aw-spec-cli 0.1.20 → 0.1.21

package/assets/guardrails/projects/dotnet-default-project/domain-rule-bindings.md

@@ -26,13 +26,16 @@ through the spec/design (as CN-/DC-/IC- ids).
 
 ## /aw-spec-constitution
 <!-- What the DOMAIN half ratifies into constitution.domain.md as domain principles XVI+.
-     The industry constitution first, then the STANDARD industry rules — identity,
-     regulatory, interop, security overlays — which every project on this corpus shares, and
-     LAST the PROJECT-SUPPLIED domain-requirements.md the project team authors. Only that
-     last file is expected to differ between two projects on the same corpus, and its mapping is
-     OPTIONAL: the project owner supplies the file, and where it is absent the set loads
-     without it rather than failing. -->
+     The industry constitution first, then the STANDARD industry rules — the modelling
+     overlay the Adopted Modelling Standard section cites, identity, regulatory, interop,
+     security overlays, and the folder overlay the Domain Folder Additions section cites —
+     which every project on this corpus shares, and LAST the PROJECT-SUPPLIED
+     domain-requirements.md the project team authors. Only that last file is expected to
+     differ between two projects on the same corpus, and its mapping is OPTIONAL: the project
+     owner supplies the file, and where it is absent the set loads without it rather than
+     failing. -->
 - guardrails/domain/healthcare/domain-constitution.md
+- guardrails/domain/healthcare/domain-driven-design.domain.md
 - guardrails/domain/healthcare/clinical-terms.md
 - guardrails/domain/healthcare/terminology.md
 - guardrails/domain/healthcare/consent.md
@@ -45,6 +48,7 @@ through the spec/design (as CN-/DC-/IC- ids).
 - guardrails/domain/healthcare/authorization.domain.md
 - guardrails/domain/healthcare/zero-trust.domain.md
 - guardrails/domain/healthcare/ai-rules.domain.md
+- guardrails/domain/healthcare/folder-structure.domain.md
 - guardrails/projects/dotnet-default-project/domain/domain-requirements.md
 
 ## /aw-spec-specify

package/assets/guardrails/projects/dotnet-default-project/tech-rule-bindings.md

@@ -141,6 +141,7 @@ NOT listed here — every consumer refers to it directly, as-is.
 - guardrails/technology/dotnet-webapi/coding-standards.md
 - guardrails/technology/dotnet-webapi/dependency-policy.md
 - guardrails/technology/dotnet-webapi/folder-structure.md
+- guardrails/technology/dotnet-webapi/framework-api-map.md
 - guardrails/technology/dotnet-webapi/testing.md
 - guardrails/technology/dotnet-webapi/PACKAGING.md
 
@@ -181,6 +182,7 @@ NOT listed here — every consumer refers to it directly, as-is.
 - guardrails/technology/dotnet-webapi/coding-standards.md
 - guardrails/technology/dotnet-webapi/dependency-policy.md
 - guardrails/technology/dotnet-webapi/folder-structure.md
+- guardrails/technology/dotnet-webapi/framework-api-map.md
 - guardrails/technology/dotnet-webapi/testing.md
 - guardrails/technology/dotnet-webapi/PACKAGING.md
 
@@ -199,6 +201,7 @@ NOT listed here — every consumer refers to it directly, as-is.
      resolve-domain `## /aw-spec-gate`). Validation input only — never authoring. -->
 - guardrails/technology/dotnet-webapi/testing.md
 - guardrails/technology/dotnet-webapi/coding-standards.md
+- guardrails/technology/dotnet-webapi/framework-api-map.md
 
 ## /aw-spec-constitution
 <!-- What the TECHNICAL half of the split constitution ratifies into
@@ -214,6 +217,7 @@ NOT listed here — every consumer refers to it directly, as-is.
 - guardrails/technology/dotnet-webapi/clean-architecture.md
 - guardrails/technology/dotnet-webapi/modular-monolith.md
 - guardrails/technology/dotnet-webapi/vertical-slices.md
+- guardrails/technology/dotnet-webapi/domain-driven-design.md
 - guardrails/technology/dotnet-webapi/cqrs.md
 - guardrails/technology/dotnet-webapi/persistence.md
 - guardrails/technology/dotnet-webapi/eventing.md

package/assets/guardrails/technology/dotnet-webapi/auditing.md

@@ -51,7 +51,9 @@ implements. The interceptor populates every audit field automatically (no manual
 | **Advanced** | Basic markers **+ `IFieldAudited`** | Basic + field-level before/after (`PropertyChange`: original → new) | entity + property-level previous/new |
 
