arkgate 4.8.2 → 4.8.4

package/docs/package-surface.md

@@ -3,7 +3,8 @@
 **Write. Check. Ship.**
 **When the agent writes a bad import, the write doesn’t land. The same check fails the pull request.**
 That is the product wedge (host hook + required CI). Skills name the next step after that.
-**Not the wedge:** the optional in-process **ArkRun** runtime (`arkgate/runtime`).
+**Not the wedge:** the optional in-process **ArkRun** runtime (`arkgate/runtime`) and the
+optional **ArkOrder** pattern extra (`arkgate/order`).
 
 The check that must agree everywhere is small ([ADR 0026](adr/0026-gate-waist-facts-in-verdict-out.md)):
 `ark.config.json` + resolved-candidate-facts → one analysis-result (`valid`).
@@ -34,7 +35,7 @@ hardening guide remains repository-hosted rather than duplicated in the gate tar
 | **Field upgrade truth (4.5.6)** | `ark upgrade` registry-aware install; JSON `reasonCode` / `suggestedInstallCmd`; `skillDrift`; `--refresh-skills`; `postUpgradeChecks`; `hostSelection`. | No false-skip when registry ahead; offline honesty; customized skills preserved unless opt-in refresh; checks are advisory only. |
 | **MCP process package honesty (4.5.6; fail-closed in 4.6.4)** | Every MCP tool context → `processPackage` (`processPackageMismatch` / `processStale`, versions, `nextAction`). | Multi-checkout users: restart MCP after pin bump. From 4.6.4, stale process context is non-authoritative; `ark_identity` remains diagnostic and project tools return `PROCESS_PACKAGE_STALE` until restart/retarget. Prefer project-local CLI until identity matched and versions align. |
 | **Doctor design fitness** | `ark-check --doctor --json` → `doctor.designFitness`, `doctor.designSmells[]` | Additive. Stable smell `id`s: `io-under-application`, `handler-in-persistence`, `god-module`, `domain-logic-in-ui`, `facade-sql-in-routes`, `mixed-pattern-cluster`, `soft-contract`. `handler-in-persistence` covers static ES imports/re-exports of framework HTTP surfaces (`next/server`), `defineRoute` calls, and existing handler bodies inside Persistence-role layers or specific persistence paths; `require()` and dynamic `import()` are outside this narrow advisory, and a generic `Infrastructure` role alone is not Persistence. Persistence candidates are filtered and sorted before the bounded content scan so large application prefixes cannot hide the advisory. The detector inspects the first 800 sorted Persistence candidates; later candidates are uninspected, so **absence of a smell is not full-tree proof** above that envelope (incomplete/`partial` analysis also never proves “no smells”). **4.2 feedback hardening:** mode labels preserve the observed SUGGEST/ADAPT/ENFORCE state; a local permission/UI-state `canEdit` name alone is not a domain smell; real UI business rules route Domain → Application → UI; seed/fixture/demo/migration/generated files are not god-module pilots. Each smell has `evidence[]`, `fix`, technical `message`, and plain-language **`outcome`**. Does **not** fail the gate by itself. |
-| **Post-green Shape door** | `doctor.postGreenPath`, `doctor.primaryNextAction`, `doctor.healthyFinishedForbidden` | Additive when `designFitness.designWeak`. Single Shape door (`id: clarify-for-ai`): explore shape-focus → dual-plan B → autopilot only with OK. Never empty plan A = healthy finished. |
+| **Post-green Shape door** | `doctor.postGreenPath`, `doctor.primaryNextAction`, `doctor.healthyFinishedForbidden` | Additive when `designFitness.designWeak`. Single Shape door (`id: clarify-for-ai`): explore shape-focus → dual-plan B → autopilot only with OK. Never empty plan A = healthy finished. A **passing** `ark-check` human run also prints one dim line naming `--plan`, the smell count and the smell ids. Its weakness test is `isDesignWeak` over the **blocking** violation count — the same input doctor uses, so the two surfaces cannot disagree about `designWeak`, and non-blocking type-only placement debt still gets the line. Report only: never a warning, never an exit-code change, silent when no smell remains, silent on `--changed` (a partial scan would report a slice as the tree) and on `--watch`. A baselined run is not called clean: the opening clause names the suppressed count instead. `--json` is unchanged. |
 | **Golden pattern (new code)** | Optional `.ark/golden-pattern.json`; doctor JSON `doctor.goldenPattern`; MCP `ark_place` / `ark_prepare_write` → `goldenPattern` | Additive, **advisory for NEW code only**. Required fields: `name`, `norm`; optional `newCodeHome`, `examplePath`, `schemaVersion`. **Absent is normal** (no claim). Never ENFORCE; never clears design-weak. Malformed → `invalid: true`, not silent guidance. |
 | **Plan pattern B (Shape bets)** | `ark-check --plan --json` → `plan.patternBets[]`, `plan.goal.designWeak` | Additive. Each bet: `id`, `smellId`, `pilot`, `evidence`, `successSignal`, `killSwitch`, **`neverMechanicalSafe: true`**, `class: "judgment"`. **Never** auto-applied by loop/autoPatch; not a `remediationKind` mechanical-safe. `goal.met` remains edge honesty only. |
 | **Pilot loop (one at a time)** | `plan.pilotLoop` / `doctor.pilotLoop` | Additive. When design-weak: `active`, `oneAtATime`, `neverMechanicalSafe`, **`nextPilot`** extraction-card fields (`pilotTarget`, `smellId`, `move`, `successSignal`, `killSwitch`, `doNot[]`). **One pilot → re-doctor**; never multi-pilot batch; never mechanical-safe. |
@@ -50,7 +51,7 @@ hardening guide remains repository-hosted rather than duplicated in the gate tar
 | **Report parity and snapshot evidence (4.2)** | `ark-check --report` → advisory sections (`data-advisory="contractHealth\|ambientState\|parseHealth\|arkRun"`, nested `governanceWeight`) + layer wall badges; `.ark/reports/*.json` | The report is a rendering of doctor truth. **Standing rule:** every doctor advisory ships with its report section — enforced by the `reportParity` guard, which enumerates the doctor's advisory keys and fails on any missing section. Snapshots add best-effort Git `HEAD`/branch/dirty provenance without a shell; unavailable Git is explicit. Evolution renders the Ark score delta only when both snapshots name the same ArkGate version, while retaining raw facts across versions. Thin `arkRun` on `latest.json` is `notAScore` residual honesty for `ark status`. |
 | **MCP project identity (4.2)** | `ark_identity`; `arkgate/schema/project-identity` or `arkgate/schema/ark.project-identity.schema.json`; root API constants/helpers/types | Schema `1.0`. `projectId` hashes canonical root + config path and stays stable across contract edits/restarts; runtime id/start time are separate. Every project-bound tool result and error carries `projectIdentity`, `binding` (`matched` / `unverified` / `mismatch`), and `authoritative`. Canonical out-of-root config/file evidence fails before project data. |
 | **MCP tools and compatibility resource** | `arkgate-mcp`; `ark_manifest`; `ark_status`; `ark://manifest` | Tool names and primary argument shapes are stable within a major. Every tool accepts additive `project.expectedRoot` / optional `expectedProjectId`. The initial handshake requires the exact project root; a contained descendant is authoritative only together with the matching project id. Legacy tool calls remain callable but `unverified` and non-authoritative. `ark_manifest` is the authoritative contract surface after binding. **`ark_status`** returns the status manifest envelope (parity with `ark status --json`). Standard `resources/read` cannot portably carry the expectation, so `ark://manifest` remains compatibility-only and always unverified/non-authoritative. The server never retargets from input. |
-| **`ark.config.json`** | Layer globs, rules, include/exclude, forbiddenGlobals, intent prefixes, `peerIsolation`, `dynamicImportAllowlist`, `safety` thresholds; optional **`arkRules`** map (schema `1.1+`); optional **`arkRun`** extra (schema `1.2+`); optional **`arkOrder`** extra (schema `1.3+`) | Versioned by `schemaVersion`; unknown fields fail closed and migrations preserve the previous supported major. Absence of `arkRules`, `arkRun`, or `arkOrder` is byte-for-byte silent on Layers / ArkRules verdicts. Enforced extra teeth share the CLI / MCP / hook / preflight / CI verdict and arm only when the layer plane is classified (same ArkRules floor). |
+| **`ark.config.json`** | Layer globs, rules, include/exclude, forbiddenGlobals, intent prefixes, `peerIsolation`, `dynamicImportAllowlist`, `safety` thresholds; optional **`coverage`** controls (`testGlobs`, `maxFiles`); optional **`arkRules`** map (schema `1.1+`); optional **`arkRun`** extra (schema `1.2+`); optional **`arkOrder`** extra (schema `1.3+`) | Versioned by `schemaVersion`; unknown fields fail closed and migrations preserve the previous supported major. Absence of `coverage`, `arkRules`, `arkRun`, or `arkOrder` is byte-for-byte silent on Layers / ArkRules verdicts. Enforced extra teeth share the CLI / MCP / hook / preflight / CI verdict and arm only when the layer plane is classified (same ArkRules floor). |
 | **ArkRules inventory / under-contract (4.0; layer context 4.2)** | `ark-check --rules-inventory [--json]`; doctor `rulesUnderContract`; MCP `ark_rules_inventory` | Additive. Honest counts (inventoried / under-contract / frozen) — **never a score**. When configured layer evidence exists it overrides filename role guesses: a Domain file named `handler` is not a controller candidate. Test/fixture/seed/migration/exclusion surfaces plus narrow development-identity, PostgreSQL OID, and technical I/O constants are silent. Without layer evidence, backward-compatible path/content heuristics remain. Structure/invariant diagnostics use adapter `1.4` provenance. |
 | **`arkgate/schema/project-identity`** or **`arkgate/schema/ark.project-identity.schema.json`** | MCP canonical project, contract, runtime, expectation, and binding envelope | Schema `1.0`. Initial `expectedRoot` must be the exact project root. A contained descendant can match only when `expectedProjectId` is also present and correct; id-only matching stays non-authoritative. Mismatch codes are `PROJECT_ROOT_MISMATCH`, `PROJECT_ID_MISMATCH`, and `INVALID_PROJECT_EXPECTATION`. |
 | **Package pin dual-truth (4.0)** | doctor JSON `packageVersionTruth`; upgrade JSON/human note when pin behind CLI | Additive, advisory. Surfaces after `upgrade --no-install` when managed CLI is ahead of package.json. |
@@ -189,6 +190,36 @@ import { createOrderPlane } from 'arkgate/order';
 
