archctx 0.9.1 → 0.9.3

package/bin/archctx.mjs

@@ -2377,8 +2377,9 @@ var init_failure = __esm(() => {
     "model-missing": { code: "AC_MODEL_ADOPTION_REQUIRED", message: "Architecture debt requires an adopted model.", fields: ["checks"] },
     "changed-path-invalid": { code: "AC_SCHEMA_INVALID", message: "Changed paths must be an array of repository-relative POSIX paths.", fields: ["checks"] },
     "debt-report-invalid": { code: "AC_SCHEMA_INVALID", message: "Architecture debt evidence violates its contract.", fields: ["checks"] },
-    "projection-manifest-upgrade-required": { code: "AC_PRECONDITION_FAILED", message: "The committed projection manifest requires supported re-baselining." },
+    "projection-manifest-upgrade-required": { code: "AC_PRECONDITION_FAILED", message: "The committed projection manifest requires supported re-baselining. First restore the original model if missing; the manifest digest cannot recover it. With the reviewed model available, follow docs/runbooks/architecture-documentation-projections.md before running archctx docs apply --approved --profile <default|repo-harness/v1>." },
     "projection-manifest-invalid": { code: "AC_PRECONDITION_FAILED", message: "The committed projection manifest violates its contract." },
+    "architecture-model-ignored": { code: "AC_PRECONDITION_FAILED", action: "commit-architecture-model", message: "Git ignore rules exclude architecture model paths, so the model cannot be committed and a manifest digest cannot rebuild it. Remove or narrow the rule, commit the model, then retry adoption. The diagnostic command prints each deciding rule.", facts: { pathCount: "uint", paths: "optional:diagnosticPaths", commands: "optional:diagnosticCommands", omittedPathCount: "uint" } },
     "projection-footprint-uncovered": { code: "AC_PRECONDITION_FAILED", message: "Declared source footprints lack a projection target." },
     "index-missing": { code: "AC_CODE_FACTS_UNAVAILABLE", message: "Required code facts have no available index. Run codegraph init." },
     "code-facts-not-ready": { code: "AC_CODE_FACTS_NOT_READY", message: "Repository code facts are not ready. Run archctx doctor --json and follow the reported action.", facts: { issues: "codeFactsIssues" } },
@@ -2816,6 +2817,89 @@ var init_failure = __esm(() => {
   };
 });
 
+// packages/contracts/src/runtime-topology.ts
+function isRuntimeTopologyNodeKind(kind) {
+  return typeof kind === "string" && RUNTIME_TOPOLOGY_NODE_KINDS.includes(kind);
+}
+function runtimeTopologyModelIssues(model) {
+  const issues = [];
+  const nodesById = new Map;
+  for (const node of model.nodes)
+    if (typeof node.id === "string")
+      nodesById.set(node.id, node);
+  const namespacesByProcess = new Map;
+  const mountersByMount = new Map;
+  for (const relation of model.relations) {
+    if (typeof relation.id !== "string" || typeof relation.kind !== "string" || !Object.hasOwn(RUNTIME_TOPOLOGY_RELATION_ENDPOINT_KINDS, relation.kind))
+      continue;
+    const rule = RUNTIME_TOPOLOGY_RELATION_ENDPOINT_KINDS[relation.kind];
+    let endpointsValid = true;
+    for (const field of ["source", "target"]) {
+      const endpoint = relation[field];
+      const node = typeof endpoint === "string" ? nodesById.get(endpoint) : undefined;
+      if (!node) {
+        issues.push({ entityId: relation.id, field, invariant: "topology-relation-endpoint-missing" });
+        endpointsValid = false;
+      } else if (!rule[field].includes(node.kind)) {
+        issues.push({ entityId: relation.id, field, invariant: field === "source" ? "topology-relation-source-kind-invalid" : "topology-relation-target-kind-invalid" });
+        endpointsValid = false;
+      }
+    }
+    if (!endpointsValid)
+      continue;
+    const source = relation.source;
+    const target = relation.target;
+    if (relation.kind === "runs-in")
+      namespacesByProcess.set(source, [...namespacesByProcess.get(source) ?? [], target]);
+    if (relation.kind === "mounts")
+      mountersByMount.set(target, [...mountersByMount.get(target) ?? [], source]);
+  }
+  for (const [processId, namespaces] of namespacesByProcess) {
+    if (new Set(namespaces).size > 1)
+      issues.push({ entityId: processId, field: "runs-in", invariant: "topology-process-namespace-ambiguous" });
+  }
+  for (const [mountId, mounters] of mountersByMount) {
+    if (new Set(mounters).size > 1)
+      issues.push({ entityId: mountId, field: "mounts", invariant: "topology-mount-mounter-ambiguous" });
+  }
+  for (const [id, node] of nodesById) {
+    if (node.kind !== "namespace" || node.parent === undefined)
+      continue;
+    const parent = typeof node.parent === "string" ? nodesById.get(node.parent) : undefined;
+    if (!parent) {
+      issues.push({ entityId: id, field: "parent", invariant: "topology-namespace-parent-missing" });
+      continue;
+    }
+    if (parent.kind !== "namespace") {
+      issues.push({ entityId: id, field: "parent", invariant: "topology-namespace-parent-kind-invalid" });
+      continue;
+    }
+    const seen = new Set([id]);
+    let cursor = parent;
+    while (cursor && cursor.kind === "namespace" && typeof cursor.id === "string") {
+      if (seen.has(cursor.id)) {
+        issues.push({ entityId: id, field: "parent", invariant: "topology-namespace-parent-cycle" });
+        break;
+      }
+      seen.add(cursor.id);
+      cursor = typeof cursor.parent === "string" ? nodesById.get(cursor.parent) : undefined;
+    }
+  }
+  return issues.sort((left, right) => compare(left.entityId, right.entityId) || compare(left.field, right.field) || compare(left.invariant, right.invariant));
+}
+function compare(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+var RUNTIME_TOPOLOGY_NODE_KINDS, RUNTIME_TOPOLOGY_RELATION_ENDPOINT_KINDS;
+var init_runtime_topology = __esm(() => {
+  RUNTIME_TOPOLOGY_NODE_KINDS = ["process", "namespace", "mount"];
+  RUNTIME_TOPOLOGY_RELATION_ENDPOINT_KINDS = {
+    spawns: { source: ["process"], target: ["process"] },
+    "runs-in": { source: ["process"], target: ["namespace"] },
+    mounts: { source: ["process", "namespace"], target: ["mount"] }
+  };
+});
+
 // packages/contracts/src/validator.ts
 function jsonSchemaResolver(documents) {
   const byId = new Map;
@@ -3159,6 +3243,10 @@ function nativeContextModelIssues(model, schemas, recordPaths) {
       if (relation[field] !== undefined && !nodes.has(relation[field]))
         add(relation, field, "relation-node-missing");
   }
+  const relations = new Map(model.relations.map((relation) => [relation.id, relation]));
+  for (const issue of runtimeTopologyModelIssues(model)) {
+    add(relations.get(issue.entityId) ?? nodes.get(issue.entityId) ?? issue.entityId, issue.field, issue.invariant);
+  }
   for (const flow of model.flows) {
     if (nodes.get(flow.capabilityId)?.kind !== "capability")
       add(flow, "capabilityId", "flow-capability-missing");
@@ -3201,6 +3289,7 @@ var NATIVE_CONTEXT_SCHEMA_VERSION = "archcontext.native-context-export/v1", NATI
 var init_native_context = __esm(() => {
   init_failure();
   init_schema();
+  init_runtime_topology();
   init_validator();
   NATIVE_CONTEXT_LIMITS = Object.freeze({
     inputFiles: 1e4,
@@ -3373,6 +3462,9 @@ var PROJECTION_PUBLISH_RUN_SCHEMA_VERSION = "archcontext.projection-publish-run/
 var init_projection_writer = () => {};
 
 // packages/contracts/src/projection-manifest.ts
+function isRuntimeTopologyTargetType(type) {
+  return typeof type === "string" && RUNTIME_TOPOLOGY_TARGET_TYPES.includes(type);
+}
 function architectureDocsProjectionManifestIssues(value) {
   const issues = [];
   const manifest = record3(value);
@@ -3408,6 +3500,7 @@ function architectureDocsProjectionManifestIssues(value) {
   }
   const paths = new Set;
   const stampOwners = new Map;
+  let topologyStamps;
   for (const [targetId, row] of Object.entries(targets)) {
     const prefix = `manifest.targets[${JSON.stringify(targetId)}]`;
     if (!isNonEmptyString(targetId))
@@ -3419,7 +3512,23 @@ function architectureDocsProjectionManifestIssues(value) {
         issues.push(`${prefix}.path is recorded by another target`);
       paths.add(path);
     }
-    for (const nodeId of Object.keys(record3(record3(row)?.sourceStamps) ?? {})) {
+    const stamps = record3(record3(row)?.sourceStamps) ?? {};
+    if (isRuntimeTopologyTargetType(record3(row)?.type)) {
+      const serialized = JSON.stringify(Object.keys(stamps).sort(compareStrings).map((nodeId) => [nodeId, stamps[nodeId]]));
+      if (topologyStamps === undefined)
+        topologyStamps = { targetId, stamps: serialized };
+      else if (topologyStamps.stamps !== serialized)
+        issues.push(`${prefix}.sourceStamps must equal the sourceStamps of ${topologyStamps.targetId}`);
+      for (const nodeId of Object.keys(stamps)) {
