arkgate 4.1.0 → 4.2.0

package/bin/lib/github-enforcement.mjs

@@ -51,7 +51,14 @@ function shellSegments(text) {
       index++;
       continue;
     }
-    if (char === ';' || char === '|' || char === '\n') {
+    if (
+      char === '&' &&
+      (input[index - 1] === '>' || input[index - 1] === '<' || input[index + 1] === '>')
+    ) {
+      current += char;
+      continue;
+    }
+    if (char === ';' || char === '|' || char === '&' || char === '\n') {
       push(char);
       continue;
     }
@@ -70,12 +77,18 @@ function analyzeCommands(commands, script = '') {
     .filter((segment) => DIRECT_ARK.test(executableText(segment.text)))
     .map((segment) => ({
       text: segment.text,
-      enforcing: segment.terminator !== '||' && segment.terminator !== '|',
+      enforcing:
+        segment.terminator !== '||' &&
+        segment.terminator !== '|' &&
+        segment.terminator !== '&',
     }));
   const found = [];
   for (const segment of shellSegments(commands)) {
     const executable = executableText(segment.text);
-    const outerEnforcing = segment.terminator !== '||' && segment.terminator !== '|';
+    const outerEnforcing =
+      segment.terminator !== '||' &&
+      segment.terminator !== '|' &&
+      segment.terminator !== '&';
     if (DIRECT_ARK.test(executable)) {
       found.push({ text: segment.text, enforcing: outerEnforcing });
     } else if (CHECK_SCRIPT.test(executable)) {
@@ -362,12 +375,132 @@ function parseJson(result) {
   }
 }
 