 One install: `npm install arkgate`. `@arkgate/runtime` is deprecated.
 
+---
+
+## Installing from git
+
+`npm install github:pedroknigge/arkgate` and `pnpm add git+https://github.com/pedroknigge/arkgate`
+are supported for pinning an unreleased commit, and they need **no build-allowlist entry**:
+this package declares no `prepack`, no `prepare`, and no install script. Through 4.8.3 the
+`prepack` hook made a pnpm git install fail closed with
+`ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` — the whole install, not just the build — and the only
+way through was adding `arkgate` to `allowBuilds` for a script that shells out to `npm`.
+The publish path builds explicitly instead (`scripts/release-npm.mjs`, plus `prepublishOnly`
+as a backstop, which pnpm does not run when it prepares a git dependency).
+
+A git install is **not** the same package as the npm tarball, because `dist/` is a build
+output and is not committed:
+
+| From a git install | Works | Why |
+|---|---|---|
+| `arkgate` / `arkgate-check` (and `ark` / `ark-check`) | **yes** | `bin/` and `bin/lib/*.mjs` are committed sources — the deliberate zero-build CLI |
+| `arkgate/schema*` subpath exports | **yes** | `schemas/*.json` are committed |
+| `import … from 'arkgate'`, `arkgate/eslint`, `arkgate/order`, `arkgate/runtime`, `arkgate/nestjs` | **no** | all resolve into `dist/` |
+| `ark-mcp` / `arkgate-mcp` | **no** | loads `dist/index.js`; it says so and names this section |
+
+So: install from git when you want the **CLI or the CI check** at a specific commit, install
+from npm (`npm i arkgate`) when you want the **library, the MCP server, or the ESLint plugin**.
+To get everything from a checkout, clone and run `npm install && npm run build` — that is the
+maintainer path in [develop.md](https://github.com/pedroknigge/arkgate/blob/main/docs/develop.md),
+and the build stays *your* explicit command, never a script your package manager has to be
+allowed to run.
+
 See [production-hardening.md](https://github.com/pedroknigge/arkgate/blob/main/docs/production-hardening.md) for requirements an eventual
 production deployment would need to satisfy; it is not a readiness certification.
 
