@codapult/guard 0.3.0 → 0.4.0

package/dist/core/history/runs.d.ts

@@ -0,0 +1,28 @@
+export declare const GUARD_RUNS_DIR: string;
+export interface GuardRunStage {
+    durationMs: number;
+    status: 'ok' | 'fail' | 'skipped';
+    detail?: string | undefined;
+}
+export interface GuardRunManifest {
+    version: 1;
+    runId: string;
+    command: string;
+    startedAt: string;
+    completedAt: string;
+    durationMs: number;
+    outcome: 'pass' | 'fail' | 'warning' | 'needs-review' | 'not-configured';
+    gate: string;
+    stages: Record<string, GuardRunStage>;
+    commit?: string | undefined;
+}
+export interface GuardRunContext {
+    runId: string;
+    startedAt: string;
+    startedAtMs: number;
+    stages: Record<string, GuardRunStage>;
+}
+export declare function startGuardRun(): GuardRunContext;
+export declare function recordGuardRunStage(context: GuardRunContext, name: string, status: GuardRunStage['status'], startedAtMs: number, detail?: string): void;
+export declare function writeGuardRun(root: string, manifest: GuardRunManifest): void;
+export declare function finishGuardRun(root: string, context: GuardRunContext, outcome: GuardRunManifest['outcome'], gate: string, command?: string): GuardRunManifest;

package/dist/core/history/runs.js

@@ -0,0 +1,59 @@
+import { randomUUID } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, renameSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { config } from '../config.js';
+export const GUARD_RUNS_DIR = `.${config.appName}/guard/history/runs`;
+export function startGuardRun() {
+    return {
+        runId: `guard-${randomUUID()}`,
+        startedAt: new Date().toISOString(),
+        startedAtMs: Date.now(),
+        stages: {},
+    };
+}
+export function recordGuardRunStage(context, name, status, startedAtMs, detail) {
+    context.stages[name] = {
+        durationMs: Math.max(0, Date.now() - startedAtMs),
+        status,
+        ...(detail ? { detail } : {}),
+    };
+}
+export function writeGuardRun(root, manifest) {
+    const directory = resolve(root, GUARD_RUNS_DIR);
+    mkdirSync(directory, { recursive: true });
+    const path = resolve(directory, `${manifest.runId}.json`);
+    const temporaryPath = `${path}.tmp-${process.pid}-${manifest.runId}`;
+    writeFileSync(temporaryPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+    renameSync(temporaryPath, path);
+}
+export function finishGuardRun(root, context, outcome, gate, command = 'verify') {
+    let commit;
+    try {
+        commit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, stdio: 'pipe' })
+            .toString()
+            .trim();
+    }
+    catch {
+        commit = undefined;
+    }
+    const manifest = {
+        version: 1,
+        runId: context.runId,
+        command,
+        startedAt: context.startedAt,
+        completedAt: new Date().toISOString(),
+        durationMs: Math.max(0, Date.now() - context.startedAtMs),
+        outcome,
+        gate,
+        stages: context.stages,
+        ...(commit ? { commit } : {}),
+    };
+    try {
+        writeGuardRun(root, manifest);
+    }
+    catch {
+        // Verification must not fail because its local diagnostic record cannot be written.
+    }
+    return manifest;
+}

package/dist/core/model/types.d.ts

@@ -0,0 +1,10 @@
+/** Shared domain vocabulary used by Guard core and its adapters. */
+export type GuardSeverity = 'error' | 'warning' | 'info';
+export type GuardRuleKind = 'forbidden-import' | 'client-forbidden-import';
+export type GuardRuleStatus = 'active' | 'proposed';
+export type GuardContractKind = 'guidance' | 'import-boundary' | 'required-call' | 'package-boundary';
+export type GuardBudgetMetric = 'lines' | 'bytes' | 'imports';
+export type GuardToolMode = 'auto' | 'on' | 'off';
+export type GuardApprovalMode = 'local' | 'protected';
+export type GuardAdapterName = 'dependency-graph' | 'security' | 'dependency-hygiene';
+export type ProjectCheck = 'lint' | 'typecheck' | 'test' | 'build';

package/dist/core/model/types.js

@@ -0,0 +1 @@
+export {};