 Field-level before/after values exist **only** at the Advanced tier. Children marked
-`IAggregateChild` fold into the root's `AuditLog`.
+`IAggregateChild` (`AppWeaver.Auditing.Interfaces`, package `AppWeaver.Auditing` —
+[[framework-api-map]]) fold into the root's `AuditLog`; an unmarked child gets a standalone
+entry instead, which is the silent failure this marker exists to prevent.
 
 ## Canonical example
 

package/assets/guardrails/technology/dotnet-webapi/coding-standards.md

@@ -7,9 +7,11 @@
 - Solution and projects: `<SampleProjectName>.<Role>` (e.g. `<SampleProjectName>.Api`,
   `<SampleProjectName>.AppHost`, `<SampleProjectName>.ServiceDefaults`).
 - Namespaces mirror the folder path exactly; **file-scoped namespaces only**.
-- Aggregates: `class <Aggregate> : EntityBase<<Aggregate>Id>, IAggregateRoot,
-  IFullAuditedObject, ISoftDeletable, IConcurrencyTracked, IHasDomainEvents,
-  INamedEntity<<Aggregate>Id>`.
+- Aggregates: `class <Aggregate> : AggregateRootBase<<Aggregate>Id>, IFullAuditedObject,
+  ISoftDeletable, IConcurrencyTracked, INamedEntity<<Aggregate>Id>` —
+  `AggregateRootBase<TId>` already carries `EntityBase<TId>`, `IAggregateRoot` and
+  `IHasDomainEvents`. Child entities take `EntityBase<TId>` plus `IAggregateChild`.
+  Packages and namespaces: [[framework-api-map]].
 - Commands/Queries: `record <Verb><Aggregate>Command(...) : ICommand<Result<TDto>>`.
 - DTOs: `record <Aggregate>Dto { public required Guid Id { get; init; } ... }` — no setters;
   required init for non-nullable members.

package/assets/guardrails/technology/dotnet-webapi/cqrs.md

@@ -47,7 +47,11 @@ Enabled at startup, in order:
 
 - Write handlers **MUST** wrap mutating work in
   `IUnitOfWork.ExecuteInTransactionAsync(..., IsolationLevel.ReadCommitted, ct)` and call
-  `SaveChangesAsync` **inside** the lambda.
+  `SaveChangesAsync` **inside** the lambda. That method is an extension in
+  `AppWeaver.Repository.Extensions` over `AppWeaver.Repository.Abstractions.IUnitOfWork` —
+  add both usings. It does NOT extend the `AppWeaver.SharedKernel` interface of the same
+  name, and injecting that one is why the method can appear not to exist
+  ([[framework-api-map]]).
 - They **MUST** publish domain events and call `ClearDomainEvents()` before returning.
 - **One command mutates one aggregate per transaction** — cross-aggregate effects flow
   through domain events or follow-up commands (see [[eventing]]).

package/assets/guardrails/technology/dotnet-webapi/domain-driven-design.md

@@ -15,10 +15,14 @@
 ## Aggregate design
 
 - Every entity exposed to the Application layer is reached through an **Aggregate Root**.
-- Aggregate roots implement `IAggregateRoot`, `EntityBase<TId>`, and the
-  audit/soft-delete/concurrency/domain-event interfaces they need:
-  `IFullAuditedObject` or `IAuditableEntityBase`, `ISoftDeletable`, `IConcurrencyTracked`,
-  `IHasDomainEvents`, `INamedEntity<TId>` when listable.
+- Aggregate roots derive from `AggregateRootBase<TId>`
+  (`AppWeaver.DomainAbstraction.Entities`), which already carries `EntityBase<TId>`,
+  `IAggregateRoot` and domain-event support — do not reassemble those by hand. They add the
+  audit/soft-delete/concurrency interfaces they need: `IFullAuditedObject`
+  (`AppWeaver.Auditing.Interfaces`) or `IAuditableEntityBase`, `ISoftDeletable`,
+  `IConcurrencyTracked` (`AppWeaver.DomainAbstraction.Entities`), and `INamedEntity<TId>`
+  when listable. Every package and namespace is in [[framework-api-map]]; a type that seems
+  to be missing is a missing package reference, not an absent API.
 
