** README host matrix, product-voice, ai-gates CI snippet, use/develop
+  honesty wording aligned with EH behavior; 0 Contradicted on public lanes.
+
+## 4.1.0 — 2026-07-25 (published)
 
 **Minor** over 4.0.1. Single ship train: field product phases + field-gap closure (S0–S7) +
 maintainer CI PR-slim / full-matrix speed work. Field product phases from Next monorepo dogfood +
@@ -15,7 +59,7 @@ write-root split, SPA/lib classification vacuum fixes, ESLint path-alias parity,
 false-positive tuning, ArkRules merge-plane honesty, type-edge placement debt, rules-inventory
 UI noise reduction, migrate-contract retrofit, and config write containment.
 **No required config migration.** Does not weaken write gate or CI value edges. Does not close
-Z09 / RB-11 field claims. **Status: prepared** (not on npm until publish).
+Z09 / RB-11 field claims. **Status: published** (`arkgate@4.1.0` on npm `latest` at ship time).
 
 ### Added
 

package/README.md

@@ -16,9 +16,8 @@ and makes sure a “green” check means something real.
 
 </div>
 
-> **ArkGate 4.0.1** is on npm `latest` (stale global CLI upgrade guard + ArkRules HTML/docs honesty).
-> **Next prepared:** [4.1.0](docs/releases/4.1.0.md) (field product train + CI PR slim — not published until registry).
-> [4.0.1 notes](docs/releases/4.0.1.md) · [Docs hub](docs/README.md) · [Product voice](docs/product-voice.md)
+> **ArkGate 4.1.0** is on npm `latest`. Tree prepares **4.1.1** (Phase EH honesty + CI/report fixes) — [4.1.1 notes](docs/releases/4.1.1.md) (**prepared**, not on npm until publish).
+> [4.1.0 notes](docs/releases/4.1.0.md) · [4.0.1](docs/releases/4.0.1.md) · [Docs hub](docs/README.md) · [Product voice](docs/product-voice.md)
 
 ---
 
@@ -99,17 +98,18 @@ Details: [docs/use.md](docs/use.md).
 <!-- arkgate-host-support:start -->
 | Host | Local write boundary | MCP validation | CI / merge path | Repair payload |
 |------|----------------------|----------------|-----------------|----------------|
-| Claude Code | **Hard** block for listed ops (PreToolUse `Write` / `Edit` / `MultiEdit`) when installed + trusted | Advisory; the agent must call it | **Required status** = hard merge boundary (`arkgate-check --strict-merge`) | Emitted on hook deny; host must re-inject |
-| Grok Build | **Hard** block for listed ops (PreToolUse `write` / `search_replace` (plus aliases)) when installed + trusted | Advisory; the agent must call it | **Required status** = hard merge boundary (`arkgate-check --strict-merge`) | Emitted on hook deny; host must re-inject |
-| Google Antigravity | **Hard** block for listed ops (PreToolUse `write_to_file` / `replace_file_content` / `multi_replace_file_content`) when installed + trusted | Advisory; the agent must call it | **Required status** = hard merge boundary (`arkgate-check --strict-merge`) | Emitted on hook deny; host must re-inject |
-| Cursor | **Advisory only** at write (no hard hook) | Advisory; the agent must call it | **Required status** = hard merge boundary (same CI) | No hard-boundary payload |
-| OpenAI Codex | **Advisory / best-effort** at write (not equivalent to Claude/Grok hard block) | Advisory; the agent must call it | **Required status** = hard merge boundary (same CI) | No hard-boundary payload |
-| OpenCode | **Advisory / best-effort** at write (MCP + optional plugin; not a hard boundary) | Advisory; the agent must call it | **Required status** = hard merge boundary (same CI) | No hard-boundary payload |
+| Claude Code | **Hard** block for listed ops (PreToolUse `Write` / `Edit` / `MultiEdit`) when installed + trusted | Advisory; the agent must call it | **Required GitHub status context** running `arkgate-check --strict-merge` (alias `ark-check`) | Emitted on hook deny; host must re-inject (hard path when installed + trusted) |
+| Grok Build | **Hard** block for listed ops (PreToolUse `write` / `search_replace` (plus aliases)) when installed + trusted | Advisory; the agent must call it | **Required GitHub status context** running `arkgate-check --strict-merge` (alias `ark-check`) | Emitted on hook deny; host must re-inject (hard path when installed + trusted) |
+| Google Antigravity | **Hard** block for listed ops (PreToolUse `write_to_file` / `replace_file_content` / `multi_replace_file_content`) when installed + trusted | Advisory; the agent must call it | **Required GitHub status context** running `arkgate-check --strict-merge` (alias `ark-check`) | Emitted on hook deny; host must re-inject (hard path when installed + trusted) |
+| Cursor | **Advisory only** at write (no hard hook) | Advisory; the agent must call it | **Required GitHub status context** running `arkgate-check --strict-merge` (alias `ark-check`) | No hard-boundary payload |
+| OpenAI Codex | **Advisory / best-effort** at write (not equivalent to Claude/Grok hard block) | Advisory; the agent must call it | **Required GitHub status context** running `arkgate-check --strict-merge` (alias `ark-check`) | Envelope may emit (`--hook-repair`); reinjection **not** guaranteed (advisory host) |
+| OpenCode | **Advisory / best-effort** at write (MCP + optional plugin; not a hard boundary) | Advisory; the agent must call it | **Required GitHub status context** running `arkgate-check --strict-merge` (alias `ark-check`) | No hard-boundary payload |
 
