arkgate 4.8.22 → 4.8.23

package/bin/lib/config-contract.mjs

@@ -233,7 +233,69 @@ export const ARK_CONFIG_SCHEMA = {
                         },
                     },
                 },
-                sharedImportsSlice: { type: 'string', enum: ['deny'] },
+                sharedImportsSlice: {
+                    type: 'string',
+                    enum: ['deny', 'deny-cross-parent'],
+                    description: 'deny blocks every shared-root import of a slice. deny-cross-parent leaves that hop as a warning and, in ark-check and CI only, reports a slice that reaches another universe through a shared root. The write hook and ESLint see one edge and do not block it. arkgate 4.8.22 and older reject deny-cross-parent.',
+                },
+                childSlices: {
+                    type: 'object',
+                    additionalProperties: false,
+                    required: ['sliceFolders'],
+                    description: 'Optional inner wall under this rule. Absent keeps today\'s universe wall. sliceFolders names children. commonFolders and flat files are universe common. siblings is "deny" (default), "advisory", or { default, enforce }. parentMayImportChild defaults to false. allowedCrossSlice may use a whole-segment *. It clears only a sibling crossing. Cross-parent has no advisory knob. arkgate 4.8.22 and older reject this key. A build that still rejects unknown childSlices fields rejects allowedCrossSlice at config load. A build that still types siblings as a string enum rejects the object at config load.',
+                    properties: {
+                        sliceFolders: { ...stringArraySchema, minItems: 1 },
+                        sliceIdentity: {
+                            type: 'string',
+                            enum: ['path', 'stars'],
+                        },
+                        commonFolders: { ...stringArraySchema, minItems: 1 },
+                        siblings: {
+                            description: '"deny" or "advisory", or { default, enforce } so listed subtrees are errors while the default stays advisory. A string-enum build rejects the object at config load (must be one of deny, advisory).',
+                            oneOf: [
+                                { type: 'string', enum: ['deny', 'advisory'] },
+                                {
+                                    type: 'object',
+                                    additionalProperties: false,
+                                    required: ['default'],
+                                    properties: {
+                                        default: { type: 'string', enum: ['deny', 'advisory'] },
+                                        enforce: { ...stringArraySchema },
+                                    },
+                                },
+                            ],
+                        },
+                        parentMayImportChild: { type: 'boolean' },
+                        sliceAliases: {
+                            type: 'array',
+                            minItems: 1,
+                            description: 'Maps a source path glob onto a child slice id (universe id plus one child segment) so files outside the slice trees take that universe and child for both walls. A bare name, a universe id alone, an unknown universe, and a wildcard in to are rejected. The glob may not overlap a slice folder, and two aliases may not match the same file. Doctor lists each alias as an owed move. A build that rejects unknown childSlices fields fails at config load (unknown field). arkgate 4.8.22 and older reject childSlices.',
+                            items: {
+                                type: 'object',
+                                additionalProperties: false,
+                                required: ['from', 'to'],
+                                properties: {
+                                    from: { type: 'string', minLength: 1 },
+                                    to: { type: 'string', minLength: 1 },
+                                },
+                            },
+                        },
+                        allowedCrossSlice: {
+                            type: 'array',
+                            minItems: 1,
+                            description: 'Directed child-slice allowances. * matches one whole path segment (features/projects/*). ** and a partial segment are rejected. A bare name is rejected. This list clears only CROSS_SIBLING_SLICE. It cannot clear CROSS_PARENT_SLICE or CROSS_PARENT_VIA_SHARED. The universe allowedCrossSlice still treats * as a literal. A build that rejects unknown childSlices fields fails at config load (unknown field).',
+                            items: {
+                                type: 'object',
+                                additionalProperties: false,
+                                required: ['from', 'to'],
+                                properties: {
+                                    from: { type: 'string', minLength: 1 },
+                                    to: { type: 'string', minLength: 1 },
+                                },
+                            },
+                        },
+                    },
+                },
             },
         },
         safety: {
@@ -395,6 +457,420 @@ function validateNode(value, schema, path, root, issues) {
         }
     }
 }
+const SIBLING_MODES = ['deny', 'advisory'];
+/**
+ * String enum builds reject this object before they reach a decision.
+ * The message names both forms so a bad value is obvious at config load.
