arkgate 4.8.14 → 4.8.15

package/templates/agent-skills/ark-adopt/SKILL.md

@@ -21,11 +21,33 @@ has honest houses. Skills never enforce — CLI / hooks / CI do.
 ## Checklist
 
 - Existing tree: propose **SharedKernel** (types/constants) + **CompositionRoot** (wiring) + `src/**/domain/**`. Never dump bare `src/lib/**` into Application.
+- Every `include` path must land in a layer. Include that classifies no file is the
+  same as an empty check — not a pass. Fix globs here; do not leave a loose gap.
 - Generate `.ark/golden-pattern.json` (load-bearing for `/ark-place`).
 - Future houses: mark unused layer globs `reserved` / `allowEmpty` so `--strict-config` does not fail.
 - When the product map or glossary names a house, write `layers[].description` as
   app-context copy (what this folder is *in the product*). Compact starter may omit.
   Do not invent captions. Do not invent `/ark-describe`.
+- When the product map names who a folder is for, write `layers[].trustBoundary`
+  (`public` | `auth` | `admin` | `internal`). Compact starter may omit. Do not
+  invent tags. Absence is silent. No `/ark-trust`.
+- When the product map names who owns a folder, write `layers[].owners`
+  (GitHub handle or email). Compact starter may omit. Do not invent people.
+  Absence is silent unless the user asked for required owners — then write
+  `requireLayerOwners: true` after the live houses have names. No `/ark-owners`.
+- When the user wants required gates (`--require-gates` / `--strict-merge` /
+  required GitHub check) and there is no `docs/adr/` (or `docs/decisions/`),
+  leave a short decision note there — only if they loosen a rule or add a real
+  gate. Not every change. Doctor residual is soft. No `/ark-adr`.
+- When a product-domain doc is already in play (`docs/domain.md` or a sibling)
+  and doctor JSON has `statesTransitions` or `statusTransitionCatalog`, add a
+  short states → transitions table (or one link) there. Use catalog names when
+  present. No flag soup. Soft residual. Silent when that doc is absent or
+  Domain has no status vocabulary. No `/ark-states`.
+- When doctor JSON has `noDomainFrontend`, keep the empty Domain house — do not
+  delete it to “clean” empty layers. Next is one Domain file (`/ark-place`), not
+  a weaker contract. Soft. Silent when there is no frontend or Domain already
+  has files. No `/ark-domain`.
 - CLI-first: if `arkgate-check` already resolved the root, do not wait on MCP.
 - Do not add `arkRun` or `arkOrder` unless the user wants that extra. When they do, write
   **advisory** extra in this turn (`arkRun` schema `1.2+`; `arkOrder` schema `1.3+`).
@@ -106,6 +128,46 @@ received."), not architecture jargon. Compact starter / `ark start` may omit the
 field. Absence is silent — never fail `--strict-config` for a missing caption.
 Do **not** invent captions. Do not invent `/ark-describe`.
 
+## Layer trust (process)
+
+Optional `layers[].trustBoundary`: `public` | `auth` | `admin` | `internal`.
+Marks who this folder is for (anyone, signed-in users, operators, or only
+other code). Write it when the product map already names that door. Compact
+starter / `ark start` may omit it. Absence is silent — never fail
+`--strict-config`, never invent a doctor residual. Do **not** invent tags.
+This is not host/CI TLS and does not add import-rule teeth. No `/ark-trust`.
+
+## Layer owners (process)
+
+Optional `layers[].owners`: GitHub handles or emails (same identity as
+`stewards` — not a display name). Write them when the product map already
+names who owns the house. Compact starter / `ark start` may omit. Absence is
+silent unless the user asked for required owners. Then write
+`requireLayerOwners: true` only after every live (non-reserved) layer has
+at least one owner. Do **not** invent people. No `/ark-owners`. The require
+flag is the fail-closed switch; owners themselves are metadata.
+
+## Decision notes (process)
+
+When gates are required (`--require-gates` / `--strict-merge` / required merge
+status) and there is no short decision-note home yet, doctor may ask for one
+under `docs/adr/` or `docs/decisions/`. Write a note when you loosen a rule or
+add a real gate — not on every file. Absence is silent unless that demand is
+on. The hint does not fail the check. Do **not** invent `/ark-adr`. Policy
+weaken still uses `--policy-ack`; this is only a place to write the why.
+
+## States and transitions (process)
+
+When a product-domain / domain-model doc is already on disk (`docs/domain.md`,
+`docs/data-model.md`, or a dedicated `docs/states.md`) and there is no short
+states → transitions table (or one link), doctor may ask for one. Write the
+table on that home — entity · states · allowed from → to. Names from the
+code or the captain. When doctor JSON has `statusTransitionCatalog`, use those
+entity · states names — Domain already opted in by having that vocabulary.
+Do **not** invent states or flag soup. Absence of the domain doc, or Domain
+with no status union/enum, stays silent. The hint does not fail the check.
+Do **not** invent `/ark-states`. Do not walk the tree to invent a roster.
+
 ## When / not when
 
 | Use `/ark-adopt` when… | Do **not** use it when… |
@@ -151,7 +213,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or promoting modes is **this skill** (session 0) or **`/ark-autopilot`** later; never invent `mechanical-safe`.
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Absence of `arkRun` is **valid**. Write it only when the user wants the extra. Skills never enforce.
 7. Absence of `arkOrder` is **valid**. Write it only when the user wants the extra. After the extra is honest: handoff **`/ark-order`** to wire one candidate. Skills never enforce.
 
