arkgate 4.8.8 → 4.8.10

package/bin/lib/contract-smells.mjs

@@ -41,7 +41,7 @@ export const CONTRACT_SMELL_OUTCOMES = Object.freeze({
   'contract-lateral-adapter-allow':
     'One adapter layer may import another adapter family directly — shared mappers/aliases will pile up in the wrong place. Move shared shapes into Domain (or a shared kernel) instead of adapter-to-adapter reach.',
   'contract-dead-rule':
-    'A rule enforces nothing: it points at a layer that matches no files or does not exist, or both sides are the same layer. Fix the layer patterns or delete the rule.',
+    'A rule enforces nothing: it points at a layer that matches no files or does not exist, or is a same-layer allow (classic same-layer deny is also a no-op). A same-layer peerIsolation deny is a live wall, not a dead rule.',
 });
 
 export const CONTRACT_SMELL_ACKS_PATH = '.ark/contract-smell-acks.json';
@@ -277,14 +277,20 @@ export function analyzeContractSmells(
     }
   }
 
-  // 4) Dead rules: self edges (the gate ignores same-layer rules), unknown layers,
-  //    or — when coverage is known — layers matching zero files (optional layers exempt).
+  // 4) Dead rules: self-allow and classic same-layer deny (the gate ignores
+  //    those), unknown layers, or — when coverage is known — layers matching
+  //    zero files (optional layers exempt). `peerIsolation: true` + `allowed:
+  //    false` is a live self-edge wall, not a dead rule.
   for (const r of rules) {
     const edge = `${r.from}->${r.to}`;
     const ackEdge = ackMatchable(r.from, r.to) ? edge : null;
     if (r.from === r.to) {
-      add('contract-dead-rule', ackEdge, `rule:${edge} (self edge has no effect)`);
-      continue;
+      const livePeerIsolationWall = r.peerIsolation === true && r.allowed === false;
+      if (!livePeerIsolationWall) {
+        add('contract-dead-rule', ackEdge, `rule:${edge} (self edge has no effect)`);
+        continue;
+      }
+      // Live slice wall on a self-edge — still check unknown/empty layers.
     }
     for (const side of [r.from, r.to]) {
       if (side.length === 0) continue;
@@ -409,7 +415,7 @@ function fixFor(id) {
     case 'contract-lateral-adapter-allow':
       return `Move shared shapes into Domain/shared kernel and drop the lateral allow (/ark-adopt), or acknowledge with a reason in ${CONTRACT_SMELL_ACKS_PATH}.`;
     case 'contract-dead-rule':
-      return 'Fix the layer patterns so the layer matches real files, or delete the stale/self rule via /ark-adopt.';
+      return 'Fix the layer patterns so the layer matches real files, or delete a stale self-allow / classic self-deny via /ark-adopt. Never delete a live peerIsolation wall (`peerIsolation: true` with `allowed: false`).';
     default:
       return 'Review the contract edge via /ark-adopt; never weaken the gate to silence a smell.';
   }

