@archpilotlabs/archpilot 0.2.2 → 0.2.4

package/dist/core/src/architectureValidation.js

@@ -0,0 +1,3879 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ValidationRuleCatalog = exports.ValidationRuleIds = void 0;
+exports.getValidationRuleMetadataById = getValidationRuleMetadataById;
+exports.getAllValidationRuleMetadata = getAllValidationRuleMetadata;
+exports.formatValidationRuleLabel = formatValidationRuleLabel;
+exports.isEnforcementRuleCategory = isEnforcementRuleCategory;
+exports.getValidationSeverityPolicyNote = getValidationSeverityPolicyNote;
+exports.getSeveritySortOrder = getSeveritySortOrder;
+exports.getValidationOverallStatus = getValidationOverallStatus;
+exports.classifyValidationResult = classifyValidationResult;
+exports.buildValidationStatusSummary = buildValidationStatusSummary;
+exports.readValidationConfig = readValidationConfig;
+exports.canOverrideSeverity = canOverrideSeverity;
+exports.resolveEffectiveSeverity = resolveEffectiveSeverity;
+exports.getEffectiveValidationConfigSummary = getEffectiveValidationConfigSummary;
+exports.buildValidationStatusExport = buildValidationStatusExport;
+exports.readArchitectureConfig = readArchitectureConfig;
+exports.runArchitectureValidationForWorkspace = runArchitectureValidationForWorkspace;
+const path = __importStar(require("node:path"));
+const node_fs_1 = require("node:fs");
+const architectureInit_1 = require("./architectureInit");
+const architectureDriftDetection_1 = require("./architectureDriftDetection");
+const dependencyValidation_1 = require("./dependencyValidation");
+const moduleContractValidation_1 = require("./moduleContractValidation");
+const validationSuppressions_1 = require("./validationSuppressions");
+const findingTargetResolution_1 = require("./findingTargetResolution");
+const discoverAdrs_1 = require("./discoverAdrs");
+const adrValidation_1 = require("./adr/adrValidation");
+const projectConfig_1 = require("./config/projectConfig");
+const projectIdentity_1 = require("./config/projectIdentity");
+const remotePolicyLoader_1 = require("./policy/remotePolicyLoader");
+const effectivePolicyResolver_1 = require("./policy/effectivePolicyResolver");
+const operationalLogging_1 = require("./operationalLogging");
+const architectureHealthScore_1 = require("./architectureHealthScore");
+const architectureHealthHistory_1 = require("./architectureHealthHistory");
+const architectureHealthHistoryReporter_1 = require("./reporting/architectureHealthHistoryReporter");
+const architectureScoreBadge_1 = require("./reporting/architectureScoreBadge");
+const architectureDriftTimeline_1 = require("./architectureDriftTimeline");
+const driftComparator_1 = require("./drift/driftComparator");
+const driftSnapshotLoader_1 = require("./drift/driftSnapshotLoader");
+const driftSnapshotWriter_1 = require("./drift/driftSnapshotWriter");
+const suppressionValidator_1 = require("./suppressions/suppressionValidator");
+const quickFixProviders_1 = require("./quickFix/quickFixProviders");
+const setupNextSteps_1 = require("./setupNextSteps");
+const changeRiskAssessment_1 = require("./reporting/changeRiskAssessment");
+const exceptionLoader_1 = require("./policy/exceptionLoader");
+const dataQueryRiskDetection_1 = require("./dataQueryRiskDetection");
+const applicationLayeringAnalysis_1 = require("./applicationLayeringAnalysis");
+const authorizationTenantAnalysis_1 = require("./authorizationTenantAnalysis");
+const transactionDomainAnalysis_1 = require("./transactionDomainAnalysis");
+const apiDesignAnalysis_1 = require("./apiDesignAnalysis");
+const eventArchitectureAnalysis_1 = require("./eventArchitectureAnalysis");
+const moduleDiscovery_1 = require("./moduleDiscovery");
+const managedArtifacts_1 = require("./managedArtifacts");
+const validationProfiling_1 = require("./validationProfiling");
+const validationSourceInventory_1 = require("./validationSourceInventory");
+const validationTypeScriptAstCache_1 = require("./validationTypeScriptAstCache");
+exports.ValidationRuleIds = {
+    ARCH_MODULAR_STRUCTURE: 'AP-ARCH-001',
+    ARCH_PROFILE_NOT_FULLY_SUPPORTED: 'AP-ARCH-002',
+    ARCH_OVERVIEW_ARTIFACT_EXISTS: 'AP-ARCH-003',
+    ARCH_MODULE_BASELINE_COMPLETE: 'AP-ARCH-004',
+    ARCH_MODULE_REGISTRY_PATH_EXISTS: 'AP-ARCH-005',
+    ARCH_MODULE_CONTRACT_FILE_EXISTS: 'AP-ARCH-006',
+    ARCH_MODULE_CONTRACT_IDENTITY_MATCHES_REGISTRY: 'AP-ARCH-007',
+    ARCH_MODULE_PUBLIC_ENTRYPOINTS_ALIGNED: 'AP-ARCH-008',
+    ARCH_RULE_CONFIGURATION_VALID: 'AP-ARCH-009',
+    ARCH_PROJECT_CONFIGURATION_VALID: 'AP-ARCH-010',
+    ARCH_PROJECT_IDENTITY_CONFIGURATION_VALID: 'AP-ARCH-011',
+    API_OPENAPI_EXISTS: 'AP-API-001',
+    API_GRAPHQL_PATH_PRESENT: 'AP-API-002',
+    API_MISSING_COLLECTION_PAGINATION: 'AP-API-010',
+    API_BULK_OPERATION_RISK: 'AP-API-011',
+    API_DTO_ENTITY_LEAKAGE: 'AP-API-012',
+    API_INCONSISTENT_RESOURCE_DESIGN: 'AP-API-013',
+    API_VERSIONING_STRATEGY_INCONSISTENCY: 'AP-API-014',
+    API_CONTRACT_IMPLEMENTATION_DRIFT: 'AP-API-015',
+    DEP_CIRCULAR_MODULE_DEPENDENCY: 'AP-DEP-001',
+    DEP_FORBIDDEN_CROSS_MODULE_DEPENDENCY: 'AP-DEP-002',
+    DEP_NON_PUBLIC_CROSS_MODULE_IMPORT: 'AP-DEP-003',
+    DEP_CROSS_MODULE_DEPENDENCY_DECLARED_IN_CONTRACT: 'AP-DEP-004',
+    DEP_CROSS_MODULE_IMPORT_USES_PUBLIC_SURFACE_ONLY: 'AP-DEP-005',
+    DEP_DECLARED_MODULE_DEPENDENCY_NOT_USED: 'AP-DEP-006',
+    DEP_ISOLATED_MODULE_DETECTED: 'AP-DEP-007',
+    DEP_TRANSITIVE_CIRCULAR_MODULE_DEPENDENCY: 'AP-DEP-008',
+    DEP_MODULE_HIGH_INBOUND_DEPENDENCY_COUNT: 'AP-DEP-009',
+    DEP_LAYER_DIRECTION_VIOLATION: 'AP-DEP-010',
+    DEP_CROSS_COMPONENT_POLICY_VIOLATION: 'AP-DEP-011',
+    ADR_DIRECTORY_EXISTS: 'AP-ADR-001',
+    ADR_FILE_HAS_TITLE: 'AP-ADR-002',
+    ADR_STATUS_VALID: 'AP-ADR-003',
+    ADR_REQUIRED_COVERAGE_PRESENT: 'AP-ADR-004',
+    SUPPRESSION_REASON_PRESENT: 'AP-SUP-001',
+    SUPPRESSION_NOT_EXPIRED: 'AP-SUP-002',
+    SUPPRESSION_MATCHES_ACTIVE_FINDING: 'AP-SUP-003',
+    SUPPRESSION_NOT_DUPLICATED: 'AP-SUP-004',
+    SUPPRESSION_EXPIRY_FORMAT_VALID: 'AP-SUP-005',
+    DB_TENANT_SAME_SCHEMA_TENANT_ID: 'AP-DB-001',
+    DB_SQL_BASELINE_EXISTS: 'AP-DB-002',
+    DQR_MISSING_TENANT_FILTER_EVIDENCE: 'AP-DQR-001',
+    DQR_BROAD_SELECT_STAR_USAGE: 'AP-DQR-002',
+    DQR_UNBOUNDED_QUERY_WITHOUT_PAGINATION: 'AP-DQR-003',
+    DQR_CROSS_MODULE_DIRECT_DB_ACCESS: 'AP-DQR-004',
+    DQR_N_PLUS_ONE_QUERY_EVIDENCE: 'AP-DQR-005',
+    DQR_LARGE_COLLECTION_LOADING: 'AP-DQR-006',
+    DQR_MISSING_PROJECTION_SELECT: 'AP-DQR-007',
+    DQR_REPEATED_QUERY_PATTERN: 'AP-DQR-008',
+    EVT_PUBLISHED_EVENT_HAS_NO_HANDLER: 'AP-EVT-001',
+    EVT_CIRCULAR_EVENT_CHAIN_RISK: 'AP-EVT-002',
+    EVT_SYNCHRONOUS_DEPENDENCY_DISGUISED_AS_EVENT: 'AP-EVT-003',
+    EVT_EVENT_NAMING_INCONSISTENCY: 'AP-EVT-004',
+    APP_CONTROLLER_BUSINESS_LOGIC: 'AP-APP-001',
+    APP_REPOSITORY_BUSINESS_LOGIC: 'AP-APP-002',
+    APP_SERVICE_BYPASSES_REPOSITORY: 'AP-APP-003',
+    APP_PACKAGE_RESPONSIBILITY_MISMATCH: 'AP-APP-004',
+    APP_SERVICE_GOD_CLASS: 'AP-APP-005',
+    AUTH_MISSING_AUTHORIZATION_ENFORCEMENT: 'AP-AUTH-001',
+    AUTH_INCONSISTENT_AUTHORIZATION: 'AP-AUTH-002',
+    AUTH_AUTHORIZATION_IN_WRONG_LAYER: 'AP-AUTH-003',
+    TEN_MISSING_TENANT_CONTEXT_PROPAGATION: 'AP-TEN-001',
+    TEN_MISSING_TENANT_ENFORCEMENT: 'AP-TEN-002',
+    TEN_CROSS_TENANT_ACCESS_RISK: 'AP-TEN-003',
+    TEN_TENANT_MODEL_UNDOCUMENTED: 'AP-TEN-004',
+    TXN_TRANSACTION_BOUNDARY_TOO_BROAD: 'AP-TXN-001',
+    TXN_TRANSACTION_STARTED_IN_CONTROLLER: 'AP-TXN-002',
+    TXN_NESTED_TRANSACTION_RISK: 'AP-TXN-003',
+    TXN_LONG_RUNNING_WORKFLOW_INSIDE_TRANSACTION: 'AP-TXN-004',
+    DOM_ANEMIC_DOMAIN_MODEL: 'AP-DOM-001',
+    DOM_AGGREGATE_BOUNDARY_VIOLATION: 'AP-DOM-002',
+    DOM_OVERSIZED_AGGREGATE_OR_SERVICE_BOUNDARY: 'AP-DOM-003',
+    DOM_DOMAIN_LOGIC_SCATTERED_ACROSS_LAYERS: 'AP-DOM-004',
+    DOM_CROSS_AGGREGATE_MODIFICATION_RISK: 'AP-DOM-005',
+    DOC_TENANT_DIFFERENT_SCHEMA_ADR: 'AP-DOC-001',
+    DOC_RBAC_MENTIONED_IN_OVERVIEW: 'AP-DOC-002',
+    SAFE_MISSING_ADR_COVERAGE: 'AP-SAFE-001',
+    SAFE_MISSING_ROLLBACK_PLAN: 'AP-SAFE-002',
+    SAFE_MISSING_FEATURE_FLAG_EVIDENCE: 'AP-SAFE-003',
+};
+exports.ValidationRuleCatalog = {
+    ARCH_MODULAR_STRUCTURE: {
+        id: exports.ValidationRuleIds.ARCH_MODULAR_STRUCTURE,
+        title: 'Modular monolith folder structure exists',
+        category: 'architecture',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether a modular monolith has a configured module root with clear top-level module or capability directories.',
+        recommendedFix: 'Set a valid module root in architecture.json and organize code into clear top-level module or capability folders under that root.',
+        explanation: 'This rule checks that architecture code is organized into explicit module or domain boundaries.',
+        whyItMatters: 'Without explicit boundaries, architectural intent becomes implicit and drift is harder to detect early.',
+        howToFix: 'Use a stable module root such as src/modules or src, then place clear business or capability folders directly under that configured root.',
+        exampleFix: `src/modules/
+  auth/
+  billing/
+  inventory/
+
+or
+
+src/
+  adr/
+  reporting/
+  remediation/`,
+        documentationHint: 'docs/architecture/overview.md',
+        relatedAdrs: ['ADR-001'],
+    },
+    ARCH_PROFILE_NOT_FULLY_SUPPORTED: {
+        id: exports.ValidationRuleIds.ARCH_PROFILE_NOT_FULLY_SUPPORTED,
+        title: 'Implementation profile not fully supported',
+        category: 'architecture',
+        defaultSeverity: 'info',
+        description: 'Indicates that the selected implementation profile does not yet have dedicated rules and templates.',
+        recommendedFix: 'Consider using the typescript-backend profile until dedicated support for this profile is available.',
+    },
+    ARCH_OVERVIEW_ARTIFACT_EXISTS: {
+        id: exports.ValidationRuleIds.ARCH_OVERVIEW_ARTIFACT_EXISTS,
+        title: 'Architecture overview artifact exists',
+        category: 'architecture',
+        defaultSeverity: 'error',
+        description: 'Checks whether docs/architecture/overview.md exists as a baseline architecture artifact generated during initialization.',
+        recommendedFix: 'Restore or recreate docs/architecture/overview.md so the initialized architecture has an explicit overview artifact.',
+    },
+    ARCH_MODULE_BASELINE_COMPLETE: {
+        id: exports.ValidationRuleIds.ARCH_MODULE_BASELINE_COMPLETE,
+        title: 'Module baseline files exist',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Modules that expose public entrypoints or are depended on by other modules must provide an index.ts public entrypoint. Internal-only modules do not require index.ts.',
+        recommendedFix: 'Ensure each module has README.md. Add index.ts for modules with declared publicEntrypoints or inbound declared dependencies from other modules.',
+    },
+    ARCH_MODULE_REGISTRY_PATH_EXISTS: {
+        id: exports.ValidationRuleIds.ARCH_MODULE_REGISTRY_PATH_EXISTS,
+        title: 'Module registry path exists',
+        category: 'architecture',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether each module path declared in architecture.json exists as a directory in the repository.',
+        recommendedFix: 'Update the module registry path in .archpilot/architecture.json or restore the missing module directory.',
+        whyItMatters: 'This is a setup/configuration mismatch: architecture.json points at a module path that is not present in the workspace, so validation cannot reliably connect the intended architecture to the current code.',
+        howToFix: 'If the module should still exist, restore the directory or run setup refresh/bootstrap workflows that generate missing ArchPilot-managed setup artifacts. If the module was renamed or removed, update .archpilot/architecture.json so the registry reflects the current source tree.',
+        exampleFix: `{
+  "modules": {
+    "billing": {
+      "path": "src/modules/billing"
+    }
+  }
+}`,
+        documentationHint: '.archpilot/architecture.json modules entries and generated setup artifacts',
+    },
+    ARCH_MODULE_CONTRACT_FILE_EXISTS: {
+        id: exports.ValidationRuleIds.ARCH_MODULE_CONTRACT_FILE_EXISTS,
+        title: 'Module contract file exists',
+        category: 'architecture',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether each module contract file referenced by the module registry exists on disk.',
+        recommendedFix: 'Generate or restore the missing module contract file, or update the module registry contract path in .archpilot/architecture.json.',
+        whyItMatters: 'This is a setup/configuration mismatch: architecture.json references a module contract file that is missing, so ArchPilot cannot validate declared dependencies, public entrypoints, or module ownership for that module.',
+        howToFix: 'If the module is still part of the architecture, run setup refresh or generate module contracts to create the missing contract without overwriting user-owned files. If the reference is stale, fix the contract path or remove the stale module entry from .archpilot/architecture.json.',
+        exampleFix: `{
+  "module": "billing",
+  "dependsOn": [],
+  "publicEntrypoints": ["src/modules/billing/index.ts"]
+}`,
+        documentationHint: '.archpilot/architecture.json module contract paths and .archpilot/contracts/<module>.contract.json',
+    },
+    ARCH_MODULE_CONTRACT_IDENTITY_MATCHES_REGISTRY: {
+        id: exports.ValidationRuleIds.ARCH_MODULE_CONTRACT_IDENTITY_MATCHES_REGISTRY,
+        title: 'Module contract identity matches registry',
+        category: 'architecture',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether each module contract JSON is valid, has a matching module identity, and uses valid array field shapes for core contract fields.',
+        recommendedFix: 'Fix module contract JSON syntax and ensure contract.module plus contract array fields are valid and aligned with the module registry.',
+    },
+    ARCH_MODULE_PUBLIC_ENTRYPOINTS_ALIGNED: {
+        id: exports.ValidationRuleIds.ARCH_MODULE_PUBLIC_ENTRYPOINTS_ALIGNED,
+        title: 'Module public entrypoints are aligned',
+        category: 'architecture',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether module publicEntrypoints are consistent between architecture.json and each module contract file.',
+        recommendedFix: 'Align publicEntrypoints in .archpilot/architecture.json and the module contract file so both describe the same public surface.',
+    },
+    ARCH_RULE_CONFIGURATION_VALID: {
+        id: exports.ValidationRuleIds.ARCH_RULE_CONFIGURATION_VALID,
+        title: 'Project rule configuration file is valid',
+        category: 'architecture',
+        defaultSeverity: 'error',
+        description: 'Checks whether .archpilot/rules.json is valid JSON and uses a supported structure for runtime rule overrides.',
+        recommendedFix: 'Fix .archpilot/rules.json so it is valid JSON and follows the expected { "rules": { "<RULE_ID>": { "enabled": boolean, "severity": "error|warning|info" } } } format.',
+    },
+    ARCH_PROJECT_CONFIGURATION_VALID: {
+        id: exports.ValidationRuleIds.ARCH_PROJECT_CONFIGURATION_VALID,
+        title: 'Invalid ArchPilot project configuration JSON',
+        category: 'architecture',
+        defaultSeverity: 'error',
+        description: 'Checks whether .archpilot/config.json is valid JSON and uses supported project-level ArchPilot settings.',
+        recommendedFix: 'Fix .archpilot/config.json so it is valid JSON, policySource is a string when configured, Cloud display metadata values are strings when configured, and uploadOnValidate is a boolean when configured.',
+    },
+    ARCH_PROJECT_IDENTITY_CONFIGURATION_VALID: {
+        id: exports.ValidationRuleIds.ARCH_PROJECT_IDENTITY_CONFIGURATION_VALID,
+        title: 'Invalid ArchPilot project identity configuration',
+        category: 'architecture',
+        defaultSeverity: 'error',
+        description: 'Checks whether .archpilot/project.json is valid JSON and defines a non-empty repositoryId plus supported optional organization metadata fields.',
+        recommendedFix: 'Fix .archpilot/project.json so it is valid JSON, repositoryId is a non-empty string, and organizationId/team/system are strings when configured.',
+    },
+    API_OPENAPI_EXISTS: {
+        id: exports.ValidationRuleIds.API_OPENAPI_EXISTS,
+        title: 'OpenAPI contract exists',
+        category: 'api',
+        defaultSeverity: 'error',
+        description: 'Checks whether contracts/openapi.yaml exists for the configured API style.',
+        recommendedFix: 'Create a contracts/openapi.yaml file that describes your public API surface, or regenerate it using ArchPilot initialization.',
+    },
+    API_GRAPHQL_PATH_PRESENT: {
+        id: exports.ValidationRuleIds.API_GRAPHQL_PATH_PRESENT,
+        title: 'GraphQL endpoint documented in OpenAPI',
+        category: 'api',
+        defaultSeverity: 'error',
+        description: 'Checks whether the OpenAPI contract contains a /graphql path when the API style is GraphQL.',
+        recommendedFix: 'Add a /graphql path entry to contracts/openapi.yaml so the GraphQL endpoint is documented.',
+    },
+    API_MISSING_COLLECTION_PAGINATION: {
+        id: exports.ValidationRuleIds.API_MISSING_COLLECTION_PAGINATION,
+        title: 'Missing pagination on collection endpoint',
+        category: 'api',
+        defaultSeverity: 'warning',
+        description: 'Detects collection-style GET endpoints that appear to return lists without pagination evidence in source or OpenAPI.',
+        recommendedFix: 'Add page/limit/offset/cursor parameters, Pageable support, or another explicit bounded collection contract.',
+        whyItMatters: 'Unbounded collection endpoints can become reliability and data-exposure risks as datasets grow.',
+        howToFix: 'Expose pagination parameters at the API boundary and pass them to the service/repository query path.',
+        documentationHint: 'controller endpoints and OpenAPI parameters',
+    },
+    API_BULK_OPERATION_RISK: {
+        id: exports.ValidationRuleIds.API_BULK_OPERATION_RISK,
+        title: 'Bulk operation risk',
+        category: 'api',
+        defaultSeverity: 'warning',
+        description: 'Detects destructive bulk or batch API operations without visible guards, confirmation, batching, dry-run, audit, or async handoff evidence.',
+        recommendedFix: 'Add explicit authorization and safety controls such as dryRun, batchSize, confirmation, reason/audit, or queue/job handoff.',
+        whyItMatters: 'Bulk write endpoints can cause large blast-radius changes if they are exposed without clear operational safeguards.',
+        howToFix: 'Guard bulk endpoints, bound the operation size, require operator intent, and record or stage the action.',
+        documentationHint: 'bulk controller endpoints and API operation contracts',
+    },
+    API_DTO_ENTITY_LEAKAGE: {
+        id: exports.ValidationRuleIds.API_DTO_ENTITY_LEAKAGE,
+        title: 'DTO/entity leakage through API boundary',
+        category: 'api',
+        defaultSeverity: 'warning',
+        description: 'Detects controller endpoints that appear to return persistence/domain entities directly instead of API DTOs or response contracts.',
+        recommendedFix: 'Map persistence/domain entities to DTO, response, resource, or contract types before returning from API handlers.',
+        whyItMatters: 'Returning internal entities leaks persistence shape into public contracts and makes API evolution harder.',
+        howToFix: 'Introduce explicit response DTOs or serializers and keep repository/domain return values inside the application boundary.',
+        documentationHint: 'controller return types, DTOs, serializers, and response schemas',
+    },
+    API_INCONSISTENT_RESOURCE_DESIGN: {
+        id: exports.ValidationRuleIds.API_INCONSISTENT_RESOURCE_DESIGN,
+        title: 'Inconsistent resource design within API',
+        category: 'api',
+        defaultSeverity: 'warning',
+        description: 'Detects clear route-shape inconsistencies within the same controller/resource group after multiple examples appear.',
+        recommendedFix: 'Choose one resource route convention for the controller and keep action-style exceptions explicit and rare.',
+        whyItMatters: 'Inconsistent routes inside one resource make API contracts harder to discover and review.',
+        howToFix: 'Align related endpoints around one resource shape, such as /resources/{id}, and document intentional exceptions.',
+        documentationHint: 'controller routes and OpenAPI paths',
+    },
+    API_VERSIONING_STRATEGY_INCONSISTENCY: {
+        id: exports.ValidationRuleIds.API_VERSIONING_STRATEGY_INCONSISTENCY,
+        title: 'API versioning strategy inconsistency',
+        category: 'api',
+        defaultSeverity: 'warning',
+        description: 'Detects API surfaces that clearly mix versioned and unversioned route strategies in the same backend.',
+        recommendedFix: 'Use one versioning convention for public API routes or document a migration boundary for legacy routes.',
+        whyItMatters: 'Mixed versioning strategies create uncertainty about compatibility guarantees and contract ownership.',
+        howToFix: 'Standardize on path or controller-level versioning, or isolate legacy unversioned routes behind a clear boundary.',
+        documentationHint: 'controller base paths and API versioning ADRs',
+    },
+    API_CONTRACT_IMPLEMENTATION_DRIFT: {
+        id: exports.ValidationRuleIds.API_CONTRACT_IMPLEMENTATION_DRIFT,
+        title: 'Contract implementation drift',
+        category: 'api',
+        defaultSeverity: 'warning',
+        description: 'Compares discovered implementation endpoints with OpenAPI paths when a parseable contract is available.',
+        recommendedFix: 'Update the OpenAPI contract or implementation so method and path pairs describe the same public API surface.',
+        whyItMatters: 'Contract drift breaks API review, client generation, and integration expectations even when a contract file exists.',
+        howToFix: 'Add missing paths to the contract, remove stale contract paths, or align implementation route paths.',
+        documentationHint: 'contracts/openapi.yaml and controller endpoint routes',
+    },
+    DEP_CIRCULAR_MODULE_DEPENDENCY: {
+        id: exports.ValidationRuleIds.DEP_CIRCULAR_MODULE_DEPENDENCY,
+        title: 'Circular module dependency detected',
+        category: 'dependency',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks for circular dependencies between modules under src/modules based on detected cross-module imports.',
+        recommendedFix: 'Break circular dependencies between modules by introducing a shared abstraction, moving common code, or reversing the dependency direction.',
+    },
+    DEP_FORBIDDEN_CROSS_MODULE_DEPENDENCY: {
+        id: exports.ValidationRuleIds.DEP_FORBIDDEN_CROSS_MODULE_DEPENDENCY,
+        title: 'Forbidden cross-module dependency detected',
+        category: 'dependency',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether cross-module imports violate the allowedDependencies declared in .archpilot/dependency-rules.json.',
+        recommendedFix: 'Update .archpilot/dependency-rules.json or refactor the import so the module depends only on explicitly allowed modules.',
+    },
+    DEP_NON_PUBLIC_CROSS_MODULE_IMPORT: {
+        id: exports.ValidationRuleIds.DEP_NON_PUBLIC_CROSS_MODULE_IMPORT,
+        title: 'Non-public cross-module import detected',
+        category: 'dependency',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether cross-module imports target another module through its public entrypoints rather than internal implementation files.',
+        recommendedFix: 'Import through the target module or package public entrypoint declared in its contract rather than reaching into internal implementation files.',
+    },
+    DEP_CROSS_MODULE_DEPENDENCY_DECLARED_IN_CONTRACT: {
+        id: exports.ValidationRuleIds.DEP_CROSS_MODULE_DEPENDENCY_DECLARED_IN_CONTRACT,
+        title: 'Cross-module dependency missing from module contract',
+        category: 'dependency',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether each cross-module import is declared in the source module contract dependsOn list.',
+        recommendedFix: 'Add the imported module to source-module contract dependsOn or remove the cross-module dependency.',
+        explanation: 'Cross-module imports must be declared in module contracts to keep architectural dependencies explicit.',
+        whyItMatters: 'Undeclared dependencies introduce hidden coupling and make impact analysis and governance unreliable.',
+        howToFix: 'Update the source module contract dependsOn list to include the target module, or remove the import.',
+        exampleFix: `{
+  "module": "billing",
+  "dependsOn": ["inventory"]
+}`,
+        documentationHint: '.archpilot/contracts/<module>.contract.json',
+        relatedAdrs: ['ADR-003'],
+    },
+    DEP_CROSS_MODULE_IMPORT_USES_PUBLIC_SURFACE_ONLY: {
+        id: exports.ValidationRuleIds.DEP_CROSS_MODULE_IMPORT_USES_PUBLIC_SURFACE_ONLY,
+        title: 'Cross-module import bypasses public module surface',
+        category: 'dependency',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether cross-module imports resolve only through target module public entrypoints declared in module contracts.',
+        recommendedFix: 'Import only through target module public entrypoints declared in its module contract.',
+        explanation: 'Cross-module imports should use only public entrypoints exposed by the target module contract.',
+        whyItMatters: 'Importing internal files bypasses module boundaries and creates brittle coupling across teams and features.',
+        howToFix: 'Replace internal path imports with imports from public entrypoints declared by the target module.',
+        exampleFix: `import { findUser } from '../identity/public';`,
+        documentationHint: '.archpilot/contracts/<module>.contract.json publicEntrypoints',
+        relatedAdrs: ['ADR-003'],
+    },
+    DEP_DECLARED_MODULE_DEPENDENCY_NOT_USED: {
+        id: exports.ValidationRuleIds.DEP_DECLARED_MODULE_DEPENDENCY_NOT_USED,
+        title: 'Declared module dependency not used',
+        category: 'dependency',
+        defaultSeverity: 'warning',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether module contract dependsOn entries are actually used by cross-module imports from that module.',
+        recommendedFix: 'Remove unused modules from dependsOn or add a legitimate cross-module import that reflects the declared dependency.',
+        whyItMatters: 'The module contract declares an architectural dependency, but the current code does not use that dependency. That mismatch makes the contract less trustworthy for impact analysis, reviews, and dependency governance.',
+        howToFix: 'Choose the architecture decision explicitly: remove the unused dependsOn entry if the dependency is stale, add a real cross-module import through the target public surface if the dependency is intentional, or keep and document the future/temporary dependency with an approved exception.',
+        exampleFix: `// Option A: remove the stale dependency from the source module contract.
