arkgate 4.1.0 → 4.2.0

package/bin/lib/effective-contract-load.mjs

@@ -10,6 +10,35 @@ import {
   loadArkRulesContract,
 } from './arkrules-contract.mjs';
 
+function normalizeProjectRelativePath(value) {
+  const normalized = value.replace(/\\/g, '/');
+  if (
+    !normalized ||
+    normalized.startsWith('/') ||
+    /^[A-Za-z]:/.test(normalized) ||
+    normalized.includes('\0')
+  ) {
+    return undefined;
+  }
+  const segments = [];
+  for (const segment of normalized.split('/')) {
+    if (!segment || segment === '.') continue;
+    if (segment === '..') return undefined;
+    segments.push(segment);
+  }
+  return segments.length > 0 ? segments.join('/') : undefined;
+}
+
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return (
+    relative === '' ||
+    (!relative.startsWith(`..${path.sep}`) &&
+      relative !== '..' &&
+      !path.isAbsolute(relative))
+  );
+}
+
 /**
  * @param {string} root
  * @param {Record<string, unknown>} config loaded ark.config.json object
@@ -29,6 +58,7 @@ export function loadEffectiveArkRulesFromDisk(root, config, opts = {}) {
   const warnings = [];
   const parts = [];
   const referenced = new Set();
+  const canonicalRoot = fs.realpathSync(root);
 
   for (const layer of Object.keys(refs).sort()) {
     const relRaw = refs[layer];
@@ -37,10 +67,12 @@ export function loadEffectiveArkRulesFromDisk(root, config, opts = {}) {
       errors.push({ path: pathKey, message: 'must be a non-empty relative path string' });
       continue;
     }
-    if (relRaw.startsWith('/') || /^[A-Za-z]:[\\/]/.test(relRaw)) {
+    const rel = normalizeProjectRelativePath(relRaw);
+    if (!rel) {
       errors.push({
         path: pathKey,
-        message: 'must be a project-relative path (absolute paths are not allowed)',
+        message:
+          'must be a project-relative path without absolute roots or parent-directory traversal',
       });
       continue;
     }
@@ -52,17 +84,42 @@ export function loadEffectiveArkRulesFromDisk(root, config, opts = {}) {
       continue;
     }
 
-    const rel = relRaw.replace(/\\/g, '/').replace(/^\.\//, '');
     referenced.add(rel);
-    const absolute = path.resolve(root, rel);
-    opts.observeInput?.(absolute, 'arkrules');
-    if (!fs.existsSync(absolute)) {
+    const lexicalTarget = path.resolve(canonicalRoot, ...rel.split('/'));
+    if (!isWithinRoot(canonicalRoot, lexicalTarget)) {
+      errors.push({
+        path: pathKey,
+        message: `referenced ArkRules path ${JSON.stringify(rel)} resolves outside the project root`,
+      });
+      continue;
+    }
+    if (!fs.existsSync(lexicalTarget)) {
       errors.push({
         path: pathKey,
         message: `referenced ArkRules file ${JSON.stringify(rel)} is missing`,
       });
       continue;
     }
+    let absolute;
+    try {
+      absolute = fs.realpathSync(lexicalTarget);
+    } catch (error) {
+      errors.push({
+        path: pathKey,
+        message: `referenced ArkRules file ${JSON.stringify(rel)} could not be resolved: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      });
+      continue;
+    }
+    if (!isWithinRoot(canonicalRoot, absolute)) {
+      errors.push({
+        path: pathKey,
+        message: `referenced ArkRules path ${JSON.stringify(rel)} resolves outside the project root`,
+      });
+      continue;
+    }
+    opts.observeInput?.(absolute, 'arkrules');
     let content;
     try {
       content = fs.readFileSync(absolute, 'utf8');
@@ -90,9 +147,16 @@ export function loadEffectiveArkRulesFromDisk(root, config, opts = {}) {
   }
 