+/**
+ * Classify GitHub provider API failures (EH06).
+ * Plan/tier claims require **explicit upgrade/plan language** — bare HTTP 403
+ * (token/SSO/scope) stays generic `provider-enforcement-unverified` so we never
+ * overclaim "proven not required" / Free-plan walls.
+ *
+ * @param {string} errorText combined stderr/stdout from gh api
+ * @param {{ classicAvailable?: boolean, rulesAvailable?: boolean }} [opts]
+ * @returns {'provider-policy-unavailable-plan'|'provider-enforcement-unverified'|'ok'}
+ */
+export function classifyGithubProviderFailure(errorText, opts = {}) {
+  const text = String(errorText || '');
+  const lower = text.toLowerCase();
+  // Explicit plan/tier walls only — not every 403 (token/SSO/scope stay unverified).
+  const planRestricted =
+    /upgrade to github (pro|team|enterprise)/i.test(lower) ||
+    /not available (on|for) (your|this) (current )?plan/i.test(lower) ||
+    /requires a paid github/i.test(lower) ||
+    /github pro.*branch protection|branch protection.*github pro/i.test(lower) ||
+    /only available (with|on) github (pro|team|enterprise)/i.test(lower) ||
+    /this feature is not available (on|for) (free|your plan)/i.test(lower);
+  if (planRestricted) return 'provider-policy-unavailable-plan';
+  if (opts.classicAvailable && opts.rulesAvailable) return 'ok';
+  return 'provider-enforcement-unverified';
+}
+
+/**
+ * True when a workflow/job title is an Ark architecture check (not lint-only / spark-ci / dark-theme).
+ * Prefer exact product tokens; "architecture" only with gate/check phrasing.
+ *
+ * @param {{ name?: string, workflowName?: string, displayTitle?: string }} run
+ * @returns {boolean}
+ */
+export function isArkishCiRun(run) {
+  const blob = `${run?.name || ''} ${run?.workflowName || ''} ${run?.displayTitle || ''}`.toLowerCase();
+  if (!blob.trim()) return false;
+  // Product tokens with word boundaries (avoid spark, dark, lark false positives).
+  if (/\barkgate(?:-check)?\b/.test(blob)) return true;
+  if (/\bark-check\b/.test(blob)) return true;
+  if (/\bark\s+architecture\b/.test(blob)) return true;
+  if (/\barchitecture\s+(?:gate|check)\b/.test(blob)) return true;
+  if (/\b(?:arkgate|ark)\s+architecture\s+gate\b/.test(blob)) return true;
+  // Standalone workflow names generated by Ark (`name: Ark architecture gate`)
+  if (/\bark architecture gate\b/.test(blob)) return true;
+  return false;
+}
+
+/**
+ * Observe recent GitHub Actions success for Ark architecture checks (EH06).
+ * Independent of branch-protection / required-status policy APIs.
+ * Never falls back to non-Ark green jobs (lint/test).
+ *
+ * @param {{ cwd?: string, env?: NodeJS.ProcessEnv, repo?: string, limit?: number }} [opts]
+ * @returns {{ runtimeObserved: boolean, latestCiRun: string|null, reason: string, runs?: unknown[] }}
+ */
+export function reportGithubCiRuntime(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const env = opts.env ?? process.env;
+  const limit = Number.isFinite(Number(opts.limit)) ? Math.max(1, Number(opts.limit)) : 30;
+  if (spawnSync('gh', ['--version'], { encoding: 'utf8', env }).status !== 0) {
+    return { runtimeObserved: false, latestCiRun: null, reason: 'gh-cli-unavailable' };
+  }
+  const args = [
+    'run', 'list',
+    '--limit', String(limit),
+    '--json', 'name,conclusion,status,workflowName,displayTitle,event',
+  ];
+  if (opts.repo) args.push('--repo', opts.repo);
+  const result = spawnSync('gh', args, { cwd, encoding: 'utf8', env });
+  if (result.status !== 0) {
+    const err = `${result.stderr || ''}${result.stdout || ''}`.slice(0, 400);
+    return {
+      runtimeObserved: false,
+      latestCiRun: null,
+      reason: classifyGithubProviderFailure(err) === 'provider-policy-unavailable-plan'
+        ? 'provider-policy-unavailable-plan'
+        : 'ci-runtime-unverified',
+    };
+  }
+  let runs = [];
+  try {
+    runs = JSON.parse(result.stdout || '[]');
+  } catch {
+    return { runtimeObserved: false, latestCiRun: null, reason: 'ci-runtime-unverified' };
+  }
+  if (!Array.isArray(runs)) {
+    return { runtimeObserved: false, latestCiRun: null, reason: 'ci-runtime-unverified' };
+  }
+  const relevant = runs.filter(isArkishCiRun);
+  if (relevant.length === 0) {
+    return {
+      runtimeObserved: false,
+      latestCiRun: null,
+      reason: runs.length === 0 ? 'ci-runtime-empty' : 'ci-runtime-no-ark-runs',
+      runs: runs.slice(0, 5),
+    };
+  }
+  const success = relevant.find(
+    (run) => String(run?.conclusion || '').toLowerCase() === 'success'
+  );
+  if (success) {
+    return {
+      runtimeObserved: true,
+      latestCiRun: 'success',
+      reason: 'ok',
+      runs: relevant.slice(0, 5),
+    };
+  }
+  const latest = relevant[0];
+  const latestConclusion = latest
+    ? String(latest.conclusion || latest.status || 'unknown').toLowerCase()
+    : null;
+  return {
+    runtimeObserved: false,
+    latestCiRun: latestConclusion,
+    reason: 'ci-runtime-no-success',
+    runs: relevant.slice(0, 5),
+  };
+}
+
 /** Query classic branch protection and all active branch rules before reporting absence. */
 export function reportGithubBranchProtection(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   const env = opts.env ?? process.env;
   if (spawnSync('gh', ['--version'], { encoding: 'utf8', env }).status !== 0) {
-    return { available: false, reason: 'gh-cli-unavailable' };
+    return { available: false, reason: 'gh-cli-unavailable', runtimeObserved: false, latestCiRun: null };
   }
   let repo = opts.repo;
   let branch = opts.branch;
@@ -375,7 +508,7 @@ export function reportGithubBranchProtection(opts = {}) {
     const args = ['repo', 'view', ...(repo ? [repo] : []), '--json', 'nameWithOwner,defaultBranchRef'];
     const metadata = parseJson(spawnSync('gh', args, { cwd, encoding: 'utf8', env }));
     if (!metadata?.nameWithOwner || !metadata?.defaultBranchRef?.name) {
-      return { available: false, reason: 'gh-repo-unavailable' };
+      return { available: false, reason: 'gh-repo-unavailable', runtimeObserved: false, latestCiRun: null };
     }
     repo ??= metadata.nameWithOwner;
     branch ??= metadata.defaultBranchRef.name;
@@ -426,9 +559,32 @@ export function reportGithubBranchProtection(opts = {}) {
   const all = [...new Set([...contexts, ...checks.map((check) => check.context), ...statusRules.map((check) => check.context)])];
   const error = `${classicResult.stderr || ''}${rulesResult.stderr || ''}`.slice(0, 400);
 
