arkgate 4.8.9 → 4.8.10

package/CHANGELOG.md

@@ -3,6 +3,84 @@
 All notable changes to ArkGate (`arkgate`; formerly `ark-runtime-kernel`) are documented here or
 in the immutable pre-2.0 archive linked below.
 
+## 4.8.10 — 2026-09-02
+
+**Patch** over **4.8.9**. Amarilla first-aggregate sensors. Incomplete analysis
+never looks green: an enforced sensor that cannot see its scope is not a pass.
+**Write. Check. Ship.** **No required config migration.** No `schemaVersion` bump.
+Does not close `K01` / `Z09`. No new skill names.
+
+**Status: prepared** (tree candidate; npm `latest` remains **4.8.9** until the
+signed-tag provenance workflow succeeds).
+
+### Added
+- `arkgate report` / `ark report` on the existing dual bins: draft an upstream GitHub issue for
+  `pedroknigge/arkgate` (`package.json` `bugs.url`), never the consumer repo. Default prints the
+  draft (arkgate version + last-check snippet). Create only with `--submit` and
+  `--i-confirm-submit` (or TTY `Type submit to send`). `--yes` does not submit. Missing or
+  unauthenticated `gh` prints the draft and the exact `gh issue create` command, then exits 2.
+  Not `ark-check --report` (HTML). Does not close `K01` / `Z09`. No new skill names.
+
+### Fixed
+- Structural-hint budget: when eligible governed files exceed `coverage.maxFiles`
+  (default `400`), emit `ARKRULE_HINT_BUDGET_EXHAUSTED` with exact hinted/governed
+  counts and per-sensor reviewed N/M of scope. `--strict-config` fails if an
+  enforced hint sensor is truncated. No `arkrules.hintBudget` key.
+- `--update-baseline` GitHub rewrite touches only `ark-check` / `arkgate-check`
+  invocation lines (`run:` / package scripts). It does not append `--baseline` to
+  `concurrency.group` or job-id lines that merely name the check. Writes outside
+  the three law files are announced (`Synced --baseline into: …`).
+- DomainModel class sensors: method finder is paren-balanced, so a later broken
+  method is visible. Remaining truncation is reported (`shape analysed until
+  character N`), not silent green.
+- One shared invariant-word list (`ensureInvariants` / `raise` / `record` / `.push(`).
+  Assignment `=` is distinct from `===` / `!==` / `<=` / `>=`. `pendingEvents = []`
+  is idiomatic; events-array `.push(` counts as publish. Object literals and
+  multiline params are not public fields.
+- `ARKRULE_SCOPE_EMPTY` is not freezable, even with `--force`. It is a config
+  diagnostic, not code debt. No `allowEmptyScope` key.
+- `ARKRULE_STRUCTURE` freeze keys include the sensor id (and symbol when present).
+  A freeze for `orchestration-only` does not silence `thin-adapter` or
+  `writes-via-aggregate` on the same file. v1 empty-target keys remain exact-match
+  only.
+- Intent-prefix checks apply only at declared intent-reference sites (`publish` /
+  `subscribe` / `defineIntent` / `registerHandler`, `intent` / `onEvent` /
+  `reactsTo`, publish `metadata.source`). Not every string literal. No
+  `kernel.dtypePrefixes`. A kernel DType such as `Management.EvmInspection.Data`
+  does not trip `LAYER_INTENT_REFERENCE_VIOLATION`.
+- A5: `writes-via-aggregate` treats `@/lib/db` (and local `…/db`) as an IO import
+  without opening tsconfig. Write tokens require callee `db` / `tx` / `client` /
+  `prisma` / `drizzle`; `repo.update(` is not a write. Optional resolved-import
+  facts: PersistenceAdapters layer is a driver.
+- IO import hints match `postgres` and `drizzle-orm/postgres-js` (package
+  subpaths), in lockstep for ArkRules and ArkOrder. `require()` matches the same
+  packages.
+- React/UI `.set()` is not `ARKORDER_GENERIC_UPDATE`. Only `plane` /
+  `orderPlane` callees (or a file that constructs `createOrderPlane`) count as ξ
+  mutation. `Map` / `URLSearchParams` / `useState` setters stay silent.
+- `--sensors` success is not a validity verdict. Stdout names the contract-only
+  skip (`Contract + coverage-evidence only: no TypeScript, no analysis. Not a
+  validity verdict.`); `--json` stamps `notAVerdict` / `didNotRun` /
+  `partialMode=contract-only`. It does not print `Ark check passed`.
+
+### Changed
+- `coverage.maxFiles` schema description, configuration docs, and diagnostics name
+  that the same budget also bounds structural-hint preload for `orchestration-only`,
+  `thin-adapter`, and `writes-via-aggregate`.
+- Brownfield: law-then-product PR sequence when a rule’s folder does not exist yet
+  (advisory or placeholder path, then product, then promote). STRUCTURE key compat
+  for v1 empty-target rows is documented.
+- A10: baseline regenerate note lists
+  `ark-check --update-baseline --force --contract-session --author <steward>`.
+  Doctor concentration looks at `sensor` / `arkruleId`; orchestration-only
+  majority is code debt, not “Fixing the contract”. Short `--help`: `--sensors`
+  does not run analysis; `--help --all` lists `--update-baseline` / `--author`.
+  AO11 9-vs-7 is not a bug.
+- A11: `--changed` bounds file-local structural sensors and hint load to the
+  touched files. Import-edge, layer, and cycle sensors still see the full
+  governed graph. Optional process-local hint cache by content hash. Does not
+  claim 170s becomes seconds. No second analysis engine.
+
 ## 4.8.9 — 2026-09-01
 