   // Drift: unreferenced files under arkrules/
-  const arkrulesDir = path.join(root, 'arkrules');
-  if (fs.existsSync(arkrulesDir) && fs.statSync(arkrulesDir).isDirectory()) {
-    for (const name of fs.readdirSync(arkrulesDir).sort()) {
+  const arkrulesDir = path.join(canonicalRoot, 'arkrules');
+  const resolvedArkRulesDir = fs.existsSync(arkrulesDir)
+    ? fs.realpathSync(arkrulesDir)
+    : undefined;
+  if (
+    resolvedArkRulesDir &&
+    isWithinRoot(canonicalRoot, resolvedArkRulesDir) &&
+    fs.statSync(resolvedArkRulesDir).isDirectory()
+  ) {
+    for (const name of fs.readdirSync(resolvedArkRulesDir).sort()) {
       if (!name.endsWith('.json')) continue;
       const rel = `arkrules/${name}`;
       if (!referenced.has(rel)) {

package/bin/lib/enforcement-honesty.mjs

@@ -207,7 +207,8 @@ export function buildWritePathHonesty(activeHost, hardWriteActive = false, extra
     hardWriteSupported: hardCapable,
     hardWriteActive: effectiveHard,
     hardWriteUnverified: hardCapable && !effectiveHard,
-    hardMergeBoundary: 'required-ci-status (arkgate-check --strict-merge)',
+    hardMergeBoundary:
+      'required-github-status-context (CLI: arkgate-check --strict-merge / ark-check --strict-merge)',
     packageInstalled,
     packagePinAbsent: pinAbsentForUser,
     ...(pinCode ? { packagePinCode: pinCode } : {}),
@@ -367,10 +368,15 @@ export function buildProductHonesty(input = {}) {
     });
   }
 
+  // EH05: soft-write-host is a permanent host posture residual — keep in evidence,
+  // do NOT alone force architecture "Not finished". Reclassified out of contract debt.
   if (write?.softWriteHost) {
     reasons.push({
       id: 'soft-write-host',
-      message: write.message || 'Local write is advisory; required CI status is the hard merge boundary.',
+      bucket: 'environment',
+      message:
+        write.message ||
+        'Local write is advisory; hard merge boundary = a required GitHub status context running arkgate-check --strict-merge (alias ark-check --strict-merge).',
     });
   }
 
@@ -399,7 +405,13 @@ export function buildProductHonesty(input = {}) {
     // Informational only when no enforced arkrule plane — does not alone make unfinished.
   }
 
-  const unfinished = reasons.length > 0;
+  // EH05: environment residual deny-list (future reason ids stay architecture debt by default).
+  const ENVIRONMENT_REASON_IDS = new Set(['soft-write-host']);
+
+  const environmentResiduals = reasons.filter((r) => ENVIRONMENT_REASON_IDS.has(r.id));
+  const architectureReasons = reasons.filter((r) => !ENVIRONMENT_REASON_IDS.has(r.id));
+  // unfinished = any non-environment residual (deny-list env, not allowlist architecture)
+  const unfinished = architectureReasons.length > 0;
   const wholeTreeGoverned = wholeTreeGovernedEarly;
   const coverageIncomplete =
     cov?.status === 'empty-scope' ||
@@ -407,31 +419,56 @@ export function buildProductHonesty(input = {}) {
     cov?.greenIsNotEnforcement === true ||
     !wholeTreeGoverned;
 