 **Read the CI column:** for every host, the repository-wide hard guarantee is a **required**
-merge check — not “CI file present.” Cursor/Codex/OpenCode never get a fake hard write claim.
+GitHub **status context** that runs the CLI — not “CI file present,” and not the CLI binary name alone.
+Cursor/Codex/OpenCode never get a fake hard write claim.
 
-This table describes the supported profile **after its files are installed and the host loads/trusts them**. A hard local boundary covers only the listed hook operations; alternate tools, direct filesystem writes, and human edits still rely on CI. MCP validation is advisory because the agent must call it. The CI check blocks a merge only when the repository makes that status required. Repair payloads never write code silently: the host must re-inject the candidate and ArkGate revalidates it. Run `arkgate-check --doctor` for the evidence actually detected in the current repository.
+This table describes the supported profile **after its files are installed and the host loads/trusts them**. A hard local boundary covers only the listed hook operations; alternate tools, direct filesystem writes, and human edits still rely on CI. MCP validation is advisory because the agent must call it. The CI check blocks a merge only when the repository makes that status required. Repair **envelopes** may be emitted without reinjection being guaranteed; silent auto-apply never happens. Run `arkgate-check --doctor` (or `ark-check --doctor`) for the evidence actually detected in the current repository.
 <!-- arkgate-host-support:end -->
 
 #### Why the hard guarantee lives at the merge gate
@@ -186,8 +186,7 @@ for real systems. Details: [docs/production-hardening.md](docs/production-harden
 | Config · package surface · TS | [configuration](docs/configuration.md) · [package-surface](docs/package-surface.md) · [typescript-support](docs/typescript-support.md) |
 | Brownfield | [docs/brownfield-adoption.md](docs/brownfield-adoption.md) |
 | Security | [SECURITY.md](SECURITY.md) |
-| Current published (4.0.1) | [docs/releases/4.0.1.md](docs/releases/4.0.1.md) · [CHANGELOG](CHANGELOG.md) |
-| Next prepared (4.1.0) | [docs/releases/4.1.0.md](docs/releases/4.1.0.md) — not on npm until publish |
+| Current published (4.1.0) | [docs/releases/4.1.0.md](docs/releases/4.1.0.md) · [CHANGELOG](CHANGELOG.md) |
 | Previous (4.0.0) | [docs/releases/4.0.0.md](docs/releases/4.0.0.md) |
 | Previous (3.9.2) | [docs/releases/3.9.2.md](docs/releases/3.9.2.md) |
 | History / maintainer evidence | [docs/archive/](docs/archive/README.md) |

