boundry 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,54 @@ All notable changes to Boundry are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 versioning follows [semver](https://semver.org/).
 
+## [0.5.0] — 2026-07-21
+
+### Fixed
+
+- **`approve` no longer leaves a stale, corrupted `boundry.diff.likec4`** ([#6]).
+  `approve` used to walk the derived diff file along with the model and splice the
+  marker tokens out of its *view rules* (`style element.tag = #proposed …`,
+  `include … where tag is #proposed`), mangling them into invalid LikeC4 — so
+  `likec4 validate` (and any `arch:verify` gate) went red immediately after a
+  successful approve, recoverable only by a separate `diff` run. `approve` now
+  skips the derived file and deletes it as part of enacting: the moment the last
+  proposal is approved those views are stale — they frame changes that are now
+  approved — so the post-approve workspace is clean and validates.
+
+### Added
+
+- **Per-altitude diff views** ([#7]). `boundry diff` now emits a focused view for
+  *every* layer that draws a changed edge, not only the common-ancestor layer. A
+  cross-system dependency between two deeply-nested leaves is drawable at each
+  endpoint's system and container as well as at the shared root; `diff` emits one
+  `view … of <scope>` for each, so a reviewer can open the change at whatever
+  altitude matters — the whole system, a specific container — instead of being
+  dropped at the noisy root view. The scopes are derived from how LikeC4's
+  `include *` actually renders: the common ancestor plus each endpoint's ancestor
+  chain down to its parent, never *above* the common ancestor (where both
+  endpoints collapse into one child and the edge becomes an undrawn self-loop) and
+  never the leaf endpoints themselves. Boxes are unchanged — one view at the box's
+  parent layer.
+
+### Changed
+
+- **`verify` now compares against the accepted `boundry.lock`, not a git ref.**
+  The lock was introduced in 0.4.0 to decouple *approved* from *committed*, but
+  `verify --base <ref>` kept re-deriving its baseline from a diagram at a git ref
+  — quietly re-coupling "accepted" to "committed", the very thing the lock exists
+  to break. `verify` now reads the lock, exactly as `annotate` does, so the two
+  share one baseline and can never disagree about what "accepted" means. It also
+  catches a committed-but-*unapproved* bare edge, which the git-ref baseline
+  silently absorbed. The `--base` flag is gone from `verify` and `approve`;
+  `approve`'s anti-laundering pre-check now runs the same lock-based gate, and the
+  first `approve` (no lock yet) bootstraps the initial accepted state. **Tradeoff,
+  by design:** the baseline is the working-tree lock, so the gate leans on
+  `approve` being a human act — the lock moves only when someone approves, which
+  is why the skill forbids agents from running it.
+
+[#6]: https://github.com/makspiechota/boundry/issues/6
+[#7]: https://github.com/makspiechota/boundry/issues/7
+
 ## [0.4.0] — 2026-07-17
 
 Makes the "one file can be both the communication diagram and the enforcement

package/README.md

@@ -227,15 +227,21 @@ deterministically, by splicing the LikeC4 CST. No model call, no reformatting:
 source-preserving, idempotent, byte-exact.
 
 ```bash
-boundry verify --arch arch --base origin/main   # any edge granted without a marker?
-boundry approve --arch arch --base origin/main  # HUMAN ONLY: strip markers = approve
+boundry verify  --arch arch   # any edge granted without a marker, vs the lock?
+boundry approve --arch arch   # HUMAN ONLY: strip markers = approve, update the lock
 ```
 
-`verify` compares against the approved diagram at a git ref and rejects edges that
-appeared *without* going through a proposal. Because proposals are excluded from
-the allow-list, the newly-allowed set is exactly the set of self-approvals — no
-diff engine required. `approve --base` runs the same gate first, so it won't
-launder a self-granted edge into an approved one.
