@synap-core/workspace-templates 0.7.0 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synap-core/workspace-templates",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "type": "module",
   "packageManager": "pnpm@9.15.4",
   "description": "Canonical workspace definitions — YAML source + typed exports for browser, backend, CLI, and marketplace",
@@ -19,10 +19,11 @@
     "type-check": "tsc --noEmit",
     "build:yaml": "node build.mjs",
     "check:converters": "node scripts/check-converters.mjs",
-    "build": "node build.mjs && tsup && node scripts/check-converters.mjs",
+    "check:concepts": "node scripts/check-concepts.mjs",
+    "build": "node build.mjs && tsup && node scripts/check-converters.mjs && node scripts/check-concepts.mjs",
     "provision": "node scripts/provision.mjs",
     "eval": "node scripts/eval-standard.mjs",
-    "prepublishOnly": "node build.mjs && tsup && node scripts/check-converters.mjs"
+    "prepublishOnly": "node build.mjs && tsup && node scripts/check-converters.mjs && node scripts/check-concepts.mjs"
   },
   "dependencies": {
     "zod": "^3.0.0",

package/src/business-developer.yaml

@@ -50,6 +50,12 @@ profiles:
     description: A person or company actively being qualified or contacted by this CRM workspace.
     scope: WORKSPACE
     profileKind: role
+    # Explicit concept identity: this is the WORKSPACE tier of the `lead`
+    # concept, not a second, unrelated one. Declaring it makes the two-tier
+    # design machine-readable (both tiers are reachable via getBySemanticSlug)
+    # and is what the cross-template concept guard requires alongside its
+    # DECLARED_DIVERGENCES entry — see src/concept-guard.ts.
+    semanticSlug: crm.lead
     applicableKinds: [person, company]
     properties:
       - slug: lifecycleStage
@@ -112,6 +118,8 @@ profiles:
     description: A CRM lead converted by a won commercial proposal and ready for handoff.
     scope: WORKSPACE
     profileKind: role
+    # Workspace tier of the `client` concept — see the note on `crm-lead` above.
+    semanticSlug: crm.client
     applicableKinds: [person, company]
     properties:
       - slug: becameClientAt

package/src/catalog.test.ts

@@ -1,11 +1,11 @@
 /**
- * Unit tests for the mergeCatalog door. Run: `npx tsx --test src/catalog.test.ts`
+ * Unit tests for the mergeCatalog door. Run: `npx vitest run packages/workspace-templates` (from the repo root).
  *
  * These test the SOURCE (`./catalog.js` → catalog.ts), never `dist/`, so no build
  * is required and there is no stale-generated-output trap.
  */
 
-import { test } from "node:test";
+import { test } from "vitest";
 import assert from "node:assert/strict";
 import { mergeCatalog, computeTemplateUpdates, type RemoteEntry } from "./catalog.js";
 import type { WorkspaceYaml } from "./types.js";

package/src/composition-graph.test.ts

@@ -0,0 +1,135 @@
+/**
+ * Unit tests for the `layerTemplateGraph` KEYSTONE engine.
+ * Run: `npx vitest run packages/workspace-templates` (from the repo root).
+ *
+ * These test the SOURCE (`./composition-graph.js` → composition-graph.ts),
+ * never `dist/`, so no build is required and there is no stale-generated-
+ * output trap (same convention as `catalog.test.ts`).
