arkgate 4.6.0 → 4.6.2

package/docs/README.md

@@ -53,15 +53,15 @@ These are **not** the day-to-day product path. They stay in the repo for evidenc
 | Area | Path |
 |------|------|
 | Release notes (by version) | [releases/](releases/) · [CHANGELOG.md](../CHANGELOG.md) |
-| Epic plans (seeded + shipped) | [plans/](plans/) — maintainer seeds (e.g. [understandable-ark-4.6](plans/understandable-ark-4.6/README.md) **4.6.0**; [field-upgrade-mcp-truth](plans/field-upgrade-mcp-truth/README.md) **shipped in 4.5.6**; deep-module coach **shipped in 4.5.5**; domain fitness & session truth for **4.5.0**; improvement compass for **4.4.0**; agent contract surface for **4.3.0**). Product how-to stays in use/develop/agent-guide; plans are not required reading to use the package. |
+| Epic plans (seeded + shipped) | [plans/](plans/) — maintainer seeds (e.g. [team-parliament](plans/team-parliament/README.md) **shipped in 4.6.1**; [five-door-autonomy](plans/five-door-autonomy/README.md) **shipped in 4.6.1**; [understandable-ark-4.6](plans/understandable-ark-4.6/README.md) **4.6.0**; [field-upgrade-mcp-truth](plans/field-upgrade-mcp-truth/README.md) **shipped in 4.5.6**; deep-module coach **shipped in 4.5.5**; domain fitness & session truth for **4.5.0**; improvement compass for **4.4.0**; agent contract surface for **4.3.0**). Product how-to stays in use/develop/agent-guide; plans are not required reading to use the package. |
 | Claims audit | [audit/claims-matrix.md](audit/claims-matrix.md) |
 | Field adoption kit (scaffolding, not closed) | [field/](field/) |
 | Runtime hardening (experimental) | [production-hardening.md](production-hardening.md) |
 
-Current published: [releases/4.5.7.md](releases/4.5.7.md) (`arkgate@4.5.7` on npm `latest`).  
-Prepared: [releases/4.6.0.md](releases/4.6.0.md) (`arkgate@4.6.0`).  
-Prior: [releases/4.4.0.md](releases/4.4.0.md) (`arkgate@4.4.0`).  
-Previous: [releases/4.3.0.md](releases/4.3.0.md) · [releases/4.2.1.md](releases/4.2.1.md) · [releases/4.2.0.md](releases/4.2.0.md) · [releases/4.1.1.md](releases/4.1.1.md).  
+Prepared: [releases/4.6.2.md](releases/4.6.2.md) (`arkgate@4.6.2` — not yet npm `latest`).  
+Current published: [releases/4.6.1.md](releases/4.6.1.md) (`arkgate@4.6.1` on npm `latest`).  
+Prior: [releases/4.6.0.md](releases/4.6.0.md) (`arkgate@4.6.0`).  
+Previous: [releases/4.5.7.md](releases/4.5.7.md) · [releases/4.5.6.md](releases/4.5.6.md) · [releases/4.5.5.md](releases/4.5.5.md) · [releases/4.5.0.md](releases/4.5.0.md) · [releases/4.4.0.md](releases/4.4.0.md) · [releases/4.3.0.md](releases/4.3.0.md) · [releases/4.2.1.md](releases/4.2.1.md) · [releases/4.2.0.md](releases/4.2.0.md) · [releases/4.1.1.md](releases/4.1.1.md).  
 Previous major: [releases/4.0.0.md](releases/4.0.0.md) (`arkgate@4.0.0`).  
 Config: [configuration.md](configuration.md) · Agent skills dual-plane: [agent-guide.md](agent-guide.md).
 

package/docs/agent-guide.md

@@ -233,7 +233,7 @@ When the top two shapes are close or projected governed coverage is below 90%, J
 `requiresConfirmation: true` and explains why in `confirmationReasons`.
 
 Human output highlights phase-1 layers and the analogy; JSON is the stable contract for
-MCP `ark_recommend` and the `/ark-architect` skill.
+MCP `ark_recommend` and the `/ark-adopt` skill (leftover name `/ark-architect` is a shortcut).
 
 ### Terminal onboarding (Phase B)
 
@@ -270,13 +270,17 @@ To remove a compact host integration, preview `ark start --remove-host <host>` a
 only after review. Ark removes only its exact compact artifacts, leaves customized files untouched
 as unresolved decisions, and restores the integration with `ark start --tools <host> --apply`.
 
