arkgate 4.8.23 → 4.8.25

package/dist/runtime/index.d.ts

@@ -1,58 +1,66 @@
-export { n as AICodeGate, o as AICodeGateContext, p as AICodeGateOptions, q as AICodeGateResult, r as AICodeGateViolation, s as AIGateExtension, t as ANALYSIS_IR_SCHEMA_VERSION, u as ARK_ANALYSIS_RESULT_SCHEMA, v as ARK_ANALYSIS_RESULT_SCHEMA_VERSION, w as ARK_DESIGN_DELTA_SCHEMA_VERSION, x as ARK_ENFORCEMENT_STATE_SCHEMA_VERSION, y as AdapterCompletenessReason, z as AdapterDiagnostic, B as AdapterResult, C as AdapterSeverity, A as AdapterViolationInput, D as AnalysisCapabilityUse, F as AnalysisCompilerOptions, G as AnalysisCompleteness, H as AnalysisContract, I as AnalysisEvidence, J as AnalysisFile, K as AnalysisFileChange, L as AnalysisFileInput, M as AnalysisImportEdge, N as AnalysisIr, O as AnalysisMode, P as AnalysisResult, Q as AnalysisViolation, S as AnalyzeArchitectureConvergenceInput, T as AnalyzeChangeInput, U as AnalyzePolicyDeltaInput, V as AnalyzeProjectInput, W as AnalyzeResolvedProjectInput, X as ArchitectureActualChange, Y as ArchitectureChangeMap, Z as ArchitectureChangeMapContract, _ as ArchitectureChangeMapDependency, $ as ArchitectureChangeMapFile, a0 as ArchitectureChangeOperation, a1 as ArchitectureConvergenceClassification, a2 as ArchitectureConvergenceFinding, a3 as ArchitectureConvergenceResult, a4 as ArchitectureDependency, a5 as ArchitectureEngineEdge, a6 as ArchitectureEngineResult, a7 as ArchitectureEngineViolation, a8 as ArkDesignDeltaResult, a9 as ArkEnforcementHost, aa as ArkEnforcementState, ac as ChangePreflightResult, ae as CollectAnalysisConfigWarningsInput, ai as DIAGNOSTIC_CATALOG, aj as DIAGNOSTIC_CATALOG_SCHEMA_VERSION, ak as DIAGNOSTIC_DOCS_RELATIVE_PATH, al as DIAGNOSTIC_RULE_IDS, an as DesignDeltaChange, ao as DesignDeltaEnforcementScope, ap as DesignDeltaIdentity, aq as DesignSmellEvidence, ar as DesignSmellFinding, as as DesignSmellId, at as DiagnosticCatalogEntry, au as DiagnosticCategory, av as EnforcementBoundaryState, aw as EnforcementEvidence, ax as EnforcementEvidenceField, ay as EnforcementVerification, az as EvaluateArchitectureGraphInput, aA as ForbiddenCapabilityUse, aD as POLICY_DELTA_SCHEMA_VERSION, aE as PolicyDelta, aF as PolicyDeltaAcknowledgement, aG as PolicyDeltaAnalysis, aH as PolicyDeltaClassification, aI as PolicyDeltaFinding, aJ as PreflightResolvedChangeInput, aK as PreparedChangeFile, aL as RESOLVED_CANDIDATE_FACTS_SCHEMA, aM as RESOLVED_CANDIDATE_FACTS_SCHEMA_VERSION, aN as ResolvedAmbientFact, aO as ResolvedAnalysisFile, aP as ResolvedAnalysisIr, aQ as ResolvedAnalysisResult, f as ResolvedArkRunCompositionRootHitFact, b as ResolvedArkRunDeclarationFact, c as ResolvedArkRunKernelCallFact, R as ResolvedArkRunKernelCallKind, d as ResolvedArkRunManagedNewFact, aR as ResolvedCandidateFacts, aS as ResolvedCandidateFactsInput, aT as ResolvedCapability, aU as ResolvedCapabilityFact, aV as ResolvedChangePreflightResult, e as ResolvedDependencyFact, aW as ResolvedDependencyKind, aX as ResolvedDependencyState, aY as ResolvedFactsCompleteness, g as ResolvedFactsReason, aZ as ResolvedFileFact, a_ as ResolvedIntentReferenceFact, a$ as ResolvedPublishFact, b0 as ResolvedSafetyFact, b1 as ResolvedSafetyKind, b2 as ResolvedSafetyReport, b3 as SemanticDependency, b4 as SemanticDependencyKind, b5 as analyzeArchitectureConvergence, b6 as analyzeChange, b7 as analyzePolicyDelta, b8 as analyzeProject, b9 as analyzeResolvedProject, bc as catalogFixForRuleId, bd as catalogWhyForRuleId, be as classifyArkPolicyDelta, bg as collectAnalysisConfigWarnings, bi as collectForbiddenCapabilityUses, bk as createAICodeGate, bl as createAdapterResult, bm as createArchitectureProfile, bn as createArchitectureProfileFromArkConfig, bo as createElevenLayerArkConfig, bp as createResolvedCandidateFacts, bs as detectArchitectureCycles, bt as deterministicHash, bu as diagnosticDocsFragment, bv as diagnosticDocsPath, bw as elevenLayerProfile, bx as evaluateArchitectureGraph, bA as explainViolation, bC as extractSemanticDependencies, bD as getDiagnosticCatalogEntry, bE as isCataloguedOrArkRuleFamily, bF as isKnownDiagnosticCode, bG as loadContract, bH as loadResolvedCandidateFacts, bI as policyDeltaAcknowledgementMatches, bJ as preflightChange, bK as preflightResolvedChange, bL as resolvedFactsEvidenceRequirementsHash, bM as serializeDiagnosticCatalog, bN as stableSerialize, bO as toAdapterDiagnostic, bP as version } from '../diagnosticCatalog-35mrwAHe.js';
-import { P as PolicyViolation, g as PolicySeverity, h as PolicyEnforcementMode, i as Policy, I as IntentName, j as IntentCreator, k as IntentRelationship, b as ArchitectureProfile, D as DomainEvent } from '../types-Ik_OakcI.js';
-export { A as ArchitectureLayer, a as ArchitectureLayerConfig, c as ArchitectureRule, d as ArkCheckConfig, l as CorrelationId, C as CreateArchitectureProfileFromArkConfigOptions, e as CreateArchitectureProfileOptions, f as CreateElevenLayerArkConfigOptions, E as EventMetadata, m as IntentRelationshipKind } from '../types-Ik_OakcI.js';
-import { I as IntentRegistry, D as DefineIntentOptions, a as DependencyGraph, G as GraphEdge, b as AuditStore, c as AuditRecord, d as AuditQuery, e as CreateAuditTrailOptions, f as AuditTrail, E as EventContractRegistry, g as EventContract, h as EventContractValidationResult, M as MetadataRegistry, R as ReadModelStore, i as CreateProjectionRegistryOptions, P as ProjectionRegistry, j as EventBufferStore, k as EventBufferRecord, l as EventBufferStatus, m as EventBusOptions, n as EventBus, o as CreateObservabilityReporterOptions, O as ObservabilityReporter, p as PolicyEngine, q as ArkManifest, W as WorkflowStore, S as SagaContext, r as WorkflowSnapshot, s as SagaDefinition, t as CreateWorkflowEngineOptions, u as SagaInstance, v as WorkflowEngine, w as DependencyInformationPackage, C as CreateArkKernelOptions, A as ArkKernel, x as ArkKernelConfig, y as CreateArkKernelFromConfigOptions, T as TraceRecordType, z as TraceRecord, B as OutboxStatus, F as OutboxRecord, H as ObservabilityDriftReport } from '../types-Bdj32QwA.js';
-export { J as ARK_RUN_COMPONENT_LIFETIMES, K as ARK_RUN_EPHEMERAL_DEFAULT, L as ARK_RUN_GRAPH_DEFAULT_SLICE, N as ARK_RUN_GRAPH_NODE_KINDS, Q as ARK_RUN_GRAPH_PROCESS_EDGE_KINDS, U as ARK_RUN_GRAPH_SCHEMA_VERSION, V as ARK_RUN_GRAPH_SLICES, X as ARK_RUN_GRAPH_TECHNICAL_EDGE_KINDS, Y as ARK_RUN_INFORMATION_PACKAGE_SCHEMA_VERSION, Z as ARK_RUN_INSPECTOR_DEFAULT_HOST, _ as ARK_RUN_INSPECTOR_DEFAULT_PORT, $ as ARK_RUN_INSPECTOR_EVENTS_PATH, a0 as ARK_RUN_INSPECTOR_GRAPH_PATH, a1 as ARK_RUN_INSPECTOR_MONITOR_SAMPLE_LIMIT, a2 as ARK_RUN_INSPECTOR_OUTBOX_PATH, a3 as ARK_RUN_INSPECTOR_SCHEMA_VERSION, a4 as ARK_RUN_INSPECTOR_SNAPSHOT_PATH, a5 as ARK_RUN_INSPECTOR_SSE_EVENT, a6 as ARK_RUN_INSPECTOR_TRANSPORT_FALLBACK, a7 as ARK_RUN_INSPECTOR_WORKFLOWS_PATH, a8 as ARK_RUN_TRANSPORT_KINDS, a9 as ArkManifestArchitecture, aa as ArkManifestData, ab as ArkManifestEntityLink, ac as ArkManifestGraph, ad as ArkManifestIntent, ae as ArkManifestPolicy, af as ArkManifestProjection, ag as ArkRunBrokerAdapter, ah as ArkRunComponentLifetime, ai as ArkRunDeliveredVia, aj as ArkRunExtendedInfo, ak as ArkRunGraph, al as ArkRunGraphEdge, am as ArkRunGraphEdgeKind, an as ArkRunGraphMatch, ao as ArkRunGraphMatchInput, ap as ArkRunGraphNode, aq as ArkRunGraphNodeKind, ar as ArkRunGraphProcessEdgeKind, as as ArkRunGraphQuery, at as ArkRunGraphResolvedQuery, au as ArkRunGraphSlice, av as ArkRunGraphTechnicalEdgeKind, aw as ArkRunInformationPackageComponent, ax as ArkRunInspectorBind, ay as ArkRunInspectorBindError, az as ArkRunInspectorBindInput, aA as ArkRunInspectorHandle, aB as ArkRunInspectorHardening, aC as ArkRunInspectorHardeningDurability, aD as ArkRunInspectorMonitorBuildOptions, aE as ArkRunInspectorOutboxMonitor, aF as ArkRunInspectorOutboxRecordSummary, aG as ArkRunInspectorProductionError, aH as ArkRunInspectorSnapshot, aI as ArkRunInspectorSnapshotInput, aJ as ArkRunInspectorSource, aK as ArkRunInspectorStoreDurability, aL as ArkRunInspectorStoreDurabilityKind, aM as ArkRunInspectorStoreRole, aN as ArkRunInspectorTransportFacts, aO as ArkRunInspectorWorkflowSummary, aP as ArkRunInspectorWorkflowsMonitor, aQ as ArkRunPublisher, aR as ArkRunRegisterOptions, aS as ArkRunRegistrationHandle, aT as ArkRunSendOptions, aU as ArkRunSendPlan, aV as ArkRunSendPlanInput, aW as ArkRunSendResult, aX as ArkRunTransportKind, aY as AuditRecordInput, aZ as AuditRecordType, a_ as EntityMeta, a$ as EventContractIssue, b0 as EventHandler, b1 as EventInterceptionInfo, b2 as EventInterceptor, b3 as EventInterceptorContext, b4 as EventPayloadPatch, b5 as EventPayloadSchema, b6 as EventPublisher, b7 as EventSchemaField, b8 as EventSchemaFieldType, b9 as FieldMeta, ba as GraphNode, bb as InvalidArkRunGraphQueryError, bc as InvalidArkRunSendOptionError, bd as ObservabilityFlow, be as ObservedLayerFlowMode, bf as OutboxStore, bg as PolicyEvaluationResult, bh as ProjectionCheckpoint, bi as ProjectionDefinition, bj as PublishedEventRecord, bk as RetryPolicy, bl as SagaStatus, bm as SagaStep, bn as StartArkRunInspectorOptions, bo as TraceSink, bp as Unsubscribe, bq as WorkflowDefinition, br as WorkflowStatus, bs as WorkflowStep, bt as appendDecisionTape, bu as arkRunGraphQueryFromSearchParams, bv as arkRunInspectorUrl, bw as buildArkRunInspectorHardening, bx as buildArkRunInspectorOutboxMonitor, by as buildArkRunInspectorSnapshot, bz as buildArkRunInspectorWorkflowsMonitor, bA as buildDependencyInformationPackage, bB as classifyArkRunInspectorStoreDurability, bC as closeArkRunGraphQuery, bD as closedArkRunEphemeral, bE as closedArkRunTransportKind, bF as formatArkRunGraphMermaid, bG as formatArkRunInspectorSseEvent, bH as isArkRunInspectorLoopbackHost, bI as isArkRunInspectorProductionEnv, bJ as requestArkRunGraph, bK as resolveArkRunInspectorBind, bL as resolveArkRunSendPlan, bM as startArkRunInspector, bN as unavailableArkRunInspectorOutboxMonitor, bO as unavailableArkRunInspectorWorkflowsMonitor } from '../types-Bdj32QwA.js';
-import '../configTypes-Bbf_MFGe.js';
+import { a as AuditStore, b as AuditRecord, c as AuditQuery, d as CreateAuditTrailOptions, e as AuditTrail, f as CreateArchitectureProfileOptions, g as ArchitectureProfile, h as ArkCheckConfig, i as CreateArchitectureProfileFromArkConfigOptions, j as CreateElevenLayerArkConfigOptions, D as DependencyGraph, I as IntentRegistry, E as EventContractRegistry, k as EventContract, l as DomainEvent, m as EventContractValidationResult, n as IntentName, o as DefineIntentOptions, p as IntentCreator, M as MetadataRegistry, R as ReadModelStore, q as CreateProjectionRegistryOptions, P as ProjectionRegistry, r as PolicyViolation, s as PolicySeverity, t as PolicyEnforcementMode, u as Policy, G as GraphEdge, v as IntentRelationship, w as EventBufferStore, x as EventBufferRecord, y as EventBufferStatus, z as EventBusOptions, B as EventBus, F as CreateObservabilityReporterOptions, O as ObservabilityReporter, H as PolicyEngine, J as ArkManifest, W as WorkflowStore, S as SagaContext, K as WorkflowSnapshot, L as SagaDefinition, N as CreateWorkflowEngineOptions, Q as SagaInstance, T as WorkflowEngine, U as ArkConfig, V as ArkConfigLoadResult, X as DependencyInformationPackage, C as CreateArkKernelOptions, A as ArkKernel, Y as ArkKernelConfig, Z as CreateArkKernelFromConfigOptions, _ as TraceRecordType, $ as TraceRecord, a0 as OutboxStatus, a1 as OutboxRecord, a2 as ObservabilityDriftReport } from '../types-CnauMQQL.js';
+export { a3 as ARK_RUN_COMPONENT_LIFETIMES, a4 as ARK_RUN_EPHEMERAL_DEFAULT, a5 as ARK_RUN_GRAPH_DEFAULT_SLICE, a6 as ARK_RUN_GRAPH_NODE_KINDS, a7 as ARK_RUN_GRAPH_PROCESS_EDGE_KINDS, a8 as ARK_RUN_GRAPH_SCHEMA_VERSION, a9 as ARK_RUN_GRAPH_SLICES, aa as ARK_RUN_GRAPH_TECHNICAL_EDGE_KINDS, ab as ARK_RUN_INFORMATION_PACKAGE_SCHEMA_VERSION, ac as ARK_RUN_INSPECTOR_DEFAULT_HOST, ad as ARK_RUN_INSPECTOR_DEFAULT_PORT, ae as ARK_RUN_INSPECTOR_EVENTS_PATH, af as ARK_RUN_INSPECTOR_GRAPH_PATH, ag as ARK_RUN_INSPECTOR_MONITOR_SAMPLE_LIMIT, ah as ARK_RUN_INSPECTOR_OUTBOX_PATH, ai as ARK_RUN_INSPECTOR_SCHEMA_VERSION, aj as ARK_RUN_INSPECTOR_SNAPSHOT_PATH, ak as ARK_RUN_INSPECTOR_SSE_EVENT, al as ARK_RUN_INSPECTOR_TRANSPORT_FALLBACK, am as ARK_RUN_INSPECTOR_WORKFLOWS_PATH, an as ARK_RUN_TRANSPORT_KINDS, ao as ArchitectureLayer, ap as ArchitectureLayerConfig, aq as ArchitectureRule, ar as ArkManifestArchitecture, as as ArkManifestData, at as ArkManifestEntityLink, au as ArkManifestGraph, av as ArkManifestIntent, aw as ArkManifestPolicy, ax as ArkManifestProjection, ay as ArkRunBrokerAdapter, az as ArkRunComponentLifetime, aA as ArkRunDeliveredVia, aB as ArkRunExtendedInfo, aC as ArkRunGraph, aD as ArkRunGraphEdge, aE as ArkRunGraphEdgeKind, aF as ArkRunGraphMatch, aG as ArkRunGraphMatchInput, aH as ArkRunGraphNode, aI as ArkRunGraphNodeKind, aJ as ArkRunGraphProcessEdgeKind, aK as ArkRunGraphQuery, aL as ArkRunGraphResolvedQuery, aM as ArkRunGraphSlice, aN as ArkRunGraphTechnicalEdgeKind, aO as ArkRunInformationPackageComponent, aP as ArkRunInspectorBind, aQ as ArkRunInspectorBindError, aR as ArkRunInspectorBindInput, aS as ArkRunInspectorHandle, aT as ArkRunInspectorHardening, aU as ArkRunInspectorHardeningDurability, aV as ArkRunInspectorMonitorBuildOptions, aW as ArkRunInspectorOutboxMonitor, aX as ArkRunInspectorOutboxRecordSummary, aY as ArkRunInspectorProductionError, aZ as ArkRunInspectorSnapshot, a_ as ArkRunInspectorSnapshotInput, a$ as ArkRunInspectorSource, b0 as ArkRunInspectorStoreDurability, b1 as ArkRunInspectorStoreDurabilityKind, b2 as ArkRunInspectorStoreRole, b3 as ArkRunInspectorTransportFacts, b4 as ArkRunInspectorWorkflowSummary, b5 as ArkRunInspectorWorkflowsMonitor, b6 as ArkRunPublisher, b7 as ArkRunRegisterOptions, b8 as ArkRunRegistrationHandle, b9 as ArkRunSendOptions, ba as ArkRunSendPlan, bb as ArkRunSendPlanInput, bc as ArkRunSendResult, bd as ArkRunTransportKind, be as AuditRecordInput, bf as AuditRecordType, bg as CorrelationId, bh as EntityMeta, bi as EventContractIssue, bj as EventHandler, bk as EventInterceptionInfo, bl as EventInterceptor, bm as EventInterceptorContext, bn as EventMetadata, bo as EventPayloadPatch, bp as EventPayloadSchema, bq as EventPublisher, br as EventSchemaField, bs as EventSchemaFieldType, bt as FieldMeta, bu as GraphNode, bv as IntentRelationshipKind, bw as InvalidArkRunGraphQueryError, bx as InvalidArkRunSendOptionError, by as ObservabilityFlow, bz as ObservedLayerFlowMode, bA as OutboxStore, bB as PolicyEvaluationResult, bC as ProjectionCheckpoint, bD as ProjectionDefinition, bE as PublishedEventRecord, bF as RetryPolicy, bG as SagaStatus, bH as SagaStep, bI as StartArkRunInspectorOptions, bJ as TraceSink, bK as Unsubscribe, bL as WorkflowDefinition, bM as WorkflowStatus, bN as WorkflowStep, bO as appendDecisionTape, bP as arkRunGraphQueryFromSearchParams, bQ as arkRunInspectorUrl, bR as buildArkRunInspectorHardening, bS as buildArkRunInspectorOutboxMonitor, bT as buildArkRunInspectorSnapshot, bU as buildArkRunInspectorWorkflowsMonitor, bV as buildDependencyInformationPackage, bW as classifyArkRunInspectorStoreDurability, bX as closeArkRunGraphQuery, bY as closedArkRunEphemeral, bZ as closedArkRunTransportKind, b_ as formatArkRunGraphMermaid, b$ as formatArkRunInspectorSseEvent, c0 as isArkRunInspectorLoopbackHost, c1 as isArkRunInspectorProductionEnv, c2 as requestArkRunGraph, c3 as resolveArkRunInspectorBind, c4 as resolveArkRunSendPlan, c5 as startArkRunInspector, c6 as unavailableArkRunInspectorOutboxMonitor, c7 as unavailableArkRunInspectorWorkflowsMonitor } from '../types-CnauMQQL.js';
 
