arkgate 4.8.13 → 4.8.15

package/templates/skills/ark-fix.md

@@ -5,28 +5,25 @@ description: Shortcut to /ark-autopilot for a small illegal-import cluster.
 
 # /ark-fix — Shortcut to /ark-autopilot
 
-**Not a first-run door.** This leftover name is a shortcut. Gate violations are
+**Not a first-class door.** One-release redirect. Gate violations are
 **`/ark-autopilot`**. Do that job now. CLI only validates.
-
-## Autonomy contract
-
-Invoking this leftover name **is** the approval to write the fix. Open importers,
-design the port/move, apply, `ark-check`. Never weaken the config. Never invent
-`mechanical-safe` kinds.
+Contener · Guiar · Ordenar — this leftover name is not a star.
 
 ## When / not when
 
 | Use this leftover name when… | Prefer instead |
 |------------------------------|----------------|
 | One change / small cluster just failed the gate | **`/ark-autopilot`** |
-| Judgment design for a known violation | Session 0 / false-green → **`/ark-adopt`** |
+| Session 0 / false-green | **`/ark-adopt`** |
+| One kernel candidate | **`/ark-runtime`** |
+| One order-plane candidate | **`/ark-order`** |
 
 ## Plan B one-pilot checklist (when leftover design, not a single edge)
 
 Empty plan A + leftover design work is **not** architecture finished. One pilot only.
 Write an **extraction card** (`docs/brownfield-adoption.md` §6) — never mechanical-safe,
 never silent B apply. **Kill-switch** required. `multiPilotBatchForbidden` — never
-multi-pilot batch.
+multi-pilot batch. Execute that work on **`/ark-autopilot`**.
 
 ## Dual engine (mandatory)
 
@@ -46,10 +43,6 @@ retain `projectIdentity.projectId`, then pass both `expectedRoot` and `expectedP
 uncertain, do not consume MCP analysis: use the workspace-local CLI and report that MCP
 restart/retargeting is required. `ark://manifest` never satisfies this preflight.
 
-## Dual plane — layers + extras (mandatory, except /ark-runtime)
-
-Label findings **`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**. Absence of extras is valid and silent. Extra skip clusters (`ARKRUN_*` / `ARKORDER_*`) are **`/ark-autopilot`**. When ArkOrder is on: later ξ is `proposeRelease` then `apply` (not a second `release()`); `refreshSigma`; ingest residual `absorb | escalate_up | hold`; capacity pack as data; in-memory `ReleaseStore`; ArkRun `decisionTape`. Do not invent `/ark-run` or `/ark-order`. Skills never enforce.
-
 ## Subagent fan-out (optional, host-dependent)
 
 If the host supports **parallel subagents**, fan out read-only scouts; otherwise
@@ -60,6 +53,15 @@ If the host supports **parallel subagents**, fan out read-only scouts; otherwise
 - **Greenfield:** `/ark-adopt` or `ark-check --recommend` / `ark start`.
 - **Brownfield:** `/ark-adopt`.
 
+## Mechanical-edit hygiene (outcome gate)
+
+Leftover name, same edit bar as `/ark-autopilot` if you still land here.
+
+- Header injection must **merge into the existing doc comment**; the kept result has one `/**`, not stacked headers.
+- Route completion or movement must **preserve the original typed `defineRoute<…>(opts, handler)` call**; reconstruct that call instead of extracting untyped opts/handler constants that drop generics or contextual typing.
+- A convention-only `*-data.ts` stub is not a fix: move the real code or **leave the placeholder file uncreated**; never write `import "server-only"; export {}` as an empty naming token.
+- Keep the edit only when the **previously clean file stays typecheck-clean**. Otherwise roll it back and treat the change as judgment.
+
 ## Steps
 
 1. Sensor: `ark-check` / `--plan --json`.
@@ -68,13 +70,6 @@ If the host supports **parallel subagents**, fan out read-only scouts; otherwise
 3. Otherwise execute **`/ark-autopilot`** for the cluster (extraction card if Shape).
 4. Re-check.
 