@@ -218,7 +249,8 @@ production deployment would need to satisfy; it is not a readiness certification
 ## Release notes (maintainers)
 
 Ship notes for a version live under [releases/](https://github.com/pedroknigge/arkgate/tree/main/docs/releases)
-(current published: [4.8.2.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.2.md);
+(current published: [4.8.3.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.3.md);
+prior published: [4.8.2.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.2.md);
 prior published: [4.8.1.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.1.md);
 prior published: [4.8.0.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.0.md);
 prior published: [4.7.6.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.7.6.md);

package/docs/product-voice.md

@@ -21,6 +21,10 @@ The same check fails the pull request.
 **ArkRun** is an optional runtime (`arkgate/runtime`). Experimental. In-memory.
 Not Postgres.
 
+**ArkOrder** is the extra that stops the agent from rewriting the few slow
+product decisions as CRUD (`arkgate/order`). Off unless you turn it on. Same
+npm package. In-memory. Not durable. Does not replace ArkRun.
+
 ```text
 Write.   the agent writes
 Check.   bad imports don’t land — same check on the PR
@@ -31,6 +35,7 @@ Ship.    required GitHub check, then merge
 ArkGate   always     import rules (write + required CI)
 ArkRules  optional   policies inside a layer
 ArkRun    optional   experimental runtime — in-memory, not Postgres
+ArkOrder  optional   the few slow product decisions the agent must not CRUD
 ```
 
 Status first (`arkgate-check --doctor`). One next step. CLI flag `--doctor` stays;
@@ -45,7 +50,7 @@ On README, use, develop, the docs hub, and the product site:
 1. **Verbs:** `Write. Check. Ship.`
 2. **Deny:** `When the agent writes a bad import, the write doesn’t land. The same check fails the pull request.`
 3. **Not-that (below the fold, one line):** `Not an API Gateway. Not a folder linter. If the check is not required on the PR, the config is just documentation.`
-4. **Nouns (once, below the deny):** ArkGate is import rules. ArkRules is optional policies. ArkRun is an optional experimental runtime.
+4. **Nouns (once, below the deny):** ArkGate is import rules. ArkRules is optional policies. ArkRun is an optional experimental runtime. ArkOrder is the extra that stops the agent from rewriting the few slow product decisions (plan, protocol) as CRUD — named when the consumer opts in, never as the first noun.
 
 Do not lead with folders, `ark.config.json`, “contract”, “gate”, “house”, or “doctor”
 as the first noun. Historical: `If the AI writes an illegal import, the write is rejected`
@@ -72,9 +77,10 @@ Three beats when a line teaches:
 | The agent imported Infrastructure from Domain. The write didn’t land. Next: `/ark-place`. | Ship it 🚀 crush the spaghetti |
 | Import rules pass. The tree still needs a refactor. Next: one small change. | You don’t need to understand anything |
 | ArkRun is experimental. In-memory. Data is gone on restart. | The kernel is production-ready |
+| The agent PATCHed the billing plan as if it were a seat count. The write didn’t land. Next: a new release, not `update`. | Freeze ξ. Four verbs. Haken slaving. |
 | Status: one light, one next step. | Become an architect in 60 seconds |
 
-**Brands, then the common word:** ArkGate, ArkRules, ArkRun. Gloss once.
+**Brands, then the common word:** ArkGate, ArkRules, ArkRun, ArkOrder. Gloss once.
 
 | Say | Do not say on first contact |
 |-----|-----------------------------|
@@ -84,6 +90,7 @@ Three beats when a line teaches:
 | `arkgate-check --doctor` — **status**, one next step | control plane, coach, doctor as the product name |
 | optional policies inside a layer | dual plane, intra-layer sensors, Saturday tidy |
 | experimental runtime / in-memory / not Postgres | production kernel, durable runtime, training wheels |
+| the few slow product decisions / billing plan vs seats / that PUT doesn’t land | four verbs, freeze a pattern, Haken, slaving, ξ vs s, extra plane, construction OS |
 
 Command names stay command names (`--doctor` is a flag). If a word is not here,
 cut it or put it below the fold (develop, JSON, ADRs).
@@ -94,7 +101,7 @@ cut it or put it below the fold (develop, JSON, ADRs).
 
 These are product law, not vibe:
 
-- **Write. Check. Ship.** ArkGate is the wedge. ArkRules and ArkRun never determine the `arkgate` package shape.
+- **Write. Check. Ship.** ArkGate is the wedge. ArkRules, ArkRun, and ArkOrder never determine the `arkgate` package shape.
 - The check is deterministic. No LLM pass/fail. Skills and `AGENTS.md` never replace the check.
 - Doctor and status advisory surfaces project existing facts. They are not a second check and never flip the deny.
 - No numeric architecture / trust / depth score. Lights and counts, never Excellent/Good.
@@ -103,7 +110,8 @@ These are product law, not vibe:
 - A weaker config needs an explicit, hash-bound yes.
 - Host write hardness differs. Required CI is the shared hard line.
 - ArkRun stores are **in-memory**. Not production durability. Do not imply otherwise.
-- Absence of ArkRules or ArkRun is silent. Label leftovers **`[Layer]`** vs **`[ArkRules]`**.
+- Absence of ArkRules, ArkRun, or ArkOrder is silent. Label leftovers **`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**.
+- ArkOrder is in-memory and not durable. It does not replace ArkRun. Do not imply a second npm package.
 