 /**
- * Typed error thrown when hard policies are violated.
+ * Reference in-process audit store. **Not production durability** — records do not
+ * survive process restarts. For production, inject an `AuditStore` that writes to your
+ * durable log/DB (see `docs/production-hardening.md`).
  */
-
-declare class PolicyViolationError extends Error {
-    readonly violations: PolicyViolation[];
-    constructor(violations: PolicyViolation[]);
+declare class InMemoryAuditStore implements AuditStore {
+    private readonly maxRecords?;
+    private readonly records;
+    constructor(maxRecords?: number | undefined);
+    append(record: AuditRecord): void;
+    query(query?: AuditQuery): AuditRecord[];
+    clear(): void;
 }
+/**
+ * Create an audit trail. Defaults to `InMemoryAuditStore` (**not** production durability).
+ * Pass `options.store` for a durable backend.
+ */
+declare function createAuditTrail(options?: CreateAuditTrailOptions): AuditTrail;
+
+declare function createArchitectureProfile(options: CreateArchitectureProfileOptions): ArchitectureProfile;
+declare function createArchitectureProfileFromArkConfig(config: ArkCheckConfig, options?: CreateArchitectureProfileFromArkConfigOptions): ArchitectureProfile;
+declare const elevenLayerProfile: ArchitectureProfile;
+declare function createElevenLayerArkConfig(options?: CreateElevenLayerArkConfigOptions): ArkCheckConfig;
 
 /**
- * definePolicy
+ * DependencyGraph implementation.
  *
- * Factory function to create architectural policies in a declarative way.
+ * Collects declared and observed relationships.
+ * Generates Mermaid diagrams and JSON.
+ * Supports simple violation detection via rule functions.
  */
 
-interface DefinePolicyOptions<Context = unknown> {
-    name: string;
-    severity?: PolicySeverity;
-    tags?: readonly string[];
-    owner?: string;
-    version?: string;
-    rationale?: string;
-    enforcementMode?: PolicyEnforcementMode;
-    deprecated?: boolean | string;
-    replacedBy?: string;
-    check: (context: Context) => boolean | PolicyViolation | PolicyViolation[];
+declare function createDependencyGraph(): DependencyGraph;
+
+/**
+ * Bridge IntentRegistry relationships into a DependencyGraph.
+ */
+
+interface SyncRegistryOptions {
+    /** Skip edges whose target intent is not registered (default: false). */
+    requireRegisteredTargets?: boolean;
 }
 /**
- * Creates a Policy from a declarative configuration.
- *
- * The provided `check` function is called as-is. The PolicyEngine is responsible
- * for normalizing results (booleans, single violations, arrays) into a consistent
- * set of PolicyViolation objects.
+ * Sync declared intent relationships from a registry into a dependency graph.
  *
- * @example
- * ```ts
- * const noDomainToInfra = definePolicy({
- *   name: 'Domain must not depend on infrastructure',
- *   severity: 'hard',
- *   check: (ctx) => {
- *     const violations: PolicyViolation[] = [];
- *     // ... logic using ctx.registry.getAllRelationships()
- *     return violations.length > 0 ? violations : true;
- *   }
- * });
- * ```
+ * - `dependsOn` → `declared` edges
+ * - `produces` → `produces` edges
  */
-declare function definePolicy<Context = unknown>(options: DefinePolicyOptions<Context>): Policy<Context>;
+declare function syncRegistryToGraph(registry: IntentRegistry, graph: DependencyGraph, options?: SyncRegistryOptions): void;
+
+declare class EventContractRegistryImpl implements EventContractRegistry {
+    private readonly contracts;
+    register(contract: EventContract): void;
+    get(intent: string, version?: string): EventContract | undefined;
+    list(intent?: string): EventContract[];
+    validate(event: DomainEvent): EventContractValidationResult;
+    clear(): void;
+    private key;
+}
+declare function createEventContractRegistry(): EventContractRegistry;
 
 /**
  * defineIntent
@@ -121,30 +129,71 @@ interface IntentNameValidation {
 declare function validateIntentName(name: string): IntentNameValidation;
 
 /**
- * DependencyGraph implementation.
- *
- * Collects declared and observed relationships.
- * Generates Mermaid diagrams and JSON.
- * Supports simple violation detection via rule functions.
+ * Basic MetadataRegistry implementation.
  */
 
-declare function createDependencyGraph(): DependencyGraph;
+declare function createMetadataRegistry(): MetadataRegistry;
 
 /**
- * Bridge IntentRegistry relationships into a DependencyGraph.
+ * Reference in-process read-model store. **Not production durability.**
+ * See `docs/production-hardening.md`.
+ */
+declare class InMemoryReadModelStore implements ReadModelStore {
+    private readonly states;
+    load<State = unknown>(name: string): State | undefined;
+    save<State = unknown>(name: string, state: State): void;
+    clear(name?: string): void;
+}
+declare function createProjectionRegistry(options?: CreateProjectionRegistryOptions): ProjectionRegistry;
+
+/**
+ * Typed error thrown when hard policies are violated.
  */
 
-interface SyncRegistryOptions {
-    /** Skip edges whose target intent is not registered (default: false). */
-    requireRegisteredTargets?: boolean;
+declare class PolicyViolationError extends Error {
+    readonly violations: PolicyViolation[];
+    constructor(violations: PolicyViolation[]);
 }
+
 /**
- * Sync declared intent relationships from a registry into a dependency graph.
+ * definePolicy
  *
- * - `dependsOn` → `declared` edges
- * - `produces` → `produces` edges
+ * Factory function to create architectural policies in a declarative way.
  */
-declare function syncRegistryToGraph(registry: IntentRegistry, graph: DependencyGraph, options?: SyncRegistryOptions): void;
+
+interface DefinePolicyOptions<Context = unknown> {
+    name: string;
+    severity?: PolicySeverity;
+    tags?: readonly string[];
+    owner?: string;
+    version?: string;
+    rationale?: string;
+    enforcementMode?: PolicyEnforcementMode;
+    deprecated?: boolean | string;
+    replacedBy?: string;
+    check: (context: Context) => boolean | PolicyViolation | PolicyViolation[];
+}
+/**
+ * Creates a Policy from a declarative configuration.
+ *
+ * The provided `check` function is called as-is. The PolicyEngine is responsible
+ * for normalizing results (booleans, single violations, arrays) into a consistent
+ * set of PolicyViolation objects.
+ *
+ * @example
+ * ```ts
+ * const noDomainToInfra = definePolicy({
+ *   name: 'Domain must not depend on infrastructure',
+ *   severity: 'hard',
+ *   check: (ctx) => {
+ *     const violations: PolicyViolation[] = [];
+ *     // ... logic using ctx.registry.getAllRelationships()
+ *     return violations.length > 0 ? violations : true;
+ *   }
+ * });
+ * ```
+ */
+declare function definePolicy<Context = unknown>(options: DefinePolicyOptions<Context>): Policy<Context>;
 
 /**
  * Built-in architectural policy helpers.
@@ -196,68 +245,55 @@ declare function defineArchitectureProfilePolicy<Context extends {
     relationships?: IntentRelationship[];
 }>(profile: ArchitectureProfile, options?: Omit<LayerPolicyOptions, 'rules' | 'resolveLayer'>): Policy<Context>;
 
-/**
- * Reference in-process audit store. **Not production durability** — records do not
- * survive process restarts. For production, inject an `AuditStore` that writes to your
- * durable log/DB (see `docs/production-hardening.md`).
- */
-declare class InMemoryAuditStore implements AuditStore {
-    private readonly maxRecords?;
-    private readonly records;
-    constructor(maxRecords?: number | undefined);
-    append(record: AuditRecord): void;
-    query(query?: AuditQuery): AuditRecord[];
-    clear(): void;
-}
-/**
- * Create an audit trail. Defaults to `InMemoryAuditStore` (**not** production durability).
- * Pass `options.store` for a durable backend.
- */
-declare function createAuditTrail(options?: CreateAuditTrailOptions): AuditTrail;
-
-declare class EventContractRegistryImpl implements EventContractRegistry {
-    private readonly contracts;
-    register(contract: EventContract): void;
-    get(intent: string, version?: string): EventContract | undefined;
-    list(intent?: string): EventContract[];
-    validate(event: DomainEvent): EventContractValidationResult;
-    clear(): void;
-    private key;
-}
-declare function createEventContractRegistry(): EventContractRegistry;
-
-/**
- * Basic MetadataRegistry implementation.
- */
-
-declare function createMetadataRegistry(): MetadataRegistry;
-
-/**
- * Reference in-process read-model store. **Not production durability.**
- * See `docs/production-hardening.md`.
- */
-declare class InMemoryReadModelStore implements ReadModelStore {
-    private readonly states;
-    load<State = unknown>(name: string): State | undefined;
-    save<State = unknown>(name: string, state: State): void;
-    clear(name?: string): void;
+interface InMemoryEventBufferOptions {
+    /**
+     * Maximum records retained. When exceeded, the oldest settled record
+     * (`dispatched` / `failed`) is evicted first; only when every record is still
+     * `pending` is the oldest pending record evicted, and `evictedPending` counts
+     * it so the loss is visible. A record evicted while still in flight that is
+     * settled afterwards (`markDispatched` / `markFailed`) was delivered, not lost,
+     * so it leaves the count. Default: unbounded (`Infinity`). Kernels built by
+     * `createArkKernel` pass `maxHistorySize` (default 1000).
+     */
+    maxRecords?: number;
 }
-declare function createProjectionRegistry(options?: CreateProjectionRegistryOptions): ProjectionRegistry;
-
 /**
  * Reference in-process event buffer. **Not production durability** — state is lost on
  * process exit. Use only for tests/demos/local single-process work; inject a durable
- * This is not an atomic outbox (see `docs/production-hardening.md`).
+ * store for production. This is not an atomic outbox (see `docs/production-hardening.md`).
  */
 declare class InMemoryEventBuffer implements EventBufferStore {
     private readonly records;
+    private readonly maxRecords;
+    /**
+     * Ids evicted while `pending`, oldest first. A later settle removes the id (the
+     * record was in flight, not lost). Bounded to {@link EVICTED_PENDING_TRACK_LIMIT}
+     * ids so the tracker itself cannot grow without limit; ids that fall off stay counted.
+     */
+    private readonly evictedPendingIds;
+    private evictedPendingCount;
+    constructor(options?: InMemoryEventBufferOptions);
+    /**
+     * Pending records dropped because the cap was reached with nothing settled to
+     * evict, and never settled afterwards. Records still in flight when evicted
+     * (e.g. fire-and-forget local handlers) leave the count once the kernel
+     * settles them.
+     */
+    get evictedPending(): number;
+    private trackEvictedPending;
+    /** A settle for an evicted in-flight record: delivered, so not a loss. */
+    private settleEvicted;
+    private evictOverflow;
     enqueue(event: DomainEvent): Promise<EventBufferRecord>;
     markDispatched(id: string): Promise<void>;
     markFailed(id: string, error: unknown): Promise<void>;
     list(status?: EventBufferStatus): Promise<EventBufferRecord[]>;
     clear(): Promise<void>;
 }
-/** @deprecated Use InMemoryEventBuffer. */
+/**
+ * @deprecated Use InMemoryEventBuffer.
+ * @alias Kept as a public alias of `arkgate/runtime` until its removal.
+ */
 declare const InMemoryOutboxStore: typeof InMemoryEventBuffer;
 
