guardian-framework 0.1.0

package/templates/pi/scripts/languages/java/validate-security.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-security.sh — Java (Spring Boot Security)
+# ============================================================================
+set -euo pipefail
+
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Security Validation (Java)"
+echo "============================================"
+echo ""
+
+SRC_DIR="${1:-src/main/java}"
+
+# ---------------------------------------------------------------------------
+# @PreAuthorize Coverage
+# ---------------------------------------------------------------------------
+echo "--- @PreAuthorize Coverage ---"
+if [ -d "$SRC_DIR" ]; then
+    CONTROLLER_FILES=$(find "$SRC_DIR" -name "*Controller.java" 2>/dev/null)
+    if [ -n "$CONTROLLER_FILES" ]; then
+        TOTAL_CONTROLLERS=$(echo "$CONTROLLER_FILES" | wc -l | tr -d ' ')
+        PROTECTED_COUNT=0
+        for f in $CONTROLLER_FILES; do
+            if grep -q "@PreAuthorize\|@Secured\|@RolesAllowed" "$f" 2>/dev/null; then
+                PROTECTED_COUNT=$((PROTECTED_COUNT + 1))
+            fi
+        done
+        if [ "$PROTECTED_COUNT" -eq "$TOTAL_CONTROLLERS" ]; then
+            pass "All $TOTAL_CONTROLLERS controllers have method-level security"
+        elif [ "$PROTECTED_COUNT" -gt 0 ]; then
+            warn "$PROTECTED_COUNT of $TOTAL_CONTROLLERS controllers have method-level security ($((TOTAL_CONTROLLERS - PROTECTED_COUNT)) unprotected)"
+        else
+            warn "No controllers have @PreAuthorize/@Secured annotations"
+        fi
+    else
+        pass "No controllers found, skipping @PreAuthorize check"
+    fi
+else
+    warn "No source directory found"
+fi
+
+# ---------------------------------------------------------------------------
+# CSRF Configuration
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- CSRF Configuration ---"
+SECURITY_CONFIG=$(find . -name "*SecurityConfig*" -o -name "*WebSecurityConfig*" -o -name "*SecurityConfiguration*" 2>/dev/null | head -5)
+if [ -n "$SECURITY_CONFIG" ]; then
+    CSRF_DISABLED=0
+    for f in $SECURITY_CONFIG; do
+        if grep -qi "csrf.*disable\|\.csrf()" "$f" 2>/dev/null; then
+            CSRF_DISABLED=$((CSRF_DISABLED + 1))
+        fi
+    done
+    if [ "$CSRF_DISABLED" -gt 0 ]; then
+        warn "CSRF protection disabled in $CSRF_DISABLED config(s) — verify this is intentional (common for REST APIs)"
+    else
+        pass "CSRF protection not explicitly disabled (default enabled)"
+    fi
+else
+    warn "No security configuration class found"
+fi
+
+# ---------------------------------------------------------------------------
+# CORS Configuration
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- CORS Configuration ---"
+if [ -n "$SECURITY_CONFIG" ]; then
+    CORS_CONFIGURED=0
+    for f in $SECURITY_CONFIG; do
+        if grep -qi "cors\|\.cors()" "$f" 2>/dev/null; then
+            CORS_CONFIGURED=$((CORS_CONFIGURED + 1))
+        fi
+    done
+    if [ "$CORS_CONFIGURED" -gt 0 ]; then
+        pass "CORS is explicitly configured in security config"
+    else
+        warn "CORS not explicitly configured (may use defaults)"
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Dependency Vulnerabilities (Maven/Gradle)
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Dependency Vulnerabilities ---"
+if [ -f "pom.xml" ]; then
+    if command -v mvn &>/dev/null; then
+        pass "Maven project — run 'mvn dependency-check:check' for full audit"
+    elif [ -f "mvnw" ]; then
+        pass "Maven Wrapper project — run './mvnw dependency-check:check' for full audit"
+    else
+        warn "Maven project but neither mvn nor mvnw found"
+    fi
+elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+    if command -v gradle &>/dev/null; then
+        pass "Gradle project — run 'gradle dependencyCheck' for full audit"
+    elif [ -f "gradlew" ]; then
+        pass "Gradle Wrapper project — run './gradlew dependencyCheck' for full audit"
+    else
+        warn "Gradle project but neither gradle nor gradlew found"
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Sensitive Configuration
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Sensitive Configuration ---"
+SECRETS_FOUND=0
+for pattern in "password" "secret" "api.key" "token" "jwt.secret"; do
+    MATCHES=$(grep -rn "$pattern" application.yml application.yaml application.properties 2>/dev/null | grep -v "example\|placeholder\|#" || true)
+    if [ -n "$MATCHES" ]; then
+        SECRETS_FOUND=$((SECRETS_FOUND + 1))
+    fi
+done
+if [ "$SECRETS_FOUND" -gt 0 ]; then
+    warn "Sensitive configuration keys found (password/secret/token) — verify they use external secrets"
+else
+    pass "No hardcoded secrets detected in configuration files"
+fi
+
+# ---------------------------------------------------------------------------
+# @Query Injection
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- @Query Safety ---"
+if [ -d "$SRC_DIR" ]; then
+    UNSAFE_QUERIES=0
+    for f in $(find "$SRC_DIR" -name "*.java" 2>/dev/null); do
+        if grep -qE "@Query\s*\(\s*\"SELECT" "$f" 2>/dev/null; then
+            if grep -qE "#\{\s*.*param\}|:\s*.*Param|@Param" "$f" 2>/dev/null; then
+                : # uses parameterized queries
+            else
+                warn "Potential unsafe query in $f (consider using @Param for parameterized queries)"
+                UNSAFE_QUERIES=$((UNSAFE_QUERIES + 1))
+            fi
+        fi
+    done
+    if [ "$UNSAFE_QUERIES" -eq 0 ]; then
+        pass "No obviously unsafe @Query patterns found"
+    fi
+else
+    pass "No source directory found, skipping @Query check"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}Security validation passed.${NC}"
+exit 0