package/dist/core/policy/schemas.d.ts

@@ -1,4 +1,26 @@
 import { z } from 'zod';
+export declare const guardBudgetSchema: z.ZodObject<{
+    id: z.ZodString;
+    description: z.ZodString;
+    metric: z.ZodEnum<{
+        bytes: "bytes";
+        imports: "imports";
+        lines: "lines";
+    }>;
+    scope: z.ZodArray<z.ZodString>;
+    limit: z.ZodNumber;
+    severity: z.ZodEnum<{
+        error: "error";
+        info: "info";
+        warning: "warning";
+    }>;
+    reason: z.ZodString;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        proposed: "proposed";
+    }>>;
+    evidence: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
 export declare const guardRuleSchema: z.ZodObject<{
     id: z.ZodString;
     description: z.ZodString;
@@ -61,6 +83,8 @@ export declare const guardContractSchema: z.ZodObject<{
 }, z.core.$strip>;
 export declare const guardConfigSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
+    revision: z.ZodOptional<z.ZodNumber>;
+    contentFingerprint: z.ZodOptional<z.ZodString>;
     rules: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         description: z.ZodString;
@@ -121,6 +145,36 @@ export declare const guardConfigSchema: z.ZodObject<{
         }>>;
         evidence: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
+    budgets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        description: z.ZodString;
+        metric: z.ZodEnum<{
+            bytes: "bytes";
+            imports: "imports";
+            lines: "lines";
+        }>;
+        scope: z.ZodArray<z.ZodString>;
+        limit: z.ZodNumber;
+        severity: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            warning: "warning";
+        }>;
+        reason: z.ZodString;
+        status: z.ZodOptional<z.ZodEnum<{
+            active: "active";
+            proposed: "proposed";
+        }>>;
+        evidence: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    approval: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            local: "local";
+            protected: "protected";
+        }>;
+        allowMcpApproval: z.ZodBoolean;
+        requireDistinctActor: z.ZodBoolean;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const guardContractsFileSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
@@ -174,10 +228,18 @@ export declare const guardProposalDecisionSchema: z.ZodObject<{
     proposalId: z.ZodOptional<z.ZodString>;
     proposalFingerprint: z.ZodOptional<z.ZodString>;
     revision: z.ZodOptional<z.ZodNumber>;
+    source: z.ZodOptional<z.ZodEnum<{
+        cli: "cli";
+        external: "external";
+        mcp: "mcp";
+    }>>;
+    actor: z.ZodOptional<z.ZodString>;
+    commit: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const guardProposalSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     generatedAt: z.ZodString;
+    generatedBy: z.ZodOptional<z.ZodString>;
     proposalId: z.ZodOptional<z.ZodString>;
     projectFingerprint: z.ZodOptional<z.ZodString>;
     revision: z.ZodOptional<z.ZodNumber>;
@@ -257,6 +319,13 @@ export declare const guardProposalSchema: z.ZodObject<{
         proposalId: z.ZodOptional<z.ZodString>;
         proposalFingerprint: z.ZodOptional<z.ZodString>;
         revision: z.ZodOptional<z.ZodNumber>;
+        source: z.ZodOptional<z.ZodEnum<{
+            cli: "cli";
+            external: "external";
+            mcp: "mcp";
+        }>>;
+        actor: z.ZodOptional<z.ZodString>;
+        commit: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
 export declare const guardAgentConfigSchema: z.ZodObject<{

package/dist/core/policy/schemas.js

@@ -1,6 +1,17 @@
 import { z } from 'zod';
 const severity = z.enum(['error', 'warning', 'info']);
 const status = z.enum(['active', 'proposed']);
+export const guardBudgetSchema = z.object({
+    id: z.string().trim().min(1),
+    description: z.string().trim().min(1),
+    metric: z.enum(['lines', 'bytes', 'imports']),
+    scope: z.array(z.string().trim().min(1)).min(1),
+    limit: z.number().int().positive(),
+    severity,
+    reason: z.string().trim().min(1),
+    status: status.optional(),
+    evidence: z.array(z.string()).optional(),
+});
 export const guardRuleSchema = z.object({
     id: z.string().trim().min(1),
     description: z.string().trim().min(1),
@@ -33,8 +44,18 @@ export const guardContractSchema = z.object({
 });
 export const guardConfigSchema = z.object({
     version: z.literal(1),
+    revision: z.number().int().nonnegative().optional(),
+    contentFingerprint: z.string().optional(),
     rules: z.array(guardRuleSchema),
     contracts: z.array(guardContractSchema).optional(),
+    budgets: z.array(guardBudgetSchema).optional(),
+    approval: z
+        .object({
+        mode: z.enum(['local', 'protected']),
+        allowMcpApproval: z.boolean(),
+        requireDistinctActor: z.boolean(),
+    })
+        .optional(),
 });
 export const guardContractsFileSchema = z.object({
     version: z.literal(1),
@@ -48,10 +69,14 @@ export const guardProposalDecisionSchema = z.object({
     proposalId: z.string().optional(),
     proposalFingerprint: z.string().optional(),
     revision: z.number().optional(),
+    source: z.enum(['cli', 'mcp', 'external']).optional(),
+    actor: z.string().optional(),
+    commit: z.string().optional(),
 });
 export const guardProposalSchema = z.object({
     version: z.literal(1),
     generatedAt: z.string(),
+    generatedBy: z.string().trim().min(1).optional(),
     proposalId: z.string().optional(),
     projectFingerprint: z.string().optional(),
     revision: z.number().int().positive().optional(),

