arkgate 4.8.23 → 4.8.25

package/bin/lib/status-command.mjs

@@ -17,6 +17,7 @@ import {
   unavailableStatusImprovementCompass,
 } from './status-manifest.mjs';
 import { createProjectId } from './project-identity.mjs';
+import { parseArkConfigJson } from './config-contract.mjs';
 import { resolveEffectiveProjectRoot } from './project-root.mjs';
 import { detectWritePathCapabilities } from './write-path-detect.mjs';
 import { buildWritePathHonesty } from './enforcement-honesty.mjs';
@@ -29,6 +30,7 @@ import { projectStatusArkRun } from './ark-run-doctor.mjs';
 import { projectStatusArkOrder } from './ark-order-doctor.mjs';
 import { collectVsBaseFacts, discoverTeamBaseRef } from './team-parliament-io.mjs';
 import { classifyAdopted, readAdoptionStance } from './adoption-stance.mjs';
+import { lastCheckVerdictFacts } from './upstream-report.mjs';
 
 function sha256Hex(value) {
   return createHash('sha256').update(value, 'utf8').digest('hex');
@@ -114,24 +116,7 @@ export function lastCheckFactsFromSnapshot(latest, baseline) {
       frozenResidual,
     };
   }
-  const at =
-    typeof latest.generatedAt === 'string'
-      ? latest.generatedAt
-      : typeof latest.at === 'string'
-        ? latest.at
-        : null;
-  const active =
-    typeof latest.activeViolations === 'number'
-      ? latest.activeViolations
-      : typeof latest.violations?.active === 'number'
-        ? latest.violations.active
-        : null;
-  let verdict = null;
-  if (latest.ok === true && (active == null || active === 0)) verdict = 'pass';
-  else if (latest.ok === false || (typeof active === 'number' && active > 0)) verdict = 'fail';
-  else if (latest.completeness === 'partial' || latest.completeness === 'unavailable') {
-    verdict = 'incomplete';
-  } else if (latest.ok === true) verdict = 'pass';
+  const { at, active, verdict } = lastCheckVerdictFacts(latest);
   return {
     lastCheckAt: at,
     lastCheckVerdict: verdict,
@@ -158,7 +143,7 @@ export function statusCompassFromSnapshot(latest, opts = {}) {
     return unavailableStatusImprovementCompass({
       reasonCode: 'NO_SESSION_SNAPSHOT',
       reason:
-        'No session report snapshot yet — run ark-check --doctor or --report for residual lenses. Status never invents green.',
+        'No session report snapshot yet — run ark-check --report to write the session snapshot (--doctor shows full lenses but does not write it). Status never invents green.',
       contractHash,
     });
   }
@@ -189,7 +174,7 @@ export function statusCompassFromSnapshot(latest, opts = {}) {
       reasonCode: complete ? undefined : 'FACTS_PARTIAL',
       reason: complete
         ? undefined
-        : 'Session snapshot residual is partial — re-run doctor/report for full compass.',
+        : 'Session snapshot residual is partial — re-run ark-check --report for full compass.',
       factsSource: 'report-snapshot',
       contractHash,
     });
@@ -198,7 +183,7 @@ export function statusCompassFromSnapshot(latest, opts = {}) {
   return unavailableStatusImprovementCompass({
     reasonCode: 'NO_SESSION_SNAPSHOT',
     reason:
-      'Session snapshot has no improvement compass facts — run ark-check --doctor or --report. Status never invents green.',
+      'Session snapshot has no improvement compass facts — run ark-check --report to refresh the session snapshot. Status never invents green.',
     contractHash,
   });
 }
@@ -242,6 +227,24 @@ export function thinStatusCompassFromDoctor(doctorCompass, opts = {}) {
  *   contractHash?: string | null,
  * }} [options]
  */
+/**
+ * Run the shared contract validator (same rules as ark-check / MCP / ESLint).
+ * @param {string} text
+ * @param {string} source
+ * @returns {string[]} `<path>: <message>` lines; empty when valid
+ */
+function validateConfigText(text, source) {
+  try {
+    parseArkConfigJson(text, source);
+    return [];
+  } catch (error) {
+    if (Array.isArray(error?.issues) && error.issues.length > 0) {
+      return error.issues.map((issue) => `${issue.path}: ${issue.message}`);
+    }
+    return [error instanceof Error ? error.message : String(error)];
+  }
+}
+
 export function collectStatusFacts(options = {}) {
   const startRoot = path.resolve(options.root || process.cwd());
   const configName = options.config || 'ark.config.json';
@@ -256,12 +259,17 @@ export function collectStatusFacts(options = {}) {
   const configExists = fs.existsSync(configPath);
 