+`verify` compares the working diagram against the accepted **`boundry.lock`** and
+rejects edges that appeared *without* going through a proposal. Because proposals
+are excluded from the allow-list, the newly-allowed set is exactly the set of
+self-approvals — no diff engine required. `approve` runs the same gate first, so
+it won't launder a self-granted edge into an approved one; then it enacts the
+proposals and records the new accepted state to the lock.
+
+The baseline is the lock, not a git ref: it's the state Boundry *owns*, so
+"accepted" never collapses into merely "committed". (One consequence, by design:
+the gate leans on `approve` being a human act — the lock moves only when someone
+approves. That's why the skill forbids agents from running it.)
 
 **To retire an edge or a box, propose its removal** with `#proposal-delete`
 instead of deleting it. The marker colours it red; a pending deletion changes
@@ -258,12 +264,12 @@ Point your agents at
 [`.claude/skills/define-architecture-boundaries`](.claude/skills/define-architecture-boundaries/SKILL.md)
 and they'll follow this protocol.
 
-### Catching drift — the lock and `annotate` (prototype)
+### Catching drift — `annotate` (prototype)
 
-`verify --base` trusts git for the baseline, which conflates *approved* with
-*committed*. If you'd rather Boundry own that baseline: `approve` records the
-accepted model to **`boundry.lock`** beside the diagram, and `annotate` compares
-against it — no git ref required.
+`verify` catches a self-grant and fails; `annotate` is the other half — it
+*rewrites* the same drift into a reviewable proposal. Both read the same baseline,
+the accepted **`boundry.lock`** that `approve` records beside the diagram, so they
+can never disagree about what "accepted" means.
 
 ```bash
 boundry approve  --arch arch          # enact proposals AND write boundry.lock
@@ -291,8 +297,8 @@ outright. Requires **LikeC4 ≥ 1.58** to render.
 
 A proposal nested inside a box is invisible at a wider zoom: at the top level the
 box collapses and its inner `#proposed` edge disappears. So `diff` generates a
-**focused view for every layer that holds a pending change** — the tightest scope
-that actually draws it — into a derived `boundry.diff.likec4`:
+**focused view for every layer that draws a pending change** — into a derived
+`boundry.diff.likec4`:
 
 ```bash
 boundry diff --arch arch              # (re)write boundry.diff.likec4
@@ -307,11 +313,20 @@ styling step. Boxes are styled *in place* (never force-included), so a nested
 proposal stays in its own layer; unchanged elements keep their defaults; and the
 rules live only in the generated views, so your own views are untouched.
 
+A changed edge is drawn at **every altitude it appears**, not only the
+common-ancestor layer — so a cross-system dependency between two deeply-nested
+leaves gets a view at each endpoint's system and container as well as at the
+shared root. Open the change at whatever altitude matters (the whole system, a
+specific container) instead of being dropped at the noisy root view. `diff` emits
+only the layers that genuinely draw the edge: never above the common ancestor
+(where it collapses to an undrawn self-loop), never the leaf endpoints themselves.
+
 The file is a **derived artifact**: overwritten every run, removed when nothing is
-proposed, so it always matches the current diagram — regenerate it after
-`approve`. It reads the diagram's own markers (not the lock), so it frames
-whatever `annotate` or a human has marked. Being derived, it's a `.gitignore`
-candidate (`boundry.diff.likec4`).
+proposed, so it always matches the current diagram. `approve` deletes it too, as
+part of enacting — the moment the last proposal is approved the views are stale,
+so the post-approve workspace validates clean. It reads the diagram's own markers
+(not the lock), so it frames whatever `annotate` or a human has marked. Being
+derived, it's a `.gitignore` candidate (`boundry.diff.likec4`).
 
 > Rendering the coloured diff views needs **LikeC4 ≥ 1.58** (the style-rule syntax
 > Boundry emits). Boundry itself depends on that floor; the tool you review with
@@ -322,8 +337,8 @@ candidate (`boundry.diff.likec4`).