@@ -159,6 +221,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 ### Adopt + ArkRules
 - After classify: emit or refresh `arkRules` for matched layers (exact names; generic mold for unknowns).
 - Mine rules → inventory + write advisory invariants/structure into `arkrules/<Layer>.json` **in this turn**.
+- Empty `invariants[]` on a populated Domain while `arkRules` is on is residual (`INVARIANT_CATALOG_EMPTY`), not done. Fill 1–2 short phrases. Advisory until a domain structure rule is `enforced`.
 - Application / Features templates include advisory `writes-via-aggregate`: driver import + write token in a use case is the skip. Do not copy `Externals/` / `admission.ts` folder religion.
 - Freeze baseline is **[Layer]** debt; inventory residual is **[ArkRules]** — report both.
 
@@ -222,6 +285,9 @@ feature dirs, plan clusters), you **may** dispatch **subagents**:
 - **Brownfield:** this skill — match config to reality; do not force a starter preset.
 - **Deep map only:** `/ark-explore`.
 - **Default path:** `ark start` → **`/ark-adopt`** → `/ark-place` / `/ark-autopilot`.
+  `start --apply` may refuse (coverage below 50% or weak shape) — that lock is
+  deliberate. Lock the shape with `--archetype`, `--preset`, or `--force`, or
+  inspect ranked shapes with `ark-check --recommend`.
 
 ## Anti-wrapper rule (mandatory)
 
@@ -248,6 +314,9 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
    If `src/contexts` or `src/bounded-contexts` exists, prefer `ddd-bounded-contexts`.
    **Next.js:** `app/api/**` / `pages/api/**` (and route-group `app/(…)/api/**`) default to
    **ApplicationOrchestration**, not Presentation — do not reclassify API shells as UI.
+   Write Next-flavored `layers[].description` only when Next is actually present
+   (`next` dependency, `next.config.*`, or `app/page` / `pages/*` routes). Library and
+   package monorepos keep framework-free captions — `ark start` already does this.
    User wants the ArkRun extra → write **advisory** `arkRun` (schema `1.2+`, real
    `kernelRoots` preferred — `compositionRoots` alias, existing `managedLayers`) **in this turn**.
    User wants the ArkOrder extra → write **advisory** `arkOrder` (schema `1.3+`, real
@@ -255,6 +324,12 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
    to a compact starter. Do not promote to enforced as the session-0 default.
    When the product map or glossary names a house, write `layers[].description` on that
    layer (app-context sentence). Compact starter may omit. Do not invent captions.
+   When the product map names who a folder is for, write `layers[].trustBoundary`
+   (`public` | `auth` | `admin` | `internal`). Do not invent tags.
+   When the product map names who owns a folder, write `layers[].owners`
+   (GitHub handle or email). Do not invent people. Write `requireLayerOwners`
+   only when the user asked for required owners and the live houses already
+   have names.
 2. **Check + diagnose** — `summary.concentrated` / dominant edge → fix contract first, don’t freeze.
    Cross-slice / cross-context `peerIsolation` hits are judgment: extract shared or events.
    The denial names its reason. `unclassifiable path` in bulk means shared code lives outside
@@ -268,6 +343,8 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
 3. **Classify ungoverned** — use coverage `suggestions` **plus** dirs you discovered by reading;
    add layers/patterns **here** (write `ark.config.json`). When adding a layer the product map
    or glossary already names, write `layers[].description` on it (do not invent filler).
+   Write `layers[].trustBoundary` only when the product map already names that door.
+   Write `layers[].owners` only when the product map already names who owns the house.
 4. **Mine business rules → manifiesto** (model job — this is why the skill exists):
    - Scan for loose domain: validators, pricing/policy functions, `can*`/`calculate*`, magic business constants, publish/intent strings, logic in UI/hooks that belongs in Domain.
    - **ArkRules inventory (AR13):** run `ark-check --rules-inventory --json` for deterministic candidates
@@ -307,6 +384,10 @@ proposals applied or deferred, **phase**, **top Shape / design-weak opportunitie
 - Claim in-memory kernel stores are production durability.
 - Invent `/ark-run`. Use `/ark-order` after this door turns the extra on.
 - Invent `layers[].description` filler or a `/ark-describe` skill.
+- Invent `layers[].trustBoundary` tags or a `/ark-trust` skill.
+- Invent `layers[].owners` names or a `/ark-owners` skill.
+- Invent `/ark-adr` or require a decision note on every change.
+- Invent `/ark-states` or invent entity states / flag soup.
 - Claim Enforce while governed% is low, cores empty with I/O in Application, or core bags ungoverned.
 - End adopt with only “baseline written” when design-weak residual is visible in files you opened.
 