+{
+  "module": "billing",
+  "dependsOn": []
+}
+
+// Option B: if the dependency is intentional, use the target module in code.
+import { reserveInventory } from "../inventory";`,
+        documentationHint: '.archpilot/contracts/<module>.contract.json dependsOn and .archpilot/dependency-rules.json',
+    },
+    DEP_ISOLATED_MODULE_DETECTED: {
+        id: exports.ValidationRuleIds.DEP_ISOLATED_MODULE_DETECTED,
+        title: 'Potential orphan module detected',
+        category: 'dependency',
+        defaultSeverity: 'warning',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether a registered module has no peer-module dependencies and little evidence of intentional architectural use.',
+        recommendedFix: 'Add intentional-use evidence such as a contract, README, public entrypoint, package entrypoint, or remove the module if it is stale.',
+    },
+    DEP_TRANSITIVE_CIRCULAR_MODULE_DEPENDENCY: {
+        id: exports.ValidationRuleIds.DEP_TRANSITIVE_CIRCULAR_MODULE_DEPENDENCY,
+        title: 'Transitive circular module dependency detected',
+        category: 'dependency',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether declared and actual module dependencies form transitive dependency cycles with three or more modules.',
+        recommendedFix: 'Break the dependency chain so modules only depend on lower-level modules or shared services.',
+    },
+    DEP_MODULE_HIGH_INBOUND_DEPENDENCY_COUNT: {
+        id: exports.ValidationRuleIds.DEP_MODULE_HIGH_INBOUND_DEPENDENCY_COUNT,
+        title: 'Module has high inbound dependency count',
+        category: 'dependency',
+        defaultSeverity: 'warning',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether a module has a high inbound dependency count, which may indicate an overloaded shared module or god module risk.',
+        recommendedFix: 'Review whether this module is becoming a shared bottleneck or god module. Consider splitting responsibilities or introducing clearer boundaries.',
+    },
+    DEP_LAYER_DIRECTION_VIOLATION: {
+        id: exports.ValidationRuleIds.DEP_LAYER_DIRECTION_VIOLATION,
+        title: 'Dependency violates architecture layer direction',
+        category: 'dependency',
+        defaultSeverity: 'error',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Checks whether module dependencies violate configured architecture layer direction rules.',
+        recommendedFix: "Generate .archpilot/layer-rules.json through ArchPilot initialization or add the file manually. Then refactor dependencies so modules depend only on modules in lower layers.",
+    },
+    DEP_CROSS_COMPONENT_POLICY_VIOLATION: {
+        id: exports.ValidationRuleIds.DEP_CROSS_COMPONENT_POLICY_VIOLATION,
+        title: 'Cross-component dependency policy violation',
+        category: 'dependency',
+        defaultSeverity: 'error',
+        architectureScope: 'component',
+        description: 'Checks whether cross-component imports violate allowedDependencies declared on source components in architecture.json.',
+        recommendedFix: 'Update the source component allowedDependencies list in .archpilot/architecture.json or refactor the import so the component depends only on explicitly allowed components.',
+        whyItMatters: 'Component dependency policies make workspace boundaries explicit so applications, services, and libraries do not drift into hidden coupling.',
+        howToFix: 'Add the target component id to sourceComponent.allowedDependencies when the dependency is intentional, or move the shared code/API behind an allowed component boundary.',
+        documentationHint: '.archpilot/architecture.json',
+    },
+    ADR_DIRECTORY_EXISTS: {
+        id: exports.ValidationRuleIds.ADR_DIRECTORY_EXISTS,
+        title: 'ADR directory missing',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks whether docs/adrs/ exists so architecture decisions can be documented and enforced.',
+        recommendedFix: 'Create docs/adrs/ and add ADR markdown files such as adr-001-tenant-model.md.',
+    },
+    ADR_FILE_HAS_TITLE: {
+        id: exports.ValidationRuleIds.ADR_FILE_HAS_TITLE,
+        title: 'ADR file missing title',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks whether each ADR markdown file includes a top-level H1 title near the top of the file.',
+        recommendedFix: 'Add a top-level H1 title to the ADR file, for example `# ADR-001: Tenant model`.',
+    },
+    ADR_STATUS_VALID: {
+        id: exports.ValidationRuleIds.ADR_STATUS_VALID,
+        title: 'ADR status missing or invalid',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks whether each ADR file defines a supported status such as proposed, accepted, deprecated, or superseded.',
+        recommendedFix: 'Add `Status: Proposed`, `Status: Accepted`, `Status: Deprecated`, or `Status: Superseded` near the top of the ADR file.',
+    },
+    ADR_REQUIRED_COVERAGE_PRESENT: {
+        id: exports.ValidationRuleIds.ADR_REQUIRED_COVERAGE_PRESENT,
+        title: 'Required ADR missing for architecture context',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks whether ADR coverage exists for key repository architecture topics such as tenant model, API style, or dependency governance.',
+        recommendedFix: 'Add ADRs covering key architecture context, for example tenant model, API style, and dependency governance decisions.',
+    },
+    SUPPRESSION_REASON_PRESENT: {
+        id: exports.ValidationRuleIds.SUPPRESSION_REASON_PRESENT,
+        title: 'Suppression reason missing',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks whether each suppression entry explains why the exception is needed.',
+        recommendedFix: 'Add a concise reason to the suppression entry so the exception remains reviewable.',
+    },
+    SUPPRESSION_NOT_EXPIRED: {
+        id: exports.ValidationRuleIds.SUPPRESSION_NOT_EXPIRED,
+        title: 'Suppression expired',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks whether suppression entries have passed their expiresOn date.',
+        recommendedFix: 'Remove expired suppressions or update expiresOn only if the exception is still justified.',
+    },
+    SUPPRESSION_MATCHES_ACTIVE_FINDING: {
+        id: exports.ValidationRuleIds.SUPPRESSION_MATCHES_ACTIVE_FINDING,
+        title: 'Suppression does not match any active finding',
+        category: 'documentation',
+        defaultSeverity: 'info',
+        description: 'Checks whether suppression entries currently match any active validation finding.',
+        recommendedFix: 'Remove suppressions that no longer match active findings.',
+    },
+    SUPPRESSION_NOT_DUPLICATED: {
+        id: exports.ValidationRuleIds.SUPPRESSION_NOT_DUPLICATED,
+        title: 'Duplicate suppression entry',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks whether the same suppression rule and scope combination is configured more than once.',
+        recommendedFix: 'Keep a single suppression entry per rule and scope combination.',
+    },
+    SUPPRESSION_EXPIRY_FORMAT_VALID: {
+        id: exports.ValidationRuleIds.SUPPRESSION_EXPIRY_FORMAT_VALID,
+        title: 'Suppression expiry format invalid',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks whether suppression expiresOn values use YYYY-MM-DD format.',
+        recommendedFix: 'Set expiresOn using YYYY-MM-DD, for example 2026-06-30.',
+    },
+    DB_TENANT_SAME_SCHEMA_TENANT_ID: {
+        id: exports.ValidationRuleIds.DB_TENANT_SAME_SCHEMA_TENANT_ID,
+        title: 'Tenant discriminator column exists for same-schema model',
+        category: 'database',
+        defaultSeverity: 'error',
+        description: 'Checks that db/sql/001_init.sql contains a tenant_id column when using the same_db_same_schema tenant model.',
+        recommendedFix: 'Add a non-null tenant_id column to tenant-scoped tables in db/sql/001_init.sql to safely separate tenant data.',
+    },
+    DB_SQL_BASELINE_EXISTS: {
+        id: exports.ValidationRuleIds.DB_SQL_BASELINE_EXISTS,
+        title: 'SQL baseline artifact exists',
+        category: 'database',
+        defaultSeverity: 'error',
+        description: 'Checks whether db/sql/001_init.sql exists as the baseline database artifact generated during initialization.',
+        recommendedFix: 'Restore or recreate db/sql/001_init.sql so the initialized database baseline remains available for validation and team workflows.',
+    },
+    DQR_MISSING_TENANT_FILTER_EVIDENCE: {
+        id: exports.ValidationRuleIds.DQR_MISSING_TENANT_FILTER_EVIDENCE,
+        title: 'Missing tenant filter evidence in multi-tenant SQL',
+        category: 'database',
+        defaultSeverity: 'warning',
+        description: 'Detects SELECT/UPDATE/DELETE statements on tenant-scoped tables without tenant_id filter evidence when tenant model is same_db_same_schema.',
+        recommendedFix: 'Add deterministic tenant_id filter conditions to tenant-scoped queries and verify multi-tenant query boundaries.',
+        whyItMatters: 'Missing tenant filters in same-schema models can cause cross-tenant data exposure and governance risk.',
+        howToFix: 'Apply explicit tenant_id conditions in query WHERE clauses (or equivalent query constraints) for tenant-scoped tables.',
+        documentationHint: 'db/sql and module SQL query files for tenant-scoped tables',
+    },
+    DQR_BROAD_SELECT_STAR_USAGE: {
+        id: exports.ValidationRuleIds.DQR_BROAD_SELECT_STAR_USAGE,
+        title: 'Broad SELECT * usage in query path',
+        category: 'database',
+        defaultSeverity: 'warning',
+        description: 'Detects broad SELECT * query patterns in SQL files where explicit column selection is usually safer and more stable.',
+        recommendedFix: 'Replace SELECT * with explicit column lists for architecture-critical query paths.',
+        whyItMatters: 'SELECT * increases coupling to schema changes and can inflate data access blast radius.',
+        howToFix: 'List required columns explicitly and keep query projections aligned with module contracts and API needs.',
+        documentationHint: 'db/sql and module SQL query files',
+    },
+    DQR_UNBOUNDED_QUERY_WITHOUT_PAGINATION: {
+        id: exports.ValidationRuleIds.DQR_UNBOUNDED_QUERY_WITHOUT_PAGINATION,
+        title: 'Unbounded query risk without limit/pagination evidence',
+        category: 'database',
+        defaultSeverity: 'warning',
+        description: 'Detects list-oriented SELECT queries in SQL files without LIMIT/OFFSET/FETCH evidence when no obvious point lookup is present.',
+        recommendedFix: 'Add deterministic pagination/limit controls for list queries and keep query size bounded by design.',
+        whyItMatters: 'Unbounded list queries can create scalability and operational risk as data grows.',
+        howToFix: 'Use LIMIT/OFFSET/FETCH or equivalent bounded query patterns and avoid unrestricted list reads in critical paths.',
+        documentationHint: 'db/sql and module SQL query files',
+    },
+    DQR_CROSS_MODULE_DIRECT_DB_ACCESS: {
+        id: exports.ValidationRuleIds.DQR_CROSS_MODULE_DIRECT_DB_ACCESS,
+        title: 'Cross-module direct database access bypasses module boundary',
+        category: 'database',
+        defaultSeverity: 'warning',
+        architectureScope: 'module',
+        applicability: { requiresArchitectureModules: true },
+        description: 'Detects high-confidence references from one module to another module database artifact path (for example /<module>/db/ or /<module>/sql/).',
+        recommendedFix: 'Route cross-module data access through module contracts/public surfaces instead of direct database artifact references.',
+        whyItMatters: 'Direct cross-module DB access can bypass architecture boundaries and create hidden coupling.',
+        howToFix: 'Expose required data through target module public contracts/APIs and remove direct path-level DB artifact coupling.',
+        documentationHint: 'module source files referencing other module db/sql paths',
+    },
+    DQR_N_PLUS_ONE_QUERY_EVIDENCE: {
+        id: exports.ValidationRuleIds.DQR_N_PLUS_ONE_QUERY_EVIDENCE,
+        title: 'N+1 query evidence in collection loop',
+        category: 'database',
+        defaultSeverity: 'warning',
+        description: 'Detects high-confidence repository/database reads inside collection loops without visible batching evidence.',
+        recommendedFix: 'Batch the lookup with an IN query/DataLoader-style loader or prefetch related records before iterating.',
+        whyItMatters: 'N+1 query paths can turn one request into many database round trips as collection size grows.',
+        howToFix: 'Move database reads out of the loop and use batched query constraints, joins, includes, or a request-scoped loader.',
+        documentationHint: 'service and repository methods with collection loops',
+    },
+    DQR_LARGE_COLLECTION_LOADING: {
+        id: exports.ValidationRuleIds.DQR_LARGE_COLLECTION_LOADING,
+        title: 'Large collection loaded then processed in memory',
+        category: 'database',
+        defaultSeverity: 'warning',
+        description: 'Detects obvious unbounded collection reads followed by in-memory filtering, mapping, or reducing.',
+        recommendedFix: 'Push filters/projections into the query and add pagination or explicit limits before processing collections.',
+        whyItMatters: 'Loading large collections into memory can create latency, memory pressure, and unstable request behavior.',
+        howToFix: 'Add take/limit/page/cursor controls and move filter or projection logic into the database query when practical.',
+        documentationHint: 'service and repository methods with list reads',
+    },
+    DQR_MISSING_PROJECTION_SELECT: {
+        id: exports.ValidationRuleIds.DQR_MISSING_PROJECTION_SELECT,
+        title: 'Missing projection/select for partial entity use',
+        category: 'database',
+        defaultSeverity: 'warning',
+        description: 'Detects list reads of full entities where only a small number of fields are used afterward and no projection is present.',
+        recommendedFix: 'Add select/projection/fields to fetch only the fields needed by this flow.',
+        whyItMatters: 'Missing projections increase data transfer, couple callers to full entity shape, and can expose unnecessary fields.',
+        howToFix: 'Use Prisma select, repository projections, DTO queries, or equivalent field selection in the read path.',
+        documentationHint: 'service and repository methods with partial entity use',
+    },
+    DQR_REPEATED_QUERY_PATTERN: {
+        id: exports.ValidationRuleIds.DQR_REPEATED_QUERY_PATTERN,
+        title: 'Repeated query pattern in one request flow',
+        category: 'database',
+        defaultSeverity: 'warning',
+        description: 'Detects repeated identical or near-identical query calls in a single method/request flow.',
+        recommendedFix: 'Reuse the first query result or consolidate repeated reads into one batched query.',
+        whyItMatters: 'Repeated query calls add avoidable database load and can hide request-flow coupling.',
+        howToFix: 'Cache the result in the method scope, batch related reads, or refactor duplicate query paths into one repository call.',
+        documentationHint: 'service and repository methods with repeated reads',
+    },
+    EVT_PUBLISHED_EVENT_HAS_NO_HANDLER: {
+        id: exports.ValidationRuleIds.EVT_PUBLISHED_EVENT_HAS_NO_HANDLER,
+        title: 'Published event has no handler',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects statically visible events that are emitted/published but have no matching listener/handler in the workspace.',
+        recommendedFix: 'Add a handler/listener for the event or remove/rename the publish call if it is stale.',
+        whyItMatters: 'Unhandled events create dead architecture paths and make async workflows look reliable when no consumer exists.',
+        howToFix: 'Register an OnEvent/EventListener/EventPattern handler with the same event name or class.',
+        documentationHint: 'event publishers and handlers',
+    },
+    EVT_CIRCULAR_EVENT_CHAIN_RISK: {
+        id: exports.ValidationRuleIds.EVT_CIRCULAR_EVENT_CHAIN_RISK,
+        title: 'Circular event chain risk',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects clear two-event static cycles where a handler for one event publishes another whose handler publishes the first.',
+        recommendedFix: 'Break the cycle with a coordinator, idempotent state transition, or explicit workflow boundary.',
+        whyItMatters: 'Circular event chains can produce duplicate processing, retries, or unstable async workflows.',
+        howToFix: 'Replace cyclic event reactions with one orchestrated workflow step or add explicit terminal conditions.',
+        documentationHint: 'event handler publish chains',
+    },
+    EVT_SYNCHRONOUS_DEPENDENCY_DISGUISED_AS_EVENT: {
+        id: exports.ValidationRuleIds.EVT_SYNCHRONOUS_DEPENDENCY_DISGUISED_AS_EVENT,
+        title: 'Synchronous dependency disguised as event',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects event publish/emit calls that are awaited, assigned, or returned like request/response dependencies.',
+        recommendedFix: 'Use a direct service/API call for request-response behavior or make the event fire-and-forget with explicit follow-up handling.',
+        whyItMatters: 'Request-response behavior hidden behind events obscures coupling and weakens async architecture boundaries.',
+        howToFix: 'Choose either an explicit synchronous dependency or a true async handoff with durable event semantics.',
+        documentationHint: 'event bus publish/emit call sites',
+    },
+    EVT_EVENT_NAMING_INCONSISTENCY: {
+        id: exports.ValidationRuleIds.EVT_EVENT_NAMING_INCONSISTENCY,
+        title: 'Event naming inconsistency',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects repeated mixed event naming styles for the same event surface.',
+        recommendedFix: 'Normalize event names to one convention such as user.created or UserCreatedEvent.',
+        whyItMatters: 'Mixed event names make async workflows harder to trace and increase handler mismatch risk.',
+        howToFix: 'Rename publishers and handlers to a single convention and keep aliases out of production event surfaces.',
+        documentationHint: 'event names/classes',
+    },
+    APP_CONTROLLER_BUSINESS_LOGIC: {
+        id: exports.ValidationRuleIds.APP_CONTROLLER_BUSINESS_LOGIC,
+        title: 'Controller contains business logic',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects high-confidence controller files that contain persistence or business workflow logic instead of delegating to an application service.',
+        recommendedFix: 'Move orchestration and persistence access out of the controller and into an application service.',
+        whyItMatters: 'Controllers should adapt transport concerns to application use cases. Business logic in controllers makes APIs harder to test, reuse, and govern.',
+        howToFix: 'Keep request/response mapping in the controller, call a service method, and move repository/database access behind that service boundary.',
+        documentationHint: 'controller and service source files',
+    },
+    APP_REPOSITORY_BUSINESS_LOGIC: {
+        id: exports.ValidationRuleIds.APP_REPOSITORY_BUSINESS_LOGIC,
+        title: 'Repository contains business logic',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects repository files that appear to contain workflow, integration, or application-service responsibilities.',
+        recommendedFix: 'Keep repositories focused on persistence and move workflow/integration behavior into services.',
+        whyItMatters: 'Repositories should isolate data access. Workflow or integration logic in repositories hides application behavior inside persistence code.',
+        howToFix: 'Move cross-service calls, event publishing, queues, mailers, and HTTP integrations into an application service that uses the repository.',
+        documentationHint: 'repository and service source files',
+    },
+    APP_SERVICE_BYPASSES_REPOSITORY: {
+        id: exports.ValidationRuleIds.APP_SERVICE_BYPASSES_REPOSITORY,
+        title: 'Service bypasses repository layer',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects service files that directly access database primitives when a repository/persistence layer is present or strongly implied.',
+        recommendedFix: 'Route service persistence operations through repositories or explicit persistence adapters.',
+        whyItMatters: 'Direct database access from services can bypass persistence boundaries and spread schema coupling across application logic.',
+        howToFix: 'Move direct SQL/ORM client usage into a repository or persistence adapter and inject that abstraction into the service.',
+        documentationHint: 'service and repository source files',
+    },
+    APP_PACKAGE_RESPONSIBILITY_MISMATCH: {
+        id: exports.ValidationRuleIds.APP_PACKAGE_RESPONSIBILITY_MISMATCH,
+        title: 'Package responsibility mismatch',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects files whose declared controller/service/repository responsibility conflicts with their package or folder role.',
+        recommendedFix: 'Move the file to the matching package or rename/refactor the class so package responsibility stays clear.',
+        whyItMatters: 'Package names are architecture signals. Mismatched roles make the codebase harder to navigate and weaken automated boundary checks.',
+        howToFix: 'Place controllers under controller packages, services under service packages, and repositories under repository or persistence packages.',
+        documentationHint: 'controller, service, and repository package layout',
+    },
+    APP_SERVICE_GOD_CLASS: {
+        id: exports.ValidationRuleIds.APP_SERVICE_GOD_CLASS,
+        title: 'Service has oversized responsibility',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects very large or highly coupled service classes that likely combine multiple application responsibilities.',
+        recommendedFix: 'Split the service by use case or cohesive responsibility and move secondary concerns behind smaller collaborators.',
+        whyItMatters: 'Oversized services concentrate change risk and often become informal architecture boundaries that are difficult to govern.',
+        howToFix: 'Extract focused use-case services, keep dependencies cohesive, and leave shared infrastructure behind explicit adapters.',
+        documentationHint: 'service source files',
+    },
+    AUTH_MISSING_AUTHORIZATION_ENFORCEMENT: {
+        id: exports.ValidationRuleIds.AUTH_MISSING_AUTHORIZATION_ENFORCEMENT,
+        title: 'Missing authorization enforcement',
+        category: 'security',
+        defaultSeverity: 'warning',
+        description: 'Detects protected-looking endpoints that lack authorization evidence while nearby peer endpoints clearly use authorization.',
+        recommendedFix: 'Add the same guard, role, permission, or public-marker convention used by peer endpoints in the controller or resource.',
+        whyItMatters: 'Inconsistent authorization at endpoint boundaries can leave sensitive operations exposed while similar operations are protected.',
+        howToFix: 'Apply the appropriate guard/decorator or explicitly mark the endpoint public when that is intentional.',
+        documentationHint: 'controller/resource authorization decorators and security configuration',
+    },
+    AUTH_INCONSISTENT_AUTHORIZATION: {
+        id: exports.ValidationRuleIds.AUTH_INCONSISTENT_AUTHORIZATION,
+        title: 'Inconsistent authorization within resource',
+        category: 'security',
+        defaultSeverity: 'warning',
+        description: 'Detects endpoints in the same controller/resource with weaker authorization evidence than protected peers.',
+        recommendedFix: 'Align role or permission requirements across similar protected operations, or document and mark intentional public access.',
+        whyItMatters: 'Authorization drift within the same resource is difficult to notice in review and can create uneven access control.',
+        howToFix: 'Use consistent roles, permissions, guards, or explicit public annotations across related endpoint methods.',
+        documentationHint: 'controller/resource authorization decorators and security configuration',
+    },
+    AUTH_AUTHORIZATION_IN_WRONG_LAYER: {
+        id: exports.ValidationRuleIds.AUTH_AUTHORIZATION_IN_WRONG_LAYER,
+        title: 'Authorization logic placed in wrong layer',