package/bin/lib/diagnostic-catalog.mjs

@@ -55,6 +55,7 @@ export const DIAGNOSTIC_CATALOG = Object.freeze([
     entry('ARKRULE_STRUCTURE', 'arkrules', 'ArkRule structure sensor failed', 'An opt-in ArkRules structure sensor (private state, factory shape, event publish, persistence write outside an aggregate, …) failed on a governed file for a declared arkruleId.', 'Restore the declared structure for the ArkRule (see arkruleSource), then preflight again. Do not demote the rule without a hash-bound policy acknowledgement.'),
     entry('ARKRULE_INVARIANT', 'arkrules', 'ArkRule invariant failed', 'Reserved / remediation-recognized code for invariant-plane failures bound to an ArkRule id (coverage path also emits INVARIANT_UNCOVERED).', 'Fix the invariant for the ArkRule declared in arkrules/<Layer>.json, then preflight again. Do not demote without acknowledgement.'),
     entry('ARKRULE_SCOPE_EMPTY', 'arkrules', 'ArkRule appliesTo matched zero files', 'An ArkRule’s appliesTo globs matched no governed files — the rule cannot observe what it claims to protect.', 'Fix appliesTo globs so they match governed files, or remove the rule. Enforced empty scope fails; advisory empty scope warns.', { oftenAdvisory: true }),
+    entry('ARKRULE_HINT_BUDGET_EXHAUSTED', 'arkrules', 'Structural-hint budget exhausted', 'orchestration-only, thin-adapter, and writes-via-aggregate only evaluate files the hint loader preloaded. When eligible governed files exceed that budget (coverage.maxFiles, default 400 — there is no arkrules.hintBudget), those sensors never saw the rest of their scope. Enforced + unreviewed is not green. The finding names exact hinted/governed counts and per-sensor reviewed N/M of scope.', 'Raise coverage.maxFiles in ark.config.json (this cap also bounds structural-hint preload; --doctor names the coupling) so hinted/governed counts match, then re-run with --strict-config. An enforced hint sensor that cannot see its scope fails strict.'),
     entry('INVARIANT_UNCOVERED', 'arkrules', 'Invariant without coverage evidence', 'An ArkRules invariant is under contract but no covering test title or declared symbol evidence was found (or coverage is partial). Kind is never-had-tests (adopt residual) vs tests-disappeared (suite exists).', 'Add a test title or declared symbol covering the arkruleId, then preflight again. Treat never-had-tests as adopt residual; treat tests-disappeared as a regression. Missing test globs report partial — never fake green. When the message reports an exhausted file budget, raise coverage.maxFiles (or narrow coverage.testGlobs) in ark.config.json.'),
     entry('INVARIANT_COVERAGE_OUTSIDE_ROOTS', 'arkrules', 'Covering test outside the declared coverage roots', 'The only test naming this invariant sits outside coverage.coverageRoots — the places the project declares its runner executes. ArkGate matches declared text and never executes tests, so it cannot tell whether that file is ever run: coverage there is a test that exists, not a test that runs.', 'Move the test under a declared coverage root, or add its root to coverage.coverageRoots in ark.config.json. Advisory: it never fails strict, but promotion to enforced refuses on it.', { oftenAdvisory: true }),
     // ── ArkRun (opt-in extra; RN05 dual-depth nextAction) ────────────────────

package/bin/lib/doctor-human.mjs

@@ -13,6 +13,23 @@ import { enforcementDoctorLines } from './enforcement-state.mjs';
 import { analysisIncompleteStatement } from './analysis-completeness.mjs';
 import { skillGapsForActiveHost, detectCodexHomeGap, codexConcernIsActive } from './agent-gates.mjs';
 import { agentHomeConcernIsActive } from './agent-homes.mjs';
+import { REQUIRED_GATE_WORKFLOW } from './gate-files.mjs';
+
+function displayedMissingGates(gatesMissing, view) {
+  const list = Array.isArray(gatesMissing) ? gatesMissing : [];
+  const hideGlob = Boolean(
+    view?.ciNotFailClosed?.workflowFile ||
+      view?.ciNotFailClosed?.error === 'ci-not-fail-closed' ||
+      view?.ciMergeBoundary?.ci?.workflowPresent
+  );
+  return hideGlob ? list.filter((item) => item !== REQUIRED_GATE_WORKFLOW) : list;
+}
+
+function ciNotFailClosedNotice(view) {
+  const file = view?.ciNotFailClosed?.workflowFile;
+  if (!file) return null;
+  return `CI not fail-closed: ${file} — remove the skippable if:, or write .ark/adoption-stance.json with stance: advisory-only`;
+}
 
 function lineWith(ok, warn, bad, color) {
   return (mark, text) => console.log(`  ${mark} ${text}`);
@@ -52,6 +69,8 @@ export function printDoctorCompactHuman(view) {
     gatesMissing,
     violations,
   } = view;
+  const listedMissing = displayedMissingGates(gatesMissing, view);
+  const skippableCi = ciNotFailClosedNotice(view);
 
   console.log(color.bold(`Ark doctor — ${path.basename(path.resolve(root)) || '.'}`));
   if (!analysisComplete) line(warn, analysisIncompleteStatement(completeness));
@@ -123,15 +142,17 @@ export function printDoctorCompactHuman(view) {
   }
 
   const hostRed =
-    gatesMissing.length > 0 ||
+    listedMissing.length > 0 ||
     Boolean(writePath.gap) ||
-    writePathHonesty?.softWriteHost === true;
+    writePathHonesty?.softWriteHost === true ||
+    Boolean(skippableCi);
   if (hostRed) {
     console.log('');
     console.log(color.bold('Host / CI'));
     if (writePath.activeHost) line(' ', `Active host: ${writePath.activeHost}`);
-    if (gatesMissing.length > 0) line(bad, `Missing gates: ${gatesMissing.join(', ')}`);
-    else if (writePath.gap || writePathHonesty?.softWriteHost) {
+    if (listedMissing.length > 0) line(bad, `Missing gates: ${listedMissing.join(', ')}`);
+    if (skippableCi) line(warn, skippableCi);
+    else if (listedMissing.length === 0 && (writePath.gap || writePathHonesty?.softWriteHost)) {
       line(warn, 'Local writes are advisory; required CI is the merge boundary.');
     }
   }
@@ -212,6 +233,8 @@ export function printDoctorDetailsHuman(view) {
     staleRunners,
     adoption,
   } = view;
+  const listedMissing = displayedMissingGates(gatesMissing, view);
+  const skippableCi = ciNotFailClosedNotice(view);
   const modeTitle = operatingModeTitle(operatingMode, designFitness.designWeak, stewardUnfinished);
 
