arkgate 4.1.1 → 4.2.1

package/bin/lib/effective-contract-load.mjs

@@ -10,6 +10,35 @@ import {
   loadArkRulesContract,
 } from './arkrules-contract.mjs';
 
+function normalizeProjectRelativePath(value) {
+  const normalized = value.replace(/\\/g, '/');
+  if (
+    !normalized ||
+    normalized.startsWith('/') ||
+    /^[A-Za-z]:/.test(normalized) ||
+    normalized.includes('\0')
+  ) {
+    return undefined;
+  }
+  const segments = [];
+  for (const segment of normalized.split('/')) {
+    if (!segment || segment === '.') continue;
+    if (segment === '..') return undefined;
+    segments.push(segment);
+  }
+  return segments.length > 0 ? segments.join('/') : undefined;
+}
+
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return (
+    relative === '' ||
+    (!relative.startsWith(`..${path.sep}`) &&
+      relative !== '..' &&
+      !path.isAbsolute(relative))
+  );
+}
+
 /**
  * @param {string} root
  * @param {Record<string, unknown>} config loaded ark.config.json object
@@ -29,6 +58,7 @@ export function loadEffectiveArkRulesFromDisk(root, config, opts = {}) {
   const warnings = [];
   const parts = [];
   const referenced = new Set();
+  const canonicalRoot = fs.realpathSync(root);
 
   for (const layer of Object.keys(refs).sort()) {
     const relRaw = refs[layer];
@@ -37,10 +67,12 @@ export function loadEffectiveArkRulesFromDisk(root, config, opts = {}) {
       errors.push({ path: pathKey, message: 'must be a non-empty relative path string' });
       continue;
     }
-    if (relRaw.startsWith('/') || /^[A-Za-z]:[\\/]/.test(relRaw)) {
+    const rel = normalizeProjectRelativePath(relRaw);
+    if (!rel) {
       errors.push({
         path: pathKey,
-        message: 'must be a project-relative path (absolute paths are not allowed)',
+        message:
+          'must be a project-relative path without absolute roots or parent-directory traversal',
       });
       continue;
     }
@@ -52,17 +84,42 @@ export function loadEffectiveArkRulesFromDisk(root, config, opts = {}) {
       continue;
     }
 
-    const rel = relRaw.replace(/\\/g, '/').replace(/^\.\//, '');
     referenced.add(rel);
-    const absolute = path.resolve(root, rel);
-    opts.observeInput?.(absolute, 'arkrules');
-    if (!fs.existsSync(absolute)) {
+    const lexicalTarget = path.resolve(canonicalRoot, ...rel.split('/'));
+    if (!isWithinRoot(canonicalRoot, lexicalTarget)) {
+      errors.push({
+        path: pathKey,
+        message: `referenced ArkRules path ${JSON.stringify(rel)} resolves outside the project root`,
+      });
+      continue;
+    }
+    if (!fs.existsSync(lexicalTarget)) {
       errors.push({
         path: pathKey,
         message: `referenced ArkRules file ${JSON.stringify(rel)} is missing`,
       });
       continue;
     }
+    let absolute;
+    try {
+      absolute = fs.realpathSync(lexicalTarget);
+    } catch (error) {
+      errors.push({
+        path: pathKey,
+        message: `referenced ArkRules file ${JSON.stringify(rel)} could not be resolved: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      });
+      continue;
+    }
+    if (!isWithinRoot(canonicalRoot, absolute)) {
+      errors.push({
+        path: pathKey,
+        message: `referenced ArkRules path ${JSON.stringify(rel)} resolves outside the project root`,
+      });
+      continue;
+    }
+    opts.observeInput?.(absolute, 'arkrules');
     let content;
     try {
       content = fs.readFileSync(absolute, 'utf8');
@@ -90,9 +147,16 @@ export function loadEffectiveArkRulesFromDisk(root, config, opts = {}) {
   }
 
   // Drift: unreferenced files under arkrules/
-  const arkrulesDir = path.join(root, 'arkrules');
-  if (fs.existsSync(arkrulesDir) && fs.statSync(arkrulesDir).isDirectory()) {
-    for (const name of fs.readdirSync(arkrulesDir).sort()) {
+  const arkrulesDir = path.join(canonicalRoot, 'arkrules');
+  const resolvedArkRulesDir = fs.existsSync(arkrulesDir)
+    ? fs.realpathSync(arkrulesDir)
+    : undefined;
+  if (
+    resolvedArkRulesDir &&
+    isWithinRoot(canonicalRoot, resolvedArkRulesDir) &&
+    fs.statSync(resolvedArkRulesDir).isDirectory()
+  ) {
+    for (const name of fs.readdirSync(resolvedArkRulesDir).sort()) {
       if (!name.endsWith('.json')) continue;
       const rel = `arkrules/${name}`;
       if (!referenced.has(rel)) {