package/dist/core/verification/verify.d.ts

@@ -1,34 +1,38 @@
 import { type CommandResult } from '../../adapters/command.js';
-import { type GuardAdapter, type ProjectCheck, type ProjectCheckResults, type ProjectRuntimeDiagnostics } from '../../adapters/project-checks.js';
+import type { ProjectCheck } from '../model/types.js';
+import { type GuardAdapter, type ProjectCheckResults, type ProjectRuntimeDiagnostics } from '../../adapters/project-checks.js';
 import { type GuardToolMode, type GuardContractIssue, type GuardReport } from '../guard.js';
 import { type GuardImpactAnalysis } from '../analysis/impact.js';
+import { type GuardRunManifest } from '../history/runs.js';
 export type GuardVerificationCheck = ProjectCheck;
+export interface GuardVerificationOptions {
+    checks?: GuardVerificationCheck[] | undefined;
+    changedOnly?: boolean | undefined;
+    timeout?: number | undefined;
+    requirement?: string | undefined;
+    tools?: GuardToolMode | undefined;
+    strict?: boolean | undefined;
+    projectChecks?: boolean | undefined;
+}
 export interface GuardVerificationResult {
     status: 'ok' | 'fail' | 'not-configured';
     outcome: 'pass' | 'fail' | 'warning' | 'needs-review' | 'not-configured';
-    errorCode?: 'GUARD_NOT_CONFIGURED' | 'GUARD_CONFIG_INVALID';
-    recoverable?: boolean;
-    tools?: GuardToolMode;
+    errorCode?: 'GUARD_NOT_CONFIGURED' | 'GUARD_CONFIG_INVALID' | undefined;
+    recoverable?: boolean | undefined;
+    tools?: GuardToolMode | undefined;
     checks: ProjectCheckResults;
     workspaceChecks: Record<string, ProjectCheckResults>;
     adapters: Partial<Record<GuardAdapter, CommandResult>>;
     runtime: ProjectRuntimeDiagnostics;
-    configError?: string;
-    architecture?: GuardReport;
-    impact?: GuardImpactAnalysis;
+    configError?: string | undefined;
+    architecture?: GuardReport | undefined;
+    impact?: GuardImpactAnalysis | undefined;
     contractIssues: GuardContractIssue[];
     requirement: {
         status: 'delegated-to-review';
         provided: boolean;
         message: string;
     };
+    run: GuardRunManifest;
 }
-export declare function runGuardVerification(root: string, options?: {
-    checks?: GuardVerificationCheck[];
-    changedOnly?: boolean;
-    timeout?: number;
-    requirement?: string;
-    tools?: GuardToolMode;
-    strict?: boolean;
-    projectChecks?: boolean;
-}): GuardVerificationResult;
+export declare function runGuardVerification(root: string, options?: GuardVerificationOptions): GuardVerificationResult;