package/bin/lib/ark-gitignore.mjs

@@ -0,0 +1,88 @@
+/**
+ * Ark report / local-state .gitignore coverage (EH03).
+ * Extracted from html-report.mjs to keep that module under its LOC budget.
+ */
+
+/**
+ * Whether .gitignore already covers Ark local state / reports.
+ * Exact-line equality is insufficient: `.ark/*`, `/.ark/*`, and `.ark/reports/`
+ * (and common gitignore variants) already cover report output.
+ *
+ * @param {string} text
+ * @returns {boolean}
+ */
+export function gitignoreCoversArkState(text) {
+  const lines = String(text || '')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && !line.startsWith('#'));
+
+  /** Patterns that cover the whole `.ark` tree or its report subtree. */
+  const cover = new Set([
+    '.ark',
+    '.ark/',
+    '/.ark',
+    '/.ark/',
+    '**/.ark',
+    '**/.ark/',
+    '.ark/*',
+    '/.ark/*',
+    '**/.ark/*',
+    '.ark/**',
+    '/.ark/**',
+    '**/.ark/**',
+    '.ark/reports',
+    '.ark/reports/',
+    '/.ark/reports',
+    '/.ark/reports/',
+    '.ark/reports/*',
+    '/.ark/reports/*',
+    '**/.ark/reports',
+    '**/.ark/reports/',
+    '**/.ark/reports/*',
+    '.ark/reports/**',
+    '/.ark/reports/**',
+  ]);
+
+  for (const line of lines) {
+    if (line.startsWith('!')) continue;
+    if (cover.has(line)) return true;
+    if (cover.has(`${line}/`) || cover.has(line.replace(/\/$/, ''))) return true;
+  }
+  return false;
+}
+
+/**
+ * Whether .gitignore already has a `!` exception under `.ark` (narrower policy).
+ * Appending a broad `.ark/` after such a policy defeats tracked golden-pattern exceptions.
+ *
+ * @param {string} text
+ * @returns {boolean}
+ */
+export function gitignoreHasArkNegationException(text) {
+  return String(text || '')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .some((line) => line.startsWith('!') && /(^|\/)\.ark(\/|$|\b)/.test(line.slice(1)));
+}
+
+/**
+ * Decide whether report archiving should append a .gitignore rule (EH03).
+ * - Already covered → do not mutate.
+ * - Has `!` exceptions under `.ark` without full cover → append **narrow**
+ *   `.ark/reports/` only (never broad `.ark/`, which would defeat exceptions).
+ * - Otherwise → append `.ark/`.
+ *
+ * @param {string} text
+ * @returns {{ append: boolean, rule: string|null, reason: string }}
+ */
+export function arkGitignoreAppendDecision(text) {
+  if (gitignoreCoversArkState(text)) {
+    return { append: false, rule: null, reason: 'already-covered' };
+  }
+  if (gitignoreHasArkNegationException(text)) {
+    // Narrow reports-only ignore keeps !/.ark/golden-pattern.json (etc.) working.
+    return { append: true, rule: '.ark/reports/', reason: 'append-narrow-reports' };
+  }
+  return { append: true, rule: '.ark/', reason: 'append-broad' };
+}

package/bin/lib/ci-and-commands.mjs

@@ -573,6 +573,22 @@ ${nodeSetup}
 ${qualityBlock ? `${qualityBlock}\n` : ''}      - name: Ark architecture check
         env:
           ARK_POLICY_BASE_REF: \${{ github.event.pull_request.base.sha || github.event.before }}
-        run: ${pm.run} --fail-on-new-smells --base-ref "\${{ github.event.pull_request.base.sha || github.event.before }}"
+        run: |
+          set -euo pipefail
+          # EH04: first push uses all-zero github.event.before — skip delta smells, keep full merge gate.
+          BASE_REF="\${ARK_POLICY_BASE_REF:-}"
+          if [[ "\$BASE_REF" =~ ^0{40,64}$ ]]; then
+            BASE_REF=""
+          fi
+          if [ -n "\$BASE_REF" ] && ! git cat-file -e "\${BASE_REF}^{commit}" 2>/dev/null; then
+            git fetch --no-tags --depth=1 origin "\$BASE_REF" 2>/dev/null || true
+          fi
+          if [ -n "\$BASE_REF" ] && git cat-file -e "\${BASE_REF}^{commit}" 2>/dev/null; then
+            export ARK_POLICY_BASE_REF="\$BASE_REF"
+            ${pm.run} --fail-on-new-smells --base-ref "\$BASE_REF"
+          else
+            export ARK_POLICY_BASE_REF=""
+            ${pm.run}
+          fi
 `;
 }

package/bin/lib/doctor-plan.mjs

@@ -833,7 +833,7 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
       productHonesty.unfinished ? warn : ok,
       `${productHonesty.headline} — ${productHonesty.primaryMessage}`
     );
-    if (productHonesty.unfinished && Array.isArray(productHonesty.reasonIds) && productHonesty.reasonIds.length > 0) {
+    if (Array.isArray(productHonesty.reasonIds) && productHonesty.reasonIds.length > 0) {
       line(' ', color.dim(`signals: ${productHonesty.reasonIds.join(', ')} (notAScore)`));
     }
     if (rulesUnderContract?.mergePlanes?.failMergeWhen) {
@@ -1045,9 +1045,17 @@ export function runDoctor(root, config, files, rules, violations, asJson, option
   }
   const enforcement = writePath.enforcementState;
   for (const row of enforcementDoctorLines(enforcement)) line(row.level === 'ok' ? ok : row.level === 'bad' ? bad : warn, row.text);
+  // EH07 Repair: use support/matrix caps (inventory omits envelope-emitted on Codex).
+  const supportCaps = writePath.support?.capabilities || {};
+  const repairReinjection = supportCaps['repair-reinjection-guaranteed'] === true;
+  const repairEnvelope = supportCaps['repair-envelope-emitted'] === true || supportCaps['repair-payload'] === true;
   line(
-    capabilities['repair-payload'] ? ok : warn,
-    `Repair payload at hard boundary: ${capabilities['repair-payload'] ? 'yes' : 'no'}`
+    repairReinjection ? ok : warn,
+    repairReinjection
+      ? 'Repair: envelope + reinjection guaranteed on hard path when installed + trusted'
+      : repairEnvelope
+        ? 'Repair: envelope may emit (`--hook-repair`); reinjection not guaranteed (advisory host)'
+        : 'Repair: no hard-boundary payload'
   );
   if (writePath.gap) {
     line(writePath.gap.severity === 'warn' ? warn : warn, writePath.gap.message);