+ */
+
+import { test } from "vitest";
+import assert from "node:assert/strict";
+import { layerTemplateGraph, type CompositionGraph } from "./composition-graph.js";
+import type { TemplateDependency } from "./types.js";
+
+/** Build a small `edgesOf` from a plain adjacency map, for test fixtures. */
+function edgesFrom(map: Record<string, TemplateDependency[]>) {
+  return (slug: string): readonly TemplateDependency[] => map[slug] ?? [];
+}
+
+function flat(graph: CompositionGraph): string[] {
+  return graph.layers.flat().map((n) => n.slug);
+}
+
+// ── Longest-path: deeper occurrence wins (bedrock behavior) ────────────────
+test("longest-path: a node required at depth 1 by one root and depth 3 by another lands at the deeper layer", () => {
+  // root-a -> shared (depth 1)
+  // root-b -> mid -> deep -> shared (depth 3)
+  const edgesOf = edgesFrom({
+    "root-a": [{ slug: "shared" }],
+    "root-b": [{ slug: "mid" }],
+    mid: [{ slug: "deep" }],
+    deep: [{ slug: "shared" }],
+  });
+
+  const graph = layerTemplateGraph({ roots: ["root-a", "root-b"], edgesOf });
+  const shared = graph.nodes.get("shared")!;
+  assert.equal(shared.layer, 3, "shared must sink to the DEEPER of its two reachable depths");
+});
+
+// ── Dedupe / fan-in ──────────────────────────────────────────────────────────
+test("dedupe/fan-in: a node reachable from 6 parents appears ONCE with dependents.length === 6", () => {
+  const parents = Array.from({ length: 6 }, (_, i) => `parent-${i}`);
+  const edgesOf = edgesFrom({
+    root: parents.map((p) => ({ slug: p })),
+    ...Object.fromEntries(parents.map((p) => [p, [{ slug: "foundation" }]])),
+  });
+
+  const graph = layerTemplateGraph({ roots: ["root"], edgesOf });
+  const foundationNodes = [...graph.nodes.values()].filter((n) => n.slug === "foundation");
+  assert.equal(foundationNodes.length, 1, "foundation must appear exactly once in the node map");
+  assert.equal(foundationNodes[0]!.dependents.length, 6, "foundation must carry TRUE fan-in from all 6 parents");
+});
+
+// ── Multi-root ───────────────────────────────────────────────────────────────
+test("multi-root: two roots both reaching a shared node → roots lists both", () => {
+  const edgesOf = edgesFrom({
+    "root-a": [{ slug: "shared" }],
+    "root-b": [{ slug: "shared" }],
+  });
+
+  const graph = layerTemplateGraph({ roots: ["root-a", "root-b"], edgesOf });
+  const shared = graph.nodes.get("shared")!;
+  assert.deepEqual(shared.roots, ["root-a", "root-b"]);
+});
+
+// ── Compose overlays ─────────────────────────────────────────────────────────
+test("compose: a relation:compose dep appears in the base's overlays[] and NOT in layers", () => {
+  // `grants` composes onto `operations` — mirrors the real grants.yaml/operations.yaml pair.
+  const edgesOf = edgesFrom({
+    grants: [{ slug: "operations", relation: "compose", reason: "overlay" }],
+  });
+
+  const graph = layerTemplateGraph({ roots: ["grants"], edgesOf });
+
+  const operations = graph.nodes.get("operations")!;
+  assert.ok(operations, "operations (the base) must be a real node");
+  assert.deepEqual(
+    operations.overlays.map((o) => o.slug),
+    ["grants"],
+    "the compose source must be attached as an overlay on the base"
+  );
+
+  assert.equal(graph.nodes.has("grants"), false, "the compose SOURCE must never be its own node");
+  assert.ok(!flat(graph).includes("grants"), "the compose source must never appear in layers[][]");
+
+  const composeEdge = graph.edges.find((e) => e.from === "grants" && e.to === "operations");
+  assert.ok(composeEdge, "the compose edge must still be recorded in edges[]");
+  assert.equal(composeEdge!.relation, "compose");
+});
+
+// ── Ghost nodes ──────────────────────────────────────────────────────────────
+test("ghost: an uninstalled dep is present with installed:false", () => {
+  const edgesOf = edgesFrom({
+    root: [{ slug: "not-installed-yet" }],
+  });
+
+  const graph = layerTemplateGraph({ roots: ["root"], edgesOf, installed: [] });
+  const ghost = graph.nodes.get("not-installed-yet")!;
+  assert.equal(ghost.installed, false);
+  assert.deepEqual(ghost.workspaceIds, []);
+  // The gap IS the information: it still occupies its layer.