package/templates/agent-skills/ark-autopilot/SKILL.md

@@ -16,6 +16,8 @@ imports, one small change at a time. Skills never enforce — CLI / hooks / CI d
 
 1. Read `arkgate-check --doctor` (do #1).
 2. Fix import-rule debt; if leftover design remains, apply **one** small refactor.
+   When doctor JSON has `noDomainFrontend`, that refactor is one pure rule into
+   Domain — not another UI helper. Soft. Silent when Domain already has files.
 3. Re-run doctor. Never weaken `ark.config.json`.
 
 **This is the apply door.** Invoking it **is** the approval. Run `arkgate-check --doctor` for the next step.
@@ -32,7 +34,9 @@ Apply plan A (`mechanical-safe` **and** judgment). If leftover design work remai
 Composes **explore → sensors → dual plan → write**. Validate with ark-check; never weaken the gate.
 **Team lock:** do not edit `ark.config.json`, `arkrules/*`, or `.ark-baseline.json` in this
 turn unless the user invoked a steward contract session. Feature diffs use
-`ark-check --changed --base <merge-ref>`. Growing the baseline is steward-only.
+`ark-check --local --base <merge-ref>` or `ark-check --changed --base <merge-ref>`.
+`--local` is the optional cheap path for many worktrees; it cannot combine with
+`--strict-merge`. Growing the baseline is steward-only.
 
 **Not a plan grinder.** Empty `--plan` does **not** mean “architecture is healthy” without
 the explore pass and dual-plan section B (pattern / Shape bets).
@@ -131,7 +135,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or promoting modes and fixing structure sensors is **this skill** (judgment, never invent `mechanical-safe`).
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Absence of extras is **valid**. Extra skip clusters grind **here** after the extra is on. Evaluate one bus → `/ark-runtime`; evaluate one order-plane candidate → `/ark-order`. Do not invent `/ark-run`. Skills never enforce.
 
 

package/templates/agent-skills/ark-coverage/SKILL.md

@@ -95,7 +95,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or promoting modes is **`/ark-adopt`**; fixing code under a structure sensor is **`/ark-autopilot`** (judgment, never invent mechanical-safe).
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 5b. Invariant coverage is a **text match, never an execution**: a file walk plus the invariant id in a `describe`/`it` title. Never report `INVARIANT_UNCOVERED: 0` as “the tests pass” or “the tests run” — ArkGate does not run tests and reads no runner config. When the project declares `coverage.coverageRoots`, a covering test found outside them raises the advisory `INVARIANT_COVERAGE_OUTSIDE_ROOTS`; without that declaration ArkGate makes no claim about where tests run.
 6. Extras silent when off. Doctor `arkRun` / `arkOrder` is `notAScore`. Do not force extras. Wire one kernel candidate via `/ark-runtime`; one order-plane candidate via `/ark-order`. Do not invent `/ark-run`.
 

package/templates/agent-skills/ark-explain/SKILL.md

@@ -79,7 +79,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or applying structure fixes is **`/ark-adopt`** / **`/ark-autopilot`** (never invent `mechanical-safe`).
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Extras silent when off. Doctor `arkRun` / `arkOrder` is `notAScore`. Do not force extras. Wire one kernel candidate via `/ark-runtime`; one order-plane candidate via `/ark-order`. Do not invent `/ark-run`.
 
 
@@ -87,7 +87,9 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 - HTML/plain tour: section **Layers** and section **Rules under contract (ArkRules)** —
   when `arkRules` is active the showcase lists **per-layer counts**, **structure sensors**
   (id / sensor / mode), **uncovered** invariants (call them out), and a **covered sample**.
-  Inactive map stays a short opt-in note. Counts are never a score.
+  Compact doctor names ArkRules only when the map is on; absence stays silent.
+  Empty `invariants[]` on a populated Domain is residual (`INVARIANT_CATALOG_EMPTY`), not “all covered”.
+  Inactive HTML map stays a short opt-in note. Counts are never a score.
 - Spoken tour: name 2–4 real invariant IDs and one structure sensor from this repo’s
   `arkrules/*` (open the files — do not invent). Residual candidates → `--rules-inventory`.
 - **Teach the product model (required when arkRules is active):**

package/templates/agent-skills/ark-explore/SKILL.md

@@ -22,6 +22,18 @@ one bounded decision needs 2–3 enforceable options.
 ## Checklist
 
