@lamentis/naome 1.3.11 → 1.3.12

package/crates/naome-core/tests/architecture.rs

@@ -1,15 +1,12 @@
-use std::fs;
-use std::path::{Path, PathBuf};
-use std::process::Command;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::{SystemTime, UNIX_EPOCH};
-
 use naome_core::{
     default_architecture_config_text, scan_architecture, validate_architecture, ArchitectureConfig,
     ArchitectureEdgeKind, ArchitectureScanOptions,
 };
 
-static FIXTURE_COUNTER: AtomicU64 = AtomicU64::new(0);
+mod architecture_support;
+
+use architecture_support::{has_import_edge, FixtureRepo};
+
 const FORBIDDEN_DOMAIN_TO_INFRASTRUCTURE_CONFIG: &str = "layers:\n  domain:\n    paths:\n      - \"src/domain/**\"\n  infrastructure:\n    paths:\n      - \"src/infrastructure/**\"\nallowed_dependencies:\n  domain:\n  infrastructure:\n    - domain\nrules:\n  no_forbidden_layer_dependencies:\n    enabled: true\n    severity: error\n";
 
 #[test]
@@ -180,7 +177,7 @@ fn import_resolution_covers_common_language_forms_without_dropping_layer_edges()
 #[test]
 fn relative_import_resolution_prefers_source_language_extensions() {
     let repo = FixtureRepo::new();
-    repo.write("src/domain/mod.rs", "mod db;\n");
+    repo.write("src/domain/mod.rs", "use self::db::right;\n");
     repo.write("src/domain/db.ts", "export const wrong = true;\n");
     repo.write("src/domain/db.rs", "pub fn right() {}\n");
 
@@ -235,12 +232,24 @@ fn import_resolver_handles_language_specific_module_roots() {
         "file:packages/app/src/domain/event.rs",
         "file:packages/app/src/infrastructure/db.rs"
     ));
-    assert!(has("file:src/domain/service.rs", "file:src/domain/service/helper.rs"));
-    assert!(!has("file:src/domain/service.rs", "file:src/domain/helper.rs"));
-    assert!(has("file:src/domain/service.rs", "file:src/domain/infra.rs"));
+    assert!(has(
+        "file:src/domain/service.rs",
+        "file:src/domain/service/helper.rs"
+    ));
+    assert!(!has(
+        "file:src/domain/service.rs",
+        "file:src/domain/helper.rs"
+    ));
+    assert!(has(
+        "file:src/domain/service.rs",
+        "file:src/domain/infra.rs"
+    ));
     assert!(!has("file:src/domain/service.rs", "file:src/infra.rs"));
     assert!(has("file:domain/event.go", "file:infrastructure/db/db.go"));
-    assert!(!has("file:domain/external.go", "file:infrastructure/db/db.go"));
+    assert!(!has(
+        "file:domain/external.go",
+        "file:infrastructure/db/db.go"
+    ));
 }
 
 #[test]
@@ -291,20 +300,44 @@ fn overlapping_target_layers_do_not_create_false_forbidden_dependency() {
 fn late_review_import_forms_keep_forbidden_layer_edges_visible() {
     let repo = FixtureRepo::new();
     repo.write("naome.arch.yaml", FORBIDDEN_DOMAIN_TO_INFRASTRUCTURE_CONFIG);
-    repo.write("src/domain/grouped.rs", "use crate::{domain::types, infrastructure::db};\n");
+    repo.write(
+        "src/domain/grouped.rs",
+        "use crate::{domain::types, infrastructure::db};\n",
+    );
     repo.write("src/domain/types.rs", "pub struct Event;\n");
     repo.write("src/infrastructure/db.rs", "pub fn connect() {}\n");
-    repo.write("src/domain/visible.rs", "pub(crate) use crate::infrastructure::db as database;\n");
-    repo.write("src/domain/nested.rs", "use crate::{domain::types, infrastructure::{db, cache}};\n");
+    repo.write(
+        "src/domain/visible.rs",
+        "pub(crate) use crate::infrastructure::db as database;\n",
+    );
+    repo.write(
+        "src/domain/nested.rs",
+        "use crate::{domain::types, infrastructure::{db, cache}};\n",
+    );
     repo.write("src/infrastructure/cache.rs", "pub fn cache() {}\n");
-    repo.write("src/domain/parenthesized.py", "from src.infrastructure import (\n    client,\n)\n");
+    repo.write(
+        "src/domain/parenthesized.py",
+        "from src.infrastructure import (\n    client,\n)\n",
+    );
     repo.write("src/infrastructure/client.py", "db = object()\n");