package/bin/lib/enforcement-state.mjs

@@ -1,2 +1,2 @@
 // Generated from enforcement-state.source.mjs — run npm run generate:packaged-tooling.
-import m from"node:fs";import{createRequire as q}from"node:module";import h from"node:path";const n="unverified";function S(a){const e=h.join(a,"package.json");try{if(JSON.parse(m.readFileSync(e,"utf8"))?.name==="arkgate"&&m.statSync(h.join(a,"bin","ark-check.mjs"),{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"package.json + bin/ark-check.mjs (self-host)",selfHost:!0}}catch{}try{const r=q(e).resolve("arkgate/package.json"),o=h.dirname(r),i=JSON.parse(m.readFileSync(r,"utf8")),s=h.join(o,"bin","ark-check.mjs");if(i?.name==="arkgate"&&m.statSync(s,{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"arkgate/package.json via project resolver",selfHost:!1}}catch{}return{installed:!1,source:"arkgate/package.json unresolved from project",selfHost:!1}}function M(a){return a.length>0?a:["filesystem scan (no matching configuration)"]}function g({supported:a,configuredPaths:e,installed:r,active:o,runtimeObserved:i,operation:s,operationCoverage:v,bypassable:u,required:c,hard:t,sources:l}){const p=e.length>0,d=!!r.installed;return{supported:a,analyzed:!0,configured:p,installed:d,active:o,runtimeObserved:i,operation:s,operationCoverage:v,bypassable:u,required:c,hard:t,evidence:[...M(e).map(f=>({field:"configured",source:f,value:p})),{field:"installed",source:r.source,value:d},{field:"active",source:l.active,value:o},{field:"runtimeObserved",source:l.runtimeObserved,value:i},{field:"operationCoverage",source:l.operationCoverage,value:v},{field:"bypassable",source:l.bypassable,value:u},{field:"required",source:l.required,value:c},{field:"hard",source:l.hard,value:t}]}}function O(a,e){const r=S(a),o=!!e.support?.capabilities?.["hard-write"],i=!!e.support?.capabilities?.["advisory-write"],s=e.capabilityEvidence["hard-write"],v=e.capabilityEvidence["advisory-write"],u=e.capabilityEvidence["merge-gate"],c=e.enforcementLadder.localWrite,t=typeof c.operationCovered=="boolean",l=t?c.operationCovered:n,p=t&&l===!0,d=!!(o&&r.installed&&p&&c.hard===!0),f=t?p&&r.installed:o&&s.length>0&&r.installed?n:!1,b=i&&v.length>0&&r.installed?n:!1,y=!!(e.ci?.failClosed&&u.length>0),C=y&&r.installed?n:!1;return{schemaVersion:"1.1",activeHost:e.activeHost,localWrite:g({supported:o,configuredPaths:s,installed:r,active:f,runtimeObserved:t,operation:t?c.operation??null:null,operationCoverage:l,bypassable:d?!1:o&&!t?n:!0,required:n,hard:d,sources:{active:t?"observed PreToolUse attempt":"runtime observation unavailable",runtimeObserved:t?"fresh PreToolUse invocation":"runtime observation unavailable",operationCoverage:t?"active-host operation matcher":"operation not observed",bypassable:d?"observed hard write boundary":"host runtime bypass evidence unavailable",required:"local host policy unavailable",hard:d?"fresh covered active-host invocation":"hardness not proven for this invocation"}}),advisoryMcp:g({supported:i,configuredPaths:v,installed:r,active:b,runtimeObserved:!1,operation:null,operationCoverage:n,bypassable:!0,required:n,hard:!1,sources:{active:"MCP runtime observation unavailable",runtimeObserved:"doctor did not observe an MCP tool invocation",operationCoverage:"advisory MCP is caller-invoked",bypassable:"advisory MCP does not intercept every write",required:"local host policy unavailable",hard:"MCP presence is advisory and never proves a hard boundary"}}),ciMerge:g({supported:!0,configuredPaths:y?u:[],installed:r,active:C,runtimeObserved:!1,operation:"merge",operationCoverage:y?n:!1,bypassable:y?n:!0,required:n,hard:!1,sources:{active:"CI run and provider enforcement not observed",runtimeObserved:"provider evidence unavailable",operationCoverage:"required-status operation coverage unavailable",bypassable:"branch-protection evidence unavailable",required:"branch-protection evidence unavailable",hard:"merge hardness requires fresh provider evidence"}})}}function $(a,e,r,o){return{...a,...o,evidence:[...a.evidence.filter(i=>!e.includes(i.field)),...e.map(i=>({field:i,source:r,value:o[i]}))]}}function R(a,e){if(!e)return a;const r=e.reason==="provider-policy-unavailable-plan"||e.policyReason==="unavailable-plan",o=e.available===!0,i=!o&&!r&&(e.reason==="provider-enforcement-unverified"||e.reason==="gh-cli-unavailable"||e.reason==="gh-repo-unavailable"||!!e.reason);if(!o&&e.runtimeObserved!==!0&&!r&&!i)return a;const s=o?typeof e.arkCheckRequired=="boolean"?e.arkCheckRequired:n:r?!1:n,v=!!(a.enforcementState.ciMerge.configured&&a.enforcementState.ciMerge.installed),u=s===!0?v:s===!1?!1:v?n:!1,c=u===!0?e.arkCheckSourceBound===!1?!0:n:s===!1?!0:v?n:!0,t=e.runtimeObserved===!0,l=o?