-## Mechanical-edit hygiene (outcome gate)
-
-- Header injection must **merge into the existing doc comment**; the kept result has one `/**`, not stacked headers.
-- Route completion or movement must **preserve the original typed `defineRoute<…>(opts, handler)` call**; reconstruct that call instead of extracting untyped opts/handler constants that drop generics or contextual typing.
-- A convention-only `*-data.ts` stub is not a fix: move the real code or **leave the placeholder file uncreated**; never write `import "server-only"; export {}` as an empty naming token.
-- Keep the edit only when the **previously clean file stays typecheck-clean**. Otherwise roll it back and treat the change as judgment.
-
 ## Completion contract (skill incomplete if missing)
 
 Skill incomplete if missing any field below.

package/templates/skills/ark-loop.md

@@ -5,21 +5,17 @@ description: Shortcut to /ark-autopilot for illegal-import fixes. CLI validates
 
 # /ark-loop — Shortcut to /ark-autopilot
 
-**Not a first-run door.** This leftover name is a shortcut. Driving `--plan` to `goal.met` is **`/ark-autopilot`**.
-Do that job now. Auto-apply only the four `mechanical-safe` kinds; judgment you write.
-
-## Autonomy contract
-
-Invoking this leftover name **is** the approval to apply plan A. Open every step file.
-Write. Re-check. Empty plan A + leftover design → **`/ark-explore`** then **`/ark-autopilot`**
-for one extraction card (never mechanical-safe B).
+**Not a first-class door.** One-release redirect. Driving `--plan` to `goal.met` is
+**`/ark-autopilot`**. Do that job now.
+Contener · Guiar · Ordenar — this leftover name is not a star.
 
 ## When / not when
 
 | Use this leftover name when… | Prefer instead |
 |------------------------------|----------------|
 | Plan A has steps; drive to `goal.met` | **`/ark-autopilot`** |
-| Mechanical-safe + judgment apply | Map only → `/ark-explore`; session 0 → `/ark-adopt` |
+| Map only | `/ark-explore` |
+| Session 0 | `/ark-adopt` |
 
 ## Dual engine (mandatory)
 
@@ -41,10 +37,6 @@ restart/retargeting is required. `ark://manifest` never satisfies this preflight
 
 Atomic multi-file work uses **`ark_prepare_change`** with the same matched `project` envelope.
 
-## Dual plane — layers + extras (mandatory, except /ark-runtime)
-
-Label findings **`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**. Absence of extras is valid and silent. Extra skip clusters (`ARKRUN_*` / `ARKORDER_*`) are **`/ark-autopilot`**. When ArkOrder is on: later ξ is `proposeRelease` then `apply`; `refreshSigma`; ingest residual `absorb | escalate_up | hold`; capacity pack as data; in-memory `ReleaseStore`; ArkRun `decisionTape`. Never invent `mechanical-safe` kinds. Do not invent `/ark-run` or `/ark-order`. Skills never enforce.
-
 ## Subagent fan-out (optional, host-dependent)
 
 If the host supports **parallel subagents**, fan out read-only scouts; otherwise
@@ -55,6 +47,15 @@ If the host supports **parallel subagents**, fan out read-only scouts; otherwise
 - **Greenfield:** `/ark-adopt` or `ark-check --recommend` / `ark start`.
 - **Brownfield:** `/ark-adopt`.
 
+## Mechanical-edit hygiene (outcome gate)
+
+Leftover name, same edit bar as `/ark-autopilot` if you still land here.
+
+- Header injection must **merge into the existing doc comment**; the kept result has one `/**`, not stacked headers.
+- Route completion or movement must **preserve the original typed `defineRoute<…>(opts, handler)` call**; reconstruct that call instead of extracting untyped opts/handler constants that drop generics or contextual typing.
+- A convention-only `*-data.ts` stub is not a fix: move the real code or **leave the placeholder file uncreated**; never write `import "server-only"; export {}` as an empty naming token.
+- Keep the edit only when the **previously clean file stays typecheck-clean**. Otherwise roll it back and treat the change as judgment.
+
 ## Steps
 
 1. `--plan --json`. Open every `steps[]` file.
@@ -64,13 +65,6 @@ If the host supports **parallel subagents**, fan out read-only scouts; otherwise
    **STOP — false-green:** execute **`/ark-adopt`**.
 4. Else execute **`/ark-autopilot`** (mechanical-safe + judgment). Extraction card for Shape B.
 
-## Mechanical-edit hygiene (outcome gate)
-
-- Header injection must **merge into the existing doc comment**; the kept result has one `/**`, not stacked headers.
-- Route completion or movement must **preserve the original typed `defineRoute<…>(opts, handler)` call**; reconstruct that call instead of extracting untyped opts/handler constants that drop generics or contextual typing.
-- A convention-only `*-data.ts` stub is not a fix: move the real code or **leave the placeholder file uncreated**; never write `import "server-only"; export {}` as an empty naming token.
-- Keep the edit only when the **previously clean file stays typecheck-clean**. Otherwise roll it back and treat the change as judgment.
-
 ## Completion contract (skill incomplete if missing)
 
 Skill incomplete if missing any field below.