-**Skill roles (expert depth — avoid overlap):** `/ark-autopilot` = **guided end-to-end** default
-when skills are installed (explore → apply A + propose/apply-with-ok B). `/ark-explore` = map +
-dual-plan **seed** + Shape residual (no apply); primary post-green map half. `/ark-coverage` = Ark
-**fitness** only (governed/gates). `/ark-think` = one decision (2–3 options). `/ark-adopt` =
-brownfield Align/Stabilize + seed Shape B. `/ark-loop` = plan A only. Empty plan A is not
-“architecture healthy” if design-weak residual remains. Full routing table: full-install
-`AGENTS.md` / [README expert skills](../README.md#expert-skills-escapes--not-onboarding).
+**Five doors (emphasize):** `/ark-adopt` = session 0 (greenfield scaffold + brownfield honesty —
+write the path). `/ark-place` = new feature (place **and write**). `/ark-autopilot` = apply
+plan A + one Shape refactor (invoke = approval). `/ark-explore` = map + dual-plan seed (no
+apply). `/ark-upgrade` = preview then apply in-turn. Other `/ark-*` names stay installed as
+**shortcuts**. Empty plan A is not “architecture healthy” if leftover design remains.
+
+**Team parliament:** adopt is a **contract session** (law-only). Feature work must not edit
+`ark.config.json` / `arkrules/*` / `.ark-baseline.json`. Prefer
+`ark-check --changed --base <merge-ref>` in local gates. `--contract-diff` + `--author`
+when `stewards` is set (`--author` is a GitHub handle or email, not git `user.name`).
+`ark status --vs <ref>` prints pin / contract / baseline drift.
 
 **Design fitness (3.0.1+ / Phase Q 3.0.3):** after checked edges are clean, doctor can still
 report **SUGGEST / ADAPT / ENFORCE · design-weak** using the mode it actually observed; a weak
@@ -290,7 +294,7 @@ npx ark-check --doctor --fail-on-new-smells --base-ref origin/main --json # opt-
 
 **Post-green path (Q01):** when design-weak, doctor sets `postGreenPath` / `primaryNextAction`
 (`clarify-for-ai`) — **one** Shape door: `/ark-explore` shape-focus → dual-plan B, then
-`/ark-autopilot` only to apply B with your OK. Do not skill-shop coverage/think for the same residual.
+`/ark-autopilot` applies one pilot. Do not skill-shop coverage/think for the same residual.
 
 **Pilot loop (Q04):** when design-weak, `pilotLoop.nextPilot` is **one** extraction card
 (pilot target, move, success, kill-switch). Apply **that one pilot only**, then re-doctor.
@@ -363,7 +367,7 @@ clusters per anchor directory (concentration, not volume — dispersed hooks nev
 fixed corpus-calibrated thresholds; anchors under `app/`/`pages/` are `fixedByConvention` and
 never move. `reshapePilot.nextPilot` is a **proposed** one-at-a-time card (`moveSample`,
 `movesTotal`, `successSignal`, `killSwitch`, `doNot[]`): run it only via `/ark-loop` through the
-write gate + atomic preflight; merges are `/ark-architect` judgment cards. `notAScore`, never a
+write gate + atomic preflight; merges are `/ark-adopt` / `/ark-autopilot` judgment cards. `notAScore`, never a
 verdict/`designFitness` input; there is no apply path.
 
 **Reshape decision memory (Y01):** when the team accepts, defers, or rejects that target, record
@@ -479,21 +483,21 @@ in `ark.config.json`.
 closed solely by `import type` (common with generated route trees) is **not** reported as
 `CIRCULAR_DEPENDENCY`. Value cycles still fail.
 
-### MCP `ark_recommend` and `/ark-architect` (Phase C)
+### MCP `ark_recommend` and `/ark-adopt` (Phase C)
 
 The `ark-mcp` server exposes **`ark_recommend`** — same JSON as
-`ark-check --recommend --json`. Call it (or invoke `/ark-architect`) before
+`ark-check --recommend --json`. Call it (or invoke `/ark-adopt`) before
 generating project structure on greenfield or early-adoption repos.
 
 `ark-mcp --session-context` appends a one-line enthusiast hint when governed
 coverage is low or the config is fresh:
 
 ```
-New to Ark? Run /ark-architect or: ark-check --recommend
+New to Ark? /ark-adopt or: arkgate-check --doctor
 ```
 
-The `/ark-architect` skill ships in `templates/skills/ark-architect.md` and installs
-via `ark-check --install-agent-gates`.
+The `/ark-adopt` skill ships in `templates/skills/ark-adopt.md` (leftover
+`/ark-architect` is a shortcut) and installs via `ark-check --install-agent-gates`.
 
 ### Adoption plan artifact (Phase E)
 
@@ -588,9 +592,9 @@ checks; this improves early feedback without upgrading Codex's bypassable hook t
 boundary. Removing `AGENTS.md`, skills, or session context never changes the contract verdict.
 
 Do not invent layers outside the 11-layer profile or named presets. Unrecognized
-directories (`utils/`, `lib/`) must be classified explicitly via `/ark-contract`.
+directories (`utils/`, `lib/`) must be classified explicitly via `/ark-adopt`.
 
-**Brownfield** (existing messy repo): use `/ark-adopt` and [brownfield-adoption.md](brownfield-adoption.md), not `/ark-architect`.
+**Brownfield** (existing messy repo): use `/ark-adopt` and [brownfield-adoption.md](brownfield-adoption.md). `/ark-architect` is a leftover shortcut to the same door.
 