`GitHub branch protection (${e.repo??"repository"}:${e.branch??"default"})`:r?`GitHub provider policy unavailable (plan) (${e.repo??"repository"}:${e.branch??"default"})`:`GitHub CI runtime (${e.repo??"repository"})`,p=s,d=u===!0&&c===!1&&p===!0,f=$(a.enforcementState.ciMerge,["active","runtimeObserved","operationCoverage","bypassable","required","hard"],l,{active:u,runtimeObserved:t,operationCoverage:p,bypassable:c,required:s,hard:d}),b={...a,enforcementState:{...a.enforcementState,ciMerge:f},enforcementLadder:{...a.enforcementLadder,ciMerge:{...a.enforcementLadder.ciMerge,requiredStatus:s,...e.latestCiRun?{latestCiRun:e.latestCiRun}:{},...r?{providerPolicy:"unavailable-plan"}:{}}}};return(r||e.reason)&&(b.providerEnforcement={available:o,reason:e.reason||(r?"provider-policy-unavailable-plan":"provider-enforcement-unverified"),policyReason:e.policyReason||(r?"unavailable-plan":null),runtimeObserved:t,latestCiRun:e.latestCiRun??null,hard:d===!0}),b}function k(a,e){const r=o=>o===!0?"yes":o===!1?"no":String(o);return`${a} \u2014 supported: ${r(e.supported)} \xB7 analyzed: ${r(e.analyzed)} \xB7 configured: ${r(e.configured)} \xB7 installed: ${r(e.installed)} \xB7 runtime observed: ${r(e.runtimeObserved)} \xB7 operation: ${e.operation??"none"} \xB7 operation covered: ${r(e.operationCoverage)} \xB7 active: ${r(e.active)} \xB7 bypassable: ${r(e.bypassable)} \xB7 required: ${r(e.required)} \xB7 hard: ${r(e.hard)}`}function x(a){const e=[{level:a.localWrite.active===!0?"ok":"warn",text:k("Local write",a.localWrite)},{level:"warn",text:k("Advisory MCP",a.advisoryMcp)},{level:a.ciMerge.required===!0?"ok":"warn",text:k("CI merge",a.ciMerge)}];return a.localWrite.active===n&&a.localWrite.hard===!1&&e.push({level:"bad",text:"RED FLAG: local hook assets exist, but this active-host operation was not observed at runtime; hard blocking is unverified."}),a.activeHost==="unknown"&&e.push({level:"warn",text:"Active host unknown for this invocation \u2014 enforcementState is session projection only. See writePath.inventory for on-disk host hooks; hard write is never claimed without runtime proof."}),e}export{O as buildEnforcementState,x as enforcementDoctorLines,S as packageInstallation,R as withCiProviderEvidence};
+import m from"node:fs";import{createRequire as q}from"node:module";import h from"node:path";const n="unverified";function O({configuredOnDisk:a=!1,restartRequired:e=a}={}){return{configuredOnDisk:!!a,restartRequired:!!e,runtimeObserved:!1,identityMatch:n,active:!1}}function M(a){const e=h.join(a,"package.json");try{if(JSON.parse(m.readFileSync(e,"utf8"))?.name==="arkgate"&&m.statSync(h.join(a,"bin","ark-check.mjs"),{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"package.json + bin/ark-check.mjs (self-host)",selfHost:!0}}catch{}try{const r=q(e).resolve("arkgate/package.json"),o=h.dirname(r),i=JSON.parse(m.readFileSync(r,"utf8")),s=h.join(o,"bin","ark-check.mjs");if(i?.name==="arkgate"&&m.statSync(s,{throwIfNoEntry:!1})?.isFile())return{installed:!0,source:"arkgate/package.json via project resolver",selfHost:!1}}catch{}return{installed:!1,source:"arkgate/package.json unresolved from project",selfHost:!1}}function S(a){return a.length>0?a:["filesystem scan (no matching configuration)"]}function g({supported:a,configuredPaths:e,installed:r,active:o,runtimeObserved:i,operation:s,operationCoverage:u,bypassable:v,required:c,hard:t,sources:l}){const p=e.length>0,d=!!r.installed;return{supported:a,analyzed:!0,configured:p,installed:d,active:o,runtimeObserved:i,operation:s,operationCoverage:u,bypassable:v,required:c,hard:t,evidence:[...S(e).map(f=>({field:"configured",source:f,value:p})),{field:"installed",source:r.source,value:d},{field:"active",source:l.active,value:o},{field:"runtimeObserved",source:l.runtimeObserved,value:i},{field:"operationCoverage",source:l.operationCoverage,value:u},{field:"bypassable",source:l.bypassable,value:v},{field:"required",source:l.required,value:c},{field:"hard",source:l.hard,value:t}]}}function E(a,e){const r=M(a),o=!!e.support?.capabilities?.["hard-write"],i=!!e.support?.capabilities?.["advisory-write"],s=e.capabilityEvidence["hard-write"],u=e.capabilityEvidence["advisory-write"],v=e.capabilityEvidence["merge-gate"],c=e.enforcementLadder.localWrite,t=typeof c.operationCovered=="boolean",l=t?c.operationCovered:n,p=t&&l===!0,d=!!(o&&r.installed&&p&&c.hard===!0),f=t?p&&r.installed:o&&s.length>0&&r.installed?n:!1,b=i&&u.length>0&&r.installed?n:!1,y=!!