package/bin/lib/enforcement-honesty.mjs

@@ -207,7 +207,8 @@ export function buildWritePathHonesty(activeHost, hardWriteActive = false, extra
     hardWriteSupported: hardCapable,
     hardWriteActive: effectiveHard,
     hardWriteUnverified: hardCapable && !effectiveHard,
-    hardMergeBoundary: 'required-ci-status (arkgate-check --strict-merge)',
+    hardMergeBoundary:
+      'required-github-status-context (CLI: arkgate-check --strict-merge / ark-check --strict-merge)',
     packageInstalled,
     packagePinAbsent: pinAbsentForUser,
     ...(pinCode ? { packagePinCode: pinCode } : {}),
@@ -367,10 +368,15 @@ export function buildProductHonesty(input = {}) {
     });
   }
 
+  // EH05: soft-write-host is a permanent host posture residual — keep in evidence,
+  // do NOT alone force architecture "Not finished". Reclassified out of contract debt.
   if (write?.softWriteHost) {
     reasons.push({
       id: 'soft-write-host',
-      message: write.message || 'Local write is advisory; required CI status is the hard merge boundary.',
+      bucket: 'environment',
+      message:
+        write.message ||
+        'Local write is advisory; hard merge boundary = a required GitHub status context running arkgate-check --strict-merge (alias ark-check --strict-merge).',
     });
   }
 
@@ -399,7 +405,13 @@ export function buildProductHonesty(input = {}) {
     // Informational only when no enforced arkrule plane — does not alone make unfinished.
   }
 
-  const unfinished = reasons.length > 0;
+  // EH05: environment residual deny-list (future reason ids stay architecture debt by default).
+  const ENVIRONMENT_REASON_IDS = new Set(['soft-write-host']);
+
+  const environmentResiduals = reasons.filter((r) => ENVIRONMENT_REASON_IDS.has(r.id));
+  const architectureReasons = reasons.filter((r) => !ENVIRONMENT_REASON_IDS.has(r.id));
+  // unfinished = any non-environment residual (deny-list env, not allowlist architecture)
+  const unfinished = architectureReasons.length > 0;
   const wholeTreeGoverned = wholeTreeGovernedEarly;
   const coverageIncomplete =
     cov?.status === 'empty-scope' ||
@@ -407,31 +419,56 @@ export function buildProductHonesty(input = {}) {
     cov?.greenIsNotEnforcement === true ||
     !wholeTreeGoverned;
 
+  const softWriteOnly =
+    !unfinished && environmentResiduals.some((r) => r.id === 'soft-write-host');
+  const hostLabel = (() => {
+    const h = typeof write?.activeHost === 'string' ? write.activeHost.trim().toLowerCase() : '';
+    if (h === 'codex') return 'Codex';
+    if (h === 'cursor') return 'Cursor';
+    if (h === 'opencode') return 'OpenCode';
+    if (h) return h;
+    return 'this host';
+  })();
+
   const primary =
-    reasons.find((r) => r.id === 'active-blocking-violations') ||
-    reasons.find((r) => r.id === 'mode-adapt-with-debt') ||
-    reasons.find((r) => r.id === 'mode-suggest-with-debt') ||
-    reasons.find((r) => r.id === 'design-weak') ||
-    reasons.find((r) => r.id === 'design-smells-open-edges') ||
-    reasons.find((r) => r.id === 'coverage-weak-or-empty') ||
-    reasons.find((r) => r.id === 'dirty-freeze') ||
-    reasons.find((r) => r.id === 'package-version-dual-truth') ||
-    reasons.find((r) => r.id === 'package-pin-absent') ||
-    reasons.find((r) => r.id === 'baseline-missing-with-debt') ||
-    reasons.find((r) => r.id === 'residual-pilot') ||
-    reasons[0];
+    architectureReasons.find((r) => r.id === 'active-blocking-violations') ||
+    architectureReasons.find((r) => r.id === 'mode-adapt-with-debt') ||
+    architectureReasons.find((r) => r.id === 'mode-suggest-with-debt') ||
+    architectureReasons.find((r) => r.id === 'design-weak') ||
+    architectureReasons.find((r) => r.id === 'design-smells-open-edges') ||
+    architectureReasons.find((r) => r.id === 'coverage-weak-or-empty') ||
+    architectureReasons.find((r) => r.id === 'dirty-freeze') ||
+    architectureReasons.find((r) => r.id === 'package-version-dual-truth') ||
+    architectureReasons.find((r) => r.id === 'package-pin-absent') ||
+    architectureReasons.find((r) => r.id === 'baseline-missing-with-debt') ||
+    architectureReasons.find((r) => r.id === 'residual-pilot') ||
+    architectureReasons[0] ||
+    environmentResiduals[0];
 