package/dist/core/verification/verify.js

@@ -1,8 +1,11 @@
+import {} from '../../adapters/command.js';
 import { runProjectAdapters, runProjectChecks, runWorkspaceProjectChecks, inspectProjectRuntime, } from '../../adapters/project-checks.js';
-import { loadBaseline, loadGuardAgentConfig, loadGuardConfig, scanGuard, classifyGuardOutcome, validateGuardContracts, } from '../guard.js';
+import { loadBaseline, loadGuardAgentConfig, loadGuardConfig, scanGuard, classifyGuardOutcome, validateGuardPolicy, } from '../guard.js';
 import { analyzeProjectImpact } from '../analysis/impact.js';
 import { discoverProject } from '../discovery/discovery.js';
+import { finishGuardRun, recordGuardRunStage, startGuardRun, } from '../history/runs.js';
 export function runGuardVerification(root, options = {}) {
+    const runContext = startGuardRun();
     const requirement = {
         status: 'delegated-to-review',
         provided: Boolean(options.requirement?.trim()),
@@ -10,12 +13,15 @@ export function runGuardVerification(root, options = {}) {
             ? 'Requirement text is included in semantic review input; deterministic verify does not judge natural-language acceptance criteria.'
             : 'Requirement satisfaction is evaluated by guard review using the task and diff.',
     };
+    const runtimeStartedAt = Date.now();
     const runtime = inspectProjectRuntime(root);
+    recordGuardRunStage(runContext, 'runtime', 'ok', runtimeStartedAt);
     let config;
     try {
         config = loadGuardConfig(root);
     }
     catch (error) {
+        const run = finishGuardRun(root, runContext, 'fail', 'configuration');
         return {
             status: 'fail',
             outcome: 'fail',
@@ -28,9 +34,11 @@ export function runGuardVerification(root, options = {}) {
             configError: error instanceof Error ? error.message : String(error),
             contractIssues: [],
             requirement,
+            run,
         };
     }
-    if (!config)
+    if (!config) {
+        const run = finishGuardRun(root, runContext, 'not-configured', 'configuration');
         return {
             status: 'not-configured',
             outcome: 'not-configured',
@@ -42,11 +50,16 @@ export function runGuardVerification(root, options = {}) {
             runtime,
             contractIssues: [],
             requirement,
+            run,
         };
+    }
     const agentConfig = loadGuardAgentConfig(root);
     const projectChecks = options.projectChecks ?? agentConfig.completionGate.projectChecks;
     const checks = projectChecks ? (options.checks ?? agentConfig.completionGate.checks) : [];
+    const checksStartedAt = Date.now();
     const results = runProjectChecks(root, checks, { timeout: options.timeout });
+    recordGuardRunStage(runContext, 'project-checks', projectChecks ? 'ok' : 'skipped', checksStartedAt);
+    const discoveryStartedAt = Date.now();
     const workspaceModel = discoverProject(root);
     const impact = analyzeProjectImpact(workspaceModel, options.changedOnly === false
         ? workspaceModel.modules.map((module) => module.path)
@@ -55,7 +68,9 @@ export function runGuardVerification(root, options = {}) {
         timeout: options.timeout,
         rootResults: results,
     });
+    recordGuardRunStage(runContext, 'discovery-impact', 'ok', discoveryStartedAt);
     const toolMode = options.tools ?? agentConfig.tools;
+    const adaptersStartedAt = Date.now();
     const adapters = toolMode === 'off'
         ? {}
         : runProjectAdapters(root, {
@@ -63,12 +78,15 @@ export function runGuardVerification(root, options = {}) {
             timeout: options.timeout,
             tooling: agentConfig.tooling,
         });
+    recordGuardRunStage(runContext, 'adapters', toolMode === 'off' ? 'skipped' : 'ok', adaptersStartedAt);
+    const architectureStartedAt = Date.now();
     const architecture = scanGuard(root, config, {
         changedOnly: options.changedOnly,
         baseline: loadBaseline(root),
         includeArchitectureInsights: true,
     });
-    const contractIssues = validateGuardContracts(root, config.contracts ?? []);
+    const contractIssues = validateGuardPolicy(root, config);
+    recordGuardRunStage(runContext, 'architecture-policy', 'ok', architectureStartedAt);
     const commandFailed = Object.values(results).some((result) => result.status === 'failed');
     const workspaceCommandFailed = Object.values(workspaceChecks).some((packageResults) => Object.values(packageResults).some((result) => result.status === 'failed'));
     const adapterFailed = Object.values(adapters).some((result) => result.status === 'failed');
@@ -83,12 +101,41 @@ export function runGuardVerification(root, options = {}) {
         architectureFailed ||
         contractIssues.length > 0 ||
         missingRequiredTools;
+    const projectChecksFailed = commandFailed || workspaceCommandFailed || (projectChecks && !runtime.compatible);
+    const adaptersFailed = adapterFailed || missingRequiredTools;
+    runContext.stages['project-checks'] = {
+        ...runContext.stages['project-checks'],
+        status: projectChecks ? (projectChecksFailed ? 'fail' : 'ok') : 'skipped',
+    };
+    runContext.stages.adapters = {
+        ...runContext.stages.adapters,
+        status: toolMode === 'off' ? 'skipped' : adaptersFailed ? 'fail' : 'ok',
+    };
+    runContext.stages['architecture-policy'] = {
+        ...runContext.stages['architecture-policy'],
+        status: architectureFailed || contractIssues.length > 0 ? 'fail' : 'ok',
+    };
+    const outcome = classifyGuardOutcome({
+        errors: failed ? 1 : 0,
+        warnings: architectureWarnings ? 1 : 0,
+    });
+    const gate = architectureFailed
+        ? 'architecture'
+        : contractIssues.length > 0
+            ? 'contracts'
+            : commandFailed || workspaceCommandFailed
+                ? 'project-checks'
+                : adapterFailed
+                    ? 'adapters'
+                    : missingRequiredTools
+                        ? 'required-tools'
+                        : !runtime.compatible && projectChecks
+                            ? 'runtime'
+                            : 'none';
+    const run = finishGuardRun(root, runContext, outcome, gate);
     return {
         status: failed ? 'fail' : 'ok',
-        outcome: classifyGuardOutcome({
-            errors: failed ? 1 : 0,
-            warnings: architectureWarnings ? 1 : 0,
-        }),
+        outcome,
         tools: toolMode,
         checks: results,
         workspaceChecks,
@@ -98,5 +145,6 @@ export function runGuardVerification(root, options = {}) {
         impact,
         contractIssues,
         requirement,
+        run,
     };
 }