+        category: 'security',
+        defaultSeverity: 'warning',
+        description: 'Detects role or permission authorization decisions inside repository or data-access classes.',
+        recommendedFix: 'Move role/permission authorization decisions to controller guards, middleware, policies, or application services.',
+        whyItMatters: 'Authorization buried in persistence code is harder to audit and can scatter access decisions across data paths.',
+        howToFix: 'Keep repositories focused on data access and enforce authorization through a consistent application/security boundary.',
+        documentationHint: 'repositories, services, guards, and security policies',
+    },
+    TEN_MISSING_TENANT_CONTEXT_PROPAGATION: {
+        id: exports.ValidationRuleIds.TEN_MISSING_TENANT_CONTEXT_PROPAGATION,
+        title: 'Missing tenant context propagation',
+        category: 'security',
+        defaultSeverity: 'warning',
+        description: 'Detects service methods that use tenant context but call repository operations without passing tenant or organization scope.',
+        recommendedFix: 'Pass tenant/organization scope through service and repository boundaries consistently.',
+        whyItMatters: 'Lost tenant context can cause lower layers to query or mutate data without the isolation scope required by the architecture.',
+        howToFix: 'Derive tenant context once at the boundary, pass it to services and repositories, and include it in query predicates.',
+        documentationHint: 'tenant context providers, services, and repository calls',
+    },
+    TEN_MISSING_TENANT_ENFORCEMENT: {
+        id: exports.ValidationRuleIds.TEN_MISSING_TENANT_ENFORCEMENT,
+        title: 'Missing tenant enforcement on data access',
+        category: 'security',
+        defaultSeverity: 'warning',
+        description: 'Detects ORM/query operations in tenant-scoped repositories without tenant or organization predicate evidence.',
+        recommendedFix: 'Add tenant/organization predicates to tenant-scoped repository queries and mutations.',
+        whyItMatters: 'Same-schema tenant isolation depends on every tenant-scoped data access path applying the tenant discriminator.',
+        howToFix: 'Include tenantId, organizationId, orgId, workspaceId, or equivalent scope in repository where clauses and query builders.',
+        documentationHint: 'tenant-scoped repository query methods',
+    },
+    TEN_CROSS_TENANT_ACCESS_RISK: {
+        id: exports.ValidationRuleIds.TEN_CROSS_TENANT_ACCESS_RISK,
+        title: 'Cross-tenant access risk',
+        category: 'security',
+        defaultSeverity: 'warning',
+        description: 'Detects destructive tenant-scoped data operations that appear to be scoped only by entity id.',
+        recommendedFix: 'Scope destructive tenant operations by tenant/organization as well as entity id, or isolate global/admin paths clearly.',
+        whyItMatters: 'Update/delete-by-id without tenant scope can mutate data across tenant boundaries when identifiers collide or leak.',
+        howToFix: 'Add tenant/org predicates to write operations or route explicit global/admin operations through guarded paths.',
+        documentationHint: 'tenant-scoped repository mutation methods',
+    },
+    TEN_TENANT_MODEL_UNDOCUMENTED: {
+        id: exports.ValidationRuleIds.TEN_TENANT_MODEL_UNDOCUMENTED,
+        title: 'Tenant isolation model undocumented or inconsistent',
+        category: 'security',
+        defaultSeverity: 'info',
+        description: 'Reports a single guidance finding when configured tenancy and scanned source tenant evidence appear inconsistent.',
+        recommendedFix: 'Document the tenant isolation model and ensure code paths show consistent tenant resolver or predicate evidence.',
+        whyItMatters: 'Tenant isolation is architecture-critical and should be visible in both configuration and implementation conventions.',
+        howToFix: 'Update architecture configuration/docs or add consistent tenant context and query-scope patterns in implementation code.',
+        documentationHint: '.archpilot/architecture.json and tenant context/query conventions',
+    },
+    TXN_TRANSACTION_BOUNDARY_TOO_BROAD: {
+        id: exports.ValidationRuleIds.TXN_TRANSACTION_BOUNDARY_TOO_BROAD,
+        title: 'Transaction boundary too broad',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects high-confidence transaction scopes that coordinate many aggregate or repository collaborators.',
+        recommendedFix: 'Narrow the transaction to one cohesive aggregate operation or split orchestration from persistence changes.',
+        whyItMatters: 'Broad transaction scopes increase lock time, failure coupling, and ambiguity about which domain boundary owns the change.',
+        howToFix: 'Keep transaction ownership in an application service and limit the scope to the repositories needed for one cohesive use case.',
+        documentationHint: 'transactional service methods and repository collaborators',
+    },
+    TXN_TRANSACTION_STARTED_IN_CONTROLLER: {
+        id: exports.ValidationRuleIds.TXN_TRANSACTION_STARTED_IN_CONTROLLER,
+        title: 'Transaction started in controller/API layer',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects controller or endpoint methods that appear to own transaction lifecycle or transactional annotations.',
+        recommendedFix: 'Move transaction boundaries from controllers into application service methods.',
+        whyItMatters: 'Controllers should adapt transport concerns; owning transactions there mixes API handling with application consistency rules.',
+        howToFix: 'Let the controller call a service use case and place @Transactional, transaction manager, or ORM transaction usage there.',
+        documentationHint: 'controllers and service transaction boundaries',
+    },
+    TXN_NESTED_TRANSACTION_RISK: {
+        id: exports.ValidationRuleIds.TXN_NESTED_TRANSACTION_RISK,
+        title: 'Nested transaction risk',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects strong evidence that one transaction scope starts or calls another transaction scope.',
+        recommendedFix: 'Flatten nested transaction ownership or make propagation semantics explicit and intentional.',
+        whyItMatters: 'Nested transaction behavior is framework-specific and can produce surprising commits, rollbacks, or lock behavior.',
+        howToFix: 'Use one outer service transaction for the use case or document explicit propagation such as REQUIRES_NEW.',
+        documentationHint: 'transactional service methods and transaction propagation settings',
+    },
+    TXN_LONG_RUNNING_WORKFLOW_INSIDE_TRANSACTION: {
+        id: exports.ValidationRuleIds.TXN_LONG_RUNNING_WORKFLOW_INSIDE_TRANSACTION,
+        title: 'Long-running workflow inside transaction',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects transaction scopes that include external I/O, queues, messaging, email, uploads, sleeps, or retries.',
+        recommendedFix: 'Move external I/O outside the database transaction and publish after commit when possible.',
+        whyItMatters: 'Long-running work inside a transaction can hold locks while waiting on systems the database cannot control.',
+        howToFix: 'Persist the state change in the transaction, then dispatch messages or call external systems after commit or through an outbox.',
+        documentationHint: 'transactional methods, messaging, email, queue, and HTTP integration calls',
+    },
+    DOM_ANEMIC_DOMAIN_MODEL: {
+        id: exports.ValidationRuleIds.DOM_ANEMIC_DOMAIN_MODEL,
+        title: 'Anemic domain model',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects meaningful domain/entity models that are mostly state while business decisions appear in services.',
+        recommendedFix: 'Move cohesive domain decisions and invariants onto aggregate/domain methods where appropriate.',
+        whyItMatters: 'When domain models only hold data, business rules scatter into services and become harder to keep consistent.',
+        howToFix: 'Keep DTOs as data carriers, but give domain entities or aggregates methods for invariants, transitions, and decisions.',
+        documentationHint: 'domain entities, aggregates, and application services',
+    },
+    DOM_AGGREGATE_BOUNDARY_VIOLATION: {
+        id: exports.ValidationRuleIds.DOM_AGGREGATE_BOUNDARY_VIOLATION,
+        title: 'Aggregate boundary violation',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects service methods that appear to reach directly into another aggregate or module repository.',
+        recommendedFix: 'Coordinate across aggregates through an application service, published contract, or explicit domain service.',
+        whyItMatters: 'Directly manipulating another aggregate bypasses ownership boundaries and can create hidden coupling between domains.',
+        howToFix: 'Route cross-aggregate work through a clear boundary, or move the use case to the module that owns the aggregate.',
+        documentationHint: 'module contracts, aggregate repositories, and domain services',
+    },
+    DOM_OVERSIZED_AGGREGATE_OR_SERVICE_BOUNDARY: {
+        id: exports.ValidationRuleIds.DOM_OVERSIZED_AGGREGATE_OR_SERVICE_BOUNDARY,
+        title: 'Oversized aggregate/service boundary',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects services with enough aggregate collaborators or operations to suggest unclear domain ownership.',
+        recommendedFix: 'Split oversized domain/application services by aggregate ownership or cohesive use case.',
+        whyItMatters: 'Oversized domain boundaries hide multiple responsibilities behind one service and make change ownership unclear.',
+        howToFix: 'Extract smaller services around cohesive aggregate operations and move unrelated collaborators behind explicit boundaries.',
+        documentationHint: 'domain services, application services, and aggregate repositories',
+    },
+    DOM_DOMAIN_LOGIC_SCATTERED_ACROSS_LAYERS: {
+        id: exports.ValidationRuleIds.DOM_DOMAIN_LOGIC_SCATTERED_ACROSS_LAYERS,
+        title: 'Domain logic scattered across layers',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects business decision evidence in controllers or repositories instead of a domain/application boundary.',
+        recommendedFix: 'Move business decisions into application services, domain services, or aggregate methods.',
+        whyItMatters: 'Business rules in transport or persistence layers are harder to reuse, test, and govern consistently.',
+        howToFix: 'Keep controllers focused on request mapping and repositories focused on persistence; place rules in the domain/application layer.',
+        documentationHint: 'controllers, repositories, services, and domain model classes',
+    },
+    DOM_CROSS_AGGREGATE_MODIFICATION_RISK: {
+        id: exports.ValidationRuleIds.DOM_CROSS_AGGREGATE_MODIFICATION_RISK,
+        title: 'Cross-aggregate modification risk',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Detects transaction scopes that mutate multiple aggregate or repository roots.',
+        recommendedFix: 'Keep one transaction focused on one aggregate boundary, or make cross-aggregate orchestration explicit.',
+        whyItMatters: 'Mutating unrelated aggregates in one transaction can blur ownership and make failure handling difficult.',
+        howToFix: 'Separate unrelated aggregate updates, use domain events/outbox patterns, or document an intentional aggregate-spanning use case.',
+        documentationHint: 'transactional service methods and aggregate repositories',
+    },
+    DOC_TENANT_DIFFERENT_SCHEMA_ADR: {
+        id: exports.ValidationRuleIds.DOC_TENANT_DIFFERENT_SCHEMA_ADR,
+        title: 'Tenant model ADR exists for different-schema model',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks that an ADR describing the tenant model decision exists when using the same_db_different_schema model.',
+        recommendedFix: 'Create docs/adrs/adr-001-tenant-model.md documenting why different schemas per tenant were chosen and their implications.',
+        relatedAdrs: ['ADR-001'],
+    },
+    DOC_RBAC_MENTIONED_IN_OVERVIEW: {
+        id: exports.ValidationRuleIds.DOC_RBAC_MENTIONED_IN_OVERVIEW,
+        title: 'RBAC or role-based access control mentioned in overview',
+        category: 'documentation',
+        defaultSeverity: 'warning',
+        description: 'Checks that the architecture overview mentions RBAC or role-based access control when RBAC is enabled.',
+        recommendedFix: 'Update docs/architecture/overview.md to describe how RBAC is implemented and enforced across the system.',
+    },
+    SAFE_MISSING_ADR_COVERAGE: {
+        id: exports.ValidationRuleIds.SAFE_MISSING_ADR_COVERAGE,
+        title: 'Missing ADR coverage for risky architecture change',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Derived governance signal indicating ADR coverage is required but not satisfied for a risky architecture change context.',
+        recommendedFix: 'Create or update the required ADR and ensure ADR requirement checks are satisfied in the current run.',
+        whyItMatters: 'Risky architecture changes should be documented with ADR coverage to keep decisions and tradeoffs auditable.',
+        howToFix: 'Use the suggested ADR command from review output, then re-run `archpilot validate`.',
+    },
+    SAFE_MISSING_ROLLBACK_PLAN: {
+        id: exports.ValidationRuleIds.SAFE_MISSING_ROLLBACK_PLAN,
+        title: 'Missing rollback plan for risky architecture change',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Derived governance signal indicating rollback evidence is missing in a risky architecture change context.',
+        recommendedFix: 'Create .archpilot/rollout/rollback-plan.md with rollback trigger, steps, owner, and validation checks.',
+        whyItMatters: 'Rollback planning reduces governance and operational risk when architecture changes need controlled reversal.',
+        howToFix: 'Run `archpilot safety init` or create the rollback plan artifact manually, then re-run validation.',
+    },
+    SAFE_MISSING_FEATURE_FLAG_EVIDENCE: {
+        id: exports.ValidationRuleIds.SAFE_MISSING_FEATURE_FLAG_EVIDENCE,
+        title: 'Missing feature-flag or staged rollout evidence for risky architecture change',
+        category: 'architecture',
+        defaultSeverity: 'warning',
+        description: 'Derived governance signal indicating feature flag or staged rollout evidence is missing or invalid in a risky architecture change context.',
+        recommendedFix: 'Create .archpilot/rollout/feature-flags.json with enabled=true or non-empty flags[] entries.',
+        whyItMatters: 'Staged rollout controls help reduce blast radius while introducing higher-risk architecture changes.',
+        howToFix: 'Run `archpilot safety init` or fix the rollout config file, then re-run validation.',
+    },
+};
+function getValidationRuleMetadataById(id) {
+    for (const key of Object.keys(exports.ValidationRuleCatalog)) {
+        const meta = exports.ValidationRuleCatalog[key];
+        if (meta.id === id) {
+            return meta;
+        }
+    }
+    // Fallback metadata for unknown rule IDs to keep reporting robust.
+    return {
+        id,
+        title: 'Unknown rule',
+        category: 'documentation',
+        defaultSeverity: 'info',
+        description: 'This rule is not registered in the catalog. It may be new or incorrectly configured.',
+        recommendedFix: 'Review the project structure and rule implementation to understand and address this rule.',
+    };
+}
+function getAllValidationRuleMetadata() {
+    return Object.keys(exports.ValidationRuleCatalog)
+        .map((key) => exports.ValidationRuleCatalog[key])
+        .sort((a, b) => a.id.localeCompare(b.id));
+}
+function getConfiguredArchitectureModuleIds(contract) {
+    const moduleIds = new Set(Object.keys(contract.modules ?? {}));
+    const components = contract.components;
+    if (components && typeof components === 'object') {
+        const entries = Array.isArray(components)
+            ? components.map((component, index) => [component.id ?? `component-${index + 1}`, component])
+            : Object.entries(components);
+        for (const [componentId, component] of entries) {
+            if (!component || typeof component !== 'object' || Array.isArray(component)) {
+                continue;
+            }
+            for (const moduleId of Object.keys(component.modules ?? {})) {
+                moduleIds.add(moduleId.includes('/') ? moduleId : `${componentId}/${moduleId}`);
+            }
+        }
+    }
+    return [...moduleIds].sort((left, right) => left.localeCompare(right));
+}
+function hasConfiguredArchitectureModules(contract) {
+    return getConfiguredArchitectureModuleIds(contract).length > 0;
+}
+function buildNotApplicableRuleResults(contract, validationConfig) {
+    const hasModules = hasConfiguredArchitectureModules(contract);
+    return getAllValidationRuleMetadata()
+        .filter((meta) => meta.applicability?.requiresArchitectureModules === true)
+        .filter((meta) => !isRuleDisabled(meta.id, validationConfig))
+        .filter(() => !hasModules)
+        .map((meta) => ({
+        id: meta.id,
+        severity: meta.defaultSeverity,
+        passed: true,
+        applicability: 'not-applicable',
+        applicabilityReason: 'No architecture modules are configured at the project root or under components.',
+        message: `${meta.title} is not applicable because this architecture has no configured modules.`,
+    }));
+}
+function applyRuleApplicability(results, contract, validationConfig, hasArchitectureModulesOverride) {
+    if (hasArchitectureModulesOverride ?? hasConfiguredArchitectureModules(contract)) {
+        return results.map((result) => ({
+            ...result,
+            applicability: result.applicability ?? 'applicable',
+        }));
+    }
+    const moduleRequiredRuleIds = new Set(getAllValidationRuleMetadata()
+        .filter((meta) => meta.applicability?.requiresArchitectureModules === true)
+        .map((meta) => meta.id));
+    return [
+        ...results
+            .filter((result) => !moduleRequiredRuleIds.has(result.id))
+            .map((result) => ({
+            ...result,
+            applicability: result.applicability ?? 'applicable',
+        })),
+        ...buildNotApplicableRuleResults(contract, validationConfig),
+    ];
+}
+function formatValidationRuleLabel(id) {
+    const meta = getValidationRuleMetadataById(id);
+    return `[${meta.id}] ${meta.title}`;
+}
+function isEnforcementRuleCategory(category) {
+    return (category === 'architecture' ||
+        category === 'api' ||
+        category === 'dependency' ||
+        category === 'database');
+}
+function getValidationSeverityPolicyNote() {
+    return 'ArchPilot uses enforcement-oriented severities by default: core architecture, API, dependency, and database safety violations are treated as errors; documentation gaps are warnings; advisory compatibility notices are informational.';
+}
+function getSeveritySortOrder(severity) {
+    switch (severity) {
+        case 'error':
+            return 1;
+        case 'warning':
+            return 2;
+        case 'info':
+            return 3;
+        default:
+            return 99;
+    }
+}
+function getValidationOverallStatus(summary) {
+    if (summary.errors > 0) {
+        return 'fail';
+    }
+    if (summary.warnings > 0) {
+        return 'warn';
+    }
+    return 'pass';
+}
+function isHeuristicArchitectureSmellRuleId(ruleId) {
+    return /^AP-(?:APP|DOM|TXN)-/u.test(ruleId);
+}
+function buildArchitectureSmellSummaryFromResults(results) {
+    const failedSmells = results.filter((result) => result.applicability !== 'not-applicable' &&
+        !result.passed &&
+        isHeuristicArchitectureSmellRuleId(result.id));
+    const familyEntries = ['AP-APP', 'AP-DOM', 'AP-TXN']
+        .map((family) => {
+        const familyResults = failedSmells.filter((result) => result.id.startsWith(family));
+        const ruleCounts = [...familyResults.reduce((acc, result) => {
+                acc.set(result.id, (acc.get(result.id) ?? 0) + 1);
+                return acc;
+            }, new Map()).entries()]
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([ruleId, count]) => ({ ruleId, count }));
+        return {
+            family,
+            count: familyResults.length,
+            rules: ruleCounts,
+        };
+    })
+        .filter((entry) => entry.count > 0);
+    return {
+        count: failedSmells.length,
+        ruleFamilies: familyEntries,
+        explanation: 'AP-APP/AP-DOM/AP-TXN findings are heuristic architecture review signals; they are not deterministic compile, security, or database failures.',
+    };
+}
+function buildFindingCountContext(results) {
+    const failedResults = results.filter((result) => result.applicability !== 'not-applicable' && !result.passed);
+    const normalizedKeys = new Set();
+    for (const result of failedResults) {
+        normalizedKeys.add(classifyValidationResult(result).deductionKey);
+    }
+    return {
+        rawFindingCount: failedResults.length,
+        normalizedFindingCount: normalizedKeys.size,
+        duplicateReductionCount: Math.max(0, failedResults.length - normalizedKeys.size),
+    };
+}
+function buildScoreExplanationSummary(results, score) {
+    const problemSummary = (0, architectureHealthScore_1.summarizeArchitectureScoreProblems)({
+        results: results.map((result) => {
+            const classification = classifyValidationResult(result);
+            return {
+                ruleId: result.id,
+                category: getValidationRuleMetadataById(result.id).category,
+                severity: result.severity,
+                passed: result.passed,
+                applicability: result.applicability,
+                impact: classification.scoreImpact,
+                deductionKey: classification.deductionKey,
+            };
+        }),
+    });
+    const categoryEntries = Object.entries(score.categoryScores)
+        .sort((left, right) => left[1] - right[1] || left[0].localeCompare(right[0]))
+        .slice(0, 3)
+        .map(([category, categoryScore]) => ({ category, score: categoryScore }));
+    const applicableCategoryScores = score.applicableCategories
+        .map((category) => ({
+        category,
+        score: score.categoryScores[category] ?? 100,
+        weight: architectureHealthScore_1.architectureHealthCategoryWeights[category] ?? 0,
+    }))
+        .sort((left, right) => left.category.localeCompare(right.category));
+    const applicableResults = results.filter((result) => result.applicability !== 'not-applicable');
+    const heuristicWarnings = applicableResults.filter((result) => !result.passed &&
+        result.severity === 'warning' &&
+        isHeuristicArchitectureSmellRuleId(result.id)).length;
+    const dependencyWarnings = applicableResults.filter((result) => !result.passed && result.severity === 'warning' && result.id.startsWith('AP-DEP-')).length;
+    const databaseWarnings = applicableResults.filter((result) => !result.passed && result.severity === 'warning' && getValidationRuleMetadataById(result.id).category === 'database').length;
+    const documentationWarnings = applicableResults.filter((result) => !result.passed && result.severity === 'warning' && getValidationRuleMetadataById(result.id).category === 'documentation').length;
+    const blockingDependencyErrors = problemSummary.clusters.filter((cluster) => cluster.severity === 'error' &&
+        cluster.ruleIds.some((ruleId) => ruleId === 'AP-DEP-001' || ruleId === 'AP-DEP-008')).length;
+    const whyScoreChanged = score.errors > 0
+        ? 'Error-level findings carry the highest score impact, but repeated root-cause clusters are normalized before scoring.'
+        : heuristicWarnings > 0 && dependencyWarnings > 0
+            ? 'The score reflects normalized warning clusters: capped architecture-review signals plus remaining dependency governance warnings.'
+            : heuristicWarnings > 0
+                ? 'The score reflects capped cumulative impact from heuristic architecture-smell warning clusters.'
+                : dependencyWarnings > 0
+                    ? 'The score reflects dependency governance warning clusters after repeated-surface normalization.'
+                    : score.warnings > 0
+                        ? 'The score reflects warning-level findings with volume normalization and diminishing returns for repeated problem families.'