+ */
+const SIBLINGS_FORM_MESSAGE = 'must be "deny", "advisory", or { "default": "deny" | "advisory", "enforce": ["<child id or subtree path>"] }';
+function validateChildSliceSiblings(candidate, issues) {
+    const rules = candidate.rules;
+    if (!Array.isArray(rules))
+        return;
+    rules.forEach((rule, index) => {
+        if (!isObject(rule))
+            return;
+        const child = rule.childSlices;
+        if (!isObject(child) || child.siblings === undefined)
+            return;
+        const siblings = child.siblings;
+        const path = `$.rules[${index}].childSlices.siblings`;
+        if (typeof siblings === 'string') {
+            if (!SIBLING_MODES.includes(siblings)) {
+                issues.push({ path, message: SIBLINGS_FORM_MESSAGE });
+            }
+            return;
+        }
+        if (!isObject(siblings)) {
+            issues.push({ path, message: SIBLINGS_FORM_MESSAGE });
+            return;
+        }
+        for (const key of Object.keys(siblings)) {
+            if (key !== 'default' && key !== 'enforce') {
+                issues.push({ path: propertyPath(path, key), message: 'unknown field' });
+            }
+        }
+        if (siblings.default === undefined) {
+            issues.push({ path: `${path}.default`, message: 'is required' });
+        }
+        else if (siblings.default !== 'deny' && siblings.default !== 'advisory') {
+            issues.push({ path: `${path}.default`, message: 'must be deny or advisory' });
+        }
+        if (siblings.enforce === undefined)
+            return;
+        if (!Array.isArray(siblings.enforce)) {
+            issues.push({
+                path: `${path}.enforce`,
+                message: 'must be an array of child slice ids or subtree paths',
+            });
+            return;
+        }
+        const seen = new Set();
+        siblings.enforce.forEach((entry, entryIndex) => {
+            const entryPath = `${path}.enforce[${entryIndex}]`;
+            if (typeof entry !== 'string' || entry.trim().length === 0) {
+                issues.push({ path: entryPath, message: 'must be a non-empty child slice id or subtree path' });
+                return;
+            }
+            const normalized = trimTrailingSlashes(entry.trim().replace(/\\/g, '/'));
+            if (normalized.split('/').some((part) => part.length === 0 || part === '.' || part === '..')) {
+                issues.push({ path: entryPath, message: 'must be a child slice id or subtree path without . or ..' });
+                return;
+            }
+            if (normalized.includes('*')) {
+                issues.push({
+                    path: entryPath,
+                    message: 'must be a child slice id or subtree path. * is not a wildcard on siblings.enforce',
+                });
+                return;
+            }
+            if (seen.has(normalized)) {
+                issues.push({ path: entryPath, message: 'duplicate enforce entry' });
+                return;
+            }
+            seen.add(normalized);
+        });
+    });
+}
+const BARE_CHILD_CROSS_SLICE = 'must be a slice id with a slash. A bare name is ambiguous across universes.';
+const WHOLE_SEGMENT_STAR = '* matches one whole path segment. ** and a partial segment are not wildcards.';
+/**
+ * Whole-segment `*` is legal only on this list. A bare name is rejected.
+ * The universe allowedCrossSlice is not checked here and still treats `*` as a literal.