-  const primaryMessage = unfinished
-    ? primary?.message ||
-      'Not finished: residual honesty signals remain (violations, mode, coverage, freeze, design, package pin, or pilots).'
-    : wholeTreeGoverned
-      ? 'No residual honesty blockers on this slice — still not a numeric architecture score; re-doctor after material change.'
-      : 'No residual honesty blockers flagged — green is only as wide as the governed slice.';
+  let primaryMessage;
+  if (unfinished) {
+    primaryMessage =
+      primary?.message ||
+      'Not finished: residual honesty signals remain (violations, mode, coverage, freeze, design, package pin, or pilots).';
+  } else if (softWriteOnly) {
+    primaryMessage = `${hostLabel} local writes stay advisory/bypassable; architecture contract on this slice is ready. Hard merge boundary is a required GitHub status context running arkgate-check --strict-merge (alias ark-check --strict-merge).`;
+  } else if (wholeTreeGoverned) {
+    primaryMessage =
+      'No residual honesty blockers on this slice — still not a numeric architecture score; re-doctor after material change.';
+  } else {
+    primaryMessage =
+      'No residual honesty blockers flagged — green is only as wide as the governed slice.';
+  }
 
   // P0B-HEADLINE: dual-truth / pin-only unfinished must not claim "not whole-tree"
   // when the governed tree is already 100%.
+  // EH05: soft-write alone → composite readiness headline, never global "Not finished".
   let headline;
-  if (!unfinished) {
+  if (!unfinished && softWriteOnly) {
+    headline = wholeTreeGoverned
+      ? `Architecture contract ready; ${hostLabel} local writes are advisory`
+      : `Contract residual clear; ${hostLabel} local writes are advisory`;
+  } else if (!unfinished) {
     headline = 'Honesty clear on residual signals';
   } else if (coverageIncomplete) {
     headline = 'Not finished / not whole-tree guarantee';
@@ -440,6 +477,7 @@ export function buildProductHonesty(input = {}) {
   }
 
   // Prefer caller next action; dual-truth / pin-absent get install/pin path when empty.
+  // Soft-write-only must not leave a failure headline with null next action (EH05).
   let primaryNextAction = input.primaryNextAction || null;
   if (!primaryNextAction && dualTruth) {
     const ver = input.packageVersionTruth?.cliVersion;
@@ -449,8 +487,20 @@ export function buildProductHonesty(input = {}) {
   } else if (!primaryNextAction && pinAbsent) {
     primaryNextAction =
       'Add arkgate to package.json and install so CI/npx resolve this CLI (PACKAGE_PIN_ABSENT)';
+  } else if (!primaryNextAction && softWriteOnly) {
+    primaryNextAction =
+      'Confirm the GitHub required status context name runs arkgate-check --strict-merge (or ark-check --strict-merge). Soft-write hosts stay advisory at local write; the required status is the hard merge boundary.';
   }
 
+  const contractReadiness = unfinished ? 'not-ready' : wholeTreeGoverned ? 'ready' : 'partial';
+  const localWriteBoundary = write?.softWriteHost
+    ? 'advisory'
+    : write?.hardWriteActive
+      ? 'hard'
+      : write?.hardWriteSupported
+        ? 'unverified'
+        : 'unknown';
+
   return {
     finished: !unfinished && wholeTreeGoverned && !designWeak && activeBlocking === 0,
     elegant: !designWeak && !base?.dirtyBaselineRisk && !designSmellsOpenEdges && activeBlocking === 0,
@@ -462,8 +512,14 @@ export function buildProductHonesty(input = {}) {
       activeBlocking === 0,
     unfinished,
     notAScore: true,
+    // Full evidence including soft-write-host (reclassified, not silenced)
     reasonIds: reasons.map((r) => r.id),
     reasons,
+    architectureReasonIds: architectureReasons.map((r) => r.id),
+    environmentResidualIds: environmentResiduals.map((r) => r.id),
+    environmentResiduals,
+    contractReadiness,
+    localWriteBoundary,
     primaryMessage,
     primaryNextAction,
     headline,