package/templates/skills/ark-order.md

@@ -0,0 +1,200 @@
+---
+name: ark-order
+description: Wire the optional ArkOrder extra (arkgate/order). One candidate. Extra on via /ark-adopt.
+---
+
+# /ark-order — Evaluate and wire ArkOrder (optional)
+
+**Contener · Guiar · Ordenar.** In plain words: contain the write, guide the next
+step, order leftover mess. This door is **Ordenar**: the extra for the few big product
+choices (billing plan, not seat counts). Ordering leftover folders is `/ark-explore`
+then `/ark-autopilot`. Skills never enforce — CLI / hooks / CI do.
+
+Layers stop a bad import. ArkOrder stops rewriting a big product choice as if it
+were a seat count. Change those choices through a valve, not a generic update.
+
+The ArkOrder extra (`arkgate/order`) is **optional**. It is **not** required for
+ArkGate enforcement and is **not** production durability. Use this skill when the
+user wants to evaluate or wire the extra. **This skill never enforces.** Do **not**
+invent `/ark-run`. `@arkgate/order` is not a package — import `arkgate/order` from
+the same `arkgate` tarball.
+
+**When:** evaluate a hand-rolled “PATCH the plan like a seat count” / generic update
+of a slow product choice, or wire an extra that is already on (plane root, named
+keys, valve).
+**Not when:** session 0 / extra not chosen (`/ark-adopt`); one new file (`/ark-place`);
+skip-violation grind (`/ark-autopilot`); wire the runtime kernel (`/ark-runtime`).
+
+## When / not when
+
+| Use `/ark-order` when… | Do **not** use it when… |
+|------------------------|-------------------------|
+| Wire one ArkOrder candidate after the extra is on | Extra not chosen → `/ark-adopt` |
+| Evaluate a generic update of a named product choice | New plane-root file only → `/ark-place` |
+| Valve: first `release()`, later `proposeRelease` then `apply` | Skip cluster grind → `/ark-autopilot`; one kernel candidate → `/ark-runtime` |
+
+## Contener · Guiar · Ordenar
+
+| Star | This door | Hand off |
+|------|-----------|----------|
+| **Contener** | `/ark-adopt` path · `/ark-place` new file · `/ark-upgrade` pin | Map → `/ark-explore` · apply → `/ark-autopilot` |
+| **Guiar** | `/ark-explore` map · `/ark-autopilot` apply · `/ark-runtime` wire ArkRun · `/ark-explain` tour · `/ark-coverage` fitness | Session 0 → `/ark-adopt` · this door for the big-choice plane |
+| **Ordenar** | **This skill** — wire ArkOrder | Extra off → `/ark-adopt` · new plane-root file → `/ark-place` · skip grind → `/ark-autopilot` |
+
+**Handoff, do not invent a door.** Extra off → `/ark-adopt`. New file → `/ark-place`.
+Skip cluster → `/ark-autopilot`. One kernel candidate → `/ark-runtime`.
+
+## Extra vs plane (mandatory)
+
+| Piece | What it is | What it is not |
+|-------|------------|----------------|
+| **ArkOrder extra** (`arkOrder` on `ark.config.json`, schema `1.3+`) | Gate contract: plane usage + named slow keys | A score; Layers / ArkRules / ArkRun replacement; merge teeth while `advisory` |
+| **Plane** `arkgate/order` | Library you construct with `createOrderPlane` (one instance per call) | A process-wide singleton; a second npm package; production durability |
+
+Absence of the extra is **silent** — Layers and ArkRules verdicts stay identical. Doctor / status
+`arkOrder` is always `notAScore`. Never invent 0–10 scores or pass/fail from this skill.
+
+## Improvement compass note
+
+This skill is **optional order-plane** only. Do **not** treat ArkOrder adoption as residual on
+the resilience lens unless the user explicitly opts into the extra. Prefer doctor compass
+for static architecture residual; hand static residual to `/ark-explore` / `/ark-autopilot`.
+Doctor `arkOrder` residual is a finding-id count (`ARKORDER_*`), never a compass score.
+
+## Dual engine (mandatory)
+
+| Engine | Role |
+|--------|------|
+| **Deterministic** | CLI / MCP / contract sensors — exit codes, plan kinds, coverage numbers, install status |
+| **Exploratory** | You open **this** repo's real files and product surface before concluding |
+