+ */
+function childCrossSlicePatternIssue(raw) {
+    const trimmed = trimTrailingSlashes(raw.trim().replace(/\\/g, '/'));
+    if (trimmed.length === 0)
+        return 'must be a non-empty slice id';
+    if (!trimmed.includes('/'))
+        return BARE_CHILD_CROSS_SLICE;
+    const parts = trimmed.split('/');
+    for (const part of parts) {
+        if (part.length === 0 || part === '.' || part === '..') {
+            return 'must be a slice id without empty, . or .. segments';
+        }
+        if (part.includes('*') && part !== '*')
+            return WHOLE_SEGMENT_STAR;
+    }
+    return null;
+}
+function childCrossSlicePatternKey(raw) {
+    return trimTrailingSlashes(raw.trim().replace(/\\/g, '/')).toLowerCase();
+}
+function validateChildSliceAllowedCrossSlice(candidate, issues) {
+    const rules = candidate.rules;
+    if (!Array.isArray(rules))
+        return;
+    rules.forEach((rule, index) => {
+        if (!isObject(rule))
+            return;
+        const child = rule.childSlices;
+        if (!isObject(child) || child.allowedCrossSlice === undefined)
+            return;
+        const edges = child.allowedCrossSlice;
+        const path = `$.rules[${index}].childSlices.allowedCrossSlice`;
+        if (!Array.isArray(edges)) {
+            issues.push({ path, message: 'must be an array of { from, to } child slice ids' });
+            return;
+        }
+        const seen = new Set();
+        edges.forEach((edge, edgeIndex) => {
+            const edgePath = `${path}[${edgeIndex}]`;
+            if (!isObject(edge)) {
+                issues.push({ path: edgePath, message: 'must be an object with from and to' });
+                return;
+            }
+            for (const key of Object.keys(edge)) {
+                if (key !== 'from' && key !== 'to') {
+                    issues.push({ path: propertyPath(edgePath, key), message: 'unknown field' });
+                }
+            }
+            for (const side of ['from', 'to']) {
+                const value = edge[side];
+                const sidePath = `${edgePath}.${side}`;
+                if (typeof value !== 'string' || value.trim().length === 0) {
+                    issues.push({ path: sidePath, message: 'must be a non-empty slice id' });
+                    continue;
+                }
+                const issue = childCrossSlicePatternIssue(value);
+                if (issue)
+                    issues.push({ path: sidePath, message: issue });
+            }
+            if (typeof edge.from !== 'string' || typeof edge.to !== 'string')
+                return;
+            const key = `${childCrossSlicePatternKey(edge.from)}\0${childCrossSlicePatternKey(edge.to)}`;
+            if (!key.startsWith('\0') && !key.endsWith('\0')) {
+                if (seen.has(key)) {
+                    issues.push({ path: edgePath, message: 'duplicate child slice allowance' });
+                    return;
+                }
+                seen.add(key);
+            }
+        });
+    });
+}
+const ALIAS_TARGET_MESSAGE = 'must be a child of an existing universe (the universe id this rule already names, plus one child segment). A bare name, a universe id alone, an unknown universe, and a wildcard are rejected.';
+const ALIAS_OVERLAP_MESSAGE = 'overlaps a slice folder. An alias covers only files outside the slice trees.';
+const ALIAS_SAME_FILE_MESSAGE = 'two slice aliases match the same file';
+function aliasPathSegments(raw) {
+    return trimTrailingSlashes(raw.trim().replace(/\\/g, '/')).toLowerCase().split('/').filter((part) => part.length > 0);
+}
+function concreteGlobPrefix(segments) {
+    const prefix = [];
+    for (const segment of segments) {
+        if (segment.includes('*'))
+            break;
+        prefix.push(segment);
+    }
+    return prefix;
+}
+function segmentsArePrefix(prefix, full) {
+    if (prefix.length > full.length)
+        return false;
+    for (let index = 0; index < prefix.length; index += 1) {
+        if (prefix[index] !== full[index])
+            return false;
+    }
+    return true;
+}
+function anchoredSlicePrefix(entry) {
+    const segments = entry.split(/[/\\]/).filter(Boolean).map((part) => part.toLowerCase());
+    if (segments.length < 2 || segments[0] === '*' || segments[0] === '**')
+        return null;
+    if (!segments.some((part) => part === '*'))
