@lamentis/naome 1.3.15 → 1.3.16

package/Cargo.lock

@@ -76,7 +76,7 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "naome-cli"
-version = "1.3.15"
+version = "1.3.16"
 dependencies = [
  "naome-core",
  "serde_json",
@@ -84,7 +84,7 @@ dependencies = [
 
 [[package]]
 name = "naome-core"
-version = "1.3.15"
+version = "1.3.16"
 dependencies = [
  "serde",
  "serde_json",

package/crates/naome-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "naome-cli"
-version = "1.3.15"
+version = "1.3.16"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

package/crates/naome-cli/src/architecture_commands.rs

@@ -2,9 +2,9 @@ use std::fs;
 use std::path::{Path, PathBuf};
 
 use naome_core::{
-    default_architecture_config_text, format_architecture_explain, format_architecture_scan,
-    format_architecture_validation, scan_architecture, validate_architecture,
-    ArchitectureScanOptions, ARCHITECTURE_RULE_IDS,
+    config_findings_for, default_architecture_config_text, format_architecture_explain,
+    format_architecture_scan, format_architecture_validation, scan_architecture,
+    validate_architecture, ArchitectureScanOptions, ARCHITECTURE_RULE_IDS,
 };
 
 use crate::cli_args::{has_flag, option_value};
@@ -53,7 +53,8 @@ fn run_arch_explain(root: &Path, args: &[String]) -> Result<(), Box<dyn std::err
                 "layers": scan.config.layers.keys().collect::<Vec<_>>(),
                 "contexts": scan.config.contexts.keys().collect::<Vec<_>>(),
                 "rules": ARCHITECTURE_RULE_IDS,
-                "extractors": ["path", "typescript", "javascript", "rust", "python", "go", "swift"]
+                "extractors": ["path", "typescript", "javascript", "rust", "python", "go", "swift"],
+                "configFindings": config_findings_for(&scan)
             }))?
         );
     } else {

package/crates/naome-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "naome-core"
-version = "1.3.15"
+version = "1.3.16"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

package/crates/naome-core/src/architecture/output.rs

@@ -34,6 +34,17 @@ pub struct ArchitectureAgentFeedback {
     pub must_not_do: Vec<String>,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct ArchitectureConfigFinding {
+    pub id: String,
+    pub severity: String,
+    pub subject: String,
+    pub message: String,
+    pub suggestion: String,
+    pub agent_instruction: String,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ArchitectureValidation {
@@ -48,6 +59,7 @@ pub struct ArchitectureValidation {
     pub changed_only_degraded_to_full_scan: bool,
     pub changed_only_mode: String,
     pub changed_only_degradation_reason: Option<String>,
+    pub config_findings: Vec<ArchitectureConfigFinding>,
     pub violations: Vec<ArchitectureViolation>,
     #[serde(rename = "agent_feedback")]
     pub agent_feedback: Vec<ArchitectureAgentFeedback>,
@@ -83,6 +95,131 @@ pub fn architecture_agent_feedback(
         .collect()
 }
 