 **Patch** over **4.8.8**. Field diagnostic honesty: doctor default homedir, live
@@ -15,8 +93,7 @@ intent-reference checks share the import classifier. Amarilla ArkOrder:
 **No required config migration.** No `ark.config.json` schema bump. Does not close `K01` / `Z09`.
 No new skill names.
 
-**Status: prepared** (tree candidate; npm `latest` remains **4.8.8** until the
-signed-tag provenance workflow succeeds).
+**Status: published** (on npm `latest`; see `docs/releases/4.8.9.md`).
 
 ### Added
 - Optional `arkOrder.appliesTo` globs (same engine as layers). `managedLayers`
@@ -72,7 +149,7 @@ payload-free inspector monitors. ArkOrder and first-contact docs gain honesty co
 **No required config migration.** No `ark.config.json` schema bump. Does not close
 `K01` / `Z09`.
 
-**Status: published** (on npm `latest`; see `docs/releases/4.8.8.md`).
+**Status: published** (see `docs/releases/4.8.8.md`).
 
 ### Added
 - Dual **`ark-dashboard` / `arkgate-dashboard`** bins render the loopback ArkRun

package/README.md

@@ -37,7 +37,7 @@ Works with Cursor, Claude, Codex, and Grok.
 
 </div>
 
-> **ArkGate 4.8.9** is prepared on this tree; npm `latest` remains **4.8.8**.
+> **ArkGate 4.8.10** is prepared on this tree; npm `latest` remains **4.8.9**.
 > Write. Check. Ship. Adopted = required GitHub
 > status running `arkgate-check --strict-merge`, or an explicit `advisory-only` stance.
 > Status is compact (`arkgate-check --doctor`; `--all` for Details). Optional **ArkRun**
@@ -45,7 +45,7 @@ Works with Cursor, Claude, Codex, and Grok.
 > (`arkgate/order`) stops the agent rewriting the few slow product decisions as CRUD;
 > later pattern change is `proposeRelease` then `apply`.
 > `@arkgate/runtime` is deprecated.
-> [4.8.9 prepared](docs/releases/4.8.9.md) · [4.8.8 published](docs/releases/4.8.8.md) · [4.8.7](docs/releases/4.8.7.md) · [4.8.6](docs/releases/4.8.6.md) · [4.8.5](docs/releases/4.8.5.md) · [4.8.4](docs/releases/4.8.4.md) · [4.8.3](docs/releases/4.8.3.md) · [4.8.2](docs/releases/4.8.2.md) · [4.8.1](docs/releases/4.8.1.md) · [4.8.0](docs/releases/4.8.0.md) · [Docs hub](docs/README.md) · [Voice](docs/product-voice.md)
+> [4.8.10 prepared](docs/releases/4.8.10.md) · [4.8.9 published](docs/releases/4.8.9.md) · [4.8.8](docs/releases/4.8.8.md) · [4.8.7](docs/releases/4.8.7.md) · [4.8.6](docs/releases/4.8.6.md) · [4.8.5](docs/releases/4.8.5.md) · [4.8.4](docs/releases/4.8.4.md) · [4.8.3](docs/releases/4.8.3.md) · [4.8.2](docs/releases/4.8.2.md) · [4.8.1](docs/releases/4.8.1.md) · [4.8.0](docs/releases/4.8.0.md) · [Docs hub](docs/README.md) · [Voice](docs/product-voice.md)
 