-    repo.write("src/domain/dynamic.ts", "const db = await import(\n  '../infrastructure/db_client'\n);\n");
+    repo.write(
+        "src/domain/dynamic.ts",
+        "const db = await import(\n  '../infrastructure/db_client'\n);\n",
+    );
     repo.write("src/infrastructure/db_client.ts", "export const db = 1;\n");
-    repo.write("src/domain/export_literal.ts", "export const fixture = '../infrastructure/db_client';\n");
-    repo.write("src/domain/commented.ts", "// await import('../infrastructure/db_client')\n");
+    repo.write(
+        "src/domain/export_literal.ts",
+        "export const fixture = '../infrastructure/db_client';\n",
+    );
+    repo.write(
+        "src/domain/commented.ts",
+        "// await import('../infrastructure/db_client')\n",
+    );
     repo.write("go.mod", "module github.com/acme/app\n");
-    repo.write("src/domain/commented.go", "package domain\nimport (\n  // \"github.com/acme/app/src/infrastructure/dbgo\"\n)\n");
+    repo.write(
+        "src/domain/commented.go",
+        "package domain\nimport (\n  // \"github.com/acme/app/src/infrastructure/dbgo\"\n)\n",
+    );
     repo.write("src/infrastructure/dbgo/dbgo.go", "package dbgo\n");
 
     let report = validate_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
@@ -481,68 +514,3 @@ ignore:
         Some("generated/client.ts")
     );
 }
-
-struct FixtureRepo {
-    root: PathBuf,
-}
-
-impl FixtureRepo {
-    fn new() -> Self {
-        let nonce = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .unwrap()
-            .as_nanos();
-        let counter = FIXTURE_COUNTER.fetch_add(1, Ordering::Relaxed);
-        let root = std::env::temp_dir().join(format!(
-            "naome-arch-fixture-{}-{nonce}-{counter}",
-            std::process::id()
-        ));
-        fs::create_dir_all(&root).unwrap();
-        fs::write(
-            root.join(".naomeignore"),
-            ".naome/archive/\n.naome/tasks/\n",
-        )
-        .unwrap();
-        Self { root }
-    }
-
-    fn path(&self) -> &Path {
-        &self.root
-    }
-
-    fn write(&self, relative_path: &str, content: &str) {
-        let path = self.root.join(relative_path);
-        fs::create_dir_all(path.parent().unwrap()).unwrap();
-        fs::write(path, content).unwrap();
-    }
-
-    fn init_git(&self) {
-        run_git(&self.root, &["init"]);
-        run_git(&self.root, &["config", "user.email", "naome@example.com"]);
-        run_git(&self.root, &["config", "user.name", "NAOME Test"]);
-        self.write("README.md", "# Fixture\n");
-        run_git(&self.root, &["add", "."]);
-        run_git(&self.root, &["commit", "-m", "baseline"]);
-    }
-}
-
-fn run_git(root: &Path, args: &[&str]) {
-    let result = Command::new("git")
-        .args(args)
-        .current_dir(root)
-        .output()
-        .unwrap();
-    assert!(
-        result.status.success(),
-        "git {:?} failed: {}{}",
-        args,
-        String::from_utf8_lossy(&result.stdout),
-        String::from_utf8_lossy(&result.stderr)
-    );
-}
-
-fn has_import_edge(scan: &naome_core::ArchitectureScanReport, from: &str, to: &str) -> bool {
-    scan.graph.edges.iter().any(|edge| {
-        edge.kind == ArchitectureEdgeKind::Imports && edge.from == from && edge.to == to
-    })
-}

package/crates/naome-core/tests/architecture_rules.rs

@@ -0,0 +1,498 @@
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use naome_core::{validate_architecture, ArchitectureScanOptions};
+
+static FIXTURE_COUNTER: AtomicU64 = AtomicU64::new(0);
+const BILLING_INTERNAL_DB_IMPORT: &str = "import { db } from '../src/billing/internal/db';\n";
+const BILLING_INTERNAL_DB_EXPORT: &str = "export const db = 1;\n";
+const RUST_PARENT_MODULE_ENTRY: &str = "mod parent;\nuse parent::run;\npub fn main() { run(); }\n";
+const RUST_PARENT_MODULE_SOURCE: &str =
+    "mod child;\nuse self::child::call;\npub fn helper() {}\npub fn run() { call(); }\n";
+const RUST_CHILD_MODULE_SOURCE: &str = "use super::helper;\npub fn call() { helper(); }\n";
