@lamentis/naome 1.3.11 → 1.3.13

package/installer/harness-files.js

@@ -22,7 +22,7 @@ export function ensureCoreHarnessFiles(ctx, archiveDirName) {
   replaceHarnessFile(ctx, "docs/naome/task-ledger.md", archiveDirName);
   ensureTemplateFile(ctx, "docs/naome/repository-model.md");
   ensureTemplateFile(ctx, "docs/naome/security.md");
-  ensureTemplateFile(ctx, "docs/naome/architecture-fitness.md");
+  replaceHarnessFile(ctx, "docs/naome/architecture-fitness.md", archiveDirName);
   replaceHarnessFile(ctx, "docs/naome/upgrade.md", archiveDirName);
 }
 
@@ -40,7 +40,7 @@ export function ensureTaskControlHarnessFiles(ctx, archiveDirName) {
   replaceHarnessFile(ctx, "docs/naome/agent-workflow.md", archiveDirName);
   replaceHarnessFile(ctx, "docs/naome/context-economy.md", archiveDirName);
   replaceHarnessFile(ctx, "docs/naome/execution.md", archiveDirName);
-  ensureTemplateFile(ctx, "docs/naome/architecture-fitness.md");
+  replaceHarnessFile(ctx, "docs/naome/architecture-fitness.md", archiveDirName);
   replaceHarnessFile(ctx, "docs/naome/upgrade.md", archiveDirName);
 }
 
@@ -59,7 +59,7 @@ export function ensureHarnessHealthFiles(ctx, archiveDirName) {
   replaceHarnessFile(ctx, "docs/naome/context-economy.md", archiveDirName);
   replaceHarnessFile(ctx, "docs/naome/execution.md", archiveDirName);
   ensureTemplateFile(ctx, "docs/naome/security.md");
-  ensureTemplateFile(ctx, "docs/naome/architecture-fitness.md");
+  replaceHarnessFile(ctx, "docs/naome/architecture-fitness.md", archiveDirName);
   replaceHarnessFile(ctx, "docs/naome/upgrade.md", archiveDirName);
   ensureNaomeIgnore(ctx);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.3.11",
+  "version": "1.3.13",
   "description": "Native-first CLI for the NAOME agent harness.",
   "license": "Apache-2.0",
   "type": "module",

package/templates/naome-root/.naome/manifest.json

@@ -1,5 +1,5 @@
 {
-  "harnessVersion": "1.3.11",
+  "harnessVersion": "1.3.13",
   "installedAt": null,
   "integrity": {
     ".naome/bin/check-harness-health.js": "sha256:802d7419774981a6af1826b3882270ff8f41259d516f98c52a02b4ddc184c467",
@@ -9,7 +9,7 @@
     ".naome/task-contract.schema.json": "sha256:1b3b62350328d0d6d660e36d1d1baaa2b88718530db774f9ab2a9e2fcba369c8",
     "AGENTS.md": "sha256:e8b2fc786c1c72b69ba8f2b2ffce4f459e799c7453ce9ff4a9f6448a8f9e6b4f",
     "docs/naome/agent-workflow.md": "sha256:0be1c29adfbcd3fd73c4f904080ffc67237692fe413871a30243538c4db38ac7",
-    "docs/naome/architecture-fitness.md": "sha256:a1f08dc02eff4e4c37934cf48e3d7ed2453e34d55dac475bc24ab913e03f263d",
+    "docs/naome/architecture-fitness.md": "sha256:26f04884c3ada083380bee5c3cb1aa3f39d8c8a1cc31ccc84c4ae795c594de5b",
     "docs/naome/context-economy.md": "sha256:3ed5075815ecf4ada46a5e65438769310307c35759fcd46b13dc0b96e02bebd9",
     "docs/naome/execution.md": "sha256:bfc5d55838942ec8e3d790b59e3c634ff5bf6a2298265cef3dca9788a097eafb",
     "docs/naome/first-run.md": "sha256:1466ce8c65e19a1514885f917db14e8a772350e3f6d1c03a66326963365919e1",