 - Doctor #1: if ENFORCE + empty plan A and gates are already installed → **Shape** (`/ark-explore` then `/ark-autopilot`). Do not say install-agent-gates.
+- When `--require-gates` / adopted-strict is on and doctor JSON has `adrPresence`,
+  the next step is a short note under `docs/adr/` (or `docs/decisions/`). Soft.
+  Not every change. Off when require-gates is off. No `/ark-adr`.
+- When doctor JSON has `statesTransitions` or `statusTransitionCatalog`, the
+  next step is a short states → transitions table (or one link) on the domain
+  doc already in play. Use catalog names when present. Soft. Silent when that
+  doc is absent or Domain has no status vocabulary. No `/ark-states`. Do not
+  invent states.
+- When doctor JSON has `noDomainFrontend`, Domain is empty and the UI holds the
+  rules. Next: one Domain file (`/ark-place`) then one small refactor
+  (`/ark-autopilot`). Soft. Silent when there is no frontend or Domain already
+  has files. No `/ark-domain`. Do not invent a Domain house.
 - Distinguish **missing** skills vs **stale** catalog. Installed ≠ stale.
 - Hook green is not tree green (scripted edits bypass PreToolUse).
 - Bug / false green / false red / missing doc / improvable behavior **in ArkGate itself** → draft one upstream GitHub issue (`pedroknigge/arkgate` or the installed package `repository.url`), **ask the human to confirm send**, then `gh issue create`. Never auto-file. Never file ArkGate defects on the consumer product repo.
@@ -179,13 +191,14 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or applying structure fixes is **`/ark-adopt`** / **`/ark-autopilot`** — explore does not write (never invent `mechanical-safe`).
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Never write `arkRun` or `arkOrder` from this skill. When extras are present, label residual **`[ArkRun]`** / **`[ArkOrder]`**. Wire one kernel candidate via `/ark-runtime`; one order-plane candidate via `/ark-order`. Do not invent `/ark-run`.
 
 
 ### Explore + ArkRules
 - Always run sensors for **both** planes when present: coverage/doctor **and** `--rules-inventory` if `arkRules` exists or brownfield may hide spaghetti rules.
 - Ranked table kinds may include `arkrules-opportunity` and `invariant-gap`.
+- Empty `invariants[]` on a populated Domain while `arkRules` is on is residual (`INVARIANT_CATALOG_EMPTY`), not done. Point at `arkrules/<Domain>.json`.
 - Dual-plan **B** may include: place advisory structure rules, extract one inventory candidate to Domain + `arkrules` entry, promote one covered invariant.
 - Field path: note whether starters emit `arkrules/*`.
 

package/templates/agent-skills/ark-place/SKILL.md

@@ -22,9 +22,21 @@ right house. Skills never enforce — CLI / hooks / CI do.
 
 - `filePath` is known before the call. Description alone is not a path.
 - Golden pattern is load-bearing when present. Adopt generates it.
+- An included file that matches no layer is not a pass. The write gate denies it
+  (`CONFIG_UNCLASSIFIED_FILES`). Place it in a layer folder, or send include/layer
+  drift to `/ark-adopt`. Do not write into a loose include gap.
 - Do not default a repository to Presentation.
+- When doctor JSON has `noDomainFrontend`, the new file is a Domain rule — not
+  another UI helper. Soft. Silent when Domain already has files or there is no
+  frontend. No `/ark-domain`.
 - When the matched layer has `layers[].description`, print that caption next to the
   layer name and globs. Omit when absent — do not invent a caption or `/ark-describe`.
+- When the matched layer has `layers[].trustBoundary`, print `trust: <tag>` next
+  to the layer name and globs. Omit when absent — do not invent a tag or `/ark-trust`.
+- When the matched layer has `layers[].owners`, print `owner: @handle` next
+  to the layer name and globs. Omit when absent — do not invent a person or `/ark-owners`.
+  When `requireLayerOwners` is on and the house has no owners, send that gap to
+  `/ark-adopt` before writing.
 - When `arkRun` is on: scaffold through the kernel (no `new` of managed types; declare
   `uses` / `reactsTo` / `raises` / `sends`; factory only in `arkRun.kernelRoots`,
   `compositionRoots` alias). Extra off → do not introduce the kernel. Enable it
@@ -69,6 +81,21 @@ When `ark_place` / the contract includes `layers[].description`, print that capt
 next to the layer name and globs. Omit it when the field is absent. Do **not** invent
 a caption or `/ark-describe`.
 