+  let reason = available ? 'ok' : 'provider-enforcement-unverified';
+  if (!available) {
+    // Plan-restriction only when neither classic nor ruleset evidence could be read.
+    // Partial success (one source OK, other 403) stays generic unverified — not a plan claim.
+    if (!classicAvailable && !rulesAvailable) {
+      const classicFail =
+        classicResult.status !== 0 ? String(classicResult.stderr || classicResult.stdout || '') : '';
+      const rulesFail =
+        rulesResult.status !== 0 ? String(rulesResult.stderr || rulesResult.stdout || '') : '';
+      reason = classifyGithubProviderFailure(`${classicFail}\n${rulesFail}\n${error}`, {
+        classicAvailable,
+        rulesAvailable,
+      });
+    }
+  }
+
+  // EH06: CI runtime observation is independent of branch-protection availability.
+  const ciRuntime = opts.includeCiRuntime === false
+    ? { runtimeObserved: false, latestCiRun: null, reason: 'skipped' }
+    : reportGithubCiRuntime({ cwd, env, repo });
+
   return {
     available,
-    reason: available ? 'ok' : 'provider-enforcement-unverified',
+    reason,
+    // Alias for consumers that look for the short code
+    policyReason: reason === 'provider-policy-unavailable-plan' ? 'unavailable-plan' : reason,
     repo,
     branch,
     requiredStatusChecks: all,
@@ -438,6 +594,11 @@ export function reportGithubBranchProtection(opts = {}) {
     enforcesAdmins: classicAvailable ? Boolean(classic.enforcesAdmins) : null,
     arkCheckRequired,
     arkCheckSourceBound,
-    raw: { classic, rules, ...(error ? { error } : {}) },
+    // hard merge remains false when status is not proven required
+    hard: arkCheckRequired === true ? undefined : false,
+    runtimeObserved: ciRuntime.runtimeObserved === true,
+    latestCiRun: ciRuntime.latestCiRun,
+    ciRuntimeReason: ciRuntime.reason,
+    raw: { classic, rules, ...(error ? { error } : {}), ciRuntime },
   };
 }