 ### Aggregate root responsibilities
 
@@ -28,7 +32,11 @@
 
 ### Child entity ownership
 
-- Child entities implement `IAggregateChild` and expose `GetAggregateRoot()`.
+- Child entities derive from `EntityBase<TId>` (`AppWeaver.DomainAbstraction.Entities`) and
+  implement `IAggregateChild` (`AppWeaver.Auditing.Interfaces` — a DIFFERENT package from the
+  aggregate types, see [[framework-api-map]]), returning the in-memory root instance from
+  `GetAggregateRoot()`. That linkage is what folds the child's changes into the root's audit
+  entry instead of leaving a standalone one.
 - They are mutated **only** through methods on the aggregate root.
 
 ## Transactional / consistency boundaries

package/assets/guardrails/technology/dotnet-webapi/examples/cqrs.md

@@ -21,6 +21,8 @@ public record CreateProjectCommand(
 ) : ICommand<Result<ProjectDto>>;
 
 // Write handler — primary-ctor DI, transaction, publish + clear events, Result<T>
+// using AppWeaver.Repository.Abstractions;   // IRepository<T>, IUnitOfWork
+// using AppWeaver.Repository.Extensions;     // ExecuteInTransactionAsync — the extension below
 public class CreateProjectCommandHandler(
     IRepository<Project> _repo, IUnitOfWork _uow, IPublisher _eventBus
 ) : ICommandHandler<CreateProjectCommand, Result<ProjectDto>>

package/assets/guardrails/technology/dotnet-webapi/examples/domain-driven-design.md

@@ -19,9 +19,11 @@ domain events, and an invariant enforced **inside** the aggregate:
 [ValueObject<Guid>]
 public partial struct ProjectId { }
 
+// using AppWeaver.DomainAbstraction.Entities;   // AggregateRootBase, ISoftDeletable, IConcurrencyTracked
+// using AppWeaver.Auditing.Interfaces;          // IFullAuditedObject, IFieldAudited  (package AppWeaver.Auditing)
 public class Project :
-    EntityBase<ProjectId>, IAggregateRoot, IFullAuditedObject, IFieldAudited,
-    ISoftDeletable, IConcurrencyTracked, IHasDomainEvents, INamedEntity<ProjectId>
+    AggregateRootBase<ProjectId>, IFullAuditedObject, IFieldAudited,
+    ISoftDeletable, IConcurrencyTracked, INamedEntity<ProjectId>
 {
     private readonly List<ProjectTask> _tasks = new();
 
@@ -100,6 +102,8 @@ setters, and is mutated **only** through methods the parent aggregate calls:
 [ValueObject<Guid>]
 public partial struct ProjectTaskId { }
 
+// using AppWeaver.DomainAbstraction.Entities;   // EntityBase
+// using AppWeaver.Auditing.Interfaces;          // IAggregateChild  (package AppWeaver.Auditing)
 public class ProjectTask : EntityBase<ProjectTaskId>, IAggregateChild
 {
     public ProjectId ProjectId { get; private set; }            // FK back to the root