   console.log('');
@@ -336,7 +359,7 @@ export function printDoctorDetailsHuman(view) {
       `${violations.length} total${typeNote}${supNote}${activeCount > 0 ? ` — ${activeCount} NOT baselined` : ''}`
     );
     for (const edge of summary.edges.slice(0, 3)) line(' ', color.dim(`${edge.count}  ${edge.edge}`));
-    if (summary.concentrated) {
+    if (summary.concentrated && typeof summary.dominant === 'string' && summary.dominant.includes(' → ')) {
       line(warn, color.dim(`${Math.round(summary.dominantShare * 100)}% on one edge (${summary.dominant}) — likely a contract fix, not debt`));
     }
   }
@@ -385,9 +408,11 @@ export function printDoctorDetailsHuman(view) {
 
   console.log('');
   console.log(color.bold('Gates & skills'));
-  if (gatesMissing.length === 0) line(ok, 'Shared gate artifacts found on disk (AGENTS.md, .mcp.json, CI); runtime activation is reported separately');
-  else {
-    line(bad, `Missing gates: ${gatesMissing.join(', ')}`);
+  if (listedMissing.length === 0 && !skippableCi) {
+    line(ok, 'Shared gate artifacts found on disk (AGENTS.md, .mcp.json, CI); runtime activation is reported separately');
+  } else {
+    if (listedMissing.length > 0) line(bad, `Missing gates: ${listedMissing.join(', ')}`);
+    if (skippableCi) line(warn, skippableCi);
   }
   const humanSkillGaps = skillGapsForActiveHost(skillGaps);
   const legacyCodex = humanSkillGaps.some((g) => g.tool === 'codex' && g.legacyPromptsOnly);
@@ -449,7 +474,7 @@ export function printDoctorDetailsHuman(view) {
   console.log('');
   console.log(color.bold('Baseline'));
   if (!baseline.exists) {
-    line(!analysisComplete || violations.length > 0 ? warn : ok, !analysisComplete ? 'No baseline — current violations were not fully evaluated' : violations.length > 0 ? 'No baseline — adopting a dirty repo? freeze with --update-baseline' : 'No baseline (nothing to freeze)');
+    line(!analysisComplete || violations.length > 0 ? warn : ok, !analysisComplete ? 'No baseline — current violations were not fully evaluated' : violations.length > 0 ? 'No baseline — adopting a dirty repo? freeze with --update-baseline --force --contract-session --author <steward>' : 'No baseline (nothing to freeze)');
   } else {
     const baseMark = !analysisComplete || baselineHonesty.dirtyBaselineRisk ? warn : ok;
     line(baseMark, `${baseline.keys.size} frozen key(s)${analysisComplete ? '' : ' — stale comparison not verified'}`);
@@ -457,7 +482,7 @@ export function printDoctorDetailsHuman(view) {
       line(warn, baselineHonesty.message);
     }
     if (analysisComplete && staleBaseline > 0) {
-      line(warn, `${staleBaseline} stale entr(y/ies) no longer occur — tighten with --update-baseline`);
+      line(warn, `${staleBaseline} stale entr(y/ies) no longer occur — tighten with --update-baseline --force --contract-session --author <steward>`);
     }
   }
 

package/bin/lib/doctor-next-actions.mjs

@@ -7,10 +7,20 @@ import { skillGapsForActiveHost } from './agent-gates.mjs';
 import { agentHomeConcernIsActive, agentHomeRefreshCommand } from './agent-homes.mjs';
 import { mergePostGreenTopActions } from './post-green-path.mjs';
 import { ADOPTED_NOT, NOT_ADOPTED_NEXT_ACTION } from './adoption-stance.mjs';
+import { REQUIRED_GATE_WORKFLOW } from './gate-files.mjs';
+
+function missingGateFiles(ctx) {
+  const list = Array.isArray(ctx.gatesMissing) ? ctx.gatesMissing : [];
+  if (ctx.ciNotFailClosed) {
+    return list.filter((item) => item !== REQUIRED_GATE_WORKFLOW);
+  }
+  return list;
+}
 