package/bin/lib/hook-templates.mjs

@@ -1,19 +1,20 @@
 // Generated from hook-templates.source.mjs — run npm run generate:packaged-tooling.
-import{execCommandParts as i,execRunner as s}from"../ark-shared.mjs";const c="arkgate-mcp";function l(e){const r=s(e);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",command:`${r} ${c} --session-context --root "$CLAUDE_PROJECT_DIR" --config ark.config.json`}]}],PreToolUse:[{matcher:"Write|Edit|MultiEdit",hooks:[{type:"command",command:`${r} ${c} --hook --hook-repair --fail-on-new-smells --root "$CLAUDE_PROJECT_DIR" --config ark.config.json`}]}]}},null,2)}
-`}function p(e){const r=s(e),o="${CODEX_PROJECT_DIR:-${PWD:-.}}";return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",timeout:30,command:`${r} ${c} --session-context --root "${o}" --config ark.config.json`}]}],PreToolUse:[{matcher:"ApplyPatch|apply_patch|Write|Edit|MultiEdit",hooks:[{type:"command",timeout:30,command:`${r} ${c} --hook --hook-repair --fail-on-new-smells --root "${o}" --config ark.config.json`}]}]}},null,2)}
-`}function g(e){const{command:r,args:o}=i(e,c,["--root",".","--config","ark.config.json"]),t=a=>a.replace(/\\/g,"\\\\").replace(/"/g,'\\"'),n=o.map(a=>`"${t(a)}"`).join(", ");return`# Generated by ark-check --install-agent-gates (Codex project scope).
-# Restart Codex after changes; MCP servers are loaded when the project session starts.
+import{execCommandParts as i,execRunner as s}from"../ark-shared.mjs";const c="arkgate-mcp";function l(o){const r=s(o);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",command:`${r} ${c} --session-context --root . --root-env CLAUDE_PROJECT_DIR --config ark.config.json`}]}],PreToolUse:[{matcher:"Write|Edit|MultiEdit",hooks:[{type:"command",command:`${r} ${c} --hook --hook-repair --fail-on-new-smells --root . --root-env CLAUDE_PROJECT_DIR --config ark.config.json`}]}]}},null,2)}
+`}function p(o){const r=s(o);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",timeout:30,command:`${r} ${c} --session-context --root . --root-env CODEX_PROJECT_DIR --config ark.config.json`}]}],PreToolUse:[{matcher:"ApplyPatch|apply_patch|Write|Edit|MultiEdit",hooks:[{type:"command",timeout:30,command:`${r} ${c} --hook --hook-repair --fail-on-new-smells --root . --root-env CODEX_PROJECT_DIR --config ark.config.json`}]}]}},null,2)}
+`}function f(o){const{command:r,args:e}=i(o,c,["--root",".","--config","ark.config.json"]),t=a=>a.replace(/\\/g,"\\\\").replace(/"/g,'\\"'),n=e.map(a=>`"${t(a)}"`).join(", ");return`# Generated by ark-check --install-agent-gates (Codex project scope).
+# CONFIGURED ON DISK \u2014 RUNTIME NOT VERIFIED.
+# Restart Codex, then call ark_identity with expectedRoot before trusting MCP verdicts.
 [mcp_servers.ark]
 command = "${t(r)}"
 args = [${n}]
-`}function f(e){const{command:r,args:o}=i(e,c,["--root",".","--config","ark.config.json"]),t=o.map(n=>`"${n.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`).join(", ");return`# Generated by ark-check --install-agent-gates (Grok Build project scope).
+`}function g(o){const{command:r,args:e}=i(o,c,["--root",".","--config","ark.config.json"]),t=e.map(n=>`"${n.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`).join(", ");return`# Generated by ark-check --install-agent-gates (Grok Build project scope).
 # Restart Grok (or /mcps \u2192 refresh) after changes. Also loads repo-root .mcp.json.
 [mcp_servers.ark]
 command = "${r.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"
 args = [${t}]
-`}function u(e){const r=s(e),o="${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}";return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",timeout:30,command:`${r} ${c} --session-context --root "${o}" --config ark.config.json`}]}],PreToolUse:[{matcher:"Write|Edit|MultiEdit|write|search_replace",hooks:[{type:"command",timeout:30,command:`${r} ${c} --hook --hook-repair --fail-on-new-smells --root "${o}" --config ark.config.json`}]}]}},null,2)}
-`}function k(e){const r=s(e);return`${JSON.stringify({"ark-write-gate":{PreToolUse:[{matcher:"write_to_file|replace_file_content|multi_replace_file_content",hooks:[{type:"command",timeout:30,command:`${r} ${c} --hook --hook-repair --fail-on-new-smells --root "\${PWD:-.}" --config ark.config.json`}]}]}},null,2)}
-`}function d(e){const{command:r,args:o}=i(e,c,["--root",".","--config","ark.config.json"]);return`${JSON.stringify({$schema:"https://opencode.ai/config.json",mcp:{ark:{type:"local",command:[r,...o],enabled:!0}}},null,2)}
-`}function $(e,r){let o,t;try{o=e&&e.trim()?JSON.parse(e):{},t=JSON.parse(r)}catch{return null}if(!o||typeof o!="object"||Array.isArray(o)||!t||typeof t!="object"||Array.isArray(t))return null;const n=t["ark-write-gate"];if(!n||typeof n!="object")return null;const a={...o,"ark-write-gate":n};return`${JSON.stringify(a,null,2)}
-`}function h(e,r){let o,t;try{o=e&&e.trim()?JSON.parse(e):{},t=JSON.parse(r)}catch{return null}if(!o||typeof o!="object"||Array.isArray(o))return null;const n={...o};!n.$schema&&t.$schema&&(n.$schema=t.$schema);const a=o.mcp&&typeof o.mcp=="object"&&!Array.isArray(o.mcp)?{...o.mcp}:{};return a.ark=t.mcp.ark,n.mcp=a,`${JSON.stringify(n,null,2)}
-`}export{c as PREFERRED_MCP_BIN,k as antigravityHooks,l as claudeSettings,p as codexHooks,g as codexProjectConfig,u as grokHooks,f as grokProjectConfig,$ as mergeAntigravityArkHook,h as mergeOpencodeArkMcp,d as opencodeProjectConfig};
+`}function u(o){const r=s(o);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",timeout:30,command:`${r} ${c} --session-context --root . --root-env GROK_WORKSPACE_ROOT,CLAUDE_PROJECT_DIR --config ark.config.json`}]}],PreToolUse:[{matcher:"Write|Edit|MultiEdit|write|search_replace",hooks:[{type:"command",timeout:30,command:`${r} ${c} --hook --hook-repair --fail-on-new-smells --root . --root-env GROK_WORKSPACE_ROOT,CLAUDE_PROJECT_DIR --config ark.config.json`}]}]}},null,2)}
+`}function k(o){const r=s(o);return`${JSON.stringify({"ark-write-gate":{PreToolUse:[{matcher:"write_to_file|replace_file_content|multi_replace_file_content",hooks:[{type:"command",timeout:30,command:`${r} ${c} --hook --hook-repair --fail-on-new-smells --root . --config ark.config.json`}]}]}},null,2)}
+`}function d(o){const{command:r,args:e}=i(o,c,["--root",".","--config","ark.config.json"]);return`${JSON.stringify({$schema:"https://opencode.ai/config.json",mcp:{ark:{type:"local",command:[r,...e],enabled:!0}}},null,2)}
+`}function h(o,r){let e,t;try{e=o&&o.trim()?JSON.parse(o):{},t=JSON.parse(r)}catch{return null}if(!e||typeof e!="object"||Array.isArray(e)||!t||typeof t!="object"||Array.isArray(t))return null;const n=t["ark-write-gate"];if(!n||typeof n!="object")return null;const a={...e,"ark-write-gate":n};return`${JSON.stringify(a,null,2)}
+`}function y(o,r){let e,t;try{e=o&&o.trim()?JSON.parse(o):{},t=JSON.parse(r)}catch{return null}if(!e||typeof e!="object"||Array.isArray(e))return null;const n={...e};!n.$schema&&t.$schema&&(n.$schema=t.$schema);const a=e.mcp&&typeof e.mcp=="object"&&!Array.isArray(e.mcp)?{...e.mcp}:{};return a.ark=t.mcp.ark,n.mcp=a,`${JSON.stringify(n,null,2)}
+`}export{c as PREFERRED_MCP_BIN,k as antigravityHooks,l as claudeSettings,p as codexHooks,f as codexProjectConfig,u as grokHooks,g as grokProjectConfig,h as mergeAntigravityArkHook,y as mergeOpencodeArkMcp,d as opencodeProjectConfig};