+  assert.equal(graph.layers[ghost.layer]!.some((n) => n.slug === "not-installed-yet"), true);
+});
+
+// ── Cycles ───────────────────────────────────────────────────────────────────
+test("cycle: A→B→A terminates and reports the broken edge in cycles[]", () => {
+  const edgesOf = edgesFrom({
+    A: [{ slug: "B" }],
+    B: [{ slug: "A" }],
+  });
+
+  const graph = layerTemplateGraph({ roots: ["A"], edgesOf });
+
+  assert.equal(graph.cycles.length, 1);
+  assert.deepEqual(graph.cycles[0], ["B", "A"]);
+
+  // Still terminates and produces a usable graph.
+  assert.ok(graph.nodes.has("A"));
+  assert.ok(graph.nodes.has("B"));
+  assert.equal(graph.nodes.get("A")!.layer, 0);
+});
+
+// ── edgesOf injection ─────────────────────────────────────────────────────────
+test("edgesOf injection: deps supplied for a slug NOT in the bundled map are still walked", () => {
+  // "private-remote-pkg" does not exist in the bundled WORKSPACE_TEMPLATES map
+  // at all — this is the live bug rule 5 fixes: a caller-supplied edgesOf must
+  // still be able to walk it.
+  const edgesOf = edgesFrom({
+    "private-remote-pkg": [{ slug: "some-base", relation: "require" }],
+  });
+
+  const graph = layerTemplateGraph({ roots: ["private-remote-pkg"], edgesOf });
+  assert.ok(graph.nodes.has("some-base"), "a dependency declared only by the injected edgesOf must still be walked");
+  assert.equal(graph.nodes.get("some-base")!.layer, 1);
+});

package/src/composition-graph.ts

@@ -0,0 +1,298 @@
+/**
+ * layerTemplateGraph — the KEYSTONE composition-graph engine.
+ * ============================================================
+ *
+ * Today the CLI (`synap-cli/src/commands/market.ts` `buildCompositionTrees`)
+ * renders template composition as a nested TREE: `buildDependencyNode`
+ * rebuilds a fresh `TreeNode` for every OCCURRENCE of a slug on every path, so
+ * a widely-required base (e.g. `foundation`) prints once per branch that
+ * reaches it (6× under a suite like `enterprise-os`). Its "shared" tag is only
+ * top-level-package granularity — there is no true fan-in count.
+ *
+ * This module replaces that with a LAYERED DAG: every node appears EXACTLY
+ * ONCE, positioned at its longest-path depth, with edges converging on it —
+ * so `foundation` sinks to the bedrock row with N inbound edges instead of
+ * being redrawn N times. It is the single source of truth for template
+ * composition; the CLI, browser dialogs, backend boot-ordering, and (later)
+ * the Atlas all consume it.
+ *
+ * PURE + TRANSPORT-AGNOSTIC (same discipline as `catalog.ts`): this is the
+ * ONLY module `synap-cli`, `browser`, `synap-control-plane-api`, and
+ * `synap-backend` can all resolve. No React, no dagre/d3, no fetch, no
+ * Node-only APIs. Pixel layout lives elsewhere (browser-only) — this module
+ * only computes topology (layers + edges + memoized nodes), never coordinates.
+ *
+ * CONSUMES drift, never recomputes it: `installed` / `updates` are read
+ * straight off `catalog.ts`'s `InstalledTemplate`-shaped rows and
+ * `computeTemplateUpdates()` output — this module does no semver comparison
+ * of its own.
+ */
+
+import type { TemplateDependency } from "./types.js";
+import { getWorkspaceTemplate } from "./templates.js";
+import type { TemplateUpdateCheck } from "./catalog.js";
+
+// ============================================================================
+// Inputs
+// ============================================================================
+
+/**
+ * An installed template row, keyed by slug — the shape this engine needs to
+ * mark a node `installed` and populate `workspaceIds`.