 /**
@@ -349,6 +385,20 @@ declare class ObservedLayerFlowViolationError extends Error {
     readonly toLayer: string;
     constructor(source: string, intentName: string, fromLayer: string, toLayer: string, message?: string);
 }
+/**
+ * A kernel built from an `ark.config.json` was explicitly asked for hard
+ * observed-layer-flow enforcement (`enforceObservedLayerFlow: 'hard'`), but some
+ * deny-rule layers declare no `intentPrefixes` and are not canonical 11-layer
+ * names (which get built-in prefixes), so no intent maps to them and the rule
+ * would be a silent no-op. With the strict default (hard implied, not passed),
+ * the kernel builds and records a `layer.observedFlowUnresolvable` audit record
+ * instead. Fix: add `intentPrefixes`, or pass `'soft' | 'off'`.
+ */
+declare class ArkKernelConfigError extends Error {
+    readonly code: 'ARKRUN_LAYER_FLOW_UNRESOLVABLE';
+    readonly layers: string[];
+    constructor(layers: string[]);
+}
 
 declare function createObservabilityReporter(options: CreateObservabilityReporterOptions): ObservabilityReporter;
 
@@ -396,42 +446,2600 @@ declare function createSaga<P extends SagaContext = SagaContext>(def: SagaDefini
     id?: string;
 }): SagaInstance<P>;
 
+/** ArkGate library version — single source of truth. */
+declare const version = "4.8.25";
+
+/** Versioned public result contract types + JSON Schema (adapter envelope). */
 /**
- * In-memory shadow / replay / compare for ArkRun information packages (XP07 / ADR 0033).
- * Not durable. Not a second bus. Stripped snapshots only.
+ * 1.5 adds stable finding refs on every factory-emitted diagnostic (ACS06):
+ * `findingRef`, `targetKey` (baseline-compatible), `docsCodePath`.
+ * 1.4 added optional evidence.arkruleId + evidence.arkruleSource (ADR 0012 / AR03).
  */
-
-type InformationPackageDiff = {
-    readonly path: string;
-    readonly left: unknown;
-    readonly right: unknown;
+declare const ARK_ANALYSIS_RESULT_SCHEMA_VERSION: "1.5";
+type AdapterSeverity = 'error' | 'warning';
+type AnalysisCompleteness = 'complete' | 'partial' | 'unavailable';
+type AnalysisMode = 'lexical-compatibility' | 'resolved-candidate-facts';
+type AdapterCompletenessReason = {
+    code: string;
+    message: string;
+    file?: string;
 };
-type InformationPackageCompare = {
-    readonly equal: boolean;
-    readonly diffs: readonly InformationPackageDiff[];
+type AdapterViolationInput = {
+    ruleId?: unknown;
+    code?: unknown;
+    message?: unknown;
+    file?: unknown;
+    line?: unknown;
+    column?: unknown;
+    target?: unknown;
+    fromLayer?: unknown;
+    toLayer?: unknown;
+    typeOnly?: unknown;
+    targetTypeOnlyExports?: unknown;
+    sourcePureTypeModule?: unknown;
+    namedBindingsTypeOnly?: unknown;
+    portProofEligible?: unknown;
+    peerIsolation?: unknown;
+    edgeKind?: unknown;
+    severity?: unknown;
+    /** When false, finding is non-blocking (e.g. type-only placement debt). */
+    failsStrict?: unknown;
+    /** Nested-wall reason. The ruleId stays LAYER_IMPORT_VIOLATION. Not part of the baseline key. */
+    reasonId?: unknown;
+    /** Last segment of the importer universe id, when the finding has a reasonId. */
+    universeFrom?: unknown;
+    /** Last segment of the importee universe id, when the finding has a reasonId. */
+    universeTo?: unknown;
+    nextAction?: unknown;
+    /** U04: the denied capability id on CAPABILITY_VIOLATION. */
+    capability?: unknown;
+    /** AR03: ArkRule identity for structure/invariant diagnostics. */
+    arkruleId?: unknown;
+    /** AR03: project-relative ArkRules source file that declared the rule. */
+    arkruleSource?: unknown;
+};
+type AdapterDiagnostic = {
+    ruleId: string;
+    severity: AdapterSeverity;
+    message: string;
+    location: {
+        file: string;
+        line: number;
+        column: number;
+    };
+    evidence: {
+        target?: string;
+        fromLayer?: string;
+        toLayer?: string;
+        typeOnly?: boolean;
+        targetTypeOnlyExports?: boolean;
+        sourcePureTypeModule?: boolean;
+        namedBindingsTypeOnly?: boolean;
+        portProofEligible?: boolean;
+        peerIsolation?: boolean;
+        capability?: string;
+        edgeKind?: string;
+        /** AR03 — ArkRule id (structure or invariant). */
+        arkruleId?: string;
+        /** AR03 — ArkRules source file path. */
+        arkruleSource?: string;
+        /** Nested-wall reason. Not part of the baseline key. */
+        reasonId?: 'CROSS_PARENT_SLICE' | 'CROSS_SIBLING_SLICE' | 'CROSS_PARENT_VIA_SHARED';
+        /** Last segment of the importer universe id, with a reasonId. */
+        universeFrom?: string;
+        /** Last segment of the importee universe id, with a reasonId. */
+        universeTo?: string;
+    };
+    /** Added in schema 1.1; optional in TypeScript so 1.0 consumer-owned values remain valid. */
+    nextAction?: string;
+    /**
+     * ACS06 / schema 1.5 — compact stable id for multi-turn re-address
+     * (`fnv1a-` + hex). Always derived from `targetKey`. Optional so 1.0–1.4
+     * consumer-owned diagnostics remain assignable.
+     */
+    findingRef?: string;
+    /**
+     * ACS06 / schema 1.5 — baseline-compatible freeze identity
+     * (`ruleId|file|fromLayer|toLayer|target`, with occurrence `#N` suffixes in lists).
+     * Must match `baselineKey` / `baselineOccurrenceKeys` so refs never orphan baselines.
+     */
+    targetKey?: string;
+    /**
+     * ACS06 / schema 1.5 — package-relative docs path with rule anchor
+     * (`docs/diagnostics.md#RULE_ID`). Optional for legacy consumer-owned values.
+     */
+    docsCodePath?: string;
+};
+type LegacyAdapterResult = {
+    schemaVersion: '1.0' | '1.1';
+    valid: boolean;
+    diagnostics: AdapterDiagnostic[];
+    completeness?: never;
+    mode?: never;
+};
+type Version12AdapterResultBase = {
+    schemaVersion: '1.2';
+    diagnostics: AdapterDiagnostic[];
+    mode?: never;
+};
+type Version12AdapterResult = (Version12AdapterResultBase & {
+    completeness: 'complete';
+    valid: boolean;
+}) | (Version12AdapterResultBase & {
+    completeness: 'partial' | 'unavailable';
+    valid: false;
+});
+type CurrentAdapterResultBase = {
+    schemaVersion: typeof ARK_ANALYSIS_RESULT_SCHEMA_VERSION;
+    completenessReasons: AdapterCompletenessReason[];
+    diagnostics: AdapterDiagnostic[];
+};
+type ResolvedAdapterEvidence = {
+    policyHash: string;
+    resolverIdentity: string;
+    factsHash: string;
+    candidateTreeHash: string;
+};
+type CurrentAdapterResult = (CurrentAdapterResultBase & Partial<ResolvedAdapterEvidence> & {
+    mode: 'lexical-compatibility';
+    valid: boolean;
+    completeness: 'complete';
+}) | (CurrentAdapterResultBase & Partial<ResolvedAdapterEvidence> & {
+    mode: 'lexical-compatibility';
+    valid: false;
+    completeness: 'partial' | 'unavailable';
+}) | (CurrentAdapterResultBase & ResolvedAdapterEvidence & {
+    mode: 'resolved-candidate-facts';
+    valid: boolean;
+    completeness: 'complete';
+}) | (CurrentAdapterResultBase & ResolvedAdapterEvidence & {
+    mode: 'resolved-candidate-facts';
+    valid: false;
+    completeness: 'partial';
+}) | (CurrentAdapterResultBase & Partial<ResolvedAdapterEvidence> & {
+    mode: 'resolved-candidate-facts';
+    valid: false;
+    completeness: 'unavailable';
+});
+type AdapterResult = LegacyAdapterResult | Version12AdapterResult | CurrentAdapterResult;
+declare const ARK_ANALYSIS_RESULT_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://unpkg.com/arkgate@3/schemas/ark.analysis-result.schema.json";
+    readonly title: "ArkGate analysis result";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["schemaVersion", "mode", "valid", "completeness", "completenessReasons", "diagnostics"];
+    readonly allOf: readonly [{
+        readonly if: {
+            readonly properties: {
+                readonly completeness: {
+                    readonly enum: readonly ["partial", "unavailable"];
+                };
+            };
+            readonly required: readonly ["completeness"];
+        };
+        readonly then: {
+            readonly properties: {
+                readonly valid: {
+                    readonly const: false;
+                };
+            };
+        };
+    }, {
+        readonly if: {
+            readonly properties: {
+                readonly mode: {
+                    readonly const: "resolved-candidate-facts";
+                };
+                readonly completeness: {
+                    readonly enum: readonly ["complete", "partial"];
+                };
+            };
+            readonly required: readonly ["mode", "completeness"];
+        };
+        readonly then: {
+            readonly required: readonly ["policyHash", "resolverIdentity", "factsHash", "candidateTreeHash"];
+        };
+    }, {
+        readonly if: {
+            readonly properties: {
+                readonly completeness: {
+                    readonly const: "complete";
+                };
+            };
+            readonly required: readonly ["completeness"];
+        };
+        readonly then: {
+            readonly properties: {
+                readonly completenessReasons: {
+                    readonly maxItems: 0;
+                };
+            };
+        };
+        readonly else: {
+            readonly properties: {
+                readonly completenessReasons: {
+                    readonly minItems: 1;
+                };
+            };
+        };
+    }];
+    readonly properties: {
+        readonly schemaVersion: {
+            readonly const: "1.5";
+        };
+        readonly mode: {
+            readonly enum: readonly ["lexical-compatibility", "resolved-candidate-facts"];
+        };
+        readonly valid: {
+            readonly type: "boolean";
+        };
+        readonly completeness: {
+            readonly enum: readonly ["complete", "partial", "unavailable"];
+        };
+        readonly completenessReasons: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["code", "message"];
+                readonly properties: {
+                    readonly code: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly message: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly policyHash: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly resolverIdentity: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly factsHash: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly candidateTreeHash: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly diagnostics: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["ruleId", "severity", "message", "location", "evidence"];
+                readonly properties: {
+                    readonly ruleId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly severity: {
+                        readonly enum: readonly ["error", "warning"];
+                    };
+                    readonly message: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly location: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["file", "line", "column"];
+                        readonly properties: {
+                            readonly file: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly line: {
+                                readonly type: "integer";
+                                readonly minimum: 1;
+                            };
+                            readonly column: {
+                                readonly type: "integer";
+                                readonly minimum: 1;
+                            };
+                        };
+                    };
+                    readonly evidence: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly properties: {
+                            readonly target: {
+                                readonly type: "string";
+                            };
+                            readonly fromLayer: {
+                                readonly type: "string";
+                            };
+                            readonly toLayer: {
+                                readonly type: "string";
+                            };
+                            readonly typeOnly: {
+                                readonly type: "boolean";
+                            };
+                            readonly targetTypeOnlyExports: {
+                                readonly type: "boolean";
+                            };
+                            readonly sourcePureTypeModule: {
+                                readonly type: "boolean";
+                            };
+                            readonly namedBindingsTypeOnly: {
+                                readonly type: "boolean";
+                            };
+                            readonly portProofEligible: {
+                                readonly type: "boolean";
+                            };
+                            readonly peerIsolation: {
+                                readonly type: "boolean";
+                            };
+                            readonly capability: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly edgeKind: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly arkruleId: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly arkruleSource: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly reasonId: {
+                                readonly enum: readonly ["CROSS_PARENT_SLICE", "CROSS_SIBLING_SLICE", "CROSS_PARENT_VIA_SHARED"];
+                            };
+                            readonly universeFrom: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly universeTo: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                        };
+                    };
+                    readonly nextAction: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    /** ACS06 — compact multi-turn id; always derived from targetKey when emitted. */
+                    readonly findingRef: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^fnv1a-[0-9a-f]{8}$";
+                    };
+                    /**
+                     * ACS06 — baseline-compatible freeze identity
+                     * (`ruleId|file|from|to|target` with optional `#N` occurrence suffix).
+                     */
+                    readonly targetKey: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    /** ACS06 — package-relative diagnostics anchor path. */
+                    readonly docsCodePath: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+    };
 };
-/** Shadow: identity snapshot. The live kernel is not copied. */
-declare function shadowInformationPackage(pack: DependencyInformationPackage): DependencyInformationPackage;
-declare function compareInformationPackages(left: DependencyInformationPackage, right: DependencyInformationPackage): InformationPackageCompare;
-/**
- * Replay: apply sequential snapshots as the "tape". Each step is compared to
- * the previous shadow. No bus, no store, no time travel across processes.
- */
-declare function replayInformationPackages(tape: readonly DependencyInformationPackage[]): InformationPackageCompare[];
 