+const RUST_CRATE_PARENT_MODULE_SOURCE: &str =
+    "mod child;\nuse crate::parent::child::call;\npub fn helper() {}\npub fn run() { call(); }\n";
+const RUST_CRATE_CHILD_MODULE_SOURCE: &str =
+    "use crate::parent::helper;\npub fn call() { helper(); }\n";
+const TRANSITIVE_LAYER_POLICY_CONFIG: &str = "layers:\n  domain:\n    paths:\n      - \"src/domain/**\"\n  shared:\n    paths:\n      - \"src/shared/**\"\n  infrastructure:\n    paths:\n      - \"src/infrastructure/**\"\nallowed_dependencies:\n  domain:\n    - shared\n  shared:\n  infrastructure:\n    - domain\n    - shared\nexternal_dependencies:\n  domain:\n    allow: []\n  infrastructure:\n    allow:\n      - \"stripe\"\n      - \"@supabase/*\"\nrules:\n  no_transitive_forbidden_layer_dependencies:\n    enabled: true\n    severity: error\n  external_dependency_policy:\n    enabled: true\n    severity: error\n";
+const GO_EXTERNAL_POLICY_CONFIG: &str = "layers:\n  domain:\n    paths:\n      - \"domain/**\"\nexternal_dependencies:\n  domain:\n    allow:\n      - \"github.com/acme/payments\"\nrules:\n  external_dependency_policy:\n    enabled: true\n    severity: error\n";
+const PYTHON_RUST_EXTERNAL_POLICY_CONFIG: &str = "layers:\n  domain:\n    paths:\n      - \"src/domain/**\"\nexternal_dependencies:\n  domain:\n    allow:\n      - \"requests\"\n      - \"serde\"\nrules:\n  external_dependency_policy:\n    enabled: true\n    severity: error\n";
+const STDLIB_EXTERNAL_POLICY_CONFIG: &str = "layers:\n  domain:\n    paths:\n      - \"src/domain/**\"\n      - \"domain/**\"\nexternal_dependencies:\n  domain:\n    allow: []\nrules:\n  external_dependency_policy:\n    enabled: true\n    severity: error\n";
+
+#[test]
+fn context_public_api_cycles_and_budgets_report_deterministic_violations() {
+    let repo = fixture_root();
+    write_context_boundary_config(
+        &repo,
+        false,
+        "  no_cycles:\n    enabled: true\n    severity: error\n  max_imports_per_file:\n    enabled: true\n    value: 1\n    severity: warning\n  max_fan_out:\n    enabled: true\n    value: 1\n    severity: warning\n",
+    );
+    fixture_write(
+        &repo,
+        "src/billing/use_ticket.ts",
+        "import { internal } from '../ticketing/internal/service';\nimport { helper } from './helper';\n",
+    );
+    fixture_write(&repo, "src/billing/helper.ts", "export const helper = 1;\n");
+    fixture_write(
+        &repo,
+        "src/ticketing/internal/service.ts",
+        "export const internal = 1;\n",
+    );
+    fixture_write(
+        &repo,
+        "src/billing/a.ts",
+        "import { b } from './b';\nexport const a = b;\n",
+    );
+    fixture_write(
+        &repo,
+        "src/billing/b.ts",
+        "import { a } from './a';\nexport const b = a;\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+    let ids = report
+        .violations
+        .iter()
+        .map(|violation| violation.id.as_str())
+        .collect::<Vec<_>>();
+
+    assert!(ids.contains(&"arch.no_cross_context_internal_imports"));
+    assert!(ids.contains(&"arch.public_api_boundary"));
+    assert!(ids.contains(&"arch.no_cycles"));
+    assert!(ids.contains(&"arch.max_imports_per_file"));
+    assert!(ids.contains(&"arch.max_fan_out"));
+    assert!(report
+        .violations
+        .iter()
+        .any(|violation| violation.agent_instruction.contains("public API")));
+}
+
+#[test]
+fn catch_all_contexts_do_not_hide_specific_context_boundaries() {
+    let repo = fixture_root();
+    write_context_boundary_config(&repo, true, "");
+    fixture_write(
+        &repo,
+        "src/billing/use_ticket.ts",
+        "import { internal } from '../ticketing/internal/service';\n",
+    );
+    fixture_write(
+        &repo,
+        "src/ticketing/internal/service.ts",
+        "export const internal = 1;\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(report
+        .violations
+        .iter()
+        .any(|violation| violation.id == "arch.no_cross_context_internal_imports"));