+pub fn config_findings_for(scan: &ArchitectureScanReport) -> Vec<ArchitectureConfigFinding> {
+    let mut findings = Vec::new();
+    findings.extend(broad_layer_findings(scan));
+    findings.extend(catch_all_context_findings(scan));
+    findings.sort_by(|left, right| {
+        (left.id.as_str(), left.subject.as_str()).cmp(&(right.id.as_str(), right.subject.as_str()))
+    });
+    findings.dedup_by(|left, right| left.id == right.id && left.subject == right.subject);
+    findings
+}
+
+fn broad_layer_findings(scan: &ArchitectureScanReport) -> Vec<ArchitectureConfigFinding> {
+    let mut findings = Vec::new();
+    for (layer_name, layer) in &scan.config.layers {
+        let Some(broad_pattern) = layer
+            .paths
+            .iter()
+            .find(|pattern| is_broad_source_pattern(pattern))
+        else {
+            continue;
+        };
+        let overlapping_layers = scan
+            .config
+            .layers
+            .iter()
+            .filter(|(other_name, other_layer)| {
+                other_name.as_str() != layer_name.as_str()
+                    && other_layer
+                        .paths
+                        .iter()
+                        .any(|pattern| pattern_is_narrower_than(pattern, broad_pattern))
+            })
+            .map(|(name, _)| name.clone())
+            .collect::<Vec<_>>();
+        if overlapping_layers.is_empty() {
+            continue;
+        }
+        findings.push(ArchitectureConfigFinding {
+            id: "arch.config.broad_layer_overlap".to_string(),
+            severity: "warning".to_string(),
+            subject: format!("layer:{layer_name}"),
+            message: format!(
+                "Layer {layer_name} uses broad path pattern {broad_pattern} while narrower layers also match inside it: {}.",
+                overlapping_layers.join(", ")
+            ),
+            suggestion: format!(
+                "Keep broad compatibility layers intentional and make allowed_dependencies explicit, or narrow {layer_name} so files do not inherit multiple architectural meanings by default."
+            ),
+            agent_instruction: format!(
+                "Do not rely on broad layer {layer_name} to hide architecture boundaries; prefer narrower layer paths or explicit allow rules."
+            ),
+        });
+    }
+    findings
+}
+
+fn catch_all_context_findings(scan: &ArchitectureScanReport) -> Vec<ArchitectureConfigFinding> {
+    if scan.config.contexts.len() <= 1 {
+        return Vec::new();
+    }
+    scan.config
+        .contexts
+        .iter()
+        .filter(|(_, context)| {
+            context
+                .paths
+                .iter()
+                .any(|pattern| is_broad_source_pattern(pattern))
+        })
+        .filter_map(|(context_name, context)| {
+            let broad_pattern = context
+                .paths
+                .iter()
+                .find(|pattern| is_broad_source_pattern(pattern))?;
+            let specific_contexts = scan
+                .config
+                .contexts
+                .iter()
+                .filter(|(other_name, other_context)| {
+                    other_name.as_str() != context_name.as_str()
+                        && other_context
+                            .paths
+                            .iter()
+                            .any(|pattern| pattern_is_narrower_than(pattern, broad_pattern))
+                })
+                .map(|(name, _)| name.clone())
+                .collect::<Vec<_>>();
+            if specific_contexts.is_empty() {
+                return None;
+            }
+            Some(ArchitectureConfigFinding {
+                id: "arch.config.catch_all_context_with_specific_contexts".to_string(),
+                severity: "warning".to_string(),
+                subject: format!("context:{context_name}"),
+                message: format!(
+                    "Context {context_name} uses catch-all path pattern {broad_pattern} alongside narrower contexts: {}.",
+                    specific_contexts.join(", ")
+                ),
+                suggestion: format!(
+                    "Treat {context_name} as a compatibility bucket only. Move shared code into explicit public APIs or replace the catch-all context with narrower bounded contexts."
+                ),
+                agent_instruction: format!(
+                    "Do not classify cross-context imports as safe only because {context_name} also matches them; model the real bounded context or public API."
+                ),
+            })
+        })
+        .collect()
+}
+
+fn is_broad_source_pattern(pattern: &str) -> bool {
+    matches!(pattern, "**" | "**/*" | "src/**" | "packages/**/src/**")
+}
+
+fn pattern_is_narrower_than(pattern: &str, broad_pattern: &str) -> bool {
+    if pattern == broad_pattern {
+        return false;
+    }
+    match broad_pattern {
+        "**" | "**/*" => true,
+        "src/**" => pattern.starts_with("src/") && pattern != "src/**",
+        "packages/**/src/**" => pattern.starts_with("packages/") && pattern.contains("/src/"),
+        _ => false,
+    }
+}
+
 pub fn summary_for(violations: &[ArchitectureViolation]) -> ViolationSummary {
     ViolationSummary {
         errors: violations
@@ -128,6 +265,21 @@ pub fn format_architecture_validation(report: &ArchitectureValidation) -> String
         lines.push("changed-only requested: using incremental architecture cache".to_string());
     }
 