 export function collectDoctorNextActions(ctx) {
   const actions = [];
-  const gatesInstalled = Array.isArray(ctx.gatesMissing) && ctx.gatesMissing.length === 0;
+  const missingFiles = missingGateFiles(ctx);
+  const gatesInstalled = missingFiles.length === 0;
   const planAEmpty = !ctx.activeCount;
   const notAdopted = ctx.adopted !== 'required-merge' && ctx.adopted !== 'advisory-only-acked';
   if (notAdopted || ctx.adopted === ADOPTED_NOT || ctx.adopted == null) {
@@ -55,9 +65,18 @@ export function collectDoctorNextActions(ctx) {
     );
   }
   if (ctx.writePath?.gap?.fix && !gatesInstalled) actions.push(ctx.writePath.gap.fix);
-  if (!gatesInstalled && ctx.gatesMissing.length > 0) {
+  if (!gatesInstalled && missingFiles.length > 0) {
     actions.push(`install gates (${arkCommand(ctx.root, 'ark-check', '--install-agent-gates')})`);
   }
+  if (ctx.ciNotFailClosed) {
+    const file = ctx.ciNotFailClosed.workflowFile;
+    actions.push(
+      ctx.ciNotFailClosed.nextAction ||
+        (file
+          ? `Remove the skippable if: in ${file}, or write .ark/adoption-stance.json with stance: advisory-only`
+          : 'Remove the skippable if:, or write .ark/adoption-stance.json with stance: advisory-only')
+    );
+  }
   const humanSkillGaps = skillGapsForActiveHost(ctx.skillGaps);
   const legacyCodex = humanSkillGaps.some((g) => g.tool === 'codex' && g.legacyPromptsOnly);
   const remainingGaps = humanSkillGaps.filter(
@@ -97,7 +116,9 @@ export function collectDoctorNextActions(ctx) {
     actions.push('review dirty baseline freezes — fix the contract before trusting green-via-freeze');
   }
   if (ctx.analysisComplete && ctx.staleBaseline > 0) {
-    actions.push('tighten the baseline (--update-baseline)');
+    actions.push(
+      'tighten the baseline (--update-baseline --force --contract-session --author <steward>)'
+    );
   }
   if (ctx.staleRunners.length > 0) {
     actions.push(

package/bin/lib/field-install.mjs

@@ -83,6 +83,27 @@ function addDevDependencyPreservingFormat(source, version) {
   return `${source.slice(0, contentEnd)}${addition}${eol}${rootClosingIndent}${source.slice(rootClose)}`;
 }
 
+const ARK_CHECK_BIN_RE = /\b(?:ark-check|arkgate-check)(?:\.mjs|\.js)?\b/;
+const ARK_CHECK_RUNNER_RE =
+  /(?:^|[\s"'`;|&])(?:npx|pnpm|yarn|npm|bunx?|node)(?:\s|$)/;
+const GITHUB_RUN_KEY_RE = /^\s*(?:-\s+)?run:\s+/;
+const YAML_CHECK_JOB_ID_RE =
+  /^\s*(?:-\s+)?['"]?(?:ark-check|arkgate-check)['"]?\s*:/;
+const YAML_CONCURRENCY_GROUP_RE = /^\s*group:\s+/;
+
+/**
+ * True when the line invokes ark-check / arkgate-check (npx/pnpm/yarn/npm/node/run).
+ * YAML concurrency.group and job-id keys that only contain the name are not invocations.
+ */
+export function isArkCheckInvocationLine(command) {
+  if (typeof command !== 'string' || !command.trim()) return false;
+  if (/^\s*#/.test(command)) return false;
+  if (YAML_CHECK_JOB_ID_RE.test(command)) return false;
+  if (YAML_CONCURRENCY_GROUP_RE.test(command)) return false;
+  if (!ARK_CHECK_BIN_RE.test(command)) return false;
+  return ARK_CHECK_RUNNER_RE.test(command) || GITHUB_RUN_KEY_RE.test(command);
+}
+
 /**
  * Ensure a check command string includes `--baseline <file>`.
  * Only touches strings that already invoke ark-check / arkgate-check.
@@ -97,7 +118,7 @@ export function ensureBaselineFlagInCheckCommand(
   if (/^\s*#/.test(command)) {
     return { command, changed: false };
   }
-  if (!/\b(ark-check|arkgate-check)\b/.test(command)) {
+  if (!isArkCheckInvocationLine(command)) {
     return { command, changed: false };
   }
   if (/(?:^|\s)--baseline(?:\s|=|$)/.test(command)) {
@@ -180,7 +201,7 @@ export function syncBaselineIntoCheckSurfaces(root, opts = {}) {
       let fileChanged = false;
       const nextLines = lines.map((line) => {
         if (/^\s*#/.test(line)) return line;
-        if (!/\b(ark-check|arkgate-check)\b/.test(line)) return line;
+        if (!isArkCheckInvocationLine(line)) return line;
         if (/(?:^|\s)--baseline(?:\s|=|$)/.test(line)) return line;
         const { command, changed: c } = ensureBaselineFlagInCheckCommand(line, flagRel);
         if (c) {

package/bin/lib/first-run-help.mjs

@@ -95,12 +95,74 @@ Non-interactive (no TTY): uses the same defaults as --yes — never calls readli
 `;
 }
 