   let config = null;
+  /** Shared contract validator messages — status must not look authoritative-green on a config every gate refuses. */
+  let configErrors = [];
   if (configExists) {
+    let text = '';
     try {
-      config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+      text = fs.readFileSync(configPath, 'utf8');
+      config = JSON.parse(text);
     } catch {
       config = null;
     }
+    configErrors = validateConfigText(text, path.basename(configPath));
   }
 
   const projectId = configExists
@@ -390,6 +398,7 @@ export function collectStatusFacts(options = {}) {
     arkgateVersion: options.arkgateVersion || packageVersion(),
     resolvedRoot: realpathOrResolve(resolvedRoot),
     resolvedConfigPath: configExists ? realpathOrResolve(configPath) : null,
+    configErrors,
     projectId,
     expectation,
     expectedRootRelation,
@@ -564,6 +573,10 @@ export function runStatusCommand(args = {}) {
             ' · not a score'
         );
       }
+      if (manifest.contract?.valid === false) {
+        write(`  contract: invalid (${manifest.contract.errors.length} issue(s)) — every enforcing surface refuses this config`);
+        for (const issue of manifest.contract.errors.slice(0, 5)) write(`    - ${issue}`);
+      }
       write(`  next: [${manifest.nextAction.id}] ${manifest.nextAction.summary}`);
     }
 