 ## Supported agent hosts
 

package/docs/configuration.md

@@ -190,7 +190,7 @@ a hash-bound policy weakening. Empty `appliesTo: []` fails closed; zero-match gl
 
 **What they do not do:** prove business semantics end-to-end; replace Layers import edges;
 make “green” mean elegant Shape. Promoting structure to enforced can force rename-to-pass
-heuristics — prefer judgment extraction via `/ark-fix` / `/ark-loop` when the real goal is
+heuristics — prefer judgment extraction via `/ark-autopilot` when the real goal is
 Domain ownership.
 
 ```bash
@@ -198,7 +198,7 @@ Domain ownership.
 npx arkgate-check --rules-inventory --json
 ```
 
-Edit ArkRules through skill `/ark-contract`; extract/implement via `/ark-fix` or `/ark-loop`.
+Edit ArkRules through `/ark-adopt` (session 0) or `/ark-autopilot`; extract/implement via `/ark-autopilot`.
 
 ## Contract transitions
 
@@ -239,6 +239,40 @@ JSON artifact passed with `--policy-ack`:
 The acknowledgement must list every blocking finding exactly. It is not a permanent allowlist:
 changing either contract changes its hash and invalidates the acknowledgement.
 
+## Team parliament (law vs feature)
+
+Optional `stewards` lists **GitHub handles or emails** who may **loosen** the contract or
+**grow** the baseline (`pedroknigge` or `pedroknigge@users.noreply.github.com` — not
+`Pedro Knigge`). The field is metadata — it does not change the policy hash. The lock
+matches `--author`, then `GITHUB_ACTOR` / `ARK_STEWARD`, then `GIT_AUTHOR_EMAIL`. A
+noreply GitHub mail and the handle are the same person. Git `user.name` is not identity.
+
+Doctor detects several recent authors or a CODEOWNERS file (`doctor.stewardNudge`).
+When `stewards` is empty it **asks** who owns the law and proposes handles or emails.
+When the list exists but CODEOWNERS is ahead, or you started with one steward and git
+now shows more authors, it shows the **gap** and asks whether to update. `/ark-adopt`
+writes only after you confirm — it does not invent names or remove entries.
+
+```json
+"stewards": ["pedroknigge", "Amarilla-David"]
+```
+
+Law files (`ark.config.json`, `arkrules/*`, `.ark-baseline.json`) are a different change
+type than product source:
+
+| Check | What it does |
+|-------|----------------|
+| `ark-check --changed --base origin/dev` | Layer check on touched sources only. A CSS/i18n PR pays almost nothing. |
+| `ark-check --against origin/dev` | New violation keys vs **that ref's** baseline (not only HEAD). |
+| `ark-check --contract-diff --base origin/dev` | Classifies tighten / loosen / reclassify / baseline-grow. |
+| `--contract-session --author <id>` | Law-only PR. Mixed law+product still fails. Loosen/grow need a listed steward. |
+| `--persona touch\|contributor\|agent\|steward` | Budget presets for the same teeth. |
+| `ark status --vs origin/dev` | One line: pin / contract / baseline drift vs that ref. |
+
+Write-gate ApplyPatch denies a batch that mixes law files with product source. Humans who
+never hit PreToolUse are unchanged. Local `pnpm` gates should call `--changed --base`, not
+only full-tree `--strict-merge`.
+
 MCP clients can call `ark_policy_delta` with the previous `baseConfig`, an optional candidate
 contract (the current project contract is the default), and the same optional acknowledgement.
 It invokes the public classifier directly, is read-only, and marks a blocking result as an MCP

package/docs/develop.md

@@ -65,7 +65,7 @@ can show `runtimeObserved: true` even when branch-protection policy is plan-unav
 | Concern | Doc / tool |
 |---------|------------|
 | Layers, rules, globs | [configuration.md](configuration.md) · `ark.config.json` |
-| ArkRules (structure + invariants) | [configuration.md](configuration.md#arkrules-intra-layer-opt-in) · `arkRules` / `arkrules/*` · skill `/ark-contract` |
+| ArkRules (structure + invariants) | [configuration.md](configuration.md#arkrules-intra-layer-opt-in) · `arkRules` / `arkrules/*` · skill `/ark-adopt` (session 0) or `/ark-autopilot` |
 | Rules inventory (brownfield) | `arkgate-check --rules-inventory` · MCP `ark_rules_inventory` |
 | Stable package API | [package-surface.md](package-surface.md) |
 | Diagnostic codes (`ruleId` why/fix) | [diagnostics.md](diagnostics.md) · root `DIAGNOSTIC_CATALOG` |
@@ -133,10 +133,22 @@ npx arkgate agents-md --write       # embed/refresh projection markers
 npx arkgate preflight --changes changes.json --json
 npx arkgate upgrade --json          # managed content preview
 npx arkgate upgrade --apply
+npx arkgate-check --changed --base origin/dev
+npx arkgate-check --against origin/dev
+npx arkgate status --vs origin/dev
 ```
 
 ---
 
+## Team parliament (law vs feature)
+
+`ark.config.json`, `arkrules/*`, and `.ark-baseline.json` are a **constitution**. A product PR
+must not amend them. Optional `stewards` (GitHub handle or email) makes loosen / baseline-grow
+steward-only. Doctor `stewardNudge` asks who owns the law or shows list drift — never invents
+names. Details: [configuration.md](configuration.md#team-parliament-law-vs-feature).
+
+---
+
 ## Optional experimental runtime
 
 Gates need **no** runtime kernel. `@arkgate/runtime` is experimental, separate package, not the day-zero product. See [package-surface.md](package-surface.md) and [production-hardening.md](production-hardening.md).

package/docs/enthusiast/README.md

@@ -70,7 +70,7 @@ Deep teaching example (runnable API + break exercises): [hexagonal-order-api](ht
 
 | Situation | Use |
 |-----------|-----|
-| New or empty repo | `/ark-architect`, `ark-check --recommend`, gallery starters |
+| New or empty repo | `/ark-adopt`, `ark-check --recommend`, gallery starters |
 | Existing messy codebase | `/ark-adopt`, [brownfield playbook](../brownfield-adoption.md) |
 
 ## Related

package/docs/enthusiast/how-to-agent-gates.md

@@ -15,8 +15,8 @@ Installs:
   Still exit 2 / hard block; never silent write. Drop `--hook-repair` for
   reject-only prose, or set `ARK_HOOK_REPAIR=0` and omit the flag.
 - MCP server entry (`.mcp.json`, Cursor/Codex/Grok equivalents)
-- `/ark-*` skills including **`/ark-architect`**, **`/ark-autopilot`**, **`/ark-loop`**
-  (with current `mechanical-safe` remediation kinds)
+- `/ark-*` skills: five doors **`/ark-adopt`**, **`/ark-place`**, **`/ark-autopilot`**,
+  **`/ark-explore`**, **`/ark-upgrade`** (other names are shortcuts)
 
 | Host | Extra paths |
 |------|-------------|
@@ -33,7 +33,7 @@ local, MCP, CI, and repair guarantees. The table above only lists installed path
 `arkgate-mcp --session-context` appends when governed coverage is low:
 