 ```
 boundry check    [--arch <dir>] [--cwd <dir>] [sources...]
 boundry generate [--arch <dir>] [--cwd <dir>] [--out <file>]
-boundry verify   [--arch <dir>] [--cwd <dir>] --base <git-ref>
-boundry approve  [--arch <dir>] [--cwd <dir>] [--base <git-ref>]
+boundry verify   [--arch <dir>] [--cwd <dir>]
+boundry approve  [--arch <dir>] [--cwd <dir>]
 boundry annotate [--arch <dir>]
 boundry diff     [--arch <dir>]
 ```
@@ -333,15 +348,16 @@ boundry diff     [--arch <dir>]
 | `--arch <dir>` | LikeC4 workspace directory (all `.likec4` files in it are merged). Default `.`. |
 | `--cwd <dir>` | Repo root to check. `folder` paths are relative to it. Lets you run from anywhere. |
 | `--out <file>` | `generate` only: where to write the dependency-cruiser config. Default `.dependency-cruiser.cjs`. |
-| `--base <ref>` | `verify`/`approve`: the git ref holding the approved diagram to compare against. |
 | `sources...` | `check` only: paths to lint. Default `src`. |
 
 - **`check`** compiles the rules and runs the linter. Exits non-zero on any violation.
 - **`generate`** just emits the dependency-cruiser config so you can commit it or
   run `depcruise` yourself.
-- **`verify`** rejects dependencies granted without a proposal.
-- **`approve`** enacts markers (strips `#proposed`, removes `#proposal-delete`) and
-  writes `boundry.lock`. For humans, not agents.
+- **`verify`** rejects dependencies granted without a proposal, comparing the
+  diagram against the accepted `boundry.lock`. Needs a lock — run `approve` once
+  to record one.
+- **`approve`** runs the same gate, then enacts markers (strips `#proposed`,
+  removes `#proposal-delete`) and writes `boundry.lock`. For humans, not agents.
 - **`annotate`** rewrites undeclared additions as `#proposed`, diffing against
   `boundry.lock`.
 - **`diff`** generates a focused, colour-coded review view per layer that holds a
@@ -366,9 +382,8 @@ jobs:
         with: { node-version: 20 }
       - run: npm ci
       - run: npx boundry check --arch arch src
-      # On PRs, also reject dependencies granted without a proposal.
-      - run: npx boundry verify --arch arch --base origin/${{ github.base_ref }}
-        if: github.event_name == 'pull_request'
+      # Reject any dependency granted without a proposal, vs the committed lock.
+      - run: npx boundry verify --arch arch
 ```
 
 ## Programmatic use (SDK)

package/dist/adapters/visualizer/likec4.d.ts

@@ -18,6 +18,13 @@ export declare class LikeC4Visualizer implements VisualizerPort {
      *   - `#proposal-delete` markers take their whole edge or box with them, so
      *     approving a proposed removal actually removes it.
      * All other formatting is left intact.
+     *
+     * The derived `boundry.diff.likec4` is skipped, not approved: it holds no real
+     * markers, only view rules that *reference* the marker tags (`style element.tag
+     * = #proposed`, `include … where tag is #proposed`). Splicing those `#proposed`
+     * tokens out would corrupt the rules into invalid LikeC4. And it is stale the
+     * moment the last proposal is enacted — it describes changes that are now
+     * approved — so approve deletes it, leaving a workspace `likec4 validate` accepts.
      */
     approve(): Promise<void>;
     /**
@@ -41,10 +48,12 @@ export declare class LikeC4Visualizer implements VisualizerPort {
     /**
      * Generate a focused diff view for every layer that holds a pending change.
      * Walks the diagram's own `#proposed` / `#proposal-delete` markers (never the
-     * lock — a `#proposal-delete` has no lock delta), buckets each change into the
-     * tightest scope that draws it, and writes one `view … of <scope>` per bucket
-     * to a derived `boundry.diff.likec4`. The file is overwritten each run and
-     * removed when nothing is proposed, so it always reflects the current diagram.