+                        : 'No active findings reduced the score.';
+    const largestScoreContributors = [];
+    if (blockingDependencyErrors > 0) {
+        largestScoreContributors.push(`Circular dependency / blocking dependency problems remain high-impact, but related findings are grouped into ${blockingDependencyErrors} blocking cluster${blockingDependencyErrors === 1 ? '' : 's'}.`);
+    }
+    if (databaseWarnings > 0) {
+        largestScoreContributors.push(`Database/query risk volume is a major contributor (${databaseWarnings} warning${databaseWarnings === 1 ? '' : 's'} across ${problemSummary.clusters.filter((cluster) => cluster.category === 'database').length} score cluster${problemSummary.clusters.filter((cluster) => cluster.category === 'database').length === 1 ? '' : 's'}; database score ${score.categoryScores.database ?? 100}/100).`);
+    }
+    if (documentationWarnings > 0) {
+        largestScoreContributors.push(`Documentation gaps contributed ${documentationWarnings} warning${documentationWarnings === 1 ? '' : 's'} to the documentation category.`);
+    }
+    if (heuristicWarnings > 0) {
+        largestScoreContributors.push(`Heuristic AP-APP/AP-DOM/AP-TXN findings are capped and did not dominate the score (${heuristicWarnings} warning${heuristicWarnings === 1 ? '' : 's'} across ${problemSummary.heuristicClusterCount} heuristic cluster${problemSummary.heuristicClusterCount === 1 ? '' : 's'}).`);
+    }
+    if (score.warnings > 1) {
+        largestScoreContributors.push(`Fixing one warning may not visibly move the rounded score; grouped fixes that clear repeated problem clusters (${problemSummary.qualityClusterCount} quality cluster${problemSummary.qualityClusterCount === 1 ? '' : 's'}) usually move it more.`);
+    }
+    return {
+        errors: score.errors,
+        warnings: score.warnings,
+        heuristicWarnings,
+        weightedBaseScore: score.weightedBaseScore,
+        applicableCategoryScores,
+        highestImpactCategories: categoryEntries,
+        whyScoreChanged,
+        largestScoreContributors,
+    };
+}
+function toTimelineRiskLevelFromValidationSummary(summary) {
+    if (summary.errors > 0 || summary.qualityFindings > 0) {
+        return 'HIGH';
+    }
+    if (summary.warnings > 0 || summary.setupGaps > 0) {
+        return 'MEDIUM';
+    }
+    return 'LOW';
+}
+function toTimelineEnforcementOutcomeFromValidationSummary(summary) {
+    if (summary.errors > 0) {
+        return 'FAIL';
+    }
+    if (summary.warnings > 0) {
+        return 'WARN';
+    }
+    return 'PASS';
+}
+function buildSetupGapDeductionKeyFromMessage(message) {
+    const normalized = message.toLowerCase();
+    if (normalized.includes('.archpilot/dependency-rules.json is missing')) {
+        return 'setup:missing-dependency-rules';
+    }
+    if (normalized.includes('.archpilot/layer-rules.json is missing')) {
+        return 'setup:missing-layer-rules';
+    }
+    if (normalized.includes('contract for') && normalized.includes('is missing')) {
+        const matches = [...normalized.matchAll(/contract for '([^']+)' is missing/gu)];
+        if (matches.length > 0) {
+            return `setup:missing-contract:${matches
+                .map((match) => match[1])
+                .sort((left, right) => left.localeCompare(right))
+                .join('+')}`;
+        }
+    }
+    if (normalized.includes('contract for') && normalized.includes('is invalid')) {
+        const matches = [...normalized.matchAll(/contract for '([^']+)' is invalid/gu)];
+        if (matches.length > 0) {
+            return `setup:invalid-contract:${matches
+                .map((match) => match[1])
+                .sort((left, right) => left.localeCompare(right))
+                .join('+')}`;
+        }
+    }
+    return undefined;
+}
+function buildDependencyDeductionKey(result) {
+    if (result.findingType !== 'module-dependency') {
+        return undefined;
+    }
+    if (typeof result.sourceFile !== 'string' ||
+        typeof result.sourceLine !== 'number' ||
+        typeof result.module !== 'string' ||
+        typeof result.target !== 'string') {
+        return undefined;
+    }
+    return [
+        'quality',
+        result.id,
+        result.module,
+        result.target,
+        result.sourceFile.replace(/\\/g, '/'),
+        String(result.sourceLine),
+        result.importSpecifier ?? '',
+    ].join('|');
+}
+function classifyValidationResult(result) {
+    if (result.applicability === 'not-applicable') {
+        return {
+            kind: 'guidance',
+            scoreImpact: 'guidance',
+            deductionKey: `not-applicable:${result.id}`,
+        };
+    }
+    if (result.passed) {
+        return {
+            kind: 'guidance',
+            scoreImpact: 'guidance',
+            deductionKey: `passed:${result.id}`,
+        };
+    }
+    const normalizedMessage = result.message.toLowerCase();
+    const setupLike = normalizedMessage.includes('validation skipped') ||
+        normalizedMessage.includes('is missing. add it to enable') ||
+        normalizedMessage.includes('run \'archpilot: initialize architecture\' to generate') ||
+        normalizedMessage.includes('contract for') &&
+            (normalizedMessage.includes('is missing') || normalizedMessage.includes('is invalid')) ||
+        (result.id === exports.ValidationRuleIds.ARCH_MODULE_CONTRACT_FILE_EXISTS &&
+            normalizedMessage.includes('is missing'));
+    if (setupLike) {
+        return {
+            kind: 'setup-gap',
+            scoreImpact: 'setup-gap',
+            deductionKey: buildSetupGapDeductionKeyFromMessage(result.message) ??
+                `setup:${result.id}:${normalizedMessage}`,
+        };
+    }
+    if (result.severity === 'info') {
+        return {
+            kind: 'guidance',
+            scoreImpact: 'guidance',
+            deductionKey: `guidance:${result.id}:${normalizedMessage}`,
+        };
+    }
+    return {
+        kind: 'violation',
+        scoreImpact: 'quality',
+        deductionKey: result.deductionKey ??
+            buildDependencyDeductionKey(result) ??
+            `quality:${result.id}:${normalizedMessage}`,
+    };
+}
+function getRuleIdSet() {
+    return new Set(getAllValidationRuleMetadata().map((meta) => meta.id));
+}
+function isKnownValidationRuleId(value) {
+    return getRuleIdSet().has(value);
+}
+function normalizeValidationConfig(config) {
+    const knownRuleIds = getRuleIdSet();
+    const rawDisabledRules = Array.isArray(config.disabledRules) ? config.disabledRules : [];
+    const rawSeverityOverrides = config.severityOverrides &&
+        typeof config.severityOverrides === 'object' &&
+        !Array.isArray(config.severityOverrides)
+        ? config.severityOverrides
+        : {};
+    const disabledRules = [...rawDisabledRules]
+        .filter((id) => {
+        if (typeof id !== 'string' || !knownRuleIds.has(id)) {
+            return false;
+        }
+        return true;
+    })
+        .sort((a, b) => a.localeCompare(b));
+    const severityOverrideEntries = Object.entries(rawSeverityOverrides)
+        .filter(([id, severity]) => {
+        if (!knownRuleIds.has(id)) {
+            return false;
+        }
+        return severity === 'error' || severity === 'warning' || severity === 'info';
+    })
+        .sort(([left], [right]) => left.localeCompare(right));
+    const normalizedOverrides = severityOverrideEntries.reduce((acc, [id, severity]) => {
+        acc[id] = severity;
+        return acc;
+    }, {});
+    const ignoredEntries = [];
+    for (const rawId of rawDisabledRules) {
+        if (typeof rawId !== 'string' || !isKnownValidationRuleId(rawId)) {
+            ignoredEntries.push({
+                kind: 'disabledRule',
+                id: String(rawId),
+                reason: 'Unknown rule ID. Entry was ignored.',
+            });
+        }
+    }
+    for (const [rawId, rawSeverity] of Object.entries(rawSeverityOverrides)) {
+        if (!isKnownValidationRuleId(rawId)) {
+            ignoredEntries.push({
+                kind: 'severityOverride',
+                id: rawId,
+                reason: 'Unknown rule ID. Override was ignored.',
+            });
+            continue;
+        }
+        if (rawSeverity !== 'error' && rawSeverity !== 'warning' && rawSeverity !== 'info') {
+            ignoredEntries.push({
+                kind: 'severityOverride',
+                id: rawId,
+                reason: 'Invalid severity. Override was ignored.',
+            });
+        }
+    }
+    return {
+        config: {
+            ...(disabledRules.length > 0 ? { disabledRules } : {}),
+            ...(Object.keys(normalizedOverrides).length > 0
+                ? { severityOverrides: normalizedOverrides }
+                : {}),
+        },
+        ignoredEntries: ignoredEntries.sort((a, b) => {
+            const kindCompare = a.kind.localeCompare(b.kind);
+            if (kindCompare !== 0) {
+                return kindCompare;
+            }
+            return a.id.localeCompare(b.id);
+        }),
+    };
+}
+function buildValidationStatusSummary(results, disabledCount = 0, suppressedCount = 0, exceptionsCount = 0, ignoredSuppressionCount = 0) {
+    const score = (0, architectureHealthScore_1.calculateArchitectureHealthScore)({
+        results: results.map((result) => {
+            const classification = classifyValidationResult(result);
+            return {
+                ruleId: result.id,
+                category: getValidationRuleMetadataById(result.id).category,
+                severity: result.severity,
+                passed: result.passed,
+                applicability: result.applicability,
+                ...(result.sourceComponentId ? { componentId: result.sourceComponentId } : {}),
+                ...(result.module ? { moduleId: result.module } : {}),
+                impact: classification.scoreImpact,
+                deductionKey: classification.deductionKey,
+            };
+        }),
+        categories: architectureHealthScore_1.defaultArchitectureHealthCategories,
+    });
+    const totalRulesEvaluated = score.totalChecks;
+    const info = score.info;
+    const failed = score.errors + score.warnings + score.info;
+    const passed = Math.max(0, score.passed - exceptionsCount);
+    const findingCountContext = buildFindingCountContext(results);
+    const architectureSmellSummary = buildArchitectureSmellSummaryFromResults(results);
+    const scoreExplanation = buildScoreExplanationSummary(results, score);
+    const base = {
+        totalRulesEvaluated,
+        notApplicable: score.notApplicable,
+        disabled: disabledCount,
+        passed,
+        failed,
+        ...findingCountContext,
+        heuristicArchitectureSmellCount: architectureSmellSummary.count,
+        architectureSmellSummary,
+        scoreExplanation,
+        suppressed: suppressedCount,
+        exceptions: exceptionsCount,
+        ignoredSuppressions: ignoredSuppressionCount,
+        errors: score.errors,
+        warnings: score.warnings,
+        info,
+        healthScore: score.overallScore,
+        categoryScores: score.categoryScores,
+        ...(score.componentScores ? { componentScores: score.componentScores } : {}),
+        ...(score.moduleScores ? { moduleScores: score.moduleScores } : {}),
+        readinessScore: score.readinessScore,
+        readinessCategoryScores: score.readinessCategoryScores,
+        setupGaps: score.setupGaps,
+        guidanceFindings: score.guidanceFindings,
+        qualityFindings: score.qualityFindings,
+    };
+    const status = getValidationOverallStatus(base);
+    return {
+        ...base,
+        status,
+        hasErrors: score.errors > 0,
+        hasWarnings: score.warnings > 0,
+    };
+}
+function mergeValidationConfig(base, override, explicitlyEnabledRuleIds = []) {
+    const disabledSet = new Set(base.disabledRules ?? []);
+    for (const ruleId of explicitlyEnabledRuleIds) {
+        disabledSet.delete(ruleId);
+    }
+    for (const ruleId of override.disabledRules ?? []) {
+        disabledSet.add(ruleId);
+    }
+    const mergedOverrides = {
+        ...(base.severityOverrides ?? {}),
+        ...(override.severityOverrides ?? {}),
+    };
+    return {
+        ...(disabledSet.size > 0
+            ? { disabledRules: [...disabledSet].sort((a, b) => a.localeCompare(b)) }
+            : {}),
+        ...(Object.keys(mergedOverrides).length > 0
+            ? { severityOverrides: mergedOverrides }
+            : {}),
+    };
+}
+function parseRulesConfigToValidationConfig(config) {
+    const rawRules = config.rules && typeof config.rules === 'object' && !Array.isArray(config.rules)
+        ? config.rules
+        : {};
+    const disabledRules = [];
+    const explicitlyEnabledRuleIds = [];
+    const severityOverrides = {};
+    for (const [ruleId, value] of Object.entries(rawRules)) {
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+            continue;
+        }
+        if (value.enabled === false) {
+            disabledRules.push(ruleId);
+        }
+        else if (value.enabled === true) {
+            explicitlyEnabledRuleIds.push(ruleId);
+        }
+        if (value.severity !== undefined) {
+            severityOverrides[ruleId] = value.severity;
+        }
+    }
+    return {
+        explicitlyEnabledRuleIds,
+        config: {
+            ...(disabledRules.length > 0
+                ? { disabledRules: disabledRules }
+                : {}),
+            ...(Object.keys(severityOverrides).length > 0
+                ? {
+                    severityOverrides: severityOverrides,
+                }
+                : {}),
+        },
+    };
+}
+async function readLegacyValidationConfig(workspaceRoot) {
+    const configPath = await resolveValidationConfigPath(workspaceRoot);
+    if (!configPath) {
+        return {};
+    }
+    const contents = await readTextFileIfExists(configPath);
+    if (!contents) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(stripJsonLineComments(contents));
+        const normalized = normalizeValidationConfig(parsed);
+        return normalized.config;
+    }
+    catch {
+        return {};
+    }
+}
+async function readValidationConfig(workspaceRoot) {
+    const legacyConfig = await readLegacyValidationConfig(workspaceRoot);
+    const rulesConfigPath = path.join(workspaceRoot, '.archpilot', 'rules.json');
+    const rulesConfigContents = await readTextFileIfExists(rulesConfigPath);
+    if (!rulesConfigContents) {
+        return { config: legacyConfig, configResults: [] };
+    }
+    try {
+        const parsed = JSON.parse(rulesConfigContents);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return {
+                config: legacyConfig,
+                configResults: [
+                    {
+                        id: exports.ValidationRuleIds.ARCH_RULE_CONFIGURATION_VALID,
+                        severity: 'error',
+                        passed: false,
+                        message: 'ArchPilot rule configuration is invalid: .archpilot/rules.json must be a JSON object.',
+                    },
+                ],
+            };
+        }
+        const rulesConfig = parseRulesConfigToValidationConfig(parsed);
+        const merged = mergeValidationConfig(legacyConfig, rulesConfig.config, rulesConfig.explicitlyEnabledRuleIds);
+        return { config: merged, configResults: [] };
+    }
+    catch {
+        return {
+            config: legacyConfig,
+            configResults: [
+                {
+                    id: exports.ValidationRuleIds.ARCH_RULE_CONFIGURATION_VALID,
+                    severity: 'error',
+                    passed: false,
+                    message: 'ArchPilot rule configuration is invalid JSON. Please fix .archpilot/rules.json.',
+                },
+            ],
+        };
+    }
+}
+function canOverrideSeverity(ruleId, from, to) {
+    void ruleId;
+    void from;
+    void to;
+    return true;
+}
+function resolveEffectiveSeverity(ruleId, config, baseSeverity) {
+    const meta = getValidationRuleMetadataById(ruleId);
+    const effectiveBaseSeverity = baseSeverity ?? meta.defaultSeverity;
+    const requested = config.severityOverrides?.[ruleId];
+    if (!requested) {
+        return effectiveBaseSeverity;
+    }
+    return canOverrideSeverity(ruleId, effectiveBaseSeverity, requested)
+        ? requested
+        : effectiveBaseSeverity;
+}
+function buildEffectiveValidationConfig(config) {
+    const normalized = normalizeValidationConfig(config);
+    const disabledRuleIds = [...(normalized.config.disabledRules ?? [])].sort((a, b) => a.localeCompare(b));
+    const ignoredEntries = [...normalized.ignoredEntries];
+    const appliedSeverityOverrides = [];
+    for (const [id, requestedSeverity] of Object.entries(normalized.config.severityOverrides ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
+        const ruleId = id;
+        const from = getValidationRuleMetadataById(ruleId).defaultSeverity;
+        if (requestedSeverity !== from) {
+            appliedSeverityOverrides.push({
+                id: ruleId,
+                from,
+                to: requestedSeverity,
+            });
+        }
+    }
+    const effectiveOverrides = appliedSeverityOverrides.reduce((acc, override) => {
+        acc[override.id] = override.to;
+        return acc;
+    }, {});
+    return {
+        config: {
+            ...(disabledRuleIds.length > 0 ? { disabledRules: disabledRuleIds } : {}),
+            ...(Object.keys(effectiveOverrides).length > 0
+                ? { severityOverrides: effectiveOverrides }
+                : {}),
+        },
+        disabledRuleIds,
+        disabledRuleIdSet: new Set(disabledRuleIds),
+        appliedSeverityOverrides,
+        ignoredEntries: ignoredEntries.sort((a, b) => {
+            const kindCompare = a.kind.localeCompare(b.kind);
+            if (kindCompare !== 0) {
+                return kindCompare;
+            }
+            return a.id.localeCompare(b.id);
+        }),
+    };
+}
+function isRuleDisabled(ruleId, config) {
+    return config.disabledRuleIdSet.has(ruleId);
+}
+function applyEffectiveSeverities(results, config) {
+    return results.map((result) => ({
+        ...result,
+        severity: resolveEffectiveSeverity(result.id, config, result.severity),
+    }));
+}
+function buildDisabledRuleDetails(disabledRuleIds) {
+    return disabledRuleIds.map((id) => {
+        const meta = getValidationRuleMetadataById(id);
+        return {
+            id,
+            title: meta.title,
+            category: meta.category,
+        };
+    });
+}
+function getEffectiveValidationConfigSummary(config) {
+    const effective = buildEffectiveValidationConfig(config);
+    const disabledCount = effective.disabledRuleIds.length;
+    const overrideCount = effective.appliedSeverityOverrides.length;
+    const ignoredCount = effective.ignoredEntries.length;
+    return `disabled=${disabledCount}, severityOverrides=${overrideCount}, ignoredConfigEntries=${ignoredCount}`;
+}
+function sortResultsForExport(results) {
+    return [...results].sort((a, b) => {
+        const bySeverity = getSeveritySortOrder(a.severity) - getSeveritySortOrder(b.severity);
+        if (bySeverity !== 0) {
+            return bySeverity;
+        }
+        return a.id.localeCompare(b.id);
+    });
+}
+function sortSuppressedResults(results) {
+    return [...results].sort((left, right) => {
+        const fileCompare = left.filePath.localeCompare(right.filePath);
+        if (fileCompare !== 0) {
+            return fileCompare;
+        }
+        const lineCompare = (left.line ?? 0) - (right.line ?? 0);
+        if (lineCompare !== 0) {
+            return lineCompare;
+        }
+        return left.id.localeCompare(right.id);
+    });
+}
+function sortSuppressionEntries(entries) {
+    return [...entries].sort((left, right) => {
+        const ruleCompare = left.entry.ruleId.localeCompare(right.entry.ruleId);
+        if (ruleCompare !== 0) {
+            return ruleCompare;
+        }
+        const scopeCompare = (left.entry.scope ?? '').localeCompare(right.entry.scope ?? '');
+        if (scopeCompare !== 0) {
+            return scopeCompare;
+        }
+        const reasonCompare = (left.entry.reason ?? '').localeCompare(right.entry.reason ?? '');
+        if (reasonCompare !== 0) {
+            return reasonCompare;
+        }
+        const expiryCompare = (left.entry.expiresOn ?? '').localeCompare(right.entry.expiresOn ?? '');
+        if (expiryCompare !== 0) {
+            return expiryCompare;
+        }
+        return left.entry.index - right.entry.index;
+    });
+}
+function buildDriftSnapshot(generatedAtUtc, status) {
+    return {
+        schemaVersion: '1.0',
+        generatedAtUtc,
+        score: status.summary.healthScore,
+        errors: status.summary.errors,
+        warnings: status.summary.warnings,
+        info: status.summary.info,
+        passed: status.summary.passed,
+        violations: status.results
+            .filter((result) => !result.passed)
+            .map((result) => ({
+            ruleId: result.id,
+            severity: result.severity,
+            ...(result.sourceFile ? { file: result.sourceFile } : {}),
+            ...(result.message ? { message: result.message } : {}),
+        }))
+            .sort((left, right) => {
+            const ruleCompare = left.ruleId.localeCompare(right.ruleId);
+            if (ruleCompare !== 0) {
+                return ruleCompare;
+            }
+            const fileCompare = (left.file ?? '').localeCompare(right.file ?? '');
+            if (fileCompare !== 0) {
+                return fileCompare;
+            }
+            const severityCompare = left.severity.localeCompare(right.severity);
+            if (severityCompare !== 0) {
+                return severityCompare;
+            }
+            return (left.message ?? '').localeCompare(right.message ?? '');
+        }),
+    };
+}
+function sortAdrSummary(summary) {
+    return {
+        total: summary.total,
+        proposed: summary.proposed,
+        accepted: summary.accepted,
+        deprecated: summary.deprecated,
+        superseded: summary.superseded,
+    };
+}
+function buildValidationStatusExport(config, results, validationConfig, suppressedResults, approvedExceptions, ignoredSuppressions, suppressionEntriesFound, exceptionEntriesFound, driftSummary, dependencyGraphSummary, suppressionSummary, suppressionEntries, policyStatus, adrSummary) {
+    const sorted = sortResultsForExport(results);
+    const sortedSuppressedResults = sortSuppressedResults(suppressedResults);
+    const summary = buildValidationStatusSummary(sorted, validationConfig.disabledRuleIds.length, sortedSuppressedResults.length, approvedExceptions.length, ignoredSuppressions.length);
+    const disabledRules = buildDisabledRuleDetails(validationConfig.disabledRuleIds);
+    const exportResults = sorted.map((r) => {
+        const meta = getValidationRuleMetadataById(r.id);
+        const classification = classifyValidationResult(r);
+        return {
+            id: r.id,
+            title: meta.title,
+            category: meta.category,
+            severity: r.severity,
+            passed: r.passed,
+            ...(r.applicability ? { applicability: r.applicability } : {}),
+            ...(r.applicabilityReason ? { applicabilityReason: r.applicabilityReason } : {}),
+            message: r.message,
+            kind: classification.kind,
+            ...(r.findingType ? { findingType: r.findingType } : {}),
+            ...(r.module ? { module: r.module } : {}),
+            ...(r.target ? { target: r.target } : {}),
+            ...(r.filePath ? { filePath: r.filePath } : {}),
+            ...(r.table ? { table: r.table } : {}),
+            ...(r.api ? { api: r.api } : {}),
+            ...(r.quickFix ? { quickFix: r.quickFix } : {}),
+            ...(r.status ? { status: r.status } : {}),
+            ...(r.exceptionReason ? { exceptionReason: r.exceptionReason } : {}),
+            ...(r.exceptionApprovedBy
+                ? { exceptionApprovedBy: r.exceptionApprovedBy }
+                : {}),
+            ...(r.exceptionExpiresAt ? { exceptionExpiresAt: r.exceptionExpiresAt } : {}),
+            ...(r.exceptionModule ? { exceptionModule: r.exceptionModule } : {}),
+            ...(r.exceptionTarget ? { exceptionTarget: r.exceptionTarget } : {}),
+            ...(r.sourceFile ? { sourceFile: r.sourceFile } : {}),
+            ...(r.sourceLine !== undefined ? { sourceLine: r.sourceLine } : {}),
+            ...(r.sourceColumn !== undefined ? { sourceColumn: r.sourceColumn } : {}),
+            ...(r.dependencyType ? { dependencyType: r.dependencyType } : {}),
+            ...(r.sourceComponentId ? { sourceComponentId: r.sourceComponentId } : {}),
+            ...(r.sourceComponentName ? { sourceComponentName: r.sourceComponentName } : {}),
+            ...(r.targetComponentId !== undefined ? { targetComponentId: r.targetComponentId } : {}),
+            ...(r.targetComponentName !== undefined ? { targetComponentName: r.targetComponentName } : {}),
+            ...(r.resolvedTargetPath !== undefined ? { resolvedTargetPath: r.resolvedTargetPath } : {}),
+            ...(r.isExternal !== undefined ? { isExternal: r.isExternal } : {}),
+        };
+    });
+    return {
+        tool: 'ArchPilot',
+        version: 1,
+        architectureStyle: config.architectureStyle,
+        implementationProfile: config.implementationProfile,
+        suppressionsFile: (0, validationSuppressions_1.getSuppressionsFilePathLabel)(),
+        suppressionEntriesFound,
+        exceptionsFile: '.archpilot/exceptions.json',
+        exceptionEntriesFound,
+        drift: driftSummary,
+        dependencyGraphSummary,
+        config: validationConfig.config,
+        summary,
+        disabledRules,
+        appliedSeverityOverrides: validationConfig.appliedSeverityOverrides,
+        ignoredConfigEntries: validationConfig.ignoredEntries,
+        suppressedResults: sortedSuppressedResults,
+        approvedExceptions: [...approvedExceptions].sort((left, right) => {
+            const ruleCompare = left.ruleId.localeCompare(right.ruleId);
+            if (ruleCompare !== 0) {
+                return ruleCompare;
+            }
+            const moduleCompare = (left.module ?? '').localeCompare(right.module ?? '');
+            if (moduleCompare !== 0) {
+                return moduleCompare;
+            }
+            const targetCompare = (left.target ?? '').localeCompare(right.target ?? '');
+            if (targetCompare !== 0) {
+                return targetCompare;
+            }
+            const filePathCompare = (left.filePath ?? '').localeCompare(right.filePath ?? '');
+            if (filePathCompare !== 0) {
+                return filePathCompare;
+            }
+            const tableCompare = (left.table ?? '').localeCompare(right.table ?? '');