+        return null;
+    const prefix = [];
+    for (const segment of segments) {
+        if (segment === '*' || segment === '**')
+            break;
+        if (segment.includes('*'))
+            return null;
+        prefix.push(segment);
+    }
+    return prefix.length > 0 ? prefix : null;
+}
+/** Trailing ** does not invent a slice-folder name the glob does not already reach. */
+function globOverlapsAnchored(glob, patternPrefix) {
+    const prefix = concreteGlobPrefix(glob);
+    const wild = prefix.length < glob.length;
+    const rooted = prefix[0] === 'src' || prefix[0] === 'app' ? prefix.slice(1) : prefix;
+    if (segmentsArePrefix(patternPrefix, prefix) || segmentsArePrefix(patternPrefix, rooted))
+        return true;
+    if (!wild)
+        return false;
+    return ((segmentsArePrefix(prefix, patternPrefix) && prefix.length < patternPrefix.length) ||
+        (segmentsArePrefix(prefix, ['src', ...patternPrefix]) && prefix.length < patternPrefix.length + 1) ||
+        (segmentsArePrefix(prefix, ['app', ...patternPrefix]) && prefix.length < patternPrefix.length + 1));
+}
+function globOverlapsBare(glob, name) {
+    for (let index = 0; index < glob.length; index += 1) {
+        if (glob[index] !== name && glob[index] !== '*')
+            continue;
+        const rest = glob.slice(index + 1);
+        if (rest.length >= 2)
+            return true;
+        if (rest.some((segment) => segment === '*' || segment === '**'))
+            return true;
+    }
+    const prefix = concreteGlobPrefix(glob);
+    return (prefix.length < glob.length &&
+        (prefix.length === 0 || (prefix.length === 1 && (prefix[0] === 'src' || prefix[0] === 'app'))));
+}
+function globOverlapsSliceEntry(glob, entry) {
+    const segments = entry.split(/[/\\]/).filter(Boolean).map((part) => part.toLowerCase());
+    if (segments.length === 1 && segments[0] && !segments[0].includes('*')) {
+        return globOverlapsBare(glob, segments[0]);
+    }
+    const prefix = anchoredSlicePrefix(entry);
+    return prefix ? globOverlapsAnchored(glob, prefix) : false;
+}
+function aliasGlobIssue(raw) {
+    const trimmed = trimTrailingSlashes(raw.trim().replace(/\\/g, '/'));
+    if (trimmed.length === 0)
+        return 'must be a non-empty path glob';
+    if (trimmed === '*' || trimmed === '**')
+        return 'must not cover the whole tree';
+    for (const part of trimmed.split('/')) {
+        if (part.length === 0 || part === '.' || part === '..') {
+            return 'must be a path glob without empty, . or .. segments';
+        }
+        if (part === '*' || part === '**')
+            continue;
+        if (part.includes('*') || part.includes('?') || part.includes('{') || part.includes('[')) {
+            return '* matches one whole path segment. ** is a whole segment. A partial segment is not a wildcard.';
+        }
+    }
+    return null;
+}
+function universeShapes(folders, identity) {
+    const shapes = [];
+    if (!Array.isArray(folders))
+        return shapes;
+    const stars = identity === 'stars';
+    for (const raw of folders) {
+        if (typeof raw !== 'string' || raw.length === 0)
+            continue;
+        const segments = raw.split(/[/\\]/).filter(Boolean).map((part) => part.toLowerCase());
+        if (segments.length === 1 && segments[0] && !segments[0].includes('*')) {
+            shapes.push({ literals: [segments[0], null] });
+            continue;
+        }
+        if (segments.some((part) => part === '**' || (part.includes('*') && part !== '*')))
+            continue;
+        if (!segments.includes('*'))
+            continue;
+        if (stars) {
+            let lastLiteral = -1;
+            for (let index = 0; index < segments.length; index += 1) {
+                if (segments[index] !== '*')
+                    lastLiteral = index;
+            }
+            if (lastLiteral < 0)
+                continue;
+            shapes.push({
+                literals: segments.slice(lastLiteral).map((part) => (part === '*' ? null : part)),
+            });
+            continue;
+        }
+        shapes.push({ literals: segments.map((part) => (part === '*' ? null : part)) });
+    }
+    return shapes;
+}
+function shapeMatches(shape, segments) {
+    if (shape.literals.length !== segments.length)
+        return false;