+     * lock — a `#proposal-delete` has no lock delta) and writes one `view … of
+     * <scope>` per layer to a derived `boundry.diff.likec4`. A box is bucketed into
+     * its parent layer; an edge into *every* layer that draws it (see `edgeScopes`),
+     * so a cross-system dependency can be reviewed at each altitude, not only the
+     * common-ancestor layer. The file is overwritten each run and removed when
+     * nothing is proposed, so it always reflects the current diagram.
      */
     emitDiffViews(): Promise<DiffView[]>;
 }

package/dist/adapters/visualizer/likec4.js

@@ -28,6 +28,46 @@ function parentScope(fqn) {
     parts.pop();
     return parts.length ? parts.join('.') : undefined;
 }
+/**
+ * Every layer that actually *draws* the edge `from -> to`, so a reviewer can open
+ * the change at whatever altitude matters — the whole system, a specific
+ * container, or the endpoint's immediate parent — not only the auto-picked common
+ * ancestor (issue #7). The set is derived from how LikeC4's `include *` renders a
+ * scoped view, verified against 1.58:
+ *
+ *   - The tightest common ancestor draws it nested (both endpoints inside).
+ *   - Every proper ancestor of an endpoint *below* that common ancestor draws it
+ *     too: that side's subtree is expanded and the far endpoint is pulled in as a
+ *     boundary node (e.g. `of s1` → `s1.c1 -> s2`).
+ *   - Ancestors *above* the common ancestor are deliberately excluded: both
+ *     endpoints collapse into the same child there, so the edge becomes a
+ *     self-loop and LikeC4 draws nothing. The common ancestor is the widest layer
+ *     that still draws it.
+ *
+ * So the scopes are the common ancestor plus each endpoint's ancestor chain from
+ * just below it down to the endpoint's parent — never the endpoints themselves
+ * (a view scoped *to* a leaf endpoint has an empty subtree).
+ */
+function edgeScopes(from, to) {
+    const common = commonScope(from, to);
+    const depthOf = (scope) => (scope ? scope.split('.').length : 0);
+    const commonDepth = depthOf(common);
+    const byId = new Map();
+    const add = (scope) => {
+        byId.set(scopeViewId(scope), scope);
+    };
+    add(common);
+    for (const endpoint of [from, to]) {
+        const parts = endpoint.split('.');
+        // Proper ancestors of the endpoint strictly below the common ancestor: prefix
+        // lengths (commonDepth + 1) .. (parts.length - 1). The last is the endpoint's
+        // parent; the endpoint itself (full length) is never a scope.
+        for (let len = commonDepth + 1; len <= parts.length - 1; len++) {
+            add(parts.slice(0, len).join('.'));
+        }
+    }
+    return [...byId.values()];
+}
 /**
  * Deterministic highlight rules for the marker tags actually in use. Referencing
  * an undeclared tag is a hard LikeC4 error, and a tag can only be *used* if it is
@@ -393,11 +433,20 @@ export class LikeC4Visualizer {
      *   - `#proposal-delete` markers take their whole edge or box with them, so
      *     approving a proposed removal actually removes it.
      * All other formatting is left intact.
+     *
+     * The derived `boundry.diff.likec4` is skipped, not approved: it holds no real
+     * markers, only view rules that *reference* the marker tags (`style element.tag
+     * = #proposed`, `include … where tag is #proposed`). Splicing those `#proposed`
+     * tokens out would corrupt the rules into invalid LikeC4. And it is stale the
+     * moment the last proposal is enacted — it describes changes that are now
+     * approved — so approve deletes it, leaving a workspace `likec4 validate` accepts.