(e.ci?.failClosed&&v.length>0),C=y&&r.installed?n:!1;return{schemaVersion:"1.1",activeHost:e.activeHost,localWrite:g({supported:o,configuredPaths:s,installed:r,active:f,runtimeObserved:t,operation:t?c.operation??null:null,operationCoverage:l,bypassable:d?!1:o&&!t?n:!0,required:n,hard:d,sources:{active:t?"observed PreToolUse attempt":"runtime observation unavailable",runtimeObserved:t?"fresh PreToolUse invocation":"runtime observation unavailable",operationCoverage:t?"active-host operation matcher":"operation not observed",bypassable:d?"observed hard write boundary":"host runtime bypass evidence unavailable",required:"local host policy unavailable",hard:d?"fresh covered active-host invocation":"hardness not proven for this invocation"}}),advisoryMcp:g({supported:i,configuredPaths:u,installed:r,active:b,runtimeObserved:!1,operation:null,operationCoverage:n,bypassable:!0,required:n,hard:!1,sources:{active:"MCP runtime observation unavailable",runtimeObserved:"doctor did not observe an MCP tool invocation",operationCoverage:"advisory MCP is caller-invoked",bypassable:"advisory MCP does not intercept every write",required:"local host policy unavailable",hard:"MCP presence is advisory and never proves a hard boundary"}}),ciMerge:g({supported:!0,configuredPaths:y?v:[],installed:r,active:C,runtimeObserved:!1,operation:"merge",operationCoverage:y?n:!1,bypassable:y?n:!0,required:n,hard:!1,sources:{active:"CI run and provider enforcement not observed",runtimeObserved:"provider evidence unavailable",operationCoverage:"required-status operation coverage unavailable",bypassable:"branch-protection evidence unavailable",required:"branch-protection evidence unavailable",hard:"merge hardness requires fresh provider evidence"}})}}function $(a,e,r,o){return{...a,...o,evidence:[...a.evidence.filter(i=>!e.includes(i.field)),...e.map(i=>({field:i,source:r,value:o[i]}))]}}function x(a,e){if(!e)return a;const r=e.reason==="provider-policy-unavailable-plan"||e.policyReason==="unavailable-plan",o=e.available===!0,i=!o&&!r&&(e.reason==="provider-enforcement-unverified"||e.reason==="gh-cli-unavailable"||e.reason==="gh-repo-unavailable"||!!e.reason);if(!o&&e.runtimeObserved!==!0&&!r&&!i)return a;const s=o?typeof e.arkCheckRequired=="boolean"?e.arkCheckRequired:n:r?!1:n,u=!!(a.enforcementState.ciMerge.configured&&a.enforcementState.ciMerge.installed),v=s===!0?u:s===!1?!1:u?n:!1,c=v===!0?e.arkCheckSourceBound===!1?!0:n:s===!1?!0:u?n:!0,t=e.runtimeObserved===!0,l=o?`GitHub branch protection (${e.repo??"repository"}:${e.branch??"default"})`:r?`GitHub provider policy unavailable (plan) (${e.repo??"repository"}:${e.branch??"default"})`:`GitHub CI runtime (${e.repo??"repository"})`,p=s,d=v===!0&&c===!1&&p===!0,f=$(a.enforcementState.ciMerge,["active","runtimeObserved","operationCoverage","bypassable","required","hard"],l,{active:v,runtimeObserved:t,operationCoverage:p,bypassable:c,required:s,hard:d}),b={...a,enforcementState:{...a.enforcementState,ciMerge:f},enforcementLadder:{...a.enforcementLadder,ciMerge:{...a.enforcementLadder.ciMerge,requiredStatus:s,...e.latestCiRun?{latestCiRun:e.latestCiRun}:{},...r?{providerPolicy:"unavailable-plan"}:{}}}};return(r||e.reason)&&(b.providerEnforcement={available:o,reason:e.reason||(r?"provider-policy-unavailable-plan":"provider-enforcement-unverified"),policyReason:e.policyReason||(r?"unavailable-plan":null),runtimeObserved:t,latestCiRun:e.latestCiRun??null,hard:d===!0}),b}function k(a,e){const r=o=>o===!0?"yes":o===!1?"no":String(o);return`${a} \u2014 supported: ${r(e.supported)} \xB7 analyzed: ${r(e.analyzed)} \xB7 configured: ${r(e.configured)} \xB7 installed: ${r(e.installed)} \xB7 runtime observed: ${r(e.runtimeObserved)} \xB7 operation: ${e.operation??"none"} \xB7 operation covered: ${r(e.operationCoverage)} \xB7 active: ${r(e.active)} \xB7 bypassable: ${r(e.bypassable)} \xB7 required: ${r(e.required)} \xB7 hard: ${r(e.hard)}`}function B(a){const e=[{level:a.localWrite.active===!0?"ok":"warn",text:k("Local write",a.localWrite)},{level:"warn",text:k("Advisory MCP",a.advisoryMcp)},{level:a.ciMerge.required===!0?"ok":"warn",text:k("CI merge",a.ciMerge)}];return a.localWrite.active===n&&a.localWrite.hard===!1&&e.push({level:"bad",text:"RED FLAG: local hook assets exist, but this active-host operation was not observed at runtime; hard blocking is unverified."}),a.activeHost==="unknown"&&e.push({level:"warn",text:"Active host unknown for this invocation \u2014 enforcementState is session projection only. See writePath.inventory for on-disk host hooks; hard write is never claimed without runtime proof."}),e}export{E as buildEnforcementState,O as codexRuntimeActivation,B as enforcementDoctorLines,M as packageInstallation,x as withCiProviderEvidence};