+The CLI is a **sensor**, never the whole job. Claiming done without the exploratory bar for this skill is **incomplete**.
+
+## MCP workspace binding (mandatory)
+
+Before any `ark_*` MCP tool, call `ark_identity` with `project.expectedRoot` set to the exact
+workspace root. Continue only when `binding.status === "matched"` and `authoritative === true`;
+retain `projectIdentity.projectId`, then pass both `expectedRoot` and `expectedProjectId` under
+`project` on every later MCP call. If identity is missing, mismatched, unverified, or the root is
+uncertain, do not consume MCP analysis: use the workspace-local CLI and report that MCP
+restart/retargeting is required. `ark://manifest` never satisfies this preflight.
+
+## Out of scope for ArkRules and ArkRun
+
+This skill is **order-plane only**. Do not mix ArkRules structure/invariants here; do **not**
+turn this skill into an ArkRun skill. Hand off first extras to `/ark-adopt`, new files to
+`/ark-place`, skip clusters to `/ark-autopilot`, one kernel candidate to `/ark-runtime`.
+Label plane residual **`[ArkOrder]`** so it never blurs with **`[Layer]`**, **`[ArkRules]`**,
+or **`[ArkRun]`**.
+
+## Subagent fan-out (optional, host-dependent)
+
+If the host supports **parallel subagents** and the task splits cleanly (e.g. multiple
+dirs to sample), fan out read-only scouts; otherwise **fall back to sequential**.
+Parent merges and still emits the **### Completion** contract. Never parallel-write
+the same files or weaken the gate.
+
+## Steps
+
+1. **Inventory** — grep the codebase for hand-rolled equivalents:
+   - a use-case that `update` / `patch` / `set` a slow product choice (plan, cycle, tenancy)
+     the same way it writes a seat count or invoice
+   - Prisma / pg / SQL writes of those names from Application / Features
+   - a second `release()` after the first freeze (should be `proposeRelease` then `apply`)
+   - membership ids (`projectId`, `orgId`) treated as slow keys
+   - recomputable statuses (`paid`, `overdue`, `atCapacity`, `approved`) stored as if they
+     were named choices
+   Also check whether the billing gallery pattern applies:
+   [examples/arkorder-billing](https://github.com/pedroknigge/arkgate/tree/main/examples/arkorder-billing)
+   (GitHub tree, not in the npm tarball). Copy billing, **rename the three keys**.
+2. **Read the extra** — open `ark.config.json`. If `arkOrder` is absent and the user wants the extra,
+   **STOP — do not continue this skill as complete.** Handoff **`/ark-adopt`** to write **advisory**
+   `arkOrder` (schema `1.3+`; real `planeRoots`, existing `managedLayers`, `maxXiKeys` default 7,
+   **`xiKeys`** the 3–5 slow names). Do not invent the extra here. If the extra is present, note
+   `mode`, `planeRoots`, managed layers, `maxXiKeys`, and `xiKeys`; doctor `arkOrder` is `notAScore`.
+3. **Pick ONE target** — the smallest, most self-contained candidate (fewest call sites).
+   Migrating everything at once is how adoptions die. List the rest as follow-ups in the report.
+   New files after the extra is on go through **`/ark-place`**.
+4. **Resolve availability** — `npm install arkgate` already ships `arkgate/order`.
+   Import `createOrderPlane` from `arkgate/order`. Same npm package. Not a second install.
+5. **Wire through the plane** — read
+   [ArkOrder](https://github.com/pedroknigge/arkgate/blob/main/docs/arkorder.md)
+   (first-contact breath first; valve tables below the fold).
+   - Call `createOrderPlane` **only** inside `arkOrder.planeRoots`. Each call is a new instance —
+     no process-wide singleton.
+   - Keep Domain-role layers plane-free (`ARKORDER_KERNEL_IN_DOMAIN`).
+   - First freeze: `release()`. Later change of a named choice is `proposeRelease` then `apply`
+     — not a second `release()` (`ARKORDER_UNVALVED_RELEASE`), not `update` / `patch` / `set`
+     (`ARKORDER_GENERIC_UPDATE`).
+   - Name **`xiKeys`** (3–5 slow product decisions). Membership ids and recomputable statuses
+     are not keys: derive a status on read or fold it from ingest. A use-case that persists