+    return shape.literals.every((literal, index) => literal === null || literal === segments[index]);
+}
+function aliasTargetIssue(raw, shapes) {
+    const trimmed = trimTrailingSlashes(raw.trim().replace(/\\/g, '/'));
+    if (trimmed.length === 0 || trimmed.split('/').some((part) => part.length === 0 || part === '.' || part === '..')) {
+        return ALIAS_TARGET_MESSAGE;
+    }
+    if (trimmed.includes('*') || !trimmed.includes('/'))
+        return ALIAS_TARGET_MESSAGE;
+    const parts = trimmed.split('/').map((part) => part.toLowerCase());
+    if (shapes.length === 0)
+        return ALIAS_TARGET_MESSAGE;
+    if (shapes.some((shape) => shapeMatches(shape, parts)))
+        return ALIAS_TARGET_MESSAGE;
+    if (shapes.some((shape) => shapeMatches(shape, parts.slice(0, -1))))
+        return null;
+    return ALIAS_TARGET_MESSAGE;
+}
+/** A leading src/ or app/ is optional at match time, so both spellings are one glob. */
+function aliasGlobVariants(segments) {
+    const head = segments[0];
+    if ((head === 'src' || head === 'app') && segments.length > 1)
+        return [segments, segments.slice(1)];
+    return [segments];
+}
+function aliasesCanMatchSameFile(left, right) {
+    const leftVariants = aliasGlobVariants(left);
+    const rightVariants = aliasGlobVariants(right);
+    for (const a of leftVariants) {
+        if (globsCanMatchSame(a, right, 0, 0, new Map()))
+            return true;
+    }
+    for (const b of rightVariants) {
+        if (globsCanMatchSame(left, b, 0, 0, new Map()))
+            return true;
+    }
+    return false;
+}
+function globsCanMatchSame(left, right, i, j, memo) {
+    const key = `${i}:${j}`;
+    const cached = memo.get(key);
+    if (cached !== undefined)
+        return cached;
+    let matched = false;
+    if (i === left.length && j === right.length)
+        matched = true;
+    else if (i < left.length && left[i] === '**') {
+        matched =
+            globsCanMatchSame(left, right, i + 1, j, memo) ||
+                (j < right.length && globsCanMatchSame(left, right, i, j + 1, memo));
+    }
+    else if (j < right.length && right[j] === '**') {
+        matched =
+            globsCanMatchSame(left, right, i, j + 1, memo) ||
+                (i < left.length && globsCanMatchSame(left, right, i + 1, j, memo));
+    }
+    else if (i < left.length && j < right.length) {
+        const a = left[i];
+        const b = right[j];
+        if (a === b || a === '*' || b === '*')
+            matched = globsCanMatchSame(left, right, i + 1, j + 1, memo);
+    }
+    memo.set(key, matched);
+    return matched;
+}
+function validateChildSliceAliases(candidate, issues) {
+    const rules = candidate.rules;
+    if (!Array.isArray(rules))
+        return;
+    rules.forEach((rule, index) => {
+        if (!isObject(rule))
+            return;
+        const child = rule.childSlices;
+        if (!isObject(child) || child.sliceAliases === undefined)
+            return;
+        const aliases = child.sliceAliases;
+        const path = `$.rules[${index}].childSlices.sliceAliases`;
+        if (!Array.isArray(aliases)) {
+            issues.push({ path, message: 'must be an array of { from, to } slice aliases' });
+            return;
+        }
+        const shapes = universeShapes(rule.sliceFolders, rule.sliceIdentity);
+        const sliceEntries = [
+            ...(Array.isArray(rule.sliceFolders) ? rule.sliceFolders : []),
+            ...(Array.isArray(child.sliceFolders) ? child.sliceFolders : []),
+        ].filter((entry) => typeof entry === 'string' && entry.length > 0);
+        const globs = [];
+        aliases.forEach((alias, aliasIndex) => {
+            const aliasPath = `${path}[${aliasIndex}]`;
+            if (!isObject(alias)) {
+                issues.push({ path: aliasPath, message: 'must be an object with from and to' });
+                return;
+            }
+            for (const key of Object.keys(alias)) {
+                if (key !== 'from' && key !== 'to') {
+                    issues.push({ path: propertyPath(aliasPath, key), message: 'unknown field' });
+                }
+            }
+            const from = alias.from;
+            const to = alias.to;
+            if (typeof from !== 'string' || from.trim().length === 0) {
+                issues.push({ path: `${aliasPath}.from`, message: 'must be a non-empty path glob' });