package/bin/lib/enforcement-state.mjs

@@ -1,2 +1,2 @@
 // Generated from enforcement-state.source.mjs — run npm run generate:packaged-tooling.
-import b from"node:fs";import{createRequire as q}from"node:module";import h from"node:path";const n="unverified";function S(a){const e=h.join(a,"package.json");try{if(JSON.parse(b.readFileSync(e,"utf8"))?.name==="arkgate"&&b.statSync(h.join(a,"bin","ark-check.mjs"),{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"package.json + bin/ark-check.mjs (self-host)",selfHost:!0}}catch{}try{const r=q(e).resolve("arkgate/package.json"),o=h.dirname(r),t=JSON.parse(b.readFileSync(r,"utf8")),l=h.join(o,"bin","ark-check.mjs");if(t?.name==="arkgate"&&b.statSync(l,{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"arkgate/package.json via project resolver",selfHost:!1}}catch{}return{installed:!1,source:"arkgate/package.json unresolved from project",selfHost:!1}}function M(a){return a.length>0?a:["filesystem scan (no matching configuration)"]}function y({supported:a,configuredPaths:e,installed:r,active:o,runtimeObserved:t,operation:l,operationCoverage:d,bypassable:u,required:c,hard:i,sources:s}){const p=e.length>0,v=!!r.installed;return{supported:a,analyzed:!0,configured:p,installed:v,active:o,runtimeObserved:t,operation:l,operationCoverage:d,bypassable:u,required:c,hard:i,evidence:[...M(e).map(g=>({field:"configured",source:g,value:p})),{field:"installed",source:r.source,value:v},{field:"active",source:s.active,value:o},{field:"runtimeObserved",source:s.runtimeObserved,value:t},{field:"operationCoverage",source:s.operationCoverage,value:d},{field:"bypassable",source:s.bypassable,value:u},{field:"required",source:s.required,value:c},{field:"hard",source:s.hard,value:i}]}}function O(a,e){const r=S(a),o=!!e.support?.capabilities?.["hard-write"],t=!!e.support?.capabilities?.["advisory-write"],l=e.capabilityEvidence["hard-write"],d=e.capabilityEvidence["advisory-write"],u=e.capabilityEvidence["merge-gate"],c=e.enforcementLadder.localWrite,i=typeof c.operationCovered=="boolean",s=i?c.operationCovered:n,p=i&&s===!0,v=!!(o&&r.installed&&p&&c.hard===!0),g=i?p&&r.installed:o&&l.length>0&&r.installed?n:!1,k=t&&d.length>0&&r.installed?n:!1,f=!!(e.ci?.failClosed&&u.length>0),C=f&&r.installed?n:!1;return{schemaVersion:"1.1",activeHost:e.activeHost,localWrite:y({supported:o,configuredPaths:l,installed:r,active:g,runtimeObserved:i,operation:i?c.operation??null:null,operationCoverage:s,bypassable:v?!1:o&&!i?n:!0,required:n,hard:v,sources:{active:i?"observed PreToolUse attempt":"runtime observation unavailable",runtimeObserved:i?"fresh PreToolUse invocation":"runtime observation unavailable",operationCoverage:i?"active-host operation matcher":"operation not observed",bypassable:v?"observed hard write boundary":"host runtime bypass evidence unavailable",required:"local host policy unavailable",hard:v?"fresh covered active-host invocation":"hardness not proven for this invocation"}}),advisoryMcp:y({supported:t,configuredPaths:d,installed:r,active:k,runtimeObserved:!1,operation:null,operationCoverage:n,bypassable:!0,required:n,hard:!1,sources:{active:"MCP runtime observation unavailable",runtimeObserved:"doctor did not observe an MCP tool invocation",operationCoverage:"advisory MCP is caller-invoked",bypassable:"advisory MCP does not intercept every write",required:"local host policy unavailable",hard:"MCP presence is advisory and never proves a hard boundary"}}),ciMerge:y({supported:!0,configuredPaths:f?u:[],installed:r,active:C,runtimeObserved:!1,operation:"merge",operationCoverage:f?n:!1,bypassable:f?n:!0,required:n,hard:!1,sources:{active:"CI run and provider enforcement not observed",runtimeObserved:"provider evidence unavailable",operationCoverage:"required-status operation coverage unavailable",bypassable:"branch-protection evidence unavailable",required:"branch-protection evidence unavailable",hard:"merge hardness requires fresh provider evidence"}})}}function w(a,e,r,o){return{...a,...o,evidence:[...a.evidence.filter(t=>!e.includes(t.field)),...e.map(t=>({field:t,source:r,value:o[t]}))]}}function x(a,e){if(!e?.available)return a;const r=typeof e.arkCheckRequired=="boolean"?e.arkCheckRequired:n,o=!!