package/dist/index.d.ts

@@ -1,10 +1,12 @@
 /** Public, framework-agnostic Guard API. */
+export * from './core/model/types.js';
 export * from './core/guard.js';
 export * from './core/errors.js';
 export * from './core/discovery/discovery.js';
 export { runGuardVerification } from './core/verification/verify.js';
 export type { GuardVerificationCheck, GuardVerificationResult, } from './core/verification/verify.js';
 export * from './core/history/history.js';
+export * from './core/history/runs.js';
 export * from './core/output/sarif.js';
 export * from './core/analysis/doctor.js';
 export * from './core/analysis/packs.js';

package/dist/index.js

@@ -1,9 +1,11 @@
 /** Public, framework-agnostic Guard API. */
+export * from './core/model/types.js';
 export * from './core/guard.js';
 export * from './core/errors.js';
 export * from './core/discovery/discovery.js';
 export { runGuardVerification } from './core/verification/verify.js';
 export * from './core/history/history.js';
+export * from './core/history/runs.js';
 export * from './core/output/sarif.js';
 export * from './core/analysis/doctor.js';
 export * from './core/analysis/packs.js';

package/dist/mcp/resources.js

@@ -1,9 +1,24 @@
-import { buildArchitectureMemory, buildConventionsMemory, discoverProject, findGuardRoot, GUARD_ARCHITECTURE_FILE, GUARD_CONVENTIONS_FILE, loadGuardAgentConfig, loadGuardArtifact, loadGuardConfig, loadGuardProposals, } from '../core/guard.js';
+import { buildArchitectureMemory, buildConventionsMemory, discoverProject, findGuardRoot, GUARD_ARCHITECTURE_FILE, GUARD_CONVENTIONS_FILE, loadGuardAgentConfig, loadGuardArtifact, loadGuardConfig, loadGuardProposals, GuardStateBusyError, GuardStateStaleError, } from '../core/guard.js';
+import { guardErrorPayload } from '../core/errors.js';
+import { DiscoveryStaleError } from '../core/discovery/discovery.js';
 function jsonResource(uri, value) {
     return {
         contents: [{ uri, text: JSON.stringify(value, null, 2), mimeType: 'application/json' }],
     };
 }
+function resourceError(uri, error) {
+    const errorCode = error instanceof GuardStateBusyError
+        ? 'GUARD_STATE_BUSY'
+        : error instanceof GuardStateStaleError || error instanceof DiscoveryStaleError
+            ? 'GUARD_STATE_STALE'
+            : 'GUARD_CONFIG_INVALID';
+    return jsonResource(uri, guardErrorPayload(errorCode, error instanceof Error ? error.message : String(error), {
+        configured: errorCode !== 'GUARD_CONFIG_INVALID',
+        outcome: 'error',
+        recoverable: true,
+        hint: 'Repair the invalid Guard artifact, then run codapult-guard doctor.',
+    }));
+}
 export function registerGuardResources(server) {
     server.registerResource('codapult_guard_rules', 'codapult://guard/rules', {
         title: 'Architecture Guard Rules',
@@ -11,13 +26,18 @@ export function registerGuardResources(server) {
         mimeType: 'application/json',
     }, () => {
         const root = findGuardRoot();
-        const config = loadGuardConfig(root);
-        return jsonResource('codapult://guard/rules', {
-            configured: config !== undefined,
-            rules: config?.rules ?? [],
-            contracts: config?.contracts ?? [],
-            project: discoverProject(root),
-        });
+        try {
+            const config = loadGuardConfig(root);
+            return jsonResource('codapult://guard/rules', {
+                configured: config !== undefined,
+                rules: config?.rules ?? [],
+                contracts: config?.contracts ?? [],
+                project: discoverProject(root),
+            });
+        }
+        catch (error) {
+            return resourceError('codapult://guard/rules', error);
+        }
     });