package/assets/guardrails/technology/dotnet-webapi/framework-api-map.md

@@ -0,0 +1,70 @@
+# Framework API Map — which package and namespace each cited type comes from
+
+> Pure technology (domain-agnostic). NON-NEGOTIABLE where it names a package.
+> Commands: `/aw-spec-implement`, `/aw-spec-implement-delta`, `/aw-spec-analyze-slice`.
+>
+> The rules in this corpus name framework types — `AggregateRootBase<TId>`,
+> `IAggregateChild`, `IUnitOfWork`. This file says where each one LIVES. Without it a
+> generator searches for a bare type name, finds a same-named type in another package or
+> none at all, and concludes the API does not exist — then hand-rolls a substitute or
+> silently drops the rule that required it.
+
+## The trap this file exists for
+
+**Several of these names exist TWICE**, once in `AppWeaver.SharedKernel` and once in the
+split packages (`AppWeaver.DomainAbstraction`, `AppWeaver.Repository`, `AppWeaver.Auditing`).
+The two sets are not interchangeable:
+
+- `AppWeaver.Repository.Abstractions.IUnitOfWork` takes an isolation level on
+  `BeginTransactionAsync` and is what `ExecuteInTransactionAsync` extends.
+  `AppWeaver.SharedKernel.UnitOfWork.IUnitOfWork` does neither — inject that one and the
+  transaction helper is not in scope, which reads exactly like "the method does not exist".
+- `EntityBase<TId>`, `IAggregateRoot`, `DomainEventBase`, `ISoftDeletable` and the other
+  entity interfaces have SharedKernel twins in the same shape.
+
+**Use the split packages.** They are what the shipped foundation references; SharedKernel is
+not referenced by it. Never import a SharedKernel namespace into generated code, and never
+mix the two sets in one type.
+
+## The map
+
+| Type | Package | Namespace |
+|---|---|---|
+| `AggregateRootBase<TId>` | `AppWeaver.DomainAbstraction` | `AppWeaver.DomainAbstraction.Entities` |
+| `EntityBase<TId>` | `AppWeaver.DomainAbstraction` | `AppWeaver.DomainAbstraction.Entities` |
+| `IEntity<TId>` | `AppWeaver.DomainAbstraction` | `AppWeaver.DomainAbstraction.Entities` |
+| `IAuditableEntityBase`, `ISoftDeletable`, `IConcurrencyTracked` | `AppWeaver.DomainAbstraction` | `AppWeaver.DomainAbstraction.Entities` |
+| `IAggregateRoot` | `AppWeaver.DomainAbstraction` | `AppWeaver.DomainAbstraction.Aggregates` |
+| `DomainEventBase`, `IHasDomainEvents` | `AppWeaver.DomainAbstraction` | `AppWeaver.DomainAbstraction.DomainEvents` |
+| `IAggregateChild`, `IFullAuditedObject`, `IFieldAudited` | **`AppWeaver.Auditing`** | `AppWeaver.Auditing.Interfaces` |
+| `IUnitOfWork`, `IRepository<T>`, `IReadRepository<T>` | `AppWeaver.Repository` | `AppWeaver.Repository.Abstractions` |
+| `ExecuteInTransactionAsync(...)` (extension on `IUnitOfWork`) | `AppWeaver.Repository` | `AppWeaver.Repository.Extensions` |
+| `ContextAwareDbContext<T>`, `EfRepository<T>` | `AppWeaver.Repository.EfCore` | `AppWeaver.Repository.EfCore` |
+| `INamedEntity`, `INamedEntity<TId>` | `AppWeaver.DomainAbstraction` | `AppWeaver.DomainAbstraction.Entities` |
+| `IAuditedObject` | `AppWeaver.Auditing` | `AppWeaver.Auditing.Interfaces` |
+| `Result`, `Result<T>` | `AppWeaver.Results` | `AppWeaver.Results` |
+| `ICommand<T>`, `ICommandHandler<TCommand, TResponse>` | `AppWeaver.Mediator` | `AppWeaver.Mediator.Interfaces` |
+| `IPublisher` | `AppWeaver.EventBus` | `AppWeaver.EventBus` |
+
+The auditing interfaces are the ones most often reported missing: they are in a DIFFERENT
+package from the aggregate types, so a project that references `AppWeaver.DomainAbstraction`
+alone cannot see `IAggregateChild` at all. A rule that requires one requires its package.
+
+## Rules
+
+- **Cite a framework type with its namespace** in plans and generated code, and add the
+  `using` for the namespace in the table above — not a guess from the type's name.
+- **A missing type is a MISSING PACKAGE REFERENCE, not an absent API.** Before concluding
+  a rule cannot be followed, check this table and the project's package references. Say so
+  in the run's summary rather than hand-rolling a substitute — a hand-rolled
+  `IAggregateChild` gives the auditing interceptor nothing to hook.
+- **`AggregateRootBase<TId>` is the base for an aggregate root.** It already combines
+  `EntityBase<TId>`, `IAggregateRoot` and domain-event support
+  (`RegisterDomainEvent` / `DomainEvents` / `ClearDomainEvents`). Assembling those by hand
+  duplicates what the package ships. `TId` is `where TId : struct, IEquatable<TId>`, which
+  the `[ValueObject<Guid>]` partial-struct id satisfies.
+- **`EntityBase<TId>` is the base for a CHILD entity**, which adds `IAggregateChild`.
+
+## Related
+
+- [[domain-driven-design]] · [[coding-standards]] · [[cqrs]] · [[auditing]] · [[persistence]]