 ```
-New to Ark? Run /ark-architect or: ark-check --recommend
+New to Ark? /ark-adopt or: arkgate-check --doctor
 ```
 
 ## Verify gates

package/docs/enthusiast/how-to-pick-shape.md

@@ -14,7 +14,7 @@ Call tool **`ark_recommend`** — same JSON as `--recommend --json`.
 
 ## Skill
 
-Run **`/ark-architect`** on a greenfield or early-adoption repo.
+Run **`/ark-adopt`** on a greenfield or early-adoption repo (leftover `/ark-architect` is a shortcut).
 
 ## What to read in the output
 
@@ -37,7 +37,7 @@ If `confidence < 0.5`, ask:
 1. Will this app save data between sessions?
 2. Is this one app or several in one repository?
 
-Then re-run `--recommend` or continue with `/ark-architect`.
+Then re-run `--recommend` or continue with `/ark-adopt`.
 
 ## Reference
 

package/docs/enthusiast/tutorial-first-project.md

@@ -61,7 +61,7 @@ Or copy a [gallery starter](../enthusiast/how-to-gallery-starter.md) and run `np
 npx ark-check --install-agent-gates
 ```
 
-This installs `/ark-architect`, `/ark-place`, `/ark-autopilot`, and the other `/ark-*` skills for Claude, Cursor, Codex, Grok, and other detected hosts.
+This installs the five doors (`/ark-adopt`, `/ark-place`, `/ark-autopilot`, `/ark-explore`, `/ark-upgrade`) and leftover shortcut names for Claude, Cursor, Codex, Grok, and other detected hosts.
 
 ## 6. Verify honestly
 
@@ -75,9 +75,10 @@ Report `governed.percent` truthfully. An empty layer is fine; an ungoverned `lib
 
 ## 7. Build a feature with the agent
 
-Invoke `/ark-architect` once at the start, then `/ark-place` for each new file. The agent
+Invoke `/ark-adopt` once at the start, then `/ark-place` for each new file. The agent
 should place use cases in `application/`, ports in `domain/`, and never import the database
-into `domain/`.
+into `domain/`. Do not edit `ark.config.json` in the same change as a feature — that is a
+steward contract session. Teams: `ark-check --changed --base origin/dev`.
 