+ *
+ * NOTE ON NAMING: `catalog.ts`'s `InstalledTemplate` is `{ slug, version }`
+ * only — it was built for `computeTemplateUpdates`'s narrower need (a version
+ * to diff) and carries no `workspaceId`. `CompositionNode.workspaceIds` is
+ * part of the ratified API and cannot be populated from that shape, so this
+ * is a REAL conflict, not a preference: this module declares its own,
+ * slightly richer row instead of importing `catalog.ts`'s `InstalledTemplate`
+ * under that name. Every field of `catalog.ts`'s `InstalledTemplate` is a
+ * subset of this one, so a caller building `InstalledTemplate[]` for
+ * `computeTemplateUpdates` can build ONE array of `CompositionInstalledEntry`
+ * and pass it to both doors.
+ */
+export interface CompositionInstalledEntry {
+  slug: string;
+  workspaceId: string;
+  workspaceName?: string;
+  /** `settings.packageVersion`, when the pod stamped one. Omit when unknown. */
+  version?: string;
+}
+
+/** One compose-relation dependency, attached to the BASE node it overlays onto. */
+export interface CompositionOverlay {
+  slug: string;
+  name: string;
+  installed: boolean;
+}
+
+/** One edge in the raw dependency graph, exactly as declared (kept even when broken by a cycle). */
+export interface CompositionEdge {
+  from: string;
+  to: string;
+  relation: "compose" | "require";
+  depKind?: string;
+}
+
+export interface CompositionNode {
+  slug: string;
+  name: string;
+  /** Longest-path depth: `1 + max(layer of every node that depends on this one)`. Roots = 0, bedrock = max. */
+  layer: number;
+  /** TRUE fan-in — every slug (node or compose-only overlay source) that declares a dependency on this one. */
+  dependents: string[];
+  /** Which of the input `roots` transitively reach this node (self-inclusive for a root). */
+  roots: string[];
+  installed: boolean;
+  workspaceIds: string[];
+  installedVersion?: string;
+  latestVersion?: string | null;
+  updateAvailable: boolean;
+  noVersionInfo: boolean;
+  /** `compose`-relation deps that overlay onto THIS node (see rule 2 — the overlay source itself is never a layer node). */
+  overlays: CompositionOverlay[];
+}
+
+export interface CompositionGraph {
+  nodes: Map<string, CompositionNode>;
+  edges: CompositionEdge[];
+  /** `layers[0]` = roots … `layers[n]` = bedrock. Compose-overlay SOURCES never appear here (rule 2). */
+  layers: CompositionNode[][];
+  /** Broken back-edges `[from, to]` — surfaced, never silently swallowed (rule 4). */
+  cycles: string[][];
+}
+
+export interface LayerTemplateGraphInput {
+  /** Top-level slugs to walk from. Always land at `layer: 0`. */
+  roots: string[];
+  /** INJECTED edge source (rule 5) — never hardcoded to the bundled map. See `bundledEdgesOf`. */
+  edgesOf: (slug: string) => readonly TemplateDependency[];
+  nameOf?: (slug: string) => string | undefined;
+  installed?: CompositionInstalledEntry[];
+  updates?: TemplateUpdateCheck[];
+}
+
+/**
+ * Default `edgesOf` — reads `dependencies[]` off the BUNDLED template map
+ * only. This is what the current CLI walker is hardcoded to, which is
+ * precisely the live bug rule 5 fixes: a remote/private CP-only package's
+ * `definition.dependencies` are invisible to it, so its subtree silently
+ * renders empty. Callers with a remote catalog entry available should pass
+ * their OWN `edgesOf` that falls back to `entry.remote.definition.dependencies`
+ * (or similar) for slugs this default can't see.