+        const owner = stampOwners.get(nodeId);
+        if (owner !== undefined && !isRuntimeTopologyTargetType(record3(targets[owner])?.type))
+          issues.push(`${prefix}.sourceStamps.${nodeId} is already stamped on ${owner}`);
+        else if (owner === undefined)
+          stampOwners.set(nodeId, targetId);
+      }
+      continue;
+    }
+    for (const nodeId of Object.keys(stamps)) {
       const owner = stampOwners.get(nodeId);
       if (owner !== undefined)
         issues.push(`${prefix}.sourceStamps.${nodeId} is already stamped on ${owner}`);
@@ -3674,9 +3783,11 @@ function manifestTargetIssues(value, prefix) {
     issues.push(`${prefix}.format is unsupported`);
   if (!isDigest(target.outputDigest))
     issues.push(`${prefix}.outputDigest must be a SHA-256 digest`);
-  if ((target.sourceStamps !== undefined || target.scale !== undefined) && target.type !== "entity-summary") {
-    issues.push(`${prefix}.sourceStamps and scale are only allowed on entity-summary targets`);
+  if (target.sourceStamps !== undefined && target.type !== "entity-summary" && !isRuntimeTopologyTargetType(target.type)) {
+    issues.push(`${prefix}.sourceStamps are only allowed on entity-summary and runtime topology targets`);
   }
+  if (target.scale !== undefined && target.type !== "entity-summary")
+    issues.push(`${prefix}.scale is only allowed on entity-summary targets`);
   if (target.sourceStamps !== undefined) {
     const stamps = record3(target.sourceStamps);
     if (!stamps || Object.keys(stamps).length === 0)
@@ -3765,7 +3876,7 @@ function architectureDocsProjectionCompatibilityIssues(value, engine = {
   }
   return issues;
 }
-var ARCHITECTURE_DOCS_PROJECTION_MANIFEST_SCHEMA_VERSION = "archcontext.architecture-docs-projection-manifest/v3", SUPERSEDED_ARCHITECTURE_DOCS_PROJECTION_MANIFEST_SCHEMA_VERSIONS, PROJECTION_MANIFEST_UPGRADE_REQUIRED = "projection-manifest-upgrade-required", PROJECTION_MANIFEST_INVALID = "projection-manifest-invalid", PROJECTION_FOOTPRINT_UNCOVERED = "projection-footprint-uncovered", ARCHITECTURE_DOCS_PROJECTION_PROVENANCE_SCHEMA_VERSION = "archcontext.architecture-docs-projection-provenance/v3", ARCHITECTURE_DOCS_LAYOUT_VERSION_V1 = "archcontext.docs-layout/v1", ARCHITECTURE_SEMANTIC_STATE_SCHEMA_VERSION = "archcontext.architecture-semantic-state/v1", ARCHITECTURE_DOCS_PROJECTION_PROFILES, SHA256, TARGET_TYPES, SCOPE_KINDS, OWNERSHIPS, FORMATS;
+var ARCHITECTURE_DOCS_PROJECTION_MANIFEST_SCHEMA_VERSION = "archcontext.architecture-docs-projection-manifest/v3", SUPERSEDED_ARCHITECTURE_DOCS_PROJECTION_MANIFEST_SCHEMA_VERSIONS, PROJECTION_MANIFEST_UPGRADE_REQUIRED = "projection-manifest-upgrade-required", PROJECTION_MANIFEST_INVALID = "projection-manifest-invalid", PROJECTION_FOOTPRINT_UNCOVERED = "projection-footprint-uncovered", ARCHITECTURE_DOCS_PROJECTION_PROVENANCE_SCHEMA_VERSION = "archcontext.architecture-docs-projection-provenance/v3", ARCHITECTURE_DOCS_LAYOUT_VERSION_V1 = "archcontext.docs-layout/v1", ARCHITECTURE_SEMANTIC_STATE_SCHEMA_VERSION = "archcontext.architecture-semantic-state/v1", ARCHITECTURE_DOCS_PROJECTION_PROFILES, SHA256, TARGET_TYPES, RUNTIME_TOPOLOGY_TARGET_TYPES, SCOPE_KINDS, OWNERSHIPS, FORMATS;
 var init_projection_manifest = __esm(() => {
   init_projection();
   init_schema();
@@ -3784,8 +3895,11 @@ var init_projection_manifest = __esm(() => {
     "diagram-mermaid": true,
     "diagram-structurizr": true,
     "diagram-likec4": true,
+    "diagram-runtime-topology": true,
+    "runtime-topology-summary": true,
     "agent-context": true
   };
+  RUNTIME_TOPOLOGY_TARGET_TYPES = ["diagram-runtime-topology", "runtime-topology-summary"];
   SCOPE_KINDS = { repository: true, entity: true, relation: true, decision: true, diagram: true, changelog: true };
   OWNERSHIPS = { generated: true, mixed: true };
   FORMATS = { markdown: true, mermaid: true, "structurizr-json": true, likec4: true };
@@ -3876,7 +3990,7 @@ function compareVersionTriples(left, right) {
   }
   return 0;
 }
-var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.9.1", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.4.3", ARCHCONTEXT_NODE_RANGE = ">=22.22 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v2", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-07-11.explorer-view-v2";
+var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.9.3", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.4.3", ARCHCONTEXT_NODE_RANGE = ">=22.22 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v2", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-07-11.explorer-view-v2";
 
 // packages/contracts/src/refactor.ts
 function refactorNamespaceIssues(value, label = "product.id") {
@@ -4981,6 +5095,7 @@ var init_src = __esm(() => {
   init_projection_writer();
   init_projection_manifest();
   init_refactor();
+  init_runtime_topology();
   init_schema();
   init_failure();
   init_validator();
@@ -17694,6 +17809,16 @@ var FIXED_TARGETS = [
   layoutTarget("projection_target.diagram.structurizr", "diagram-structurizr", { kind: "diagram", id: "architecture" }, "docs/architecture/diagrams/architecture.structurizr.json", "generated", "structurizr-json"),
   layoutTarget("projection_target.diagram.likec4", "diagram-likec4", { kind: "diagram", id: "architecture" }, "docs/architecture/diagrams/architecture.likec4", "generated", "likec4")
 ];
+var RUNTIME_TOPOLOGY_DIAGRAM_PATH = "docs/architecture/diagrams/runtime-topology.mmd";
+var RUNTIME_TOPOLOGY_SUMMARY_PATH = "docs/architecture/runtime-topology.md";
+var RUNTIME_TOPOLOGY_SCOPE_ID = "runtime-topology";
+var RUNTIME_TOPOLOGY_TARGETS = [
+  layoutTarget("projection_target.diagram.runtime-topology", "diagram-runtime-topology", { kind: "diagram", id: RUNTIME_TOPOLOGY_SCOPE_ID }, RUNTIME_TOPOLOGY_DIAGRAM_PATH, "generated", "mermaid"),
+  layoutTarget("projection_target.runtime-topology.summary", "runtime-topology-summary", { kind: "diagram", id: RUNTIME_TOPOLOGY_SCOPE_ID }, RUNTIME_TOPOLOGY_SUMMARY_PATH, "generated", "markdown")
+];
+function hasRuntimeTopologyNodes(nodes) {
+  return nodes.some((node) => isRuntimeTopologyNodeKind(node.kind));
+}
 function parseRepoHarnessNodeProfile(node) {
   const match = /^capability\.([a-z0-9]+(?:-[a-z0-9]+)*)\.([a-z0-9]+(?:-[a-z0-9]+)*)$/.exec(node.id);
   if (!match || node.kind !== "capability") {
@@ -17721,7 +17846,7 @@ function parseRepoHarnessNodeProfile(node) {
   };
 }
 function entitySummaryTargetNodes(nodes, profile) {
-  return profile === REPO_HARNESS_PROJECTION_PROFILE ? nodes.filter((node) => node.kind === "capability") : [...nodes];
+  return profile === REPO_HARNESS_PROJECTION_PROFILE ? nodes.filter((node) => node.kind === "capability") : nodes.filter((node) => !isRuntimeTopologyNodeKind(node.kind));
 }
 function resolveArchitectureDocumentationLayout(input) {
   const profile = input.profile ?? "default";
@@ -17731,7 +17856,8 @@ function resolveArchitectureDocumentationLayout(input) {
     return layoutTarget(`projection_target.entity.${stableId(node.id)}`, "entity-summary", { kind: "entity", id: node.id, entityKind: node.kind }, path, "mixed", "markdown");
   });
   const relationTargets = (profile === REPO_HARNESS_PROJECTION_PROFILE ? [] : input.relations).map((relation) => layoutTarget(`projection_target.relation.${stableId(relation.id)}`, "relation-summary", { kind: "relation", id: relation.id }, `docs/architecture/relations/${pathSegment(relation.id)}.md`, "mixed", "markdown"));
-  const targets = [FIXED_TARGETS[0], ...entityTargets, ...relationTargets, ...FIXED_TARGETS.slice(1)].map((target) => ({ ...target, path: requiredPath(target.path, target.targetId) }));
+  const topologyTargets = hasRuntimeTopologyNodes(input.nodes) ? RUNTIME_TOPOLOGY_TARGETS : [];
+  const targets = [FIXED_TARGETS[0], ...entityTargets, ...relationTargets, ...FIXED_TARGETS.slice(1), ...topologyTargets].map((target) => ({ ...target, path: requiredPath(target.path, target.targetId) }));
   assertUniqueTargets(targets);
   return {
     profile,
@@ -19369,6 +19495,7 @@ function renderArchitectureDocumentationProjection(input) {
   const rendered = targetDrafts.map((draft) => {
     const existing = existingByPath.get(draft.path);
     const nodeId = draft.type === "entity-summary" ? draft.scope.id : undefined;
+    const topology = isRuntimeTopologyTargetType(draft.type);
     const generatedBody = renderTargetGeneratedBody(draft, model, {
       scaleSignalsByNodeId,
       scaleByNodeId,
@@ -19392,6 +19519,10 @@ function renderArchitectureDocumentationProjection(input) {
         if (scale === undefined)
           throw new Error(`architecture-docs-projection-scale-signal-missing: ${nodeId}`);
       }
+    } else if (topology) {
+      const owned = Object.keys(sourceStamps).filter((stamped) => footprintOwners.get(stamped) === RUNTIME_TOPOLOGY_SCOPE_ID);