(a.enforcementState.ciMerge.configured&&a.enforcementState.ciMerge.installed),t=r===!0?o:r===!1?!1:o?n:!1,l=t===!0?e.arkCheckSourceBound===!1?!0:n:r===!1?!0:o?n:!0,d=`GitHub branch protection (${e.repo??"repository"}:${e.branch??"default"})`,u=!0,c=r,i=t===!0&&l===!1&&c===!0,s=w(a.enforcementState.ciMerge,["active","runtimeObserved","operationCoverage","bypassable","required","hard"],d,{active:t,runtimeObserved:u,operationCoverage:c,bypassable:l,required:r,hard:i});return{...a,enforcementState:{...a.enforcementState,ciMerge:s},enforcementLadder:{...a.enforcementLadder,ciMerge:{...a.enforcementLadder.ciMerge,requiredStatus:r}}}}function m(a,e){const r=o=>o===!0?"yes":o===!1?"no":String(o);return`${a} \u2014 supported: ${r(e.supported)} \xB7 analyzed: ${r(e.analyzed)} \xB7 configured: ${r(e.configured)} \xB7 installed: ${r(e.installed)} \xB7 runtime observed: ${r(e.runtimeObserved)} \xB7 operation: ${e.operation??"none"} \xB7 operation covered: ${r(e.operationCoverage)} \xB7 active: ${r(e.active)} \xB7 bypassable: ${r(e.bypassable)} \xB7 required: ${r(e.required)} \xB7 hard: ${r(e.hard)}`}function P(a){const e=[{level:a.localWrite.active===!0?"ok":"warn",text:m("Local write",a.localWrite)},{level:"warn",text:m("Advisory MCP",a.advisoryMcp)},{level:a.ciMerge.required===!0?"ok":"warn",text:m("CI merge",a.ciMerge)}];return a.localWrite.active===n&&a.localWrite.hard===!1&&e.push({level:"bad",text:"RED FLAG: local hook assets exist, but this active-host operation was not observed at runtime; hard blocking is unverified."}),a.activeHost==="unknown"&&e.push({level:"warn",text:"Active host unknown for this invocation \u2014 enforcementState is session projection only. See writePath.inventory for on-disk host hooks; hard write is never claimed without runtime proof."}),e}export{O as buildEnforcementState,P as enforcementDoctorLines,S as packageInstallation,x as withCiProviderEvidence};
+import m from"node:fs";import{createRequire as q}from"node:module";import h from"node:path";const n="unverified";function S(a){const e=h.join(a,"package.json");try{if(JSON.parse(m.readFileSync(e,"utf8"))?.name==="arkgate"&&m.statSync(h.join(a,"bin","ark-check.mjs"),{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"package.json + bin/ark-check.mjs (self-host)",selfHost:!0}}catch{}try{const r=q(e).resolve("arkgate/package.json"),o=h.dirname(r),i=JSON.parse(m.readFileSync(r,"utf8")),s=h.join(o,"bin","ark-check.mjs");if(i?.name==="arkgate"&&m.statSync(s,{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"arkgate/package.json via project resolver",selfHost:!1}}catch{}return{installed:!1,source:"arkgate/package.json unresolved from project",selfHost:!1}}function M(a){return a.length>0?a:["filesystem scan (no matching configuration)"]}function g({supported:a,configuredPaths:e,installed:r,active:o,runtimeObserved:i,operation:s,operationCoverage:v,bypassable:u,required:c,hard:t,sources:l}){const p=e.length>0,d=!!r.installed;return{supported:a,analyzed:!0,configured:p,installed:d,active:o,runtimeObserved:i,operation:s,operationCoverage:v,bypassable:u,required:c,hard:t,evidence:[...M(e).map(f=>({field:"configured",source:f,value:p})),{field:"installed",source:r.source,value:d},{field:"active",source:l.active,value:o},{field:"runtimeObserved",source:l.runtimeObserved,value:i},{field:"operationCoverage",source:l.operationCoverage,value:v},{field:"bypassable",source:l.bypassable,value:u},{field:"required",source:l.required,value:c},{field:"hard",source:l.hard,value:t}]}}function O(a,e){const r=S(a),o=!!e.support?.capabilities?.["hard-write"],i=!!e.support?.capabilities?.["advisory-write"],s=e.capabilityEvidence["hard-write"],v=e.capabilityEvidence["advisory-write"],u=e.capabilityEvidence["merge-gate"],c=e.enforcementLadder.localWrite,t=typeof c.operationCovered=="boolean",l=t?c.operationCovered:n,p=t&&l===!0,d=!!(o&&r.installed&&p&&c.hard===!0),f=t?p&&r.installed:o&&s.length>0&&r.installed?n:!1,b=i&&v.length>0&&r.installed?n:!1,y=!!