+ */
+export function bundledEdgesOf(slug: string): readonly TemplateDependency[] {
+  return getWorkspaceTemplate(slug)?.dependencies ?? [];
+}
+
+// ============================================================================
+// The engine
+// ============================================================================
+
+export function layerTemplateGraph(input: LayerTemplateGraphInput): CompositionGraph {
+  const { roots, edgesOf } = input;
+  const nameOf = input.nameOf ?? (() => undefined);
+  const rootSet = new Set(roots);
+
+  const installedBySlug = new Map<string, CompositionInstalledEntry[]>();
+  for (const entry of input.installed ?? []) {
+    const list = installedBySlug.get(entry.slug);
+    if (list) list.push(entry);
+    else installedBySlug.set(entry.slug, [entry]);
+  }
+  const updatesBySlug = new Map((input.updates ?? []).map((u) => [u.slug, u]));
+
+  // ── Phase 1: discovery — walk every root, global memo (rule 1) ───────────
+  const edges: CompositionEdge[] = [];
+  const cycles: string[][] = [];
+  /** Every edge target/source touched, whether or not it ends up a layer node. */
+  const touched = new Set<string>(roots);
+  /** dependent -> Set(dependency) for EVERY edge (both relations) — reachability adjacency. */
+  const adjacency = new Map<string, Set<string>>();
+  /** dependency -> Set(dependent) for every NON-broken edge (both relations) — true fan-in + layering DP. */
+  const dependentsMap = new Map<string, Set<string>>();
+  /** Compose-relation edges, kept separately to build overlays + the node-exclusion set. */
+  const composeEdges: Array<{ from: string; to: string; depKind?: string }> = [];
+  /** A slug's `edgesOf` has already been walked — prevents re-expanding a shared node's children (rule 1). */
+  const discovered = new Set<string>();
+
+  function addAdjacency(from: string, to: string): void {
+    const set = adjacency.get(from);
+    if (set) set.add(to);
+    else adjacency.set(from, new Set([to]));
+  }
+
+  function addDependent(dependency: string, dependent: string): void {
+    const set = dependentsMap.get(dependency);
+    if (set) set.add(dependent);
+    else dependentsMap.set(dependency, new Set([dependent]));
+  }
+
+  function walk(slug: string, ancestors: Set<string>): void {
+    const deps = edgesOf(slug) ?? [];
+    for (const dep of deps) {
+      const relation: "compose" | "require" = dep.relation ?? "require";
+      touched.add(dep.slug);
+
+      if (ancestors.has(dep.slug)) {
+        // Broken back-edge — surfaced, not swallowed (rule 4). Still recorded
+        // in `edges` (the honest picture of what was declared), but excluded
+        // from `dependentsMap`/`adjacency` so it can't loop the DP/BFS below.