package/bin/lib/gate-files.mjs

@@ -4,6 +4,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { codexProjectMcpIsValid } from './codex-home.mjs';
+import { enforcingArkRunText } from './github-enforcement.mjs';
 
 export const __packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 export const __arkCheckCli = path.join(__packageRoot, 'bin', 'ark-check.mjs');
@@ -120,6 +122,7 @@ export const REQUIRED_GATE_FILES = [
 ];
 const REQUIRED_GATE_WORKFLOW = '.github/workflows/*.yml running ark-check';
 const COMPACT_ROUTER = /<!--\s*arkgate:compact-router host=([a-z]+)\s*-->/;
+const FAIL_CLOSED_ARK_FLAG = /(?:^|\s)--(?:strict|strict-merge|require-gates)(?=\s|$)/;
 
 const COMPACT_HOST_FILES = {
   claude: ['.claude/settings.json'],
@@ -149,24 +152,454 @@ export function isCompactRouterAgentsContent(text) {
 }
 
 function hasCompactHostRegistration(root, host) {
-  if (host === 'none') return fs.existsSync(path.join(root, '.mcp.json'));
+  if (host === 'none') return hasArkMcpRegistration(root);
+  if (host === 'cursor') return hasArkMcpRegistration(root, '.cursor/mcp.json');
+  if (host === 'codex') return hasCodexCompactRegistration(root);
   const files = COMPACT_HOST_FILES[host];
   return Boolean(files) && files.every((relativePath) => fs.existsSync(path.join(root, relativePath)));
 }
 