 Full engineering queue: [ROADMAP.md](../ROADMAP.md). Do not narrate phase ids in consumer copy.
 
@@ -147,6 +155,7 @@ a product PR — that is an owner `--contract-session` (config change).
 - Package AI decided pass/fail
 - Depth scores, trust scores, Excellent module bands
 - ArkRun as Postgres, an outbox, or Temporal
+- ArkOrder as durable storage, a second npm package, or a replacement for ArkRun
 - New skill *names* without a live queue item
 - “the house stays up” / “training wheels” / “mimo” on first contact
 
@@ -169,8 +178,9 @@ Invoking a command **is** the approval. CLI checks; it does not silently rewrite
 - [ ] **Write. Check. Ship.** is on first-contact.
 - [ ] Deny is `When the agent writes a bad import, the write doesn’t land.`
 - [ ] One next action is obvious.
-- [ ] ArkGate / ArkRules / ArkRun are import rules / policies / experimental runtime.
+- [ ] ArkGate / ArkRules / ArkRun / ArkOrder are import rules / policies / experimental runtime / the extra that stops slow product decisions being CRUD.
 - [ ] ArkRun is never implied durable / Postgres.
+- [ ] ArkOrder is never implied durable, a second install, or a replacement for ArkRun.
 - [ ] Status lights read Setup / In progress / Ready to humans.
 - [ ] No score, no false done, no Gateway as the first sentence, no “disable the rules”.
 - [ ] A senior would paste the line into a PR without cringing.

package/docs/use.md

@@ -80,11 +80,14 @@ The config only binds when the write doesn’t land and CI is required.
 |--|---------------|---------|
 | **ArkGate** (layers) | Import rules. The write doesn’t land. The PR fails. | Always — this is the product |
 | **ArkRules** | Optional policies *inside* a layer. | Off until you turn it on (start may ship advisory templates) |
-| **ArkRun** | Optional experimental runtime | Off. In-memory. Not Postgres. |
-
-Start always gives you **layers**. Compact starters do **not** turn on ArkRun.
-No ArkRules / ArkRun is fine — only ArkGate runs. Leftovers are labeled
-**`[Layer]`** vs **`[ArkRules]`**. Green imports ≠ elegant design. ArkRun ≠ durable stores.
+| **ArkRun** | Optional experimental runtime (`arkgate/runtime`) | Off. In-memory. Not Postgres. |
+| **ArkOrder** | Stops the agent rewriting the few slow product decisions as CRUD (`arkgate/order`) | Off. Name `xiKeys` (plan / protocol, not `projectId`). Invoices and seats still flow. In-memory. Not durable. |
+
+Start always gives you **layers**. Compact starters do **not** turn on ArkRun or
+ArkOrder. No extras is fine — only ArkGate runs. Leftovers are labeled
+**`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**. Green
+imports ≠ elegant design. Green imports also ≠ a frozen billing plan. ArkRun ≠
+durable stores. ArkOrder does not replace ArkRun.
 
 ### New modules vs config edits
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkgate",
-  "version": "4.8.2",
+  "version": "4.8.4",
   "description": "When the agent writes a bad import, the write doesn’t land. The same check fails the pull request.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -163,7 +163,7 @@
     "audit:beta-exit": "node scripts/beta-exit-audit.mjs",
     "clean": "rm -rf dist",
     "release:npm": "node scripts/release-npm.mjs",
-    "prepack": "npm run build",
+    "prepublishOnly": "npm run build",
     "bench:hook-path": "node scripts/hook-path-bench.mjs"
   },
   "dependencies": {

package/schemas/ark.arkrules.schema.json

@@ -60,6 +60,7 @@
             "domain-event-on-mutation",
             "orchestration-only",
             "thin-adapter",
+            "writes-via-aggregate",
             "no-anemic-model",
             "invariant-coverage"
           ]

package/schemas/ark.config.schema.json

@@ -625,6 +625,9 @@
         "allowDisabledPeerIsolation": false
       }
     },
+    "coverage": {
+      "$ref": "#/$defs/coverage"
+    },
     "arkRules": {
       "type": "object",
       "additionalProperties": {
@@ -773,6 +776,37 @@
           },
           "uniqueItems": true,
           "minItems": 1
+        },
+        "sharedRoots": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true,
+          "minItems": 1
+        },
+        "allowedCrossSlice": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "from",
+              "to"
+            ],
+            "properties": {
+              "from": {
+                "type": "string",
+                "minLength": 1
+              },
+              "to": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
         }
       }
     },
@@ -800,6 +834,35 @@
         }
       }
     },
+    "coverage": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Invariant coverage scan controls. testGlobs replaces the built-in test-name heuristic; maxFiles raises or lowers the evidence file budget; coverageRoots declares where the project runs its tests, so a covering test found outside them is reported instead of silently certifying an invariant.",
+      "properties": {
+        "testGlobs": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true,
+          "minItems": 1
+        },
+        "maxFiles": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "coverageRoots": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true,
+          "minItems": 1
+        }
+      }
+    },
     "arkRun": {
       "type": "object",
       "additionalProperties": false,
@@ -882,6 +945,15 @@
           "type": "integer",
           "minimum": 1,
           "default": 7
+        },
+        "xiKeys": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true,
+          "default": []
         }
       }
     }