+declare function toAdapterDiagnostic(violation: AdapterViolationInput, fallbackSeverity?: AdapterSeverity, 
 /**
- * Default cap for in-memory history, trace, and audit records. Without a cap a
- * long-running process grows without bound on every publish. Pass
- * `maxHistorySize: Infinity` to explicitly opt back into unbounded retention.
+ * Optional precomputed baseline-compatible targetKey (e.g. occurrence-aware from
+ * `adapterFindingOccurrenceTargetKeys`). When omitted, uses the first-occurrence key.
  */
-declare const DEFAULT_MAX_HISTORY_SIZE = 1000;
-declare function createArkKernel(options?: CreateArkKernelOptions): ArkKernel;
+targetKeyOverride?: string): AdapterDiagnostic;
+declare function createAdapterResult(input: {
+    valid: boolean;
+    completeness?: AnalysisCompleteness;
+    mode?: AnalysisMode;
+    policyHash?: unknown;
+    resolverIdentity?: unknown;
+    factsHash?: unknown;
+    candidateTreeHash?: unknown;
+    completenessReasons?: readonly AdapterCompletenessReason[];
+    violations?: readonly AdapterViolationInput[];
+    warnings?: readonly AdapterViolationInput[];
+}): CurrentAdapterResult;
+
 /**
- * Preferred ArkRun factory. Each call is a new isolated instance — there is no
- * process-wide singleton.
+ * AI Code Gate (basic).
+ *
+ * Allows validation of generated source code against the defined architecture.
+ */
+interface AICodeGateViolation {
+    /** Stable rule identifier for agents and CI pipelines. */
+    ruleId: string;
+    /** @deprecated Use ruleId — kept for backward compatibility. */
+    code: string;
+    message: string;
+    line?: number;
+    suggestion?: string;
+    source?: string;
+    filePath?: string;
+    target?: string;
+    fromLayer?: string;
+    toLayer?: string;
+    /** Nested-wall reason. Absent on a classic layer deny and on a child-only parent import. */
+    reasonId?: string;
+    /** Last segment of the importer universe id, with a reasonId. */
+    universeFrom?: string;
+    /** Last segment of the importee universe id, with a reasonId. */
+    universeTo?: string;
+    /** True when a peerIsolation rule produced this finding (also mirrored in details). */
+    peerIsolation?: boolean;
+    /** False for an advisory sibling crossing. Omitted findings still block the snippet. */
+    failsStrict?: boolean;
+    details?: unknown;
+}
+/** Extension point for external analyzers (AST, semantic, etc.). */
+interface AIGateExtension<Context = unknown> {
+    readonly name: string;
+    analyze(source: string, context?: Context): AICodeGateViolation[];
+}
+interface AICodeGateContext {
+    filePath?: string;
+    agentId?: string;
+    layer?: string;
+    [key: string]: unknown;
+}
+interface AICodeGateResult {
+    /** Single-source snippets do not carry project-wide resolver evidence. */
+    mode: 'lexical-compatibility';
+    /** A snippet result is intentionally never an authoritative complete verdict. */
+    completeness: 'partial';
+    completenessReasons: string[];
+    /** Authoritative verdict. Always false until the complete candidate is resolved. */
+    valid: boolean;
+    /** Compatibility signal for the bounded lexical checks performed here. */
+    lexicalValid: boolean;
+    violations: AICodeGateViolation[];
+}
+interface AICodeGate<Context = AICodeGateContext> {
+    validate(source: string, context?: Context): AICodeGateResult;
+}
+
+/**
+ * Basic AI Code Gate implementation.
+ *
+ * Uses simple string heuristics + registered intent names to detect obvious
+ * architectural violations in generated code (e.g. direct infra imports from domain).
+ * Not a full static analyzer — documented limitation.
+ */
+
+interface AICodeGatePolicyContext<Context = AICodeGateContext> {
+    source: string;
+    context?: Context;
+}
+interface AICodeGateOptions<Context = AICodeGateContext> {
+    policies?: Policy<AICodeGatePolicyContext<Context>>[];
+    intents?: Array<string | Pick<IntentCreator<IntentName, unknown>, 'name'>>;
+    /**
+     * Additional forbidden patterns (regex or strings).
+     */
+    forbiddenPatterns?: Array<string | RegExp>;
+    /**
+     * External analyzer extensions (type-only contract; plug in AST tools later).
+     */
+    extensions?: AIGateExtension<Context>[];
+    /**
+     * Optional architecture profile for layer-aware generated-code checks.
+     * When context.layer is provided, intent references are checked against it.
+     */
+    architectureProfile?: ArchitectureProfile;
+    /**
+     * When true, flag string literals that look like intent names but are not registered.
+     */
+    enforceIntentAllowlist?: boolean;
+    /**
+     * Optional TypeScript module object. When provided, AICodeGate adds AST-backed checks
+     * for publish misuse without taking a runtime dependency on TypeScript.
+     */
+    typescript?: unknown;
+    /**
+     * Ambient globals forbidden per layer (layer name → entries such as "fetch" or
+     * "Date.now"). Checked only when `typescript` is provided and context.layer resolves
+     * to a listed layer — mirrors ark-check's FORBIDDEN_GLOBAL rule.
+     */
+    forbiddenGlobals?: Record<string, string[]>;
+    /**
+     * Layer → effective capability deny set (U04 walls; ADR 0009). Enforced like
+     * forbiddenGlobals when the target file's layer is known. An ambient use
+     * already covered by the layer's forbiddenGlobals reports only
+     * FORBIDDEN_GLOBAL (D7 — one violation, one voice).
+     */
+    capabilityWalls?: Record<string, string[]>;
+    /**
+     * Layer names whose role is infrastructure and may therefore import infrastructure
+     * (a persistence adapter importing the DB is correct, not a violation). The built-in
+     * infra-import heuristics are suppressed for these layers and for any layer whose
+     * name matches the conventional infra tokens. Populate from ark.config.json layers
+     * flagged `mayImportInfrastructure: true`, so unconventionally-named infra layers
+     * opt in explicitly. User-supplied `forbiddenPatterns` still apply everywhere.
+     */
+    infrastructureLayers?: string[];
+    /**
+     * Preferred single resolve step: import specifier or absolute source file →
+     * `{ layer, relPath }` for contract + peerIsolation. Prefer this over the
+     * legacy layer-only callback.
+     */
+    resolveImportTarget?: (specifierOrFilePath: string, fromFilePath?: string) => {
+        layer?: string;
+        relPath?: string;
+    } | undefined;
+    /**
+     * @deprecated Prefer resolveImportTarget. Layer-only resolve for governed imports.
+     */
+    resolveImportLayer?: (specifier: string, fromFilePath?: string) => string | undefined;
+    /**
+     * Layer configs (patterns) used to infer sliceFolders when a peerIsolation rule
+     * omits an explicit list.
+     */
+    architectureLayers?: Array<{
+        name: string;
+        patterns?: string[];
+    }>;
+    /** Explicit file-level escape hatch for reviewed non-literal import()/require() calls. */
+    allowNonLiteralDynamicImport?: (filePath?: string) => boolean;
+}
+declare function createAICodeGate<Context = AICodeGateContext>(options?: AICodeGateOptions<Context>): AICodeGate<Context>;
+
+/**
+ * Portable identity/fingerprint primitives for pure Domain contracts.
+ *
+ * FNV-1a is intentional: no Node crypto dependency for CLI/MCP/browserless consumers.
+ */
+/** Stable FNV-1a hash. Identity/fingerprint only — not a security primitive. */
+declare function deterministicHash(value: string): string;
+/** Serialize JSON-like values with sorted object keys for reproducible hashes. */
+declare function stableSerialize(value: unknown): string;
+
+/**
+ * ArkOrder resolver-fact extraction (ADR 0029). Syntax only — no verdicts.
+ */
+
+type ResolvedArkOrderPlaneCallFact = {
+    file: string;
+    line: number;
+    callee: string;
+};
+type ResolvedArkOrderGenericUpdateFact = {
+    file: string;
+    line: number;
+    method: string;
+};
+type ResolvedArkOrderRootHitFact = {
+    file: string;
+    matchedRoot: string;
+    hasPlaneFactory: boolean;
+};
+type ResolvedArkOrderXiFieldWriteFact = {
+    file: string;
+    line: number;
+    key: string;
+};
+type ResolvedArkOrderIngestWriteFact = {
+    file: string;
+    line: number;
+};
+type ResolvedArkOrderReleaseKeyCountFact = {
+    file: string;
+    line: number;
+    keyCount: number;
+};
+/** A freshness key (ttl/freshUntil/maxAge) inside the ξ literal of plane.release / proposeRelease. */
+type ResolvedArkOrderXiTtlFact = {
+    file: string;
+    line: number;
+    key: string;
+};
+/** A literal `allowedKinds` entry that a literal `informationBudget.cannotObserve` denies. */
+type ResolvedArkOrderBudgetLeakFact = {
+    file: string;
+    line: number;
+    kind: string;
+};
+
+/**
+ * Versioned type vocabulary for resolved candidate facts (schema 1.0).
+ *
+ * Pure declarations + schema version identity. Create/load live in
+ * resolvedCandidateFacts.ts; JSON Schema lives in resolvedCandidateFactsSchema.ts.
+ */
+
+/** 1.1 adds optional classShapes[] (ADR 0013). 1.2 adds optional ArkRun facts (ADR 0022). 1.0/1.1 remain loadable. */
+declare const RESOLVED_CANDIDATE_FACTS_SCHEMA_VERSION: "1.2";
+type ResolvedFactsCompleteness = 'complete' | 'partial' | 'unavailable';
+type ResolvedDependencyKind = 'import' | 'export' | 'dynamic-import' | 'require';
+type ResolvedDependencyState = 'resolved-project' | 'resolved-external' | 'unresolved' | 'dynamic';
+type ResolvedCapability = 'network' | 'filesystem' | 'clock' | 'randomness' | 'environment' | 'process' | 'persistence';
+type ResolvedFactsReason = {
+    code: string;
+    message: string;
+    file?: string;
+};
+type ResolvedFileFact = {
+    path: string;
+    contentHash: string;
+    parseStatus: 'parsed' | 'invalid';
+    parseDiagnosticCount: number;
+    exportsOnlyTypes: boolean;
+    typeOnlyExportNames: string[];
+    hasTopLevelSideEffects: boolean;
+};
+/** ADR 0022 kernel API call-site evidence. Sensors consume this in RN04. */
+type ResolvedArkRunKernelCallKind = 'factory' | 'publisher' | 'publish' | 'raise' | 'send' | 'subscribe' | 'register-handler' | 'resolve' | 'resolve-singleton';
+type ResolvedArkRunKernelCallFact = {
+    file: string;
+    line: number;
+    kind: ResolvedArkRunKernelCallKind;
+    callee: string;
+    viaImport: boolean;
+    receiver?: string;
+    nameLiteral?: string;
+};
+/** `new` of a class admitted for kernel creation (classShapes name or kernel import). */
+type ResolvedArkRunManagedNewFact = {
+    file: string;
+    line: number;
+    typeName: string;
+    importedFrom?: string;
+};
+/** Governed file that matched an `arkRun.compositionRoots` glob. */
+type ResolvedArkRunCompositionRootHitFact = {
+    file: string;
+    matchedRoot: string;
+    hasKernelFactory: boolean;
+};
+/** File-scoped interaction declaration lists (ADR 0023). Sensors consume this in RN04. */
+type ResolvedArkRunDeclarationFact = {
+    file: string;
+    line: number;
+    uses: string[];
+    reactsTo: string[];
+    raises: string[];
+    sends: string[];
+};
+/** ADR 0013 class-shape evidence for ArkRules structure sensors. */
+type ResolvedClassShapeFact = {
+    file: string;
+    className: string;
+    exported: boolean;
+    hasPublicMutableFields: boolean;
+    hasPublicSetters: boolean;
+    hasPublicConstructor: boolean;
+    hasStaticFactory: boolean;
+    mutatingMethods: readonly {
+        name: string;
+        referencesGuardOrPublish: boolean;
+    }[];
+    dataOnly?: boolean;
+    /** Source offset where the class-shape scan stopped (unwalkable body/header). */
+    truncatedUntil?: number;
+};
+type ResolvedDependencyFact = {
+    from: string;
+    specifier?: string;
+    kind: ResolvedDependencyKind;
+    typeOnly: boolean;
+    line: number;
+    resolution: ResolvedDependencyState;
+    target?: string;
+    namedBindings?: string[];
+    targetTypeOnlyExports?: boolean;
+    sourcePureTypeModule?: boolean;
+    namedBindingsTypeOnly?: boolean;
+    portProofEligible?: boolean;
+};
+type ResolvedCapabilityFact = {
+    file: string;
+    line: number;
+    symbol: string;
+    capability: ResolvedCapability;
+    source: 'ambient-global' | 'import-based';
+};
+type ResolvedAmbientFact = {
+    file: string;
+    line: number;
+    symbol: string;
+};
+type ResolvedPublishFact = {
+    file: string;
+    line: number;
+    rawIntentName?: string;
+    objectHasIntent: boolean;
+    arkPublishCandidate: boolean;
+    hasSource: boolean;
+    sourceIntent?: string;
+};
+type ResolvedIntentReferenceFact = {
+    file: string;
+    line: number;
+    intent: string;
+};
+type ResolvedSafetyKind = 'ts-suppression' | 'any-cast' | 'dynamic-import' | 'dynamic-require' | 'in-memory-store';
+/** Neutral syntax evidence for policy-controlled safety diagnostics. */
+type ResolvedSafetyFact = {
+    file: string;
+    line: number;
+    kind: ResolvedSafetyKind;
+    symbol?: string;
+};
+type ResolvedCandidateFactsInput = {
+    schemaVersion: '1.0' | '1.1' | typeof RESOLVED_CANDIDATE_FACTS_SCHEMA_VERSION;
+    completeness: ResolvedFactsCompleteness;
+    completenessReasons: readonly ResolvedFactsReason[];
+    resolverIdentity: string;
+    compilerIdentity: string;
+    compilerOptionsHash: string;
+    tsconfigHash: string;
+    evidenceRequirementsHash: string;
+    projectPackageName?: string;
+    files: readonly ResolvedFileFact[];
+    dependencies: readonly ResolvedDependencyFact[];
+    capabilityUses: readonly ResolvedCapabilityFact[];
+    ambientUses: readonly ResolvedAmbientFact[];
+    publishCalls: readonly ResolvedPublishFact[];
+    intentReferences: readonly ResolvedIntentReferenceFact[];
+    safetyUses: readonly ResolvedSafetyFact[];
+    /** ADR 0013 — optional on 1.0; default [] on load. */
+    classShapes?: readonly ResolvedClassShapeFact[];
+    /** ADR 0022 / RN03 — optional on 1.0/1.1; default [] on load. */
+    arkRunKernelCalls?: readonly ResolvedArkRunKernelCallFact[];
+    arkRunManagedNews?: readonly ResolvedArkRunManagedNewFact[];
+    arkRunCompositionRootHits?: readonly ResolvedArkRunCompositionRootHitFact[];
+    arkRunDeclarations?: readonly ResolvedArkRunDeclarationFact[];
+    arkOrderPlaneCalls?: readonly ResolvedArkOrderPlaneCallFact[];
+    arkOrderGenericUpdates?: readonly ResolvedArkOrderGenericUpdateFact[];
+    arkOrderRootHits?: readonly ResolvedArkOrderRootHitFact[];
+    arkOrderXiFieldWrites?: readonly ResolvedArkOrderXiFieldWriteFact[];
+    arkOrderIngestWritesXi?: readonly ResolvedArkOrderIngestWriteFact[];
+    arkOrderReleaseKeyCounts?: readonly ResolvedArkOrderReleaseKeyCountFact[];
+    arkOrderXiTtlKeys?: readonly ResolvedArkOrderXiTtlFact[];
+    arkOrderBudgetLeaks?: readonly ResolvedArkOrderBudgetLeakFact[];
+};
+type ResolvedCandidateFacts = Omit<ResolvedCandidateFactsInput, 'candidateTreeHash' | 'classShapes' | 'arkRunKernelCalls' | 'arkOrderPlaneCalls' | 'arkOrderGenericUpdates' | 'arkOrderXiFieldWrites' | 'arkOrderIngestWritesXi' | 'arkOrderReleaseKeyCounts' | 'arkOrderXiTtlKeys' | 'arkOrderBudgetLeaks' | 'arkOrderRootHits' | 'arkRunManagedNews' | 'arkRunCompositionRootHits' | 'arkRunDeclarations'> & {
+    schemaVersion: typeof RESOLVED_CANDIDATE_FACTS_SCHEMA_VERSION;
+    completenessReasons: ResolvedFactsReason[];
+    candidateTreeHash: string;
+    files: ResolvedFileFact[];
+    dependencies: ResolvedDependencyFact[];
+    capabilityUses: ResolvedCapabilityFact[];
+    ambientUses: ResolvedAmbientFact[];
+    publishCalls: ResolvedPublishFact[];
+    intentReferences: ResolvedIntentReferenceFact[];
+    safetyUses: ResolvedSafetyFact[];
+    classShapes: ResolvedClassShapeFact[];
+    arkRunKernelCalls: ResolvedArkRunKernelCallFact[];
+    arkRunManagedNews: ResolvedArkRunManagedNewFact[];
+    arkRunCompositionRootHits: ResolvedArkRunCompositionRootHitFact[];
+    arkRunDeclarations: ResolvedArkRunDeclarationFact[];
+    arkOrderPlaneCalls: ResolvedArkOrderPlaneCallFact[];
+    arkOrderGenericUpdates: ResolvedArkOrderGenericUpdateFact[];
+    arkOrderRootHits: ResolvedArkOrderRootHitFact[];
+    arkOrderXiFieldWrites: ResolvedArkOrderXiFieldWriteFact[];
+    arkOrderIngestWritesXi: ResolvedArkOrderIngestWriteFact[];
+    arkOrderReleaseKeyCounts: ResolvedArkOrderReleaseKeyCountFact[];
+    arkOrderXiTtlKeys: ResolvedArkOrderXiTtlFact[];
+    arkOrderBudgetLeaks: ResolvedArkOrderBudgetLeakFact[];
+    factsHash: string;
+};
+
+/**
+ * Canonical create/load for versioned resolved candidate facts.
+ *
+ * Types: resolvedCandidateFactsTypes.ts · Schema: resolvedCandidateFactsSchema.ts ·
+ * Hash: stableHash.ts. Plan-B god-module pilot cluster (pattern-b:god-module).
+ */
+
+/** Identity of the policy-controlled evidence a resolver must attempt to collect. */
+declare function resolvedFactsEvidenceRequirementsHash(config: ArkConfig): string;
+declare function createResolvedCandidateFacts(input: ResolvedCandidateFactsInput): ResolvedCandidateFacts;
+declare function loadResolvedCandidateFacts(input: unknown): ResolvedCandidateFacts;
+
+declare const RESOLVED_CANDIDATE_FACTS_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://unpkg.com/arkgate@3/schemas/ark.resolved-candidate-facts.schema.json";
+    readonly title: "ArkGate resolved candidate facts";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["schemaVersion", "completeness", "completenessReasons", "resolverIdentity", "compilerIdentity", "compilerOptionsHash", "tsconfigHash", "candidateTreeHash", "evidenceRequirementsHash", "files", "dependencies", "capabilityUses", "ambientUses", "publishCalls", "intentReferences", "safetyUses", "factsHash"];
+    readonly properties: {
+        readonly schemaVersion: {
+            readonly enum: readonly ["1.0", "1.1", "1.2"];
+        };
+        readonly completeness: {
+            readonly enum: readonly ["complete", "partial", "unavailable"];
+        };
+        readonly completenessReasons: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["code", "message"];
+                readonly properties: {
+                    readonly code: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly message: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                };
+            };
+        };