package/bin/lib/status-manifest.mjs

@@ -10,6 +10,22 @@
 
 import { projectStatusArkRun } from './ark-run-doctor.mjs';
 import { projectStatusArkOrder } from './ark-order-doctor.mjs';
+/** Status slice schema of one extra plane (ArkRun / ArkOrder). */
+function extraPlaneStatusSchema(plane) {
+    return {
+        type: 'object',
+        description: `${plane} extra residual (notAScore). present/mode from config; residual is a finding-id count (null = unknown, not green). extraMergeTeeth is honesty, never a score.`,
+        additionalProperties: false,
+        required: ['notAScore', 'present', 'mode', 'extraMergeTeeth', 'residual'],
+        properties: {
+            notAScore: { const: true },
+            present: { type: 'boolean' },
+            mode: { anyOf: [{ enum: ['advisory', 'enforced'] }, { type: 'null' }] },
+            extraMergeTeeth: { type: 'boolean' },
+            residual: { anyOf: [{ type: 'integer', minimum: 0 }, { type: 'null' }] },
+        },
+    };
+}
 export const ARK_STATUS_MANIFEST_SCHEMA_VERSION = '1.0';
 export const ARK_STATUS_MANIFEST_SCHEMA_URL = 'https://unpkg.com/arkgate@4/schemas/ark.status-manifest.schema.json';
 /**
@@ -175,6 +191,11 @@ export function defaultHonestLabel(writePath, host) {
  * Deterministic next action from residual facts (no LLM).
  * Prefer explicit override from productHonesty when provided.
  */
+function normalizedConfigErrors(errors) {
+    if (!Array.isArray(errors))
+        return [];
+    return errors.filter((entry) => typeof entry === 'string' && entry.length > 0);
+}
 export function resolveStatusNextAction(facts, binding, activation, lastCheck, rules) {
     if (facts.nextActionOverride?.id && facts.nextActionOverride.summary) {
         return {
@@ -202,22 +223,31 @@ export function resolveStatusNextAction(facts, binding, activation, lastCheck, r
             summary: 'No ark.config.json found — run ark start (preview) then ark start --apply.',
         };
     }
+    const configErrors = normalizedConfigErrors(facts.configErrors);
+    if (configErrors.length > 0) {
+        return {
+            id: 'fix-config',
+            summary: `The Ark config is invalid, so ark-check, MCP and ESLint refuse it — fix: ${configErrors
+                .slice(0, 3)
+                .join('; ')}${configErrors.length > 3 ? ` (+${configErrors.length - 3} more)` : ''}`,
+        };
+    }
     if (lastCheck.verdict === 'fail' || (lastCheck.activeViolations ?? 0) > 0) {
         return {
             id: 'fix-active-violations',
-            summary: `Clear ${lastCheck.activeViolations ?? 'active'} blocking architecture finding(s), then re-run ark-check (or ark-check --doctor).`,
+            summary: `Clear ${lastCheck.activeViolations ?? 'active'} blocking architecture finding(s), then re-run ark-check --report to refresh the last-check snapshot (a plain check or --doctor does not update .ark/reports/latest.json).`,
         };
     }
     if (lastCheck.verdict === 'incomplete') {
         return {
             id: 'restore-complete-analysis',
-            summary: 'Last check was incomplete — restore TypeScript/analysis inputs and re-run ark-check.',
+            summary: 'Last check was incomplete — restore TypeScript/analysis inputs and re-run ark-check --report to refresh the snapshot.',
         };
     }
     if (lastCheck.verdict == null && lastCheck.at == null) {
         return {
             id: 'run-ark-check',
-            summary: 'No last-check snapshot yet — run ark-check --report (or --doctor) to freeze session evidence.',
+            summary: 'No last-check snapshot yet — run ark-check --report to freeze session evidence (--doctor does not write the snapshot).',
         };
     }
     if (activation.writePath === 'unavailable') {
@@ -334,6 +364,10 @@ export function buildStatusManifest(facts) {
         rules,
         nextAction: resolveStatusNextAction(facts, binding, activation, lastCheck, rules),
     };
+    const configErrors = normalizedConfigErrors(facts.configErrors);
+    if (projectIdentity.resolvedConfigPath && configErrors.length > 0) {
+        status.contract = { valid: false, errors: configErrors };
+    }
     const compass = normalizeStatusImprovementCompass(facts.improvementCompass);
     if (compass)
         status.improvementCompass = compass;
@@ -433,7 +467,7 @@ export function unavailableStatusImprovementCompass(input = {}) {
         topResidual: [],
         reasonCode: input.reasonCode ?? STATUS_COMPASS_REASON_CODES.NO_SESSION_SNAPSHOT,
         reason: input.reason ??
-            'No session compass facts yet — run ark-check --doctor or --report for residual lenses. Status never invents green.',
+            'No session compass facts yet — run ark-check --report to write the session snapshot (--doctor shows full lenses but does not write it). Status never invents green.',
         factsSource: 'none',
         contractHash: input.contractHash,
     });
@@ -591,6 +625,16 @@ export const ARK_STATUS_MANIFEST_SCHEMA = {
                 summary: { type: 'string', minLength: 1 },
             },
         },
+        contract: {
+            type: 'object',
+            description: 'Present only when the resolved config fails the shared contract validator (the same fail-closed rules ark-check, MCP and ESLint apply).',
+            additionalProperties: false,
+            required: ['valid', 'errors'],
+            properties: {
+                valid: { const: false },
+                errors: { type: 'array', minItems: 1, items: { type: 'string', minLength: 1 } },
+            },
+        },
         improvementCompass: {
             type: 'object',
             description: 'Thin improvement-compass residual ids with honesty mode (notAScore). full | subset | unavailable. Never a gate input; full lenses on doctor JSON. When full, residual ids ⊆ doctor residual for the same facts. unavailable never invents green residual.',
@@ -625,31 +669,7 @@ export const ARK_STATUS_MANIFEST_SCHEMA = {
                 baselineGrew: { type: 'boolean' },
             },
         },
-        arkRun: {
-            type: 'object',
-            description: 'ArkRun extra residual (notAScore). present/mode from config; residual is a finding-id count (null = unknown, not green). extraMergeTeeth is honesty, never a score.',
-            additionalProperties: false,
-            required: ['notAScore', 'present', 'mode', 'extraMergeTeeth', 'residual'],
-            properties: {
-                notAScore: { const: true },
-                present: { type: 'boolean' },
-                mode: { anyOf: [{ enum: ['advisory', 'enforced'] }, { type: 'null' }] },
-                extraMergeTeeth: { type: 'boolean' },
-                residual: { anyOf: [{ type: 'integer', minimum: 0 }, { type: 'null' }] },
-            },
-        },
-        arkOrder: {
-            type: 'object',
-            description: 'ArkOrder extra residual (notAScore). present/mode from config; residual is a finding-id count (null = unknown, not green). extraMergeTeeth is honesty, never a score.',
-            additionalProperties: false,
-            required: ['notAScore', 'present', 'mode', 'extraMergeTeeth', 'residual'],
-            properties: {
-                notAScore: { const: true },
-                present: { type: 'boolean' },
-                mode: { anyOf: [{ enum: ['advisory', 'enforced'] }, { type: 'null' }] },
-                extraMergeTeeth: { type: 'boolean' },
-                residual: { anyOf: [{ type: 'integer', minimum: 0 }, { type: 'null' }] },
-            },
-        },
+        arkRun: extraPlaneStatusSchema('ArkRun'),
+        arkOrder: extraPlaneStatusSchema('ArkOrder'),
     },
 };