+    assert!(report
+        .violations
+        .iter()
+        .any(|violation| violation.id == "arch.public_api_boundary"));
+}
+
+#[test]
+fn catch_all_contexts_do_not_turn_shared_helpers_into_context_targets() {
+    let repo = fixture_root();
+    write_context_boundary_config(&repo, true, "");
+    fixture_write(
+        &repo,
+        "src/billing/use_logger.ts",
+        "import { logger } from '../shared/logger';\n",
+    );
+    fixture_write(
+        &repo,
+        "src/shared/logger.ts",
+        "export const logger = console;\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(
+        report.violations.iter().all(|violation| !matches!(
+            violation.id.as_str(),
+            "arch.no_cross_context_internal_imports" | "arch.public_api_boundary"
+        )),
+        "{:?}",
+        report.violations
+    );
+}
+
+fn write_context_boundary_config(repo: &Path, include_default: bool, extra_rules: &str) {
+    let default_context = if include_default {
+        "  default:\n    paths:\n      - \"src/**\"\n    public_api:\n      - \"src/index.ts\"\n"
+    } else {
+        ""
+    };
+    fixture_write(
+        repo,
+        "naome.arch.yaml",
+        &format!(
+            "contexts:\n{default_context}  billing:\n    paths:\n      - \"src/billing/**\"\n    public_api:\n      - \"src/billing/index.ts\"\n  ticketing:\n    paths:\n      - \"src/ticketing/**\"\n    public_api:\n      - \"src/ticketing/index.ts\"\nrules:\n  no_cross_context_internal_imports:\n    enabled: true\n    severity: error\n  public_api_boundary:\n    enabled: true\n    severity: error\n{extra_rules}"
+        ),
+    );
+}
+
+#[test]
+fn transitive_layer_and_external_dependency_policies_are_enforced() {
+    let repo = fixture_root();
+    fixture_write(&repo, "naome.arch.yaml", TRANSITIVE_LAYER_POLICY_CONFIG);
+    fixture_write(
+        &repo,
+        "src/domain/event.ts",
+        "import { shared } from '../shared/shared';\nimport Stripe from 'stripe';\n",
+    );
+    fixture_write(
+        &repo,
+        "src/shared/shared.ts",
+        "import { db } from '../infrastructure/db';\nexport const shared = db;\n",
+    );
+    fixture_write(&repo, "src/infrastructure/db.ts", "export const db = 1;\n");
+    fixture_write(
+        &repo,
+        "src/infrastructure/payments.ts",
+        "import Stripe from 'stripe';\nexport const payments = Stripe;\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(report.violations.iter().any(|violation| {
+        violation.id == "arch.no_transitive_forbidden_layer_dependencies"
+            && violation.path.as_deref() == Some("src/domain/event.ts")
+    }));
+    assert!(report.violations.iter().any(|violation| {
+        violation.id == "arch.external_dependency_policy"
+            && violation.path.as_deref() == Some("src/domain/event.ts")
+            && violation.to.as_deref() == Some("external:stripe")
+    }));
+    assert!(!report.violations.iter().any(|violation| {
+        violation.id == "arch.external_dependency_policy"
+            && violation.path.as_deref() == Some("src/infrastructure/payments.ts")
+    }));
+}
+
+#[test]
+fn go_external_dependency_policy_matches_full_module_paths() {
+    let repo = fixture_root();
+    fixture_write(&repo, "naome.arch.yaml", GO_EXTERNAL_POLICY_CONFIG);
+    fixture_write(
+        &repo,
+        "domain/payments.go",
+        "package domain\nimport \"github.com/acme/payments\"\n",
+    );
+    fixture_write(
+        &repo,
+        "domain/storage.go",
+        "package domain\nimport \"github.com/acme/storage\"\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(!report.violations.iter().any(|violation| {
+        violation.id == "arch.external_dependency_policy"
+            && violation.path.as_deref() == Some("domain/payments.go")
+    }));
+    assert!(report.violations.iter().any(|violation| {
+        violation.id == "arch.external_dependency_policy"