+        readonly resolverIdentity: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly compilerIdentity: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly compilerOptionsHash: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly tsconfigHash: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly candidateTreeHash: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly evidenceRequirementsHash: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly projectPackageName: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly files: {
+            readonly type: "array";
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["path", "contentHash", "parseStatus", "parseDiagnosticCount", "exportsOnlyTypes", "typeOnlyExportNames", "hasTopLevelSideEffects"];
+                readonly properties: {
+                    readonly path: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly contentHash: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly parseStatus: {
+                        readonly enum: readonly ["parsed", "invalid"];
+                    };
+                    readonly parseDiagnosticCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                    };
+                    readonly exportsOnlyTypes: {
+                        readonly type: "boolean";
+                    };
+                    readonly typeOnlyExportNames: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                    readonly hasTopLevelSideEffects: {
+                        readonly type: "boolean";
+                    };
+                };
+                readonly allOf: readonly [{
+                    readonly if: {
+                        readonly properties: {
+                            readonly parseStatus: {
+                                readonly const: "parsed";
+                            };
+                        };
+                    };
+                    readonly then: {
+                        readonly properties: {
+                            readonly parseDiagnosticCount: {
+                                readonly const: 0;
+                            };
+                        };
+                    };
+                }, {
+                    readonly if: {
+                        readonly properties: {
+                            readonly parseStatus: {
+                                readonly const: "invalid";
+                            };
+                        };
+                    };
+                    readonly then: {
+                        readonly properties: {
+                            readonly parseDiagnosticCount: {
+                                readonly minimum: 1;
+                            };
+                        };
+                    };
+                }];
+            };
+        };
+        readonly dependencies: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["from", "kind", "typeOnly", "line", "resolution"];
+                readonly properties: {
+                    readonly from: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly specifier: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly kind: {
+                        readonly enum: readonly ["import", "export", "dynamic-import", "require"];
+                    };
+                    readonly typeOnly: {
+                        readonly type: "boolean";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly resolution: {
+                        readonly enum: readonly ["resolved-project", "resolved-external", "unresolved", "dynamic"];
+                    };
+                    readonly target: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly namedBindings: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                    readonly targetTypeOnlyExports: {
+                        readonly type: "boolean";
+                    };
+                    readonly sourcePureTypeModule: {
+                        readonly type: "boolean";
+                    };
+                    readonly namedBindingsTypeOnly: {
+                        readonly type: "boolean";
+                    };
+                    readonly portProofEligible: {
+                        readonly type: "boolean";
+                    };
+                };
+                readonly allOf: readonly [{
+                    readonly if: {
+                        readonly properties: {
+                            readonly resolution: {
+                                readonly const: "resolved-project";
+                            };
+                        };
+                    };
+                    readonly then: {
+                        readonly required: readonly ["target"];
+                    };
+                    readonly else: {
+                        readonly not: {
+                            readonly required: readonly ["target"];
+                        };
+                    };
+                }, {
+                    readonly if: {
+                        readonly properties: {
+                            readonly resolution: {
+                                readonly const: "dynamic";
+                            };
+                        };
+                    };
+                    readonly else: {
+                        readonly required: readonly ["specifier"];
+                    };
+                }];
+            };
+        };
+        readonly capabilityUses: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "symbol", "capability", "source"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly symbol: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly capability: {
+                        readonly enum: readonly ["network", "filesystem", "clock", "randomness", "environment", "process", "persistence"];
+                    };
+                    readonly source: {
+                        readonly enum: readonly ["ambient-global", "import-based"];
+                    };
+                };
+            };
+        };
+        readonly ambientUses: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "symbol"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly symbol: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly publishCalls: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "objectHasIntent", "arkPublishCandidate", "hasSource"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly rawIntentName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly objectHasIntent: {
+                        readonly type: "boolean";
+                    };
+                    readonly arkPublishCandidate: {
+                        readonly type: "boolean";
+                    };
+                    readonly hasSource: {
+                        readonly type: "boolean";
+                    };
+                    readonly sourceIntent: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly intentReferences: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "intent"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly intent: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly safetyUses: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "kind"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly kind: {
+                        readonly enum: readonly ["ts-suppression", "any-cast", "dynamic-import", "dynamic-require", "in-memory-store"];
+                    };
+                    readonly symbol: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+                readonly allOf: readonly [{
+                    readonly if: {
+                        readonly properties: {
+                            readonly kind: {
+                                readonly const: "in-memory-store";
+                            };
+                        };
+                    };
+                    readonly then: {
+                        readonly required: readonly ["symbol"];
+                    };
+                    readonly else: {
+                        readonly not: {
+                            readonly required: readonly ["symbol"];
+                        };
+                    };
+                }];
+            };
+        };
+        readonly classShapes: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "className", "exported", "hasPublicMutableFields", "hasPublicSetters", "hasPublicConstructor", "hasStaticFactory", "mutatingMethods"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly className: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly exported: {
+                        readonly type: "boolean";
+                    };
+                    readonly hasPublicMutableFields: {
+                        readonly type: "boolean";
+                    };
+                    readonly hasPublicSetters: {
+                        readonly type: "boolean";
+                    };
+                    readonly hasPublicConstructor: {
+                        readonly type: "boolean";
+                    };
+                    readonly hasStaticFactory: {
+                        readonly type: "boolean";
+                    };
+                    readonly dataOnly: {
+                        readonly type: "boolean";
+                    };
+                    readonly truncatedUntil: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                    };
+                    readonly mutatingMethods: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["name", "referencesGuardOrPublish"];
+                            readonly properties: {
+                                readonly name: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                };
+                                readonly referencesGuardOrPublish: {
+                                    readonly type: "boolean";
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        readonly arkRunKernelCalls: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "kind", "callee", "viaImport"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly kind: {
+                        readonly enum: readonly ["factory", "publisher", "publish", "raise", "send", "subscribe", "register-handler", "resolve", "resolve-singleton"];
+                    };
+                    readonly callee: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly viaImport: {
+                        readonly type: "boolean";
+                    };
+                    readonly receiver: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly nameLiteral: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly arkRunManagedNews: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "typeName"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly typeName: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly importedFrom: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly arkRunCompositionRootHits: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "matchedRoot", "hasKernelFactory"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly matchedRoot: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly hasKernelFactory: {
+                        readonly type: "boolean";
+                    };
+                };
+            };
+        };
+        readonly arkRunDeclarations: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "uses", "reactsTo", "raises", "sends"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly uses: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                    readonly reactsTo: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                    readonly raises: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                    readonly sends: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                };
+            };
+        };
+        readonly arkOrderPlaneCalls: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "callee"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly callee: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly arkOrderGenericUpdates: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "method"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly method: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly arkOrderRootHits: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "matchedRoot", "hasPlaneFactory"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly matchedRoot: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly hasPlaneFactory: {
+                        readonly type: "boolean";
+                    };
+                };
+            };
+        };
+        readonly arkOrderXiFieldWrites: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "key"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly key: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly arkOrderIngestWritesXi: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                };
+            };
+        };
+        readonly arkOrderReleaseKeyCounts: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "keyCount"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly keyCount: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                };
+            };
+        };
+        readonly arkOrderXiTtlKeys: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "key"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly key: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly arkOrderBudgetLeaks: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["file", "line", "kind"];
+                readonly properties: {
+                    readonly file: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly pattern: "^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$";
+                    };
+                    readonly line: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    };
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly factsHash: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+    };
+    readonly allOf: readonly [{
+        readonly if: {
+            readonly properties: {
+                readonly completeness: {
+                    readonly const: "complete";
+                };
+            };
+        };
+        readonly then: {
+            readonly properties: {
+                readonly completenessReasons: {
+                    readonly maxItems: 0;
+                };
+                readonly files: {
+                    readonly items: {
+                        readonly properties: {
+                            readonly parseStatus: {
+                                readonly const: "parsed";
+                            };
+                        };
+                    };
+                };
+            };
+        };
+    }, {
+        readonly if: {
+            readonly properties: {
+                readonly completeness: {
+                    readonly enum: readonly ["partial", "unavailable"];
+                };
+            };
+        };
+        readonly then: {
+            readonly properties: {
+                readonly completenessReasons: {
+                    readonly minItems: 1;
+                };
+            };
+        };
+    }];
+};
+
+/**
+ * Stable, pure vocabulary for ArkGate's importable analysis engine.
+ *
+ * This module owns the Analysis IR types and re-exports the resolved-candidate-facts
+ * pilot cluster (plan-B / pattern-b:god-module). Parsing and filesystem discovery
+ * belong to adapters.
+ *
+ * Cluster:
+ * - `stableHash` — identity/fingerprint primitives
+ * - `resolvedCandidateFactsTypes` — versioned fact types
+ * - `resolvedCandidateFacts` — create/load/canonicalize
+ * - `resolvedCandidateFactsSchema` — published JSON Schema
+ *
+ * Consumer import paths through this facade remain stable (same pattern as Kernel
+ * `analysis.ts` after U02).
+ */
+
+declare const ANALYSIS_IR_SCHEMA_VERSION: "1.0";
+type AnalysisFileInput = {
+    path: string;
+    content: string;
+};
+type AnalysisFileChange = {
+    path: string;
+    content: string;
+} | {
+    path: string;
+    delete: true;
+};
+type AnalysisCompilerOptions = Readonly<Record<string, unknown>>;
+type AnalysisFile = AnalysisFileInput & {
+    contentHash: string;
+    layer: string | null;
+};
+type AnalysisImportEdge = {
+    from: string;
+    specifier: string;
+    to: string | null;
+    resolution: 'resolved' | 'unresolved';
+    fromLayer: string | null;
+    toLayer: string | null;
+    evidence: AnalysisEvidence;
+};
+/** A capability use is reserved for C04's symbol-aware implementation. */
+type AnalysisCapabilityUse = {
+    file: string;
+    symbol: string;
+    capability: string;
+    evidence: AnalysisEvidence;
+};
+type AnalysisEvidence = {
+    kind: 'import' | 'policy';
+    file: string;
+    line: number;
+    excerpt: string;
+};
+type AnalysisViolation = {
+    ruleId: string;
+    message: string;
+    edge?: AnalysisImportEdge;
+    /** U04 (additive): present on CAPABILITY_VIOLATION — the denied capability id. */
+    capability?: string;
+    /** U04 (additive): the matched module specifier or ambient path. */
+    symbol?: string;
+    evidence: AnalysisEvidence;
+};
+type AnalysisIr = {
+    schemaVersion: typeof ANALYSIS_IR_SCHEMA_VERSION;
+    policyHash: string;
+    compilerOptionsHash: string;
+    files: AnalysisFile[];
+    layers: string[];
+    edges: AnalysisImportEdge[];
+    capabilityUses: AnalysisCapabilityUse[];
+    violations: AnalysisViolation[];
+};
+
+declare const ARK_CHANGE_MAP_SCHEMA_VERSION: "1.0";
+type ArchitectureChangeOperation = 'create' | 'update' | 'delete';
+type ArchitectureChangeMapFile = {
+    path: string;
+    operation: ArchitectureChangeOperation;
+    layer: string;
+};
+type ArchitectureChangeMapDependency = {
+    from: string;
+    to: string;
+};
+type ArchitectureChangeMap = {
+    $schema: string;
+    schemaVersion: typeof ARK_CHANGE_MAP_SCHEMA_VERSION;
+    files: ArchitectureChangeMapFile[];
+    dependencies: ArchitectureChangeMapDependency[];
+};
+type ArchitectureChangeMapContract = {
+    map: ArchitectureChangeMap;
+    hash: string;
+};
+
+type ArchitectureDependency = {
+    from: string;
+    to: string;
+};
+type ArchitectureActualChange = {
+    path: string;
+    operation: ArchitectureChangeOperation;
+};