package/bin/lib/status-transition-catalog.mjs

@@ -17,12 +17,6 @@ import { layerForFile } from '../ark-shared.mjs';
 import { isDomainRoleLayerName } from './arkrules-sensors.mjs';
 import { collectStatesTransitionsResidual } from './states-transitions-presence.mjs';
 
-export const STATUS_CATALOG_ASK =
-  'Domain code already names statuses, but the states → transitions map is still thin.';
-
-export const STATUS_CATALOG_NEXT =
-  'Add those names to the table on the domain doc (entity · states · allowed from → to). No flag soup.';
-
 const SOURCE_EXT = new Set(['.ts', '.tsx', '.mts', '.cts', '.js', '.mjs', '.cjs']);
 const MAX_FILE_BYTES = 200_000;
 const MAX_ENTITIES = 8;

package/bin/lib/suggestions.mjs

@@ -19,7 +19,7 @@ export function dirSegmentsFromGlob(pattern) {
  * Basename / path tokens that score as Persistence (data clients, auth, CRM).
  * Used so adopt never maps lib/turso → Presentation (NEW-ADOPT-LIB-AS-PRESENTATION).
  */
-export const PERSISTENCE_PATH_TOKENS = Object.freeze([
+const PERSISTENCE_PATH_TOKENS = Object.freeze([
   'turso',
   'prisma',
   'supabase',
@@ -64,7 +64,7 @@ export function isPersistenceClientPath(relPath) {
 }
 
 /** True when a path looks like pure domain folders. */
-export function isDomainPath(relPath) {
+function isDomainPath(relPath) {
   const posix = String(relPath || '')
     .split(/[/\\]/)
     .filter(Boolean)
@@ -81,7 +81,7 @@ let _layerByDir;
 // Map<dirBasename, string[] layers>. A basename mapping to >1 layer (e.g. `app` — Application
 // orchestration in the 11-layer defaults, but Presentation in the monorepo/Next preset) is
 // genuinely ambiguous; every candidate is surfaced rather than silently picked.
-export function layerByDir() {
+function layerByDir() {
   if (_layerByDir) return _layerByDir;
   const map = new Map();
   const add = (segment, layer) => {

package/bin/lib/team-parliament-io.mjs

@@ -2,11 +2,10 @@
  * Team parliament I/O — git base refs, changed paths, pin/contract/baseline compare.
  * Pure classification lives in team-parliament.mjs (Domain).
  */
-import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
-import { applyAdvisorySiblingRatchet } from '../ark-layer-match.mjs';
+import { applyAdvisorySiblingRatchet, globToRegExp } from '../ark-layer-match.mjs';
 import {
   baselineKeysFromDocument,
   classifyBaselineKeyDelta,
@@ -20,39 +19,17 @@ import {
   resolveStewardHandle,
   suggestStewards,
 } from './team-parliament.mjs';
+import {
+  TEAM_BASE_CANDIDATES,
+  discoverTeamBaseRef,
+  gitShowText,
+  listChangedPaths,
+  runGit,
+  safeGitRef,
+} from './git-change-scope.mjs';
 