+      if (owned.length > 0)
+        targetStamps = Object.fromEntries(owned.map((stamped) => [stamped, sourceStamps[stamped]]));
     }
     const generatedBodyDigest = digestJson({ targetId: draft.targetId, body: generatedBody });
     const target = projectionTarget({
@@ -19757,6 +19888,10 @@ function architectureProjectionFootprintOwners(model, profile = "default") {
   for (const node of [...model.nodes].sort((left, right) => compareStrings3(left.id, right.id))) {
     if ((nativeNodeSource(node)?.include ?? []).length === 0)
       continue;
+    if (isRuntimeTopologyNodeKind(node.kind)) {
+      owners.set(node.id, RUNTIME_TOPOLOGY_SCOPE_ID);
+      continue;
+    }
     const seen = new Set;
     let current = node;
     while (current && !targetNodeIds.has(current.id) && !seen.has(current.id)) {
@@ -20103,12 +20238,52 @@ function normalizeNativeModel(model) {
     flows: [...model.flows ?? []].sort((a, b) => a.id.localeCompare(b.id))
   };
 }
+var ARCHITECTURE_NODE_LAYER_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+function nativeNodeLayer(node) {
+  const layer = node.layer;
+  if (layer === undefined)
+    return;
+  if (typeof layer !== "string" || !ARCHITECTURE_NODE_LAYER_PATTERN.test(layer)) {
+    throw new Error(`architecture-node-layer-invalid: ${node.id} (${JSON.stringify(layer)})`);
+  }
+  return layer;
+}
+function architectureLayerGroups(model) {
+  const nodesByLayer = new Map;
+  const ungroupedNodes = [];
+  const layerByNodeId = new Map;
+  for (const node of [...model.nodes].sort((a, b) => a.id.localeCompare(b.id))) {
+    const layer = nativeNodeLayer(node);
+    if (layer === undefined) {
+      ungroupedNodes.push(node);
+      continue;
+    }
+    const members = nodesByLayer.get(layer);
+    if (members)
+      members.push(node);
+    else
+      nodesByLayer.set(layer, [node]);
+    layerByNodeId.set(node.id, layer);
+  }
+  const layers = [...nodesByLayer.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([layer, nodes]) => ({ layer, nodes }));
+  return { layers, ungroupedNodes, layerByNodeId };
+}
+function mermaidLayerId(layer) {
+  return `layer__${layer.replace(/-/g, "_")}`;
+}
 function exportMermaidModel(model) {
   const normalized = normalizeNativeModel(model);
+  const grouping = architectureLayerGroups(normalized);
+  const nodeLine = (indent, node) => `${indent}${mermaidId(node.id)}["${escapeMermaid(node.name)}"]`;
   const lines = ["%% Generated by ArchContext. Native model remains source of truth.", "flowchart LR"];
-  for (const node of normalized.nodes) {
-    lines.push(`  ${mermaidId(node.id)}["${escapeMermaid(node.name)}"]`);
+  for (const group of grouping.layers) {
+    lines.push(`  subgraph ${mermaidLayerId(group.layer)}["${escapeMermaid(group.layer)}"]`);
+    for (const node of group.nodes)
+      lines.push(nodeLine("    ", node));
+    lines.push("  end");
   }
+  for (const node of grouping.ungroupedNodes)
+    lines.push(nodeLine("  ", node));
   for (const relation of normalized.relations) {
     lines.push(`  ${mermaidId(relation.source)} -->|"${escapeMermaid(relation.kind)}"| ${mermaidId(relation.target)}`);
   }
@@ -20125,22 +20300,15 @@ function exportDocumentationLikeC4Model(model) {
   const normalized = normalizeNativeModel(model);
   const lines = [
     "// Generated by ArchContext. Native model remains source of truth.",
-    "specification {",
-    "  element capability",
-    "  element module",
-    "  element component",
-    "  element interface",
-    "  element datastore",
-    "  element external_system",
-    "}",
+    ...likeC4SpecificationLines(normalized.nodes),
     "",
     "model {"
   ];
   for (const node of normalized.nodes)
-    lines.push(`  ${mermaidId(node.id)} = ${documentationLikeC4Kind(node.kind)} "${escapeDsl(node.name)}"`);
+    lines.push(`  ${mermaidId(node.id)} = ${likeC4ElementKind(node.kind)} "${escapeDsl(node.name)}"`);
   for (const relation of normalized.relations)
     lines.push(`  ${mermaidId(relation.source)} -> ${mermaidId(relation.target)} "${escapeDsl(relation.kind)}"`);
-  lines.push("}", "", "views {", "  view index {", "    include *", "    autoLayout TopBottom", "  }", "}");
+  lines.push("}", "", ...likeC4IndexViewLines(architectureLayerGroups(normalized), mermaidId));
   const content = `${lines.join(`
 `)}
 `;
@@ -20150,18 +20318,73 @@ function exportDocumentationLikeC4Model(model) {
     files: [{ path: "docs/architecture/diagrams/architecture.likec4", content }]
   };
 }
+function likeC4SpecificationLines(nodes) {
+  const topologyKinds = RUNTIME_TOPOLOGY_NODE_KINDS.filter((kind) => nodes.some((node) => node.kind === kind));
+  return [
+    "specification {",
+    "  element capability",
+    "  element module",
+    "  element component",
+    "  element interface",
+    "  element datastore",
+    "  element external_system",
+    ...topologyKinds.map((kind) => `  element ${kind}`),
+    "}"
+  ];
+}
+function likeC4ElementKind(kind) {
+  if (kind === "external-system")
+    return "external_system";
+  if (kind === "datastore")
+    return "datastore";
+  if (["capability", "module", "component", "interface"].includes(kind))
+    return kind;
+  if (isRuntimeTopologyNodeKind(kind))
+    return kind;
+  return "component";
+}
+function architectureStructurizrElementType(kind) {
+  if (kind === "capability")
+    return "Software System";
+  if (kind === "module")
+    return "Container";
+  if (kind === "datastore")
+    return "Database";
+  if (kind === "external-system")
+    return "External System";
+  if (kind === "namespace")
+    return "Deployment Node";
+  if (kind === "process")
+    return "Container Instance";
+  if (kind === "mount")
+    return "Infrastructure Node";
+  return "Component";
+}
+function likeC4IndexViewLines(grouping, elementId) {
+  const groupLines = grouping.layers.flatMap((group) => [
+    `    group "${escapeDsl(group.layer)}" {`,
+    ...group.nodes.map((node) => `      include ${elementId(node.id)}`),
+    "    }"
+  ]);
+  return ["views {", "  view index {", ...groupLines, "    include *", "    autoLayout TopBottom", "  }", "}"];
+}
 function exportDocumentationStructurizrWorkspace(model) {
   const normalized = normalizeNativeModel(model);
+  const { layerByNodeId } = architectureLayerGroups(normalized);
   const workspace = {
     schemaVersion: "archcontext.structurizr-export/v1",
     name: "ArchContext Architecture",
     model: {
-      elements: normalized.nodes.map((node) => ({
-        id: node.id,
-        name: node.name,
-        type: documentationStructurizrElementType(node.kind),
-        tags: [node.kind]
-      })),
+      elements: normalized.nodes.map((node) => {
+        const layer = layerByNodeId.get(node.id);
+        return {
+          id: node.id,
+          name: node.name,
+          type: architectureStructurizrElementType(node.kind),
+          tags: [node.kind],
+          ...layer === undefined ? {} : { group: layer }
+        };
+      }),
       relationships: normalized.relations.map((relation) => ({
         id: relation.id,
         sourceId: relation.source,
@@ -20184,6 +20407,214 @@ function exportDocumentationStructurizrWorkspace(model) {
     files: [{ path: "docs/architecture/diagrams/architecture.structurizr.json", content }]
   };
 }
+var RUNTIME_TOPOLOGY_NAMESPACE_TYPES = ["host", "container", "pod", "kubernetes", "pid", "mount", "net", "user"];
+var RUNTIME_TOPOLOGY_MOUNT_TARGET_PATTERN = /^\/([^/\u0000]+(\/[^/\u0000]+)*)?$/;
+function runtimeTopologyView(model) {
+  const issues = runtimeTopologyModelIssues(model);
+  if (issues.length > 0) {
+    throw new Error(`runtime-topology-model-invalid: ${issues.map((issue) => `${issue.entityId} ${issue.field} ${issue.invariant}`).join("; ")}`);
+  }
+  const byId = (left, right) => compareStrings3(left.id, right.id);
+  const nodes = [...model.nodes].sort(byId);
+  const relations = [...model.relations].sort(byId);
+  const nodesById = new Map(nodes.map((node) => [node.id, node]));
+  const namespaces = nodes.filter((node) => node.kind === "namespace").map((node) => ({
+    node,
+    type: runtimeTopologyNamespaceType(node),
+    ...typeof node.parent === "string" ? { parentId: node.parent } : {},
+    namespaceIds: [],
+    processIds: []
+  }));
+  const namespaceById = new Map(namespaces.map((namespace) => [namespace.node.id, namespace]));
+  for (const namespace of namespaces) {
+    if (namespace.parentId !== undefined)
+      namespaceById.get(namespace.parentId).namespaceIds.push(namespace.node.id);
+  }
+  const namespaceByProcessId = new Map(relations.filter((relation) => relation.kind === "runs-in").map((relation) => [relation.source, relation.target]));
+  const processes = nodes.filter((node) => node.kind === "process").map((node) => {
+    const namespaceId = namespaceByProcessId.get(node.id);