+type ArchitectureConvergenceClassification = 'satisfied' | 'missing' | 'contradictory' | 'unplanned';
+type ArchitectureConvergenceFinding = {
+    id: string;
+    classification: ArchitectureConvergenceClassification;
+    subject: 'file' | 'dependency';
+    message: string;
+    nextAction?: string;
+    path?: string;
+    from?: string;
+    to?: string;
+    expectedOperation?: ArchitectureChangeOperation;
+    actualOperation?: ArchitectureChangeOperation | 'added' | 'removed';
+};
+type ArchitectureConvergenceResult = {
+    schemaVersion: '1.0';
+    readOnly: true;
+    changeMapHash: string;
+    structurallyConverged: boolean;
+    behavioralCompletion: 'not-evaluated';
+    summary: Record<ArchitectureConvergenceClassification, number>;
+    findings: ArchitectureConvergenceFinding[];
+};
+type AnalyzeArchitectureConvergenceInput = {
+    changeMap: ArchitectureChangeMapContract;
+    changes: readonly ArchitectureActualChange[];
+    baseDependencies: readonly ArchitectureDependency[];
+    candidateDependencies: readonly ArchitectureDependency[];
+};
+declare function analyzeArchitectureConvergence(input: AnalyzeArchitectureConvergenceInput): ArchitectureConvergenceResult;
+
+type SemanticDependencyKind = 'import' | 'export' | 'dynamic-import' | 'require';
+type SemanticDependency = {
+    specifier?: string;
+    kind: SemanticDependencyKind;
+    line: number;
+    typeOnly: boolean;
+    unresolved: boolean;
+    node: unknown;
+};
+type ForbiddenCapabilityUse = {
+    name: string;
+    line: number;
+    node: unknown;
+};
+/** Extract every dependency form whose specifier is statically knowable, plus unresolved calls. */
+declare function extractSemanticDependencies(ts: any, sourceFile: any): SemanticDependency[];
+/** Resolve forbidden ambient capabilities through symbols, aliases, globalThis, and static keys. */
+declare function collectForbiddenCapabilityUses(ts: any, sourceFile: any, forbidden: readonly string[]): ForbiddenCapabilityUse[];
+
+/**
+ * Type vocabulary for ArkRules files (ADR 0012).
+ *
+ * Pure declarations only — runtime validation and the published JSON Schema live in
+ * ./arkRulesContract.ts so generate:cli-pure can emit a self-contained artifact.
+ */
+/** Closed sensor vocabulary (ADR 0013). Unknown sensors fail closed at load time. */
+declare const ARK_RULE_SENSOR_IDS: readonly ["aggregate-private-state", "always-valid-factory", "domain-event-on-mutation", "orchestration-only", "thin-adapter", "writes-via-aggregate", "no-anemic-model", "invariant-coverage"];
+type ArkRuleSensorId = (typeof ARK_RULE_SENSOR_IDS)[number];
+type ArkRuleMode = 'advisory' | 'enforced';
+type ArkRuleStructureEntry = {
+    id: string;
+    sensor: ArkRuleSensorId;
+    mode?: ArkRuleMode;
+    appliesTo?: string[];
+    description?: string;
+};
+type ArkRuleInvariantCoverage = {
+    test?: boolean;
+    symbol?: string;
+};
+type ArkRuleInvariantEntry = {
+    id: string;
+    description: string;
+    aggregate?: string;
+    coverage?: ArkRuleInvariantCoverage;
+    mode?: ArkRuleMode;
+    appliesTo?: string[];
+};
+type ArkRuleProvenance = {
+    sourceFile: string;
+    ruleId: string;
+    layer: string;
+    /** Set when the rule was read from a child-slice file. Absent on central files. */
+    childId?: string;
+};
+type EffectiveStructureRule = ArkRuleStructureEntry & {
+    mode: ArkRuleMode;
+    provenance: ArkRuleProvenance;
+};
+type EffectiveInvariantRule = ArkRuleInvariantEntry & {
+    mode: ArkRuleMode;
+    provenance: ArkRuleProvenance;
+};
+type EffectiveArkRules = {
+    schemaVersion: '1.0';
+    byLayer: Record<string, {
+        sourceFile: string;
+        /** Every file merged into this layer, central paths first. Absent on older catalogs. */
+        sourceFiles?: string[];
+        structure: EffectiveStructureRule[];
+        invariants: EffectiveInvariantRule[];
+    }>;
+    structure: EffectiveStructureRule[];
+    invariants: EffectiveInvariantRule[];
+};
+
+/** Priority order: guard-family operators first, constants last. */
+declare const INVARIANT_PROBE_OPERATORS: readonly ["negate-guard", "drop-throw", "flip-comparison", "boundary-shift", "const-shift"];
+type ProbeOperator = (typeof INVARIANT_PROBE_OPERATORS)[number];
+declare const INVARIANT_PROBE_VERDICTS: readonly ["killed", "survived", "not-reached", "inconclusive", "unprobeable"];
+type ProbeVerdict = (typeof INVARIANT_PROBE_VERDICTS)[number];
+declare const INVARIANT_PROBE_REASONS: readonly ["all-killed", "mutant-survived", "reach-canary-survived", "baseline-red", "baseline-timeout", "runner-error", "file-not-loaded", "mutant-runtime-error", "no-symbol", "declaration-only", "symbol-not-found", "no-covering-test", "no-site"];
+type ProbeReason = (typeof INVARIANT_PROBE_REASONS)[number];
+/** What promotion and status read from one row. */
+type InvariantProbeSummary = {
+    verdict: ProbeVerdict;
+    reason: ProbeReason;
+    /** False when a hashed input changed since the run; a stale row changes nothing. */
+    fresh: boolean;
+    survivors: Array<{
+        operator: ProbeOperator;
+        line: number;
+        original: string;
+        replacement: string;
+    }>;
+    staleBecause?: string[];
+    symbolFile?: string;
+    probedOn?: string;
+};
+
+/**
+ * Pure invariant coverage evidence (ADR 0014 / AR09–AR10).
+ *
+ * Mines test titles and symbol declarations against the Effective ArkRules catalog.
+ * `classifyCoverage` returns one verdict; `countsAsCoverage` is the policy;
+ * `describeCoverage` is the sentence. A bare mention is never coverage.
+ * No filesystem — Tooling supplies file contents and test globs.
+ */
+
+/**
+ * How a `coverage.symbol` identifier is declared. `type`, `interface`, and
+ * `enum` are declarations — the same witness as function, class, const, and
+ * method.
+ */
+type DeclarationShape = 'function' | 'class' | 'const' | 'method' | 'type' | 'interface' | 'enum';
+type InvariantCoverageEvidence = {
+    invariantId: string;
+    layer: string;
+    sourceFile: string;
+    mode: 'advisory' | 'enforced';
+    covered: boolean;
+    evidence: Array<'test-title' | 'symbol'>;
+    /** When no test globs were supplied, coverage cannot be proven. */
+    partial: boolean;
+    description: string;
+    /** Test file that supplied the `test-title` evidence, when there was one. */
+    testEvidenceFile?: string;
+    /**
+     * Non-test file that declares `coverage.symbol`. Absent when the name only
+     * appears in an import or a call. ArkGate never runs tests; this path is the
+     * declaration text, not a passing suite.
+     */
+    symbolEvidenceFile?: string;
+    /**
+     * Declaration shape when `evidence` includes `symbol`. Additive: readers that
+     * only know `test-title` | `symbol` ignore it.
+     */
+    shape?: DeclarationShape;
+    /**
+     * The only covering test found sits outside `coverage.coverageRoots` — the
+     * places the project declares its runner executes. ArkGate never runs tests,
+     * so a title match outside those roots is a test that exists, not a test that
+     * runs. Absent (undefined) when no roots were declared: without a declaration
+     * there is nothing to compare against, and silence is honest.
+     */
+    outsideDeclaredRoots?: boolean;
+    /**
+     * True when `coverage.coverageRoots` was non-empty for this evaluation.
+     * `false` when the project declared nothing. Omitted on hand-built evidence
+     * so existing promote fixtures stay valid; the evaluator always sets it.
+     */
+    coverageRootsDeclared?: boolean;
+    /**
+     * Committed mutation-probe evidence for this invariant (ADR 0039), attached
+     * by Tooling when `.ark/invariant-probe.json` has a row. Additive: absent on
+     * every evaluation that has no artifact. Only a fresh `survived` /
+     * `not-reached` changes promotion; every other state changes nothing.
+     */
+    probe?: InvariantProbeSummary;
+};
+/**
+ * What the Tooling scan actually saw. Every discard has a counted reason —
+ * a silent drop would make an uncovered verdict unexplainable.
+ */
+type InvariantCoverageStats = {
+    /**
+     * Files actually opened and read. Always >= filesLoaded: a test is read
+     * before it can be judged for naming an invariant, so the file budget bounds
+     * RETENTION, not I/O. Reporting only the retained count made
+     * `coverage.maxFiles` read as a knob on how much the scan opens.
+     */
+    filesRead?: number;
+    /** Files retained as coverage evidence (tests + production). */
+    filesLoaded: number;
+    /** Test files retained (subset of filesLoaded). */
+    testFilesRetained: number;
+    /** The file budget in force for this scan (config `coverage.maxFiles` or the default). */
+    maxFiles: number;
+    discarded: {
+        /** Reached the file budget. */
+        budget: number;
+        /** Test file naming no catalogued invariant (scanned, then dropped). */
+        noInvariantMention: number;
+        /** Larger than the per-file byte cap. */
+        oversize: number;
+        /**
+         * stat/read failed on a file or a directory: permissions, a broken symlink,
+         * or something that moved mid-scan. Files and directories share one counter.
+         */
+        unreadable: number;
+        /** Directory deeper than the walk depth limit — its files were never seen. */
+        depthLimited: number;
+        /**
+         * Symlink inside the tree whose target resolves outside the project root.
+         * Refused as evidence: a file that is not in this repo must not prove an
+         * invariant covered.
+         */
+        outOfRoot: number;
+    };
+};
+
+/**
+ * Pure ArkRules structure sensor evaluation (ADR 0013).
+ *
+ * Consumes closed class-shape / file facts + Effective ArkRules. Emits violations with
+ * arkrule provenance. No filesystem, no TypeScript compiler.
+ */
+
+type ClassShapeFact = {
+    file: string;
+    className: string;
+    exported: boolean;
+    hasPublicMutableFields: boolean;
+    hasPublicSetters: boolean;
+    hasPublicConstructor: boolean;
+    hasStaticFactory: boolean;
+    mutatingMethods: readonly {
+        name: string;
+        referencesGuardOrPublish: boolean;
+    }[];
+    /** Heuristic: data-only class (fields, no methods beyond accessors). */
+    dataOnly?: boolean;
+    /**
+     * Set when the scanner could not walk the class to its end: the character
+     * offset (in the source file) where analysis stopped. Enumerable on purpose so
+     * it survives fact canonicalisation and serialisation; enforced structure
+     * sensors report it instead of passing in silence.
+     */
+    truncatedUntil?: number;
+};
+
+/**
+ * Config-key version floors plus pin evidence (#338).
+ *
+ * A slice key such as `childSlices` is rejected at config load by an older
+ * arkgate (the rule schema sets `additionalProperties: false`). ArkGate warns
+ * about that only with evidence that this repo pins such an older arkgate: an
+ * exact package.json dependency, the installed copy, the lockfile, a hook
+ * script, or a CI workflow. Without evidence it stays silent.
+ *
+ * Pure: Tooling reads the files and passes their text here.
+ */
+/** Where a pin was found. */
+type ArkgatePinSource = 'package-json' | 'package-lock' | 'installed' | 'hook' | 'ci';
+type ArkgatePinEvidence = {
+    /** Repo-relative file that pins arkgate. */
+    file: string;
+    /** 1-based line of the pin. */
+    line: number;
+    /** Pinned version, without a leading `v`. */
+    version: string;
+    source: ArkgatePinSource;
+};
+
+declare const POLICY_DELTA_SCHEMA_VERSION: "1.0";
+type PolicyDeltaClassification = 'strengthening' | 'neutral' | 'judgment-required' | 'weakening';
+type PolicyDeltaFinding = {
+    id: string;
+    path: string;
+    classification: Exclude<PolicyDeltaClassification, 'neutral'>;
+    message: string;
+    nextAction?: string;
+    before?: unknown;
+    after?: unknown;
+};
+type PolicyDelta = {
+    schemaVersion: typeof POLICY_DELTA_SCHEMA_VERSION;
+    classification: PolicyDeltaClassification;
+    findings: PolicyDeltaFinding[];
+};
+type PolicyDeltaAcknowledgement = {
+    schemaVersion: typeof POLICY_DELTA_SCHEMA_VERSION;
+    basePolicyHash: string;
+    candidatePolicyHash: string;
+    findingIds: readonly string[];
+    reason: string;
+    /**
+     * Relative decision-note path under a conventional home (`docs/adr/`,
+     * `docs/decisions/`, or the AP01 single-file homes). Tooling checks the file.
+     * Hash matching does not require it.
+     */
+    adrPath?: string;
+};
+type ClassifyArkPolicyDeltaOptions = {
+    baseArkRules?: EffectiveArkRules;
+    candidateArkRules?: EffectiveArkRules;
+    /**
+     * AR11 — coverage evidence for candidate invariants. Required to auto-allow
+     * advisory→enforced promotion; without it (or when uncovered), promotion is
+     * judgment-required / refused.
+     */
+    candidateInvariantCoverage?: readonly InvariantCoverageEvidence[];
+};
+declare function classifyArkPolicyDelta(base: ArkConfig, candidate: ArkConfig, options?: ClassifyArkPolicyDeltaOptions): PolicyDelta;
+declare function policyDeltaAcknowledgementMatches(acknowledgement: PolicyDeltaAcknowledgement | undefined, expected: {
+    basePolicyHash: string;
+    candidatePolicyHash: string;
+    findingIds: readonly string[];
+}): boolean;
+
+type AnalysisContract = ArkConfigLoadResult & {
+    policyHash: string;
+    /**
+     * ADR 0012 Effective ArkRules (empty when arkRules is absent).
+     * Included in policyHash when non-empty so arkrules edits invalidate identity.
+     */
+    arkRules?: EffectiveArkRules;
+    /**
+     * ADR 0013 class-shape facts for ArkRules sensors (Tooling-supplied).
+     * Empty / absent when ArkRules are not active.
+     */
+    classShapes?: ClassShapeFact[];
+};
+type AnalyzeProjectInput = {
+    contract: AnalysisContract;
+    files: readonly AnalysisFileInput[];
+    compilerOptions?: AnalysisCompilerOptions;
+};
+type AnalyzeChangeInput = AnalyzeProjectInput & {
+    changes: readonly AnalysisFileChange[];
+    changeMap?: ArchitectureChangeMapContract;
+};
+type AnalysisResult = {
+    mode: 'lexical-compatibility';
+    completeness: ResolvedFactsCompleteness;
+    completenessReasons: ResolvedFactsReason[];
+    valid: boolean;
+    ir: AnalysisIr;
+};
+type AnalyzeResolvedProjectInput = {
+    contract: AnalysisContract;
+    facts: unknown;
+    /** Tooling FS evidence of arkgate pins. Omitted: version-floor warnings stay silent. */
+    arkgatePins?: readonly ArkgatePinEvidence[];
+    /** The running arkgate version, for the version-floor nextAction. */
+    runningArkgateVersion?: string;
+    /**
+     * D0 adopted or --require-gates / --strict-merge. When true, a missing
+     * domain-invariant tests path fails closed. Omitted stays silent.
+     */
+    adopted?: boolean;
+    /**
+     * Tooling FS check for the declared tests path. `false` means empty on disk.
+     * Omitted: a non-empty config declaration is enough.
+     */
+    invariantTestsPathPresent?: boolean;
+    /**
+     * Tooling FS check for declared `coverage.coverageRoots`. `false` means
+     * missing or empty on disk. Omitted: a non-empty config declaration is enough.
+     */
+    coverageRootsPresent?: boolean;
+    /**
+     * AR10 — Tooling-supplied contents for invariant coverage evidence.
+     * When omitted and the Effective Contract has invariants, coverage is partial
+     * (never false green covered).
+     */
+    coverageInputs?: {
+        fileContents: Readonly<Record<string, string>>;
+        testFiles?: readonly string[];
+        testGlobsMissing?: boolean;
+        coverageBudgetExhausted?: boolean;
+        /** Declared `coverage.coverageRoots`: where the project says its runner runs. */
+        coverageRoots?: readonly string[];
+        /** Counted scan facts: files loaded, tests retained, discards by reason. */
+        stats?: InvariantCoverageStats;
+    };
+    /**
+     * AR07 — Tooling-supplied orchestration/thin-adapter heuristics per file.
+     * Prefer deriveArkRuleFileHints / buildArkRuleFileHints (Domain pure).
+     * When omitted, orchestration-only, thin-adapter, and writes-via-aggregate
+     * sensors stay silent.
+     */
+    fileHints?: Readonly<Record<string, {
+        orchestrationHeavy?: boolean;
+        adapterThick?: boolean;
+        persistenceWrite?: boolean;
+    }>>;
+};
+/** Tooling-supplied analysis evidence for one side (base or candidate) of a preflight. */
+type ResolvedAnalysisSideInputs = Pick<AnalyzeResolvedProjectInput, 'adopted' | 'invariantTestsPathPresent' | 'coverageRootsPresent' | 'coverageInputs' | 'fileHints'>;
+type PreflightResolvedChangeInput = {
+    contract: AnalysisContract;
+    baseFacts: unknown;
+    candidateFacts: unknown;
+    changes: readonly AnalysisFileChange[];
+    changeMap?: ArchitectureChangeMapContract;
+    /**
+     * ArkRules evidence (coverage contents, structural hints) for the on-disk base and
+     * the in-memory candidate, so preflight runs the same engine inputs as ark-check.
+     */
+    baseAnalysisInputs?: ResolvedAnalysisSideInputs;
+    candidateAnalysisInputs?: ResolvedAnalysisSideInputs;
+};
+type ResolvedAnalysisFile = ResolvedFileFact & {
+    layer: string | null;
+};
+type ResolvedAnalysisIr = {
+    schemaVersion: '1.0';
+    policyHash: string;
+    compilerOptionsHash: string;
+    files: ResolvedAnalysisFile[];
+    layers: string[];
+    edges: ArchitectureEngineEdge[];
+    capabilityUses: ResolvedCapabilityFact[];
+    violations: ArchitectureEngineViolation[];
+    warnings: ArchitectureEngineViolation[];
+};
+type ResolvedSafetyReport = {
+    tsSuppressions: {
+        file: string;
+        line: number;
+    }[];
+    anyCasts: {
+        file: string;
+        line: number;
+    }[];
+    nonLiteralDynamicImports: {
+        file: string;
+        line: number;
+        kind: 'import' | 'require';
+    }[];
+    inMemoryProductionStores: {
+        file: string;
+        line: number;
+        store: string;
+    }[];
+    disabledPeerIsolationRules: {
+        from: string;
+        to: string;
+    }[];
+    thresholds: {
+        maxTsSuppressions: number;
+        maxAnyCasts: number;
+    };
+};
+type ResolvedAnalysisResult = {