-export {
-  baselineKeysFromDocument,
-  classifyBaselineKeyDelta,
-  classifyChangeSet,
-  evaluateTeamGate,
-  formatVsBaseLine,
-  isTeamPersona,
-  mapPolicyClassToKind,
-  parseCodeownersHandles,
-  personaCheckBudget,
-  resolveStewardHandle,
-  suggestStewards,
-};
-
-/** Kill hung git instead of stalling CI. */
-export const SPAWN_TIMEOUT_MS = 8000;
-
-function runGit(cwd, args) {
-  return spawnSync('git', ['-C', cwd, ...args], {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-    timeout: SPAWN_TIMEOUT_MS,
-  });
-}
-
-export function safeGitRef(value) {
-  return (
-    typeof value === 'string' &&
-    /^[A-Za-z0-9][A-Za-z0-9._/-]{0,200}$/.test(value) &&
-    !value.includes('..')
-  );
-}
+// prettier-ignore
+export { discoverTeamBaseRef, safeGitRef };
 
 export function contractSessionFrom(args, env = process.env) {
   if (args?.contractSession === true) return true;
@@ -70,49 +47,6 @@ export function resolveTeamAuthor(args, env = process.env) {
   });
 }
 
-export function discoverTeamBaseRef(root, preferred) {
-  if (safeGitRef(preferred)) return preferred;
-  const candidates = ['origin/dev', 'origin/main', 'origin/master', 'dev', 'main'];
-  for (const candidate of candidates) {
-    const exists = runGit(root, ['rev-parse', '--verify', `${candidate}^{commit}`]);
-    if (exists.status === 0) return candidate;
-  }
-  return null;
-}
-
-export function listChangedPaths(root, baseRef) {
-  if (!safeGitRef(baseRef)) {
-    return { ok: false, paths: [], error: 'Invalid or missing git base ref.' };
-  }
-  const verify = runGit(root, ['rev-parse', '--verify', `${baseRef}^{commit}`]);
-  if (verify.status !== 0) {
-    return { ok: false, paths: [], error: `Cannot resolve git ref ${baseRef}.` };
-  }
-  const diff = runGit(root, ['diff', '--name-only', `${baseRef}...HEAD`]);
-  const unstaged = runGit(root, ['diff', '--name-only']);
-  const staged = runGit(root, ['diff', '--name-only', '--cached']);
-  const untracked = runGit(root, ['ls-files', '--others', '--exclude-standard']);
-  if (diff.status !== 0) {
-    return { ok: false, paths: [], error: diff.stderr.trim() || `git diff ${baseRef} failed.` };
-  }
-  const paths = [
-    ...diff.stdout.split('\n'),
-    ...unstaged.stdout.split('\n'),
-    ...staged.stdout.split('\n'),
-    ...untracked.stdout.split('\n'),
-  ]
-    .map((line) => line.trim().replace(/\\/g, '/'))
-    .filter(Boolean);
-  return { ok: true, paths: [...new Set(paths)].sort(), error: null };
-}
-
-export function gitShowText(root, baseRef, relPath) {
-  if (!safeGitRef(baseRef) || !relPath) return null;
-  const shown = runGit(root, ['show', `${baseRef}:${relPath}`]);
-  if (shown.status !== 0) return null;
-  return shown.stdout;
-}
-
 export function readJsonMaybe(text) {
   if (typeof text !== 'string' || !text.trim()) return null;
   try {
@@ -193,8 +127,11 @@ export function bindTeamBaseRefs(args, root) {
     if (!next.against && (next.changed || next.contractDiff || next.persona)) {
       next.against = teamBase;
     }
-    if (!next.policyBaseRef && (next.contractDiff || next.changed || next.against)) {
+    // A contract session must classify the law change, or loosening skips steward/ack checks.
+    // policyBaseFromTeam: a base without the contract yet is adoption (no predecessor), not an error.
+    if (!next.policyBaseRef && (next.contractDiff || next.changed || next.against || next.contractSession)) {
       next.policyBaseRef = teamBase;
+      next.policyBaseFromTeam = true;
     }
     if (!next.baseRef && next.failOnNewSmells) next.baseRef = teamBase;
   }
@@ -236,17 +173,28 @@ export function runTeamPreflight({ root, args, config, policyDelta, teamBase })
     return { halt: null, teamParliament: null, changedPaths: [] };
   }
   const againstRef = args.against || teamBase;
-  if (args.local && !againstRef) {