 ## Next steps
 

package/docs/package-surface.md

@@ -47,6 +47,7 @@ hardening guide remains repository-hosted rather than duplicated in the gate tar
 | **Managed upgrade self-service honesty (4.5 / DF05)** | `ark upgrade [--json]` → `selfService` (+ human “Self-service honesty” lines) | Additive, advisory. Answers without a maintainer: write-path activation labels per selected host (`hard`\|`advisory`\|`unavailable`) and customized content-identity preserve (`customizedPaths` / `customizedContentPreserved`). Soft hosts never hard; upgrade never invents `hardWriteActive` from disk alone. Always `notAScore: true`. Not a gate input; not part of `planDigest`. |
 | **Product honesty readiness split (4.1.1)** | doctor JSON `productHonesty` | Additive. `unfinished` / `headline` / `primaryNextAction` / `reasonIds` remain; EH adds `contractReadiness` (`ready`\|`partial`\|`not-ready`), `localWriteBoundary` (`advisory`\|`hard`\|`unverified`\|`unknown`), `architectureReasonIds`, `environmentResidualIds` / `environmentResiduals`. Soft-write hosts stay in evidence without alone forcing global **Not finished**. `notAScore: true` always. |
 | **Policy transition analysis (3.1.0)** | `analyzePolicyDelta(...)`; MCP `ark_policy_delta`; CLI `--policy-base` / `--policy-base-ref` / `--policy-ack`; check JSON `policyDelta` | Additive schema `1.0`. Classifications and finding ids are deterministic. Weakening/judgment requires an acknowledgement bound to both policy hashes and the exact blocking finding set. |
+| **Team parliament (law vs feature)** | Optional `stewards` on `ark.config.json` (GitHub handle or email); CLI `--changed` / `--against` / `--base` / `--contract-diff` / `--contract-session` / `--persona` / `--author`; check JSON `teamParliament`; `ark status --vs`; write-gate mixed-batch deny | Additive. Law files must not mix with product source. Loosen / baseline-grow are steward-only when `stewards` is set. `--against` ratchets vs the base-ref baseline. `--changed` scans touched sources. `stewards` is excluded from policy hash. Identity is handle or email, not git `user.name`. No org plane. |
 | **Atomic change preflight (3.1.0)** | `preflightChange(...)`; CLI `ark preflight --changes <file> --json`; MCP `ark_prepare_change` | Additive schema `1.0`. One complete governed production-source `{path,content}` / `{path,delete:true}` batch; read-only; returns operation, content/tree/policy/compiler fingerprints and stable graph findings. MCP availability alone is advisory. |
 | **Architecture change map (3.1.0)** | `arkgate/schema/change-map` or `arkgate/schema/ark.change-map.schema.json`; CLI `ark preflight --change-map <file>`; MCP `ark_prepare_change.changeMap` | Optional strict schema `1.0`. Canonical planned paths + operations + resolved Ark layers + dependencies between planned files. Preflight returns `changeMapHash`; absence is normal and adds no project file. Structural intent only, never behavioral completion. |
 | **Structural convergence (3.1.0)** | `analyzeArchitectureConvergence(...)`; map-enabled `preflightChange(...)`; existing CLI/MCP preflight adapters | Additive `convergence` result with stable `satisfied`, `missing`, `contradictory`, and `unplanned` findings. Uses the supplied/current project tree as base and the explicit complete change set as candidate; no implicit Git or LLM input. `readOnly: true`; `behavioralCompletion: "not-evaluated"`. Structural mismatch makes preflight invalid. |
@@ -56,7 +57,7 @@ hardening guide remains repository-hosted rather than duplicated in the gate tar
 | **`arkgate/schema/analysis-result`** or **`arkgate/schema/ark.analysis-result.schema.json`** | Public CLI/MCP/hook diagnostic envelope (`schemaVersion`, `mode`, `valid`, `completeness`, `completenessReasons`, `diagnostics`, resolved identities) | Schema **`1.5`** adds optional stable finding refs on diagnostics: `findingRef` (`fnv1a-` + hex), `targetKey` (baseline-compatible freeze identity), `docsCodePath` (`docs/diagnostics.md#RULE_ID`). Factory-emitted diagnostics always include them; consumer-owned 1.0–1.4 values remain valid without them. `1.4` added optional `evidence.arkruleId` / `evidence.arkruleSource` for ArkRules; `1.3` distinguished `resolved-candidate-facts` from `lexical-compatibility`; partial/unavailable analysis is always non-green, and resolved complete/partial results require policy/resolver/facts/tree identities. `1.2` added completeness and remains accepted alongside consumer-owned 1.0/1.1 values. |
 | **Stable finding refs (4.3)** | Root API `adapterFindingTargetKey` / `adapterFindingRefFromTargetKey` / `toAdapterDiagnostic` / `createAdapterResult`; CLI/MCP/repair envelopes via analysis-result diagnostics | Multi-turn re-address without fuzzy message match. `targetKey` **is** the baseline (occurrence) key so freeze identity is never orphaned; `findingRef` is a compact FNV-1a of that key. Line/message drift does not change the ref. Multi-turn fixture: `tests/fixtures/finding-refs/multi-turn-stability.json`. |
 | **Diagnostic code catalog** | Root API `DIAGNOSTIC_CATALOG` / `getDiagnosticCatalogEntry` / `diagnosticDocsPath`; docs [diagnostics.md](diagnostics.md) (`#RULE_ID` anchors) | Closed vocabulary of public `ruleId`s with why/fix anchors. Cataloguing only — no new rule semantics. Remediation parity is test-guarded. Docs ship in the npm tarball. |
-| **Status manifest** | CLI `ark status [--json]`; MCP `ark_status`; `arkgate/schema/status-manifest`; root API `buildStatusManifest` / `ARK_STATUS_MANIFEST_SCHEMA` / `projectStatusImprovementCompass` | Schema `1.0`. One session/project snapshot: identity binding, honest write-path activation (`hard`\|`advisory`\|`unavailable`), last-check summary, rules residual counts, primary next action, and **`improvementCompass`** with honesty **`mode`** `full`\|`subset`\|`unavailable` (residual ids only; always `notAScore: true`; optional `reasonCode`/`reason`/`factsSource`/`contractHash`). **Not a score.** Residual never changes gate verdicts. Never prompts (`CI=1` forces JSON). Optional `--expected-root` / `--expected-project-id` (MCP `project`) for matched vs stale identity. |
+| **Status manifest** | CLI `ark status [--json] [--vs <ref>]`; MCP `ark_status`; `arkgate/schema/status-manifest`; root API `buildStatusManifest` / `ARK_STATUS_MANIFEST_SCHEMA` / `projectStatusImprovementCompass` | Schema `1.0`. One session/project snapshot: identity binding, honest write-path activation (`hard`\|`advisory`\|`unavailable`), last-check summary, rules residual counts, primary next action, **`improvementCompass`** with honesty **`mode`** `full`\|`subset`\|`unavailable` (residual ids only; always `notAScore: true`; optional `reasonCode`/`reason`/`factsSource`/`contractHash`), and optional **`vsBase`** (pin / contract / baseline grow vs a git ref; advisory only). **Not a score.** Residual never changes gate verdicts. Never prompts (`CI=1` forces JSON). Optional `--expected-root` / `--expected-project-id` (MCP `project`) for matched vs stale identity. |
 | **Agent contract projection** | CLI `ark agents-md [--write] [--check] [--stdout] [--json]`; install/upgrade AGENTS templates; root API `buildAgentProjectionBlock` / `mergeAgentProjectionDocument` | Schema `1.0` (projection markers). Version-stamped managed block (`arkgateVersion` + contract summary + diagnostic short list). **Non-authoritative** — not a gate input; enforcement is ark-check / hooks / CI. Content-identity merge preserves customized regions outside markers. Drift: `--check` vs package version. |
 | **Agent Skills packaging** | `templates/agent-skills/<name>/SKILL.md` (+ package README); root API `ARK_SKILL_NAMES` / `validateAgentSkillsPackage`; `npm run check:agent-skills` | Schema `1.0` (package contract). Same **13** skill names as flat templates; Agent Skills–compatible layout for `npx skills add`. No new skill names. Layout is generated 1:1 from `templates/skills/*.md`. |
 | **`arkgate/schema/arkrules`** or **`arkgate/schema/ark.arkrules.schema.json`** | Per-layer structure sensors + invariant catalog (ADR 0012) | Schema `1.0`. Opt-in via root `arkRules` map (`ark.config` schema `1.1`). |
@@ -209,8 +210,9 @@ production deployment would need to satisfy; it is not a readiness certification
 ## Release notes (maintainers)
 