+## Layer trust (process)
+
+When the matched layer has `layers[].trustBoundary` (`public` | `auth` |
+`admin` | `internal`), print `trust: <tag>` next to the layer name and globs.
+Omit it when the field is absent. Do **not** invent a tag or `/ark-trust`.
+The tag is guidance, not an import-rule deny.
+
+## Layer owners (process)
+
+When the matched layer has `layers[].owners`, print `owner: @handle` (or
+`owner: name@host`) next to the layer name and globs. Omit when absent.
+Do **not** invent a person or `/ark-owners`. When `requireLayerOwners` is
+on and this house has no owners, do not write — hand off `/ark-adopt` to
+name who owns the folder.
+
 ## Deep modules (process)
 
 - Place so new code stays **deep**: one small public surface per concern; hide implementation details.
@@ -92,7 +119,9 @@ and — if they asked to build it — scaffold it there correctly.
 **No artifact given?** If the skill is invoked with nothing to place, don't error
 and don't guess — the artifact is the one thing only the user knows. Read the
 contract (step 1) and print the placement map from it: one row per declared layer
-with layer name, globs, and `layers[].description` when present (omit when absent),
+with layer name, globs, `layers[].description` when present,
+`layers[].trustBoundary` when present, and `layers[].owners` when present
+(omit any when absent),
 what belongs there, its directory, and which layers it may/may not import,
 plus the not-yet-adopted `suggestedLayers` as a footnote. Then ask what they want
 to place. That map is derived entirely from the repo, so producing it is real work,
@@ -134,7 +163,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Missing layer home: add it via **`/ark-adopt`** in this session if needed, then write the file; never invent `mechanical-safe`.
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Absence of `arkRun` is **valid**. Do not introduce the kernel speculatively. Skills never enforce this extra.
 7. Absence of `arkOrder` is **valid**. When on: Domain stays plane-free; first freeze ξ with `release()`; later ξ is `proposeRelease` then `apply`; never `update`/`patch`/`set` the pattern. Import `createOrderPlane` from `arkgate/order` (same npm package). Evaluate / wire one candidate via **`/ark-order`**.
 
@@ -180,7 +209,11 @@ the same files or weaken the gate.
    its forbidden globals, and exactly which layers the file may / must not import,
    straight from the contract (no guessing). When the matched layer has
    `layers[].description`, print that caption next to the layer name and globs;
-   omit it when absent. When present, also honor optional
+   omit it when absent. When the matched layer has `layers[].trustBoundary`,
+   print `trust: <tag>` next to the layer name and globs; omit it when absent.
+   When the matched layer has `layers[].owners`, print `owner: @handle`; omit
+   when absent.
+   When present, also honor optional
    **`goldenPattern`** (from `.ark/golden-pattern.json`) for **NEW code only** —
    advisory layout norm; never overrides the gate and never clears design-weak.
    Absent golden is normal. Otherwise load `ark.config.json`; after the matched preflight,
@@ -215,6 +248,8 @@ the same files or weaken the gate.
    `patterns`), intent-name prefix if the layer declares `intentPrefixes`, and
    which layers it may/may not import (from `rules`). When present, print
    `layers[].description` next to the layer name and globs; omit when absent.
+   Print `layers[].trustBoundary` as `trust: <tag>` when present; omit when absent.
+   Print `layers[].owners` as `owner: @handle` when present; omit when absent.
 4. **If the layer isn't adopted yet** (suggested but no directory): write the
    layer into `ark.config.json` (session-0 honesty — same as `/ark-adopt` for
    that glob) **then** write the file. Don't silently drop the code into a

package/templates/agent-skills/ark-runtime/SKILL.md

@@ -34,8 +34,10 @@ grind (`/ark-autopilot`); wire the order plane (`/ark-order`).
 | **ArkRun extra** (`arkRun` on `ark.config.json`, schema `1.2+`) | Gate contract: kernel usage + complete declarations | A score; Layers / ArkRules replacement; merge teeth while `advisory` |
 | **Kernel** `arkgate/runtime` | Kernel you construct with `createStrictArkKernel` (one instance per call) | A process-wide `getKernel()`; shipped cloud broker SDKs; production durability |
 
-Absence of the extra is **silent** — Layers and ArkRules verdicts stay identical. Doctor / status
-`arkRun` is always `notAScore`. Never invent 0–10 scores or pass/fail from this skill.
+Absence of the extra is **silent** — Layers and ArkRules verdicts stay identical. Compact
+doctor names ArkRun only when the extra is on (experimental, in-memory, not Postgres;
+`/ark-runtime` when residual remains). Doctor / status `arkRun` is always `notAScore`.
+Never invent 0–10 scores or pass/fail from this skill.
 
 ## Improvement compass note
 

package/templates/agent-skills/ark-upgrade/SKILL.md

@@ -143,7 +143,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. After upgrade, leftover architecture work is **`/ark-autopilot`** (never invent `mechanical-safe`).
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Schema `1.3` extras stay off unless already on. Pin teaches `arkgate/runtime` and `arkgate/order` (same tarball), not a second install. Wire after upgrade via `/ark-runtime` / `/ark-order`. Do not invent `/ark-run`.
 