-    const message =
-      '--local needs a git merge base so it can reuse --changed. Pass --base <ref> (for example --base HEAD or --base origin/main). The merge gate stays --strict-merge.';
-    const teamParliament = { deny: false, reasonId: 'local-needs-base', message };
+  if ((args.local || args.changed || args.contractDiff) && !againstRef) {
+    const reasonId = args.local
+      ? 'local-needs-base'
+      : args.changed
+        ? 'changed-needs-base'
+        : 'contract-diff-needs-base';
+    const message = args.local
+      ? '--local needs a git merge base so it can reuse --changed. Pass --base <ref> (for example --base HEAD or --base origin/main). The merge gate stays --strict-merge.'
+      : args.changed
+        ? changedNeedsBaseMessage(args)
+        : contractDiffNeedsBaseMessage(args);
+    const teamParliament = { deny: false, reasonId, message };
     return {
       halt: { exitCode: 2, message, teamParliament },
       teamParliament,
       changedPaths: [],
     };
   }
-  const listed = againstRef ? listChangedPaths(root, againstRef) : { ok: true, paths: [], error: null };
+  // No base ref means the change set was never computed: never report it as empty.
+  const listed = againstRef
+    ? listChangedPaths(root, againstRef)
+    : { ok: false, paths: [], error: 'No git base ref resolved.' };
   const changedPaths = listed.ok ? listed.paths : [];
   const changeSet = classifyChangeSet(changedPaths);
   const baseBaselineRaw = againstRef
@@ -279,8 +227,12 @@ export function runTeamPreflight({ root, args, config, policyDelta, teamBase })
     changedPathError: listed.ok ? null : listed.error,
   };
   if (!listed.ok && (args.changed || args.against || args.contractDiff)) {
+    // The verdict above ran over an uncomputed diff: never label it `ok`.
+    teamParliament.deny = false;
+    teamParliament.reasonId = 'changed-paths-unavailable';
+    teamParliament.message = `${listed.error || 'Cannot list changed paths.'} Pass --base <ref> or fix the git error, or run a full check without diff flags.`;
     return {
-      halt: { exitCode: 2, message: listed.error || 'Cannot resolve team base ref.', teamParliament },
+      halt: { exitCode: 2, message: teamParliament.message, teamParliament },
       teamParliament,
       changedPaths,
     };
@@ -302,6 +254,17 @@ export function runTeamPreflight({ root, args, config, policyDelta, teamBase })
   return { halt: null, teamParliament, changedPaths };
 }
 
+/** `--changed` / `--persona touch|contributor|agent` without a resolvable merge base. */
+function changedNeedsBaseMessage(args) {
+  const flag = args?.persona ? `--persona ${args.persona}` : '--changed';
+  return `${flag} needs a git merge base to know which files changed, and none was found (tried ${TEAM_BASE_CANDIDATES.join(', ')}; or this is not a git repository). Pass --base <ref> (for example --base HEAD or --base origin/main), or run without ${flag} for a full-tree check.`;
+}
+
+function contractDiffNeedsBaseMessage(args) {
+  const flag = args?.persona ? `--persona ${args.persona}` : '--contract-diff';
+  return `${flag} compares the contract and .ark-baseline.json against a git base, and none was found (tried ${TEAM_BASE_CANDIDATES.join(', ')}; or this is not a git repository). Pass --base <ref> (for example --base origin/main), or run a plain full-tree check without ${flag}.`;
+}
+
 export function ungovernedDumpMessage(dumped) {
   return `New ungoverned source in this diff: ${dumped.slice(0, 8).join(', ')}${dumped.length > 8 ? '…' : ''}. Classify via /ark-adopt (contract session) or move into a governed layer.`;
 }
@@ -312,6 +275,29 @@ export function filterChangedGovernedFiles(allGovernedFiles, root, changedPaths,
   return allGovernedFiles.filter((abs) => changedSet.has(normalizeRel(path.relative(root, abs))));
 }
 