package/assets/guardrails/technology/dotnet-webapi/technology-constitution.md

@@ -124,6 +124,9 @@ Governed in full by the technical rule files; this file does not duplicate them.
   `guardrails/technology/dotnet-webapi/coding-standards.md`
 - Package governance (approved/banned packages, supply-chain, licensing):
   `guardrails/technology/dotnet-webapi/dependency-policy.md`
+- Which package and namespace each framework type cited by these rules comes from, and the
+  same-named types that must NOT be mixed:
+  `guardrails/technology/dotnet-webapi/framework-api-map.md`
 - AI operational rules (generation, context loading, refusal conditions):
   `.appweaver/ai-rules.md` — the domain half extends this with domain-specific masking,
   code-set and refusal rules

package/assets/guardrails/technology/dotnet-webapi/testing.md

@@ -38,6 +38,16 @@ Required for **every** Command/Query handler and MUST cover:
 - Integration and contract tests spin up real PostgreSQL (and other backing services)
   via Testcontainers / Aspire — no faked persistence in integration tests.
 
+## Container validation
+
+- One test per service project builds the application's service provider with
+  `ValidateOnBuild` and `ValidateScopes` enabled and asserts it succeeds — the registrations
+  the app runs with, not a subset re-declared in the test.
+- Every handler, endpoint and adapter the app registers MUST resolve from it. A dependency
+  that is injected and never bound compiles green, because a container graph is not
+  compile-checked, and fails on the first request that needs it. This test is what turns
+  that into a red `dotnet test`.
+
 ## Test data hygiene
 
 - Tests use a **shared fixture library** rather than inlining fabricated data.

package/assets/guardrails/technology/nextjs/ui-constitution.md

@@ -83,6 +83,13 @@ Every route, form and interaction state ships with tests: component behaviour, c
 integration against the generated types, and an accessibility assertion per interactive surface.
 Snapshot-only tests do not count as coverage.
 
+**The runner is wired up, not assumed.** The lane's `package.json` defines the `test` script
+its declared command runs (`npm test` unless `.appweaver/stacks.json` says otherwise), pointing
+at the runner the tests are written for. A scaffold ships without one — `create-next-app`
+defines no `test` script — so the first feature that writes a test installs the runner and adds
+the script in the same pass. A lane whose declared test command has nothing to run is not a
+passing lane: `analyze-slice` reports it as untested and fails the gate.
+
 ## Where Each Principle Is Detailed
 
 This file is the thin authority; the enforceable rules live in the corpus beside it. Each
@@ -125,7 +132,7 @@ web/
   lib/api/              # the GENERATED contract client + typed wrappers (never hand-edited)
   lib/                  # cross-feature client utilities
   locales/              # locale catalogues
-  tests/                # component, integration and accessibility tests
+  tests/                # component, integration and accessibility tests — see "Test runner"
 ```
 
 Generated contract clients land in `lib/api/` and are regenerated, never patched. A feature

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aw-spec-cli",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "AppWeaver Spec-Driven Development CLI - scaffolds projects with vertical slices, DDD, CQRS, and agent skills",
   "type": "module",
   "main": "dist/index.js",

package/assets/.appweaver/orchestrator/.state/smoke.state.json

@@ -1,32 +0,0 @@
-{
-  "vars": {},
-  "strategy": "agent",
-  "model": "",
-  "input": "",
-  "answers": {},
-  "selects": {},
-  "agent_profile": "",
-  "isolation": "bare",
-  "os": "posix",
-  "cache": {
-    "script_ro": {
-      "domains": [
-        "dotnet-default-project"
-      ]
-    }
-  },
-  "pending": {
-    "kind": "ask",
-    "key": "pick_mode",
-    "step": "pick_mode",
-    "prompt": "Smoke mode?",
-    "options": [
-      "fast",
-      "slow"
-    ],
-    "multi": false,
-    "instructions": "Ask the USER this question (the options are the allowed choices). Write the answer as PLAIN TEXT to response_path, then re-run the resume command.",
-    "response_path": ".appweaver/orchestrator/.state/smoke.state.json.response.md",
-    "resume": "python3 .appweaver/orchestrator/orchestrator.py .appweaver/orchestrator/workflows/_smoke.orch.yaml --checkpoint .appweaver/orchestrator/.state/smoke.state.json --json"
-  }
-}