package/schemas/ark.resolved-candidate-facts.schema.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://unpkg.com/arkgate@3/schemas/ark.resolved-candidate-facts.schema.json","title":"ArkGate resolved candidate facts","type":"object","additionalProperties":false,"required":["schemaVersion","completeness","completenessReasons","resolverIdentity","compilerIdentity","compilerOptionsHash","tsconfigHash","candidateTreeHash","evidenceRequirementsHash","files","dependencies","capabilityUses","ambientUses","publishCalls","intentReferences","safetyUses","factsHash"],"properties":{"schemaVersion":{"enum":["1.0","1.1","1.2"]},"completeness":{"enum":["complete","partial","unavailable"]},"completenessReasons":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["code","message"],"properties":{"code":{"type":"string","minLength":1},"message":{"type":"string","minLength":1},"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"}}}},"resolverIdentity":{"type":"string","minLength":1},"compilerIdentity":{"type":"string","minLength":1},"compilerOptionsHash":{"type":"string","minLength":1},"tsconfigHash":{"type":"string","minLength":1},"candidateTreeHash":{"type":"string","minLength":1},"evidenceRequirementsHash":{"type":"string","minLength":1},"projectPackageName":{"type":"string","minLength":1},"files":{"type":"array","uniqueItems":true,"items":{"type":"object","additionalProperties":false,"required":["path","contentHash","parseStatus","parseDiagnosticCount","exportsOnlyTypes","typeOnlyExportNames","hasTopLevelSideEffects"],"properties":{"path":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"contentHash":{"type":"string","minLength":1},"parseStatus":{"enum":["parsed","invalid"]},"parseDiagnosticCount":{"type":"integer","minimum":0},"exportsOnlyTypes":{"type":"boolean"},"typeOnlyExportNames":{"type":"array","items":{"type":"string","minLength":1}},"hasTopLevelSideEffects":{"type":"boolean"}},"allOf":[{"if":{"properties":{"parseStatus":{"const":"parsed"}}},"then":{"properties":{"parseDiagnosticCount":{"const":0}}}},{"if":{"properties":{"parseStatus":{"const":"invalid"}}},"then":{"properties":{"parseDiagnosticCount":{"minimum":1}}}}]}},"dependencies":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["from","kind","typeOnly","line","resolution"],"properties":{"from":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"specifier":{"type":"string","minLength":1},"kind":{"enum":["import","export","dynamic-import","require"]},"typeOnly":{"type":"boolean"},"line":{"type":"integer","minimum":1},"resolution":{"enum":["resolved-project","resolved-external","unresolved","dynamic"]},"target":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"namedBindings":{"type":"array","items":{"type":"string","minLength":1}},"targetTypeOnlyExports":{"type":"boolean"},"sourcePureTypeModule":{"type":"boolean"},"namedBindingsTypeOnly":{"type":"boolean"},"portProofEligible":{"type":"boolean"}},"allOf":[{"if":{"properties":{"resolution":{"const":"resolved-project"}}},"then":{"required":["target"]},"else":{"not":{"required":["target"]}}},{"if":{"properties":{"resolution":{"const":"dynamic"}}},"else":{"required":["specifier"]}}]}},"capabilityUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","symbol","capability","source"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"symbol":{"type":"string","minLength":1},"capability":{"enum":["network","filesystem","clock","randomness","environment","process","persistence"]},"source":{"enum":["ambient-global","import-based"]}}}},"ambientUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","symbol"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"symbol":{"type":"string","minLength":1}}}},"publishCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","objectHasIntent","arkPublishCandidate","hasSource"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"rawIntentName":{"type":"string","minLength":1},"objectHasIntent":{"type":"boolean"},"arkPublishCandidate":{"type":"boolean"},"hasSource":{"type":"boolean"},"sourceIntent":{"type":"string","minLength":1}}}},"intentReferences":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","intent"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"intent":{"type":"string","minLength":1}}}},"safetyUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","kind"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"kind":{"enum":["ts-suppression","any-cast","dynamic-import","dynamic-require","in-memory-store"]},"symbol":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"kind":{"const":"in-memory-store"}}},"then":{"required":["symbol"]},"else":{"not":{"required":["symbol"]}}}]}},"classShapes":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","className","exported","hasPublicMutableFields","hasPublicSetters","hasPublicConstructor","hasStaticFactory","mutatingMethods"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"className":{"type":"string","minLength":1},"exported":{"type":"boolean"},"hasPublicMutableFields":{"type":"boolean"},"hasPublicSetters":{"type":"boolean"},"hasPublicConstructor":{"type":"boolean"},"hasStaticFactory":{"type":"boolean"},"dataOnly":{"type":"boolean"},"mutatingMethods":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["name","referencesGuardOrPublish"],"properties":{"name":{"type":"string","minLength":1},"referencesGuardOrPublish":{"type":"boolean"}}}}}}},"arkRunKernelCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","kind","callee","viaImport"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"kind":{"enum":["factory","publisher","publish","raise","send","subscribe","register-handler","resolve","resolve-singleton"]},"callee":{"type":"string","minLength":1},"viaImport":{"type":"boolean"},"receiver":{"type":"string","minLength":1},"nameLiteral":{"type":"string","minLength":1}}}},"arkRunManagedNews":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","typeName"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"typeName":{"type":"string","minLength":1},"importedFrom":{"type":"string","minLength":1}}}},"arkRunCompositionRootHits":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","matchedRoot","hasKernelFactory"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"matchedRoot":{"type":"string","minLength":1},"hasKernelFactory":{"type":"boolean"}}}},"arkRunDeclarations":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","uses","reactsTo","raises","sends"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"uses":{"type":"array","items":{"type":"string","minLength":1}},"reactsTo":{"type":"array","items":{"type":"string","minLength":1}},"raises":{"type":"array","items":{"type":"string","minLength":1}},"sends":{"type":"array","items":{"type":"string","minLength":1}}}}},"arkOrderPlaneCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","callee"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"callee":{"type":"string","minLength":1}}}},"arkOrderGenericUpdates":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","method"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"method":{"type":"string","minLength":1}}}},"arkOrderRootHits":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","matchedRoot","hasPlaneFactory"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"matchedRoot":{"type":"string","minLength":1},"hasPlaneFactory":{"type":"boolean"}}}},"factsHash":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"completeness":{"const":"complete"}}},"then":{"properties":{"completenessReasons":{"maxItems":0},"files":{"items":{"properties":{"parseStatus":{"const":"parsed"}}}}}}},{"if":{"properties":{"completeness":{"enum":["partial","unavailable"]}}},"then":{"properties":{"completenessReasons":{"minItems":1}}}}]}