     server.registerResource('codapult_guard_context', 'codapult://guard/context', {
         title: 'Guard Project Context',
@@ -25,19 +45,24 @@ export function registerGuardResources(server) {
         mimeType: 'application/json',
     }, () => {
         const root = findGuardRoot();
-        const project = discoverProject(root);
-        const config = loadGuardConfig(root);
-        return jsonResource('codapult://guard/context', {
-            version: 1,
-            root,
-            configured: config !== undefined,
-            project,
-            architecture: loadGuardArtifact(root, GUARD_ARCHITECTURE_FILE) ?? buildArchitectureMemory(project),
-            conventions: loadGuardArtifact(root, GUARD_CONVENTIONS_FILE) ?? buildConventionsMemory(project),
-            rules: config?.rules ?? [],
-            contracts: config?.contracts ?? [],
-            agent: loadGuardAgentConfig(root),
-        });
+        try {
+            const project = discoverProject(root);
+            const config = loadGuardConfig(root);
+            return jsonResource('codapult://guard/context', {
+                version: 1,
+                root,
+                configured: config !== undefined,
+                project,
+                architecture: loadGuardArtifact(root, GUARD_ARCHITECTURE_FILE) ?? buildArchitectureMemory(project),
+                conventions: loadGuardArtifact(root, GUARD_CONVENTIONS_FILE) ?? buildConventionsMemory(project),
+                rules: config?.rules ?? [],
+                contracts: config?.contracts ?? [],
+                agent: loadGuardAgentConfig(root),
+            });
+        }
+        catch (error) {
+            return resourceError('codapult://guard/context', error);
+        }
     });
     server.registerResource('codapult_guard_architecture', 'codapult://guard/architecture', {
         title: 'Guard Architecture Map',
@@ -45,13 +70,18 @@ export function registerGuardResources(server) {
         mimeType: 'application/json',
     }, () => {
         const root = findGuardRoot();
-        const project = discoverProject(root);
-        return jsonResource('codapult://guard/architecture', {
-            version: 1,
-            root,
-            architecture: loadGuardArtifact(root, GUARD_ARCHITECTURE_FILE) ?? buildArchitectureMemory(project),
-            conventions: loadGuardArtifact(root, GUARD_CONVENTIONS_FILE) ?? buildConventionsMemory(project),
-        });
+        try {
+            const project = discoverProject(root);
+            return jsonResource('codapult://guard/architecture', {
+                version: 1,
+                root,
+                architecture: loadGuardArtifact(root, GUARD_ARCHITECTURE_FILE) ?? buildArchitectureMemory(project),
+                conventions: loadGuardArtifact(root, GUARD_CONVENTIONS_FILE) ?? buildConventionsMemory(project),
+            });
+        }
+        catch (error) {
+            return resourceError('codapult://guard/architecture', error);
+        }
     });
     server.registerResource('codapult_guard_proposals', 'codapult://guard/proposals', {
         title: 'Architecture Guard Proposals',
@@ -59,6 +89,11 @@ export function registerGuardResources(server) {
         mimeType: 'application/json',
     }, () => {
         const root = findGuardRoot();
-        return jsonResource('codapult://guard/proposals', loadGuardProposals(root) ?? { version: 1, rules: [], contracts: [], questions: [] });
+        try {
+            return jsonResource('codapult://guard/proposals', loadGuardProposals(root) ?? { version: 1, rules: [], contracts: [], questions: [] });
+        }
+        catch (error) {
+            return resourceError('codapult://guard/proposals', error);
+        }
     });
 }