+  const softWriteOnly =
+    !unfinished && environmentResiduals.some((r) => r.id === 'soft-write-host');
+  const hostLabel = (() => {
+    const h = typeof write?.activeHost === 'string' ? write.activeHost.trim().toLowerCase() : '';
+    if (h === 'codex') return 'Codex';
+    if (h === 'cursor') return 'Cursor';
+    if (h === 'opencode') return 'OpenCode';
+    if (h) return h;
+    return 'this host';
+  })();
+
   const primary =
-    reasons.find((r) => r.id === 'active-blocking-violations') ||
-    reasons.find((r) => r.id === 'mode-adapt-with-debt') ||
-    reasons.find((r) => r.id === 'mode-suggest-with-debt') ||
-    reasons.find((r) => r.id === 'design-weak') ||
-    reasons.find((r) => r.id === 'design-smells-open-edges') ||
-    reasons.find((r) => r.id === 'coverage-weak-or-empty') ||
-    reasons.find((r) => r.id === 'dirty-freeze') ||
-    reasons.find((r) => r.id === 'package-version-dual-truth') ||
-    reasons.find((r) => r.id === 'package-pin-absent') ||
-    reasons.find((r) => r.id === 'baseline-missing-with-debt') ||
-    reasons.find((r) => r.id === 'residual-pilot') ||
-    reasons[0];
+    architectureReasons.find((r) => r.id === 'active-blocking-violations') ||
+    architectureReasons.find((r) => r.id === 'mode-adapt-with-debt') ||
+    architectureReasons.find((r) => r.id === 'mode-suggest-with-debt') ||
+    architectureReasons.find((r) => r.id === 'design-weak') ||
+    architectureReasons.find((r) => r.id === 'design-smells-open-edges') ||
+    architectureReasons.find((r) => r.id === 'coverage-weak-or-empty') ||
+    architectureReasons.find((r) => r.id === 'dirty-freeze') ||
+    architectureReasons.find((r) => r.id === 'package-version-dual-truth') ||
+    architectureReasons.find((r) => r.id === 'package-pin-absent') ||
+    architectureReasons.find((r) => r.id === 'baseline-missing-with-debt') ||
+    architectureReasons.find((r) => r.id === 'residual-pilot') ||
+    architectureReasons[0] ||
+    environmentResiduals[0];
 
-  const primaryMessage = unfinished
-    ? primary?.message ||
-      'Not finished: residual honesty signals remain (violations, mode, coverage, freeze, design, package pin, or pilots).'
-    : wholeTreeGoverned
-      ? 'No residual honesty blockers on this slice — still not a numeric architecture score; re-doctor after material change.'
-      : 'No residual honesty blockers flagged — green is only as wide as the governed slice.';
+  let primaryMessage;
+  if (unfinished) {
+    primaryMessage =
+      primary?.message ||
+      'Not finished: residual honesty signals remain (violations, mode, coverage, freeze, design, package pin, or pilots).';
+  } else if (softWriteOnly) {
+    primaryMessage = `${hostLabel} local writes stay advisory/bypassable; architecture contract on this slice is ready. Hard merge boundary is a required GitHub status context running arkgate-check --strict-merge (alias ark-check --strict-merge).`;
+  } else if (wholeTreeGoverned) {
+    primaryMessage =
+      'No residual honesty blockers on this slice — still not a numeric architecture score; re-doctor after material change.';
+  } else {
+    primaryMessage =
+      'No residual honesty blockers flagged — green is only as wide as the governed slice.';
+  }
 
   // P0B-HEADLINE: dual-truth / pin-only unfinished must not claim "not whole-tree"
   // when the governed tree is already 100%.
+  // EH05: soft-write alone → composite readiness headline, never global "Not finished".
   let headline;
-  if (!unfinished) {
+  if (!unfinished && softWriteOnly) {
+    headline = wholeTreeGoverned
+      ? `Architecture contract ready; ${hostLabel} local writes are advisory`
+      : `Contract residual clear; ${hostLabel} local writes are advisory`;
+  } else if (!unfinished) {
     headline = 'Honesty clear on residual signals';
   } else if (coverageIncomplete) {
     headline = 'Not finished / not whole-tree guarantee';
@@ -440,6 +477,7 @@ export function buildProductHonesty(input = {}) {
   }
 
   // Prefer caller next action; dual-truth / pin-absent get install/pin path when empty.
+  // Soft-write-only must not leave a failure headline with null next action (EH05).
   let primaryNextAction = input.primaryNextAction || null;
   if (!primaryNextAction && dualTruth) {
     const ver = input.packageVersionTruth?.cliVersion;
@@ -449,8 +487,20 @@ export function buildProductHonesty(input = {}) {
   } else if (!primaryNextAction && pinAbsent) {
     primaryNextAction =
       'Add arkgate to package.json and install so CI/npx resolve this CLI (PACKAGE_PIN_ABSENT)';
+  } else if (!primaryNextAction && softWriteOnly) {
+    primaryNextAction =
+      'Confirm the GitHub required status context name runs arkgate-check --strict-merge (or ark-check --strict-merge). Soft-write hosts stay advisory at local write; the required status is the hard merge boundary.';
   }
 