+{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://unpkg.com/arkgate@3/schemas/ark.resolved-candidate-facts.schema.json","title":"ArkGate resolved candidate facts","type":"object","additionalProperties":false,"required":["schemaVersion","completeness","completenessReasons","resolverIdentity","compilerIdentity","compilerOptionsHash","tsconfigHash","candidateTreeHash","evidenceRequirementsHash","files","dependencies","capabilityUses","ambientUses","publishCalls","intentReferences","safetyUses","factsHash"],"properties":{"schemaVersion":{"enum":["1.0","1.1","1.2"]},"completeness":{"enum":["complete","partial","unavailable"]},"completenessReasons":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["code","message"],"properties":{"code":{"type":"string","minLength":1},"message":{"type":"string","minLength":1},"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"}}}},"resolverIdentity":{"type":"string","minLength":1},"compilerIdentity":{"type":"string","minLength":1},"compilerOptionsHash":{"type":"string","minLength":1},"tsconfigHash":{"type":"string","minLength":1},"candidateTreeHash":{"type":"string","minLength":1},"evidenceRequirementsHash":{"type":"string","minLength":1},"projectPackageName":{"type":"string","minLength":1},"files":{"type":"array","uniqueItems":true,"items":{"type":"object","additionalProperties":false,"required":["path","contentHash","parseStatus","parseDiagnosticCount","exportsOnlyTypes","typeOnlyExportNames","hasTopLevelSideEffects"],"properties":{"path":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"contentHash":{"type":"string","minLength":1},"parseStatus":{"enum":["parsed","invalid"]},"parseDiagnosticCount":{"type":"integer","minimum":0},"exportsOnlyTypes":{"type":"boolean"},"typeOnlyExportNames":{"type":"array","items":{"type":"string","minLength":1}},"hasTopLevelSideEffects":{"type":"boolean"}},"allOf":[{"if":{"properties":{"parseStatus":{"const":"parsed"}}},"then":{"properties":{"parseDiagnosticCount":{"const":0}}}},{"if":{"properties":{"parseStatus":{"const":"invalid"}}},"then":{"properties":{"parseDiagnosticCount":{"minimum":1}}}}]}},"dependencies":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["from","kind","typeOnly","line","resolution"],"properties":{"from":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"specifier":{"type":"string","minLength":1},"kind":{"enum":["import","export","dynamic-import","require"]},"typeOnly":{"type":"boolean"},"line":{"type":"integer","minimum":1},"resolution":{"enum":["resolved-project","resolved-external","unresolved","dynamic"]},"target":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"namedBindings":{"type":"array","items":{"type":"string","minLength":1}},"targetTypeOnlyExports":{"type":"boolean"},"sourcePureTypeModule":{"type":"boolean"},"namedBindingsTypeOnly":{"type":"boolean"},"portProofEligible":{"type":"boolean"}},"allOf":[{"if":{"properties":{"resolution":{"const":"resolved-project"}}},"then":{"required":["target"]},"else":{"not":{"required":["target"]}}},{"if":{"properties":{"resolution":{"const":"dynamic"}}},"else":{"required":["specifier"]}}]}},"capabilityUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","symbol","capability","source"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"symbol":{"type":"string","minLength":1},"capability":{"enum":["network","filesystem","clock","randomness","environment","process","persistence"]},"source":{"enum":["ambient-global","import-based"]}}}},"ambientUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","symbol"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"symbol":{"type":"string","minLength":1}}}},"publishCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","objectHasIntent","arkPublishCandidate","hasSource"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"rawIntentName":{"type":"string","minLength":1},"objectHasIntent":{"type":"boolean"},"arkPublishCandidate":{"type":"boolean"},"hasSource":{"type":"boolean"},"sourceIntent":{"type":"string","minLength":1}}}},"intentReferences":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","intent"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"intent":{"type":"string","minLength":1}}}},"safetyUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","kind"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"kind":{"enum":["ts-suppression","any-cast","dynamic-import","dynamic-require","in-memory-store"]},"symbol":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"kind":{"const":"in-memory-store"}}},"then":{"required":["symbol"]},"else":{"not":{"required":["symbol"]}}}]}},"classShapes":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","className","exported","hasPublicMutableFields","hasPublicSetters","hasPublicConstructor","hasStaticFactory","mutatingMethods"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"className":{"type":"string","minLength":1},"exported":{"type":"boolean"},"hasPublicMutableFields":{"type":"boolean"},"hasPublicSetters":{"type":"boolean"},"hasPublicConstructor":{"type":"boolean"},"hasStaticFactory":{"type":"boolean"},"dataOnly":{"type":"boolean"},"mutatingMethods":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["name","referencesGuardOrPublish"],"properties":{"name":{"type":"string","minLength":1},"referencesGuardOrPublish":{"type":"boolean"}}}}}}},"arkRunKernelCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","kind","callee","viaImport"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"kind":{"enum":["factory","publisher","publish","raise","send","subscribe","register-handler","resolve","resolve-singleton"]},"callee":{"type":"string","minLength":1},"viaImport":{"type":"boolean"},"receiver":{"type":"string","minLength":1},"nameLiteral":{"type":"string","minLength":1}}}},"arkRunManagedNews":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","typeName"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"typeName":{"type":"string","minLength":1},"importedFrom":{"type":"string","minLength":1}}}},"arkRunCompositionRootHits":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","matchedRoot","hasKernelFactory"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"matchedRoot":{"type":"string","minLength":1},"hasKernelFactory":{"type":"boolean"}}}},"arkRunDeclarations":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","uses","reactsTo","raises","sends"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"uses":{"type":"array","items":{"type":"string","minLength":1}},"reactsTo":{"type":"array","items":{"type":"string","minLength":1}},"raises":{"type":"array","items":{"type":"string","minLength":1}},"sends":{"type":"array","items":{"type":"string","minLength":1}}}}},"arkOrderPlaneCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","callee"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"callee":{"type":"string","minLength":1}}}},"arkOrderGenericUpdates":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","method"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"method":{"type":"string","minLength":1}}}},"arkOrderRootHits":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","matchedRoot","hasPlaneFactory"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"matchedRoot":{"type":"string","minLength":1},"hasPlaneFactory":{"type":"boolean"}}}},"arkOrderXiFieldWrites":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","key"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"key":{"type":"string","minLength":1}}}},"arkOrderIngestWritesXi":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1}}}},"arkOrderReleaseKeyCounts":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","keyCount"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"keyCount":{"type":"integer","minimum":1}}}},"factsHash":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"completeness":{"const":"complete"}}},"then":{"properties":{"completenessReasons":{"maxItems":0},"files":{"items":{"properties":{"parseStatus":{"const":"parsed"}}}}}}},{"if":{"properties":{"completeness":{"enum":["partial","unavailable"]}}},"then":{"properties":{"completenessReasons":{"minItems":1}}}}]}