+     those keys is `ARKORDER_XI_FIELD_WRITE`. Invoices and seats still flow through `ingest`.
+   - Before writing a name, drop the candidate and ask: can current state reconstruct it
+     uniquely? If it is recomputable or ingest determines it, derive it. The check remains
+     silent on semantic entailment.
+   - `refreshSigma`; ingest residual `absorb | escalate_up | hold` + `reasonCode`; capacity
+     pack as data; in-memory `ReleaseStore` (`createMemoryReleaseStore`); `ingestTravelAction`.
+     ArkRun `decisionTape` is still **`[ArkRun]`** — do not turn the tape into this skill.
+   - In-memory stores lose state on restart — **not** production durability. Branding ArkOrder
+     is not a durability claim. Doctor / status `arkOrder` is `notAScore`.
+6. **Delete the hand-rolled generic update** once call sites are moved — the point is
+   less code, not a second parallel system. Deleting code is a destructive move:
+   confirm with the user before removing the old implementation, and never delete
+   something the inventory only *suspects* is dead.
+
+## Critical handoffs
+
+- No static gates yet: **STOP — do not continue this skill as complete.** Run `/ark-adopt` first
+  (`ark-check --recommend`).
+- Extra absent and the user wants it: **STOP — do not continue this skill as complete.**
+  **`/ark-adopt`** writes advisory `arkOrder`.
+- Skip cluster (`ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE`
+  / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`) after
+  the extra is on: **`/ark-autopilot`** — this skill still wires one candidate.
+- New plane-root file after the extra is on: **`/ark-place`**.
+- One kernel / bus candidate: **`/ark-runtime`** — do not mix planes.
+- `arkgate` not installed and no local checkout: **STOP** and report the distribution boundary.
+- Inventory finds nothing: stop; do not introduce the plane speculatively.
+
+## Operating rules
+
+- If the inventory finds NO hand-rolled equivalents, say so and stop — do not
+  introduce ArkOrder speculatively. Static enforcement alone is a complete, valid use of Ark.
+- Keep the migration diff reviewable: one feature per invocation.
+- Skills never enforce; never weaken `ark.config.json` to skip `ARKORDER_*`.
+- Never a process-wide plane singleton. Never a second npm package.
+- Never claim in-memory stores are production-durable.
+- Never force the extra on. Compact starter / `ark start` stays extras-off.
+- Plain-language reporting: one sentence per concept ("the billing plan is a
+  named choice — change it through the valve, not a generic update").
+- ξ / Haken / slaving stay **below the fold**. First contact uses the one-minute breath.
+
+## Related onboarding
+
+- Adopt static gates and application shape **first** (`/ark-adopt` or `ark-check --recommend`).
+  Brownfield: same door — advisory extra only until the team promotes; absence is valid.
+- ArkOrder is optional and separate from enthusiast onboarding. Do not put `arkOrder` on the
+  compact starter.
+
+## Verify and report
+
+Run the project's tests plus `ark-check --root . --config ark.config.json
+--strict-config`. Report: what was migrated, lines deleted vs added, remaining
+candidates ranked, behavior differences, and **`[ArkOrder]`** residual
+(`ARKORDER_*` / doctor `arkOrder`, `notAScore`) separately from Layers / ArkRules / ArkRun.
+
+## Completion contract (skill incomplete if missing)
+
+End with **exactly** these headings (markdown `###`):
+
+### Completion
+- **Sensor:** commands/tools run
+- **Opened:** real paths read (or `n/a` only if pure install/upgrade with no source analysis)
+- **Result:** one-line outcome
+- **Planes:** **`[ArkOrder]`** residual (or `n/a` if extra absent) — do not mix with `[Layer]` / `[ArkRules]` / `[ArkRun]`
+- **Compass:** `n/a` (order skill; static residual → explore/autopilot) | top residual if doctor was run
+- **Handoff:** `/ark-…` / CLI / `none`
+- **Incomplete?** `no` | `yes — <what is missing>`
+
+If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
+**Skill incomplete if missing** any of the bullets above.