 

package/templates/arkrules/DomainModel.json

@@ -28,5 +28,18 @@
       "description": "Prefer rich domain types over data-only bags (advisory only)."
     }
   ],
-  "invariants": []
+  "invariants": [
+    {
+      "id": "INV-ALWAYS-VALID",
+      "description": "A domain object is never stored in an invalid state",
+      "mode": "advisory",
+      "coverage": { "test": false }
+    },
+    {
+      "id": "INV-ONE-DECISION",
+      "description": "Each business fact has one place that decides it",
+      "mode": "advisory",
+      "coverage": { "test": false }
+    }
+  ]
 }

package/templates/skills/ark-adopt.md

@@ -21,11 +21,33 @@ has honest houses. Skills never enforce — CLI / hooks / CI do.
 ## Checklist
 
 - Existing tree: propose **SharedKernel** (types/constants) + **CompositionRoot** (wiring) + `src/**/domain/**`. Never dump bare `src/lib/**` into Application.
+- Every `include` path must land in a layer. Include that classifies no file is the
+  same as an empty check — not a pass. Fix globs here; do not leave a loose gap.
 - Generate `.ark/golden-pattern.json` (load-bearing for `/ark-place`).
 - Future houses: mark unused layer globs `reserved` / `allowEmpty` so `--strict-config` does not fail.
 - When the product map or glossary names a house, write `layers[].description` as
   app-context copy (what this folder is *in the product*). Compact starter may omit.
   Do not invent captions. Do not invent `/ark-describe`.
+- When the product map names who a folder is for, write `layers[].trustBoundary`
+  (`public` | `auth` | `admin` | `internal`). Compact starter may omit. Do not
+  invent tags. Absence is silent. No `/ark-trust`.
+- When the product map names who owns a folder, write `layers[].owners`
+  (GitHub handle or email). Compact starter may omit. Do not invent people.
+  Absence is silent unless the user asked for required owners — then write
+  `requireLayerOwners: true` after the live houses have names. No `/ark-owners`.
+- When the user wants required gates (`--require-gates` / `--strict-merge` /
+  required GitHub check) and there is no `docs/adr/` (or `docs/decisions/`),
+  leave a short decision note there — only if they loosen a rule or add a real
+  gate. Not every change. Doctor residual is soft. No `/ark-adr`.
+- When a product-domain doc is already in play (`docs/domain.md` or a sibling)
+  and doctor JSON has `statesTransitions` or `statusTransitionCatalog`, add a
+  short states → transitions table (or one link) there. Use catalog names when
+  present. No flag soup. Soft residual. Silent when that doc is absent or
+  Domain has no status vocabulary. No `/ark-states`.
+- When doctor JSON has `noDomainFrontend`, keep the empty Domain house — do not
+  delete it to “clean” empty layers. Next is one Domain file (`/ark-place`), not
+  a weaker contract. Soft. Silent when there is no frontend or Domain already
+  has files. No `/ark-domain`.
 - CLI-first: if `arkgate-check` already resolved the root, do not wait on MCP.
 - Do not add `arkRun` or `arkOrder` unless the user wants that extra. When they do, write
   **advisory** extra in this turn (`arkRun` schema `1.2+`; `arkOrder` schema `1.3+`).
@@ -106,6 +128,46 @@ received."), not architecture jargon. Compact starter / `ark start` may omit the
 field. Absence is silent — never fail `--strict-config` for a missing caption.
 Do **not** invent captions. Do not invent `/ark-describe`.
 
+## Layer trust (process)
+
+Optional `layers[].trustBoundary`: `public` | `auth` | `admin` | `internal`.
+Marks who this folder is for (anyone, signed-in users, operators, or only
+other code). Write it when the product map already names that door. Compact
+starter / `ark start` may omit it. Absence is silent — never fail
+`--strict-config`, never invent a doctor residual. Do **not** invent tags.
+This is not host/CI TLS and does not add import-rule teeth. No `/ark-trust`.
+
+## Layer owners (process)
+
+Optional `layers[].owners`: GitHub handles or emails (same identity as
+`stewards` — not a display name). Write them when the product map already
+names who owns the house. Compact starter / `ark start` may omit. Absence is
+silent unless the user asked for required owners. Then write
+`requireLayerOwners: true` only after every live (non-reserved) layer has
+at least one owner. Do **not** invent people. No `/ark-owners`. The require
+flag is the fail-closed switch; owners themselves are metadata.
+
+## Decision notes (process)
+
+When gates are required (`--require-gates` / `--strict-merge` / required merge
+status) and there is no short decision-note home yet, doctor may ask for one
+under `docs/adr/` or `docs/decisions/`. Write a note when you loosen a rule or
+add a real gate — not on every file. Absence is silent unless that demand is
+on. The hint does not fail the check. Do **not** invent `/ark-adr`. Policy
+weaken still uses `--policy-ack`; this is only a place to write the why.
+
+## States and transitions (process)
+
+When a product-domain / domain-model doc is already on disk (`docs/domain.md`,
+`docs/data-model.md`, or a dedicated `docs/states.md`) and there is no short
+states → transitions table (or one link), doctor may ask for one. Write the
+table on that home — entity · states · allowed from → to. Names from the
+code or the captain. When doctor JSON has `statusTransitionCatalog`, use those
+entity · states names — Domain already opted in by having that vocabulary.
+Do **not** invent states or flag soup. Absence of the domain doc, or Domain
+with no status union/enum, stays silent. The hint does not fail the check.
+Do **not** invent `/ark-states`. Do not walk the tree to invent a roster.
+
 ## When / not when
 