+function executableName(value) {
+  return path.basename(String(value).trim().replace(/\\/g, '/')).replace(/\.(?:cmd|exe)$/i, '');
+}
+
+function arkMcpArgs(server) {
+  if (!server || typeof server !== 'object' || typeof server.command !== 'string') return null;
+  if (server.args !== undefined && !Array.isArray(server.args)) return null;
+  const args = server.args ?? [];
+  if (!args.every((value) => typeof value === 'string')) return null;
+  const command = executableName(server.command);
+  const isArkBin = (value) => /^(?:arkgate-mcp|ark-mcp)(?:\.mjs)?$/.test(executableName(value));
+  if ([server.command, ...args].filter(isArkBin).length !== 1) return null;
+  if (isArkBin(server.command)) return args;
+  if ((command === 'npx' || command === 'yarn') && isArkBin(args[0])) return args.slice(1);
+  if (command === 'pnpm') {
+    const binIndex =
+      args[0] === 'exec'
+        ? 1
+        : args[0] === '--config.verify-deps-before-run=false' && args[1] === 'exec'
+          ? 2
+          : -1;
+    return binIndex >= 0 && isArkBin(args[binIndex]) ? args.slice(binIndex + 1) : null;
+  }
+  if (command === 'node') {
+    const script = String(args[0] ?? '').replace(/\\/g, '/');
+    return /(?:^|\/)bin\/ark-mcp\.mjs$/.test(script) ? args.slice(1) : null;
+  }
+  return null;
+}
+
+function projectBindingArguments(args) {
+  if (args.length !== 4) return null;
+  const values = {};
+  for (let index = 0; index < args.length; index += 2) {
+    const name = args[index];
+    if ((name !== '--root' && name !== '--config') || values[name] !== undefined) return null;
+    const value = args[index + 1];
+    if (typeof value !== 'string' || !value.trim() || value.startsWith('-')) return null;
+    values[name] = value;
+  }
+  return values['--root'] && values['--config']
+    ? { root: values['--root'], config: values['--config'] }
+    : null;
+}
+
+function nativePathInput(value) {
+  const text = String(value).trim();
+  return path.sep === '/' ? text.replace(/\\/g, '/') : text.replace(/\//g, '\\');
+}
+
+function canonicalNativePath(value) {
+  const absolute = path.resolve(value);
+  let canonical = absolute;
+  try {
+    canonical = fs.realpathSync.native(absolute);
+  } catch {
+    /* A missing candidate still compares by its normalized absolute path. */
+  }
+  const normalized = path.normalize(canonical);
+  return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+
+function bindingTargetsProject(binding, root, invocationRoot = root) {
+  const resolvedRoot = path.resolve(invocationRoot, nativePathInput(binding.root));
+  if (canonicalNativePath(resolvedRoot) !== canonicalNativePath(root)) return false;
+  const nativeConfig = nativePathInput(binding.config);
+  const resolvedConfig = path.isAbsolute(nativeConfig)
+    ? nativeConfig
+    : path.resolve(resolvedRoot, nativeConfig);
+  return (
+    canonicalNativePath(resolvedConfig) ===
+    canonicalNativePath(path.join(root, 'ark.config.json'))
+  );
+}
+
+function registrationTargetsProject(server, args, root) {
+  const binding = projectBindingArguments(args);
+  if (!binding) return false;
+  if (server.cwd !== undefined && (typeof server.cwd !== 'string' || !server.cwd.trim())) {
+    return false;
+  }
+  const invocationRoot = server.cwd
+    ? path.resolve(root, nativePathInput(server.cwd))
+    : root;
+  return bindingTargetsProject(binding, root, invocationRoot);
+}
+
+export function hasArkMcpRegistration(root, relativePath = '.mcp.json') {
+  try {
+    const server = readJson(path.join(root, relativePath))?.mcpServers?.ark;
+    const args = arkMcpArgs(server);
+    return Boolean(args && registrationTargetsProject(server, args, root));
+  } catch {
+    return false;
+  }
+}
+
+function commandArkMcpArgs(command) {
+  if (typeof command !== 'string') return null;
+  const words = [];
+  let consumed = 0;
+  for (const match of command.matchAll(/"([^"]*)"|'([^']*)'|(&&|\|\||[;|#])|([^\s;&|#]+)/g)) {
+    if (command.slice(consumed, match.index).trim() || match[3]) return null;
+    words.push(match[1] ?? match[2] ?? match[4]);
+    consumed = Number(match.index) + match[0].length;
+  }
+  if (command.slice(consumed).trim()) return null;
+  return arkMcpArgs({ command: words[0], args: words.slice(1) });
+}
+
+function codexHookArguments(args, expectedModes) {
+  const allowedModes = new Set(expectedModes);
+  const seenModes = new Set();
+  const values = {};
+  for (let index = 0; index < args.length; index += 1) {
+    const name = args[index];
+    if (allowedModes.has(name)) {
+      if (seenModes.has(name)) return null;
+      seenModes.add(name);
+      continue;
+    }
+    if (!['--root', '--root-env', '--config'].includes(name) || values[name] !== undefined) {
+      return null;
+    }
+    const value = args[++index];
+    if (typeof value !== 'string' || !value.trim() || value.startsWith('-')) return null;
+    values[name] = value;
+  }
+  if (
+    seenModes.size !== allowedModes.size ||
+    !values['--root'] ||
+    !values['--root-env'] ||
+    !values['--config']
+  ) {
+    return null;
+  }
+  return {
+    root: values['--root'],
+    rootEnv: values['--root-env'],
+    config: values['--config'],
+  };
+}
+
+function codexHookCommandIsValid(command, root, expectedModes) {
+  const args = commandArkMcpArgs(command);
+  if (!args) return false;
+  const binding = codexHookArguments(args, expectedModes);
+  return Boolean(
+    binding &&
+      binding.rootEnv === 'CODEX_PROJECT_DIR' &&
+      bindingTargetsProject(binding, root)
+  );
+}
+