      */
     async approve() {
         const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
         for (const doc of likec4.LangiumDocuments.all) {
             const filePath = doc.uri.fsPath;
+            if (filePath.endsWith(DIFF_FILE))
+                continue;
             const text = doc.textDocument?.getText?.() ?? readFileSync(filePath, 'utf8');
             const ranges = collectApprovalRanges(doc.parseResult?.value, text);
             if (ranges.length === 0)
@@ -408,6 +457,12 @@ export class LikeC4Visualizer {
             }
             writeFileSync(filePath, next);
         }
+        // Enacting the last proposal makes any diff views stale — they frame changes
+        // that are now approved. Remove the derived artifact so the post-approve
+        // workspace validates and never renders an approved-away change.
+        const diffPath = join(this.workspaceDir, DIFF_FILE);
+        if (existsSync(diffPath))
+            rmSync(diffPath);
     }
     /**
      * Deterministically mark the given edges and elements `#proposed`. The inverse
@@ -529,10 +584,12 @@ export class LikeC4Visualizer {
     /**
      * Generate a focused diff view for every layer that holds a pending change.
      * Walks the diagram's own `#proposed` / `#proposal-delete` markers (never the
-     * lock — a `#proposal-delete` has no lock delta), buckets each change into the
-     * tightest scope that draws it, and writes one `view … of <scope>` per bucket
-     * to a derived `boundry.diff.likec4`. The file is overwritten each run and
-     * removed when nothing is proposed, so it always reflects the current diagram.
+     * lock — a `#proposal-delete` has no lock delta) and writes one `view … of
+     * <scope>` per layer to a derived `boundry.diff.likec4`. A box is bucketed into
+     * its parent layer; an edge into *every* layer that draws it (see `edgeScopes`),
+     * so a cross-system dependency can be reviewed at each altitude, not only the
+     * common-ancestor layer. The file is overwritten each run and removed when
+     * nothing is proposed, so it always reflects the current diagram.
      */
     async emitDiffViews() {
         const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
@@ -562,8 +619,11 @@ export class LikeC4Visualizer {
                 if (statement?.$type === 'Relation') {
                     const from = fqnOf(endpointElement(statement.source));
                     const to = fqnOf(endpointElement(statement.target));
+                    // One view per layer that actually draws this edge, so the reviewer can
+                    // judge it at every altitude — not only the common-ancestor layer (#7).
                     if (from && to)
-                        record(commonScope(from, to));
+                        for (const scope of edgeScopes(from, to))
+                            record(scope);
                 }
                 else if (statement?.$type === 'Element') {
                     const fqn = fqnOf(statement);

package/dist/cli/index.js

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
-import { execFileSync } from 'node:child_process';
-import { existsSync, mkdtempSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join, relative, resolve } from 'node:path';
 import { Pipeline } from '../core/pipeline/pipeline.js';
 import { LikeC4Visualizer } from '../adapters/visualizer/likec4.js';
 import { DepCruiserEnforcer } from '../adapters/enforcer/depcruiser.js';
-const USAGE = 'usage: boundry <generate|check|approve|verify|annotate|diff> [--arch <dir>] [--base <git-ref>] [--cwd <dir>] [--out <file>] [sources...]';
+const USAGE = 'usage: boundry <generate|check|approve|verify|annotate|diff> [--arch <dir>] [--cwd <dir>] [--out <file>] [sources...]';
 function optValue(args, flag) {
     const i = args.indexOf(flag);
     return i >= 0 ? args[i + 1] : undefined;
@@ -22,30 +20,6 @@ function positionals(args) {
     }
     return out;
 }
-/**
- * Materialize the architecture as of a git ref into a temp workspace, so the
- * previously-approved boundary model can be lifted and compared against HEAD.