 | Use `/ark-adopt` when… | Do **not** use it when… |
@@ -151,7 +213,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or promoting modes is **this skill** (session 0) or **`/ark-autopilot`** later; never invent `mechanical-safe`.
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Absence of `arkRun` is **valid**. Write it only when the user wants the extra. Skills never enforce.
 7. Absence of `arkOrder` is **valid**. Write it only when the user wants the extra. After the extra is honest: handoff **`/ark-order`** to wire one candidate. Skills never enforce.
 
@@ -159,6 +221,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 ### Adopt + ArkRules
 - After classify: emit or refresh `arkRules` for matched layers (exact names; generic mold for unknowns).
 - Mine rules → inventory + write advisory invariants/structure into `arkrules/<Layer>.json` **in this turn**.
+- Empty `invariants[]` on a populated Domain while `arkRules` is on is residual (`INVARIANT_CATALOG_EMPTY`), not done. Fill 1–2 short phrases. Advisory until a domain structure rule is `enforced`.
 - Application / Features templates include advisory `writes-via-aggregate`: driver import + write token in a use case is the skip. Do not copy `Externals/` / `admission.ts` folder religion.
 - Freeze baseline is **[Layer]** debt; inventory residual is **[ArkRules]** — report both.
 
@@ -222,6 +285,9 @@ feature dirs, plan clusters), you **may** dispatch **subagents**:
 - **Brownfield:** this skill — match config to reality; do not force a starter preset.
 - **Deep map only:** `/ark-explore`.
 - **Default path:** `ark start` → **`/ark-adopt`** → `/ark-place` / `/ark-autopilot`.
+  `start --apply` may refuse (coverage below 50% or weak shape) — that lock is
+  deliberate. Lock the shape with `--archetype`, `--preset`, or `--force`, or
+  inspect ranked shapes with `ark-check --recommend`.
 
 ## Anti-wrapper rule (mandatory)
 
@@ -248,6 +314,9 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
    If `src/contexts` or `src/bounded-contexts` exists, prefer `ddd-bounded-contexts`.
    **Next.js:** `app/api/**` / `pages/api/**` (and route-group `app/(…)/api/**`) default to
    **ApplicationOrchestration**, not Presentation — do not reclassify API shells as UI.
+   Write Next-flavored `layers[].description` only when Next is actually present
+   (`next` dependency, `next.config.*`, or `app/page` / `pages/*` routes). Library and
+   package monorepos keep framework-free captions — `ark start` already does this.
    User wants the ArkRun extra → write **advisory** `arkRun` (schema `1.2+`, real
    `kernelRoots` preferred — `compositionRoots` alias, existing `managedLayers`) **in this turn**.
    User wants the ArkOrder extra → write **advisory** `arkOrder` (schema `1.3+`, real
@@ -255,6 +324,12 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
    to a compact starter. Do not promote to enforced as the session-0 default.
    When the product map or glossary names a house, write `layers[].description` on that
    layer (app-context sentence). Compact starter may omit. Do not invent captions.
+   When the product map names who a folder is for, write `layers[].trustBoundary`
+   (`public` | `auth` | `admin` | `internal`). Do not invent tags.
+   When the product map names who owns a folder, write `layers[].owners`
+   (GitHub handle or email). Do not invent people. Write `requireLayerOwners`
+   only when the user asked for required owners and the live houses already
+   have names.
 2. **Check + diagnose** — `summary.concentrated` / dominant edge → fix contract first, don’t freeze.
    Cross-slice / cross-context `peerIsolation` hits are judgment: extract shared or events.
    The denial names its reason. `unclassifiable path` in bulk means shared code lives outside
@@ -268,6 +343,8 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
 3. **Classify ungoverned** — use coverage `suggestions` **plus** dirs you discovered by reading;
    add layers/patterns **here** (write `ark.config.json`). When adding a layer the product map
    or glossary already names, write `layers[].description` on it (do not invent filler).
+   Write `layers[].trustBoundary` only when the product map already names that door.
+   Write `layers[].owners` only when the product map already names who owns the house.
 4. **Mine business rules → manifiesto** (model job — this is why the skill exists):
    - Scan for loose domain: validators, pricing/policy functions, `can*`/`calculate*`, magic business constants, publish/intent strings, logic in UI/hooks that belongs in Domain.
    - **ArkRules inventory (AR13):** run `ark-check --rules-inventory --json` for deterministic candidates
@@ -307,6 +384,10 @@ proposals applied or deferred, **phase**, **top Shape / design-weak opportunitie
 - Claim in-memory kernel stores are production durability.
 - Invent `/ark-run`. Use `/ark-order` after this door turns the extra on.
 - Invent `layers[].description` filler or a `/ark-describe` skill.
+- Invent `layers[].trustBoundary` tags or a `/ark-trust` skill.
+- Invent `layers[].owners` names or a `/ark-owners` skill.
+- Invent `/ark-adr` or require a decision note on every change.
+- Invent `/ark-states` or invent entity states / flag soup.
 - Claim Enforce while governed% is low, cores empty with I/O in Application, or core bags ungoverned.
 - End adopt with only “baseline written” when design-weak residual is visible in files you opened.
 