+    return namespaceId === undefined ? { node } : { node, namespaceId };
+  });
+  for (const topologyProcess of processes) {
+    if (topologyProcess.namespaceId !== undefined)
+      namespaceById.get(topologyProcess.namespaceId).processIds.push(topologyProcess.node.id);
+  }
+  const mounts = nodes.filter((node) => node.kind === "mount").map(runtimeTopologyMount);
+  const mounterByMountId = new Map(relations.filter((relation) => relation.kind === "mounts").map((relation) => [relation.target, relation.source]));
+  const stacksByMounterId = new Map;
+  for (const mount of mounts) {
+    const mounterId = mounterByMountId.get(mount.node.id);
+    if (mounterId === undefined)
+      continue;
+    stacksByMounterId.set(mounterId, [...stacksByMounterId.get(mounterId) ?? [], mount]);
+  }
+  const mountStacks = [...stacksByMounterId.entries()].sort(([left], [right]) => compareStrings3(left, right)).map(([mounterId, stack]) => ({
+    mounterId,
+    mounts: stack.sort((left, right) => left.order - right.order || compareStrings3(left.node.id, right.node.id))
+  }));
+  const deployments = relations.filter((relation) => relation.kind === "deployed-on" && isRuntimeTopologyNodeKind(nodesById.get(relation.target)?.kind));
+  const linkedNodeIds = new Set;
+  for (const relation of deployments) {
+    const source = nodesById.get(relation.source);
+    if (!source)
+      throw new Error(`runtime-topology-relation-endpoint-missing: ${relation.id} (${relation.source})`);
+    if (!isRuntimeTopologyNodeKind(source.kind))
+      linkedNodeIds.add(source.id);
+  }
+  return {
+    nodesById,
+    namespaces,
+    rootNamespaceIds: namespaces.filter((namespace) => namespace.parentId === undefined).map((namespace) => namespace.node.id),
+    processes,
+    mountStacks,
+    unmountedMounts: mounts.filter((mount) => !mounterByMountId.has(mount.node.id)),
+    spawns: relations.filter((relation) => relation.kind === "spawns"),
+    mounts: relations.filter((relation) => relation.kind === "mounts"),
+    deployments,
+    linkedNodes: nodes.filter((node) => linkedNodeIds.has(node.id))
+  };
+}
+function runtimeTopologyNamespaceType(node) {
+  const value = node.namespace;
+  const type = value !== null && typeof value === "object" && !Array.isArray(value) ? value.type : undefined;
+  if (typeof type !== "string" || !RUNTIME_TOPOLOGY_NAMESPACE_TYPES.includes(type)) {
+    throw new Error(`runtime-topology-namespace-invalid: ${node.id}`);
+  }
+  return type;
+}
+function runtimeTopologyMount(node) {
+  const value = node.mount;
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`runtime-topology-mount-invalid: ${node.id}`);
+  const { source, target, mode, order } = value;
+  if (source !== undefined && (typeof source !== "string" || source === "") || typeof target !== "string" || !RUNTIME_TOPOLOGY_MOUNT_TARGET_PATTERN.test(target) || mode !== "ro" && mode !== "rw" || typeof order !== "number" || !Number.isInteger(order) || order < 0) {
+    throw new Error(`runtime-topology-mount-invalid: ${node.id}`);
+  }
+  return { node, ...source === undefined ? {} : { source }, target, mode, order };
+}
+function runtimeTopologyMountStackId(mounterId) {
+  return `mounts__${mermaidId(mounterId)}`;
+}
+function runtimeTopologyMountLabel(mount) {
+  return `${mount.node.name} (${mount.target}, ${mount.mode}, order ${mount.order})`;
+}
+function exportRuntimeTopologyMermaid(model) {
+  const view = runtimeTopologyView(model);
+  const namespaceById = new Map(view.namespaces.map((namespace) => [namespace.node.id, namespace]));
+  const nodeLine = (indent, node, label = node.name) => `${indent}${mermaidId(node.id)}["${escapeMermaid(label)}"]`;
+  const lines = ["%% Generated by ArchContext. Native model remains source of truth.", "flowchart TB"];
+  const pushNamespace = (namespaceId, depth) => {
+    const namespace = namespaceById.get(namespaceId);
+    const indent = "  ".repeat(depth);
+    lines.push(`${indent}subgraph ${mermaidId(namespaceId)}["${escapeMermaid(`${namespace.node.name} (${namespace.type})`)}"]`);
+    for (const processId of namespace.processIds)
+      lines.push(nodeLine(`${indent}  `, view.nodesById.get(processId)));
+    for (const childId of namespace.namespaceIds)
+      pushNamespace(childId, depth + 1);
+    lines.push(`${indent}end`);
+  };
+  for (const namespaceId of view.rootNamespaceIds)
+    pushNamespace(namespaceId, 1);
+  for (const topologyProcess of view.processes)
+    if (topologyProcess.namespaceId === undefined)
+      lines.push(nodeLine("  ", topologyProcess.node));
+  for (const stack of view.mountStacks) {
+    const mounter = view.nodesById.get(stack.mounterId);
+    lines.push(`  subgraph ${runtimeTopologyMountStackId(stack.mounterId)}["${escapeMermaid(`Mounts: ${mounter.name}`)}"]`, "    direction TB");
+    for (const mount of stack.mounts)
+      lines.push(nodeLine("    ", mount.node, runtimeTopologyMountLabel(mount)));
+    for (let index = 1;index < stack.mounts.length; index += 1) {
+      lines.push(`    ${mermaidId(stack.mounts[index - 1].node.id)} ~~~ ${mermaidId(stack.mounts[index].node.id)}`);
+    }
+    lines.push("  end");
+  }
+  for (const mount of view.unmountedMounts)
+    lines.push(nodeLine("  ", mount.node, runtimeTopologyMountLabel(mount)));
+  for (const node of view.linkedNodes)
+    lines.push(nodeLine("  ", node));
+  for (const relation of [...view.spawns, ...view.mounts, ...view.deployments].sort((left, right) => compareStrings3(left.id, right.id))) {
+    lines.push(`  ${mermaidId(relation.source)} -->|"${escapeMermaid(relation.kind)}"| ${mermaidId(relation.target)}`);
+  }
+  const content = `${lines.join(`
+`)}
+`;
+  return {
+    format: "mermaid",
+    digest: digestJson({ format: "mermaid", content }),
+    files: [{ path: RUNTIME_TOPOLOGY_DIAGRAM_PATH, content }]
+  };
+}
+function renderRuntimeTopologySummary(model, summaryPath) {
+  const view = runtimeTopologyView(model);
+  const cell = (value) => value.replaceAll("|", "\\|");
+  const named = (id) => {
+    const node = view.nodesById.get(id);
+    return `\`${id}\`${node ? ` ${cell(node.name)}` : ""}`;
+  };
+  const list = (ids) => ids.length === 0 ? "none" : ids.map((id) => `\`${id}\``).join(", ");
+  const lines = [
+    "# Runtime Topology",
+    "",
+    "The architecture model declares this topology. No code facts verify it: archctx never reads the configuration it describes. A change to a file a node lists in `source.include` marks this page and its diagram stale.",
+    "",
+    `- Diagram: [Mermaid](${posix.relative(posix.dirname(summaryPath), RUNTIME_TOPOLOGY_DIAGRAM_PATH)})`,
+    "",
+    "## Namespaces",
+    ""
+  ];
+  if (view.namespaces.length === 0)
+    lines.push("- No namespaces recorded.");
+  else {
+    lines.push("| Namespace | Type | Parent | Namespaces | Processes |", "| --- | --- | --- | --- | --- |");
+    for (const namespace of view.namespaces) {
+      lines.push(`| ${named(namespace.node.id)} | ${namespace.type} | ${namespace.parentId === undefined ? "none" : `\`${namespace.parentId}\``} | ${list(namespace.namespaceIds)} | ${list(namespace.processIds)} |`);
+    }
+  }
+  lines.push("", "## Processes", "");
+  if (view.processes.length === 0)
+    lines.push("- No processes recorded.");
+  else {
+    lines.push("| Process | Namespace | Spawns | Deployed here |", "| --- | --- | --- | --- |");
+    for (const topologyProcess of view.processes) {
+      const id = topologyProcess.node.id;
+      const spawned = view.spawns.filter((relation) => relation.source === id).map((relation) => relation.target);
+      const deployed = view.deployments.filter((relation) => relation.target === id).map((relation) => relation.source);
+      lines.push(`| ${named(id)} | ${topologyProcess.namespaceId === undefined ? "none" : `\`${topologyProcess.namespaceId}\``} | ${list([...new Set(spawned)].sort(compareStrings3))} | ${list([...new Set(deployed)].sort(compareStrings3))} |`);
+    }
+  }
+  lines.push("", "## Mount Stacks", "");
+  const mountRows = (stack) => [
+    "| Order | Mount | Source | Target | Mode |",
+    "| --- | --- | --- | --- | --- |",
+    ...stack.map((mount) => `| ${mount.order} | ${named(mount.node.id)} | ${mount.source === undefined ? "none" : `\`${cell(mount.source)}\``} | \`${cell(mount.target)}\` | ${mount.mode} |`)
+  ];
+  if (view.mountStacks.length === 0 && view.unmountedMounts.length === 0)
+    lines.push("- No mounts recorded.");
+  for (const [index, stack] of view.mountStacks.entries()) {
+    if (index > 0)
+      lines.push("");
+    lines.push(`### ${named(stack.mounterId)}`, "", ...mountRows(stack.mounts));
+  }
+  if (view.unmountedMounts.length > 0) {
+    if (view.mountStacks.length > 0)
+      lines.push("");
+    lines.push("### Not mounted", "", ...mountRows(view.unmountedMounts));
+  }