+/** `--sensors` is contract + coverage-evidence only — never a full-check pass. */
+export const SENSORS_PARTIAL_MODE_LINE =
+  'Contract + coverage-evidence only: no TypeScript, no analysis. Not a validity verdict.';
+
+export const SENSORS_DID_NOT_RUN = Object.freeze(['TypeScript', 'analysis']);
+
+/**
+ * Stamp a successful `--sensors --json` payload so agents cannot read exit 0 as
+ * a full-check pass. Failure payloads (`sensors.ok === false`) stay untouched.
+ */
+export function stampSensorsPartialModePayload(payload) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return payload;
+  const sensors = payload.sensors;
+  if (!sensors || typeof sensors !== 'object' || Array.isArray(sensors)) return payload;
+  if (sensors.ok === false) return payload;
+  return {
+    ...payload,
+    sensors: {
+      ...sensors,
+      notAVerdict: true,
+      didNotRun: [...SENSORS_DID_NOT_RUN],
+      partialMode: 'contract-only',
+    },
+  };
+}
+
+/**
+ * After `runSensors`, name what this mode skipped. Human success prints the
+ * line on stdout; JSON success restamps the captured object. Failures reprint
+ * as-is so exit 2 does not look like a map.
+ */
+export async function withSensorsPartialModeHonesty(args, run) {
+  if (args?.json) {
+    const chunks = [];
+    const original = console.log;
+    console.log = (...parts) => {
+      chunks.push(parts.map(String).join(' '));
+    };
+    try {
+      await run();
+    } finally {
+      console.log = original;
+    }
+    const text = chunks.join('\n');
+    if ((process.exitCode ?? 0) !== 0) {
+      if (text) original(text);
+      return;
+    }
+    try {
+      original(JSON.stringify(stampSensorsPartialModePayload(JSON.parse(text)), null, 2));
+    } catch {
+      original(text);
+    }
+    return;
+  }
+  await run();
+  if ((process.exitCode ?? 0) === 0) {
+    console.log(SENSORS_PARTIAL_MODE_LINE);
+  }
+}
+
 export function checkUsage() {
   return [
     'arkgate-check (alias ark-check) — the architecture check.',
     '',
     '  arkgate-check --doctor         where you are: one status light, one next action',
     '  arkgate-check --strict-merge   CI / merge gate (required GitHub status)',
+    '  arkgate-check --sensors        which sensors can ever be enforced (does not run analysis)',
     '',
     'Every flag and command: arkgate-check --help --all',
   ].join('\n');
@@ -124,7 +186,7 @@ export function checkUsageAll() {
     '           Exit 0 ran and clean, 1 drift remains, 2 could not run (no usable base ref).',
     '       ark-check --sensors [--json]           every sensor with its tier and whether it can EVER be enforced, plus every declared rule',
     '           with its local id, the sensor it delegates to, its source file, its mode and why it can or cannot be promoted.',
-    '           Contract + coverage-evidence only: no TypeScript, no analysis. Exit 0 on a report, 2 if the contract will not load.',
+    `           ${SENSORS_PARTIAL_MODE_LINE} Exit 0 on a report, 2 if the contract will not load.`,
     '       ark-check --promote [<ruleId>] [--json] [--apply]',
     '           what enforcing would cost: the findings each advisory rule already produces, from ONE run rather than one run per attempt.',
     '           Plan by default; --promote <ruleId> --apply (or --promote=<ruleId>) writes mode "enforced" into the ArkRules file that declares it.',
@@ -143,12 +205,14 @@ export function checkUsageAll() {
     '       ark-check --init [--preset hexagonal|layered|feature-sliced|monorepo|ui-surface|vertical-slice|ddd-bounded-contexts|vite-vercel-spa|clean-architecture|onion-architecture] [--force] [--follow-config-root]',
     '       --follow-config-root  On writes (init/install-agent-gates/migrate --write/…), adopt walked-up monorepo config root (default: keep explicit --root)',
     '       ark-check --install-agent-gates [--tools claude,cursor,codex,grok,antigravity] [--require-write-hook <host>] [--skills-only] [--codex-home] [--claude-home] [--grok-home] [--antigravity-home] [--agent-homes] [--force]',
-    '       ark-check --update-baseline [file]     freeze current violations (default .ark-baseline.json)',
+    '       ark-check --update-baseline [file] --force --contract-session --author <steward>',
+    '           freeze current violations (default .ark-baseline.json). --contract-session is required;',
+    '           --force when freeze-refuse fires; --author when stewards[] is set.',
     '       ark-check --print-config eleven-layer',
     '',
-    'Adopting Ark in an existing codebase? Run --update-baseline once to freeze existing',
-    'violations, commit the baseline file, and gate CI with --baseline: only NEW violations',
-    'fail the check, so the ratchet only moves toward zero.',
+    'Adopting Ark in an existing codebase? Run --update-baseline --force --contract-session --author <steward>',
+    'once to freeze existing violations, commit the baseline file, and gate CI with --baseline: only NEW',
+    'violations fail the check, so the ratchet only moves toward zero.',
     '',
     'Team parliament: law files (ark.config / arkrules / .ark-baseline.json) cannot ship in',
     'the same diff as product source. --changed --base <ref> checks touched files only.',