package/bin/lib/host-support-matrix.mjs

@@ -6,7 +6,21 @@
  * reported separately by write-path-capabilities.mjs.
  */
 
-function hostProfile(label, hookPath, hookSurface, hookOperations, hardWrite, repairPayload) {
+/**
+ * @param {string} label
+ * @param {string|null} hookPath
+ * @param {string|null} hookSurface
+ * @param {string[]} hookOperations
+ * @param {boolean} hardWrite
+ * @param {boolean} repairPayload reinjection guaranteed under hard boundary (historical key)
+ * @param {{ repairEnvelopeEmitted?: boolean, operationCoverage?: Record<string, boolean> }} [extras]
+ */
+function hostProfile(label, hookPath, hookSurface, hookOperations, hardWrite, repairPayload, extras = {}) {
+  // EH07: repair envelope emission ≠ reinjection guarantee.
+  // Codex hooks may emit --hook-repair JSON while reinjection stays host-dependent / not hard.
+  const repairEnvelopeEmitted =
+    extras.repairEnvelopeEmitted === true || repairPayload === true;
+  const repairReinjectionGuaranteed = hardWrite === true && repairPayload === true;
   return Object.freeze({
     label,
     hookPath,
@@ -16,8 +30,16 @@ function hostProfile(label, hookPath, hookSurface, hookOperations, hardWrite, re
       'hard-write': hardWrite,
       'advisory-write': true,
       'merge-gate': true,
+      // Historical key: true only when hard reinjection path is package-supported.
       'repair-payload': repairPayload,
+      'repair-envelope-emitted': repairEnvelopeEmitted,
+      'repair-reinjection-guaranteed': repairReinjectionGuaranteed,
     }),
+    // EH07 minimum ops matrix (hard=false for soft hosts on every listed op).
+    operationCoverage: Object.freeze(
+      extras.operationCoverage ||
+        Object.fromEntries(hookOperations.map((op) => [op, hardWrite === true]))
+    ),
   });
 }
 
@@ -48,14 +70,25 @@ export const HOST_SUPPORT_MATRIX = Object.freeze({
     true,
     true
   ),
-  cursor: hostProfile('Cursor', null, null, [], false, false),
+  cursor: hostProfile('Cursor', null, null, [], false, false, {
+    operationCoverage: { shell: false, 'pre-commit': false },
+  }),
   codex: hostProfile(
     'OpenAI Codex',
     '.codex/hooks.json',
     'Best-effort PreToolUse `apply_patch`; Code Mode hosts may bypass the event',
     ['apply_patch'],
     false,
-    false
+    false,
+    {
+      // Install writes --hook-repair; envelope can be emitted; reinjection is not guaranteed.
+      repairEnvelopeEmitted: true,
+      operationCoverage: {
+        apply_patch: false,
+        shell: false,
+        'pre-commit': false,
+      },
+    }
   ),
   // OpenCode: first-class MCP + permissions; plugin tool.execute.before is incomplete
   // (subagent holes). Never claim hard write.
@@ -65,7 +98,10 @@ export const HOST_SUPPORT_MATRIX = Object.freeze({
     'Advisory MCP + optional experimental plugin (`tool.execute.before`); not a hard boundary',
     [],
     false,
-    false
+    false,
+    {
+      operationCoverage: { shell: false, 'pre-commit': false },
+    }
   ),
 });
 
@@ -82,7 +118,15 @@ export function formatHostSupportSummary(profile) {
   const write = capabilities['hard-write']
     ? 'hard local write boundary'
     : 'no hard local write boundary';
-  const repair = capabilities['repair-payload'] ? 'repair payload' : 'no hard-boundary repair';
+  // EH07 three-way repair story: reinjection guaranteed / envelope-only / none.
+  let repair;
+  if (capabilities['repair-reinjection-guaranteed']) {
+    repair = 'repair reinjection (hard path)';
+  } else if (capabilities['repair-envelope-emitted']) {
+    repair = 'repair envelope may emit (reinjection not guaranteed)';
+  } else {
+    repair = 'no hard-boundary repair';
+  }
   return `${write} + advisory MCP + CI check + ${repair}`;
 }
 