+  const otherDeployments = view.deployments.filter((relation) => view.nodesById.get(relation.target)?.kind !== "process");
+  if (otherDeployments.length > 0) {
+    lines.push("", "## Other Deployments", "");
+    for (const relation of otherDeployments)
+      lines.push(`- \`${relation.source}\` -> \`${relation.target}\` — ${relation.intent}`);
+  }
+  lines.push("", "## Source Anchors", "", "| Node | Source |", "| --- | --- |");
+  for (const node of [...view.nodesById.values()].filter((entry) => isRuntimeTopologyNodeKind(entry.kind)).sort((left, right) => compareStrings3(left.id, right.id))) {
+    const include = nativeNodeSource(node)?.include ?? [];
+    lines.push(`| ${named(node.id)} | ${include.length === 0 ? "model-authored, no source anchor" : include.map((pattern) => `\`${cell(pattern)}\``).join(", ")} |`);
+  }
+  return `${lines.join(`
+`)}
+`;
+}
 function loadNativeModelFromArchContext(root) {
   return nativeModelFromYamlObjects({
     nodes: readYamlObjects(resolve6(root, ".archcontext/model/nodes")),
@@ -20202,6 +20633,7 @@ function nativeModelFromYamlObjects(input) {
       throw new Error(`architecture-node-schema-version-unsupported: ${node.id || "unknown"} (${String(node.schemaVersion)})`);
     }
     assertArchitectureNodeSourceV2(node);
+    nativeNodeLayer(node);
   }
   const flows = input.flows;
   for (const flow of flows)
@@ -20386,8 +20818,15 @@ function renderTargetGeneratedBody(target, model, input) {
     return exportDocumentationStructurizrWorkspace(model).files[0].content;
   if (target.type === "diagram-likec4")
     return exportDocumentationLikeC4Model(model).files[0].content;
+  if (target.type === "diagram-runtime-topology")
+    return exportRuntimeTopologyMermaid(model).files[0].content;
+  if (target.type === "runtime-topology-summary")
+    return renderRuntimeTopologySummary(model, target.path);
   return "";
 }
+function architectureIndexLink(path) {
+  return path.replace(/^docs\/architecture\//, "");
+}
 function renderArchitectureIndex(model, layout2) {
   const lines = [
     "# Architecture Index",
@@ -20412,6 +20851,7 @@ function renderArchitectureIndex(model, layout2) {
     "- [Mermaid](diagrams/architecture.mmd)",
     "- [Structurizr JSON](diagrams/architecture.structurizr.json)",
     "- [LikeC4](diagrams/architecture.likec4)",
+    ...layout2.targets.flatMap((target) => target.type === "diagram-runtime-topology" ? [`- [Runtime topology Mermaid](${architectureIndexLink(target.path)})`] : target.type === "runtime-topology-summary" ? [`- [Runtime topology](${architectureIndexLink(target.path)})`] : []),
     "- [Decision index](decisions/index.md)",
     "- [Architecture changelog](changelog.md)"
   ];
@@ -20865,26 +21305,6 @@ function isManagedArchitectureDocumentationMarkdownPath(path) {
 function pathSegment2(id) {
   return stableId(id).replace(/\./g, "-");
 }
-function documentationLikeC4Kind(kind) {
-  if (kind === "external-system")
-    return "external_system";
-  if (kind === "datastore")
-    return "datastore";
-  if (["capability", "module", "component", "interface"].includes(kind))
-    return kind;
-  return "component";
-}
-function documentationStructurizrElementType(kind) {
-  if (kind === "capability")
-    return "Software System";
-  if (kind === "module")
-    return "Container";
-  if (kind === "datastore")
-    return "Database";
-  if (kind === "external-system")
-    return "External System";
-  return "Component";
-}
 function escapeDsl(value) {
   return value.replace(/"/g, "'");
 }
@@ -21548,7 +21968,7 @@ function sameOwners(left, right) {
 
 // packages/core/module-statistics/src/index.ts
 function evaluateDependencyConstraints(input) {
-  const constraints = [...input.constraints].sort((left, right) => compare(left.id, right.id));
+  const constraints = [...input.constraints].sort((left, right) => compare2(left.id, right.id));
   const certification = certifyCodeFacts(input.codeFacts, input.worktreeDigest, input.truncated, input.importNodeLimitExceeded ?? false);
   if (constraints.length === 0) {
     return {
@@ -21605,7 +22025,7 @@ function evaluateDependencyConstraints(input) {
     reasonCodes.add("unresolved-import");
   if (input.workspacePackagesResolved === false)
     reasonCodes.add("workspace-resolution-failed");
-  const sortedViolations = [...violations.values()].sort((left, right) => compare(left.constraintId, right.constraintId) || compare(left.fromPath, right.fromPath) || compare(left.toPath, right.toPath));
+  const sortedViolations = [...violations.values()].sort((left, right) => compare2(left.constraintId, right.constraintId) || compare2(left.fromPath, right.fromPath) || compare2(left.toPath, right.toPath));
   return {
     schemaVersion: "archcontext.dependency-constraint-evaluation/v1",
     status: sortedViolations.length > 0 ? "violated" : reasonCodes.size > 0 ? "undetermined" : "pass",
@@ -21682,7 +22102,7 @@ function measureCapabilityDependencies(input) {
     const cellKey = JSON.stringify([from.capability, to.capability]);
     let cell = cells.get(cellKey);
     if (cell === undefined) {
-      const relationIds = [...new Set(declaringRelations.get(cellKey) ?? [])].sort(compare);
+      const relationIds = [...new Set(declaringRelations.get(cellKey) ?? [])].sort(compare2);
       cell = { from: from.capability, to: to.capability, imports: 0, calls: null, declared: from.capability === to.capability || relationIds.length > 0, relationIds };
       cells.set(cellKey, cell);
     }
@@ -21690,14 +22110,14 @@ function measureCapabilityDependencies(input) {
     attributedEdges.push({ fromPath: edge.from, toPath: edge.to, fromCapability: from.capability, toCapability: to.capability });
   }
   const edgeLimit = input.edgeLimit ?? CAPABILITY_DEPENDENCIES_EDGE_LIMIT;
-  attributedEdges.sort((left, right) => compare(left.fromPath, right.fromPath) || compare(left.toPath, right.toPath));
+  attributedEdges.sort((left, right) => compare2(left.fromPath, right.fromPath) || compare2(left.toPath, right.toPath));
   const listed = attributedEdges.slice(0, edgeLimit);
   return {
     schemaVersion: CAPABILITY_DEPENDENCIES_SCHEMA_VERSION,
     ownershipRule: "parent-chain",
     filter: { from: input.from ?? null, into: input.into ?? null },
-    capabilities: input.nodes.filter((node) => node.kind === "capability").map((node) => node.id).sort(compare),
-    matrix: [...cells.values()].sort((left, right) => compare(left.from, right.from) || compare(left.to, right.to)),
+    capabilities: input.nodes.filter((node) => node.kind === "capability").map((node) => node.id).sort(compare2),
+    matrix: [...cells.values()].sort((left, right) => compare2(left.from, right.from) || compare2(left.to, right.to)),
     imports: {
       coverage: certification.coverage,
       reasonCodes: [...certification.reasonCodes].sort(),
@@ -21733,7 +22153,7 @@ function isRepositoryLocalSpecifier(specifier, workspacePackages) {
     return true;
   return workspacePackages.some((workspacePackage) => specifier === workspacePackage.name || specifier.startsWith(`${workspacePackage.name}/`));
 }
-function compare(left, right) {
+function compare2(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 function measureModuleStatistics(input) {
@@ -21818,7 +22238,7 @@ function modelDigest(model, constraints) {
     nodes: [...model.nodes].sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0),
     relations: [...model.relations].sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0),
     flows: [...model.flows ?? []].sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0),
-    ...constraints.length === 0 ? {} : { constraints: [...constraints].sort((left, right) => compare(left.id, right.id)) }
+    ...constraints.length === 0 ? {} : { constraints: [...constraints].sort((left, right) => compare2(left.id, right.id)) }
   });
 }
 function countViolationsByNode(evaluation) {
@@ -22715,6 +23135,29 @@ function listGitVisibleFiles(root, pathspec) {
     }
   }).sort((left, right) => left.localeCompare(right));
 }
+function ignoredRepositoryPaths(root, paths) {
+  if (paths.length === 0)
+    return [];
+  const result = spawnSync2("git", ["check-ignore", "--verbose", "--no-index", "-z", "--stdin"], {
+    cwd: root,
+    encoding: "utf8",
+    input: paths.map((path) => `${path}\x00`).join(""),
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  if (result.status !== 0 && result.status !== 1) {
+    const detail = result.error?.message ?? (result.stderr.trim() || `git check-ignore exited ${result.status}`);
+    throw new GitVisibleFilesUnavailableError(root, detail);
+  }
+  const fields = result.stdout.split("\x00");
+  const ignored = [];
+  for (let index = 0;index + 3 < fields.length; index += 4) {
+    const [source, line, pattern, path] = fields.slice(index, index + 4);
+    if (pattern.startsWith("!"))