+            }
+            else {
+                const issue = aliasGlobIssue(from);
+                if (issue)
+                    issues.push({ path: `${aliasPath}.from`, message: issue });
+                else {
+                    const segments = aliasPathSegments(from);
+                    if (sliceEntries.some((entry) => globOverlapsSliceEntry(segments, entry))) {
+                        issues.push({ path: `${aliasPath}.from`, message: ALIAS_OVERLAP_MESSAGE });
+                    }
+                    for (const previous of globs) {
+                        if (aliasesCanMatchSameFile(previous, segments)) {
+                            issues.push({ path: aliasPath, message: ALIAS_SAME_FILE_MESSAGE });
+                            break;
+                        }
+                    }
+                    globs.push(segments);
+                }
+            }
+            if (typeof to !== 'string' || to.trim().length === 0) {
+                issues.push({ path: `${aliasPath}.to`, message: ALIAS_TARGET_MESSAGE });
+            }
+            else {
+                const issue = aliasTargetIssue(to, shapes);
+                if (issue)
+                    issues.push({ path: `${aliasPath}.to`, message: issue });
+            }
+        });
+    });
+}
 function validateLayerOwners(candidate, issues) {
     const layers = candidate.layers;
     if (!Array.isArray(layers))
@@ -525,6 +1001,9 @@ export function loadArkConfigContract(input, source = 'ark.config.json') {
     validateArkRunExtra(candidate, issues);
     validateArkOrderExtra(candidate, issues);
     validateLayerOwners(candidate, issues);
+    validateChildSliceSiblings(candidate, issues);
+    validateChildSliceAllowedCrossSlice(candidate, issues);
+    validateChildSliceAliases(candidate, issues);
     if (issues.length > 0)
         throw new ArkConfigValidationError(source, issues);
     return { config: candidate, migratedFrom };
@@ -557,3 +1036,15 @@ export function withArkConfigMetadata(config) {
     }
     return result;
 }
+/**
+ * Trim trailing slashes without a regex.
+ *
+ * `/\/+$/` is a polynomial ReDoS on a value that comes from the repo's own
+ * contract but is still library input. A scan is linear and says the same thing.
+ */
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/')
+        end -= 1;
+    return value.slice(0, end);
+}

package/bin/lib/diagnostic-catalog.mjs

@@ -121,6 +121,9 @@ export const DIAGNOSTIC_CATALOG = Object.freeze([
     entry('CONFIG_UNCLASSIFIED_FILES', 'config', 'Unclassified included files', 'Included source files match no layer pattern; import rules will not enforce on them.', 'Extend layer patterns or narrow include so every governed file is classified.', { oftenAdvisory: true }),
     entry('CONFIG_LAYER_MISSING_OWNER', 'config', 'Layer missing owner', 'requireLayerOwners is on and this layer has no owners. Writes to that house fail closed, like a folder with no name on the door.', 'Add a GitHub handle or email to that layer’s owners in ark.config.json (/ark-adopt), then re-run. Reserved/allowEmpty houses may stay unnamed. Turn the flag off only if you no longer want owners required.'),
     entry('CONFIG_SLICE_IDENTITY_COLLISION', 'config', 'Starred slice prefixes share one id', 'sliceIdentity is stars and two different sliceFolders prefixes bind as the same slice id. Parallel trees of one feature do that on purpose; unrelated trees that share the last folder name merge by accident.', 'Keep stars when those prefixes are one feature. Otherwise use path, or rename the last literal so the prefixes do not bind as the same id. Doctor names both paths.', { oftenAdvisory: true }),
+    entry('CONFIG_CHILD_SLICES_VERSION', 'config', 'childSlices needs a newer arkgate', 'The rule schema sets additionalProperties to false. arkgate 4.8.22 and older reject a config that contains childSlices instead of ignoring the key.', 'Pin arkgate newer than 4.8.22 before shipping a config that sets childSlices. This warning does not fail the check.', { oftenAdvisory: true }),
+    entry('CONFIG_CHILD_SLICE_EXTENDS', 'config', 'Child slice id does not extend its universe', 'A path resolved a child id that is not the universe id plus a further segment. The child wall does not treat that id as a child, so the edge is universe common until the folders line up.', 'Point childSlices.sliceFolders at children under the same universe id the outer sliceFolders already names. Doctor names the path.', { oftenAdvisory: true }),