 Ship notes for a version live under [releases/](https://github.com/pedroknigge/arkgate/tree/main/docs/releases)
-(current published: [4.5.7.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.5.7.md);
- prior published: [4.5.6.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.5.6.md), [4.5.0.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.5.0.md), [4.4.0.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.4.0.md), [4.3.0.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.3.0.md),
+(prepared: [4.6.2.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.6.2.md);
+ current published: [4.6.1.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.6.1.md);
+ prior published: [4.6.0.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.6.0.md), [4.5.7.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.5.7.md), [4.5.6.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.5.6.md), [4.5.0.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.5.0.md), [4.4.0.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.4.0.md), [4.3.0.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.3.0.md),
 [4.2.1.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.2.1.md);
 previous: [4.2.0.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.2.0.md),
 [4.1.1.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.1.1.md),

package/docs/product-voice.md

@@ -22,6 +22,13 @@ because the design space is small and honest.
   inside a layer) opt-in.
 - **Coach side:** where code belongs, who talks to whom, how; fix imports first, then leftover
   design work; one small refactor at a time; never silent auto-reshape; never weaken the config.
+- **Five-door autonomy:** invoking `/ark-adopt`, `/ark-place`, `/ark-autopilot`, `/ark-explore`,
+  or `/ark-upgrade` **is** the approval. The agent writes or maps in that turn. CLI/MCP are
+  sensor + gate. Silent reshape from the compact router (unasked) stays forbidden.
+- **Team parliament:** the architecture file is a **constitution**. A product change must not
+  amend it. Stewards own loosen and baseline-grow. The ratchet is **new vs the branch you
+  merge to**, not only the file on this checkout. A small PR pays `--changed --base`, not
+  the whole tree. Humans who never hit the write hook are allowed to ignore Ark.
 - **Agent contract surface (4.3.0):** agents read **guardrail catalogs** and **scan** evidence;
   they **process** (judge / coach) outside the package. Projection and skills never become the
   pass/fail gate.
@@ -83,7 +90,13 @@ stay stable unless a change explicitly adds an alias.
 | **don’t show green if unverified** | fail-closed | Incomplete analysis or unproven enforcement never looks green |
 | **honest coverage** | honest coverage | Governed % and empty scope that cannot false-green |
 | **safe to auto-apply** | mechanical-safe | Deterministic auto-apply class only |
-| **your judgment** | judgment | Human/agent design work; never silent auto-apply |
+| **your judgment** | judgment | Human/agent design work; invoke of an apply door is the approval — not silent compact-router reshape |
+| **five doors** | skill menu of 13 | adopt · place · autopilot · explore · upgrade — other names are shortcuts |
+| **law / constitution** | contract + baseline + ArkRules files | `ark.config.json`, `arkrules/*`, `.ark-baseline.json` — a different change type than product |
+| **steward** | contract owner | GitHub handle or email in `stewards`; only they may loosen the law or grow the baseline |
+| **several hands** | multi-author / CODEOWNERS | Doctor asks for stewards or shows list drift; adopt proposes handles or emails, never invents names |
+| **contract session** | `--contract-session` | Explicit “this diff is a law change”; still never mixed with product files |
+| **vs the base branch** | `--against` / `--changed --base` / `status --vs` | Ratchet and honesty against the ref you merge to |
 | **doctor** | doctor | Status light + next action |
 | **short agent router** | compact router | Default onboarding agent instructions (not the full skill pack) |
 | **right project?** | matched binding / project identity | Live MCP answered for this exact project root (+ id). `ark_identity` |
@@ -271,7 +284,7 @@ Each model line follows the sentence template: **plain fact · term · next acti
 | **Suggest** | Thin or new tree. Architecture config is not yet in charge. Next: `ark start` preview, then `--apply`; re-run doctor. |
 | **Adapt** | Config and tree still disagree, or debt is open. The write path does not fully protect you yet. Next: doctor top action #1. |
 | **Enforce** | Honest coverage and clean checked imports. Keep the host write path + required CI. |
-| **Enforce · leftover design work** | Import rules check out; design smells remain. Green is not elegant design. Next: one Shape door — map (`/ark-explore` shape-focus) → plan B → apply B only with `/ark-autopilot` and OK. |
+| **Enforce · leftover design work** | Import rules check out; design smells remain. Green is not elegant design. Next: map (`/ark-explore` shape-focus) then apply one small refactor with `/ark-autopilot` (invoke = apply). |
 