+      continue;
+    ignored.push({ path, source, line: Number(line), pattern });
+  }
+  return ignored;
+}
 function readHeadSha(root) {
   try {
     return execFileSync("git", ["rev-parse", "HEAD"], {
@@ -26083,7 +26526,7 @@ function buildObservations(snapshot, structure, model) {
       evidence: evidence.evidenceGap()
     });
   }
-  return drafts.map((draft, index) => ({ draft, order: draft.kind === "cycle" ? index : 0 })).sort((left, right) => compare2(left.draft.kind, right.draft.kind) || left.order - right.order || compare2(left.draft.subjectSelectorId, right.draft.subjectSelectorId)).map(({ draft }) => ({
+  return drafts.map((draft, index) => ({ draft, order: draft.kind === "cycle" ? index : 0 })).sort((left, right) => compare3(left.draft.kind, right.draft.kind) || left.order - right.order || compare3(left.draft.subjectSelectorId, right.draft.subjectSelectorId)).map(({ draft }) => ({
     kind: draft.kind,
     subjectSelectorId: draft.subjectSelectorId,
     affectedNodeIds: draft.affectedNodeIds,
@@ -26273,13 +26716,13 @@ function signalIdFor(draft) {
 }
 function modelDigest2(model, constraints) {
   return digestJson({
-    nodes: [...model.nodes].sort((left, right) => compare2(left.id, right.id)),
-    relations: [...model.relations].sort((left, right) => compare2(left.id, right.id)),
-    flows: [...model.flows ?? []].sort((left, right) => compare2(left.id, right.id)),
-    ...constraints.length === 0 ? {} : { constraints: [...constraints].sort((left, right) => compare2(left.id, right.id)) }
+    nodes: [...model.nodes].sort((left, right) => compare3(left.id, right.id)),
+    relations: [...model.relations].sort((left, right) => compare3(left.id, right.id)),
+    flows: [...model.flows ?? []].sort((left, right) => compare3(left.id, right.id)),
+    ...constraints.length === 0 ? {} : { constraints: [...constraints].sort((left, right) => compare3(left.id, right.id)) }
   });
 }
-function compare2(left, right) {
+function compare3(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 function isNumber(value) {
@@ -26301,17 +26744,49 @@ var architecture_node_schema_default = {
   type: "object",
   additionalProperties: false,
   required: ["schemaVersion", "id", "kind", "name", "status", "summary"],
+  allOf: [
+    {
+      if: { properties: { kind: { const: "namespace" } }, required: ["kind"] },
+      then: { required: ["namespace"] },
+      else: { not: { required: ["namespace"] } }
+    },
+    {
+      if: { properties: { kind: { const: "mount" } }, required: ["kind"] },
+      then: { required: ["mount"] },
+      else: { not: { required: ["mount"] } }
+    }
+  ],
   properties: {
     schemaVersion: { const: "archcontext.node/v2" },
     id: { type: "string", pattern: "^([a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)*::)?[a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)+$" },
     kind: {
       type: "string",
-      enum: ["capability", "module", "component", "interface", "event", "datastore", "external-system", "deployment"]
+      enum: ["capability", "module", "component", "interface", "event", "datastore", "external-system", "deployment", "process", "namespace", "mount"]
     },
     name: { type: "string" },
     status: { type: "string", enum: ["active", "planned", "deprecated", "removed"] },
     parent: { type: "string", pattern: "^([a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)*::)?[a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)+$" },
+    layer: { type: "string", pattern: "^[a-z][a-z0-9]*(-[a-z0-9]+)*$" },
     summary: { type: "string" },
+    namespace: {
+      type: "object",
+      additionalProperties: false,
+      required: ["type"],
+      properties: {
+        type: { type: "string", enum: ["host", "container", "pod", "kubernetes", "pid", "mount", "net", "user"] }
+      }
+    },
+    mount: {
+      type: "object",
+      additionalProperties: false,
+      required: ["target", "mode", "order"],
+      properties: {
+        source: { type: "string", minLength: 1 },
+        target: { type: "string", pattern: "^/([^/\\u0000]+(/[^/\\u0000]+)*)?$" },
+        mode: { type: "string", enum: ["ro", "rw"] },
+        order: { type: "integer", minimum: 0 }
+      }
+    },
     responsibilities: { type: "array", items: { type: "string" }, minItems: 1 },
     source: {
       type: "object",
@@ -26400,7 +26875,7 @@ var architecture_relation_schema_default = {
     id: { type: "string", pattern: "^([a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)*::)?[a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)+$" },
     kind: {
       type: "string",
-      enum: ["depends-on", "calls", "publishes", "subscribes", "reads", "writes", "implements", "deployed-on"]
+      enum: ["depends-on", "calls", "publishes", "subscribes", "reads", "writes", "implements", "deployed-on", "spawns", "runs-in", "mounts"]
     },
     source: { type: "string", pattern: "^([a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)*::)?[a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)+$" },
     target: { type: "string", pattern: "^([a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)*::)?[a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)+$" },
@@ -27108,6 +27583,22 @@ function createDefaultProjectionTargetManifest() {
         ownership: "generated",
         format: "likec4"
       },
+      {
+        id: "projection_rule.diagram.runtime-topology",
+        targetType: "diagram-runtime-topology",
+        scope: { kind: "diagram", id: "runtime-topology" },
+        pathTemplate: "docs/architecture/diagrams/runtime-topology.mmd",
+        ownership: "generated",
+        format: "mermaid"
+      },
+      {
+        id: "projection_rule.runtime-topology.summary",
+        targetType: "runtime-topology-summary",
+        scope: { kind: "diagram", id: "runtime-topology" },
+        pathTemplate: "docs/architecture/runtime-topology.md",
+        ownership: "generated",
+        format: "markdown"
+      },
       {
         id: "projection_rule.agent-context.claude",
         targetType: "agent-context",
@@ -27253,10 +27744,19 @@ class YamlModelStore {
       }
     }
     const files = listModelFiles(workspace.root);
+    const topologyRecords = { nodes: [], relations: [] };
+    const topologyRecordPaths = new Map;
     for (const file of files) {
       if (file.path.startsWith(".archcontext/model/") && /\.ya?ml$/.test(file.path)) {
         try {
           const value = parseJsonOrStableYaml(file.body, file.path);
+          for (const [directory, records] of [["nodes", topologyRecords.nodes], ["relations", topologyRecords.relations]]) {
+            if (!file.path.startsWith(`.archcontext/model/${directory}/`) || !isJsonRecord2(value))
+              continue;
+            records.push(value);
+            if (typeof value.id === "string")
+              topologyRecordPaths.set(value.id, file.path);
+          }
           if (file.path.startsWith(".archcontext/model/nodes/")) {
             const { issues } = validateJsonSchema(architecture_node_schema_default, value);
             for (const issue of issues) {
@@ -27277,6 +27777,9 @@ class YamlModelStore {
         errors.push(`${file.path}: expected archcontext.flow/v1, got ${file.schemaVersion || "missing"}`);
       }
     }
+    for (const issue of runtimeTopologyModelIssues(topologyRecords)) {
+      errors.push(`${topologyRecordPaths.get(issue.entityId) ?? issue.entityId}: ${issue.field}: ${issue.invariant}`);
+    }
     const adr = validateAdrAppliesTo(files);
     const constraints = readDependencyConstraints(files);
     const reviewPolicy = readReviewPolicy(files);
@@ -27297,6 +27800,21 @@ class YamlModelStore {
     return { digest: digestJson(changeSet), summary: "ChangeSet preview generated" };
   }
 }
+var ARCHITECTURE_MODEL_COMMITTED_PATHS = Object.freeze([
+  ".archcontext/manifest.yaml",
+  ".archcontext/product.yaml",
+  ".archcontext/model/nodes/",
+  ".archcontext/model/relations/",
+  ".archcontext/model/flows/",
+  ".archcontext/decisions/",
+  ".archcontext/policies/",
+  ".archcontext/practices/",
+  ".archcontext/projections/"
+]);
+function architectureModelIgnoreProbePaths(root) {