+function matcherHasExactTools(matcher, expectedTools) {
+  if (typeof matcher !== 'string') return false;
+  const tools = matcher.split('|').map((tool) => tool.trim()).filter(Boolean);
+  const unique = new Set(tools);
+  return (
+    tools.length === expectedTools.length &&
+    unique.size === expectedTools.length &&
+    expectedTools.every((tool) => unique.has(tool))
+  );
+}
+
+function hookGroupHasValidCodexContract(group, root, expectedModes, expectedTools = null) {
+  if (!Array.isArray(group)) return false;
+  return group.some(
+    (entry) =>
+      entry &&
+      typeof entry === 'object' &&
+      (!expectedTools || matcherHasExactTools(entry.matcher, expectedTools)) &&
+      Array.isArray(entry.hooks) &&
+      entry.hooks.some(
+        (hook) =>
+          hook &&
+          typeof hook === 'object' &&
+          hook.type === 'command' &&
+          codexHookCommandIsValid(hook.command, root, expectedModes)
+      )
+  );
+}
+
+function hasCodexCompactRegistration(root) {
+  try {
+    const config = fs.readFileSync(path.join(root, '.codex', 'config.toml'), 'utf8');
+    const hooks = readJson(path.join(root, '.codex', 'hooks.json'))?.hooks;
+    return (
+      codexProjectMcpIsValid(config, root) &&
+      hookGroupHasValidCodexContract(hooks?.SessionStart, root, ['--session-context']) &&
+      hookGroupHasValidCodexContract(hooks?.PreToolUse, root, [
+        '--hook',
+        '--hook-repair',
+        '--fail-on-new-smells',
+      ], ['ApplyPatch', 'apply_patch', 'Write', 'Edit', 'MultiEdit'])
+    );
+  } catch {
+    return false;
+  }
+}
+
+function architectureScript(root) {
+  try {
+    const script = readPackageJson(root)?.scripts?.['check:architecture'];
+    return typeof script === 'string' ? script : '';
+  } catch {
+    return '';
+  }
+}
+
+function isFailClosedArchitectureScript(script) {
+  if (!script) return false;
+  if (
+    /(?:^|;|\n|(?<!&)&(?!&))\s*exit(?:\s+\/b)?\s+0(?=\s*(?:;|&&|\|\||#|$))/im.test(
+      script
+    )
+  ) {
+    return false;
+  }
+  const body = script
+    .split('\n')
+    .map((line) => `          ${line}`)
+    .join('\n');
+  const workflow = `jobs:
+  ark:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+${body}
+`;
+  return FAIL_CLOSED_ARK_FLAG.test(enforcingArkRunText(workflow));
+}
+
+export function hasArkAgentsContract(root) {
+  try {
+    const content = fs.readFileSync(path.join(root, 'AGENTS.md'), 'utf8');
+    const directCheck =
+      /\b(?:arkgate-check|ark-check)\b[\s\S]{0,240}--(?:strict-config|strict-merge|strict)\b/.test(
+        content
+      );
+    const scriptCheck =
+      /\b(?:npm|pnpm)\s+run\s+check:architecture\b|\byarn(?:\s+run)?\s+check:architecture\b/.test(
+        content
+      ) && isFailClosedArchitectureScript(architectureScript(root));
+    return (
+      /^#{1,6}\s+Ark(?:Gate)?\s+Enforcement\b/im.test(content) &&
+      /\bark\.config\.json\b/i.test(content) &&
+      /\bauthoritative\b/i.test(content) &&
+      (directCheck || scriptCheck)
+    );
+  } catch {
+    return false;
+  }
+}
+
+function withFailClosedArkActions(content) {
+  const lines = String(content).split('\n');
+  for (let index = 0; index < lines.length; index += 1) {
+    const match = lines[index].match(
+      /^(\s*)(-\s+)?uses:\s*['"]?pedroknigge\/arkgate@[^'"\s#]+['"]?\s*(?:#.*)?$/i
+    );
+    if (!match) continue;
+    const propertyIndent = match[1].length + (match[2] ? 2 : 0);
+    let start = index;
+    let stepIndent = match[2] ? match[1].length : null;
+    if (stepIndent === null) {
+      for (let cursor = index - 1; cursor >= 0; cursor -= 1) {
+        const indent = lines[cursor].match(/^\s*/)?.[0].length ?? 0;
+        if (/^\s*-\s+/.test(lines[cursor]) && indent < propertyIndent) {
+          start = cursor;
+          stepIndent = indent;
+          break;
+        }
+      }
+    }
+    if (stepIndent === null) continue;
+    let end = lines.length;
+    for (let cursor = start + 1; cursor < lines.length; cursor += 1) {
+      if (!lines[cursor].trim()) continue;
+      const indent = lines[cursor].match(/^\s*/)?.[0].length ?? 0;
+      if (indent < stepIndent || (indent === stepIndent && /^\s*-\s+/.test(lines[cursor]))) {
+        end = cursor;
+        break;
+      }
+    }
+    const block = lines.slice(start, end).join('\n');
+    const strictInput = block.match(/^\s*strict-config:\s*(.*?)\s*(?:#.*)?$/im)?.[1];
+    if (strictInput !== undefined && !/^['"]?true['"]?$/i.test(strictInput)) {
+      continue;
+    }
+    lines[index] = lines[index].replace(/\buses:/, 'run:').replace(
+      /['"]?pedroknigge\/arkgate@[^'"\s#]+['"]?/i,
+      'ark-check --strict-merge'
+    );
+  }
+  return lines.join('\n');
+}
+
+function workflowJobSections(content) {
+  const lines = String(content).split('\n');
+  const jobsIndex = lines.findIndex((line) =>
+    /^\s*(?:"jobs"|'jobs'|jobs):\s*(?:#.*)?$/.test(line)
+  );
+  if (jobsIndex < 0) return { lines, jobs: [] };
+  const jobsIndent = lines[jobsIndex].match(/^\s*/)?.[0].length ?? 0;
+  let jobIndent = null;
+  let jobsEnd = lines.length;
+  const headers = [];
+  for (let index = jobsIndex + 1; index < lines.length; index += 1) {
+    if (!lines[index].trim() || /^\s*#/.test(lines[index])) continue;
+    const indent = lines[index].match(/^\s*/)?.[0].length ?? 0;
+    if (indent <= jobsIndent) {
+      jobsEnd = index;
+      break;
+    }
+    const header = lines[index].match(
+      /^\s*(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+)):\s*(?:#.*)?$/
+    );
+    if (!header) continue;