 ### Primary next action
 
@@ -281,10 +294,17 @@ Each model line follows the sentence template: **plain fact · term · next acti
 ### Deny / gate failure
 
 ```text
-[What failed in plain terms]. [Rule or evidence id]. Next: [one fix path — /ark-fix, prepare-write, or contract edit].
+[What failed in plain terms]. [Rule or evidence id]. Next: [one fix path — /ark-autopilot, /ark-place, or /ark-adopt].
 ```
 
 Never: mock the user, imply the gate is optional, or suggest disabling rules to “finish.”
+Never: tell an agent to edit `ark.config.json` to clear a product-PR red. That is a **contract
+session** for a steward — split the PR.
+
+```text
+This change mixes the constitution with product files. Next: split the PR, or run a steward
+--contract-session that touches only ark.config / arkrules / .ark-baseline.json.
+```
 
 ### Healthy finished
 
@@ -295,11 +315,13 @@ Otherwise name the leftover work.
 
 ## Compact router model
 
-Keep short. Three jobs only:
+Keep short. Five doors only:
 
 1. Point at **doctor** as status.
-2. Day-to-day place / validate / check.
-3. Point at **full skill pack install** as optional expert depth — not a skill catalog dump.
+2. Session 0: **`/ark-adopt`**. Day-to-day new files: **`/ark-place`**.
+3. Apply / leftover design: **`/ark-explore`** then **`/ark-autopilot`** (invoke = apply one refactor).
+4. Bump: **`/ark-upgrade`**.
+5. Full skill pack is optional expert depth — not a 13-name exam.
 
 ---
 
@@ -307,11 +329,27 @@ Keep short. Three jobs only:
 
 | Skill role | Frontmatter tone |
 |------------|------------------|
-| `/ark-autopilot` | Guided **end-to-end** path (explore → dual plan → apply A; B with OK) |
-| `/ark-explore` | Map / dual-plan **seed** only; primary post-green map half |
-| Others | Specialized escape; name when **not** to use them |
+| `/ark-adopt` | Session 0 — write the path (greenfield + brownfield) |
+| `/ark-place` | New feature — place **and write** |
+| `/ark-autopilot` | Apply A + one Shape refactor; invoke = approval |
+| `/ark-explore` | Map / dual-plan **seed** only |
+| `/ark-upgrade` | Preview then apply in-turn |
+| Others | Shortcut to a door above |
+
+Autonomy contract on every door. Never claim silent full-tree reshape from the compact router.
+
+---
+
+## Autonomy contract (skills)
+
+Invoking a five-door skill **is** the approval. Write or map in the same turn.
+
+**CLI budget:** identity only if using MCP; one doctor / recommend / upgrade preview; then work;
+then check. Forbidden as the deliverable: dumping `--plan` JSON, “approve?”, or
+`STOP — invoke /ark-X` for work that door absorbs.
 
-Keep dual-engine rules and **STOP** handoffs. Never claim silent full-tree reshape.
+**Still never:** weaken the architecture config; invent `mechanical-safe` kinds; claim finished
+while leftover design work remains; batch every Shape bet in one turn.
 
 ---
 

package/docs/use.md

@@ -49,9 +49,9 @@ In those cases a boundary linter or editor rules may be enough; see [README —
 | Before merge | Make the Ark job a **required GitHub status context** running `arkgate-check --strict-merge` (alias `ark-check`) |
 | Anytime | Doctor: Suggest / Adapt / Enforce (+ leftover design work if the design is still messy) |
 
-**Codex / Cursor / OpenCode:** local write stays advisory forever — that is not unfinished architecture. Doctor may say **contract ready** while still reminding you that local writes are advisory; **Not finished** is reserved for real project/contract debt.
+**Cursor:** pre-write block for Write/StrReplace when `.cursor/hooks.json` is trusted. **Codex / OpenCode:** local write stays advisory (warning only, not blocked) — that is not unfinished architecture. Doctor may say **contract ready** while still reminding you that those hosts do not hard-block writes; **Not finished** is reserved for real project/contract debt.
 