+  const directories = ARCHITECTURE_MODEL_COMMITTED_PATHS.filter((path) => path.endsWith("/")).map((path) => path.slice(0, -1));
+  return [...new Set([...ARCHITECTURE_MODEL_COMMITTED_PATHS, ...collectArchContextFiles(root, directories)])];
+}
 function listModelFiles(root) {
   const paths = collectArchContextFiles(root, [
     ".archcontext/manifest.yaml",
@@ -27381,6 +27899,9 @@ function extractSchemaVersion(body, path) {
     return "archcontext.generated/v1";
   return "";
 }
+function isJsonRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function withTrailingNewline(body) {
   return body.endsWith(`
 `) ? body : `${body}
@@ -31318,13 +31839,10 @@ class HttpContext7Transport {
     url.searchParams.set("libraryName", input.libraryName);
     url.searchParams.set("query", input.query);
     url.searchParams.set("fast", input.fast ? "true" : "false");
-    const response = await fetchWithTimeout(url, {
+    const { payload } = await fetchJsonWithTimeout(url, {
       method: "GET",
       headers: authHeaders(input.apiKey)
-    }, input.timeoutMs);
-    if (!response.ok)
-      throw httpStatusError("Context7 search failed", response);
-    const { payload } = await parseJsonResponse(response, "Context7 search");
+    }, input.timeoutMs, "Context7 search");
     return parseSearchResponse(payload);
   }
   async getContext(input) {
@@ -31333,13 +31851,10 @@ class HttpContext7Transport {
     url.searchParams.set("query", input.query);
     url.searchParams.set("type", "json");
     url.searchParams.set("fast", "true");
-    const response = await fetchWithTimeout(url, {
+    const { payload } = await fetchJsonWithTimeout(url, {
       method: "GET",
       headers: authHeaders(input.apiKey)
-    }, input.timeoutMs);
-    if (!response.ok)
-      throw httpStatusError("Context7 context fetch failed", response);
-    const { payload } = await parseJsonResponse(response, "Context7 context fetch");
+    }, input.timeoutMs, "Context7 context fetch");
     return parseDocumentationResponse(payload).slice(0, input.maxResults);
   }
 }
@@ -31437,11 +31952,14 @@ function normalizeSourceUri(value) {
     return;
   }
 }
-async function fetchWithTimeout(input, init, timeoutMs) {
+async function fetchJsonWithTimeout(input, init, timeoutMs, label) {
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    return await withLocalEgress2("context7", () => fetch(input, { ...init, redirect: "error", signal: controller.signal }));
+    const response = await withLocalEgress2("context7", () => fetch(input, { ...init, redirect: "error", signal: controller.signal }));
+    if (!response.ok)
+      throw httpStatusError(`${label} failed`, response);
+    return await parseJsonResponse(response, label);
   } catch (error) {
     if (isAbortError(error)) {
       throw new Context7ProviderError("timeout", "Context7 provider request timed out", { retryable: true, cause: error });
@@ -32674,6 +33192,11 @@ async function runArchitectureDocsProjectionCommand(input, cwd, daemon) {
   try {
     const subcommand = input.action ?? "plan";
     const root = findRepositoryRoot(cwd);
+    if (subcommand === "adopt") {
+      const ignored = architectureModelIgnoredEnvelope("docs.adopt", root);
+      if (ignored)
+        return ignored;
+    }
     let profile;
     let projection;
     let acceptedChange;
@@ -32789,6 +33312,23 @@ async function runArchitectureDocsProjectionCommand(input, cwd, daemon) {
     throw publicOperationFailure(error);
   }
 }
+function ignoredArchitectureModelPaths(root) {
+  const ignored = ignoredRepositoryPaths(root, architectureModelIgnoreProbePaths(root));
+  const directories = ignored.filter((entry) => entry.path.endsWith("/")).map((entry) => entry.path);
+  return ignored.filter((entry) => entry.path.endsWith("/") || !directories.some((directory) => entry.path.startsWith(directory)));
+}
+function architectureModelIgnoredEnvelope(requestId, root) {
+  const ignored = ignoredArchitectureModelPaths(root);
+  if (ignored.length === 0)
+    return;
+  const paths = ignored.map((entry) => entry.path).slice(0, 8);
+  return publicFailureEnvelope(requestId, "AC_PRECONDITION_FAILED", "architecture-model-ignored", {
+    pathCount: ignored.length,
+    paths,
+    commands: [`git check-ignore --verbose --no-index -- ${paths.join(" ")}`],
+    omittedPathCount: ignored.length - paths.length
+  });
+}
 function committedArchitectureDocsProfile(root) {
   return existsSync9(resolve13(root, ARCHITECTURE_DOCS_PROJECTION_MANIFEST_PATH)) ? loadArchitectureDocumentationProfile(root) : "default";
 }
@@ -33099,6 +33639,11 @@ async function runProjectionProtocolCommand(invocation, cwd, daemon) {
       if (replay)
         return replay;
     }
+    if (request.mode === "adopt") {
+      const ignored = architectureModelIgnoredEnvelope("projection.run", root);
+      if (ignored)
+        return ignored;
+    }
     let observed;
     let acceptedChange = request.acceptedChange;
     let declinedUnprovableNodeIds;
@@ -34663,6 +35208,7 @@ init_projection_recovery();
 init_projection_writer();
 init_projection_manifest();
 init_refactor();
+init_runtime_topology();
 init_schema();
 init_failure();
 init_validator();
@@ -47072,7 +47618,7 @@ function upgradeExistingLocalStoreTarget2(paths, integrityCheck) {
 var RUNTIME_AGENT_JOB_STATUSES = ["queued", "running", "succeeded", "failed", "cancelled", "superseded", "expired"];
 var CHANGESET_MODEL_TRANSITION_SCHEMA_VERSION = "archcontext.changeset-model-transition/v1";
 function assertChangeSetModelTransition(value, label = "changeset-model-transition-invalid") {
-  if (!isJsonRecord2(value) || Object.keys(value).sort().join(",") !== "after,before,schemaVersion" || value.schemaVersion !== CHANGESET_MODEL_TRANSITION_SCHEMA_VERSION || typeof value.before !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.before) || typeof value.after !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.after)) {
+  if (!isJsonRecord3(value) || Object.keys(value).sort().join(",") !== "after,before,schemaVersion" || value.schemaVersion !== CHANGESET_MODEL_TRANSITION_SCHEMA_VERSION || typeof value.before !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.before) || typeof value.after !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.after)) {
     throw new Error(label);
   }
   return { schemaVersion: CHANGESET_MODEL_TRANSITION_SCHEMA_VERSION, before: value.before, after: value.after };
@@ -51360,10 +51906,10 @@ function readChangeSetJournalTaskSessionId(metadataJson, journalId) {
   } catch {
     throw new Error(`changeset-journal-metadata-malformed: ${journalId}`);
   }
-  if (!isJsonRecord2(metadata))
+  if (!isJsonRecord3(metadata))
     throw new Error(`changeset-journal-metadata-malformed: ${journalId}`);
   const reason = metadata.reason;
-  if (!isJsonRecord2(reason) || typeof reason.taskSessionId !== "string" || reason.taskSessionId === "") {
+  if (!isJsonRecord3(reason) || typeof reason.taskSessionId !== "string" || reason.taskSessionId === "") {
     throw new Error(`changeset-journal-reason-malformed: ${journalId}`);
   }
   return reason.taskSessionId;
@@ -51396,7 +51942,7 @@ function committedChangeSetJournalFiles(filesJson, journalId) {
   if (!Array.isArray(parsed))
     throw new Error(`changeset-journal-files-malformed: ${journalId}`);
   return parsed.map((entry) => {
-    if (!isJsonRecord2(entry) || typeof entry.path !== "string" || typeof entry.operation !== "string") {
+    if (!isJsonRecord3(entry) || typeof entry.path !== "string" || typeof entry.operation !== "string") {
       throw new Error(`changeset-journal-file-malformed: ${journalId}`);
     }
     if (typeof entry.bodyHash !== "string" || entry.bodyHash === "") {
@@ -51416,7 +51962,7 @@ function committedChangeSetProjectionOwned(metadataJson, journalId) {
   } catch {
     throw new Error(`changeset-journal-metadata-malformed: ${journalId}`);
   }
-  return isJsonRecord2(metadata) && metadata.projectionOwned === true;
+  return isJsonRecord3(metadata) && metadata.projectionOwned === true;
 }
 function committedChangeSetModelTransition(metadataJson, journalId) {
   let metadata;
@@ -51425,7 +51971,7 @@ function committedChangeSetModelTransition(metadataJson, journalId) {