+    jobIndent ??= indent;
+    if (indent === jobIndent) {
+      headers.push({ id: header[1] ?? header[2] ?? header[3], start: index });
+    }
+  }
+  const jobs = headers.map((header, index) => {
+    const end = headers[index + 1]?.start ?? jobsEnd;
+    const propertyIndents = lines
+      .slice(header.start + 1, end)
+      .filter((line) => line.trim() && !/^\s*#/.test(line))
+      .map((line) => line.match(/^\s*/)?.[0].length ?? 0)
+      .filter((indent) => indent > Number(jobIndent));
+    return {
+      ...header,
+      end,
+      propertyIndent:
+        propertyIndents.length > 0 ? Math.min(...propertyIndents) : Number(jobIndent) + 2,
+    };
+  });
+  return { lines, jobs };
+}
+
+function jobProperty(lines, job, name) {
+  const matcher = new RegExp(
+    `^\\s*(?:"${name}"|'${name}'|${name}):\\s*(.*?)\\s*(?:#.*)?$`,
+    'i'
+  );
+  for (let index = job.start + 1; index < job.end; index += 1) {
+    if ((lines[index].match(/^\s*/)?.[0].length ?? 0) !== job.propertyIndent) continue;
+    const match = lines[index].match(matcher);
+    if (match) return { index, value: match[1].trim() };
+  }
+  return null;
+}
+
+function unquoteYamlScalar(value) {
+  const text = String(value).trim();
+  const match = text.match(/^(['"])(.*)\1$/);
+  return match ? match[2].trim() : text;
+}
+
+function jobCondition(lines, job) {
+  const condition = jobProperty(lines, job, 'if');
+  if (!condition) return 'default';
+  const value = unquoteYamlScalar(condition.value);
+  if (/^(?:\$\{\{\s*)?always\(\)(?:\s*\}\})?$/i.test(value)) return 'always';
+  if (/^(?:true|\$\{\{\s*true\s*\}\})$/i.test(value)) return 'true';
+  return 'conditional';
+}
+
+function jobNeeds(lines, job) {
+  const property = jobProperty(lines, job, 'needs');
+  if (!property) return { ids: [], indexes: [], valid: true };
+  const indexes = [property.index];
+  if (property.value) {
+    const value = unquoteYamlScalar(property.value);
+    const raw = value.startsWith('[') && value.endsWith(']')
+      ? value.slice(1, -1).split(',')
+      : [value];
+    const ids = raw.map(unquoteYamlScalar).filter((id) => /^[A-Za-z0-9_-]+$/.test(id));
+    return { ids, indexes, valid: ids.length === raw.length && ids.length > 0 };
+  }
+  const ids = [];
+  for (let index = property.index + 1; index < job.end; index += 1) {
+    if (!lines[index].trim() || /^\s*#/.test(lines[index])) {
+      indexes.push(index);
+      continue;
+    }
+    const indent = lines[index].match(/^\s*/)?.[0].length ?? 0;
+    if (indent <= job.propertyIndent) break;
+    indexes.push(index);
+    const item = lines[index].match(/^\s*-\s*(['"]?)([A-Za-z0-9_-]+)\1\s*(?:#.*)?$/);
+    if (!item) return { ids: [], indexes, valid: false };
+    ids.push(item[2]);
+  }
+  return { ids, indexes, valid: ids.length > 0 };
+}
+
+function withVerifiedDependencyJobs(content) {
+  const { lines, jobs } = workflowJobSections(content);
+  const byId = new Map(jobs.map((job) => [job.id, job]));
+  const guaranteed = (job, seen = new Set()) => {
+    if (!job || seen.has(job.id)) return false;
+    const condition = jobCondition(lines, job);
+    if (condition === 'conditional') return false;
+    if (condition === 'always') return true;
+    const needs = jobNeeds(lines, job);
+    if (!needs.valid) return false;
+    const nextSeen = new Set(seen).add(job.id);
+    return needs.ids.every((id) => guaranteed(byId.get(id), nextSeen));
+  };
+  for (const job of jobs) {
+    const needs = jobNeeds(lines, job);
+    if (
+      needs.valid &&
+      needs.ids.length > 0 &&
+      needs.ids.every((id) => guaranteed(byId.get(id)))
+    ) {
+      // The shared analyzer treats every `needs` as skippable. Hide it only after
+      // this dependency chain is proven unconditional; keep uncertain/skipped needs visible.
+      for (const index of needs.indexes) lines[index] = '';
+    }
+  }
+  return lines.join('\n');
+}
+
 export function hasArkWorkflow(root) {
   const workflowsDir = path.join(root, '.github', 'workflows');
   if (!fs.existsSync(workflowsDir)) return false;
+  const declaredScript = architectureScript(root);
+  const script = isFailClosedArchitectureScript(declaredScript) ? declaredScript : '';
   return fs
     .readdirSync(workflowsDir)
     .filter((file) => /\.ya?ml$/i.test(file))
     .some((file) => {
       try {
         const content = fs.readFileSync(path.join(workflowsDir, file), 'utf8');
-        return (
-          /\bark-check\b/.test(content) ||
-          /\bcheck:architecture\b/.test(content) ||
-          /\buses\s*:\s*['"]?[^'"\s#]+\/arkgate@/i.test(content)
+        return FAIL_CLOSED_ARK_FLAG.test(
+          enforcingArkRunText(
+            withVerifiedDependencyJobs(withFailClosedArkActions(content)),
+            script
+          )
         );
       } catch {
         return false;
@@ -176,10 +609,9 @@ export function hasArkWorkflow(root) {
 
 export function missingGates(root) {
   const compactHost = compactRouterHost(root);
-  const required = compactHost
-    ? REQUIRED_GATE_FILES.filter((relativePath) => relativePath !== '.mcp.json')
-    : REQUIRED_GATE_FILES;
-  const missing = required.filter((relativePath) => !fs.existsSync(path.join(root, relativePath)));
+  const missing = [];
+  if (!hasArkAgentsContract(root)) missing.push('AGENTS.md');
+  if (!compactHost && !hasArkMcpRegistration(root)) missing.push('.mcp.json');
   if (compactHost && !hasCompactHostRegistration(root, compactHost)) {
     missing.push(`compact host registration (${compactHost})`);
   }