+    entry('CONFIG_CHILD_SLICE_CROSS_UNIVERSE', 'config', 'Child slice allowance cannot cross the universe wall', 'childSlices.allowedCrossSlice names a pattern that can match two universes. That list clears only a sibling crossing inside one universe. The universe wall still denies the edge.', 'Narrow the pattern so both sides share one universe prefix (features/projects/* to features/projects/d2d-item), or remove the entry. This warning does not fail the check.', { oftenAdvisory: true }),
     // ── literal path drift ───────────────────────────────────────────────────
     entry('LITERAL_PATH_DRIFT', 'drift', 'Literal path moved by a rename', 'A repo path written inside a string, a comment or a docstring no longer resolves, and the rename set says where it went. Nothing in the gate sees this class: `tsc` resolves imports, not strings, and ESLint does not either, so the rename compiles green and the reference lies afterwards. It appears in four forms — the tsconfig alias, a relative literal, a path written without the include-root prefix, and prose — and a hand sweep reliably covers one of them.', 'Apply the suggested replacement, or re-run `npx arkgate-check --path-drift --base-ref <ref> --write` to apply every writable anchored replacement at once. The rewrite is mechanical and one-directional: the destination comes from the rename, it must itself resolve and be path-shaped, and the token is rewritten in the form the author wrote it in. A destination that leaves the alias root of the literal is reported with the target only and must be rewritten by hand.'),
     entry('LITERAL_PATH_UNRESOLVED', 'drift', 'Literal path does not resolve', 'A literal that looks like a repo path does not resolve under this root, and no rename explains where it went. Unlike LITERAL_PATH_DRIFT this is a candidate, not a verdict: with nothing to anchor it, ArkGate cannot tell a dead reference from an illustrative path in a comment, an example in documentation, or a path belonging to another tree.', 'Read the candidate and decide: fix the path, or leave it. Advisory only — it never fails a run and is never rewritten by --write, because there is no destination to propose. Run `--path-drift --all` to list the sweep.', { oftenAdvisory: true }),
@@ -183,3 +186,32 @@ export function catalogFixForRuleId(ruleId) {
 export function catalogWhyForRuleId(ruleId) {
     return getDiagnosticCatalogEntry(ruleId)?.why;
 }
+export const SLICE_REASON_HINTS = Object.freeze([
+    Object.freeze({
+        reasonId: 'CROSS_PARENT_SLICE',
+        ruleId: 'LAYER_IMPORT_VIOLATION',
+        title: 'Cross-universe slice',
+        why: 'This import crosses two universe slices. The child wall cannot allow another universe.',
+        fix: 'Keep the import inside one universe, or move the shared code into a folder both universes may use.',
+    }),
+    Object.freeze({
+        reasonId: 'CROSS_SIBLING_SLICE',
+        ruleId: 'LAYER_IMPORT_VIOLATION',
+        title: 'Cross-sibling slice',
+        why: 'This import crosses two feature slices inside one universe.',
+        fix: 'Import universe-common code, or move the shared piece into the feature that owns it. An enforce list makes those importer subtrees errors. Other sibling crossings stay warnings, and a new one past the baseline still fails.',
+    }),
+    Object.freeze({
+        reasonId: 'CROSS_PARENT_VIA_SHARED',
+        ruleId: 'LAYER_IMPORT_VIOLATION',
+        title: 'Cross-universe through a shared root',
+        why: 'A slice reaches another universe only through a shared root. ark-check and CI report this path. The write hook and ESLint see one edge at a time and do not block it.',
+        fix: 'Stop the shared root from importing the other universe, or move that import into the universe that owns it. A shared hop that stays inside one universe is allowed.',
+    }),
+]);
+const SLICE_REASON_BY_ID = new Map(SLICE_REASON_HINTS.map((hint) => [hint.reasonId, hint]));
+export function sliceReasonHint(reasonId) {
+    if (typeof reasonId !== 'string' || reasonId.length === 0)
+        return undefined;
+    return SLICE_REASON_BY_ID.get(reasonId);
+}

package/bin/lib/doctor-advisories.mjs