   } catch {
     throw new Error(`changeset-journal-metadata-malformed: ${journalId}`);
   }
-  if (!isJsonRecord2(metadata))
+  if (!isJsonRecord3(metadata))
     throw new Error(`changeset-journal-metadata-malformed: ${journalId}`);
   if (metadata.modelTransition === undefined)
     return;
@@ -51439,7 +51985,7 @@ function readChangeSetJournalMetadata(db, journalId) {
 }
 function withChangeSetJournalArchitectureLedger(metadata, patch) {
   const existing = metadata.architectureLedger;
-  const architectureLedger = isJsonRecord2(existing) ? { ...existing, ...patch } : {
+  const architectureLedger = isJsonRecord3(existing) ? { ...existing, ...patch } : {
     schemaVersion: "archcontext.changeset-ledger-recovery/v1",
     ...patch
   };
@@ -51461,12 +52007,12 @@ function changeSetJournalPlannedLedgerEvent(metadata) {
   const architectureLedger = metadata.architectureLedger;
   if (architectureLedger === undefined)
     return;
-  if (!isJsonRecord2(architectureLedger))
+  if (!isJsonRecord3(architectureLedger))
     throw new Error("changeset-ledger-recovery-metadata-malformed");
   const plannedEvent = architectureLedger.plannedEvent;
   if (plannedEvent === undefined)
     return;
-  if (!isJsonRecord2(plannedEvent))
+  if (!isJsonRecord3(plannedEvent))
     throw new Error("changeset-ledger-recovery-planned-event-malformed");
   const event = plannedEvent;
   try {
@@ -51476,7 +52022,7 @@ function changeSetJournalPlannedLedgerEvent(metadata) {
   }
   return event;
 }
-function isJsonRecord2(value) {
+function isJsonRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function recoverJournalFiles(root, files) {
@@ -59359,11 +59905,13 @@ class ArchctxDaemon {
         return okEnvelope("status", status);
       const repositoryId = repositoryFingerprint(root);
       const session = this.sessions.get(repositoryId);
+      const ignoredModelPaths = ignoredArchitectureModelPaths(root);
       return okEnvelope("status", {
         ...status,
         repositoryId,
         headSha: session?.workspace.headSha ?? readHeadSha(root),
-        worktreeDigest: computeWorktreeDigest(root, listGitVisibleFiles(root))
+        worktreeDigest: computeWorktreeDigest(root, listGitVisibleFiles(root)),
+        ...ignoredModelPaths.length === 0 ? {} : { architectureModelIgnoredPaths: ignoredModelPaths }
       });
     } catch (error) {
       throw publicOperationFailure(error);
@@ -60078,26 +60626,19 @@ function exportLikeC4Model(model) {
   const normalized = normalizeNativeModel(model);
   const lines = [
     "// Generated by ArchContext. Native model remains source of truth.",
-    "specification {",
-    "  element capability",
-    "  element module",
-    "  element component",
-    "  element interface",
-    "  element datastore",
-    "  element external_system",
-    "}",
+    ...likeC4SpecificationLines(normalized.nodes),
     "",
     "model {"
   ];
   for (const node of normalized.nodes) {
     lines.push(`  // archctx-node ${JSON.stringify(node)}`);
-    lines.push(`  ${likec4Id(node.id)} = ${likec4Kind(node.kind)} "${escapeDsl2(node.name)}"`);
+    lines.push(`  ${likec4Id(node.id)} = ${likeC4ElementKind(node.kind)} "${escapeDsl2(node.name)}"`);
   }
   for (const relation of normalized.relations) {
     lines.push(`  // archctx-relation ${JSON.stringify(relation)}`);
     lines.push(`  ${likec4Id(relation.source)} -> ${likec4Id(relation.target)} "${escapeDsl2(relation.kind)}"`);
   }
-  lines.push("}", "", "views {", "  view index {", "    include *", "    autoLayout TopBottom", "  }", "}");
+  lines.push("}", "", ...likeC4IndexViewLines(architectureLayerGroups(normalized), likec4Id));
   const content = `${lines.join(`
 `)}
 `;
@@ -60127,15 +60668,6 @@ function importLikeC4InitialModel(content) {
 function likec4Id(id) {
   return stableId(id).replace(/-/g, "_").replace(/\./g, "_").replace(/::/g, "__");
 }
-function likec4Kind(kind) {
-  if (kind === "external-system")
-    return "external_system";
-  if (kind === "datastore")
-    return "datastore";
-  if (["capability", "module", "component", "interface"].includes(kind))
-    return kind;
-  return "component";
-}
 function escapeDsl2(value) {
   return value.replace(/"/g, "'");
 }
@@ -60144,17 +60676,22 @@ function escapeDsl2(value) {
 init_src();
 function exportStructurizrWorkspace(model, name = "ArchContext Export") {
   const normalized = normalizeNativeModel(model);
+  const { layerByNodeId } = architectureLayerGroups(normalized);
   const workspace = {
     schemaVersion: "archcontext.structurizr-export/v1",
     name,
     model: {
-      elements: normalized.nodes.map((node) => ({
-        id: node.id,
-        name: node.name,
-        type: structurizrElementType(node.kind),
-        tags: [node.kind],
-        archcontextNative: node
-      })),
+      elements: normalized.nodes.map((node) => {
+        const layer = layerByNodeId.get(node.id);
+        return {
+          id: node.id,
+          name: node.name,
+          type: architectureStructurizrElementType(node.kind),
+          tags: [node.kind],
+          ...layer === undefined ? {} : { group: layer },
+          archcontextNative: node
+        };
+      }),
       relationships: normalized.relations.map((relation) => ({
         id: relation.id,
         sourceId: relation.source,
@@ -60198,17 +60735,6 @@ function importStructurizrInitialModel(content) {
     warnings: ["Structurizr import is initialization-only; Native ArchContext remains source of truth."]
   };
 }
-function structurizrElementType(kind) {
-  if (kind === "capability")
-    return "Software System";
-  if (kind === "module")
-    return "Container";
-  if (kind === "datastore")
-    return "Database";
-  if (kind === "external-system")
-    return "External System";
-  return "Component";
-}
 
 // packages/surfaces/mcp-local/src/tool-schemas.ts
 var text2 = { type: "string", minLength: 1 };
@@ -60782,17 +61308,49 @@ var architecture_node_schema_default2 = {
   type: "object",
   additionalProperties: false,
   required: ["schemaVersion", "id", "kind", "name", "status", "summary"],
+  allOf: [
+    {
+      if: { properties: { kind: { const: "namespace" } }, required: ["kind"] },
+      then: { required: ["namespace"] },
+      else: { not: { required: ["namespace"] } }
+    },
+    {
+      if: { properties: { kind: { const: "mount" } }, required: ["kind"] },
+      then: { required: ["mount"] },
+      else: { not: { required: ["mount"] } }
+    }
+  ],
   properties: {
     schemaVersion: { const: "archcontext.node/v2" },
     id: { type: "string", pattern: "^([a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)*::)?[a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)+$" },
     kind: {
       type: "string",
-      enum: ["capability", "module", "component", "interface", "event", "datastore", "external-system", "deployment"]
+      enum: ["capability", "module", "component", "interface", "event", "datastore", "external-system", "deployment", "process", "namespace", "mount"]
     },
     name: { type: "string" },
     status: { type: "string", enum: ["active", "planned", "deprecated", "removed"] },
     parent: { type: "string", pattern: "^([a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)*::)?[a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*)+$" },
+    layer: { type: "string", pattern: "^[a-z][a-z0-9]*(-[a-z0-9]+)*$" },
     summary: { type: "string" },
+    namespace: {
+      type: "object",
+      additionalProperties: false,
+      required: ["type"],
+      properties: {
+        type: { type: "string", enum: ["host", "container", "pod", "kubernetes", "pid", "mount", "net", "user"] }
+      }
+    },
+    mount: {
+      type: "object",
+      additionalProperties: false,
+      required: ["target", "mode", "order"],
+      properties: {
+        source: { type: "string", minLength: 1 },
+        target: { type: "string", pattern: "^/([^/\\u0000]+(/[^/\\u0000]+)*)?$" },
+        mode: { type: "string", enum: ["ro", "rw"] },
+        order: { type: "integer", minimum: 0 }
+      }
+    },
     responsibilities: { type: "array", items: { type: "string" }, minItems: 1 },
     source: {
       type: "object",