@@ -104,12 +148,18 @@ export function renderHostSupportMatrixMarkdown() {
     } else {
       local = '**Advisory only** at write (no hard hook)';
     }
-    const repair = capabilities['repair-payload']
-      ? 'Emitted on hook deny; host must re-inject'
-      : 'No hard-boundary payload';
-    const merge = capabilities['hard-write']
-      ? '**Required status** = hard merge boundary (`arkgate-check --strict-merge`)'
-      : '**Required status** = hard merge boundary (same CI)';
+    // EH07: distinguish envelope emission vs reinjection guarantee in the repair column.
+    let repair;
+    if (capabilities['repair-reinjection-guaranteed']) {
+      repair = 'Emitted on hook deny; host must re-inject (hard path when installed + trusted)';
+    } else if (capabilities['repair-envelope-emitted']) {
+      repair = 'Envelope may emit (`--hook-repair`); reinjection **not** guaranteed (advisory host)';
+    } else {
+      repair = 'No hard-boundary payload';
+    }
+    // EH07: name the CLI explicitly; required status is a GitHub status context name, not the CLI alone.
+    const merge =
+      '**Required GitHub status context** running `arkgate-check --strict-merge` (alias `ark-check`)';
     return `| ${profile.label} | ${local} | Advisory; the agent must call it | ${merge} | ${repair} |`;
   }).join('\n');
 
@@ -118,9 +168,30 @@ export function renderHostSupportMatrixMarkdown() {
 ${rows}
 
 **Read the CI column:** for every host, the repository-wide hard guarantee is a **required**
-merge check — not “CI file present.” Cursor/Codex/OpenCode never get a fake hard write claim.
+GitHub **status context** that runs the CLI — not “CI file present,” and not the CLI binary name alone.
+Cursor/Codex/OpenCode never get a fake hard write claim.
+
+This table describes the supported profile **after its files are installed and the host loads/trusts them**. A hard local boundary covers only the listed hook operations; alternate tools, direct filesystem writes, and human edits still rely on CI. MCP validation is advisory because the agent must call it. The CI check blocks a merge only when the repository makes that status required. Repair **envelopes** may be emitted without reinjection being guaranteed; silent auto-apply never happens. Run \`arkgate-check --doctor\` (or \`ark-check --doctor\`) for the evidence actually detected in the current repository.`;
+}
 
-This table describes the supported profile **after its files are installed and the host loads/trusts them**. A hard local boundary covers only the listed hook operations; alternate tools, direct filesystem writes, and human edits still rely on CI. MCP validation is advisory because the agent must call it. The CI check blocks a merge only when the repository makes that status required. Repair payloads never write code silently: the host must re-inject the candidate and ArkGate revalidates it. Run \`arkgate-check --doctor\` for the evidence actually detected in the current repository.`;
+/**
+ * EH07 doctor/JSON host capability split for repair envelope vs reinjection.
+ * @param {string|null|undefined} host
+ */
+export function hostRepairCapabilities(host) {
+  const profile = getHostSupportProfile(host);
+  if (!profile) {
+    return {
+      repairEnvelopeEmitted: false,
+      repairReinjectionGuaranteed: false,
+      operationCoverage: {},
+    };
+  }
+  return {
+    repairEnvelopeEmitted: profile.capabilities['repair-envelope-emitted'] === true,
+    repairReinjectionGuaranteed: profile.capabilities['repair-reinjection-guaranteed'] === true,
+    operationCoverage: { ...(profile.operationCoverage || {}) },
+  };
 }
 
 /**
@@ -129,19 +200,22 @@ This table describes the supported profile **after its files are installed and t
  */
 export function doctorWritePathHonestyMessage(activeHost, hardWriteActive) {
   const host = typeof activeHost === 'string' ? activeHost.trim().toLowerCase() : '';
+  // EH07: distinguish CLI command (arkgate-check / ark-check) from the GitHub required status context name.
+  const mergeBoundary =
+    'Required CI hard merge boundary = a required GitHub status context that runs arkgate-check --strict-merge (alias ark-check --strict-merge)';
   if (host === 'cursor') {
-    return 'Cursor: write path is advisory (MCP/rules; no hard PreToolUse). Required CI status (arkgate-check --strict-merge) is the hard merge boundary.';
+    return `Cursor: write path is advisory (MCP/rules; no hard PreToolUse). ${mergeBoundary}.`;
   }
   if (host === 'codex') {
-    return 'Codex: write path is advisory / best-effort at write (not Claude/Grok hard). Required CI status (arkgate-check --strict-merge) is the hard merge boundary.';
+    return `Codex: write path is advisory / best-effort at write (not Claude/Grok hard). ${mergeBoundary}.`;
   }
   if (host === 'opencode') {
-    return 'OpenCode: write path is advisory / best-effort (MCP + optional plugin; not Claude/Grok/Antigravity hard). Required CI status (arkgate-check --strict-merge) is the hard merge boundary.';
+    return `OpenCode: write path is advisory / best-effort (MCP + optional plugin; not Claude/Grok/Antigravity hard). ${mergeBoundary}.`;
   }
   if ((host === 'claude' || host === 'grok' || host === 'antigravity') && !hardWriteActive) {
     const label =
       host === 'claude' ? 'Claude' : host === 'grok' ? 'Grok' : 'Antigravity';
-    return `${label}: hard PreToolUse is supported for listed ops when installed + trusted; without runtime-observed hook evidence, hard is unverified. Required CI remains the merge hard boundary.`;
+    return `${label}: hard PreToolUse is supported for listed ops when installed + trusted; without runtime-observed hook evidence, hard is unverified. ${mergeBoundary}.`;
   }
   return null;
 }