+  const contractReadiness = unfinished ? 'not-ready' : wholeTreeGoverned ? 'ready' : 'partial';
+  const localWriteBoundary = write?.softWriteHost
+    ? 'advisory'
+    : write?.hardWriteActive
+      ? 'hard'
+      : write?.hardWriteSupported
+        ? 'unverified'
+        : 'unknown';
+
   return {
     finished: !unfinished && wholeTreeGoverned && !designWeak && activeBlocking === 0,
     elegant: !designWeak && !base?.dirtyBaselineRisk && !designSmellsOpenEdges && activeBlocking === 0,
@@ -462,8 +512,14 @@ export function buildProductHonesty(input = {}) {
       activeBlocking === 0,
     unfinished,
     notAScore: true,
+    // Full evidence including soft-write-host (reclassified, not silenced)
     reasonIds: reasons.map((r) => r.id),
     reasons,
+    architectureReasonIds: architectureReasons.map((r) => r.id),
+    environmentResidualIds: environmentResiduals.map((r) => r.id),
+    environmentResiduals,
+    contractReadiness,
+    localWriteBoundary,
     primaryMessage,
     primaryNextAction,
     headline,

package/bin/lib/enforcement-state.mjs

@@ -1,2 +1,2 @@
 // Generated from enforcement-state.source.mjs — run npm run generate:packaged-tooling.
-import b from"node:fs";import{createRequire as q}from"node:module";import h from"node:path";const n="unverified";function S(a){const e=h.join(a,"package.json");try{if(JSON.parse(b.readFileSync(e,"utf8"))?.name==="arkgate"&&b.statSync(h.join(a,"bin","ark-check.mjs"),{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"package.json + bin/ark-check.mjs (self-host)",selfHost:!0}}catch{}try{const r=q(e).resolve("arkgate/package.json"),o=h.dirname(r),t=JSON.parse(b.readFileSync(r,"utf8")),l=h.join(o,"bin","ark-check.mjs");if(t?.name==="arkgate"&&b.statSync(l,{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"arkgate/package.json via project resolver",selfHost:!1}}catch{}return{installed:!1,source:"arkgate/package.json unresolved from project",selfHost:!1}}function M(a){return a.length>0?a:["filesystem scan (no matching configuration)"]}function y({supported:a,configuredPaths:e,installed:r,active:o,runtimeObserved:t,operation:l,operationCoverage:d,bypassable:u,required:c,hard:i,sources:s}){const p=e.length>0,v=!!r.installed;return{supported:a,analyzed:!0,configured:p,installed:v,active:o,runtimeObserved:t,operation:l,operationCoverage:d,bypassable:u,required:c,hard:i,evidence:[...M(e).map(g=>({field:"configured",source:g,value:p})),{field:"installed",source:r.source,value:v},{field:"active",source:s.active,value:o},{field:"runtimeObserved",source:s.runtimeObserved,value:t},{field:"operationCoverage",source:s.operationCoverage,value:d},{field:"bypassable",source:s.bypassable,value:u},{field:"required",source:s.required,value:c},{field:"hard",source:s.hard,value:i}]}}function O(a,e){const r=S(a),o=!!e.support?.capabilities?.["hard-write"],t=!!e.support?.capabilities?.["advisory-write"],l=e.capabilityEvidence["hard-write"],d=e.capabilityEvidence["advisory-write"],u=e.capabilityEvidence["merge-gate"],c=e.enforcementLadder.localWrite,i=typeof c.operationCovered=="boolean",s=i?c.operationCovered:n,p=i&&s===!0,v=!!(o&&r.installed&&p&&c.hard===!0),g=i?p&&r.installed:o&&l.length>0&&r.installed?n:!1,k=t&&d.length>0&&r.installed?n:!1,f=!!