package/bin/lib/gate-files.mjs

@@ -5,7 +5,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { codexProjectMcpIsValid } from './codex-home.mjs';
-import { enforcingArkRunText } from './github-enforcement.mjs';
+import { enforcingArkRunText, runsArkCheck } from './github-enforcement.mjs';
 
 export const __packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 export const __arkCheckCli = path.join(__packageRoot, 'bin', 'ark-check.mjs');
@@ -120,7 +120,8 @@ export const REQUIRED_GATE_FILES = [
   'AGENTS.md',
   '.mcp.json',
 ];
-const REQUIRED_GATE_WORKFLOW = '.github/workflows/*.yml running ark-check';
+export const REQUIRED_GATE_WORKFLOW = '.github/workflows/*.yml running ark-check';
+export const CI_NOT_FAIL_CLOSED_ERROR = 'ci-not-fail-closed';
 const COMPACT_ROUTER = /<!--\s*arkgate:compact-router host=([a-z]+)\s*-->/;
 const FAIL_CLOSED_ARK_FLAG = /(?:^|\s)--(?:strict|strict-merge|require-gates)(?=\s|$)/;
 
@@ -584,27 +585,112 @@ function withVerifiedDependencyJobs(content) {
   return lines.join('\n');
 }
 
-export function hasArkWorkflow(root) {
+function isGuaranteedJobCondition(value) {
+  const text = unquoteYamlScalar(value);
+  return (
+    /^(?:\$\{\{\s*)?always\(\)(?:\s*\}\})?$/i.test(text) ||
+    /^(?:true|\$\{\{\s*true\s*\}\})$/i.test(text)
+  );
+}
+
+function neutralizeSkippableJobControls(content) {
+  const { lines, jobs } = workflowJobSections(content);
+  for (const job of jobs) {
+    const condition = jobProperty(lines, job, 'if');
+    if (condition && !isGuaranteedJobCondition(condition.value)) {
+      lines[condition.index] = lines[condition.index].replace(
+        /^(\s*(?:"if"|'if'|if):\s*).*$/i,
+        '$1true'
+      );
+    }
+    const continuation = jobProperty(lines, job, 'continue-on-error');
+    if (continuation && !/^['"]?false['"]?$/i.test(unquoteYamlScalar(continuation.value))) {
+      lines[continuation.index] = lines[continuation.index].replace(
+        /^(\s*(?:"continue-on-error"|'continue-on-error'|continue-on-error):\s*).*$/i,
+        '$1false'
+      );
+    }
+  }
+  return lines.join('\n');
+}
+
+function workflowMentionsArkAction(content) {
+  return /^\s*(?:-\s+)?uses:\s*['"]?pedroknigge\/arkgate@/im.test(String(content));
+}
+
+function listWorkflowYamlFiles(root) {
   const workflowsDir = path.join(root, '.github', 'workflows');
-  if (!fs.existsSync(workflowsDir)) return false;
+  if (!fs.existsSync(workflowsDir)) return [];
+  try {
+    return fs.readdirSync(workflowsDir).filter((file) => /\.ya?ml$/i.test(file));
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Presence vs fail-closed. A skippable `if:` still means the YAML exists.
+ * `failClosed` matches `hasArkWorkflow` (merge line). `present` is any
+ * ark-check / arkgate action workflow, including draft-skip jobs.
+ */
+export function inspectArkCiGate(root) {
+  const failClosedFiles = [];
+  const presentFiles = [];
   const declaredScript = architectureScript(root);
-  const script = isFailClosedArchitectureScript(declaredScript) ? declaredScript : '';
-  return fs
-    .readdirSync(workflowsDir)
-    .filter((file) => /\.ya?ml$/i.test(file))
-    .some((file) => {
-      try {
-        const content = fs.readFileSync(path.join(workflowsDir, file), 'utf8');
-        return FAIL_CLOSED_ARK_FLAG.test(
-          enforcingArkRunText(
-            withVerifiedDependencyJobs(withFailClosedArkActions(content)),
-            script
-          )
-        );
-      } catch {
-        return false;
-      }
-    });
+  const failClosedScript = isFailClosedArchitectureScript(declaredScript)
+    ? declaredScript
+    : '';
+  const workflowsDir = path.join(root, '.github', 'workflows');
+  for (const file of listWorkflowYamlFiles(root)) {
+    let content = '';
+    try {