+/**
+ * `--changed` scans a subset, so a layer whose files were not touched looks empty to the
+ * kernel. Keep CONFIG_LAYER_PATTERN_NO_MATCHES only when the FULL governed tree has no
+ * match either (a real typo). `loadFullFiles` is lazy: the full walk runs only when needed.
+ */
+export function pruneScopedPatternWarnings(warnings, root, loadFullFiles) {
+  const isNoMatch = (w) =>
+    (w?.ruleId ?? w?.code) === 'CONFIG_LAYER_PATTERN_NO_MATCHES' && typeof w.pattern === 'string';
+  if (!Array.isArray(warnings) || !warnings.some(isNoMatch)) return warnings;
+  const rels = loadFullFiles().map((abs) => path.relative(root, abs).split(path.sep).join('/'));
+  for (let i = warnings.length - 1; i >= 0; i -= 1) {
+    if (!isNoMatch(warnings[i])) continue;
+    let expression;
+    try {
+      expression = globToRegExp(warnings[i].pattern);
+    } catch {
+      continue;
+    }
+    if (rels.some((rel) => expression.test(rel))) warnings.splice(i, 1);
+  }
+  return warnings;
+}
+
 export function applyAgainstRatchet({
   violations,
   againstRef,
@@ -319,16 +305,18 @@ export function applyAgainstRatchet({
   changed,
   changedPaths,
   occurrenceKeys,
+  rules,
+  layers,
 }) {
   const baseRaw = readJsonMaybe(gitShowText(root, againstRef, '.ark-baseline.json'));
   const baseKeys = new Set(baselineKeysFromDocument(baseRaw));
-  const judged = baseRaw ? applyAdvisorySiblingRatchet(violations, occurrenceKeys, baseKeys) : violations;
+  const judged = baseRaw ? applyAdvisorySiblingRatchet(violations, occurrenceKeys, baseKeys, { rules, layers }) : violations;
   const vsBaseActive = judged.filter((_, index) => !baseKeys.has(occurrenceKeys[index]));
   const changedSet = new Set(changedPaths ?? []);
+  // A CROSS_PARENT_VIA_SHARED path belongs to the change when any file on it changed.
+  const touched = (v) => [v.file, ...(Array.isArray(v.via) ? v.via : []), ...(v.reasonId === 'CROSS_PARENT_VIA_SHARED' ? [v.target] : [])];
   const activeViolations = changed
-    ? vsBaseActive.filter((violation) =>
-        changedSet.has(String(violation.file || '').replace(/\\/g, '/'))
-      )
+    ? vsBaseActive.filter((v) => touched(v).some((f) => changedSet.has(String(f || '').replace(/\\/g, '/'))))
     : vsBaseActive;
   return {
     activeViolations,

package/bin/lib/team-parliament.mjs

@@ -8,8 +8,8 @@
  * Pure CLI helper (bin/lib/team-parliament.mjs). Zero Node I/O.
  */
 