(e.ci?.failClosed&&u.length>0),C=f&&r.installed?n:!1;return{schemaVersion:"1.1",activeHost:e.activeHost,localWrite:y({supported:o,configuredPaths:l,installed:r,active:g,runtimeObserved:i,operation:i?c.operation??null:null,operationCoverage:s,bypassable:v?!1:o&&!i?n:!0,required:n,hard:v,sources:{active:i?"observed PreToolUse attempt":"runtime observation unavailable",runtimeObserved:i?"fresh PreToolUse invocation":"runtime observation unavailable",operationCoverage:i?"active-host operation matcher":"operation not observed",bypassable:v?"observed hard write boundary":"host runtime bypass evidence unavailable",required:"local host policy unavailable",hard:v?"fresh covered active-host invocation":"hardness not proven for this invocation"}}),advisoryMcp:y({supported:t,configuredPaths:d,installed:r,active:k,runtimeObserved:!1,operation:null,operationCoverage:n,bypassable:!0,required:n,hard:!1,sources:{active:"MCP runtime observation unavailable",runtimeObserved:"doctor did not observe an MCP tool invocation",operationCoverage:"advisory MCP is caller-invoked",bypassable:"advisory MCP does not intercept every write",required:"local host policy unavailable",hard:"MCP presence is advisory and never proves a hard boundary"}}),ciMerge:y({supported:!0,configuredPaths:f?u:[],installed:r,active:C,runtimeObserved:!1,operation:"merge",operationCoverage:f?n:!1,bypassable:f?n:!0,required:n,hard:!1,sources:{active:"CI run and provider enforcement not observed",runtimeObserved:"provider evidence unavailable",operationCoverage:"required-status operation coverage unavailable",bypassable:"branch-protection evidence unavailable",required:"branch-protection evidence unavailable",hard:"merge hardness requires fresh provider evidence"}})}}function w(a,e,r,o){return{...a,...o,evidence:[...a.evidence.filter(t=>!e.includes(t.field)),...e.map(t=>({field:t,source:r,value:o[t]}))]}}function x(a,e){if(!e?.available)return a;const r=typeof e.arkCheckRequired=="boolean"?e.arkCheckRequired:n,o=!!(a.enforcementState.ciMerge.configured&&a.enforcementState.ciMerge.installed),t=r===!0?o:r===!1?!1:o?n:!1,l=t===!0?e.arkCheckSourceBound===!1?!0:n:r===!1?!0:o?n:!0,d=`GitHub branch protection (${e.repo??"repository"}:${e.branch??"default"})`,u=!0,c=r,i=t===!0&&l===!1&&c===!0,s=w(a.enforcementState.ciMerge,["active","runtimeObserved","operationCoverage","bypassable","required","hard"],d,{active:t,runtimeObserved:u,operationCoverage:c,bypassable:l,required:r,hard:i});return{...a,enforcementState:{...a.enforcementState,ciMerge:s},enforcementLadder:{...a.enforcementLadder,ciMerge:{...a.enforcementLadder.ciMerge,requiredStatus:r}}}}function m(a,e){const r=o=>o===!0?"yes":o===!1?"no":String(o);return`${a} \u2014 supported: ${r(e.supported)} \xB7 analyzed: ${r(e.analyzed)} \xB7 configured: ${r(e.configured)} \xB7 installed: ${r(e.installed)} \xB7 runtime observed: ${r(e.runtimeObserved)} \xB7 operation: ${e.operation??"none"} \xB7 operation covered: ${r(e.operationCoverage)} \xB7 active: ${r(e.active)} \xB7 bypassable: ${r(e.bypassable)} \xB7 required: ${r(e.required)} \xB7 hard: ${r(e.hard)}`}function P(a){const e=[{level:a.localWrite.active===!0?"ok":"warn",text:m("Local write",a.localWrite)},{level:"warn",text:m("Advisory MCP",a.advisoryMcp)},{level:a.ciMerge.required===!0?"ok":"warn",text:m("CI merge",a.ciMerge)}];return a.localWrite.active===n&&a.localWrite.hard===!1&&e.push({level:"bad",text:"RED FLAG: local hook assets exist, but this active-host operation was not observed at runtime; hard blocking is unverified."}),a.activeHost==="unknown"&&e.push({level:"warn",text:"Active host unknown for this invocation \u2014 enforcementState is session projection only. See writePath.inventory for on-disk host hooks; hard write is never claimed without runtime proof."}),e}export{O as buildEnforcementState,P as enforcementDoctorLines,S as packageInstallation,x as withCiProviderEvidence};