+      content = fs.readFileSync(path.join(workflowsDir, file), 'utf8');
+    } catch {
+      continue;
+    }
+    const prepared = withVerifiedDependencyJobs(withFailClosedArkActions(content));
+    const failClosed = FAIL_CLOSED_ARK_FLAG.test(
+      enforcingArkRunText(prepared, failClosedScript)
+    );
+    const visible = withVerifiedDependencyJobs(
+      neutralizeSkippableJobControls(withFailClosedArkActions(content))
+    );
+    const present =
+      failClosed ||
+      runsArkCheck(visible, declaredScript) ||
+      workflowMentionsArkAction(content);
+    const relativePath = `.github/workflows/${file}`;
+    if (failClosed) failClosedFiles.push(relativePath);
+    if (present) presentFiles.push(relativePath);
+  }
+  return {
+    failClosed: failClosedFiles.length > 0,
+    present: presentFiles.length > 0,
+    failClosedFiles,
+    presentFiles,
+    workflowFile:
+      presentFiles.find((file) => !failClosedFiles.includes(file)) ??
+      presentFiles[0] ??
+      null,
+  };
+}
+
+export function hasArkWorkflow(root) {
+  return inspectArkCiGate(root).failClosed;
+}
+
+export function ciNotFailClosed(root) {
+  const ci = inspectArkCiGate(root);
+  if (!ci.present || ci.failClosed) return null;
+  const workflowFile = ci.workflowFile;
+  const named = workflowFile || REQUIRED_GATE_WORKFLOW;
+  return {
+    error: CI_NOT_FAIL_CLOSED_ERROR,
+    workflowFile,
+    workflowFiles: ci.presentFiles,
+    nextAction: `Remove the skippable if: in ${named}, or write .ark/adoption-stance.json with stance: advisory-only`,
+    message: `CI is not fail-closed. Workflow ${named} runs ark-check but a skippable if: is not a merge line.`,
+  };
 }
 
 export function missingGates(root) {
@@ -615,7 +701,7 @@ export function missingGates(root) {
   if (compactHost && !hasCompactHostRegistration(root, compactHost)) {
     missing.push(`compact host registration (${compactHost})`);
   }
-  if (!hasArkWorkflow(root)) missing.push(REQUIRED_GATE_WORKFLOW);
+  if (!inspectArkCiGate(root).present) missing.push(REQUIRED_GATE_WORKFLOW);
   return missing;
 }
 

package/bin/lib/managed-upgrade.mjs

@@ -494,8 +494,12 @@ export function planManagedUpgrade(root, options = {}) {
       action: canApply ? (currentScoped == null ? 'create' : 'update') : 'none',
       willApply: canApply,
       blocked,
+      // Raw scoped bytes. state/willApply use identity, not these hashes.
       beforeHash: hash(currentScoped == null ? null : Buffer.from(currentScoped)),
       afterHash: hash(Buffer.from(desiredScoped)),
+      beforeIdentity:
+        currentScoped == null ? null : managedContentIdentity(currentScoped, catalogAsset.kind),
+      afterIdentity: managedContentIdentity(desiredScoped, catalogAsset.kind),
       containerBeforeHash: hash(currentFile),
       [AFTER_CONTENT]: desiredFile,
     };
@@ -531,6 +535,8 @@ export function planManagedUpgrade(root, options = {}) {
       blocked: false,
       beforeHash: recorded.baseHash,
       afterHash: null,
+      beforeIdentity: recorded.contentIdentity ?? null,
+      afterIdentity: null,
       containerBeforeHash: null,
     });
   }
@@ -834,7 +840,9 @@ function assertAssetUnchanged(root, asset) {
 export function applyManagedUpgrade(root, plan, expectedPlanDigest) {
   const resolvedRoot = path.resolve(root);
   if (resolvedRoot !== plan.root) throw new Error('managed upgrade plan root mismatch');
-  if (plan.summary.blocked > 0) return publicPlan(plan, { blocked: true });
+  if (plan.summary.blocked > 0) {
+    return publicPlan(plan, { blocked: true, reasonCode: 'managed-consent-required' });
+  }
   const wouldWrite = plan.summary.wouldWrite ?? 0;
   // Content already matches: unbound --apply is a no-op (exit success), not a digest error.
   if (!expectedPlanDigest || expectedPlanDigest !== plan.planDigest) {