 ---
 
@@ -342,8 +342,8 @@ Rename the three keys. Compact starters leave it off. Details:
 | Config · package surface · TS | [configuration](docs/configuration.md) · [package-surface](docs/package-surface.md) · [typescript-support](docs/typescript-support.md) |
 | Brownfield | [docs/brownfield-adoption.md](docs/brownfield-adoption.md) |
 | Security | [SECURITY.md](SECURITY.md) |
-| Prepared (4.8.9; not published) | [docs/releases/4.8.9.md](docs/releases/4.8.9.md) · [CHANGELOG](CHANGELOG.md) |
-| Current published (4.8.8 on npm `latest`) | [docs/releases/4.8.8.md](docs/releases/4.8.8.md) · [CHANGELOG](CHANGELOG.md) |
+| Prepared (4.8.10; not published) | [docs/releases/4.8.10.md](docs/releases/4.8.10.md) · [CHANGELOG](CHANGELOG.md) |
+| Current published (4.8.9 on npm `latest`) | [docs/releases/4.8.9.md](docs/releases/4.8.9.md) · [CHANGELOG](CHANGELOG.md) |
 | Prior published (4.8.7) | [docs/releases/4.8.7.md](docs/releases/4.8.7.md) · [CHANGELOG](CHANGELOG.md) |
 | Prior published (4.8.6) | [docs/releases/4.8.6.md](docs/releases/4.8.6.md) |
 | Prior published (4.8.5) | [docs/releases/4.8.5.md](docs/releases/4.8.5.md) |

package/bin/ark-check-runtime.mjs

@@ -96,7 +96,7 @@ import {
   writeArkRulesTemplates,
 } from './lib/presets.mjs';
 import { loadArkConfigContract, parseArkConfigJson } from './lib/config-contract.mjs';
-import { checkUsage, checkUsageAll } from './lib/first-run-help.mjs';
+import { checkUsage, checkUsageAll, withSensorsPartialModeHonesty } from './lib/first-run-help.mjs';
 import { createAdapterResult } from './lib/adapter-contract.mjs';
 import {
   UNGOVERNED_PROBE_CAP,
@@ -1140,7 +1140,7 @@ async function main() {
 
   if (args.sensors) {
     const { runSensors } = await import('./lib/sensor-promote-cli.mjs');
-    await runSensors(args, readConfig);
+    await withSensorsPartialModeHonesty(args, () => runSensors(args, readConfig));
     return;
   }
 

package/bin/ark.mjs

@@ -36,6 +36,7 @@ import {
 import { runStatusCommand } from './lib/status-command.mjs';
 import { runAgentProjectionCommand } from './lib/agent-projection-command.mjs';
 import { setupUsage, setupUsageAll, upgradeUsage } from './lib/first-run-help.mjs';
+import { runUpstreamReportCommand } from './lib/upstream-report.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const arkCheck = path.join(here, 'ark-check.mjs');
@@ -45,20 +46,20 @@ Usage: arkgate dashboard [--url <snapshot-url>] [--interval <ms>]
 Polls an ArkRun inspector; it does not start the kernel.`;
 
 function withDashboardHelp(text, detailed) {
+  const extra = detailed
+    ? '  arkgate dashboard [--url <snapshot-url>] [--interval <ms>]\n  arkgate report  [--root <project>] [--json] [--title <text>] [--finding <ref>] [--submit] [--i-confirm-submit]\n'
+    : '';
+  const extraDesc = detailed
+    ? '  dashboard  ANSI observability TUI (spawns ark-dashboard).\n  report     Draft an upstream GitHub issue for pedroknigge/arkgate. Create needs --submit plus confirm. --yes does not submit.\n'
+    : '';
   if (detailed) {
     return text
-      .replace(
-        '  arkgate agents-md [--root',
-        '  arkgate dashboard [--url <snapshot-url>] [--interval <ms>]\n  arkgate agents-md [--root'
-      )
-      .replace(
-        '  agents-md Version-matched',
-        '  dashboard  ANSI observability TUI against a running ArkRun inspector (spawns ark-dashboard).\n  agents-md Version-matched'
-      );
+      .replace('  arkgate agents-md [--root', `${extra}  arkgate agents-md [--root`)
+      .replace('  agents-md Version-matched', `${extraDesc}  agents-md Version-matched`);
   }
   return text.replace(
     '  arkgate-check --doctor     status — one next step\n',
-    '  arkgate-check --doctor     status — one next step\n  arkgate dashboard         observability TUI (inspector)\n'
+    '  arkgate-check --doctor     status — one next step\n  arkgate dashboard         observability TUI (inspector)\n  arkgate report            draft an upstream GitHub issue\n'
   );
 }
 
@@ -181,7 +182,7 @@ function parseArgs(argv) {
     else if (!arg.startsWith('-') && args.command === undefined) {
       args.command = arg;
       // Dashboard owns its flags (--url/--interval); pass the rest through untouched.
-      if (arg === 'dashboard') {
+      if (arg === 'dashboard' || arg === 'report') {
         args.passthrough = argv.slice(i + 1);
         break;
       }
@@ -946,6 +947,13 @@ async function main() {
     });
   }
 
+  if (args.command === 'report') {
+    return runUpstreamReportCommand({
+      root: args.root, json: args.json, yes: args.yes,
+      arkgateVersion: cliVersion(), argv: args.passthrough,
+    });
+  }
+
   if (args.command === 'agents-md' || args.command === 'agent-projection') {
     return runAgentProjectionCommand({
       root: args.root,