+            && violation.path.as_deref() == Some("domain/storage.go")
+            && violation.to.as_deref() == Some("external:github.com/acme/storage")
+    }));
+}
+
+#[test]
+fn external_dependency_policy_normalizes_python_members_and_rust_aliases() {
+    let repo = fixture_root();
+    fixture_write(&repo, "naome.arch.yaml", PYTHON_RUST_EXTERNAL_POLICY_CONFIG);
+    fixture_write(
+        &repo,
+        "src/domain/http.py",
+        "from requests import Session\n",
+    );
+    fixture_write(
+        &repo,
+        "src/domain/lib.rs",
+        "extern crate serde as serde_json;\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(
+        report
+            .violations
+            .iter()
+            .all(|violation| violation.id != "arch.external_dependency_policy"),
+        "{:?}",
+        report.violations
+    );
+}
+
+#[test]
+fn external_dependency_policy_ignores_language_standard_libraries() {
+    let repo = fixture_root();
+    fixture_write(&repo, "naome.arch.yaml", STDLIB_EXTERNAL_POLICY_CONFIG);
+    fixture_write(
+        &repo,
+        "src/domain/node.js",
+        "import fs from 'node:fs';\nimport express from 'express';\n",
+    );
+    fixture_write(
+        &repo,
+        "src/domain/service.py",
+        "from os import path\nimport requests\n",
+    );
+    fixture_write(
+        &repo,
+        "src/domain/lib.rs",
+        "use std::fs;\nextern crate serde;\n",
+    );
+    fixture_write(
+        &repo,
+        "domain/main.go",
+        "package domain\nimport (\n  \"fmt\"\n  \"github.com/acme/storage\"\n)\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+    let external_targets = report
+        .violations
+        .iter()
+        .filter(|violation| violation.id == "arch.external_dependency_policy")
+        .filter_map(|violation| violation.to.as_deref())
+        .collect::<Vec<_>>();
+
+    assert_eq!(
+        external_targets,
+        vec![
+            "external:github.com/acme/storage",
+            "external:serde",
+            "external:express",
+            "external:requests"
+        ]
+    );
+}
+
+#[test]
+fn uncontexted_callers_must_use_context_public_apis() {
+    let repo = fixture_root();
+    fixture_write(
+        &repo,
+        "naome.arch.yaml",
+        r#"
+contexts:
+  billing:
+    paths:
+      - "src/billing/**"
+    public_api:
+      - "src/billing/index.ts"
+rules:
+  no_cross_context_internal_imports:
+    enabled: true
+    severity: error
+  public_api_boundary:
+    enabled: true
+    severity: error
+"#,
+    );
+    fixture_write(&repo, "tests/billing_test.ts", BILLING_INTERNAL_DB_IMPORT);
+    fixture_write(
+        &repo,
+        "src/billing/internal/db.ts",
+        BILLING_INTERNAL_DB_EXPORT,
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(report
+        .violations
+        .iter()
+        .any(|violation| violation.id == "arch.no_cross_context_internal_imports"));
+    assert!(report
+        .violations
+        .iter()
+        .any(|violation| violation.id == "arch.public_api_boundary"));
+}
+
+#[test]
+fn non_public_cross_context_imports_do_not_count_as_internal_imports() {
+    let repo = fixture_root();
+    write_context_boundary_config(&repo, false, "");
+    fixture_write(
+        &repo,
+        "src/billing/use_ticket.ts",
+        "import { helper } from '../ticketing/helpers';\n",
+    );
+    fixture_write(
+        &repo,
+        "src/ticketing/helpers.ts",
+        "export const helper = 1;\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(!report
+        .violations
+        .iter()
+        .any(|violation| violation.id == "arch.no_cross_context_internal_imports"));
+    assert!(report
+        .violations
+        .iter()
+        .any(|violation| violation.id == "arch.public_api_boundary"));
+}
+
+#[test]
+fn rust_module_declarations_do_not_create_import_cycles() {
+    let repo = fixture_root();
+    write_cycle_config(&repo);
+    fixture_write(&repo, "src/lib.rs", RUST_PARENT_MODULE_ENTRY);