package/bin/lib/resolved-candidate-facts.mjs

@@ -750,6 +750,83 @@ function declaredIntent(value, config) {
   );
 }
 
+/** Call names whose string arguments are declared intent-reference sites. */
+const INTENT_CALL_NAMES = new Set(['publish', 'subscribe', 'defineIntent', 'registerHandler']);
+
+function isSyntaxWrapper(ts, node) {
+  return Boolean(
+    node &&
+      (ts.isParenthesizedExpression(node) ||
+        ts.isAsExpression(node) ||
+        (typeof ts.isTypeAssertionExpression === 'function' &&
+          ts.isTypeAssertionExpression(node)) ||
+        (typeof ts.isSatisfiesExpression === 'function' && ts.isSatisfiesExpression(node)))
+  );
+}
+
+function unwrapWrappers(ts, node) {
+  let current = node;
+  while (current?.parent && isSyntaxWrapper(ts, current.parent)) {
+    current = current.parent;
+  }
+  return current;
+}
+
+function callCalleeName(ts, node) {
+  if (!node || !ts.isCallExpression(node)) return undefined;
+  const expression = node.expression;
+  if (ts.isIdentifier(expression)) return expression.text;
+  if (ts.isPropertyAccessExpression(expression)) return expression.name.text;
+  return undefined;
+}
+
+function isPublishMetadataSource(ts, sourceProp) {
+  const object = sourceProp.parent;
+  if (!object || !ts.isObjectLiteralExpression(object)) return false;
+  const objectSite = unwrapWrappers(ts, object);
+  const objectParent = objectSite.parent;
+  if (!objectParent) return false;
+  if (ts.isCallExpression(objectParent) && callCalleeName(ts, objectParent) === 'publish') {
+    const args = objectParent.arguments;
+    return args[1] === objectSite || args[2] === objectSite;
+  }
+  if (
+    ts.isPropertyAssignment(objectParent) &&
+    syntaxPropertyName(ts, objectParent.name) === 'metadata'
+  ) {
+    const eventObject = objectParent.parent;
+    if (!eventObject) return false;
+    const eventSite = unwrapWrappers(ts, eventObject);
+    const call = eventSite.parent;
+    return Boolean(
+      call && ts.isCallExpression(call) && callCalleeName(ts, call) === 'publish'
+    );
+  }
+  return false;
+}
+
+/** Events, sagas, and publish metadata — not every string that matches a prefix. */
+function isDeclaredIntentSite(ts, node) {
+  const siteNode = unwrapWrappers(ts, node);
+  const parent = siteNode.parent;
+  if (!parent) return false;
+  if (ts.isCallExpression(parent)) {
+    const name = callCalleeName(ts, parent);
+    if (INTENT_CALL_NAMES.has(name) && parent.arguments.some((arg) => arg === siteNode)) {
+      return true;
+    }
+  }
+  if (ts.isArrayLiteralExpression(parent)) {
+    return isDeclaredIntentSite(ts, parent);
+  }
+  if (ts.isPropertyAssignment(parent)) {
+    const name = syntaxPropertyName(ts, parent.name);
+    if (name === 'intent' || name === 'onEvent' || name === 'reactsTo') return true;
+    if (name === 'source' && isPublishMetadataSource(ts, parent)) return true;
+  }
+  return false;
+}
+
 function mayContainForbiddenCapability(ts, sourceFile, forbiddenGlobals) {
   // Every symbol-aware match originates in an identifier or static string path segment.
   // Inspect decoded AST text so escaped identifiers still take the full checker path.
@@ -788,7 +865,11 @@ function collectPolicyFacts(ts, sourceFile, relativePath, config) {
           : {}),
       });
     }
-    if (ts.isStringLiteralLike(node) && declaredIntent(node.text, config)) {
+    if (
+      ts.isStringLiteralLike(node) &&
+      declaredIntent(node.text, config) &&
+      isDeclaredIntentSite(ts, node)
+    ) {
       intentReferences.push({
         file: relativePath,
         line: lineOf(sourceFile, node.getStart(sourceFile)),