+import m from"node:fs";import{createRequire as q}from"node:module";import h from"node:path";const n="unverified";function O({configuredOnDisk:a=!1,restartRequired:e=a}={}){return{configuredOnDisk:!!a,restartRequired:!!e,runtimeObserved:!1,identityMatch:n,active:!1}}function M(a){const e=h.join(a,"package.json");try{if(JSON.parse(m.readFileSync(e,"utf8"))?.name==="arkgate"&&m.statSync(h.join(a,"bin","ark-check.mjs"),{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"package.json + bin/ark-check.mjs (self-host)",selfHost:!0}}catch{}try{const r=q(e).resolve("arkgate/package.json"),o=h.dirname(r),i=JSON.parse(m.readFileSync(r,"utf8")),s=h.join(o,"bin","ark-check.mjs");if(i?.name==="arkgate"&&m.statSync(s,{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"arkgate/package.json via project resolver",selfHost:!1}}catch{}return{installed:!1,source:"arkgate/package.json unresolved from project",selfHost:!1}}function S(a){return a.length>0?a:["filesystem scan (no matching configuration)"]}function g({supported:a,configuredPaths:e,installed:r,active:o,runtimeObserved:i,operation:s,operationCoverage:u,bypassable:v,required:c,hard:t,sources:l}){const p=e.length>0,d=!!r.installed;return{supported:a,analyzed:!0,configured:p,installed:d,active:o,runtimeObserved:i,operation:s,operationCoverage:u,bypassable:v,required:c,hard:t,evidence:[...S(e).map(f=>({field:"configured",source:f,value:p})),{field:"installed",source:r.source,value:d},{field:"active",source:l.active,value:o},{field:"runtimeObserved",source:l.runtimeObserved,value:i},{field:"operationCoverage",source:l.operationCoverage,value:u},{field:"bypassable",source:l.bypassable,value:v},{field:"required",source:l.required,value:c},{field:"hard",source:l.hard,value:t}]}}function E(a,e){const r=M(a),o=!!e.support?.capabilities?.["hard-write"],i=!!e.support?.capabilities?.["advisory-write"],s=e.capabilityEvidence["hard-write"],u=e.capabilityEvidence["advisory-write"],v=e.capabilityEvidence["merge-gate"],c=e.enforcementLadder.localWrite,t=typeof c.operationCovered=="boolean",l=t?c.operationCovered:n,p=t&&l===!0,d=!!(o&&r.installed&&p&&c.hard===!0),f=t?p&&r.installed:o&&s.length>0&&r.installed?n:!1,b=i&&u.length>0&&r.installed?n:!1,y=!!(e.ci?.failClosed&&v.length>0),C=y&&r.installed?n:!1;return{schemaVersion:"1.1",activeHost:e.activeHost,localWrite:g({supported:o,configuredPaths:s,installed:r,active:f,runtimeObserved:t,operation:t?c.operation??null:null,operationCoverage:l,bypassable:d?!1:o&&!t?n:!0,required:n,hard:d,sources:{active:t?"observed PreToolUse attempt":"runtime observation unavailable",runtimeObserved:t?"fresh PreToolUse invocation":"runtime observation unavailable",operationCoverage:t?"active-host operation matcher":"operation not observed",bypassable:d?"observed hard write boundary":"host runtime bypass evidence unavailable",required:"local host policy unavailable",hard:d?"fresh covered active-host invocation":"hardness not proven for this invocation"}}),advisoryMcp:g({supported:i,configuredPaths:u,installed:r,active:b,runtimeObserved:!1,operation:null,operationCoverage:n,bypassable:!0,required:n,hard:!1,sources:{active:"MCP runtime observation unavailable",runtimeObserved:"doctor did not observe an MCP tool invocation",operationCoverage:"advisory MCP is caller-invoked",bypassable:"advisory MCP does not intercept every write",required:"local host policy unavailable",hard:"MCP presence is advisory and never proves