+        cycles.push([slug, dep.slug]);
+        edges.push({ from: slug, to: dep.slug, relation, depKind: dep.kind });
+        continue;
+      }
+
+      edges.push({ from: slug, to: dep.slug, relation, depKind: dep.kind });
+      addAdjacency(slug, dep.slug);
+      addDependent(dep.slug, slug);
+      if (relation === "compose") {
+        composeEdges.push({ from: slug, to: dep.slug, depKind: dep.kind });
+      }
+
+      if (!discovered.has(dep.slug)) {
+        discovered.add(dep.slug);
+        const nextAncestors = new Set(ancestors);
+        nextAncestors.add(slug);
+        walk(dep.slug, nextAncestors);
+      }
+    }
+  }
+
+  for (const root of roots) {
+    if (discovered.has(root)) continue;
+    discovered.add(root);
+    walk(root, new Set([root]));
+  }
+
+  // ── Phase 2: compose-relation sources are never layer nodes (rule 2) ─────
+  const composeSources = new Set(composeEdges.map((e) => e.from));
+  const overlaysByBase = new Map<string, CompositionOverlay[]>();
+  for (const e of composeEdges) {
+    const isInstalled = installedBySlug.has(e.from);
+    const overlay: CompositionOverlay = { slug: e.from, name: nameOf(e.from) ?? e.from, installed: isInstalled };
+    const list = overlaysByBase.get(e.to);
+    if (list) list.push(overlay);
+    else overlaysByBase.set(e.to, [overlay]);
+  }
+
+  // ── Phase 3: which touched slugs are real layer nodes ────────────────────
+  const nodeSlugs = [...touched].filter((s) => !composeSources.has(s)).sort();
+
+  // ── Phase 4: reachability — which input roots reach each slug ────────────
+  const rootsReaching = new Map<string, Set<string>>();
+  for (const root of roots) {
+    const visited = new Set<string>([root]);
+    const queue: string[] = [root];
+    const addReach = (s: string) => {
+      const set = rootsReaching.get(s);
+      if (set) set.add(root);
+      else rootsReaching.set(s, new Set([root]));
+    };
+    addReach(root);
+    while (queue.length) {
+      const cur = queue.shift()!;
+      for (const next of adjacency.get(cur) ?? []) {
+        if (visited.has(next)) continue;
+        visited.add(next);
+        addReach(next);
+        queue.push(next);
+      }
+    }
+  }
+
+  // ── Phase 5: longest-path layering (rule 1) ───────────────────────────────
+  // layer(n) = 1 + max(layer of every node that depends on n); roots = 0.
+  // Works for ANY slug (node or compose-only overlay source) so a compose
+  // source's OWN layer still feeds the DP for the base it composes onto —
+  // e.g. `grants` (excluded from `nodes`) still positions `operations` one
+  // layer below wherever `grants` itself sits.
+  const layerMemo = new Map<string, number>();
+  function layerOf(slug: string, stack: Set<string>): number {
+    if (rootSet.has(slug)) return 0;
+    const memoized = layerMemo.get(slug);
+    if (memoized !== undefined) return memoized;
+    if (stack.has(slug)) return 0; // defensive — cycle edges are already excluded from dependentsMap
+    stack.add(slug);
+    const dependents = dependentsMap.get(slug);
+    const layer = !dependents || dependents.size === 0
+      ? 0
+      : 1 + Math.max(...[...dependents].map((d) => layerOf(d, stack)));
+    stack.delete(slug);
+    layerMemo.set(slug, layer);
+    return layer;
+  }
+
+  // ── Phase 6: build nodes ──────────────────────────────────────────────────
+  const nodes = new Map<string, CompositionNode>();
+  for (const slug of nodeSlugs) {
+    const installedEntries = installedBySlug.get(slug) ?? [];
+    const workspaceIds = installedEntries.map((e) => e.workspaceId).filter(Boolean);
+    const installed = workspaceIds.length > 0;
+    const update = updatesBySlug.get(slug);
+    const installedVersion = update?.installedVersion || installedEntries[0]?.version;
+    const noVersionInfo = installed && (update === undefined || update.latestVersion === undefined);
+
+    nodes.set(slug, {
+      slug,
+      name: nameOf(slug) ?? slug,
+      layer: layerOf(slug, new Set()),
+      dependents: [...(dependentsMap.get(slug) ?? [])].sort(),
+      roots: [...(rootsReaching.get(slug) ?? [])].sort(),
+      installed,
+      workspaceIds,
+      installedVersion,
+      latestVersion: update?.latestVersion ?? null,
+      updateAvailable: update?.updateAvailable ?? false,
+      noVersionInfo,
+      overlays: overlaysByBase.get(slug) ?? [],
+    });
+  }
+
+  const maxLayer = Math.max(0, ...[...nodes.values()].map((n) => n.layer));
+  const layers: CompositionNode[][] = Array.from({ length: maxLayer + 1 }, () => []);
+  for (const node of nodes.values()) layers[node.layer].push(node);
+  for (const bucket of layers) bucket.sort((a, b) => a.slug.localeCompare(b.slug));
+
+  return { nodes, edges, layers, cycles };
+}

package/src/concept-guard.test.ts

@@ -0,0 +1,176 @@
+/**
+ * Concept-guard tests.