@@ -11,6 +11,7 @@ import {
   computePhysicalCohesion,
   printPhysicalCohesionSection,
 } from './physical-cohesion.mjs';
+import { collectFlatParentPilot, printFlatParentPilot } from './flat-parent-pilot.mjs';
 import {
   computeDecisionAwareReshapePilot,
   computeReshapeDecisionMemory,
@@ -37,7 +38,7 @@ import {
 } from './ark-order-doctor.mjs';
 import { composeMergePlanesHonesty } from './extra-merge-teeth.mjs';
 import { collectPrototypeShortcutsResidual } from './prototype-shortcuts.mjs';
-import { sliceIdentityCollisions } from '../ark-layer-match.mjs';
+import { sliceAliasReport, sliceCountReport, sliceIdentityCollisions } from '../ark-layer-match.mjs';
 
 export function attachExtraDoctorSections(rulesUnderContract, config, classification, findings) {
   const arkRulesMerge = {
@@ -130,6 +131,12 @@ export function printCompactExtraDoctorLines(advisories, io) {
       io.line(io.warn, collision.message);
     }
   }
+  const flatMoves = advisories?.flatParentPilot?.moves;
+  if (Array.isArray(flatMoves) && flatMoves.length > 0 && typeof flatMoves[0]?.evidence === 'string') {
+    console.log('');
+    io.line(io.warn, flatMoves[0].evidence);
+    if (flatMoves.length > 1) io.line(' ', `${flatMoves.length - 1} more flat-parent suggestion(s) in --doctor --all`);
+  }
   const noDomain = advisories?.noDomainFrontend;
   if (noDomain?.ask) {
     console.log('');
@@ -189,6 +196,31 @@ export function printCompactExtraDoctorLines(advisories, io) {
   }
 }
 
+function stripEdgeSlashes(value, edge) {
+  let start = 0;
+  let end = value.length;
+  if (edge !== 'end') {
+    while (start < end && value[start] === '/') start += 1;
+  }
+  if (edge !== 'start') {
+    while (end > start && value[end - 1] === '/') end -= 1;
+  }
+  return value.slice(start, end);
+}
+
+/** Governed file lists are absolute. Alias globs are project-relative. */
+function aliasScanPath(root, entry) {
+  const raw = typeof entry === 'string' ? entry : typeof entry?.path === 'string' ? entry.path : '';
+  if (!raw) return null;
+  const norm = raw.replace(/\\/g, '/');
+  const base = stripEdgeSlashes(String(root ?? '').replace(/\\/g, '/'), 'end');
+  const rel =
+    base && (norm === base || norm.startsWith(`${base}/`))
+      ? stripEdgeSlashes(norm.slice(base.length), 'start')
+      : stripEdgeSlashes(norm, 'start');
+  return rel.length > 0 ? rel : null;
+}
+
 function classificationFromCoverage(cov) {
   return {
     governedPercent: cov?.governed?.percent ?? null,
@@ -256,7 +288,23 @@ export function computeDoctorAdvisories(root, config, cov, rules, files, ts, par
     files,
   });
   const sliceIdentityHits = sliceIdentityCollisions(rules ?? config?.rules);
+  const slices = sliceCountReport(activeViolations);
+  const aliasFiles = [];
+  for (const entry of Array.isArray(files) ? files : []) {
+    const rel = aliasScanPath(root, entry);
+    if (rel) aliasFiles.push(rel);
+  }
+  const sliceAliases = sliceAliasReport(rules ?? config?.rules, aliasFiles);
+  const flatParentPilot = collectFlatParentPilot({
+    root,
+    files: aliasFiles,
+    rules: rules ?? config?.rules,
+    layers: config?.layers,
+  });
   return {
+    ...(slices ? { slices } : {}),
+    ...(sliceAliases ? { sliceAliases } : {}),
+    ...(flatParentPilot ? { flatParentPilot } : {}),
     ...(prototypeShortcuts ? { prototypeShortcuts } : {}),
     ...(sliceIdentityHits.length > 0
       ? { sliceIdentity: { notAScore: true, collisions: sliceIdentityHits } }
@@ -277,6 +325,17 @@ export function computeDoctorAdvisories(root, config, cov, rules, files, ts, par
 }
 
 export function printDoctorAdvisories(advisories, io) {
+  printFlatParentPilot(advisories?.flatParentPilot, io);
+  const sliceAliases = advisories?.sliceAliases;
+  if (sliceAliases && sliceAliases.notAScore === true && Array.isArray(sliceAliases.moves)) {
+    console.log('');
+    console.log(io.color.bold('Slice aliases (owed move)'));
+    io.line(io.warn, sliceAliases.debt);
+    for (const move of sliceAliases.moves) {
+      io.line(io.warn, `${move.from} → ${move.to}. Move these files to ${move.destination}. They are not finished.`);
+      for (const file of move.files ?? []) io.line(' ', file);
+    }
+  }
   const sliceIdentity = advisories?.sliceIdentity;
   if (Array.isArray(sliceIdentity?.collisions) && sliceIdentity.collisions.length > 0) {
     console.log('');