package/templates/skills/ark-autopilot.md

@@ -16,6 +16,8 @@ imports, one small change at a time. Skills never enforce — CLI / hooks / CI d
 
 1. Read `arkgate-check --doctor` (do #1).
 2. Fix import-rule debt; if leftover design remains, apply **one** small refactor.
+   When doctor JSON has `noDomainFrontend`, that refactor is one pure rule into
+   Domain — not another UI helper. Soft. Silent when Domain already has files.
 3. Re-run doctor. Never weaken `ark.config.json`.
 
 **This is the apply door.** Invoking it **is** the approval. Run `arkgate-check --doctor` for the next step.
@@ -32,7 +34,9 @@ Apply plan A (`mechanical-safe` **and** judgment). If leftover design work remai
 Composes **explore → sensors → dual plan → write**. Validate with ark-check; never weaken the gate.
 **Team lock:** do not edit `ark.config.json`, `arkrules/*`, or `.ark-baseline.json` in this
 turn unless the user invoked a steward contract session. Feature diffs use
-`ark-check --changed --base <merge-ref>`. Growing the baseline is steward-only.
+`ark-check --local --base <merge-ref>` or `ark-check --changed --base <merge-ref>`.
+`--local` is the optional cheap path for many worktrees; it cannot combine with
+`--strict-merge`. Growing the baseline is steward-only.
 
 **Not a plan grinder.** Empty `--plan` does **not** mean “architecture is healthy” without
 the explore pass and dual-plan section B (pattern / Shape bets).
@@ -131,7 +135,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or promoting modes and fixing structure sensors is **this skill** (judgment, never invent `mechanical-safe`).
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Absence of extras is **valid**. Extra skip clusters grind **here** after the extra is on. Evaluate one bus → `/ark-runtime`; evaluate one order-plane candidate → `/ark-order`. Do not invent `/ark-run`. Skills never enforce.
 
 

package/templates/skills/ark-coverage.md

@@ -95,7 +95,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or promoting modes is **`/ark-adopt`**; fixing code under a structure sensor is **`/ark-autopilot`** (judgment, never invent mechanical-safe).
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 5b. Invariant coverage is a **text match, never an execution**: a file walk plus the invariant id in a `describe`/`it` title. Never report `INVARIANT_UNCOVERED: 0` as “the tests pass” or “the tests run” — ArkGate does not run tests and reads no runner config. When the project declares `coverage.coverageRoots`, a covering test found outside them raises the advisory `INVARIANT_COVERAGE_OUTSIDE_ROOTS`; without that declaration ArkGate makes no claim about where tests run.
 6. Extras silent when off. Doctor `arkRun` / `arkOrder` is `notAScore`. Do not force extras. Wire one kernel candidate via `/ark-runtime`; one order-plane candidate via `/ark-order`. Do not invent `/ark-run`.
 

package/templates/skills/ark-explain.md

@@ -79,7 +79,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 2. Never call an import-edge violation an “invariant” or an aggregate sensor a “layer deny.”
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or applying structure fixes is **`/ark-adopt`** / **`/ark-autopilot`** (never invent `mechanical-safe`).
-5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 6. Extras silent when off. Doctor `arkRun` / `arkOrder` is `notAScore`. Do not force extras. Wire one kernel candidate via `/ark-runtime`; one order-plane candidate via `/ark-order`. Do not invent `/ark-run`.
 
 
@@ -87,7 +87,9 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 - HTML/plain tour: section **Layers** and section **Rules under contract (ArkRules)** —
   when `arkRules` is active the showcase lists **per-layer counts**, **structure sensors**
   (id / sensor / mode), **uncovered** invariants (call them out), and a **covered sample**.
-  Inactive map stays a short opt-in note. Counts are never a score.
+  Compact doctor names ArkRules only when the map is on; absence stays silent.
+  Empty `invariants[]` on a populated Domain is residual (`INVARIANT_CATALOG_EMPTY`), not “all covered”.
+  Inactive HTML map stays a short opt-in note. Counts are never a score.
 - Spoken tour: name 2–4 real invariant IDs and one structure sensor from this repo’s
   `arkrules/*` (open the files — do not invent). Residual candidates → `--rules-inventory`.
 - **Teach the product model (required when arkRules is active):**