-ArkGate is **not** a web framework, ORM, or app runtime. It is architecture enforcement + co-pilot for AI TypeScript.
+ArkGate is **not** a web framework, ORM, or app runtime. It is architecture enforcement + a coach for AI TypeScript.
 
 ### Two planes (you choose)
 
@@ -83,7 +83,7 @@ list: [configuration.md](configuration.md).
 | **Suggest** | New or thin project | Finish `start`, re-run doctor |
 | **Adapt** | Not fully protected yet | Doctor action #1 until clean |
 | **Enforce** | Edges honest under the contract | Keep write path + CI |
-| **Enforce · design-weak** | Edges clean; design still messy | Shape door — not “done” |
+| **Enforce · leftover design work** | Edges clean; design still messy | Shape door — not “done” |
 
 **Green edges ≠ elegant design.** Empty remediation plan is not “architecture finished” if design residual remains.
 
@@ -97,9 +97,14 @@ outside the package. **Enforce green ≠ feature done.**
 That is **Shape** work (plan B) — suggested, never auto-applied as silent magic.
 
 1. Doctor confirms leftover design work (and residual lenses on the improvement compass)  
-2. Guided map / dual plan (skill pack: `/ark-explore` then `/ark-autopilot` with your OK)  
+2. Guided map / dual plan (skill pack: `/ark-explore` then `/ark-autopilot` applies one refactor)  
 3. One small refactor at a time · re-run doctor  
 
+**Teams:** do not amend `ark.config.json` in a product PR. Local gate:
+`npx arkgate-check --changed --base origin/dev`. Law-only PRs use
+`--contract-session` (stewards own loosen / baseline-grow). Checkout honesty:
+`npx arkgate status --vs origin/dev`.
+
 Install skills only when you want that guided path:
 
 ```bash
@@ -170,7 +175,7 @@ Human doctor prints the short section above.
 | **Stabilize** | Edges under Enforce | Real debt only in baseline; write path + CI honest |
 | **Shape** | One golden pattern + pilots | Residual lenses shrink pilot by pilot — never silent multi-pilot |
 
-Green edges under **Enforce · design-weak** mean Align/Stabilize may be fine while Shape remains open.
+Green edges under **Enforce · leftover design work** mean Align/Stabilize may be fine while Shape remains open.
 Empty plan A is **not** “architecture finished.”
 
 ---

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "arkgate",
-  "version": "4.6.0",
-  "description": "ArkGate \u2014 architecture co-pilot for AI TypeScript (write gate, CI gate, plan/loop; optional ArkRules)",
+  "version": "4.6.2",
+  "description": "One architecture config. One check. One coach.",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",

package/schemas/ark.config.schema.json

@@ -632,6 +632,15 @@
         "minLength": 1
       },
       "default": {}
+    },
+    "stewards": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
+      "uniqueItems": true,
+      "default": []
     }
   },
   "$defs": {

package/schemas/ark.status-manifest.schema.json

@@ -292,6 +292,57 @@
           "minLength": 1
         }
       }
+    },
+    "vsBase": {
+      "type": "object",
+      "description": "Checkout vs a git base ref: pin, contract identity, baseline grow. Advisory honesty only — never a gate input.",
+      "additionalProperties": false,
+      "required": [
+        "baseRef",
+        "line",
+        "pinLocal",
+        "pinBase",
+        "contractEqual",
+        "baselineGrew"
+      ],
+      "properties": {
+        "baseRef": {
+          "type": "string",
+          "minLength": 1
+        },
+        "line": {
+          "type": "string",
+          "minLength": 1
+        },
+        "pinLocal": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "pinBase": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "contractEqual": {
+          "type": "boolean"
+        },
+        "baselineGrew": {
+          "type": "boolean"
+        }
+      }
     }
   }
 }

package/server.json

@@ -1,17 +1,17 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.pedroknigge/arkgate",
-  "description": "ArkGate \u2014 architecture co-pilot for AI TypeScript (write gate, CI, plan/loop)",
+  "description": "When your agent writes TypeScript, ArkGate stops it from breaking the layers — and CI rejects the merge if it still does.",
   "repository": {
     "url": "https://github.com/pedroknigge/arkgate",
     "source": "github"
   },
-  "version": "4.6.0",
+  "version": "4.6.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "arkgate",
-      "version": "4.6.0",
+      "version": "4.6.2",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/templates/agent-skills/README.md

@@ -7,7 +7,7 @@
 This directory is the **Agent Skills–compatible** packaging of the same **13**
 `/ark-*` skills shipped as flat templates for Ark install. **No new skill names.**
 
-Package version when last generated context: **arkgate@4.6.0**
+Package version when last generated context: **arkgate@4.6.2**
 Schema: agent-skills package contract `1.0`
 
 ## Skills (frozen catalog)