- */
-function materializeArchAt(archDir, ref) {
-    const gitRoot = execFileSync('git', ['rev-parse', '--show-toplevel'], {
-        cwd: archDir,
-        encoding: 'utf8',
-    }).trim();
-    const workDir = mkdtempSync(join(tmpdir(), 'boundry-base-'));
-    for (const file of readdirSync(archDir).filter((f) => f.endsWith('.likec4'))) {
-        try {
-            const content = execFileSync('git', ['show', `${ref}:${relative(gitRoot, join(archDir, file))}`], {
-                cwd: gitRoot,
-                encoding: 'utf8',
-            });
-            writeFileSync(join(workDir, file), content);
-        }
-        catch {
-            // The file did not exist at `ref` — everything it declares is new.
-        }
-    }
-    return workDir;
-}
 function countGrants(granted) {
     return granted.edges.length + granted.exemptions.length;
 }
@@ -69,17 +43,17 @@ async function main() {
     const archDir = resolve(optValue(rest, '--arch') ?? '.');
     const outArg = optValue(rest, '--out');
     const outFile = outArg ? resolve(outArg) : undefined;
-    const baseRef = optValue(rest, '--base');
     // `--cwd` lets you check a repo without cd-ing into it. `folder` metadata is
     // relative to the target repo root, so the enforcer runs from there.
     const cwd = optValue(rest, '--cwd');
     if (cwd)
         process.chdir(resolve(cwd));
     // The accepted-state lock lives beside the diagram it locks. `approve` writes
-    // it; `annotate` reads it — the baseline Boundry owns, not one inferred from git.
+    // it; `verify` and `annotate` read it — the baseline Boundry owns, decoupled
+    // from git, so "accepted" never means merely "committed".
     const lockFile = join(archDir, 'boundry.lock');
+    const readLock = () => existsSync(lockFile) ? readFileSync(lockFile, 'utf8') : undefined;
     const pipeline = new Pipeline(new LikeC4Visualizer(archDir), new DepCruiserEnforcer());
-    const grantedSince = (ref) => pipeline.verify(new LikeC4Visualizer(materializeArchAt(archDir, ref)));
     if (command === 'generate') {
         const config = await pipeline.generate();
         const out = outFile ?? resolve(config.filename);
@@ -105,37 +79,43 @@ async function main() {
         return;
     }
     if (command === 'verify') {
-        if (!baseRef) {
-            console.error('Boundry: verify requires --base <git-ref>');
+        const lock = readLock();
+        if (!lock) {
+            console.error(`Boundry: no ${relative(process.cwd(), lockFile)} — run 'boundry approve' first to record the accepted state`);
             process.exitCode = 2;
             return;
         }
-        const granted = await grantedSince(baseRef);
+        const granted = await pipeline.verify(lock);
         if (countGrants(granted) === 0) {
-            console.log(`Boundry: ✓ nothing granted without a #proposed marker (vs ${baseRef})`);
+            console.log('Boundry: ✓ nothing granted without a #proposed marker (vs the accepted lock)');
             return;
         }
-        console.error(`Boundry: ✗ ${countGrants(granted)} grant(s) made without a #proposed marker (vs ${baseRef})`);
+        console.error(`Boundry: ✗ ${countGrants(granted)} grant(s) made without a #proposed marker (vs the accepted lock)`);
         listGrants(granted);
         process.exitCode = 1;
         return;
     }
     if (command === 'approve') {
         // Approving must never launder an edge that skipped the proposal protocol.
-        if (baseRef) {
-            const granted = await grantedSince(baseRef);
+        // The accepted lock is the baseline: a bare edge added since the last approve
+        // is in the allow-list but not the lock, so it surfaces here; a #proposed one
+        // is excluded from the allow-list, so it passes and gets enacted below. The
+        // first approve has no lock yet — it establishes the initial accepted state.