package/server.json

@@ -1,17 +1,17 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.pedroknigge/arkgate",
-  "description": "When the agent writes a bad import, the write doesn’t land. The same check fails the pull request.",
+  "description": "When the agent writes a bad import, the write doesn\u2019t land. The same check fails the pull request.",
   "repository": {
     "url": "https://github.com/pedroknigge/arkgate",
     "source": "github"
   },
-  "version": "4.8.2",
+  "version": "4.8.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "arkgate",
-      "version": "4.8.2",
+      "version": "4.8.4",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/templates/agent-skills/README.md

@@ -7,7 +7,7 @@
 This directory is the **Agent Skills–compatible** packaging of the same **13**
 `/ark-*` skills shipped as flat templates for Ark install. **No new skill names.**
 
-Package version when last generated context: **arkgate@4.8.1**
+Package version when last generated context: **arkgate@4.8.3**
 Schema: agent-skills package contract `1.0`
 
 ## Skills (frozen catalog)

package/templates/agent-skills/ark-adopt/SKILL.md

@@ -142,6 +142,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 ### Adopt + ArkRules
 - After classify: emit or refresh `arkRules` for matched layers (exact names; generic mold for unknowns).
 - Mine rules → inventory + write advisory invariants/structure into `arkrules/<Layer>.json` **in this turn**.
+- Application / Features templates include advisory `writes-via-aggregate`: driver import + write token in a use case is the skip. Do not copy `Externals/` / `admission.ts` folder religion.
 - Freeze baseline is **[Layer]** debt; inventory residual is **[ArkRules]** — report both.
 
 ### Adopt + ArkRun
@@ -156,8 +157,8 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 
 ### Adopt + ArkOrder
 - User asked to turn the extra on: write **advisory** `arkOrder` on `ark.config.json` (`schemaVersion` `1.3+`) **in this turn**. Default `"mode": "advisory"` — never session-0 default `enforced`.
-- Required shape: `planeRoots` (real files; empty + enforced = `ARKORDER_MISSING_PLANE`), `managedLayers` (existing `layers[].name` only), `maxXiKeys` (default 7).
-- Example (consumer trees — not this library's 4-layer compact):
+- Required shape: `planeRoots` (real files; empty + enforced = `ARKORDER_MISSING_PLANE`), `managedLayers` (existing `layers[].name` only), `maxXiKeys` (default 7), **`xiKeys`** (the 3–5 slow names; empty = field-write sensor silent).
+- Example (consumer trees — not this library's 4-layer compact). Copy billing, **rename the three keys**:
 
 ```json
 {
@@ -166,11 +167,15 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
     "mode": "advisory",
     "planeRoots": ["src/main.ts"],
     "managedLayers": ["Application"],
-    "maxXiKeys": 7
+    "maxXiKeys": 7,
+    "xiKeys": ["plan", "cycle", "tenancy"]
   }
 }
 ```
 
+- `xiKeys` are meaning, not membership. `projectId` / `orgId` do not belong. If `proposeRelease` throws empty blast, that key does not order anything.
+- A use-case that `prisma.*.update({ plan })` while `plan` is in `xiKeys` is **[ArkOrder]** `ARKORDER_XI_FIELD_WRITE`. Invoices and seats still flow through `ingest`.
+
 - Do **not** put `arkOrder` on the compact starter / `ark start` scaffold. Domain stays plane-free. Import `createOrderPlane` from `arkgate/order` (same npm package).
 - Absence is valid and **silent** — never force the extra. Do not invent `/ark-order`.
 - Demoting enforced → advisory or deleting the extra is policy-delta **weakening**.
@@ -232,6 +237,11 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
    to a compact starter. Do not promote to enforced as the session-0 default.
 2. **Check + diagnose** — `summary.concentrated` / dominant edge → fix contract first, don’t freeze.
    Cross-slice / cross-context `peerIsolation` hits are judgment: extract shared or events.
+   The denial names its reason. `unclassifiable path` in bulk means shared code lives outside
+   the slice folders — declare those roots (`sharedRoots`) on the rule instead of treating
+   thousands of shared files as violations; `cross-slice edge a → b` is the real one, and a
+   deliberate directed edge goes in `allowedCrossSlice`. Promoting the shared slice to its own
+   layer is still the preferred fix.
    If one edge dominates residual debt: **STOP — do not continue this skill as complete.** **STOP — concentrated edge:** rewrite `ark.config.json` **in this turn** with source evidence (do not freeze a wrong config or grind N freezes).
    Empty Domain/Persistence + I/O under Application → false-green.
    **STOP — do not continue this skill as complete.** **STOP — false-green:** fix the config **in this turn** before claiming ENFORCE. Do not claim goal.met / ENFORCE from type-only cleanup while doctor reports `contract-false-green-io-under-application`.