+    mode: 'resolved-candidate-facts';
+    completeness: ResolvedFactsCompleteness;
+    completenessReasons: ResolvedFactsReason[];
+    valid: boolean;
+    strictValid: boolean;
+    policyHash: string;
+    factsHash: ResolvedCandidateFacts['factsHash'];
+    resolverIdentity: ResolvedCandidateFacts['resolverIdentity'];
+    candidateTreeHash: ResolvedCandidateFacts['candidateTreeHash'];
+    safety: ResolvedSafetyReport;
+    ir: ResolvedAnalysisIr;
+};
+type ResolvedChangePreflightResult = {
+    schemaVersion: '1.0';
+    mode: 'resolved-candidate-facts';
+    valid: boolean;
+    readOnly: true;
+    policyHash: string;
+    resolverIdentity: string;
+    compilerIdentity: string;
+    compilerOptionsHash: string;
+    tsconfigHash: string;
+    baseCompilerOptionsHash: string;
+    candidateCompilerOptionsHash: string;
+    baseTsconfigHash: string;
+    candidateTsconfigHash: string;
+    evidenceRequirementsHash: string;
+    baseFactsHash: string;
+    candidateFactsHash: string;
+    baseTreeHash: string;
+    candidateTreeHash: string;
+    baseCompleteness: ResolvedFactsCompleteness;
+    candidateCompleteness: ResolvedFactsCompleteness;
+    baseCompletenessReasons: ResolvedFactsReason[];
+    candidateCompletenessReasons: ResolvedFactsReason[];
+    changeMapHash?: string;
+    convergence?: ArchitectureConvergenceResult;
+    changes: PreparedChangeFile[];
+    violations: ArchitectureEngineViolation[];
+    warnings: ArchitectureEngineViolation[];
+};
+type AnalyzePolicyDeltaInput = {
+    baseConfig: unknown;
+    candidateConfig: unknown;
+    acknowledgement?: PolicyDeltaAcknowledgement;
+    baseSource?: string;
+    candidateSource?: string;
+    /** Optional pre-resolved Effective ArkRules for each side (ADR 0012 / AR02). */
+    baseArkRules?: EffectiveArkRules;
+    candidateArkRules?: EffectiveArkRules;
+    /**
+     * AR11 — optional coverage evidence for candidate invariants.
+     * When omitted, advisory→enforced promotion is judgment-required (refuse auto-allow).
+     */
+    candidateInvariantCoverage?: readonly InvariantCoverageEvidence[];
+};
+type PolicyDeltaAnalysis = {
+    schemaVersion: '1.0';
+    basePolicyHash: string;
+    candidatePolicyHash: string;
+    classification: PolicyDeltaClassification;
+    findings: PolicyDeltaFinding[];
+    blockingFindingIds: string[];
+    requiresAcknowledgement: boolean;
+    acknowledged: boolean;
+    valid: boolean;
+};
+type ArchitectureEngineViolation = {
+    ruleId: string;
+    message: string;
+    file?: string;
+    line?: number;
+    target?: string;
+    fromLayer?: string;
+    toLayer?: string;
+    nextAction?: string;
+    [key: string]: unknown;
+};
+type ArchitectureEngineEdge = {
+    from: string;
+    fromLayer: string | null;
+    to?: string;
+    toLayer?: string;
+    line: number;
+    kind: string;
+    typeOnly?: boolean;
+    targetTypeOnlyExports?: boolean;
+    sourcePureTypeModule?: boolean;
+    namedBindingsTypeOnly?: boolean;
+    portProofEligible?: boolean;
+};
+type EvaluateArchitectureGraphInput = {
+    config: ArkConfig;
+    rules: ArkConfig['rules'];
+    files: readonly string[];
+    contentViolations: readonly ArchitectureEngineViolation[];
+    edges: readonly ArchitectureEngineEdge[];
+    warnings?: readonly ArchitectureEngineViolation[];
+    safety?: unknown;
+};
+type ArchitectureEngineResult = {
+    violations: ArchitectureEngineViolation[];
+    warnings: ArchitectureEngineViolation[];
+    safety?: unknown;
+};
+type PreparedChangeFile = {
+    path: string;
+    operation: 'create' | 'update' | 'delete';
+    beforeContentHash?: string;
+    candidateContentHash?: string;
+};
+type ChangePreflightResult = {
+    schemaVersion: '1.0';
+    mode: 'lexical-compatibility';
+    valid: boolean;
+    readOnly: true;
+    policyHash: string;
+    compilerOptionsHash: string;
+    baseTreeHash: string;
+    candidateTreeHash: string;
+    baseCompleteness: ResolvedFactsCompleteness;
+    candidateCompleteness: ResolvedFactsCompleteness;
+    baseCompletenessReasons: ResolvedFactsReason[];
+    candidateCompletenessReasons: ResolvedFactsReason[];
+    changeMapHash?: string;
+    convergence?: ArchitectureConvergenceResult;
+    changes: PreparedChangeFile[];
+    violations: ArchitectureEngineViolation[];
+    warnings: ArchitectureEngineViolation[];
+};
+type CollectAnalysisConfigWarningsInput = {
+    config: ArkConfig;
+    rules: ArkConfig['rules'];
+    files: readonly string[];
+    /**
+     * Tooling FS evidence of arkgate pins in this repo (package.json, lockfile,
+     * installed copy, hook scripts, CI). Omitted: version-floor warnings stay silent.
+     */
+    arkgatePins?: readonly ArkgatePinEvidence[];
+    /** The running arkgate version. The version-floor nextAction targets it when newer. */
+    runningArkgateVersion?: string;
+    manifest?: {
+        architecture?: {
+            layers?: readonly {
+                name?: string;
+                prefixes?: readonly string[];
+            }[];
+        };
+    };
+};
+
+/**
+ * Contract loading, project/change analysis, and policy-delta analysis
+ * (U02 pilot 2). Reached through the src/kernel/analysis.ts facade; consumer
+ * import paths never change.
+ */
+
+type LoadContractOptions = {
+    /** Pre-resolved Effective ArkRules (from resolveEffectiveContract). */
+    arkRules?: EffectiveArkRules;
+};
+declare function loadContract(input: unknown, source?: string, options?: LoadContractOptions): AnalysisContract;
+declare function analyzePolicyDelta(input: AnalyzePolicyDeltaInput): PolicyDeltaAnalysis;
+declare function analyzeProject(input: AnalyzeProjectInput): AnalysisResult;
+declare function analyzeChange(input: AnalyzeChangeInput): AnalysisResult;
+declare function explainViolation(violation: AnalysisViolation): string;
+
+declare function detectArchitectureCycles(graph: ReadonlyMap<string, ReadonlySet<string>>): ArchitectureEngineViolation[];
+/** Canonical graph and layer-policy evaluator shared by library, CLI, and MCP adapters. */
+declare function evaluateArchitectureGraph(input: EvaluateArchitectureGraphInput): ArchitectureEngineResult;
+
+/**
+ * Pure evaluation of validated, resolver-supplied candidate facts (ADR 0011).
+ *
+ * Filesystem discovery and TypeScript resolution remain Tooling concerns. This
+ * module only classifies canonical paths against the supplied contract and
+ * produces the one architecture verdict consumed by every resolved adapter.
+ */
+
+/** Validate supplied facts and evaluate their graph without host effects. */
+declare function analyzeResolvedProject(input: AnalyzeResolvedProjectInput): ResolvedAnalysisResult;
+
+/**
+ * Evaluate one create/update/delete set as a single in-memory candidate.
+ * The function never writes and returns hashes that bind a later host commit to
+ * the exact base, policy, compiler options, and candidate contents it checked.
+ */
+declare function preflightChange(input: AnalyzeChangeInput): ChangePreflightResult;
+
+/** Atomic preflight over one validated base/candidate facts pair (ADR 0011). */
+
+/**
+ * Validate that the supplied candidate is exactly the declared in-memory
+ * overlay, then return its canonical resolved verdict. No project file is read
+ * or written here.
+ */
+declare function preflightResolvedChange(input: PreflightResolvedChangeInput): ResolvedChangePreflightResult;
+
+/** Canonical config diagnostics over repo-relative file paths. */
+declare function collectAnalysisConfigWarnings(input: CollectAnalysisConfigWarningsInput): ArchitectureEngineViolation[];
+
+/**
+ * Public diagnostic code catalog (ACS02).
+ *
+ * Closed vocabulary of stable `ruleId` values emitted by ArkGate adapters with
+ * human/agent `why` / `fix` anchors and docs fragment ids. Cataloguing only —
+ * no new rule semantics, no LLM verdict, no enforcement from prose.
+ *
+ * **Canonical** for docs, agent projection (ACS04), and finding refs (ACS06).
+ * Runtime remediation remains in `remediation.ts`; parity tests bind the two.
+ *
+ * Zero Node I/O. Optional CLI surface: generated `bin/lib/diagnostic-catalog.mjs`.
+ *
+ * @see docs/diagnostics.md
+ * @see docs/plans/agent-contract-surface-4.3/README.md
+ */
+/** Product-relative docs path (shipped in the npm tarball when listed in package files). */
+declare const DIAGNOSTIC_DOCS_RELATIVE_PATH: "docs/diagnostics.md";
+/** Schema id for serializing the catalog snapshot (agents / install projection). */
+declare const DIAGNOSTIC_CATALOG_SCHEMA_VERSION: "1.0";
+type DiagnosticCategory = 'layer' | 'capability' | 'publish' | 'safety' | 'arkrules' | 'arkrun' | 'arkorder' | 'preflight' | 'analysis' | 'drift' | 'snippet-policy' | 'config' | 'adapter' | 'meta';
+type DiagnosticCatalogEntry = {
+    /** Stable public violation / diagnostic id. */
+    ruleId: string;
+    /** Short title for indexes and agent projection. */
+    title: string;
+    /** Why this finding exists (contract intent). */
+    why: string;
+    /**
+     * Canonical fix guidance (agent + human). Contextual nextAction on live
+     * findings may specialize this (e.g. type-only vs value layer import).
+     */
+    fix: string;
+    /** Markdown fragment id for docs/diagnostics.md (without leading #). */
+    docsAnchor: string;
+    category: DiagnosticCategory;
+    /**
+     * When true, finding is commonly advisory / non-blocking in default profiles
+     * (doctor/config warnings, type-only placement debt, empty ArkRule scope).
+     * Not a severity bit for the engine — documentation only.
+     */
+    oftenAdvisory?: boolean;
+};
+/**
+ * Closed public catalog. Order is stable (category groups, then ruleId) for
+ * deterministic serialization and docs generation.
+ *
+ * Every production-emitted `ruleId` must appear here. Remediation switch cases
+ * and adapter nextAction branches are parity-tested against this list.
+ */
+declare const DIAGNOSTIC_CATALOG: readonly DiagnosticCatalogEntry[];
+/** All public ruleIds in catalog order. */
+declare const DIAGNOSTIC_RULE_IDS: readonly string[];
+declare function isKnownDiagnosticCode(ruleId: string | null | undefined): boolean;
+/**
+ * True when the code is catalogued or is an ArkRule-family id handled by the
+ * ARKRULE_* prefix fallback in remediation (structure sensors may add members later
+ * only via catalog + ROADMAP — prefix alone is not a license for free-form ids).
+ */
+declare function isCataloguedOrArkRuleFamily(ruleId: string | null | undefined): boolean;
+declare function getDiagnosticCatalogEntry(ruleId: string | null | undefined): DiagnosticCatalogEntry | undefined;
+/** Fragment for docs links, e.g. `#LAYER_IMPORT_VIOLATION`. */
+declare function diagnosticDocsFragment(ruleId: string): string;
+/**
+ * Repo-relative docs path with fragment (for agents and JSON).
+ * Package consumers resolve against the installed package root or GitHub tree.
+ */
+declare function diagnosticDocsPath(ruleId: string): string;
+/** Catalog snapshot for JSON export / agent projection (stable field order). */
+declare function serializeDiagnosticCatalog(): {
+    schemaVersion: typeof DIAGNOSTIC_CATALOG_SCHEMA_VERSION;
+    docsPath: typeof DIAGNOSTIC_DOCS_RELATIVE_PATH;
+    codes: readonly DiagnosticCatalogEntry[];
+};
+/**
+ * Static catalog fix for a ruleId when no live violation context is available.
+ * Live adapters should still use deterministicNextAction for specialized edges.
+ */
+declare function catalogFixForRuleId(ruleId: string | null | undefined): string | undefined;
+/**
+ * Static catalog why for a ruleId (agent “why” surface).
+ */
+declare function catalogWhyForRuleId(ruleId: string | null | undefined): string | undefined;
+
+/** Public, evidence-backed enforcement state shared by doctor adapters. */
+declare const ARK_ENFORCEMENT_STATE_SCHEMA_VERSION: "1.1";
+type EnforcementVerification = boolean | 'unverified';
+type EnforcementEvidenceField = 'configured' | 'installed' | 'active' | 'runtimeObserved' | 'operationCoverage' | 'bypassable' | 'required' | 'hard';
+type EnforcementEvidence = {
+    field: 'configured' | 'installed' | 'runtimeObserved' | 'hard';
+    source: string;
+    value: boolean;
+} | {
+    field: 'active' | 'operationCoverage' | 'bypassable' | 'required';
+    source: string;
+    value: EnforcementVerification;
+};
+/**
+ * State for one enforcement boundary.
+ *
+ * `configured` records valid wiring, while `installed` requires the referenced
+ * package or executable to resolve. Runtime/provider facts remain
+ * `unverified` until observed; local files never prove `required: true`.
+ */
+type EnforcementBoundaryState = {
+    supported: boolean;
+    analyzed: boolean;
+    configured: boolean;
+    installed: boolean;
+    active: EnforcementVerification;
+    runtimeObserved: boolean;
+    operation: string | null;
+    operationCoverage: EnforcementVerification;
+    bypassable: EnforcementVerification;
+    required: EnforcementVerification;
+    hard: boolean;
+    evidence: readonly EnforcementEvidence[];
+};
+type ArkEnforcementHost = 'claude' | 'grok' | 'cursor' | 'codex' | 'unknown';
+type ArkEnforcementState = {
+    schemaVersion: typeof ARK_ENFORCEMENT_STATE_SCHEMA_VERSION;
+    activeHost: ArkEnforcementHost;
+    localWrite: EnforcementBoundaryState;
+    advisoryMcp: EnforcementBoundaryState;
+    ciMerge: EnforcementBoundaryState;
+};
+
+/** Public neutral contract for the opt-in new-code design-fitness ratchet. */
+declare const ARK_DESIGN_DELTA_SCHEMA_VERSION: "1.0";
+type DesignSmellId = 'io-under-application' | 'handler-in-persistence' | 'god-module' | 'domain-logic-in-ui' | 'facade-sql-in-routes' | 'mixed-pattern-cluster' | 'soft-contract';
+type DesignDeltaIdentity = {
+    kind: 'git-tree' | 'candidate-tree';
+    value: string;
+    commit?: string;
+};
+type DesignSmellEvidence = {
+    kind: string;
+    path: string;
+    line?: number;
+    symbol?: string;
+    detail?: string;
+    magnitude: number;
+};
+type DesignSmellFinding = {
+    smellId: DesignSmellId;
+    fingerprint: string;
+    identity: string;
+    evidence: DesignSmellEvidence;
+    repairHint: string;
+};
+type DesignDeltaChange = DesignSmellFinding & {
+    classification: 'new' | 'worsened';
+    baseMagnitude: number;
+    candidateMagnitude: number;
+};
+/** Created-path merge vs full new+worsened ratchet (Z10). Omitted on older producers. */
+type DesignDeltaEnforcementScope = 'created-paths' | 'touched-new-or-worsened';
+type ArkDesignDeltaResult = {
+    schemaVersion: typeof ARK_DESIGN_DELTA_SCHEMA_VERSION;
+    mode: 'git-base' | 'write-candidate';
+    complete: boolean;
+    valid: boolean;
+    base: DesignDeltaIdentity;
+    candidate: DesignDeltaIdentity;
+    supportedSmellIds: readonly DesignSmellId[];
+    touchedPaths: readonly string[];
+    changes: readonly DesignDeltaChange[];
+    baseFindingCount: number;
+    candidateFindingCount: number;
+    historicalResidualCount: number;
+    enforcementScope?: DesignDeltaEnforcementScope;
+    error?: string;
+};
+
+/**
+ * In-memory shadow / replay / compare for ArkRun information packages (XP07 / ADR 0033).
+ * Not durable. Not a second bus. Stripped snapshots only.
+ */
+
+type InformationPackageDiff = {
+    readonly path: string;
+    readonly left: unknown;
+    readonly right: unknown;
+};
+type InformationPackageCompare = {
+    readonly equal: boolean;
+    readonly diffs: readonly InformationPackageDiff[];
+};
+/** Shadow: identity snapshot. The live kernel is not copied. */
+declare function shadowInformationPackage(pack: DependencyInformationPackage): DependencyInformationPackage;
+declare function compareInformationPackages(left: DependencyInformationPackage, right: DependencyInformationPackage): InformationPackageCompare;
+/**
+ * Replay: apply sequential snapshots as the "tape". Each step is compared to
+ * the previous shadow. No bus, no store, no time travel across processes.
+ */
+declare function replayInformationPackages(tape: readonly DependencyInformationPackage[]): InformationPackageCompare[];
+
+/**
+ * Default cap for in-memory history, trace, audit, and default event-buffer
+ * records. Without a cap a long-running process grows without bound on every
+ * publish. Pass `maxHistorySize: Infinity` to explicitly opt back into unbounded
+ * retention. An injected `eventBuffer` owns its own retention.
+ */
+declare const DEFAULT_MAX_HISTORY_SIZE = 1000;
+declare function createArkKernel(options?: CreateArkKernelOptions): ArkKernel;
+/**
+ * Preferred ArkRun factory. Each call is a new isolated instance — there is no
+ * process-wide singleton.
+ */
+declare function createStrictArkKernel(options?: CreateArkKernelOptions): ArkKernel;
+declare function createArkKernelFromConfig(config: ArkKernelConfig, options?: CreateArkKernelFromConfigOptions): ArkKernel;
+/**
+ * Strict kernel whose runtime layer profile comes from `ark.config.json`.
+ * Hard observed-layer-flow needs every layer a deny rule names to resolve an
+ * intent: declared `intentPrefixes`, or a canonical 11-layer name (`DomainModel`,
+ * `ApplicationOrchestration`, … — what `ark init` writes) which gets the built-in
+ * prefixes. A custom-named deny layer without prefixes is recorded as a
+ * `layer.observedFlowUnresolvable` audit record (`ARKRUN_LAYER_FLOW_UNRESOLVABLE`);
+ * passing `enforceObservedLayerFlow: 'hard'` explicitly throws `ArkKernelConfigError`
+ * instead.
  */
-declare function createStrictArkKernel(options?: CreateArkKernelOptions): ArkKernel;
-declare function createArkKernelFromConfig(config: ArkKernelConfig, options?: CreateArkKernelFromConfigOptions): ArkKernel;
 declare function createStrictArkKernelFromConfig(config: ArkKernelConfig, options?: CreateArkKernelFromConfigOptions): ArkKernel;
 declare function createLenientArkKernelFromConfig(config: ArkKernelConfig, options?: CreateArkKernelFromConfigOptions): ArkKernel;
 declare function createLenientArkKernel(options?: CreateArkKernelOptions): ArkKernel;
@@ -517,4 +3125,4 @@ declare function createAdapter<T>(port: Port<T>, impl: T, requiredKeysOrOptions?
 declare function checkContract(impl: unknown, requiredKeys?: string[]): ContractCheckResult;
 declare function checkAdapterGovernance(adapter: Adapter): AdapterGovernanceResult;
 