+    if !report.config_findings.is_empty() {
+        lines.push(format!(
+            "configuration findings: {}",
+            report.config_findings.len()
+        ));
+    }
+
+    for finding in report.config_findings.iter().take(5) {
+        lines.push(format!(
+            "- Config {} {} {}",
+            finding.severity, finding.subject, finding.message
+        ));
+        lines.push(format!("  fix: {}", finding.suggestion));
+    }
+
     for violation in report.violations.iter().take(10) {
         lines.push(format!(
             "- {:?} {} {}",
@@ -164,6 +316,7 @@ pub fn format_architecture_scan(report: &ArchitectureScanReport) -> String {
 }
 
 pub fn format_architecture_explain(scan: &ArchitectureScanReport) -> String {
+    let findings = config_findings_for(scan);
     let layers = scan
         .config
         .layers
@@ -178,12 +331,22 @@ pub fn format_architecture_explain(scan: &ArchitectureScanReport) -> String {
         .cloned()
         .collect::<Vec<_>>()
         .join(", ");
-    format!(
+    let mut output = format!(
         "NAOME Architecture Fitness\nrules: {}\nlayers: {}\ncontexts: {}\npath extractor: enabled for every repository\nimport extractors: typescript, javascript, rust, python, go, swift\n",
         ARCHITECTURE_RULE_IDS.join(", "),
         empty_label(&layers),
         empty_label(&contexts)
-    )
+    );
+    if !findings.is_empty() {
+        output.push_str(&format!("configuration findings: {}\n", findings.len()));
+        for finding in findings.iter().take(5) {
+            output.push_str(&format!(
+                "- {} {}: {}\n",
+                finding.severity, finding.subject, finding.message
+            ));
+        }
+    }
+    output
 }
 
 fn empty_label(value: &str) -> &str {

package/crates/naome-core/src/architecture/rules.rs

@@ -2,7 +2,8 @@ use crate::paths;
 
 use super::model::Severity;
 use super::output::{
-    architecture_agent_feedback, summary_for, ArchitectureValidation, ArchitectureViolation,
+    architecture_agent_feedback, config_findings_for, summary_for, ArchitectureValidation,
+    ArchitectureViolation,
 };
 use super::scan::ArchitectureScanReport;
 use crate::architecture::model::ArchitectureEdgeKind;
@@ -44,6 +45,7 @@ pub fn validate_scan(scan: ArchitectureScanReport) -> ArchitectureValidation {
     let summary = summary_for(&violations);
     let status = if summary.errors > 0 { "fail" } else { "pass" }.to_string();
     let agent_feedback = architecture_agent_feedback(&violations);
+    let config_findings = config_findings_for(&scan);
 
     ArchitectureValidation {
         schema: "naome.arch.validation.v1".to_string(),
@@ -57,6 +59,7 @@ pub fn validate_scan(scan: ArchitectureScanReport) -> ArchitectureValidation {
         changed_only_degraded_to_full_scan: scan.changed_only_degraded_to_full_scan,
         changed_only_mode: scan.changed_only_mode,
         changed_only_degradation_reason: scan.changed_only_degradation_reason,
+        config_findings,
         violations,
         agent_feedback,
     }

package/crates/naome-core/src/architecture.rs

@@ -16,9 +16,9 @@ pub use model::{
     ArchitectureNode, ArchitectureNodeKind, Severity, SourceRange,
 };
 pub use output::{
-    format_architecture_explain, format_architecture_scan, format_architecture_validation,
-    ArchitectureAgentFeedback, ArchitectureValidation, ArchitectureViolation, ViolationSummary,
-    ARCHITECTURE_RULE_IDS,
+    config_findings_for, format_architecture_explain, format_architecture_scan,
+    format_architecture_validation, ArchitectureAgentFeedback, ArchitectureConfigFinding,
+    ArchitectureValidation, ArchitectureViolation, ViolationSummary, ARCHITECTURE_RULE_IDS,
 };
 pub use scan::{scan_architecture, ArchitectureScanOptions, ArchitectureScanReport};
 