package/templates/naome-root/docs/naome/architecture-fitness.md

@@ -53,6 +53,29 @@ rules:
   no_forbidden_layer_dependencies:
     enabled: true
     severity: error
+  no_cross_context_internal_imports:
+    enabled: true
+    severity: error
+  public_api_boundary:
+    enabled: true
+    severity: error
+  no_cycles:
+    enabled: true
+    severity: error
+  no_transitive_forbidden_layer_dependencies:
+    enabled: true
+    severity: error
+  max_imports_per_file:
+    enabled: true
+    value: 20
+    severity: warning
+  max_fan_out:
+    enabled: true
+    value: 20
+    severity: warning
+  external_dependency_policy:
+    enabled: true
+    severity: error
   max_file_lines:
     enabled: true
     value: 400
@@ -66,6 +89,14 @@ allowed_dependencies:
   infrastructure:
     - domain
 
+external_dependencies:
+  domain:
+    allow: []
+  infrastructure:
+    allow:
+      - "stripe"
+      - "@supabase/*"
+
 ignore:
   - path: "generated/**"
     reason: "Generated code is not architecture-owned."
@@ -79,6 +110,17 @@ ignore:
   change.
 - `arch.no_forbidden_layer_dependencies` rejects import edges whose source
   layer is not allowed to depend on the imported file's layer.
+- `arch.no_cross_context_internal_imports` rejects imports into another bounded
+  context's internal files.
+- `arch.public_api_boundary` requires cross-context imports to target declared
+  `public_api` paths.
+- `arch.no_cycles` detects file-level import cycles.
+- `arch.no_transitive_forbidden_layer_dependencies` catches indirect reachability
+  from a layer to a forbidden layer.
+- `arch.max_imports_per_file` and `arch.max_fan_out` enforce local dependency
+  budgets.
+- `arch.external_dependency_policy` enforces allowed external packages per layer
+  or context.
 
 ## Agent Integration
 
@@ -95,15 +137,26 @@ fails only on configured error rules.
 
 ## Language Support
 
-The v1.3.11 foundation classifies TypeScript, JavaScript, Rust, Python, Go,
+The v1.3.13 foundation classifies TypeScript, JavaScript, Rust, Python, Go,
 Java, Kotlin, and Swift files by path extension. It extracts import facts for
-TypeScript, JavaScript, Rust, Python, and Go, resolves relative imports and
-simple repository-absolute aliases, and represents unresolved imports
-explicitly as graph nodes instead of dropping them.
+TypeScript, JavaScript, Rust, Python, Go, and Swift, resolves relative imports
+and simple repository-absolute aliases where the language supports them, and
+represents unresolved imports explicitly as graph nodes instead of dropping
+them. Swift and iOS app repositories get Apple framework imports, SwiftPM
+manifests, and Xcode Swift package references represented in the normalized
+graph; Apple SDK frameworks are treated as platform APIs for external policy.
+It also extracts package and dependency facts from `package.json`,
+`Cargo.toml`, `pyproject.toml`, `go.mod`, lightweight `pom.xml` / Gradle
+manifests, `Package.swift`, and `.xcodeproj/project.pbxproj`, then emits
+manifest-identity package nodes and manifest-owned `DependsOn` edges to
+external dependencies.
+Architecture rules now cover layers, bounded contexts, public APIs, cycles,
+transitive layer reach, import/fan-out budgets, and external dependency
+policies.
 
 ## Limitations
 
-This release intentionally validates direct file-level import edges. Manifest
-extractors, cross-context public API boundaries, cycle detection, transitive
-forbidden dependencies, SARIF output, and persistent scan caching remain planned
-follow-up slices before v1.4.0.
+This release intentionally keeps validation file-graph based. Manifest
+extractors are dependency-owner oriented and do not yet parse every build-tool
+feature. SARIF output, persistent scan caching, and deeper symbol-level call
+analysis remain planned follow-up slices before v1.4.0.