package/bin/lib/html-report-depth.mjs

@@ -288,6 +288,10 @@ function baselineLegendBody(signal) {
 export function renderProductHonestyCard(productHonesty, mergePlanes = null) {
   if (!productHonesty || typeof productHonesty !== 'object') return '';
   const unfinished = productHonesty.unfinished === true;
+  const envResiduals = Array.isArray(productHonesty.environmentResidualIds)
+    ? productHonesty.environmentResidualIds
+    : [];
+  const envOnly = !unfinished && envResiduals.length > 0;
   const headline = productHonesty.headline || (unfinished ? 'Not finished' : 'Honesty clear');
   const primary = productHonesty.primaryMessage || '';
   // Avoid repeating the same status label in title and body (past-issue pattern).
@@ -298,7 +302,9 @@ export function renderProductHonestyCard(productHonesty, mergePlanes = null) {
     if (p === h) {
       body = unfinished
         ? 'Residual honesty signals remain — not a whole-tree guarantee and not a score.'
-        : 'No residual honesty blockers on this slice — still not a numeric architecture score.';
+        : envOnly
+          ? 'Architecture residual clear; host/environment residual remains (advisory write) — not a score.'
+          : 'No residual honesty blockers on this slice — still not a numeric architecture score.';
     } else if (p.toLowerCase().startsWith(h.toLowerCase())) {
       const stripped = p.slice(h.length).replace(/^[\s—–:-]+/, '').trim();
       body = stripped || p;
@@ -319,10 +325,15 @@ export function renderProductHonestyCard(productHonesty, mergePlanes = null) {
     mergePlanes?.dualPlaneStamp
       ? `<p class="dim" style="margin:.25rem 0 0;font-size:.84rem">${esc(mergePlanes.dualPlaneStamp)}</p>`
       : '';
+  const subtitle = unfinished
+    ? 'architecture residual'
+    : envOnly
+      ? 'environment residual (advisory write)'
+      : 'no residual honesty blockers';
   return `<div class="section card design-strip ${unfinished ? 'is-weak' : 'is-clean'}" id="product-honesty" data-product-honesty="1">
     <div class="design-head">
       <span class="badge design" title="Product honesty — not a score">${esc(headline)}</span>
-      <span class="dim" style="font-size:.86rem">${unfinished ? 'residual honesty signals' : 'no residual honesty blockers'}</span>
+      <span class="dim" style="font-size:.86rem">${esc(subtitle)}</span>
     </div>
     <p style="margin:.45rem 0 0">${esc(body)}</p>
     ${reasonHtml}