package/crates/naome-core/src/lib.rs

@@ -21,13 +21,13 @@ mod verification_contract_policy;
 mod workflow;
 
 pub use architecture::{
-    default_architecture_config_text, format_architecture_explain, format_architecture_scan,
-    format_architecture_validation, scan_architecture, validate_architecture,
-    ArchitectureAgentFeedback, ArchitectureConfig, ArchitectureEdge, ArchitectureEdgeKind,
-    ArchitectureGraph, ArchitectureMetadata, ArchitectureNode, ArchitectureNodeKind,
-    ArchitectureScanOptions, ArchitectureScanReport, ArchitectureValidation, ArchitectureViolation,
-    ContextConfig, LayerConfig, RuleConfig, Severity, SourceRange, ViolationSummary,
-    ARCHITECTURE_RULE_IDS,
+    config_findings_for, default_architecture_config_text, format_architecture_explain,
+    format_architecture_scan, format_architecture_validation, scan_architecture,
+    validate_architecture, ArchitectureAgentFeedback, ArchitectureConfig,
+    ArchitectureConfigFinding, ArchitectureEdge, ArchitectureEdgeKind, ArchitectureGraph,
+    ArchitectureMetadata, ArchitectureNode, ArchitectureNodeKind, ArchitectureScanOptions,
+    ArchitectureScanReport, ArchitectureValidation, ArchitectureViolation, ContextConfig,
+    LayerConfig, RuleConfig, Severity, SourceRange, ViolationSummary, ARCHITECTURE_RULE_IDS,
 };
 pub use context::{
     select_context_for_changed_paths, select_context_for_prompt, ContextBudgetLedger,

package/crates/naome-core/tests/architecture_config.rs

@@ -0,0 +1,67 @@
+use naome_core::{format_architecture_validation, validate_architecture, ArchitectureScanOptions};
+
+mod architecture_support;
+
+use architecture_support::FixtureRepo;
+
+#[test]
+fn validation_reports_risky_broad_architecture_config_without_failing() {
+    let repo = FixtureRepo::new();
+    repo.write(
+        "naome.arch.yaml",
+        r#"
+layers:
+  application:
+    paths:
+      - "src/**"
+  domain:
+    paths:
+      - "src/domain/**"
+  infrastructure:
+    paths:
+      - "src/infrastructure/**"
+allowed_dependencies:
+  application:
+    - domain
+    - infrastructure
+  domain:
+  infrastructure:
+    - domain
+contexts:
+  default:
+    paths:
+      - "src/**"
+    public_api:
+      - "src/index.ts"
+  billing:
+    paths:
+      - "src/billing/**"
+    public_api:
+      - "src/billing/index.ts"
+rules:
+  no_forbidden_layer_dependencies:
+    enabled: true
+    severity: error
+"#,
+    );
+    repo.write("src/domain/event.ts", "export const event = 1;\n");
+    repo.write("src/infrastructure/db.ts", "export const db = 1;\n");
+    repo.write("src/billing/index.ts", "export const billing = 1;\n");
+
+    let report = validate_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+    let output = format_architecture_validation(&report);
+
+    assert_eq!(report.status, "pass");
+    assert_eq!(report.summary.warnings, 0);
+    assert!(report.config_findings.iter().any(|finding| {
+        finding.id == "arch.config.broad_layer_overlap"
+            && finding.subject == "layer:application"
+            && finding.severity == "warning"
+    }));
+    assert!(report.config_findings.iter().any(|finding| {
+        finding.id == "arch.config.catch_all_context_with_specific_contexts"
+            && finding.subject == "context:default"
+            && finding.severity == "warning"
+    }));
+    assert!(output.contains("configuration findings: 2"));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.3.15",
+  "version": "1.3.16",
   "description": "Native-first CLI for the NAOME agent harness.",
   "license": "Apache-2.0",
   "type": "module",