Skip to content

arkgate 4.3.0

Latest
Latest

Choose a tag to compare

View all tags
@pedroknigge pedroknigge released this 09 Aug 04:42
· 3 commits to main since this release
v4.3.0
This tag was signed with the committer’s verified signature.
pedroknigge Pedro Knigge
SSH Key Fingerprint: 2yMsN35E9VkcNVMh2wC6EpqMuPtKy66aFf1IJB932WU
Verified
Learn about vigilant mode.
65f95a0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ArkGate 4.3.0

  • Status: prepared
  • npm: arkgate@4.3.0 (not published yet)
  • Git tag: v4.3.0 (pending)

Minor over 4.2.1. Phase ACS — agent contract surface: diagnostic code catalog,
unified status snapshot, version-matched agent projection, Agent Skills packaging of the
existing 13 skills, stable finding refs, and maintainer placement A/B eval.

No required config migration. Codex / Cursor / OpenCode remain advisory at write time. Skills
and AGENTS projection never enforce. Z09 / RB-11 remain open. No new skill names, no new
presets/packs, no LLM pass/fail in the package.

What ArkGate is / isn't

  • Guardrail + write firewall + coach — not an autonomous architect. Scan is deterministic;
    process (placement, pilots, wording) is agent/human judgment outside the package.
  • Green edges / ark-check pass ≠ finished architecture or good design. Design residual and
    judgment remain after Enforce; design-weak is honest residual, not “healthy finished.”
  • Structure sensors and many smells are heuristics. Validate warnings by reading the code;
    do not treat advisory ArkRules or smell inventory as a score.
  • Without a required CI / merge status check, enforcement is still avoidable. Local hooks and
    MCP only coach; they do not replace a required GitHub status context.
  • Soft hosts (Codex / Cursor / OpenCode): advisory at local write. The hard merge boundary is a
    required GitHub status running arkgate-check --strict-merge (alias ark-check --strict-merge).
  • The contract proves declared rules hold (layers, capabilities, enforced sensors/invariants with
    evidence). It does not prove the chosen design is correct.

What changed

Area 4.3.0 result
Diagnostic catalog (ACS02) Closed public ruleId vocabulary with why/fix + docs/diagnostics.md#RULE_ID anchors; root API exports
Status manifest (ACS03) ark status --json + MCP ark_status; schema arkgate/schema/status-manifest; identity/activation/last-check/rules/nextAction
Agent projection (ACS04) ark agents-md version-stamped managed AGENTS block; install/upgrade embed; content-identity merge; non-authoritative
Agent Skills packaging (ACS05) Same 13 skills at templates/agent-skills/<name>/SKILL.md for npx skills add; no new names
Finding refs (ACS06) Analysis-result schema 1.5: findingRef, baseline-compatible targetKey, docsCodePath on factory diagnostics
Placement A/B eval (ACS07) Maintainer eval/placement-ab/ dry harness; not a product score
Product voice (ACS01) Guardrail catalog + scan/process dual-depth language; freeze restated for 4.3.0

What did not change

  • Write gate / CI fail-closed semantics for value-layer edges
  • Host hardness claims (Codex/Cursor/OpenCode stay advisory at local write)
  • Skill names (still 13; packaging only)
  • Z09 / RB-11 field claims (still open)
  • Binary gate; no numeric trust score; no LLM process verdict in package

Upgrade

# After Trusted Publishing only (this release is still prepared, not on npm yet):
npm install -D arkgate@4.3.0
# or, once 4.3.0 is latest: npm install -D arkgate@latest
# Until then, stay on published 4.2.1 or dogfood this git tree after npm run build.
npx arkgate-check --doctor --json
# optional agent surfaces (4.3.0+):
npx arkgate status --json
npx arkgate agents-md --write
# optional ecosystem skills path (same 13 names):
# npx skills add ./node_modules/arkgate/templates/agent-skills

No ark.config.json migration. Dual bins arkgate* / ark* unchanged. Analysis-result
consumers that parse diagnostics may see additive findingRef / targetKey / docsCodePath
fields (schema 1.5); older consumer-owned 1.0–1.4 envelopes remain valid without them.

Compatibility and limits

  • Projection and skills remain non-enforcing — gate is CLI / hooks / CI only.
  • Soft hosts stay advisory; doctor honesty taxonomy from 4.1.x is unchanged.
  • Status snapshot is not a score; residual counts are inventory facts only.
  • Maintainer placement A/B is offline/eval only and is not a release product metric.
  • Does not close Z09 / RB-11 retained-adoption claims.

Maintainer publication checklist

  1. Full-matrix CI and Security green on the release SHA
  2. Package measurement still under 4.2.0 ceilings (or re-record budget)
  3. npm run release:npm -- --dry (via publish-npm.yml OIDC path)
  4. Signed tag v4.3.0 + GitHub Release from this file
  5. gh workflow run publish-npm.yml -f tag=v4.3.0 -f dry_run=false (OIDC trusted publisher)
  6. Verify npm version, latest, provenance, and gitHead
  7. Flip public pointers and this status to published
  8. mcp-publisher validate server.json && mcp-publisher publish server.json

Security notes

No new dependency advisories unique to this prepare beyond overrides already on main.
Agent-facing surfaces add catalog/status/projection/refs only — they do not weaken gate edges
or invent hard-write for soft hosts.

Assets 12
Loading