+    fixture_write(&repo, "src/parent.rs", RUST_PARENT_MODULE_SOURCE);
+    fixture_write(&repo, "src/parent/child.rs", RUST_CHILD_MODULE_SOURCE);
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(
+        report
+            .violations
+            .iter()
+            .all(|violation| violation.id != "arch.no_cycles"),
+        "{:?}",
+        report.violations
+    );
+}
+
+#[test]
+fn rust_crate_qualified_parent_child_modules_do_not_create_import_cycles() {
+    let repo = fixture_root();
+    write_cycle_config(&repo);
+    fixture_write(&repo, "src/lib.rs", "mod parent;\n");
+    fixture_write(&repo, "src/parent.rs", RUST_CRATE_PARENT_MODULE_SOURCE);
+    fixture_write(&repo, "src/parent/child.rs", RUST_CRATE_CHILD_MODULE_SOURCE);
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(
+        report
+            .violations
+            .iter()
+            .all(|violation| violation.id != "arch.no_cycles"),
+        "{:?}",
+        report.violations
+    );
+}
+
+#[test]
+fn self_imports_are_reported_as_cycles() {
+    let repo = fixture_root();
+    write_cycle_config(&repo);
+    fixture_write(
+        &repo,
+        "src/a.ts",
+        "import { a } from './a';\nexport const a = 1;\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(
+        report
+            .violations
+            .iter()
+            .any(|violation| violation.id == "arch.no_cycles"),
+        "{:?}",
+        report.violations
+    );
+}
+
+#[test]
+fn rust_sibling_module_import_cycles_are_still_reported() {
+    let repo = rust_sibling_cycle_repo(
+        "use crate::parent::right::right;\npub fn left() { right(); }\n",
+        "use crate::parent::left::left;\npub fn right() { left(); }\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(
+        report
+            .violations
+            .iter()
+            .any(|violation| violation.id == "arch.no_cycles"),
+        "{:?}",
+        report.violations
+    );
+}
+
+#[test]
+fn rust_relative_sibling_module_references_are_module_internal() {
+    let repo = rust_sibling_cycle_repo(
+        "use super::right::right;\npub fn left() { right(); }\n",
+        "use super::left::left;\npub fn right() { left(); }\n",
+    );
+
+    let report = validate_architecture(&repo, ArchitectureScanOptions::default()).unwrap();
+
+    assert!(
+        report
+            .violations
+            .iter()
+            .any(|violation| violation.id == "arch.no_cycles"),
+        "{:?}",
+        report.violations
+    );
+}
+
+fn rust_sibling_cycle_repo(left_source: &str, right_source: &str) -> PathBuf {
+    let repo = fixture_root();
+    write_cycle_config(&repo);
+    fixture_write(&repo, "src/lib.rs", "mod parent;\n");
+    fixture_write(&repo, "src/parent.rs", "pub mod left;\npub mod right;\n");
+    fixture_write(&repo, "src/parent/left.rs", left_source);
+    fixture_write(&repo, "src/parent/right.rs", right_source);
+    repo
+}
+
+fn write_cycle_config(repo: &Path) {
+    fixture_write(
+        repo,
+        "naome.arch.yaml",
+        r#"
+rules:
+  no_cycles:
+    enabled: true
+    severity: error
+"#,
+    );
+}
+
+fn fixture_root() -> PathBuf {
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    let counter = FIXTURE_COUNTER.fetch_add(1, Ordering::Relaxed);
+    let mut root = std::env::temp_dir();
+    root.push(format!(
+        "naome-arch-rules-fixture-{}-{nonce}-{counter}",
+        std::process::id()
+    ));
+    fs::create_dir_all(&root).unwrap();
+    fs::write(
+        root.join(".naomeignore"),
+        [".naome/archive/", ".naome/tasks/", ""].join("\n"),
+    )
+    .unwrap();
+    root
+}
+
+fn fixture_write(root: &Path, relative_path: &str, content: &str) {
+    let path = relative_path
+        .split('/')
+        .fold(root.to_path_buf(), |mut path, segment| {
+            path.push(segment);
+            path
+        });
+    fs::create_dir_all(path.parent().unwrap()).unwrap();
+    fs::write(path, content).unwrap();
+}