+            if (tableCompare !== 0) {
+                return tableCompare;
+            }
+            const apiCompare = (left.api ?? '').localeCompare(right.api ?? '');
+            if (apiCompare !== 0) {
+                return apiCompare;
+            }
+            return left.reason.localeCompare(right.reason);
+        }),
+        ignoredSuppressions,
+        results: exportResults,
+        ...(suppressionSummary ? { suppressionSummary } : {}),
+        ...(suppressionEntries ? { suppressionEntries: sortSuppressionEntries(suppressionEntries) } : {}),
+        ...(policyStatus ? { policy: policyStatus } : {}),
+        ...(adrSummary ? { adrSummary: sortAdrSummary(adrSummary) } : {}),
+    };
+}
+function normalizeRelativePathForSuppression(filePath) {
+    let normalized = filePath.replace(/\\/g, '/').trim();
+    while (normalized.startsWith('./')) {
+        normalized = normalized.slice(2);
+    }
+    return normalized;
+}
+function resolveFindingPathForSuppression(result) {
+    if (typeof result.sourceFile === 'string' && result.sourceFile.length > 0) {
+        return normalizeRelativePathForSuppression(result.sourceFile);
+    }
+    const resolvedTargetPath = (0, findingTargetResolution_1.resolveNavigationTargetPath)({
+        ruleId: result.id,
+        message: result.message,
+    });
+    if (!resolvedTargetPath) {
+        return undefined;
+    }
+    return normalizeRelativePathForSuppression(resolvedTargetPath);
+}
+function applyValidationSuppressions(results, suppressions) {
+    const activeResults = [];
+    const suppressedResults = [];
+    for (const result of results) {
+        if (result.passed) {
+            activeResults.push(result);
+            continue;
+        }
+        const findingPath = resolveFindingPathForSuppression(result);
+        const suppression = (0, validationSuppressions_1.findMatchingSuppression)(result.id, findingPath, suppressions);
+        if (!suppression) {
+            activeResults.push(result);
+            continue;
+        }
+        const meta = getValidationRuleMetadataById(result.id);
+        suppressedResults.push({
+            id: result.id,
+            title: meta.title,
+            category: meta.category,
+            severity: result.severity,
+            filePath: findingPath ?? (0, validationSuppressions_1.getSuppressionScopeLabel)(suppression),
+            ...(result.sourceLine !== undefined ? { line: result.sourceLine } : {}),
+            suppressionPath: (0, validationSuppressions_1.getSuppressionScopeLabel)(suppression),
+            ...(suppression.reason ? { suppressionReason: suppression.reason } : {}),
+            message: result.message,
+        });
+    }
+    return { activeResults, suppressedResults };
+}
+function applyValidationExceptions(results, exceptions) {
+    const activeResults = [];
+    const approvedExceptions = [];
+    for (const result of results) {
+        const matchedException = (0, exceptionLoader_1.shouldIgnoreViolationDueToException)(result, exceptions);
+        if (!matchedException) {
+            activeResults.push(result);
+            continue;
+        }
+        activeResults.push({
+            ...result,
+            passed: true,
+            status: 'exception',
+            exceptionReason: matchedException.reason,
+            exceptionApprovedBy: matchedException.approvedBy,
+            ...(matchedException.expiresAt
+                ? { exceptionExpiresAt: matchedException.expiresAt }
+                : {}),
+            ...(matchedException.module ? { exceptionModule: matchedException.module } : {}),
+            ...(matchedException.target ? { exceptionTarget: matchedException.target } : {}),
+        });
+        approvedExceptions.push({
+            ruleId: matchedException.ruleId,
+            ...(matchedException.module ? { module: matchedException.module } : {}),
+            ...(matchedException.target ? { target: matchedException.target } : {}),
+            ...(matchedException.filePath ? { filePath: matchedException.filePath } : {}),
+            ...(matchedException.table ? { table: matchedException.table } : {}),
+            ...(matchedException.api ? { api: matchedException.api } : {}),
+            reason: matchedException.reason,
+            approvedBy: matchedException.approvedBy,
+            createdAt: matchedException.createdAt,
+            ...(matchedException.expiresAt ? { expiresAt: matchedException.expiresAt } : {}),
+        });
+    }
+    const dedupedApprovedExceptions = [...approvedExceptions]
+        .sort((left, right) => {
+        const ruleCompare = left.ruleId.localeCompare(right.ruleId);
+        if (ruleCompare !== 0) {
+            return ruleCompare;
+        }
+        const moduleCompare = (left.module ?? '').localeCompare(right.module ?? '');
+        if (moduleCompare !== 0) {
+            return moduleCompare;
+        }
+        const targetCompare = (left.target ?? '').localeCompare(right.target ?? '');
+        if (targetCompare !== 0) {
+            return targetCompare;
+        }
+        const filePathCompare = (left.filePath ?? '').localeCompare(right.filePath ?? '');
+        if (filePathCompare !== 0) {
+            return filePathCompare;
+        }
+        const tableCompare = (left.table ?? '').localeCompare(right.table ?? '');
+        if (tableCompare !== 0) {
+            return tableCompare;
+        }
+        const apiCompare = (left.api ?? '').localeCompare(right.api ?? '');
+        if (apiCompare !== 0) {
+            return apiCompare;
+        }
+        return left.reason.localeCompare(right.reason);
+    })
+        .filter((entry, index, values) => {
+        if (index === 0) {
+            return true;
+        }
+        const previous = values[index - 1];
+        return !(entry.ruleId === previous.ruleId &&
+            (entry.module ?? '') === (previous.module ?? '') &&
+            (entry.target ?? '') === (previous.target ?? '') &&
+            (entry.filePath ?? '') === (previous.filePath ?? '') &&
+            (entry.table ?? '') === (previous.table ?? '') &&
+            (entry.api ?? '') === (previous.api ?? '') &&
+            entry.reason === previous.reason);
+    });
+    return {
+        activeResults,
+        approvedExceptions: dedupedApprovedExceptions,
+    };
+}
+async function pathExists(targetPath) {
+    try {
+        await node_fs_1.promises.access(targetPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function readTextFileIfExists(filePath) {
+    try {
+        const buf = await node_fs_1.promises.readFile(filePath, { encoding: 'utf8' });
+        return buf.toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readDependencyRulesRawConfig(workspaceRoot) {
+    const dependencyRulesPath = path.join(workspaceRoot, '.archpilot', 'dependency-rules.json');
+    const contents = await readTextFileIfExists(dependencyRulesPath);
+    if (!contents) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(contents);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return undefined;
+        }
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveValidationConfigPath(workspaceRoot) {
+    const configDir = path.join(workspaceRoot, '.archpilot');
+    const jsoncPath = path.join(configDir, 'validation-config.jsonc');
+    if (await pathExists(jsoncPath)) {
+        return jsoncPath;
+    }
+    // Legacy fallback for older workspaces that still use strict .json.
+    const jsonPath = path.join(configDir, 'validation-config.json');
+    if (await pathExists(jsonPath)) {
+        return jsonPath;
+    }
+    return undefined;
+}
+function stripJsonLineComments(contents) {
+    let result = '';
+    let inString = false;
+    let isEscaped = false;
+    for (let index = 0; index < contents.length; index += 1) {
+        const current = contents[index];
+        const next = contents[index + 1];
+        if (inString) {
+            result += current;
+            if (isEscaped) {
+                isEscaped = false;
+                continue;
+            }
+            if (current === '\\') {
+                isEscaped = true;
+                continue;
+            }
+            if (current === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (current === '"') {
+            inString = true;
+            result += current;
+            continue;
+        }
+        if (current === '/' && next === '/') {
+            while (index < contents.length && contents[index] !== '\n') {
+                index += 1;
+            }
+            if (index < contents.length) {
+                result += contents[index];
+            }
+            continue;
+        }
+        result += current;
+    }
+    return result;
+}
+function hasConfiguredApi(config) {
+    return config.apiStyle !== 'none';
+}
+function hasConfiguredDatabase(config) {
+    return config.database !== 'none';
+}
+function isFlatModulesRoot(modulesRoot) {
+    return !modulesRoot.endsWith('/modules') && !modulesRoot.endsWith('/domain');
+}
+async function getConfiguredModulesRoot(workspaceRoot, contract) {
+    const fallbackModulesRoot = (0, moduleDiscovery_1.resolveModulesRootFromContract)(contract);
+    return (0, moduleDiscovery_1.resolveConfiguredModulesRoot)(workspaceRoot, fallbackModulesRoot);
+}
+function normalizeRelativePath(value) {
+    return value.replace(/\\/g, '/').replace(/^\/+/, '');
+}
+function resolveOverviewRelativePath(contract) {
+    if (typeof contract.artifacts?.architectureOverview === 'string' &&
+        contract.artifacts.architectureOverview.trim().length > 0) {
+        return normalizeRelativePath(contract.artifacts.architectureOverview);
+    }
+    return `${(0, moduleDiscovery_1.resolveDocsRootFromContract)(contract)}/architecture/overview.md`;
+}
+function resolveAdrDirectoryRelativePath(contract) {
+    if (typeof contract.artifacts?.adrDirectory === 'string' &&
+        contract.artifacts.adrDirectory.trim().length > 0) {
+        return normalizeRelativePath(contract.artifacts.adrDirectory);
+    }
+    return `${(0, moduleDiscovery_1.resolveDocsRootFromContract)(contract)}/adrs`;
+}
+function resolveTenantModelAdrRelativePath(contract) {
+    return `${resolveAdrDirectoryRelativePath(contract)}/adr-001-tenant-model.md`;
+}
+function resolveOpenApiRelativePath(contract) {
+    if (typeof contract.artifacts?.openApiSpec === 'string' &&
+        contract.artifacts.openApiSpec.trim().length > 0) {
+        return normalizeRelativePath(contract.artifacts.openApiSpec);
+    }
+    return `${(0, moduleDiscovery_1.resolveApiRootFromContract)(contract)}/openapi.yaml`;
+}
+function resolveSqlBaselineRelativePath(contract) {
+    if (typeof contract.artifacts?.sqlBaseline === 'string' &&
+        contract.artifacts.sqlBaseline.trim().length > 0) {
+        return normalizeRelativePath(contract.artifacts.sqlBaseline);
+    }
+    return `${(0, moduleDiscovery_1.resolveDatabaseRootFromContract)(contract)}/001_init.sql`;
+}
+async function readArchitectureConfig(workspaceRoot) {
+    try {
+        const contract = await (0, architectureInit_1.loadArchitectureContract)(workspaceRoot);
+        if (!contract) {
+            return undefined;
+        }
+        const config = {
+            version: contract.version,
+            projectName: contract.projectName,
+            repoTopology: contract.repoTopology,
+            projectKinds: contract.projectKinds,
+            stacks: contract.stacks,
+            architectureStyle: contract.architectureStyle,
+            database: contract.database,
+            tenantModel: contract.tenantModel,
+            rbac: contract.rbac,
+            apiStyle: contract.apiStyle,
+            authStyle: contract.authStyle,
+            implementationProfile: contract.implementationProfile,
+            createdAtUtc: contract.createdAtUtc,
+        };
+        return config;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function validateApiStyle(workspaceRoot, contract, config, validationConfig) {
+    const results = [];
+    if (!hasConfiguredApi(config)) {
+        return results;
+    }
+    const openApiRequired = !isRuleDisabled(exports.ValidationRuleIds.API_OPENAPI_EXISTS, validationConfig);
+    const graphqlRequired = config.apiStyle === 'graphql' &&
+        !isRuleDisabled(exports.ValidationRuleIds.API_GRAPHQL_PATH_PRESENT, validationConfig);
+    if (!openApiRequired && !graphqlRequired) {
+        return results;
+    }
+    const openApiRelativePath = resolveOpenApiRelativePath(contract);
+    const openApiPath = path.join(workspaceRoot, ...openApiRelativePath.split('/'));
+    const exists = await pathExists(openApiPath);
+    if (openApiRequired) {
+        results.push({
+            id: exports.ValidationRuleIds.API_OPENAPI_EXISTS,
+            severity: 'error',
+            passed: exists,
+            message: exists
+                ? `${openApiRelativePath} exists.`
+                : `${openApiRelativePath} is missing but required by apiStyle.`,
+            sourceFile: openApiRelativePath,
+            filePath: openApiRelativePath,
+            findingType: 'file-scope',
+            api: 'openapi',
+        });
+    }
+    if (graphqlRequired) {
+        const text = exists ? await readTextFileIfExists(openApiPath) : undefined;
+        const hasGraphqlPath = !!text && text.includes('/graphql');
+        results.push({
+            id: exports.ValidationRuleIds.API_GRAPHQL_PATH_PRESENT,
+            severity: 'error',
+            passed: hasGraphqlPath,
+            message: hasGraphqlPath
+                ? 'OpenAPI contract mentions /graphql for GraphQL API style.'
+                : 'OpenAPI contract does not mention /graphql even though apiStyle is graphql.',
+            sourceFile: openApiRelativePath,
+            filePath: openApiRelativePath,
+            findingType: 'api-scope',
+            api: '/graphql',
+        });
+    }
+    return results;
+}
+async function validateTenantModel(workspaceRoot, contract, config, validationConfig) {
+    const results = [];
+    if (!hasConfiguredDatabase(config)) {
+        return results;
+    }
+    if (config.tenantModel === 'same_db_same_schema' &&
+        !isRuleDisabled(exports.ValidationRuleIds.DB_TENANT_SAME_SCHEMA_TENANT_ID, validationConfig)) {
+        const sqlRelativePath = resolveSqlBaselineRelativePath(contract);
+        const sqlPath = path.join(workspaceRoot, ...sqlRelativePath.split('/'));
+        const sql = await readTextFileIfExists(sqlPath);
+        const hasTenantId = !!sql && sql.includes('tenant_id');
+        results.push({
+            id: exports.ValidationRuleIds.DB_TENANT_SAME_SCHEMA_TENANT_ID,
+            severity: 'error',
+            passed: hasTenantId,
+            message: hasTenantId
+                ? 'Multi-tenant same-schema SQL contains tenant_id discriminator.'
+                : `${sqlRelativePath} should contain tenant_id for same_db_same_schema tenant model.`,
+            sourceFile: sqlRelativePath,
+            filePath: sqlRelativePath,
+            findingType: 'table-scope',
+            table: 'tenant_id',
+        });
+    }
+    if (config.tenantModel === 'same_db_different_schema' &&
+        !isRuleDisabled(exports.ValidationRuleIds.DOC_TENANT_DIFFERENT_SCHEMA_ADR, validationConfig)) {
+        const tenantModelAdrRelativePath = resolveTenantModelAdrRelativePath(contract);
+        const adrPath = path.join(workspaceRoot, ...tenantModelAdrRelativePath.split('/'));
+        const exists = await pathExists(adrPath);
+        results.push({
+            id: exports.ValidationRuleIds.DOC_TENANT_DIFFERENT_SCHEMA_ADR,
+            severity: 'warning',
+            passed: exists,
+            message: exists
+                ? 'ADR for tenant model exists for different-schema model.'
+                : `${tenantModelAdrRelativePath} should exist for same_db_different_schema tenant model.`,
+        });
+    }
+    return results;
+}
+async function validateRbac(workspaceRoot, contract, config, validationConfig) {
+    const results = [];
+    if (!config.rbac ||
+        isRuleDisabled(exports.ValidationRuleIds.DOC_RBAC_MENTIONED_IN_OVERVIEW, validationConfig)) {
+        return results;
+    }
+    const overviewRelativePath = resolveOverviewRelativePath(contract);
+    const overviewPath = path.join(workspaceRoot, ...overviewRelativePath.split('/'));
+    const overview = await readTextFileIfExists(overviewPath);
+    const overviewLower = overview?.toLowerCase() ?? '';
+    const mentionsRbac = overviewLower.includes('rbac') || overviewLower.includes('role-based access control');
+    results.push({
+        id: exports.ValidationRuleIds.DOC_RBAC_MENTIONED_IN_OVERVIEW,
+        severity: 'warning',
+        passed: mentionsRbac,
+        message: mentionsRbac
+            ? 'Architecture overview mentions RBAC or role-based access control.'
+            : `${overviewRelativePath} should mention RBAC or role-based access control when rbac is true.`,
+        sourceFile: overviewRelativePath,
+        filePath: overviewRelativePath,
+        findingType: 'file-scope',
+    });
+    return results;
+}
+async function validateArchitectureStyle(workspaceRoot, contract, validationConfig) {
+    const results = [];
+    const { architectureStyle, implementationProfile } = contract;
+    if (architectureStyle !== 'modular_monolith' ||
+        isRuleDisabled(exports.ValidationRuleIds.ARCH_MODULAR_STRUCTURE, validationConfig)) {
+        return results;
+    }
+    const isLibraryOnlyProject = contract.projectKinds.includes('library') &&
+        !contract.projectKinds.some((kind) => kind === 'backend' || kind === 'frontend');
+    if (isLibraryOnlyProject) {
+        return results;
+    }
+    const modulesRootRelativePath = await getConfiguredModulesRoot(workspaceRoot, contract);
+    const moduleDirectories = await (0, moduleDiscovery_1.listModuleDirectoryNames)(workspaceRoot, modulesRootRelativePath);
+    const minimumModuleCount = isFlatModulesRoot(modulesRootRelativePath) ? 2 : 1;
+    const hasValidModuleRoot = moduleDirectories.length >= minimumModuleCount;
+    results.push({
+        id: exports.ValidationRuleIds.ARCH_MODULAR_STRUCTURE,
+        severity: 'error',
+        passed: hasValidModuleRoot,
+        message: hasValidModuleRoot
+            ? `Configured module root '${modulesRootRelativePath}' contains ${moduleDirectories.length} top-level module/capability directories.`
+            : `Modular monolith structure missing: configured module root '${modulesRootRelativePath}' must exist and contain at least ${minimumModuleCount} top-level module/capability director${minimumModuleCount === 1 ? 'y' : 'ies'}.`,
+    });
+    if (implementationProfile === 'typescript-backend' &&
+        !isRuleDisabled(exports.ValidationRuleIds.ARCH_OVERVIEW_ARTIFACT_EXISTS, validationConfig)) {
+        const overviewRelativePath = resolveOverviewRelativePath(contract);
+        const overviewPath = path.join(workspaceRoot, ...overviewRelativePath.split('/'));
+        const overviewExists = await pathExists(overviewPath);
+        results.push({
+            id: exports.ValidationRuleIds.ARCH_OVERVIEW_ARTIFACT_EXISTS,
+            severity: 'error',
+            passed: overviewExists,
+            message: overviewExists
+                ? `${overviewRelativePath} exists.`
+                : `${overviewRelativePath} is missing from the initialized architecture baseline.`,
+        });
+    }
+    if (implementationProfile === 'typescript-backend' &&
+        !isRuleDisabled(exports.ValidationRuleIds.ARCH_MODULE_BASELINE_COMPLETE, validationConfig)) {
+        const normalizeEntrypoint = (entry) => normalizeRelativePath(entry.trim());
+        const hasDeclaredPublicEntrypoint = async (moduleName, entry) => {
+            const entryPath = path.join(workspaceRoot, ...normalizeEntrypoint(entry).split('/'));
+            return pathExists(entryPath);
+        };
+        const readModuleContractPublicEntrypoints = async (moduleName) => {
+            const registryEntry = contract.modules[moduleName];
+            const contractRelativePath = typeof registryEntry?.contract === 'string'
+                ? normalizeRelativePath(registryEntry.contract)
+                : normalizeRelativePath((0, architectureInit_1.buildDefaultModuleContractPath)(moduleName, contract));
+            const contractAbsolutePath = path.join(workspaceRoot, ...contractRelativePath.split('/'));
+            const rawContract = await readTextFileIfExists(contractAbsolutePath);
+            if (!rawContract) {
+                return [];
+            }
+            try {
+                const parsed = JSON.parse(rawContract);
+                if (!Array.isArray(parsed.publicEntrypoints)) {
+                    return [];
+                }
+                return parsed.publicEntrypoints
+                    .filter((value) => typeof value === 'string')
+                    .map((entry) => normalizeEntrypoint(entry));
+            }
+            catch {
+                return [];
+            }
+        };
+        const modulesRootRelativePath = await getConfiguredModulesRoot(workspaceRoot, contract);
+        const modulesRoot = path.join(workspaceRoot, ...modulesRootRelativePath.split('/'));
+        if (await pathExists(modulesRoot)) {
+            const hierarchicalModules = await (0, moduleDiscovery_1.discoverHierarchicalModuleRoots)(workspaceRoot, modulesRootRelativePath);
+            const moduleDirectories = hierarchicalModules.length > 0
+                ? hierarchicalModules.map((entry) => ({
+                    moduleName: entry.moduleId,
+                    sourcePath: entry.sourcePath,
+                }))
+                : (await node_fs_1.promises.readdir(modulesRoot, { withFileTypes: true }))
+                    .filter((entry) => entry.isDirectory())
+                    .map((entry) => ({
+                    moduleName: entry.name,
+                    sourcePath: `${modulesRootRelativePath}/${entry.name}`,
+                }))
+                    .sort((left, right) => left.moduleName.localeCompare(right.moduleName));
+            const dependencySummary = await (0, dependencyValidation_1.buildDependencyGraphSummary)(workspaceRoot, contract, {
+                modulesRootRelativePath,
+            });
+            const modulesRequiringPublicEntrypointFromInboundDeclaredDependencies = new Set(dependencySummary.modules
+                .filter((moduleSummary) => moduleSummary.inboundDeclaredFrom.length > 0)
+                .map((moduleSummary) => moduleSummary.module));
+            const incompleteModules = [];
+            for (const moduleDirectory of moduleDirectories) {
+                const moduleName = moduleDirectory.moduleName;
+                const moduleDir = path.join(workspaceRoot, ...moduleDirectory.sourcePath.split('/'));
+                const readmeExists = await pathExists(path.join(moduleDir, 'README.md'));
+                const indexExists = await pathExists(path.join(moduleDir, 'index.ts'));
+                const registryPublicEntrypoints = (contract.modules[moduleName]?.publicEntrypoints ?? [])
+                    .filter((entry) => typeof entry === 'string')
+                    .map((entry) => normalizeEntrypoint(entry));
+                const contractPublicEntrypoints = await readModuleContractPublicEntrypoints(moduleName);
+                const declaredPublicEntrypoints = [
+                    ...new Set([...registryPublicEntrypoints, ...contractPublicEntrypoints]),
+                ];
+                const requiresPublicEntrypoint = declaredPublicEntrypoints.length > 0 ||
+                    modulesRequiringPublicEntrypointFromInboundDeclaredDependencies.has(moduleName);
+                const missingParts = [];
+                if (!readmeExists) {
+                    missingParts.push('README.md');
+                }
+                if (requiresPublicEntrypoint) {
+                    if (!indexExists) {
+                        missingParts.push('index.ts');
+                    }
+                    if (declaredPublicEntrypoints.length > 0) {
+                        const declaredEntrypointExists = (await Promise.all(declaredPublicEntrypoints.map((entry) => hasDeclaredPublicEntrypoint(moduleName, entry)))).some((exists) => exists);
+                        if (!declaredEntrypointExists) {
+                            missingParts.push('public entrypoint');
+                        }
+                    }
+                }
+                if (missingParts.length > 0) {
+                    incompleteModules.push(`${moduleName} (${missingParts.join(', ')})`);
+                }
+            }
+            results.push({
+                id: exports.ValidationRuleIds.ARCH_MODULE_BASELINE_COMPLETE,
+                severity: 'warning',
+                passed: incompleteModules.length === 0,
+                message: incompleteModules.length === 0
+                    ? `All immediate modules under ${modulesRootRelativePath} contain README.md, and modules requiring a public entrypoint provide one.`
+                    : `Module baseline drift detected in ${modulesRootRelativePath}: ${incompleteModules.join('; ')}.`,
+            });
+        }
+    }
+    return results;
+}
+async function validateDatabaseArtifacts(workspaceRoot, contract, config, validationConfig) {
+    const results = [];
+    if (!hasConfiguredDatabase(config) ||
+        config.implementationProfile !== 'typescript-backend' ||
+        isRuleDisabled(exports.ValidationRuleIds.DB_SQL_BASELINE_EXISTS, validationConfig)) {
+        return results;
+    }
+    const sqlBaselineRelativePath = resolveSqlBaselineRelativePath(contract);
+    const sqlBaselinePath = path.join(workspaceRoot, ...sqlBaselineRelativePath.split('/'));
+    const exists = await pathExists(sqlBaselinePath);
+    results.push({
+        id: exports.ValidationRuleIds.DB_SQL_BASELINE_EXISTS,
+        severity: 'error',
+        passed: exists,
+        message: exists
+            ? `${sqlBaselineRelativePath} exists.`
+            : `${sqlBaselineRelativePath} is missing from the initialized database baseline.`,
+    });
+    return results;
+}
+function buildDependencyFindingStableKey(finding) {
+    if (!finding.result.id ||
+        !finding.module ||
+        !finding.target ||
+        !finding.filePath ||
+        finding.line === undefined ||
+        !finding.importSpecifier) {
+        return undefined;
+    }
+    return [
+        finding.result.id,
+        finding.module,
+        finding.target,
+        finding.filePath.replace(/\\/g, '/'),
+        String(finding.line),
+        finding.importSpecifier,
+    ].join('|');
+}
+function dedupeDependencyFindings(findings) {
+    const seen = new Set();
+    const deduped = [];
+    for (const finding of findings) {
+        const stableKey = buildDependencyFindingStableKey(finding);
+        if (stableKey && seen.has(stableKey)) {
+            continue;
+        }
+        if (stableKey) {
+            seen.add(stableKey);
+        }