+        const lock = readLock();
+        if (lock) {
+            const granted = await pipeline.verify(lock);
             if (countGrants(granted) > 0) {
-                console.error(`Boundry: ✗ refusing to approve — ${countGrants(granted)} grant(s) were made without a #proposed marker (vs ${baseRef})`);
+                console.error(`Boundry: ✗ refusing to approve — ${countGrants(granted)} grant(s) were made without a #proposed marker (vs the accepted lock)`);
                 listGrants(granted);
                 process.exitCode = 1;
                 return;
             }
         }
         else {
-            console.error('Boundry: ⚠ no --base given — approving without verifying that every new edge was proposed');
+            console.error('Boundry: ⚠ no boundry.lock yet — approving to record the initial accepted state');
         }
-        const lock = await pipeline.approve();
-        writeFileSync(lockFile, lock);
+        const nextLock = await pipeline.approve();
+        writeFileSync(lockFile, nextLock);
         console.log('Boundry: ✓ approved — enacted the diagram and wrote', relative(process.cwd(), lockFile));
         return;
     }

package/dist/core/pipeline/pipeline.d.ts

@@ -31,12 +31,18 @@ export declare class Pipeline {
     /** Diagram -> boundary model -> run the linter over `sources`. */
     check(sources: string[]): Promise<CheckResult>;
     /**
-     * What this diagram grants that `base` did not — dependencies added without a
-     * `#proposed` marker, and importer exemptions added. Proposals are excluded
-     * from the allow-list, so anything reported here bypassed the approval
-     * protocol.
+     * What this diagram grants that the accepted `lock` did not — dependencies
+     * added without a `#proposed` marker, and importer exemptions added. Proposals
+     * are excluded from the allow-list, so anything reported here bypassed the
+     * approval protocol.
+     *
+     * The baseline is the lock — the accepted state `approve` records — not a git
+     * ref. The lock exists precisely to decouple "accepted" from "committed", so
+     * verify reads from it, exactly as `annotate` does; the two can never disagree
+     * about what "accepted" means. It also catches a committed-but-unapproved bare
+     * edge, which re-deriving a baseline from a git ref would silently absorb.
      */
-    verify(base: VisualizerPort): Promise<VerifyResult>;
+    verify(lock: string): Promise<VerifyResult>;
     /**
      * Enact the diagram's pending proposals (strip `#proposed`, remove
      * `#proposal-delete`), then return the resulting accepted model as a lock

package/dist/core/pipeline/pipeline.js

@@ -21,16 +21,23 @@ export class Pipeline {
         return this.enforcer.check(model, sources);
     }
     /**
-     * What this diagram grants that `base` did not — dependencies added without a
-     * `#proposed` marker, and importer exemptions added. Proposals are excluded
-     * from the allow-list, so anything reported here bypassed the approval
-     * protocol.
+     * What this diagram grants that the accepted `lock` did not — dependencies
+     * added without a `#proposed` marker, and importer exemptions added. Proposals
+     * are excluded from the allow-list, so anything reported here bypassed the
+     * approval protocol.
+     *
+     * The baseline is the lock — the accepted state `approve` records — not a git
+     * ref. The lock exists precisely to decouple "accepted" from "committed", so
+     * verify reads from it, exactly as `annotate` does; the two can never disagree
+     * about what "accepted" means. It also catches a committed-but-unapproved bare
+     * edge, which re-deriving a baseline from a git ref would silently absorb.
      */
-    async verify(base) {
-        const [baseModel, headModel] = await Promise.all([base.read(), this.visualizer.read()]);
+    async verify(lock) {
+        const base = parseModel(lock);
+        const head = await this.visualizer.read();
         return {
-            edges: newlyAllowedEdges(baseModel, headModel),
-            exemptions: newlyExemptedImporters(baseModel, headModel),
+            edges: newlyAllowedEdges(base, head),
+            exemptions: newlyExemptedImporters(base, head),
         };
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "boundry",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Compile a C4 architecture diagram into a deterministic dependency linter. Deterministic architectural guardrails for AI agents and humans.",
   "type": "module",
   "license": "MIT",