a hard boundary"}}),ciMerge:g({supported:!0,configuredPaths:y?v:[],installed:r,active:C,runtimeObserved:!1,operation:"merge",operationCoverage:y?n:!1,bypassable:y?n:!0,required:n,hard:!1,sources:{active:"CI run and provider enforcement not observed",runtimeObserved:"provider evidence unavailable",operationCoverage:"required-status operation coverage unavailable",bypassable:"branch-protection evidence unavailable",required:"branch-protection evidence unavailable",hard:"merge hardness requires fresh provider evidence"}})}}function $(a,e,r,o){return{...a,...o,evidence:[...a.evidence.filter(i=>!e.includes(i.field)),...e.map(i=>({field:i,source:r,value:o[i]}))]}}function x(a,e){if(!e)return a;const r=e.reason==="provider-policy-unavailable-plan"||e.policyReason==="unavailable-plan",o=e.available===!0,i=!o&&!r&&(e.reason==="provider-enforcement-unverified"||e.reason==="gh-cli-unavailable"||e.reason==="gh-repo-unavailable"||!!e.reason);if(!o&&e.runtimeObserved!==!0&&!r&&!i)return a;const s=o?typeof e.arkCheckRequired=="boolean"?e.arkCheckRequired:n:r?!1:n,u=!!(a.enforcementState.ciMerge.configured&&a.enforcementState.ciMerge.installed),v=s===!0?u:s===!1?!1:u?n:!1,c=v===!0?e.arkCheckSourceBound===!1?!0:n:s===!1?!0:u?n:!0,t=e.runtimeObserved===!0,l=o?`GitHub branch protection (${e.repo??"repository"}:${e.branch??"default"})`:r?`GitHub provider policy unavailable (plan) (${e.repo??"repository"}:${e.branch??"default"})`:`GitHub CI runtime (${e.repo??"repository"})`,p=s,d=v===!0&&c===!1&&p===!0,f=$(a.enforcementState.ciMerge,["active","runtimeObserved","operationCoverage","bypassable","required","hard"],l,{active:v,runtimeObserved:t,operationCoverage:p,bypassable:c,required:s,hard:d}),b={...a,enforcementState:{...a.enforcementState,ciMerge:f},enforcementLadder:{...a.enforcementLadder,ciMerge:{...a.enforcementLadder.ciMerge,requiredStatus:s,...e.latestCiRun?{latestCiRun:e.latestCiRun}:{},...r?{providerPolicy:"unavailable-plan"}:{}}}};return(r||e.reason)&&(b.providerEnforcement={available:o,reason:e.reason||(r?"provider-policy-unavailable-plan":"provider-enforcement-unverified"),policyReason:e.policyReason||(r?"unavailable-plan":null),runtimeObserved:t,latestCiRun:e.latestCiRun??null,hard:d===!0}),b}function k(a,e){const r=o=>o===!0?"yes":o===!1?"no":String(o);return`${a} \u2014 supported: ${r(e.supported)} \xB7 analyzed: ${r(e.analyzed)} \xB7 configured: ${r(e.configured)} \xB7 installed: ${r(e.installed)} \xB7 runtime observed: ${r(e.runtimeObserved)} \xB7 operation: ${e.operation??"none"} \xB7 operation covered: ${r(e.operationCoverage)} \xB7 active: ${r(e.active)} \xB7 bypassable: ${r(e.bypassable)} \xB7 required: ${r(e.required)} \xB7 hard: ${r(e.hard)}`}function B(a){const e=[{level:a.localWrite.active===!0?"ok":"warn",text:k("Local write",a.localWrite)},{level:"warn",text:k("Advisory MCP",a.advisoryMcp)},{level:a.ciMerge.required===!0?"ok":"warn",text:k("CI merge",a.ciMerge)}];return a.localWrite.active===n&&a.localWrite.hard===!1&&e.push({level:"bad",text:"RED FLAG: local hook assets exist, but this active-host operation was not observed at runtime; hard blocking is unverified."}),a.activeHost==="unknown"&&e.push({level:"warn",text:"Active host unknown for this invocation \u2014 enforcementState is session projection only. See writePath.inventory for on-disk host hooks; hard write is never claimed without runtime proof."}),e}export{E as buildEnforcementState,O as codexRuntimeActivation,B as enforcementDoctorLines,M as packageInstallation,x as withCiProviderEvidence};