package/templates/skills/ark-place.md

@@ -5,6 +5,10 @@ description: "Where does new code go? Names the folder from the rules file and w
 
 # /ark-place — Where does this code go?
 
+**Contener · Guiar · Ordenar.** In plain words: contain the write, guide the next
+step, order leftover mess. This door is **Contener**: write the new file in the
+right house. Skills never enforce — CLI / hooks / CI do.
+
 **When:** you are adding a new file or artifact and need the layer, folder, and name.
 **Not when:** session 0 / config is missing or lying (`/ark-adopt`) or an existing violation cluster (`/ark-autopilot`).
 
@@ -18,9 +22,21 @@ description: "Where does new code go? Names the folder from the rules file and w
 
 - `filePath` is known before the call. Description alone is not a path.
 - Golden pattern is load-bearing when present. Adopt generates it.
+- An included file that matches no layer is not a pass. The write gate denies it
+  (`CONFIG_UNCLASSIFIED_FILES`). Place it in a layer folder, or send include/layer
+  drift to `/ark-adopt`. Do not write into a loose include gap.
 - Do not default a repository to Presentation.
+- When doctor JSON has `noDomainFrontend`, the new file is a Domain rule — not
+  another UI helper. Soft. Silent when Domain already has files or there is no
+  frontend. No `/ark-domain`.
 - When the matched layer has `layers[].description`, print that caption next to the
   layer name and globs. Omit when absent — do not invent a caption or `/ark-describe`.
+- When the matched layer has `layers[].trustBoundary`, print `trust: <tag>` next
+  to the layer name and globs. Omit when absent — do not invent a tag or `/ark-trust`.
+- When the matched layer has `layers[].owners`, print `owner: @handle` next
+  to the layer name and globs. Omit when absent — do not invent a person or `/ark-owners`.
+  When `requireLayerOwners` is on and the house has no owners, send that gap to
+  `/ark-adopt` before writing.
 - When `arkRun` is on: scaffold through the kernel (no `new` of managed types; declare
   `uses` / `reactsTo` / `raises` / `sends`; factory only in `arkRun.kernelRoots`,
   `compositionRoots` alias). Extra off → do not introduce the kernel. Enable it
@@ -65,6 +81,21 @@ When `ark_place` / the contract includes `layers[].description`, print that capt
 next to the layer name and globs. Omit it when the field is absent. Do **not** invent
 a caption or `/ark-describe`.
 
+## Layer trust (process)
+
+When the matched layer has `layers[].trustBoundary` (`public` | `auth` |
+`admin` | `internal`), print `trust: <tag>` next to the layer name and globs.
+Omit it when the field is absent. Do **not** invent a tag or `/ark-trust`.
+The tag is guidance, not an import-rule deny.
+
+## Layer owners (process)
+
+When the matched layer has `layers[].owners`, print `owner: @handle` (or
+`owner: name@host`) next to the layer name and globs. Omit when absent.
+Do **not** invent a person or `/ark-owners`. When `requireLayerOwners` is
+on and this house has no owners, do not write — hand off `/ark-adopt` to
+name who owns the folder.
+
 ## Deep modules (process)
 
 - Place so new code stays **deep**: one small public surface per concern; hide implementation details.
@@ -78,7 +109,7 @@ a caption or `/ark-describe`.
 | New artifact: where + **write** under the config | Existing violation cluster → `/ark-autopilot` |
 | Naming / directory for a known kind | Session 0 / config missing or lying → `/ark-adopt` (then come back) |
 | Kernel-managed artifact when `arkRun` is already on | Extra not chosen yet → `/ark-adopt` (advisory `arkRun`); evaluate / migrate a hand-rolled bus → `/ark-runtime` |
-| Plane-root artifact when `arkOrder` is already on | Extra not chosen yet → `/ark-adopt` (advisory `arkOrder`); skip cluster grind → `/ark-autopilot` |
+| Plane-root artifact when `arkOrder` is already on | Extra not chosen yet → `/ark-adopt` (advisory `arkOrder`); evaluate / wire one plane candidate → `/ark-order`; skip cluster grind → `/ark-autopilot` |
 
 The user describes something they need to build (a saga, a background job, an
 event handler, a repository, an HTTP client, a use case, a projection, …).
@@ -88,7 +119,9 @@ and — if they asked to build it — scaffold it there correctly.
 **No artifact given?** If the skill is invoked with nothing to place, don't error
 and don't guess — the artifact is the one thing only the user knows. Read the
 contract (step 1) and print the placement map from it: one row per declared layer
-with layer name, globs, and `layers[].description` when present (omit when absent),
+with layer name, globs, `layers[].description` when present,
+`layers[].trustBoundary` when present, and `layers[].owners` when present
+(omit any when absent),
 what belongs there, its directory, and which layers it may/may not import,
 plus the not-yet-adopted `suggestedLayers` as a footnote. Then ask what they want
 to place. That map is derived entirely from the repo, so producing it is real work,
@@ -130,9 +163,9 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Missing layer home: add it via **`/ark-adopt`** in this session if needed, then write the file; never invent `mechanical-safe`.
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Absence of `arkRun` is **valid**. Do not introduce the kernel speculatively. Skills never enforce this extra.
-7. Absence of `arkOrder` is **valid**. When on: Domain stays plane-free; first freeze ξ with `release()`; later ξ is `proposeRelease` then `apply`; never `update`/`patch`/`set` the pattern. Import `createOrderPlane` from `arkgate/order` (same npm package). No `/ark-order` skill.
+7. Absence of `arkOrder` is **valid**. When on: Domain stays plane-free; first freeze ξ with `release()`; later ξ is `proposeRelease` then `apply`; never `update`/`patch`/`set` the pattern. Import `createOrderPlane` from `arkgate/order` (same npm package). Evaluate / wire one candidate via **`/ark-order`**.
 
