arkgate v4.6.4

ArkGate 4.6.4

• Status: prepared
• Target npm: arkgate@4.6.4 (latest after publish)
• Target Git tag: v4.6.4
• Prior published: arkgate@4.6.3

Patch over 4.6.3. Managed upgrade now tells Codex users exactly how to activate and verify
the operation-scoped local apply_patch boundary. No required config migration. No new skill
names, sensors, scores, or runtime-package promotion.

What changed

ark upgrade --json now includes:

{
  "id": "codex-hard-write",
  "try": "npx arkgate-check --install-agent-gates --tools codex --force"
}

The full card tells users to:

1. refresh .codex/hooks.json;
2. restart Codex CLI or the local ChatGPT Desktop session;
3. review and trust the exact project hook definition;
4. exercise a governed apply_patch; and
5. inspect doctor.writePath for fresh operation-scoped evidence.

The human Suggested improvements block prints the same path on preview and apply, even when
managed content has nothing else to write. The packaged /ark-upgrade skill carries matching
guidance.

Stale process recovery

• A long-lived MCP process whose processArkgateVersion differs from the project install becomes
  non-authoritative. ark_identity still reports the mismatch so the host can diagnose it;
  project tools return PROCESS_PACKAGE_STALE until restart/retarget.
• When a modern global ArkGate runs ark upgrade but is older than the project install, it
  automatically hands the original invocation to node_modules/arkgate/bin/ark.mjs.
• JSON output stays machine-clean because the project-local child owns the command output.
• A global CLI older than 4.6.4 cannot contain this handoff; invoke npx arkgate upgrade --json
  once to enter the project-local path.

Honest limits

• Only a complete runtime-observed local apply_patch can become hard.
• Hook files on disk stay configured/unverified until observed.
• Hosted tools, specialized opt-out paths, shell/direct writes, incomplete reconstruction, and
  human edits remain CI-backed.
• MCP remains advisory. Repair reinjection is not guaranteed.
• Required arkgate-check --strict-merge remains the all-path merge boundary.
• Z09 / RB-11 retained-adoption claims remain open.

Upgrade

npm install -D arkgate@4.6.4
npx arkgate upgrade --json
npx arkgate-check --install-agent-gates --tools codex --force
npx arkgate-check --doctor

Maintainer publication checklist

1. Land the prepared 4.6.4 PR on protected main
2. Signed tag v4.6.4 + GitHub Release from this file
3. gh workflow run publish-npm.yml -f tag=v4.6.4 -f dry_run=false
4. Verify npm latest, provenance, checksum, and gitHead
5. mcp-publisher validate server.json && mcp-publisher publish server.json
6. Flip public pointers and publish arkgate-site 4.6.4 with 4.6.3/4.6.4 notes

Security notes

This release changes advisory upgrade guidance only. It does not weaken architecture policy,
expand filesystem access, auto-apply repair output, or broaden the 4.6.3 hard-write claim.