-export const TEAM_PERSONAS = ['touch', 'contributor', 'agent', 'steward'];
-export const CONTRACT_DIFF_KINDS = [
+const TEAM_PERSONAS = ['touch', 'contributor', 'agent', 'steward'];
+const CONTRACT_DIFF_KINDS = [
     'unchanged',
     'tighten',
     'loosen',
@@ -35,11 +35,14 @@ export function isLawRelativePath(relPath) {
     if ((n.startsWith('arkrules/') || n.includes('/arkrules/')) && n.endsWith('.json')) {
         return true;
     }
+    // Slice file named by childSlices.arkRulesFile (`arkrules.<Layer>.json`), including a lookalike.
+    if (/^arkrules\.[^/]+\.json$/i.test(base))
+        return true;
     return false;
 }
 const PRODUCT_SOURCE = /\.(tsx?|jsx?|mjs|cjs)$/i;
 /** Governable product source (not law, not tests-only heuristic — basename extension). */
-export function isProductSourceRelativePath(relPath) {
+function isProductSourceRelativePath(relPath) {
     const n = posixRel(relPath);
     if (!n || isLawRelativePath(n))
         return false;
@@ -100,29 +103,34 @@ export function classifyBaselineKeyDelta(baseKeys, candidateKeys) {
         kinds.push('baseline-shrink');
     return { grow, shrink, kinds };
 }
-export function normalizeStewardId(value) {
+function normalizeStewardId(value) {
     if (typeof value !== 'string')
         return null;
     const trimmed = value.trim().replace(/^@/, '').toLowerCase();
     return trimmed.length > 0 ? trimmed : null;
 }
 /** GitHub handle (login), not a display name. Spaces and emails are not handles. */
-export function isGitHubHandle(value) {
+function isGitHubHandle(value) {
     const id = normalizeStewardId(value);
     if (!id || isAutomationAuthor(id) || id.includes(' ') || id.includes('@'))
         return false;
     return /^(?!-)[a-z0-9-]{1,39}(?<!-)$/.test(id);
 }
-export function isGitHubEmail(value) {
+function isGitHubEmail(value) {
     if (typeof value !== 'string')
         return false;
     const email = value.trim().toLowerCase();
     if (!email.includes('@') || email.includes(' ') || isAutomationAuthor(email))
         return false;
-    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+    // local@domain.tld without a backtracking regex (CodeQL js/polynomial-redos).
+    const parts = email.split('@');
+    if (parts.length !== 2 || !parts[0] || /\s/.test(email))
+        return false;
+    const dot = parts[1].lastIndexOf('.');
+    return dot > 0 && dot < parts[1].length - 1;
 }
 /** `123+login@users.noreply.github.com` or `login@users.noreply.github.com` → login. */
-export function githubHandleFromEmail(email) {
+function githubHandleFromEmail(email) {
     if (typeof email !== 'string')
         return null;
     const match = email.trim().match(/^(?:\d+\+)?([^@]+)@users\.noreply\.github\.com$/i);
@@ -145,7 +153,7 @@ export function canonicalStewardId(value) {
         return id;
     return null;
 }
-export function formatStewardMention(id) {
+function formatStewardMention(id) {
     return id.includes('@') ? id : `@${id}`;
 }
 /**
@@ -173,7 +181,7 @@ export function isSteward(author, stewards) {
     return stewards.some((entry) => canonicalStewardId(entry) === who);
 }
 const BOT_STEWARD = /bot\b|\[bot\]|dependabot|renovate|github-actions|imgbot|codecov/i;
-export function isAutomationAuthor(value) {
+function isAutomationAuthor(value) {
     const id = normalizeStewardId(value);
     return !id || BOT_STEWARD.test(id);
 }
@@ -313,6 +321,9 @@ export function personaCheckBudget(persona) {
         denyLoosenUnlessSteward: true,
     };
 }
+/**
+ * Narrow a string to a team persona.
+ */
 export function isTeamPersona(value) {
     return TEAM_PERSONAS.includes(value);
 }

package/bin/lib/upgrade-behavior-changes.mjs

@@ -46,7 +46,7 @@ function versionParts(version) {
  * @param {string} right
  * @returns {-1|0|1}
  */
-export function compareUpgradeVersions(left, right) {
+function compareUpgradeVersions(left, right) {
   const a = versionParts(left);
   const b = versionParts(right);
   const length = Math.max(a.length, b.length);
@@ -61,7 +61,7 @@ export function compareUpgradeVersions(left, right) {
  * @param {UpgradeBehaviorChange} row
  * @returns {string}
  */
-export function formatBehaviorChange(row) {
+function formatBehaviorChange(row) {
   return `${row.version}: ${row.note}`;
 }