 
 ### Place + ArkRules
@@ -158,8 +191,8 @@ When `arkOrder` is present on the architecture config:
 - Call the factory only inside `arkOrder.planeRoots`. Empty roots in `enforced` mode is `ARKORDER_MISSING_PLANE`.
 - Named slow keys live in `arkOrder.xiKeys`. A managed-layer Prisma/pg write of those keys is `ARKORDER_XI_FIELD_WRITE` — absorb with `ingest` or change the pattern with `proposeRelease` then `apply`.
 - A recomputable status is not a new `xiKeys` entry or a `proposeRelease`: place it as a read projection or an ingest fold. If slow-key naming remains unresolved, return to `/ark-adopt` and run the elimination test before writing the config.
-- Skip clusters (`ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE` / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`): place this artifact, then grind via `/ark-autopilot`. Extra not on → `/ark-adopt`. Do not invent `/ark-order`.
-- Absence of the extra is valid. Do not invent `/ark-order`. Skills never enforce.
+- Skip clusters (`ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE` / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`): place this artifact, then grind via `/ark-autopilot`. Extra not on → `/ark-adopt`. Evaluate / wire one candidate → `/ark-order`.
+- Absence of the extra is valid. Skills never enforce.
 
 ## Subagent fan-out (optional, host-dependent)
 
@@ -176,7 +209,11 @@ the same files or weaken the gate.
    its forbidden globals, and exactly which layers the file may / must not import,
    straight from the contract (no guessing). When the matched layer has
    `layers[].description`, print that caption next to the layer name and globs;
-   omit it when absent. When present, also honor optional
+   omit it when absent. When the matched layer has `layers[].trustBoundary`,
+   print `trust: <tag>` next to the layer name and globs; omit it when absent.
+   When the matched layer has `layers[].owners`, print `owner: @handle`; omit
+   when absent.
+   When present, also honor optional
    **`goldenPattern`** (from `.ark/golden-pattern.json`) for **NEW code only** —
    advisory layout norm; never overrides the gate and never clears design-weak.
    Absent golden is normal. Otherwise load `ark.config.json`; after the matched preflight,
@@ -211,6 +248,8 @@ the same files or weaken the gate.
    `patterns`), intent-name prefix if the layer declares `intentPrefixes`, and
    which layers it may/may not import (from `rules`). When present, print
    `layers[].description` next to the layer name and globs; omit when absent.
+   Print `layers[].trustBoundary` as `trust: <tag>` when present; omit when absent.
+   Print `layers[].owners` as `owner: @handle` when present; omit when absent.
 4. **If the layer isn't adopted yet** (suggested but no directory): write the
    layer into `ark.config.json` (session-0 honesty — same as `/ark-adopt` for
    that glob) **then** write the file. Don't silently drop the code into a
@@ -229,11 +268,10 @@ the same files or weaken the gate.
   hand off **one** pilot via `pilotLoop.nextPilot` / `/ark-explore` shape-focus — never multi-pilot
   batch reshape from this skill.
 - If `arkRun` is on and the user is grinding skip violations (`new` of managed types, homemade
-  bus) across many files: place this artifact through the kernel, then leftover `/ark-fix` /
-  `/ark-autopilot`. Extra not on → `/ark-adopt` (advisory) or `/ark-runtime` (evaluate).
+  bus) across many files: place this artifact through the kernel, then `/ark-autopilot`. Extra not on → `/ark-adopt` (advisory) or `/ark-runtime` (evaluate).
 - If `arkOrder` is on and the user is grinding skip violations (`ARKORDER_*`) across many files:
-  place this artifact on a plane root, then leftover `/ark-fix` / `/ark-autopilot`. Extra not on
-  → `/ark-adopt` (advisory). Do not invent `/ark-order`.
+  place this artifact on a plane root, then `/ark-autopilot`. Extra not on
+  → `/ark-adopt` (advisory). Evaluate / wire one candidate → `/ark-order`.
 