+        deduped.push(finding);
+    }
+    return deduped;
+}
+async function validateModuleDependencies(workspaceRoot, contract, validationConfig, onDependencyConfigError, dependencyRulesConfigOverride, precomputedImports, hasArchitectureModulesOverride) {
+    const modulesRootRelativePath = await getConfiguredModulesRoot(workspaceRoot, contract);
+    const hasArchitectureModules = hasArchitectureModulesOverride ?? hasConfiguredArchitectureModules(contract);
+    const dependencyRuleChecks = {
+        modulesRootRelativePath,
+        checkCircularDependencies: hasArchitectureModules && !isRuleDisabled(exports.ValidationRuleIds.DEP_CIRCULAR_MODULE_DEPENDENCY, validationConfig),
+        checkForbiddenDependencies: hasArchitectureModules && !isRuleDisabled(exports.ValidationRuleIds.DEP_FORBIDDEN_CROSS_MODULE_DEPENDENCY, validationConfig),
+        checkNonPublicImports: hasArchitectureModules && !isRuleDisabled(exports.ValidationRuleIds.DEP_NON_PUBLIC_CROSS_MODULE_IMPORT, validationConfig),
+        checkComponentDependencyPolicies: !isRuleDisabled(exports.ValidationRuleIds.DEP_CROSS_COMPONENT_POLICY_VIOLATION, validationConfig),
+    };
+    const contractDependencyRuleChecks = {
+        checkDeclaredDependencies: hasArchitectureModules && !isRuleDisabled(exports.ValidationRuleIds.DEP_CROSS_MODULE_DEPENDENCY_DECLARED_IN_CONTRACT, validationConfig),
+        checkPublicSurfaceImports: hasArchitectureModules && !isRuleDisabled(exports.ValidationRuleIds.DEP_CROSS_MODULE_IMPORT_USES_PUBLIC_SURFACE_ONLY, validationConfig),
+        checkDeclaredDependenciesUsedByCode: hasArchitectureModules && !isRuleDisabled(exports.ValidationRuleIds.DEP_DECLARED_MODULE_DEPENDENCY_NOT_USED, validationConfig),
+    };
+    try {
+        const [legacyFindings, contractFindings] = await Promise.all([
+            (0, dependencyValidation_1.validateDependencyBoundaries)(workspaceRoot, {
+                ...dependencyRuleChecks,
+                ...(dependencyRulesConfigOverride
+                    ? { dependencyRulesConfigOverride }
+                    : {}),
+                ...(precomputedImports ? { precomputedImports } : {}),
+            }),
+            (0, dependencyValidation_1.validateDependencyContractBoundaries)(workspaceRoot, contract, {
+                ...contractDependencyRuleChecks,
+                modulesRootRelativePath,
+                suppressPublicSurfaceFailuresForNonPublicImports: dependencyRuleChecks.checkNonPublicImports,
+                ...(precomputedImports ? { precomputedImports } : {}),
+            }),
+        ]);
+        const findings = dedupeDependencyFindings([...legacyFindings, ...contractFindings]);
+        const results = [];
+        for (const finding of findings) {
+            const resultWithSource = {
+                ...finding.result,
+                ...(finding.module ? { module: finding.module } : {}),
+                ...(finding.target ? { target: finding.target } : {}),
+                ...(finding.table ? { table: finding.table } : {}),
+                ...(finding.api ? { api: finding.api } : {}),
+                ...(finding.findingType ? { findingType: finding.findingType } : {}),
+                ...(finding.filePath ? { sourceFile: finding.filePath, filePath: finding.filePath } : {}),
+                ...(finding.line !== undefined ? { sourceLine: finding.line } : {}),
+                ...(finding.importSpecifier ? { importSpecifier: finding.importSpecifier } : {}),
+                ...(finding.dependencyType ? { dependencyType: finding.dependencyType } : {}),
+                ...(finding.sourceComponentId ? { sourceComponentId: finding.sourceComponentId } : {}),
+                ...(finding.sourceComponentName ? { sourceComponentName: finding.sourceComponentName } : {}),
+                ...(finding.targetComponentId !== undefined
+                    ? { targetComponentId: finding.targetComponentId }
+                    : {}),
+                ...(finding.targetComponentName !== undefined
+                    ? { targetComponentName: finding.targetComponentName }
+                    : {}),
+                ...(finding.resolvedTargetPath !== undefined
+                    ? { resolvedTargetPath: finding.resolvedTargetPath }
+                    : {}),
+                ...(finding.isExternal !== undefined ? { isExternal: finding.isExternal } : {}),
+            };
+            results.push(resultWithSource);
+        }
+        return results;
+    }
+    catch (error) {
+        if (error instanceof dependencyValidation_1.DependencyRulesConfigError) {
+            onDependencyConfigError?.(error.message);
+            return [];
+        }
+        throw error;
+    }
+}
+async function validateDependencyGraphIsolation(workspaceRoot, contract, dependencyGraphSummary, validationConfig) {
+    if (isRuleDisabled(exports.ValidationRuleIds.DEP_ISOLATED_MODULE_DETECTED, validationConfig)) {
+        return [];
+    }
+    const isolatedResults = [];
+    const sourceFileExtensions = new Set([
+        '.ts',
+        '.tsx',
+        '.js',
+        '.jsx',
+        '.mjs',
+        '.cjs',
+        '.mts',
+        '.cts',
+        '.py',
+        '.go',
+        '.java',
+        '.kt',
+        '.kts',
+        '.cs',
+        '.php',
+        '.rb',
+        '.vue',
+        '.svelte',
+    ]);
+    const isTestLikeModule = (moduleName) => {
+        const normalized = moduleName.toLowerCase();
+        return (normalized === 'test' ||
+            normalized === 'tests' ||
+            normalized.endsWith('-test') ||
+            normalized.endsWith('-tests'));
+    };
+    const collectModuleSourceEvidence = async (directoryPath) => {
+        let entries;
+        try {
+            entries = await node_fs_1.promises.readdir(directoryPath, { withFileTypes: true });
+        }
+        catch {
+            return { sourceFileCount: 0, hasReadme: false, hasEntrypointFile: false };
+        }
+        let sourceFileCount = 0;
+        let hasReadme = false;
+        let hasEntrypointFile = false;
+        for (const entry of entries) {
+            const fullPath = path.join(directoryPath, entry.name);
+            if (entry.isDirectory()) {
+                if ([
+                    'node_modules',
+                    '.git',
+                    '.archpilot',
+                    '.next',
+                    'dist',
+                    'out',
+                    'build',
+                    'coverage',
+                    'fixtures',
+                    '__fixtures__',
+                ].includes(entry.name)) {
+                    continue;
+                }
+                const nested = await collectModuleSourceEvidence(fullPath);
+                sourceFileCount += nested.sourceFileCount;
+                hasReadme ||= nested.hasReadme;
+                hasEntrypointFile ||= nested.hasEntrypointFile;
+                continue;
+            }
+            if (!entry.isFile()) {
+                continue;
+            }
+            const lowerName = entry.name.toLowerCase();
+            if (lowerName === 'readme.md' || lowerName === 'readme.mdx') {
+                hasReadme = true;
+            }
+            if (/^(index|main|app|extension|cli)\.[cm]?[jt]sx?$/iu.test(entry.name)) {
+                hasEntrypointFile = true;
+            }
+            if (sourceFileExtensions.has(path.extname(entry.name).toLowerCase())) {
+                sourceFileCount += 1;
+            }
+        }
+        return { sourceFileCount, hasReadme, hasEntrypointFile };
+    };
+    const readPackageJsonIfExists = async (moduleDirectoryPath) => {
+        const content = await readTextFileIfExists(path.join(moduleDirectoryPath, 'package.json'));
+        if (!content) {
+            return undefined;
+        }
+        try {
+            const parsed = JSON.parse(content);
+            return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+                ? parsed
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const hasPackageEntrypoint = async (moduleDirectoryPath) => {
+        const packageJson = await readPackageJsonIfExists(moduleDirectoryPath);
+        if (!packageJson) {
+            return false;
+        }
+        return ['main', 'module', 'browser', 'types', 'bin', 'exports'].some((field) => packageJson[field] !== undefined);
+    };
+    const hasKnownBoundaryRole = (moduleName) => {
+        const normalized = moduleName.toLowerCase();
+        const compact = normalized.replace(/[-_/]/gu, '');
+        const segments = normalized.split(/[/-]/u);
+        return ['adr', 'ci', 'compliance', 'config', 'governance', 'policy', 'validation', 'smartinit'].some((role) => compact.includes(role) || segments.includes(role));
+    };
+    const hasConfiguredPublicEntrypoint = (moduleName) => {
+        const publicEntrypoints = contract.modules[moduleName]?.publicEntrypoints;
+        return (Array.isArray(publicEntrypoints) &&
+            publicEntrypoints.some((entry) => typeof entry === 'string' && entry.trim().length > 0));
+    };
+    const hasIntentionalIndependentEvidence = async (moduleSummary, moduleDirectoryPath) => {
+        const sourceEvidence = await collectModuleSourceEvidence(moduleDirectoryPath);
+        return (moduleSummary.hasContract ||
+            hasConfiguredPublicEntrypoint(moduleSummary.module) ||
+            sourceEvidence.hasReadme ||
+            sourceEvidence.hasEntrypointFile ||
+            (await hasPackageEntrypoint(moduleDirectoryPath)) ||
+            moduleSummary.childModules.length > 0 ||
+            (moduleSummary.parentModule !== undefined &&
+                moduleSummary.childModules.length === 0 &&
+                sourceEvidence.sourceFileCount > 0) ||
+            hasKnownBoundaryRole(moduleSummary.module) ||
+            sourceEvidence.sourceFileCount >= 2);
+    };
+    for (const moduleSummary of dependencyGraphSummary.modules) {
+        if (isTestLikeModule(moduleSummary.module)) {
+            continue;
+        }
+        const registryEntry = contract.modules[moduleSummary.module];
+        if (!registryEntry?.path) {
+            continue;
+        }
+        const moduleDirectoryPath = path.join(workspaceRoot, ...registryEntry.path.split('/'));
+        const moduleDirectoryExists = await pathExists(moduleDirectoryPath);
+        if (!moduleDirectoryExists) {
+            continue;
+        }
+        const isIsolated = moduleSummary.declaredDependencies.length === 0 &&
+            moduleSummary.actualDependencies.length === 0 &&
+            moduleSummary.inboundDeclaredFrom.length === 0 &&
+            moduleSummary.inboundActualFrom.length === 0;
+        if (!isIsolated) {
+            continue;
+        }
+        if (await hasIntentionalIndependentEvidence(moduleSummary, moduleDirectoryPath)) {
+            continue;
+        }
+        isolatedResults.push({
+            id: exports.ValidationRuleIds.DEP_ISOLATED_MODULE_DETECTED,
+            severity: 'warning',
+            passed: false,
+            message: `Module '${moduleSummary.module}' is a potential orphan: it has no declared or actual inbound/outbound module dependencies and little evidence of intentional architectural use.`,
+            findingType: 'module-dependency',
+            module: moduleSummary.module,
+        });
+    }
+    if (isolatedResults.length > 0) {
+        return isolatedResults;
+    }
+    return [
+        {
+            id: exports.ValidationRuleIds.DEP_ISOLATED_MODULE_DETECTED,
+            severity: 'warning',
+            passed: true,
+            message: 'No potential orphan modules detected among registered modules with existing registry paths.',
+        },
+    ];
+}
+function canonicalizeTransitiveCycle(cycle) {
+    const uniqueNodes = cycle.slice(0, -1);
+    const rotations = uniqueNodes.map((_, index) => {
+        const rotated = [...uniqueNodes.slice(index), ...uniqueNodes.slice(0, index)];
+        return `${rotated.join('->')}->${rotated[0]}`;
+    });
+    return rotations.sort((left, right) => left.localeCompare(right))[0];
+}
+function detectTransitiveCyclesFromDependencySummary(dependencyGraphSummary) {
+    const moduleIds = dependencyGraphSummary.modules.map((entry) => entry.module);
+    const moduleIdSet = new Set(moduleIds);
+    const adjacency = new Map();
+    for (const moduleSummary of dependencyGraphSummary.modules) {
+        const neighbors = [
+            ...moduleSummary.declaredDependencies,
+            ...moduleSummary.actualDependencies,
+        ]
+            .filter((dependency) => moduleIdSet.has(dependency) && dependency !== moduleSummary.module)
+            .filter((dependency, index, values) => values.indexOf(dependency) === index)
+            .sort((left, right) => left.localeCompare(right));
+        adjacency.set(moduleSummary.module, neighbors);
+    }
+    const cycles = new Set();
+    const visited = new Set();
+    const stack = [];
+    const visit = (moduleId) => {
+        visited.add(moduleId);
+        stack.push(moduleId);
+        for (const neighbor of adjacency.get(moduleId) ?? []) {
+            const stackIndex = stack.indexOf(neighbor);
+            if (stackIndex !== -1) {
+                const cyclePath = [...stack.slice(stackIndex), neighbor];
+                const cycleNodeCount = cyclePath.length - 1;
+                if (cycleNodeCount >= 3) {
+                    cycles.add(canonicalizeTransitiveCycle(cyclePath));
+                }
+                continue;
+            }
+            if (!visited.has(neighbor)) {
+                visit(neighbor);
+            }
+        }
+        stack.pop();
+    };
+    for (const moduleId of [...moduleIds].sort((left, right) => left.localeCompare(right))) {
+        if (!visited.has(moduleId)) {
+            visit(moduleId);
+        }
+    }
+    return [...cycles].sort((left, right) => left.localeCompare(right));
+}
+function validateTransitiveModuleDependencyCycles(dependencyGraphSummary, validationConfig) {
+    if (isRuleDisabled(exports.ValidationRuleIds.DEP_TRANSITIVE_CIRCULAR_MODULE_DEPENDENCY, validationConfig)) {
+        return [];
+    }
+    const cycles = detectTransitiveCyclesFromDependencySummary(dependencyGraphSummary);
+    if (cycles.length === 0) {
+        return [
+            {
+                id: exports.ValidationRuleIds.DEP_TRANSITIVE_CIRCULAR_MODULE_DEPENDENCY,
+                severity: 'error',
+                passed: true,
+                message: 'No transitive circular module dependencies detected across declared and actual dependency edges.',
+            },
+        ];
+    }
+    return cycles.map((cycle) => ({
+        id: exports.ValidationRuleIds.DEP_TRANSITIVE_CIRCULAR_MODULE_DEPENDENCY,
+        severity: 'error',
+        passed: false,
+        message: `Transitive circular dependency detected: ${cycle.replaceAll('->', ' -> ')}.`,
+    }));
+}
+function resolveHighInboundDependencyThreshold(contract) {
+    const configured = contract.governance.validation?.highInboundDependencyWarningThreshold;
+    if (typeof configured !== 'number' || !Number.isInteger(configured) || configured < 1) {
+        return 3;
+    }
+    return configured;
+}
+function validateHighInboundDependencyCount(contract, dependencyGraphSummary, validationConfig) {
+    if (isRuleDisabled(exports.ValidationRuleIds.DEP_MODULE_HIGH_INBOUND_DEPENDENCY_COUNT, validationConfig)) {
+        return [];
+    }
+    const threshold = resolveHighInboundDependencyThreshold(contract);
+    const violations = dependencyGraphSummary.modules
+        .map((moduleSummary) => {
+        const declaredInboundCount = moduleSummary.inboundDeclaredFrom.length;
+        const actualInboundCount = moduleSummary.inboundActualFrom.length;
+        const effectiveInboundCount = Math.max(declaredInboundCount, actualInboundCount);
+        return {
+            moduleSummary,
+            declaredInboundCount,
+            actualInboundCount,
+            effectiveInboundCount,
+        };
+    })
+        .filter((entry) => entry.effectiveInboundCount >= threshold)
+        .sort((left, right) => left.moduleSummary.module.localeCompare(right.moduleSummary.module));
+    if (violations.length === 0) {
+        return [
+            {
+                id: exports.ValidationRuleIds.DEP_MODULE_HIGH_INBOUND_DEPENDENCY_COUNT,
+                severity: 'warning',
+                passed: true,
+                message: `No modules exceeded the inbound dependency threshold (${threshold}).`,
+            },
+        ];
+    }
+    return violations.map((entry) => ({
+        id: exports.ValidationRuleIds.DEP_MODULE_HIGH_INBOUND_DEPENDENCY_COUNT,
+        severity: 'warning',
+        passed: false,
+        message: `Module '${entry.moduleSummary.module}' has high inbound dependency count (${entry.effectiveInboundCount}). Declared inbound: ${entry.declaredInboundCount}. Actual inbound: ${entry.actualInboundCount}.`,
+        findingType: 'module-dependency',
+        module: entry.moduleSummary.module,
+    }));
+}
+async function readLayerRulesConfig(workspaceRoot) {
+    const layerRulesPath = path.join(workspaceRoot, '.archpilot', 'layer-rules.json');
+    const contents = await readTextFileIfExists(layerRulesPath);
+    if (!contents) {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(contents);
+    }
+    catch {
+        return {
+            layers: [],
+            moduleLayers: {},
+        };
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return {
+            layers: [],
+            moduleLayers: {},
+        };
+    }
+    const typedParsed = parsed;
+    const layersRaw = typedParsed.layers;
+    const moduleLayersRaw = typedParsed.moduleLayers;
+    const layers = Array.isArray(layersRaw)
+        ? layersRaw.filter((value) => typeof value === 'string')
+        : [];
+    const moduleLayers = moduleLayersRaw && typeof moduleLayersRaw === 'object' && !Array.isArray(moduleLayersRaw)
+        ? Object.entries(moduleLayersRaw)
+            .filter((entry) => typeof entry[1] === 'string')
+            .sort(([left], [right]) => left.localeCompare(right))
+            .reduce((accumulator, [moduleName, layer]) => {
+            accumulator[moduleName] = layer;
+            return accumulator;
+        }, {})
+        : {};
+    return {
+        layers,
+        moduleLayers,
+    };
+}
+function buildLayerDirectionAdjacency(dependencyGraphSummary) {
+    return new Map(dependencyGraphSummary.modules
+        .map((moduleSummary) => {
+        const combinedDependencies = [
+            ...moduleSummary.declaredDependencies,
+            ...moduleSummary.actualDependencies,
+        ]
+            .filter((dependency, index, values) => values.indexOf(dependency) === index)
+            .sort((left, right) => left.localeCompare(right));
+        return [moduleSummary.module, combinedDependencies];
+    })
+        .sort(([left], [right]) => left.localeCompare(right)));
+}
+async function validateDependencyLayerDirection(workspaceRoot, dependencyGraphSummary, validationConfig) {
+    if (isRuleDisabled(exports.ValidationRuleIds.DEP_LAYER_DIRECTION_VIOLATION, validationConfig)) {
+        return [];
+    }
+    const layerRules = await readLayerRulesConfig(workspaceRoot);
+    if (!layerRules) {
+        return [
+            {
+                id: exports.ValidationRuleIds.DEP_LAYER_DIRECTION_VIOLATION,
+                severity: 'info',
+                passed: false,
+                message: "Layer direction validation skipped: .archpilot/layer-rules.json is missing. Run 'ArchPilot: Initialize Architecture' to generate default layer rules.",
+            },
+        ];
+    }
+    if (layerRules.layers.length === 0) {
+        return [
+            {
+                id: exports.ValidationRuleIds.DEP_LAYER_DIRECTION_VIOLATION,
+                severity: 'error',
+                passed: false,
+                message: 'Layer direction validation configuration is invalid: .archpilot/layer-rules.json must define a non-empty layers array.',
+            },
+        ];
+    }
+    const layerOrder = new Map(layerRules.layers.map((layer, index) => [layer, index]));
+    const adjacency = buildLayerDirectionAdjacency(dependencyGraphSummary);
+    const violations = [];
+    for (const [sourceModule, targets] of adjacency.entries()) {
+        const sourceLayer = layerRules.moduleLayers[sourceModule];
+        if (!sourceLayer || !layerOrder.has(sourceLayer)) {
+            continue;
+        }
+        for (const targetModule of targets) {
+            const targetLayer = layerRules.moduleLayers[targetModule];
+            if (!targetLayer || !layerOrder.has(targetLayer)) {
+                continue;
+            }
+            const sourceLayerIndex = layerOrder.get(sourceLayer) ?? 0;
+            const targetLayerIndex = layerOrder.get(targetLayer) ?? 0;
+            if (targetLayerIndex >= sourceLayerIndex) {
+                continue;
+            }
+            violations.push({
+                id: exports.ValidationRuleIds.DEP_LAYER_DIRECTION_VIOLATION,
+                severity: 'error',
+                passed: false,
+                message: `Module '${sourceModule}' (${sourceLayer} layer) depends on '${targetModule}' (${targetLayer} layer), which violates architecture layering.`,
+                findingType: 'module-dependency',
+                module: sourceModule,
+                target: targetModule,
+            });
+        }
+    }
+    if (violations.length === 0) {
+        return [
+            {
+                id: exports.ValidationRuleIds.DEP_LAYER_DIRECTION_VIOLATION,
+                severity: 'error',
+                passed: true,
+                message: 'No architecture layer direction dependency violations detected.',
+            },
+        ];
+    }
+    return violations.sort((left, right) => left.message.localeCompare(right.message));
+}
+async function validateModuleContractRegistryIntegrity(workspaceRoot, contract, validationConfig) {
+    const moduleContractRuleChecks = {
+        checkRegistryPathExists: !isRuleDisabled(exports.ValidationRuleIds.ARCH_MODULE_REGISTRY_PATH_EXISTS, validationConfig),
+        checkContractFileExists: !isRuleDisabled(exports.ValidationRuleIds.ARCH_MODULE_CONTRACT_FILE_EXISTS, validationConfig),
+        checkContractIdentityMatchesRegistry: !isRuleDisabled(exports.ValidationRuleIds.ARCH_MODULE_CONTRACT_IDENTITY_MATCHES_REGISTRY, validationConfig),
+        checkPublicEntrypointsAligned: !isRuleDisabled(exports.ValidationRuleIds.ARCH_MODULE_PUBLIC_ENTRYPOINTS_ALIGNED, validationConfig),
+    };
+    const findings = await (0, moduleContractValidation_1.validateModuleContractIntegrity)(workspaceRoot, contract, moduleContractRuleChecks);
+    const results = [];
+    for (const finding of findings) {
+        if (!finding.filePath) {
+            results.push(finding.result);
+            continue;
+        }
+        const resultWithSource = {
+            ...finding.result,
+            sourceFile: finding.filePath,
+            filePath: finding.filePath,
+            ...(finding.line !== undefined ? { sourceLine: finding.line } : {}),
+        };
+        results.push(resultWithSource);
+    }
+    return results;
+}
+async function validateImplementationProfile(config, validationConfig) {
+    const results = [];
+    const normalizedProfile = config.implementationProfile.trim().toLowerCase();
+    const supportedProfileMatchers = [
+        /^typescript-backend$/u,
+        /^java-spring$/u,
+        /^spring-backend$/u,
+        /^backend-spring(?:-.+)?$/u,
+        /^backend-nestjs(?:-.+)?$/u,
+        /^python-fastapi$/u,
+        /^backend-fastapi(?:-.+)?$/u,
+        /^dotnet-webapi$/u,
+        /^php-laravel$/u,
+        /^backend-laravel(?:-.+)?$/u,
+        /^go-backend$/u,
+    ];
+    const isSupportedProfile = supportedProfileMatchers.some((matcher) => matcher.test(normalizedProfile));
+    if (!isSupportedProfile &&
+        !isRuleDisabled(exports.ValidationRuleIds.ARCH_PROFILE_NOT_FULLY_SUPPORTED, validationConfig)) {
+        results.push({
+            id: exports.ValidationRuleIds.ARCH_PROFILE_NOT_FULLY_SUPPORTED,
+            severity: 'info',
+            passed: true,
+            message: `Implementation profile '${config.implementationProfile}' has limited dedicated analyzer support in this release.`,
+        });
+    }
+    return results;
+}
+const architectureReviewSignalRulePrefixes = ['AP-APP-', 'AP-DOM-', 'AP-TXN-'];
+function isArchitectureReviewSignalRule(ruleId) {
+    return architectureReviewSignalRulePrefixes.some((prefix) => ruleId.startsWith(prefix));
+}
+function formatFindingMessageSections(ruleId, message, indent = '  ') {
+    const nPlusOneMatch = /^(.+?without clear batching evidence\.)\s+Affected methods:\s+(.+?)\.\s+Repository\/model families:\s+(.+?)\.\s+Loop query evidence:\s+(.+?)\.\s+Risk instances:\s+(\d+)\.?$/u.exec(message);
+    if (ruleId === exports.ValidationRuleIds.DQR_N_PLUS_ONE_QUERY_EVIDENCE && nPlusOneMatch) {
+        const [, summary, methods, repositories, evidence, instances] = nPlusOneMatch;
+        return [
+            `${indent}- Details: ${summary}`,
+            `${indent}- Affected methods:`,
+            ...methods.split(/,\s*/u).filter(Boolean).map((value) => `${indent}  - ${value}`),
+            `${indent}- Repository/model families:`,
+            ...repositories
+                .split(/,\s*/u)
+                .filter(Boolean)
+                .map((value) => `${indent}  - ${value}`),
+            `${indent}- Risk instances: ${instances}`,
+            `${indent}- Loop query evidence:`,
+            ...evidence.split(/,\s*/u).filter(Boolean).map((value) => `${indent}  - ${value}`),
+        ];
+    }
+    const repeatedQueryMatch = /^Repeated query pattern:\s+method '(.+?)' performs the same '(.+?)' query (\d+) times in one flow\.$/u.exec(message);
+    if (ruleId === exports.ValidationRuleIds.DQR_REPEATED_QUERY_PATTERN && repeatedQueryMatch) {
+        const [, methodName, queryLabel, duplicateReads] = repeatedQueryMatch;
+        return [
+            `${indent}- Details: Repeated query detected in one request flow.`,
+            `${indent}- Repeated query:`,
+            `${indent}  - Method: ${methodName}`,
+            `${indent}  - Query: ${queryLabel}`,
+            `${indent}  - Duplicate reads: ${duplicateReads}`,
+        ];
+    }
+    const oversizedMatch = /^(.*?)\s+\((loc=\d+.*)\)\.?$/u.exec(message);
+    if (oversizedMatch && (ruleId === exports.ValidationRuleIds.APP_SERVICE_GOD_CLASS || ruleId === exports.ValidationRuleIds.DOM_OVERSIZED_AGGREGATE_OR_SERVICE_BOUNDARY)) {
+        const [, summary, metrics] = oversizedMatch;
+        const metricMap = new Map(metrics.split(/,\s*/u).map((entry) => {
+            const [key, value] = entry.split('=', 2);
+            return [key?.trim() ?? '', value?.trim() ?? ''];
+        }));
+        const metricLines = [
+            ['Lines of code', formatMetricNumber(metricMap.get('loc'))],
+            ['Methods', metricMap.get('methods')],