package/bin/lib/html-report-evolution.mjs

@@ -0,0 +1,114 @@
+export function renderEvolutionSection({
+  originSnapshot,
+  currentSnapshot,
+  originJustCreated,
+  esc,
+  formatDelta,
+  historyMax,
+}) {
+  if (!currentSnapshot) return '';
+  if (originJustCreated || !originSnapshot) {
+    return `<div class="section card evolve">
+        <h2>Origin baseline captured</h2>
+        <p class="dim" style="margin:.2rem 0 0;font-size:.9rem">
+          This is the <b>first</b> architecture snapshot for this project
+          (<code>.ark/reports/origin.json</code> + <code>origin.html</code>).
+          Future reports will show deltas against this starting point so you can prove evolution.
+        </p>
+      </div>`;
+  }
+  const scoreComparable =
+    typeof originSnapshot.arkVersion === 'string' &&
+    originSnapshot.arkVersion.length > 0 &&
+    originSnapshot.arkVersion === currentSnapshot.arkVersion;
+  const rows = [
+    ['Ark score', originSnapshot.score, currentSnapshot.score, '', scoreComparable],
+    ['Governed %', originSnapshot.governedPercent, currentSnapshot.governedPercent, 'pp', true],
+    ['Files in scope', originSnapshot.totalFiles, currentSnapshot.totalFiles, '', true],
+    ['Classified files', originSnapshot.classifiedFiles, currentSnapshot.classifiedFiles, '', true],
+    ['Active violations', originSnapshot.activeViolations, currentSnapshot.activeViolations, '', true],
+    ['Value violations', originSnapshot.valueViolations, currentSnapshot.valueViolations, '', true],
+    ['Type-only violations', originSnapshot.typeOnlyViolations, currentSnapshot.typeOnlyViolations, '', true],
+    ['Layers', originSnapshot.layerCount, currentSnapshot.layerCount, '', true],
+    ['Deny rules', originSnapshot.denyRules, currentSnapshot.denyRules, '', true],
+    ['Gates configured', originSnapshot.gatesOn, currentSnapshot.gatesOn, '', true],
+  ];
+  const originDate = (originSnapshot.generatedAt || '').slice(0, 10) || 'origin';
+  const nowDate = (currentSnapshot.generatedAt || '').slice(0, 10) || 'now';
+  const tr = rows
+    .map(([label, from, to, unit, comparable]) => {
+      const d =
+        comparable && typeof from === 'number' && typeof to === 'number'
+          ? to - from
+          : null;
+      const good =
+        label.includes('violation') || label.includes('Violation')
+          ? d != null && d <= 0
+          : label.includes('Governed') ||
+              label.includes('score') ||
+              label.includes('Classified') ||
+              label.includes('Gates')
+            ? d != null && d >= 0
+            : null;
+      const cls =
+        d == null || d === 0 ? 'flat' : good === true ? 'up' : good === false ? 'down' : 'flat';
+      const delta =
+        d == null
+          ? '—'
+          : unit === 'pp'
+            ? formatDelta(Math.round(d * 10) / 10, { suffix: ' pp' })
+            : formatDelta(d);
+      return `<tr>
+          <td>${esc(label)}</td>
+          <td class="num">${from ?? '—'}</td>
+          <td class="num">${to ?? '—'}</td>
+          <td class="num delta ${cls}">${esc(delta)}</td>
+        </tr>`;
+    })
+    .join('\n');
+  const originLayers = originSnapshot.layerFiles || {};
+  const currentLayers = currentSnapshot.layerFiles || {};
+  const layerKeys = [
+    ...new Set([...Object.keys(originLayers), ...Object.keys(currentLayers)]),
+  ].sort();
+  const layerTr = layerKeys
+    .map((name) => {
+      const from = originLayers[name] || 0;
+      const to = currentLayers[name] || 0;
+      const d = to - from;
+      const cls = d === 0 ? 'flat' : d > 0 ? 'up' : 'down';
+      return `<tr>
+          <td class="ln">${esc(name)}</td>
+          <td class="num">${from}</td>
+          <td class="num">${to}</td>
+          <td class="num delta ${cls}">${esc(formatDelta(d))}</td>
+        </tr>`;
+    })
+    .join('\n');
+  const scoreNote = scoreComparable
+    ? ''
+    : `<p class="dim" style="margin:-.35rem 0 .75rem;font-size:.88rem">
+        Ark score is not comparable across Ark versions
+        (<code>${esc(originSnapshot.arkVersion ?? 'unknown')}</code> →
+        <code>${esc(currentSnapshot.arkVersion ?? 'unknown')}</code>); its Δ is shown as —.
+        Raw coverage, files, violations, layers, rules, and gate metrics remain visible.
+      </p>`;
+  return `<div class="section card evolve">
+      <h2>Evolution vs origin</h2>
+      <p class="dim" style="margin:.15rem 0 .75rem;font-size:.88rem">
+        Origin snapshot <code>${esc(originDate)}</code> → this report <code>${esc(nowDate)}</code>
+        · frozen at <code>.ark/reports/origin.*</code> · reopen origin HTML anytime for the starting picture.
+      </p>
+      ${scoreNote}
+      <table class="layers">
+        <tr><th>Metric</th><th>Origin</th><th>Now</th><th>Δ</th></tr>
+        ${tr}
+      </table>
+      <h3>Files per layer</h3>
+      <table class="layers">
+        <tr><th>Layer</th><th>Origin</th><th>Now</th><th>Δ</th></tr>
+        ${layerTr || '<tr><td colspan="4" class="dim">No layer file data in snapshots.</td></tr>'}
+      </table>
+      <p class="legend">Green Δ = improvement for that metric (↑ coverage/score/gates, ↓ violations). Score Δ is comparable only within the same Ark version. History JSON under <code>.ark/reports/history/</code> (last ${historyMax}).</p>
+    </div>`;
+}