 ## Operating rules
 

package/templates/skills/ark-runtime.md

@@ -5,6 +5,10 @@ description: Wire the optional ArkRun extra (arkgate/runtime). One candidate. Ex
 
 # /ark-runtime — Evaluate and wire ArkRun (experimental opt-in)
 
+**Contener · Guiar · Ordenar.** In plain words: contain the write, guide the next
+step, order leftover mess. This door is **Guiar**: wire the optional runtime so work
+keeps moving. Skills never enforce — CLI / hooks / CI do.
+
 The ArkRun kernel (`arkgate/runtime`) is currently **experimental**. It is **not** required
 for ArkGate enforcement and is **not** production durability. Use this skill when the user wants
 to evaluate or wire the kernel. **This skill never enforces** — the write / CI / ESLint plane
@@ -13,7 +17,15 @@ does when the `arkRun` extra is on. Do **not** invent `/ark-run`. `@arkgate/runt
 **When:** evaluate a hand-rolled bus / outbox / saga / projection / policy / Nest adapter against
 the kernel, or wire an extra that is already on (kernel root, declarations, transport).
 **Not when:** session 0 / extra not chosen (`/ark-adopt`); one new file (`/ark-place`); skip-violation
-grind (`/ark-autopilot` / leftover `/ark-fix`).
+grind (`/ark-autopilot`); wire the order plane (`/ark-order`).
+
+## When / not when
+
+| Use `/ark-runtime` when… | Do **not** use it when… |
+|--------------------------|-------------------------|
+| Wire one ArkRun candidate after the extra is on | Extra not chosen → `/ark-adopt` |
+| Evaluate a hand-rolled bus / outbox / saga | New kernel-managed file only → `/ark-place` |
+| Declarations / transport / Nest adapter | Skip cluster grind → `/ark-autopilot`; one order-plane candidate → `/ark-order` |
 
 ## Extra vs kernel (mandatory)
 
@@ -22,8 +34,10 @@ grind (`/ark-autopilot` / leftover `/ark-fix`).
 | **ArkRun extra** (`arkRun` on `ark.config.json`, schema `1.2+`) | Gate contract: kernel usage + complete declarations | A score; Layers / ArkRules replacement; merge teeth while `advisory` |
 | **Kernel** `arkgate/runtime` | Kernel you construct with `createStrictArkKernel` (one instance per call) | A process-wide `getKernel()`; shipped cloud broker SDKs; production durability |
 
-Absence of the extra is **silent** — Layers and ArkRules verdicts stay identical. Doctor / status
-`arkRun` is always `notAScore`. Never invent 0–10 scores or pass/fail from this skill.
+Absence of the extra is **silent** — Layers and ArkRules verdicts stay identical. Compact
+doctor names ArkRun only when the extra is on (experimental, in-memory, not Postgres;
+`/ark-runtime` when residual remains). Doctor / status `arkRun` is always `notAScore`.
+Never invent 0–10 scores or pass/fail from this skill.
 
 ## Improvement compass note
 
@@ -52,7 +66,7 @@ restart/retargeting is required. `ark://manifest` never satisfies this preflight
 
 ## Out of scope for ArkRules and ArkOrder
 
-This skill is **runtime-kernel only**. Do not mix ArkRules structure/invariants here; do **not** turn this skill into an ArkOrder skill. Hand off first extras to `/ark-adopt`, new files to `/ark-place`, skip clusters to `/ark-autopilot`. Label kernel-usage residual **`[ArkRun]`** so it never blurs with **`[Layer]`**, **`[ArkRules]`**, or **`[ArkOrder]`**.
+This skill is **runtime-kernel only**. Do not mix ArkRules structure/invariants here; do **not** turn this skill into an ArkOrder skill. Hand off first extras to `/ark-adopt`, new files to `/ark-place`, skip clusters to `/ark-autopilot`, one order-plane candidate to `/ark-order`. Label kernel-usage residual **`[ArkRun]`** so it never blurs with **`[Layer]`**, **`[ArkRules]`**, or **`[ArkOrder]`**.
 
 ## Subagent fan-out (optional, host-dependent)
 
@@ -119,9 +133,10 @@ the same files or weaken the gate.
 
 ## Critical handoffs
 
-- No static gates yet: **STOP — do not continue this skill as complete.** Run `/ark-adopt` first (`ark-check --recommend` / leftover `/ark-architect`).
+- No static gates yet: **STOP — do not continue this skill as complete.** Run `/ark-adopt` first (`ark-check --recommend`).
 - Extra absent and the user wants it: **STOP — do not continue this skill as complete.** **`/ark-adopt`** writes advisory `arkRun`.
-- Skip cluster (`new` of managed types, homemade bus, kernel in Domain) after the extra is on: leftover **`/ark-fix`** / **`/ark-loop`** or **`/ark-autopilot`** — this skill still wires one candidate.
+- Skip cluster (`new` of managed types, homemade bus, kernel in Domain) after the extra is on: **`/ark-autopilot`** — this skill still wires one candidate.
+- One order-plane candidate: **`/ark-order`** — do not mix planes.
 - `arkgate` not installed and no local checkout: **STOP** and report the distribution boundary.
 - Inventory finds nothing: stop; do not introduce kernel speculatively.