-export { type Adapter, type AdapterGovernanceIssue, type AdapterGovernanceResult, ArchitectureProfile, ArkKernel, ArkKernelConfig, ArkManifest, type ArkTestHarness, type ArkTestSnapshot, AuditQuery, AuditRecord, AuditStore, AuditTrail, type BuildPublishPolicyContextOptions, type ContractCheckResult, type CreateAdapterOptions, CreateArkKernelFromConfigOptions, CreateArkKernelOptions, type CreateArkManifestOptions, CreateAuditTrailOptions, CreateObservabilityReporterOptions, CreateProjectionRegistryOptions, CreateWorkflowEngineOptions, DEFAULT_MAX_HISTORY_SIZE, DefineIntentOptions, type DefinePolicyOptions, type DefinePortOptions, DependencyGraph, DependencyInformationPackage, DomainEvent, EventBufferRecord, EventBufferStatus, EventBufferStore, EventBus, EventBusOptions, EventContract, EventContractRegistry, EventContractRegistryImpl, EventContractValidationResult, EventContractViolationError, GraphEdge, type GraphPolicyContext, InMemoryAuditStore, InMemoryEventBuffer, InMemoryOutboxStore, InMemoryReadModelStore, InMemoryWorkflowStore, type InformationPackageCompare, type InformationPackageDiff, IntentCreator, IntentCreator as IntentDefinition, IntentName, type IntentNameValidation, IntentRegistry, IntentRelationship, InvalidIntentNameError, type LayerFlowRule, LayerPolicyContextError, type LayerPolicyOptions, MANIFEST_SCHEMA_VERSION, MetadataRegistry, ObservabilityDriftReport, ObservabilityReporter, ObservedLayerFlowViolationError, OutboxRecord, OutboxStatus, Policy, PolicyEnforcementMode, PolicyEngine, PolicySeverity, PolicyViolation, PolicyViolationError, type Port, ProjectionRegistry, type PublishPolicyContext, ReadModelStore, SagaDefinition, SagaInstance, SourceMetadataOverrideError, type SyncRegistryOptions, TraceRecord, TraceRecordType, UnknownEventSourceError, UnregisteredIntentError, WorkflowEngine, WorkflowSnapshot, WorkflowStore, architecturalPolicies, buildPublishPolicyContext, checkAdapterGovernance, checkContract, compareInformationPackages, createAdapter, createArkKernel, createArkKernelFromConfig, createArkManifest, createArkTestHarness, createAuditTrail, createDependencyGraph, createEventBus, createEventContractRegistry, createIntentRegistry, createLenientArkKernel, createLenientArkKernelFromConfig, createMetadataRegistry, createObservabilityReporter, createProjectionRegistry, createSaga, createStrictArkKernel, createStrictArkKernelFromConfig, createWorkflowEngine, defaultIntentRegistry, defineArchitectureProfilePolicy, defineIntent, defineLayerPolicy, definePolicy, definePort, definePublishPolicy, isLayerPolicy, replayInformationPackages, shadowInformationPackage, syncRegistryToGraph, validateIntentName };
+export { type AICodeGate, type AICodeGateContext, type AICodeGateOptions, type AICodeGateResult, type AICodeGateViolation, type AIGateExtension, ANALYSIS_IR_SCHEMA_VERSION, ARK_ANALYSIS_RESULT_SCHEMA, ARK_ANALYSIS_RESULT_SCHEMA_VERSION, ARK_DESIGN_DELTA_SCHEMA_VERSION, ARK_ENFORCEMENT_STATE_SCHEMA_VERSION, type Adapter, type AdapterCompletenessReason, type AdapterDiagnostic, type AdapterGovernanceIssue, type AdapterGovernanceResult, type AdapterResult, type AdapterSeverity, type AdapterViolationInput, type AnalysisCapabilityUse, type AnalysisCompilerOptions, type AnalysisCompleteness, type AnalysisContract, type AnalysisEvidence, type AnalysisFile, type AnalysisFileChange, type AnalysisFileInput, type AnalysisImportEdge, type AnalysisIr, type AnalysisMode, type AnalysisResult, type AnalysisViolation, type AnalyzeArchitectureConvergenceInput, type AnalyzeChangeInput, type AnalyzePolicyDeltaInput, type AnalyzeProjectInput, type AnalyzeResolvedProjectInput, type ArchitectureActualChange, type ArchitectureChangeMap, type ArchitectureChangeMapContract, type ArchitectureChangeMapDependency, type ArchitectureChangeMapFile, type ArchitectureChangeOperation, type ArchitectureConvergenceClassification, type ArchitectureConvergenceFinding, type ArchitectureConvergenceResult, type ArchitectureDependency, type ArchitectureEngineEdge, type ArchitectureEngineResult, type ArchitectureEngineViolation, ArchitectureProfile, ArkCheckConfig, type ArkDesignDeltaResult, type ArkEnforcementHost, type ArkEnforcementState, ArkKernel, ArkKernelConfig, ArkKernelConfigError, ArkManifest, type ArkTestHarness, type ArkTestSnapshot, AuditQuery, AuditRecord, AuditStore, AuditTrail, type BuildPublishPolicyContextOptions, type ChangePreflightResult, type CollectAnalysisConfigWarningsInput, type ContractCheckResult, type CreateAdapterOptions, CreateArchitectureProfileFromArkConfigOptions, CreateArchitectureProfileOptions, CreateArkKernelFromConfigOptions, CreateArkKernelOptions, type CreateArkManifestOptions, CreateAuditTrailOptions, CreateElevenLayerArkConfigOptions, CreateObservabilityReporterOptions, CreateProjectionRegistryOptions, CreateWorkflowEngineOptions, DEFAULT_MAX_HISTORY_SIZE, DIAGNOSTIC_CATALOG, DIAGNOSTIC_CATALOG_SCHEMA_VERSION, DIAGNOSTIC_DOCS_RELATIVE_PATH, DIAGNOSTIC_RULE_IDS, DefineIntentOptions, type DefinePolicyOptions, type DefinePortOptions, DependencyGraph, DependencyInformationPackage, type DesignDeltaChange, type DesignDeltaEnforcementScope, type DesignDeltaIdentity, type DesignSmellEvidence, type DesignSmellFinding, type DesignSmellId, type DiagnosticCatalogEntry, type DiagnosticCategory, DomainEvent, type EnforcementBoundaryState, type EnforcementEvidence, type EnforcementEvidenceField, type EnforcementVerification, type EvaluateArchitectureGraphInput, EventBufferRecord, EventBufferStatus, EventBufferStore, EventBus, EventBusOptions, EventContract, EventContractRegistry, EventContractRegistryImpl, EventContractValidationResult, EventContractViolationError, type ForbiddenCapabilityUse, GraphEdge, type GraphPolicyContext, InMemoryAuditStore, InMemoryEventBuffer, type InMemoryEventBufferOptions, InMemoryOutboxStore, InMemoryReadModelStore, InMemoryWorkflowStore, type InformationPackageCompare, type InformationPackageDiff, IntentCreator, IntentCreator as IntentDefinition, IntentName, type IntentNameValidation, IntentRegistry, IntentRelationship, InvalidIntentNameError, type LayerFlowRule, LayerPolicyContextError, type LayerPolicyOptions, MANIFEST_SCHEMA_VERSION, MetadataRegistry, ObservabilityDriftReport, ObservabilityReporter, ObservedLayerFlowViolationError, OutboxRecord, OutboxStatus, POLICY_DELTA_SCHEMA_VERSION, Policy, type PolicyDelta, type PolicyDeltaAcknowledgement, type PolicyDeltaAnalysis, type PolicyDeltaClassification, type PolicyDeltaFinding, PolicyEnforcementMode, PolicyEngine, PolicySeverity, PolicyViolation, PolicyViolationError, type Port, type PreflightResolvedChangeInput, type PreparedChangeFile, ProjectionRegistry, type PublishPolicyContext, RESOLVED_CANDIDATE_FACTS_SCHEMA, RESOLVED_CANDIDATE_FACTS_SCHEMA_VERSION, ReadModelStore, type ResolvedAmbientFact, type ResolvedAnalysisFile, type ResolvedAnalysisIr, type ResolvedAnalysisResult, type ResolvedArkRunCompositionRootHitFact, type ResolvedArkRunDeclarationFact, type ResolvedArkRunKernelCallFact, type ResolvedArkRunKernelCallKind, type ResolvedArkRunManagedNewFact, type ResolvedCandidateFacts, type ResolvedCandidateFactsInput, type ResolvedCapability, type ResolvedCapabilityFact, type ResolvedChangePreflightResult, type ResolvedDependencyFact, type ResolvedDependencyKind, type ResolvedDependencyState, type ResolvedFactsCompleteness, type ResolvedFactsReason, type ResolvedFileFact, type ResolvedIntentReferenceFact, type ResolvedPublishFact, type ResolvedSafetyFact, type ResolvedSafetyKind, type ResolvedSafetyReport, SagaDefinition, SagaInstance, type SemanticDependency, type SemanticDependencyKind, SourceMetadataOverrideError, type SyncRegistryOptions, TraceRecord, TraceRecordType, UnknownEventSourceError, UnregisteredIntentError, WorkflowEngine, WorkflowSnapshot, WorkflowStore, analyzeArchitectureConvergence, analyzeChange, analyzePolicyDelta, analyzeProject, analyzeResolvedProject, architecturalPolicies, buildPublishPolicyContext, catalogFixForRuleId, catalogWhyForRuleId, checkAdapterGovernance, checkContract, classifyArkPolicyDelta, collectAnalysisConfigWarnings, collectForbiddenCapabilityUses, compareInformationPackages, createAICodeGate, createAdapter, createAdapterResult, createArchitectureProfile, createArchitectureProfileFromArkConfig, createArkKernel, createArkKernelFromConfig, createArkManifest, createArkTestHarness, createAuditTrail, createDependencyGraph, createElevenLayerArkConfig, createEventBus, createEventContractRegistry, createIntentRegistry, createLenientArkKernel, createLenientArkKernelFromConfig, createMetadataRegistry, createObservabilityReporter, createProjectionRegistry, createResolvedCandidateFacts, createSaga, createStrictArkKernel, createStrictArkKernelFromConfig, createWorkflowEngine, defaultIntentRegistry, defineArchitectureProfilePolicy, defineIntent, defineLayerPolicy, definePolicy, definePort, definePublishPolicy, detectArchitectureCycles, deterministicHash, diagnosticDocsFragment, diagnosticDocsPath, elevenLayerProfile, evaluateArchitectureGraph, explainViolation, extractSemanticDependencies, getDiagnosticCatalogEntry, isCataloguedOrArkRuleFamily, isKnownDiagnosticCode, isLayerPolicy, loadContract, loadResolvedCandidateFacts, policyDeltaAcknowledgementMatches, preflightChange, preflightResolvedChange, replayInformationPackages, resolvedFactsEvidenceRequirementsHash, serializeDiagnosticCatalog, shadowInformationPackage, stableSerialize, syncRegistryToGraph, toAdapterDiagnostic, validateIntentName, version };