+ *
+ * The first test is the gate: the SHIPPED corpus must be free of undeclared
+ * vocabulary forks. The rest prove the guard actually fires — a guard nobody
+ * has watched fail is decoration, so the failure cases are pinned here rather
+ * than demonstrated once by hand and forgotten.
+ */
+
+import { describe, expect, it } from "vitest";
+import {
+  DECLARED_DIVERGENCES,
+  conceptTerm,
+  findConceptViolations,
+  formatConceptViolations,
+} from "./concept-guard.js";
+import { WORKSPACE_TEMPLATES } from "./templates.js";
+import type { WorkspaceYaml } from "./types.js";
+
+/** Minimal fixture corpus — only the fields the guard reads. */
+function corpus(
+  templates: Record<string, Array<Record<string, unknown>>>
+): Record<string, WorkspaceYaml> {
+  return Object.fromEntries(
+    Object.entries(templates).map(([slug, profiles]) => [slug, { profiles }])
+  ) as unknown as Record<string, WorkspaceYaml>;
+}
+
+const role = (slug: string, extra: Record<string, unknown> = {}) => ({
+  slug,
+  displayName: slug,
+  profileKind: "role",
+  properties: [],
+  ...extra,
+});
+
+describe("concept guard — shipped corpus", () => {
+  it("has no undeclared cross-template concept forks", () => {
+    const violations = findConceptViolations();
+    expect(
+      violations,
+      violations.length ? `\n${formatConceptViolations(violations)}\n` : ""
+    ).toEqual([]);
+  });
+
+  it("still sees the two-tier CRM divergence — declared, not absent", () => {
+    // If business-developer's crm-lead/crm-client ever stopped colliding with
+    // foundation's lead/client, the allowlist would be stale and rule 3 would
+    // fire. This asserts the allowlist is load-bearing, not inert.
+    const withoutAllowlist = Object.keys(DECLARED_DIVERGENCES);
+    expect(withoutAllowlist).toEqual(["crm-lead|lead", "client|crm-client"]);
+    expect(WORKSPACE_TEMPLATES["business-developer"]?.profiles.find((p) => p.slug === "crm-lead")
+      ?.semanticSlug).toBe("crm.lead");
+  });
+});
+
+describe("conceptTerm", () => {
+  it("reduces a qualified concept identifier to its bare noun", () => {
+    expect(conceptTerm("lead")).toBe("lead");
+    expect(conceptTerm("crm.lead")).toBe("lead");
+    expect(conceptTerm("crm-lead")).toBe("lead");
+    expect(conceptTerm("marketing.contact")).toBe("contact");
+  });
+});
+
+describe("concept guard — fires on a real fork", () => {
+  it("fails when a second template renames an existing role concept", () => {
+    const violations = findConceptViolations(
+      corpus({
+        foundation: [role("partner", { scope: "shared", applicableKinds: ["company"] })],
+        "some-addon": [role("channel-partner", { scope: "WORKSPACE" })],
+      })
+    );
+    // Fixture corpora never match the real allowlist, so the stale-allowlist
+    // findings are expected noise here — the collision is what is under test.
+    const forks = violations.filter((v) => v.rule !== "stale-allowlist");
+    expect(forks).toHaveLength(1);
+    expect(forks[0]!.rule).toBe("concept-collision");
+    expect(forks[0]!.concept).toBe("partner");
+    expect(forks[0]!.message).toContain("channel-partner");
+  });
+
+  it("suppresses exactly the pair an author declared — and nothing else", () => {
+    // The SAME shape as the test above, but with the slugs the allowlist names.
+    // This is the whole safety property of the escape hatch: it is per-pair, not
+    // per-concept, so a THIRD `lead` spelling would still fail.