+            ['Collaborators', metricMap.get('collaborators')],
+            ['Repository collaborators', metricMap.get('repositories')],
+            ['Persistence calls', metricMap.get('persistence')],
+            [
+                'Database signals',
+                metricMap.get('db')?.split('|').filter(Boolean).join(', '),
+            ],
+            [
+                'External systems',
+                metricMap.get('external')?.split('|').filter(Boolean).join(', '),
+            ],
+        ].filter(([, value]) => value && value.length > 0);
+        return [
+            `${indent}- Details: ${summary}`,
+            `${indent}- Metrics:`,
+            ...metricLines.map(([label, value]) => `${indent}  - ${label}: ${value}`),
+        ];
+    }
+    return [`${indent}- Details: ${message}`];
+}
+function formatMetricNumber(value) {
+    if (!value || !/^\d+$/u.test(value)) {
+        return value;
+    }
+    return Number(value).toLocaleString('en-US');
+}
+function collectValidationGroupDetails(entries) {
+    const files = [...new Set(entries
+            .map((entry) => entry.sourceFile)
+            .filter((value) => typeof value === 'string' && value.length > 0))].sort((left, right) => left.localeCompare(right));
+    const tables = [...new Set(entries
+            .map((entry) => entry.table)
+            .filter((value) => typeof value === 'string' && value.length > 0))].sort((left, right) => left.localeCompare(right));
+    const apis = [...new Set(entries
+            .map((entry) => entry.api)
+            .filter((value) => typeof value === 'string' && value.length > 0))].sort((left, right) => left.localeCompare(right));
+    const modules = [...new Set(entries
+            .map((entry) => entry.module)
+            .filter((value) => typeof value === 'string' && value.length > 0))].sort((left, right) => left.localeCompare(right));
+    const targets = [...new Set(entries
+            .map((entry) => entry.target)
+            .filter((value) => typeof value === 'string' && value.length > 0))].sort((left, right) => left.localeCompare(right));
+    return { files, tables, apis, modules, targets };
+}
+function formatValidationMessageGroup(ruleId, entries, indent = '  ') {
+    const first = entries[0];
+    if (!first) {
+        return [];
+    }
+    const lines = formatFindingMessageSections(ruleId, first.message, indent);
+    if (entries.length > 1) {
+        lines.push(`${indent}- Occurrences: ${entries.length}`);
+    }
+    const details = collectValidationGroupDetails(entries);
+    if (details.files.length > 0) {
+        lines.push(`${indent}- Affected files:`);
+        for (const file of details.files) {
+            lines.push(`${indent}  - ${file}`);
+        }
+    }
+    if (details.tables.length > 0) {
+        lines.push(`${indent}- Affected tables:`);
+        for (const table of details.tables) {
+            lines.push(`${indent}  - ${table}`);
+        }
+    }
+    if (details.apis.length > 0) {
+        lines.push(`${indent}- Affected APIs:`);
+        for (const api of details.apis) {
+            lines.push(`${indent}  - ${api}`);
+        }
+    }
+    if (details.modules.length > 0) {
+        lines.push(`${indent}- Affected modules:`);
+        for (const moduleName of details.modules) {
+            lines.push(`${indent}  - ${moduleName}`);
+        }
+    }
+    if (details.targets.length > 0) {
+        lines.push(`${indent}- Affected targets:`);
+        for (const targetName of details.targets) {
+            lines.push(`${indent}  - ${targetName}`);
+        }
+    }
+    return lines;
+}
+function groupValidationResultsByRule(items) {
+    const groups = new Map();
+    for (const item of items) {
+        const group = groups.get(item.id);
+        if (group) {
+            group.push(item);
+        }
+        else {
+            groups.set(item.id, [item]);
+        }
+    }
+    return [...groups.values()];
+}
+function buildValidationReportMarkdown(config, results, validationConfig, suppressedResults, approvedExceptions, ignoredSuppressions, suppressionEntriesFound, exceptionEntriesFound, driftSummary, dependencyGraphSummary, suppressionSummary, timestampIso, discoveredAdrs, healthTrend, healthHistoryRecent) {
+    const buildDefaultWhyItMatters = (category) => {
+        switch (category) {
+            case 'architecture':
+                return 'Architecture structure rules keep module boundaries explicit and reduce drift over time.';
+            case 'dependency':
+                return 'Dependency rules prevent hidden coupling and keep architecture impact predictable.';
+            case 'api':
+                return 'API rules keep service contracts explicit for consumers and reviewers.';
+            case 'database':
+                return 'Database rules protect consistency, tenant boundaries, and long-term maintainability.';
+            case 'documentation':
+                return 'Documentation rules preserve architectural decisions and operational context.';
+            case 'security':
+                return 'Security rules help keep architecture controls explicit and enforceable.';
+            default:
+                return 'This rule helps keep implementation aligned with declared architecture.';
+        }
+    };
+    const buildDefaultDocumentationHint = (category) => {
+        switch (category) {
+            case 'architecture':
+                return '.archpilot/architecture.json and docs/architecture/overview.md';
+            case 'dependency':
+                return '.archpilot/dependency-rules.json and module contracts';
+            case 'api':
+                return 'contracts/openapi.yaml';
+            case 'database':
+                return 'db/sql/001_init.sql';
+            case 'documentation':
+                return 'docs/architecture/overview.md and docs/adrs/';
+            case 'security':
+                return 'docs/architecture/overview.md';
+            default:
+                return 'docs/architecture/overview.md';
+        }
+    };
+    const passed = results.filter((r) => r.passed);
+    const errors = results.filter((r) => !r.passed && r.severity === 'error');
+    const architectureReviewSignals = results.filter((r) => !r.passed && r.severity === 'warning' && isArchitectureReviewSignalRule(r.id));
+    const warnings = results.filter((r) => !r.passed && r.severity === 'warning' && !isArchitectureReviewSignalRule(r.id));
+    const infos = results.filter((r) => !r.passed && r.severity === 'info');
+    const disabledRules = buildDisabledRuleDetails(validationConfig.disabledRuleIds);
+    const sortedSuppressedResults = sortSuppressedResults(suppressedResults);
+    const summary = buildValidationStatusSummary(results, disabledRules.length, sortedSuppressedResults.length, approvedExceptions.length, ignoredSuppressions.length);
+    const summaryLines = [
+        `- Project: ${config.projectName}`,
+        `- Timestamp (UTC): ${timestampIso}`,
+        `- Architecture health score: ${summary.healthScore} / 100`,
+        `- Setup readiness score: ${summary.readinessScore} / 100`,
+        `- ${(0, architectureHealthHistoryReporter_1.formatArchitectureHealthTrendLine)(healthTrend)}`,
+        `- Total checks: ${summary.totalRulesEvaluated}`,
+        `- Disabled rules: ${summary.disabled}`,
+        `- Suppressions file: ${(0, validationSuppressions_1.getSuppressionsFilePathLabel)()}`,
+        `- Suppression entries found: ${suppressionEntriesFound}`,
+        `- Suppressed results: ${summary.suppressed}`,
+        `- Exceptions file: .archpilot/exceptions.json`,
+        `- Exception entries found: ${exceptionEntriesFound}`,
+        `- Approved exceptions applied: ${summary.exceptions}`,
+        `- Ignored suppression entries: ${summary.ignoredSuppressions}`,
+        ...(suppressionSummary
+            ? [
+                `- Active suppressions: ${suppressionSummary.activeSuppressions}`,
+                `- Expired suppressions: ${suppressionSummary.expiredSuppressions}`,
+                `- Unused suppressions: ${suppressionSummary.unusedSuppressions}`,
+                `- Findings suppressed in this run: ${suppressionSummary.findingsSuppressed}`,
+            ]
+            : []),
+        `- Errors: ${summary.errors}`,
+        `- Warnings: ${summary.warnings}`,
+        `- Info: ${summary.info}`,
+        `- Architecture findings: ${summary.qualityFindings}`,
+        `- Setup gaps: ${summary.setupGaps}`,
+        `- Guidance findings: ${summary.guidanceFindings}`,
+        `- Passed: ${summary.passed}`,
+        `- Policy: ${getValidationSeverityPolicyNote()}`,
+    ];
+    const categoryLabel = {
+        architecture: 'Architecture',
+        dependency: 'Dependency',
+        api: 'API',
+        database: 'Database',
+        documentation: 'Documentation',
+        security: 'Security',
+    };
+    const healthCategoryLines = Object.entries(summary.categoryScores)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([category, score]) => `- ${categoryLabel[category] ?? category}: ${score} / 100`);
+    const normalizedFindingLines = [
+        `- Raw findings: ${summary.rawFindingCount}`,
+        `- Normalized findings: ${summary.normalizedFindingCount}`,
+        `- Duplicate reduction: ${summary.duplicateReductionCount}`,
+    ];
+    const architectureSignalSummaryLines = [
+        `- Heuristic architecture smell findings: ${summary.architectureSmellSummary.count}`,
+        `- Explanation: ${summary.architectureSmellSummary.explanation}`,
+        ...(summary.architectureSmellSummary.ruleFamilies.length === 0
+            ? ['- Families: (none)']
+            : summary.architectureSmellSummary.ruleFamilies.map((family) => `- ${family.family}: ${family.count} (${family.rules
+                .map((rule) => `${rule.ruleId}=${rule.count}`)
+                .join(', ')})`)),
+    ];
+    const scoreExplanationLines = [
+        `- Errors: ${summary.scoreExplanation.errors}`,
+        `- Warnings: ${summary.scoreExplanation.warnings}`,
+        `- Heuristic warnings: ${summary.scoreExplanation.heuristicWarnings}`,
+        `- Weighted base health: ${summary.scoreExplanation.weightedBaseScore} / 100`,
+        `- Applicable category weights: ${summary.scoreExplanation.applicableCategoryScores
+            .map((entry) => `${categoryLabel[entry.category] ?? entry.category}=${entry.score} x ${Math.round(entry.weight * 100)}%`)
+            .join(', ') || '(none)'}`,
+        `- Highest-impact categories: ${summary.scoreExplanation.highestImpactCategories
+            .map((entry) => `${categoryLabel[entry.category] ?? entry.category}=${entry.score}`)
+            .join(', ') || '(none)'}`,
+        `- Why score changed: ${summary.scoreExplanation.whyScoreChanged}`,
+    ];
+    const healthHistoryLines = healthHistoryRecent.length === 0
+        ? ['- (none)']
+        : [...healthHistoryRecent]
+            .sort((left, right) => left.generatedAtUtc.localeCompare(right.generatedAtUtc))
+            .map((snapshot) => `- ${snapshot.generatedAtUtc} | ${snapshot.overallScore}`);
+    const readinessCategoryLines = Object.entries(summary.readinessCategoryScores)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([category, score]) => `- ${categoryLabel[category] ?? category}: ${score} / 100`);
+    const formatResultLines = (items) => {
+        if (items.length === 0) {
+            return ['- (none)'];
+        }
+        const lines = [];
+        for (const group of groupValidationResultsByRule(items)) {
+            const first = group[0];
+            if (!first) {
+                continue;
+            }
+            const meta = getValidationRuleMetadataById(first.id);
+            const classification = classifyValidationResult(first);
+            const relatedAdrs = [...(meta.relatedAdrs ?? [])]
+                .map((adrId) => adrId.trim().toUpperCase())
+                .filter((adrId) => adrId.length > 0)
+                .sort((left, right) => left.localeCompare(right))
+                .map((adrId) => {
+                const found = discoveredAdrs.find((discoveredAdr) => discoveredAdr.id.toUpperCase() === adrId);
+                return {
+                    id: adrId,
+                    title: found?.title ?? '(not found)',
+                    filePath: found?.filePath,
+                    found: !!found,
+                };
+            });
+            lines.push(`- [${meta.id}] ${meta.title}${group.length > 1 ? ` (${group.length} findings)` : ''}`);
+            lines.push(`  - Category: ${categoryLabel[meta.category] ?? meta.category}`);
+            if (first.passed) {
+                lines.push('  - Status: Passed');
+            }
+            else {
+                lines.push(`  - Severity: ${first.severity}`);
+                lines.push(`  - Classification: ${isArchitectureReviewSignalRule(first.id)
+                    ? 'Architecture Review Signal'
+                    : classification.kind}`);
+            }
+            const groupedMessages = new Map();
+            for (const item of group) {
+                groupedMessages.set(item.message, (groupedMessages.get(item.message) ?? 0) + 1);
+            }
+            if (groupedMessages.size === 1) {
+                lines.push(...formatValidationMessageGroup(first.id, group));
+            }
+            else {
+                lines.push('  - Findings:');
+                for (const detailMessage of [...groupedMessages.keys()].sort((left, right) => left.localeCompare(right))) {
+                    lines.push(...formatValidationMessageGroup(first.id, group.filter((item) => item.message === detailMessage), '    '));
+                }
+            }
+            if (!first.passed) {
+                lines.push(`  - Recommended fix: ${meta.recommendedFix}`);
+                lines.push(`  - Why this matters: ${meta.whyItMatters ?? buildDefaultWhyItMatters(meta.category)}`);
+                lines.push(`  - How to fix: ${meta.howToFix ?? meta.recommendedFix}`);
+                lines.push(`  - Example: ${meta.exampleFix ?? 'Update the affected architecture artifact or implementation path so the rule expectation is met.'}`);
+                lines.push(`  - Documentation hint: ${meta.documentationHint ?? buildDefaultDocumentationHint(meta.category)}`);
+                if (relatedAdrs.length > 0) {
+                    lines.push('  - Related ADRs:');
+                    for (const adr of relatedAdrs) {
+                        lines.push(`    - ${adr.id} ${adr.title}${adr.filePath ? ` (${adr.filePath})` : ''}${adr.found ? '' : ' (not found)'}`);
+                    }
+                }
+                if (group.some((item) => item.quickFix?.available)) {
+                    const quickFix = group.find((item) => item.quickFix?.available)?.quickFix;
+                    lines.push('  - Quick Fix:');
+                    lines.push('    - Available: Yes');
+                    if (quickFix) {
+                        lines.push(`    - Type: ${quickFix.type}`);
+                        lines.push(`    - Description: ${quickFix.description}`);
+                    }
+                }
+            }
+        }
+        return lines;
+    };
+    const passedLines = formatResultLines(passed);
+    const errorLines = formatResultLines(errors);
+    const architectureReviewSignalLines = formatResultLines(architectureReviewSignals);
+    const warningLines = formatResultLines(warnings);
+    const infoLines = formatResultLines(infos);
+    const disabledRuleLines = disabledRules.length === 0
+        ? ['- (none)']
+        : disabledRules.map((rule) => `- ${rule.id} | ${rule.title}`);
+    const appliedOverrideLines = validationConfig.appliedSeverityOverrides.length === 0
+        ? ['- (none)']
+        : validationConfig.appliedSeverityOverrides.map((override) => `- ${override.id}: ${override.from} -> ${override.to}`);
+    const ignoredConfigLines = validationConfig.ignoredEntries.length === 0
+        ? ['- (none)']
+        : validationConfig.ignoredEntries.map((entry) => {
+            const requestedSeverity = entry.requestedSeverity
+                ? ` | requested=${entry.requestedSeverity}`
+                : '';
+            return `- ${entry.kind} | ${entry.id}${requestedSeverity} | ${entry.reason}`;
+        });
+    const suppressedResultLines = sortedSuppressedResults.length === 0
+        ? ['- (none)']
+        : sortedSuppressedResults.map((result) => {
+            const lineSuffix = result.line !== undefined ? `:${result.line}` : '';
+            const reasonLine = result.suppressionReason
+                ? `\n  - Reason: ${result.suppressionReason}`
+                : '';
+            return `- [${result.id}] suppressed for ${result.filePath}${lineSuffix}\n  - Matched suppression path: ${result.suppressionPath}${reasonLine}`;
+        });
+    const approvedExceptionLines = approvedExceptions.length === 0
+        ? ['- (none)']
+        : [...approvedExceptions]
+            .sort((left, right) => {
+            const ruleCompare = left.ruleId.localeCompare(right.ruleId);
+            if (ruleCompare !== 0) {
+                return ruleCompare;
+            }
+            const moduleCompare = (left.module ?? '').localeCompare(right.module ?? '');
+            if (moduleCompare !== 0) {
+                return moduleCompare;
+            }
+            const targetCompare = (left.target ?? '').localeCompare(right.target ?? '');
+            if (targetCompare !== 0) {
+                return targetCompare;
+            }
+            const filePathCompare = (left.filePath ?? '').localeCompare(right.filePath ?? '');
+            if (filePathCompare !== 0) {
+                return filePathCompare;
+            }
+            const tableCompare = (left.table ?? '').localeCompare(right.table ?? '');
+            if (tableCompare !== 0) {
+                return tableCompare;
+            }
+            const apiCompare = (left.api ?? '').localeCompare(right.api ?? '');
+            if (apiCompare !== 0) {
+                return apiCompare;
+            }
+            return left.reason.localeCompare(right.reason);
+        })
+            .map((entry) => {
+            return [
+                `- Rule ID: ${entry.ruleId}`,
+                `  - Module: ${entry.module ?? '(any)'}`,
+                `  - Target: ${entry.target ?? '(any)'}`,
+                `  - File Path: ${entry.filePath ?? '(any)'}`,
+                `  - Table: ${entry.table ?? '(any)'}`,
+                `  - API: ${entry.api ?? '(any)'}`,
+                `  - Reason: ${entry.reason}`,
+                `  - Approved By: ${entry.approvedBy}`,
+                `  - Expires At: ${entry.expiresAt ?? '(none)'}`,
+            ].join('\n');
+        });
+    const ignoredSuppressionLines = ignoredSuppressions.length === 0
+        ? ['- (none)']
+        : ignoredSuppressions.map((entry) => {
+            const ruleId = entry.ruleId ?? '(missing ruleId)';
+            const entryPath = entry.path ?? '(missing path)';
+            return `- #${entry.index} | ${ruleId} | ${entryPath} | ${entry.reason ?? 'ignored'}`;
+        });
+    const formatDependencyList = (values) => values.length === 0 ? 'none' : values.join(', ');
+    const dependencyGraphLines = dependencyGraphSummary.modules.length === 0
+        ? ['- (none)']
+        : dependencyGraphSummary.modules.flatMap((entry) => [
+            `- ${entry.module}`,
+            `  - Contract: ${entry.hasContract ? 'present' : 'missing or invalid'}`,
+            `  - Declared: ${formatDependencyList(entry.declaredDependencies)}`,
+            `  - Actual: ${formatDependencyList(entry.actualDependencies)}`,
+            `  - Unused declared: ${formatDependencyList(entry.unusedDeclaredDependencies)}`,
+            `  - Undeclared actual: ${formatDependencyList(entry.undeclaredActualDependencies)}`,
+            `  - Inbound declared from: ${formatDependencyList(entry.inboundDeclaredFrom)}`,
+            `  - Inbound actual from: ${formatDependencyList(entry.inboundActualFrom)}`,
+        ]);
+    const suggestedNextActions = errors.length === 0 && warnings.length === 0
+        ? [
+            '- Keep configuration and documentation in sync as the system evolves.',
+            '- Add additional checks as new architecture decisions are made.',
+        ]
+        : errors.length > 0
+            ? [
+                '- Resolve all error-level architecture, API, and database violations before considering the system aligned with the selected architecture.',
+                '- After errors are resolved, address warning-level documentation and advisory findings.',
+                '- Consider adding automated tests or CI checks that enforce these rules.',
+            ]
+            : [
+                '- Review each warning and decide whether the configuration or implementation should change.',
+                '- Update documentation (ADRs, overview, contracts) to match the current system.',
+                '- Consider adding automated tests or CI checks that enforce these rules.',
+            ];
+    if (summary.setupGaps > 0) {
+        suggestedNextActions.unshift('- Run `archpilot bootstrap --with-contracts` to close setup gaps quickly.');
+    }
+    const catalogLines = getAllValidationRuleMetadata().map((meta) => `- ${meta.id} | ${meta.title} | ${meta.category} | ${meta.defaultSeverity}`);
+    return `# ArchPilot Architecture Validation Report
+
+## Architecture Health Score
+- Overall Score: ${summary.healthScore} / 100
+- ${(0, architectureHealthHistoryReporter_1.formatArchitectureHealthTrendLine)(healthTrend)}
+- Total Checks: ${summary.totalRulesEvaluated}
+- Errors: ${summary.errors}
+- Warnings: ${summary.warnings}
+- Passed: ${summary.passed}
+
+## Score Explanation
+${scoreExplanationLines.join('\n')}
+
+## Largest Score Contributors
+${summary.scoreExplanation.largestScoreContributors.length === 0
+        ? '- (none)'
+        : summary.scoreExplanation.largestScoreContributors.map((entry) => `- ${entry}`).join('\n')}
+
+## Architecture Drift
+${driftSummary.message}
+
+## Category Breakdown
+${healthCategoryLines.join('\n')}
+
+## Setup Readiness Category Breakdown
+${readinessCategoryLines.join('\n')}
+
+## Recent Health Snapshots
+${healthHistoryLines.join('\n')}
+
+## Summary
+${summaryLines.join('\n')}
+
+## Normalized Finding Context
+${normalizedFindingLines.join('\n')}
+
+## Architecture Review Signals
+${architectureSignalSummaryLines.join('\n')}
+${architectureReviewSignalLines.join('\n')}
+
+## Errors
+${errorLines.join('\n')}
+
+## Warnings
+${warningLines.join('\n')}
+
+## Informational Checks
+${infoLines.join('\n')}
+
+## Passed Checks
+${passedLines.join('\n')}
+
+## Module Dependency Summary
+${dependencyGraphLines.join('\n')}
+
+## Disabled Rules
+${disabledRuleLines.join('\n')}
+
+## Severity Overrides Applied
+${appliedOverrideLines.join('\n')}
+
+## Ignored Config Entries
+${ignoredConfigLines.join('\n')}
+
+## Suppressed Results
+${suppressedResultLines.join('\n')}
+
+## Approved Exceptions
+${approvedExceptionLines.join('\n')}
+
+## Ignored Suppression Entries
+${ignoredSuppressionLines.join('\n')}
+
+## Suggested Next Actions
+${suggestedNextActions.map((line) => `${line}`).join('\n')}
+
+## Rule Catalog Reference
+${catalogLines.join('\n')}
+`;
+}
+async function writeValidationReport(workspaceRoot, config, results, validationConfig, suppressedResults, approvedExceptions, ignoredSuppressions, suppressionEntriesFound, exceptionEntriesFound, driftSummary, dependencyGraphSummary, suppressionSummary, suppressionEntries, adrSummary, policyStatus, options) {
+    const timestampIso = new Date().toISOString();
+    const discoveredAdrs = await (0, validationProfiling_1.profileValidationPhase)('report generation ADR discovery', () => (0, discoverAdrs_1.discoverAdrs)(workspaceRoot));
+    const reportDir = path.join(workspaceRoot, '.archpilot');
+    const reportPath = path.join(reportDir, 'validation-report.md');
+    const statusPath = path.join(reportDir, 'validation-status.json');
+    const statusExport = await (0, validationProfiling_1.profileValidationPhase)('scoring', () => Promise.resolve(buildValidationStatusExport(config, results, validationConfig, suppressedResults, approvedExceptions, ignoredSuppressions, suppressionEntriesFound, exceptionEntriesFound, driftSummary, dependencyGraphSummary, suppressionSummary, suppressionEntries, policyStatus, adrSummary)), (result) => [
+        { name: 'results', value: result.results.length },
+        { name: 'healthScore', value: result.summary.healthScore },
+    ]);
+    statusExport.xArchPilot = await (0, validationProfiling_1.profileValidationPhase)('managed metadata generation', () => (0, managedArtifacts_1.buildManagedMetadata)('validation-status', timestampIso));
+    let healthTrend = {
+        currentScore: statusExport.summary.healthScore,
+        trendDirection: 'no-history',
+    };
+    let driftComparison = {
+        hasPreviousSnapshot: false,
+        newViolations: [],
+        resolvedViolations: [],
+    };
+    let healthHistoryRecent = [];
+    const previousDriftSnapshot = await (0, validationProfiling_1.profileValidationPhase)('history/artifact read', () => (0, driftSnapshotLoader_1.loadLatestDriftSnapshot)(workspaceRoot));
+    const currentDriftSnapshot = buildDriftSnapshot(timestampIso, statusExport);
+    driftComparison = (0, driftComparator_1.compareDriftSnapshots)(previousDriftSnapshot, currentDriftSnapshot);
+    healthTrend = (0, architectureHealthHistory_1.buildArchitectureHealthTrendFromSnapshotScores)(statusExport.summary.healthScore, driftComparison.previousScore);
+    const snapshot = (0, architectureHealthHistory_1.createArchitectureHealthSnapshot)({
+        generatedAtUtc: timestampIso,
+        overallScore: statusExport.summary.healthScore,
+        categoryScores: statusExport.summary.categoryScores,
+        totalChecks: statusExport.summary.totalRulesEvaluated,
+        errors: statusExport.summary.errors,
+        warnings: statusExport.summary.warnings,
+        info: statusExport.summary.info,
+        passed: statusExport.summary.passed,
+    });
+    try {
+        const appended = await (0, validationProfiling_1.profileValidationPhase)('badge/history/artifact writing health history', () => (0, architectureHealthHistory_1.appendArchitectureHealthSnapshot)(workspaceRoot, snapshot, {
+            maxSnapshots: 100,
+        }));
+        healthHistoryRecent = [...appended.history.snapshots]
+            .sort((left, right) => left.generatedAtUtc.localeCompare(right.generatedAtUtc))
+            .slice(-5);
+    }
+    catch {
+        healthHistoryRecent = [snapshot];
+    }
+    try {
+        await (0, validationProfiling_1.profileValidationPhase)('badge/history/artifact writing drift snapshot', () => (0, driftSnapshotWriter_1.writeLatestDriftSnapshot)(workspaceRoot, currentDriftSnapshot));
+    }
+    catch {
+        // Ignore snapshot persistence failures so validation behavior remains stable.