package/templates/agent-skills/ark-autopilot/SKILL.md

@@ -147,7 +147,7 @@ When `arkRun` is present:
 
 ### Autopilot + ArkOrder
 When `arkOrder` is present:
-- Grind skip clusters with judgment: `ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE` / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI`. Freeze ξ with `release()`; never `update`/`patch`/`set`.
+- Grind skip clusters with judgment: `ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE` / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`. Freeze ξ with `release()`; never `update`/`patch`/`set`. Name `xiKeys`; do not persist those keys from a use-case.
 - Extra off → `/ark-adopt` (advisory). Do not invent `/ark-order`.
 - Skills never enforce.
 

package/templates/agent-skills/ark-contract/SKILL.md

@@ -43,6 +43,10 @@ restart/retargeting is required. `ark://manifest` never satisfies this preflight
 
 Label findings **`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**. Absence of extras is valid and silent. First-time extra is **`/ark-adopt`** (advisory). Wire one kernel candidate with **`/ark-runtime`**. New kernel-managed / plane-root file with **`/ark-place`**. Grind skip clusters with **`/ark-autopilot`**. Do not invent `/ark-run` or `/ark-order`. Skills never enforce.
 
+Application / Features may declare advisory **`writes-via-aggregate`**: a use-case that imports a persistence driver and calls `.insert` / `.create` / `INSERT INTO` is the skip. Persistence adapters stay the write edge. Do not add `Externals/` or `admission.ts` as contract law.
+
+When `arkOrder` is on, name **`xiKeys`** (3–5 slow product decisions). Membership ids are not keys. A use-case that persists those keys is `ARKORDER_XI_FIELD_WRITE`. Copy [examples/arkorder-billing/](../../../examples/arkorder-billing/) and rename the three keys.
+
 ## Subagent fan-out (optional, host-dependent)
 
 If the host supports **parallel subagents**, fan out read-only scouts; otherwise

package/templates/agent-skills/ark-coverage/SKILL.md

@@ -92,6 +92,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or promoting modes is **`/ark-adopt`** / leftover **`/ark-contract`**; fixing code under a structure sensor is leftover **`/ark-fix`** / **`/ark-loop`** or **`/ark-autopilot`** (judgment, never invent mechanical-safe).
 5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` with `evidence.arkruleId`.
+5b. Invariant coverage is a **text match, never an execution**: a file walk plus the invariant id in a `describe`/`it` title. Never report `INVARIANT_UNCOVERED: 0` as “the tests pass” or “the tests run” — ArkGate does not run tests and reads no runner config. When the project declares `coverage.coverageRoots`, a covering test found outside them raises the advisory `INVARIANT_COVERAGE_OUTSIDE_ROOTS`; without that declaration ArkGate makes no claim about where tests run.
 6. Extras silent when off. Doctor `arkRun` is `notAScore`. Do not force extras. Do not invent `/ark-run` or `/ark-order`.
 
 

package/templates/agent-skills/ark-place/SKILL.md

@@ -127,8 +127,9 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 
 
 ### Place + ArkRules
-- Choose layer from contract **and** check structure sensors for that layer (private state, factory, thin adapter).
+- Choose layer from contract **and** check structure sensors for that layer (private state, factory, thin adapter, writes-via-aggregate).
 - Scaffold to satisfy **[ArkRules]** when present; state which sensors apply.
+- Persistence **writes** (insert/update/delete against a driver) go through a Domain aggregate + persistence adapter. Application/Feature files that import Prisma/pg/Supabase and call `.insert` / `.create` are **[ArkRules]** `writes-via-aggregate`. Do not invent `Externals/` or `admission.ts`.
 
 ### Place + ArkRun
 When `arkRun` is present on the architecture config:
@@ -146,7 +147,8 @@ When `arkOrder` is present on the architecture config:
 - Import `createOrderPlane` from `arkgate/order` (same npm package). Domain-role files stay plane-free.
 - Freeze ξ with `release()`; derive s with `project()`; field `ingest()` never mints a pattern; `proposeRelease()` needs a non-empty blast. There is no `update`/`patch`/`set`.
 - Call the factory only inside `arkOrder.planeRoots`. Empty roots in `enforced` mode is `ARKORDER_MISSING_PLANE`.
-- Skip clusters (`ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE` / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI`): place this artifact, then grind via `/ark-autopilot`. Extra not on → `/ark-adopt`. Do not invent `/ark-order`.
+- Named slow keys live in `arkOrder.xiKeys`. A managed-layer Prisma/pg write of those keys is `ARKORDER_XI_FIELD_WRITE` — absorb with `ingest` or change the pattern with `proposeRelease`.
+- Skip clusters (`ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE` / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`): place this artifact, then grind via `/ark-autopilot`. Extra not on → `/ark-adopt`. Do not invent `/ark-order`.
 - Absence of the extra is valid. Do not invent `/ark-order`. Skills never enforce.
 
 ## Subagent fan-out (optional, host-dependent)
@@ -178,6 +180,8 @@ the same files or weaken the gate.
    - Orchestrates a use case, no I/O of its own → application layer.
    - Talks to a database, queue, API, filesystem → an adapter layer on the side
      that matches the direction (driven/persistence vs driving/http).
+     **Writes** go through a Domain aggregate that uses a persistence port; the
+     adapter implements the port. Do not put `prisma.order.create` in a use case.
    - Reacts to events, long-running coordination (saga/workflow), scheduled
      jobs, projections → the event/workflow layers if the config declares them.
      When `arkRun` is on, wire those through the kernel (register + declarations),

package/templates/arkrules/ApplicationOrchestration.json

@@ -8,6 +8,12 @@
       "sensor": "orchestration-only",
       "mode": "advisory",
       "description": "Application use cases orchestrate; keep domain branching in Domain."
+    },
+    {
+      "id": "writes-via-aggregate",
+      "sensor": "writes-via-aggregate",
+      "mode": "advisory",
+      "description": "Persistence writes go through a Domain aggregate and a persistence adapter; use cases do not call the driver."
     }
   ],
   "invariants": []