+    const declared = findConceptViolations(
+      corpus({
+        foundation: [role("lead", { scope: "shared" })],
+        "business-developer": [role("crm-lead", { semanticSlug: "crm.lead", scope: "WORKSPACE" })],
+      })
+    );
+    expect(declared.filter((v) => v.rule === "concept-collision")).toEqual([]);
+
+    const third = findConceptViolations(
+      corpus({
+        foundation: [role("lead", { scope: "shared" })],
+        "business-developer": [role("crm-lead", { semanticSlug: "crm.lead", scope: "WORKSPACE" })],
+        "another-addon": [role("sales-lead", { scope: "WORKSPACE" })],
+      })
+    );
+    expect(third.filter((v) => v.rule === "concept-collision")).toHaveLength(2);
+  });
+
+  it("fires even when the fork hides behind a namespaced semanticSlug", () => {
+    const violations = findConceptViolations(
+      corpus({
+        foundation: [role("lead")],
+        other: [role("pipeline-lead", { semanticSlug: "sales.lead" })],
+      })
+    );
+    expect(violations.filter((v) => v.rule !== "stale-allowlist").map((v) => v.rule)).toEqual([
+      "concept-collision",
+    ]);
+  });
+
+  it("fails when two aliased profiles disagree on shape", () => {
+    const violations = findConceptViolations(
+      corpus({
+        a: [role("campaign", { semanticSlug: "marketing.campaign", scope: "shared" })],
+        b: [role("promo", { semanticSlug: "marketing.campaign", scope: "WORKSPACE" })],
+      })
+    );
+    expect(violations.map((v) => v.rule)).toContain("alias-shape-divergence");
+  });
+
+  it("fails when an allowlist entry stops matching anything", () => {
+    // DECLARED_DIVERGENCES is module-level, so an empty corpus makes every
+    // entry stale — exactly the state a resolved divergence would leave behind.
+    const violations = findConceptViolations(corpus({}));
+    expect(violations.every((v) => v.rule === "stale-allowlist")).toBe(true);
+    expect(violations).toHaveLength(Object.keys(DECLARED_DIVERGENCES).length);
+  });
+});
+
+describe("concept guard — stays green on legitimate patterns", () => {
+  it("allows the same slug re-declared across templates (overlay mechanism)", () => {
+    const violations = findConceptViolations(
+      corpus({
+        foundation: [role("lead", { scope: "shared", applicableKinds: ["person", "company"] })],
+        // A consumer legitimately OMITS row-level fields it does not own.
+        marketing: [role("lead", { scope: "shared" })],
+      })
+    );
+    expect(violations.filter((v) => v.rule !== "stale-allowlist")).toEqual([]);
+  });
+
+  it("allows sibling roles authored in ONE template to share a noun", () => {
+    const violations = findConceptViolations(
+      corpus({
+        "blockchain-ecosystem": [role("marketing-agency"), role("paid-ads-agency")],
+      })
+    );
+    expect(violations.filter((v) => v.rule !== "stale-allowlist")).toEqual([]);
+  });
+
+  it("allows an identical concept reused under one semanticSlug", () => {
+    const violations = findConceptViolations(
+      corpus({
+        "content-os": [role("campaign", { semanticSlug: "marketing.campaign", scope: "shared" })],
+        marketing: [role("campaign", { semanticSlug: "marketing.campaign", scope: "shared" })],
+      })
+    );
+    expect(violations.filter((v) => v.rule !== "stale-allowlist")).toEqual([]);
+  });
+
+  it("does not police non-role profiles", () => {
+    const violations = findConceptViolations(
+      corpus({
+        a: [{ slug: "note", displayName: "Note", properties: [] }],
+        b: [{ slug: "meeting-note", displayName: "Meeting Note", properties: [] }],
+      })
+    );
+    expect(violations.filter((v) => v.rule !== "stale-allowlist")).toEqual([]);
+  });
+});