(e.ci?.failClosed&&u.length>0),C=y&&r.installed?n:!1;return{schemaVersion:"1.1",activeHost:e.activeHost,localWrite:g({supported:o,configuredPaths:s,installed:r,active:f,runtimeObserved:t,operation:t?c.operation??null:null,operationCoverage:l,bypassable:d?!1:o&&!t?n:!0,required:n,hard:d,sources:{active:t?"observed PreToolUse attempt":"runtime observation unavailable",runtimeObserved:t?"fresh PreToolUse invocation":"runtime observation unavailable",operationCoverage:t?"active-host operation matcher":"operation not observed",bypassable:d?"observed hard write boundary":"host runtime bypass evidence unavailable",required:"local host policy unavailable",hard:d?"fresh covered active-host invocation":"hardness not proven for this invocation"}}),advisoryMcp:g({supported:i,configuredPaths:v,installed:r,active:b,runtimeObserved:!1,operation:null,operationCoverage:n,bypassable:!0,required:n,hard:!1,sources:{active:"MCP runtime observation unavailable",runtimeObserved:"doctor did not observe an MCP tool invocation",operationCoverage:"advisory MCP is caller-invoked",bypassable:"advisory MCP does not intercept every write",required:"local host policy unavailable",hard:"MCP presence is advisory and never proves a hard boundary"}}),ciMerge:g({supported:!0,configuredPaths:y?u:[],installed:r,active:C,runtimeObserved:!1,operation:"merge",operationCoverage:y?n:!1,bypassable:y?n:!0,required:n,hard:!1,sources:{active:"CI run and provider enforcement not observed",runtimeObserved:"provider evidence unavailable",operationCoverage:"required-status operation coverage unavailable",bypassable:"branch-protection evidence unavailable",required:"branch-protection evidence unavailable",hard:"merge hardness requires fresh provider evidence"}})}}function $(a,e,r,o){return{...a,...o,evidence:[...a.evidence.filter(i=>!e.includes(i.field)),...e.map(i=>({field:i,source:r,value:o[i]}))]}}function R(a,e){if(!e)return a;const r=e.reason==="provider-policy-unavailable-plan"||e.policyReason==="unavailable-plan",o=e.available===!0,i=!o&&!r&&(e.reason==="provider-enforcement-unverified"||e.reason==="gh-cli-unavailable"||e.reason==="gh-repo-unavailable"||!!e.reason);if(!o&&e.runtimeObserved!==!0&&!r&&!i)return a;const s=o?typeof e.arkCheckRequired=="boolean"?e.arkCheckRequired:n:r?!1:n,v=!!(a.enforcementState.ciMerge.configured&&a.enforcementState.ciMerge.installed),u=s===!0?v:s===!1?!1:v?n:!1,c=u===!0?e.arkCheckSourceBound===!1?!0:n:s===!1?!0:v?n:!0,t=e.runtimeObserved===!0,l=o?`GitHub branch protection (${e.repo??"repository"}:${e.branch??"default"})`:r?`GitHub provider policy unavailable (plan) (${e.repo??"repository"}:${e.branch??"default"})`:`GitHub CI runtime (${e.repo??"repository"})`,p=s,d=u===!0&&c===!1&&p===!0,f=$(a.enforcementState.ciMerge,["active","runtimeObserved","operationCoverage","bypassable","required","hard"],l,{active:u,runtimeObserved:t,operationCoverage:p,bypassable:c,required:s,hard:d}),b={...a,enforcementState:{...a.enforcementState,ciMerge:f},enforcementLadder:{...a.enforcementLadder,ciMerge:{...a.enforcementLadder.ciMerge,requiredStatus:s,...e.latestCiRun?{latestCiRun:e.latestCiRun}:{},...r?{providerPolicy:"unavailable-plan"}:{}}}};return(r||e.reason)&&(b.providerEnforcement={available:o,reason:e.reason||(r?"provider-policy-unavailable-plan":"provider-enforcement-unverified"),policyReason:e.policyReason||(r?"unavailable-plan":null),runtimeObserved:t,latestCiRun:e.latestCiRun??null,hard:d===!0}),b}function k(a,e){const r=o=>o===!0?"yes":o===!1?"no":String(o);return`${a} \u2014 supported: ${r(e.supported)} \xB7 analyzed: ${r(e.analyzed)} \xB7 configured: ${r(e.configured)} \xB7 installed: ${r(e.installed)} \xB7 runtime observed: ${r(e.runtimeObserved)} \xB7 operation: ${e.operation??"none"} \xB7 operation covered: ${r(e.operationCoverage)} \xB7 active: ${r(e.active)} \xB7 bypassable: ${r(e.bypassable)} \xB7 required: ${r(e.required)} \xB7 hard: ${r(e.hard)}`}function x(a){const e=[{level:a.localWrite.active===!0?"ok":"warn",text:k("Local write",a.localWrite)},{level:"warn",text:k("Advisory MCP",a.advisoryMcp)},{level:a.ciMerge.required===!0?"ok":"warn",text:k("CI merge",a.ciMerge)}];return a.localWrite.active===n&&a.localWrite.hard===!1&&e.push({level:"bad",text:"RED FLAG: local hook assets exist, but this active-host operation was not observed at runtime; hard blocking is unverified."}),a.activeHost==="unknown"&&e.push({level:"warn",text:"Active host unknown for this invocation \u2014 enforcementState is session projection only. See writePath.inventory for on-disk host hooks; hard write is never claimed without runtime proof."}),e}export{O as buildEnforcementState,x as enforcementDoctorLines,S as packageInstallation,R as withCiProviderEvidence};