+    }
+    statusExport.summary = {
+        ...statusExport.summary,
+        healthTrend,
+        healthHistoryRecent,
+    };
+    statusExport.driftComparison = driftComparison;
+    try {
+        const violationCount = results.filter((result) => {
+            if (result.passed) {
+                return false;
+            }
+            return classifyValidationResult(result).kind === 'violation';
+        }).length;
+        const changeRisk = (0, changeRiskAssessment_1.assessChangeRisk)({
+            errorCount: statusExport.summary.errors,
+            warningCount: statusExport.summary.warnings,
+            crossModuleDependencyViolations: results.filter((result) => !result.passed && result.id.startsWith('AP-DEP-')).length,
+            diffContextAvailable: false,
+        });
+        const summaryRiskLevel = toTimelineRiskLevelFromValidationSummary(statusExport.summary);
+        const snapshot = (0, architectureDriftTimeline_1.createArchitectureDriftTimelineSnapshot)({
+            timestampUtcIso: timestampIso,
+            architectureScore: statusExport.summary.healthScore,
+            setupReadinessScore: statusExport.summary.readinessScore,
+            moduleCount: statusExport.dependencyGraphSummary.modules.length,
+            edgeCount: statusExport.dependencyGraphSummary.modules.reduce((total, moduleEntry) => total + moduleEntry.actualDependencies.length, 0),
+            errorCount: statusExport.summary.errors,
+            warningCount: statusExport.summary.warnings,
+            infoCount: statusExport.summary.info,
+            passedCount: statusExport.summary.passed,
+            driftDetected: statusExport.drift.detected,
+            violationCount,
+            changeRiskLevel: changeRisk.riskLevel.toUpperCase(),
+            governanceRiskLevel: summaryRiskLevel,
+            enforcementOutcome: toTimelineEnforcementOutcomeFromValidationSummary(statusExport.summary),
+        });
+        await (0, validationProfiling_1.profileValidationPhase)('badge/history/artifact writing drift timeline', () => (0, architectureDriftTimeline_1.writeArchitectureDriftTimelineSnapshot)(workspaceRoot, snapshot));
+    }
+    catch {
+        // Ignore timeline snapshot failures so validation execution remains stable.
+    }
+    const report = await (0, validationProfiling_1.profileValidationPhase)('report generation markdown render', () => Promise.resolve(buildValidationReportMarkdown(config, results, validationConfig, suppressedResults, approvedExceptions, ignoredSuppressions, suppressionEntriesFound, exceptionEntriesFound, driftSummary, dependencyGraphSummary, suppressionSummary, timestampIso, discoveredAdrs, healthTrend, healthHistoryRecent)), (result) => [{ name: 'bytes', value: result.length }]);
+    await (0, validationProfiling_1.profileValidationPhase)('badge/history/artifact writing reports badge status', async () => {
+        await node_fs_1.promises.mkdir(reportDir, { recursive: true });
+        await Promise.all([
+            node_fs_1.promises.writeFile(reportPath, report, { encoding: 'utf8' }),
+            node_fs_1.promises.writeFile(statusPath, `${JSON.stringify(statusExport, null, 2)}\n`, { encoding: 'utf8' }),
+            (0, architectureScoreBadge_1.writeArchitectureScoreBadge)(workspaceRoot, statusExport.summary.healthScore),
+        ]);
+    });
+    return {
+        reportPath,
+        statusPath,
+        status: statusExport,
+    };
+}
+function filterResultsByModuleScope(results, moduleScope) {
+    if (moduleScope.length === 0) {
+        return results;
+    }
+    const scopeSet = new Set(moduleScope);
+    const modulePatterns = [...scopeSet].map((moduleId) => ({
+        moduleId,
+        pathNeedle: `/modules/${moduleId.toLowerCase()}/`,
+        srcPathNeedle: `/src/${moduleId.toLowerCase()}/`,
+        contractNeedle: `.archpilot/contracts/${moduleId.toLowerCase()}.contract.json`,
+        quotedNeedle: `'${moduleId.toLowerCase()}'`,
+    }));
+    return results.filter((result) => {
+        const sourceFile = (result.sourceFile ?? '').replace(/\\/g, '/').toLowerCase();
+        const message = result.message.toLowerCase();
+        for (const pattern of modulePatterns) {
+            if (sourceFile.includes(pattern.pathNeedle) ||
+                sourceFile.includes(pattern.srcPathNeedle) ||
+                sourceFile.includes(pattern.contractNeedle) ||
+                message.includes(pattern.pathNeedle) ||
+                message.includes(pattern.srcPathNeedle) ||
+                message.includes(pattern.contractNeedle) ||
+                message.includes(pattern.quotedNeedle)) {
+                return true;
+            }
+        }
+        return false;
+    });
+}
+function filterDependencyGraphSummaryByModuleScope(dependencyGraphSummary, moduleScope) {
+    if (moduleScope.length === 0) {
+        return dependencyGraphSummary;
+    }
+    const scopeSet = new Set(moduleScope);
+    const scopedModules = dependencyGraphSummary.modules
+        .filter((moduleSummary) => scopeSet.has(moduleSummary.module))
+        .map((moduleSummary) => ({
+        ...moduleSummary,
+        declaredDependencies: moduleSummary.declaredDependencies.filter((dependency) => scopeSet.has(dependency)),
+        actualDependencies: moduleSummary.actualDependencies.filter((dependency) => scopeSet.has(dependency)),
+        inboundDeclaredFrom: moduleSummary.inboundDeclaredFrom.filter((dependency) => scopeSet.has(dependency)),
+        inboundActualFrom: moduleSummary.inboundActualFrom.filter((dependency) => scopeSet.has(dependency)),
+        unusedDeclaredDependencies: moduleSummary.unusedDeclaredDependencies.filter((dependency) => scopeSet.has(dependency)),
+        undeclaredActualDependencies: moduleSummary.undeclaredActualDependencies.filter((dependency) => scopeSet.has(dependency)),
+    }));
+    return {
+        modules: scopedModules,
+        hierarchyEdges: dependencyGraphSummary.hierarchyEdges.filter((edge) => scopeSet.has(edge.parentModule) && scopeSet.has(edge.childModule)),
+    };
+}
+async function runArchitectureValidationForWorkspace(workspaceRoot, options) {
+    const phase = async (label, run) => {
+        const started = Date.now();
+        (0, operationalLogging_1.emitOperationalMessage)(options?.onOperationalMessage, 'info', `${label}...`);
+        try {
+            return await run();
+        }
+        finally {
+            (0, validationProfiling_1.emitValidationProfile)(label, Date.now() - started);
+            (0, operationalLogging_1.emitOperationalMessage)(options?.onOperationalMessage, 'info', `${label} completed in ${Date.now() - started}ms.`);
+        }
+    };
+    const config = await phase('Loading architecture configuration', () => readArchitectureConfig(workspaceRoot));
+    if (!config) {
+        throw new Error('ArchPilot is not initialized in this workspace.');
+    }
+    const architectureContract = await phase('Loading architecture contract', () => (0, architectureInit_1.loadArchitectureContract)(workspaceRoot));
+    if (!architectureContract) {
+        throw new Error('ArchPilot is not initialized in this workspace.');
+    }
+    const [validationConfigLoad, projectConfigLoad, projectIdentityLoad, adrValidation,] = await phase('Loading validation inputs', () => Promise.all([
+        readValidationConfig(workspaceRoot),
+        (0, projectConfig_1.readProjectConfig)(workspaceRoot),
+        (0, projectIdentity_1.readProjectIdentity)(workspaceRoot),
+        (0, adrValidation_1.validateAdrEnforcement)(workspaceRoot, config),
+    ]));
+    const policyStatus = {
+        remotePolicyLoaded: false,
+    };
+    let remotePolicy;
+    if (projectConfigLoad.config?.policySource) {
+        policyStatus.policySource = projectConfigLoad.config.policySource;
+        const loadedRemotePolicy = await (0, remotePolicyLoader_1.loadRemotePolicyWithStatus)(projectConfigLoad.config.policySource, { onOperationalMessage: options?.onOperationalMessage });
+        remotePolicy = loadedRemotePolicy.policy;
+        policyStatus.remotePolicyLoaded = !!remotePolicy;
+        policyStatus.message = loadedRemotePolicy.message;
+    }
+    const localDependencyRulesRaw = await phase('Loading dependency rule configuration', () => readDependencyRulesRawConfig(workspaceRoot));
+    const effectivePolicy = (0, effectivePolicyResolver_1.resolveEffectivePolicy)({
+        localValidationConfig: validationConfigLoad.config,
+        localDependencyRulesRaw,
+        remotePolicy,
+        knownRuleIds: getAllValidationRuleMetadata().map((meta) => meta.id),
+    });
+    const validationConfig = buildEffectiveValidationConfig(effectivePolicy.effectiveValidationConfig);
+    const knownRuleIds = new Set(getAllValidationRuleMetadata().map((meta) => meta.id));
+    const suppressionsConfig = await phase('Loading suppressions', () => (0, validationSuppressions_1.readValidationSuppressions)(workspaceRoot, knownRuleIds));
+    let hasArchitectureModules = hasConfiguredArchitectureModules(architectureContract);
+    const results = [];
+    results.push(...validationConfigLoad.configResults);
+    if (projectConfigLoad.invalidJson) {
+        results.push({
+            id: exports.ValidationRuleIds.ARCH_PROJECT_CONFIGURATION_VALID,
+            severity: 'error',
+            passed: false,
+            message: projectConfigLoad.errorMessage ??
+                'ArchPilot project config is invalid. Please fix .archpilot/config.json.',
+        });
+    }
+    if (projectIdentityLoad.invalidJson) {
+        results.push({
+            id: exports.ValidationRuleIds.ARCH_PROJECT_IDENTITY_CONFIGURATION_VALID,
+            severity: 'error',
+            passed: false,
+            message: projectIdentityLoad.errorMessage ??
+                'ArchPilot project identity config is invalid. Please fix .archpilot/project.json.',
+        });
+    }
+    results.push(...suppressionsConfig.configResults);
+    const configuredModulesRoot = await phase('Discovering project modules', () => getConfiguredModulesRoot(workspaceRoot, architectureContract));
+    let precomputedDependencyImports;
+    const dependencyGraphSummary = await phase('Building dependency graph', () => (0, dependencyValidation_1.buildDependencyGraphSummary)(workspaceRoot, architectureContract, {
+        modulesRootRelativePath: configuredModulesRoot,
+        onCollectedImports: (imports) => {
+            precomputedDependencyImports = imports;
+        },
+    }));
+    hasArchitectureModules =
+        hasArchitectureModules || dependencyGraphSummary.modules.length > 0;
+    (0, operationalLogging_1.emitOperationalMessage)(options?.onOperationalMessage, 'info', `Dependency scan summary: modules=${dependencyGraphSummary.modules.length}, importEdges=${dependencyGraphSummary.modules.reduce((total, moduleEntry) => total + moduleEntry.actualDependencies.length, 0)}, ignoredDefaults=node_modules,.git,.archpilot,dist,build,out,coverage,fixtures.`);
+    const sourceInventory = (0, validationSourceInventory_1.createValidationSourceInventory)(workspaceRoot);
+    const astCache = (0, validationTypeScriptAstCache_1.createValidationTypeScriptAstCache)();
+    const ruleExecutionResults = await phase('Executing validation rules', () => Promise.all([
+        (0, validationProfiling_1.profileValidationPhase)('implementation profile analyzer', () => validateImplementationProfile(config, validationConfig)),
+        (0, validationProfiling_1.profileValidationPhase)('API style analyzer', () => validateApiStyle(workspaceRoot, architectureContract, config, validationConfig)),
+        (0, validationProfiling_1.profileValidationPhase)('module contract registry analyzer', () => hasArchitectureModules
+            ? validateModuleContractRegistryIntegrity(workspaceRoot, architectureContract, validationConfig)
+            : Promise.resolve([])),
+        (0, validationProfiling_1.profileValidationPhase)('module dependency analyzer', () => validateModuleDependencies(workspaceRoot, architectureContract, validationConfig, options?.onDependencyConfigError, projectConfigLoad.config?.policySource
+            ? effectivePolicy.effectiveDependencyRulesConfig
+            : undefined, precomputedDependencyImports, hasArchitectureModules)),
+        (0, validationProfiling_1.profileValidationPhase)('tenant model analyzer', () => validateTenantModel(workspaceRoot, architectureContract, config, validationConfig)),
+        (0, validationProfiling_1.profileValidationPhase)('RBAC analyzer', () => validateRbac(workspaceRoot, architectureContract, config, validationConfig)),
+        (0, validationProfiling_1.profileValidationPhase)('architecture style analyzer', () => validateArchitectureStyle(workspaceRoot, architectureContract, validationConfig)),
+        (0, validationProfiling_1.profileValidationPhase)('database artifact analyzer', () => validateDatabaseArtifacts(workspaceRoot, architectureContract, config, validationConfig)),
+        (0, validationProfiling_1.profileValidationPhase)('data/query risk analyzer', () => (0, dataQueryRiskDetection_1.detectDataQueryRiskFindings)({
+            workspaceRoot,
+            config,
+            contract: architectureContract,
+            disabledRuleIds: validationConfig.disabledRuleIdSet,
+            sourceInventory,
+            astCache,
+        }), (result) => [{ name: 'findings', value: result.length }]),
+        (0, validationProfiling_1.profileValidationPhase)('AP-API analyzer', () => (0, apiDesignAnalysis_1.detectApiDesignFindings)({
+            workspaceRoot,
+            config,
+            contract: architectureContract,
+            disabledRuleIds: validationConfig.disabledRuleIdSet,
+            sourceInventory,
+        }), (result) => [{ name: 'findings', value: result.length }]),
+        (0, validationProfiling_1.profileValidationPhase)('AP-EVT analyzer', () => (0, eventArchitectureAnalysis_1.detectEventArchitectureFindings)({
+            workspaceRoot,
+            contract: architectureContract,
+            disabledRuleIds: validationConfig.disabledRuleIdSet,
+            sourceInventory,
+            astCache,
+        }), (result) => [{ name: 'findings', value: result.length }]),
+        (0, validationProfiling_1.profileValidationPhase)('AP-APP analyzer', () => (0, applicationLayeringAnalysis_1.detectApplicationLayeringFindings)({
+            workspaceRoot,
+            contract: architectureContract,
+            disabledRuleIds: validationConfig.disabledRuleIdSet,
+            sourceInventory,
+            astCache,
+        }), (result) => [{ name: 'findings', value: result.length }]),
+        (0, validationProfiling_1.profileValidationPhase)('AP-AUTH/AP-TEN analyzer', () => (0, authorizationTenantAnalysis_1.detectAuthorizationTenantFindings)({
+            workspaceRoot,
+            config,
+            contract: architectureContract,
+            disabledRuleIds: validationConfig.disabledRuleIdSet,
+            sourceInventory,
+            astCache,
+        }), (result) => [{ name: 'findings', value: result.length }]),
+        (0, validationProfiling_1.profileValidationPhase)('AP-TXN/AP-DOM analyzer', () => (0, transactionDomainAnalysis_1.detectTransactionDomainFindings)({
+            workspaceRoot,
+            config,
+            contract: architectureContract,
+            disabledRuleIds: validationConfig.disabledRuleIdSet,
+            sourceInventory,
+            astCache,
+        }), (result) => [{ name: 'findings', value: result.length }]),
+    ]));
+    results.push(...ruleExecutionResults.flat(), ...adrValidation.results);
+    if (hasArchitectureModules) {
+        results.push(...(await phase('Analyzing dependency graph rules', () => validateDependencyLayerDirection(workspaceRoot, dependencyGraphSummary, validationConfig))), ...validateTransitiveModuleDependencyCycles(dependencyGraphSummary, validationConfig), ...validateHighInboundDependencyCount(architectureContract, dependencyGraphSummary, validationConfig), ...(await validateDependencyGraphIsolation(workspaceRoot, architectureContract, dependencyGraphSummary, validationConfig)));
+    }
+    const scopeModules = options?.moduleScope
+        ? [...new Set(options.moduleScope)].sort((left, right) => left.localeCompare(right))
+        : [];
+    const applicableResults = applyRuleApplicability(results, architectureContract, validationConfig, hasArchitectureModules);
+    const effectiveResults = applyEffectiveSeverities(applicableResults, validationConfig.config);
+    const scopedResults = filterResultsByModuleScope(effectiveResults, scopeModules);
+    const scopedResultsWithQuickFix = (0, quickFixProviders_1.attachQuickFixMetadataToResults)(scopedResults);
+    const scopedDependencyGraphSummary = filterDependencyGraphSummaryByModuleScope(dependencyGraphSummary, scopeModules);
+    const todayIsoDate = new Date().toISOString().slice(0, 10);
+    const matchableSuppressions = suppressionsConfig.suppressions.filter((entry) => (0, suppressionValidator_1.getSuppressionExpiryState)(entry, todayIsoDate) !== 'expired');
+    const appliedSuppressions = applyValidationSuppressions(scopedResultsWithQuickFix, matchableSuppressions);
+    const shouldInitializeExceptionsFile = !(await (0, exceptionLoader_1.exceptionsFileExists)(workspaceRoot)) &&
+        appliedSuppressions.activeResults.some((result) => !result.passed);
+    if (shouldInitializeExceptionsFile) {
+        await (0, exceptionLoader_1.ensureExceptionsFile)(workspaceRoot);
+    }
+    const exceptionsLoad = await (0, exceptionLoader_1.loadExceptions)(workspaceRoot);
+    const appliedExceptions = applyValidationExceptions(appliedSuppressions.activeResults, exceptionsLoad.exceptions);
+    const suppressionEvaluation = (0, suppressionValidator_1.evaluateSuppressions)({
+        suppressions: suppressionsConfig.suppressions,
+        suppressedResults: appliedSuppressions.suppressedResults,
+        todayIsoDate,
+    });
+    appliedExceptions.activeResults.push(...suppressionEvaluation.validationResults);
+    const driftSummary = (0, architectureDriftDetection_1.buildArchitectureDriftSummary)(appliedExceptions.activeResults, appliedSuppressions.suppressedResults);
+    const written = await phase('Generating validation findings and reports', () => writeValidationReport(workspaceRoot, config, appliedExceptions.activeResults, validationConfig, appliedSuppressions.suppressedResults, appliedExceptions.approvedExceptions, suppressionsConfig.ignored, suppressionsConfig.suppressions.length, exceptionsLoad.exceptions.length, driftSummary, scopedDependencyGraphSummary, suppressionEvaluation.summary, suppressionEvaluation.entries, adrValidation.summary, policyStatus.policySource || policyStatus.message
+        ? policyStatus
+        : undefined, { openReportInEditor: options?.openReportInEditor }));
+    await phase('Refreshing setup readiness and next steps', () => (0, setupNextSteps_1.refreshSetupNextStepsForWorkspace)({
+        workspaceRoot,
+        validationStatus: written.status,
+    }));
+    return {
+        config,
+        results: appliedExceptions.activeResults,
+        status: written.status,
+        reportPath: written.reportPath,
+        statusPath: written.statusPath,
+    };
+}
+//# sourceMappingURL=architectureValidation.js.map