package/templates/pi/scripts/languages/java/validate-spring-architecture.sh

@@ -0,0 +1,227 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-spring-architecture.sh — Spring Boot Package Ring Enforcement
+# ============================================================================
+#
+# Package Ring Definitions (shared with validate-annotations.sh):
+#   domain/        → Zero external dependencies (no imports outside domain)
+#   application/   → Only depends on domain/
+#   infrastructure/ → Depends on application/ and domain/ only
+#   interfaces/    → Web layer, depends on application/ only
+#
+# Convention: com.{project}.{layer}.{component}
+#   Example: com.myapp.domain.model, com.myapp.application.usecase
+#
+# Architecture mode: reads archMode from guardian-manifest.json
+#   strict     — domain/ must have zero external deps (default)
+#   simplified — domain/ may contain concrete providers (downgraded to warnings)
+# ============================================================================
+set -euo pipefail
+
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Spring Architecture Ring Validation"
+echo "============================================"
+echo ""
+
+ARCH_MODE="strict"
+if [ -f "guardian-manifest.json" ]; then
+	ARCH_MODE=$(jq -r '.archMode // "strict"' guardian-manifest.json 2>/dev/null || echo "strict")
+fi
+
+echo "Architecture mode: ${ARCH_MODE}"
+echo ""
+
+SRC_DIR="${1:-src/main/java}"
+
+if [ ! -d "$SRC_DIR" ]; then
+    warn "No source directory found at $SRC_DIR"
+    echo ""
+    echo "============================================"
+    echo "  Summary"
+    echo "============================================"
+    echo -e "  Passed:   ${GREEN}0${NC}"
+    echo -e "  Failed:   ${RED}0${NC}"
+    echo ""
+    exit 0
+fi
+
+# ============================================================================
+# Step 1: Detect package rings
+# ============================================================================
+echo "--- Layer Discovery ---"
+DOMAIN_DIR=$(find "$SRC_DIR" -type d -name "domain" 2>/dev/null | head -1)
+APP_DIR=$(find "$SRC_DIR" -type d -name "application" 2>/dev/null | head -1)
+INFRA_DIR=$(find "$SRC_DIR" -type d -name "infrastructure" 2>/dev/null | head -1)
+WEB_DIR=$(find "$SRC_DIR" -type d \( -name "web" -o -name "interfaces" -o -name "controller" \) 2>/dev/null | head -1)
+
+LAYER_COUNT=0
+[ -n "$DOMAIN_DIR" ] && LAYER_COUNT=$((LAYER_COUNT + 1)) && echo "  [✓] domain/"
+[ -n "$APP_DIR" ] && LAYER_COUNT=$((LAYER_COUNT + 1)) && echo "  [✓] application/"
+[ -n "$INFRA_DIR" ] && LAYER_COUNT=$((LAYER_COUNT + 1)) && echo "  [✓] infrastructure/"
+[ -n "$WEB_DIR" ] && LAYER_COUNT=$((LAYER_COUNT + 1)) && echo "  [✓] interfaces/web/"
+
+if [ "$LAYER_COUNT" -ge 3 ]; then
+    pass "Clean Architecture layers detected ($LAYER_COUNT of 4)"
+elif [ "$LAYER_COUNT" -ge 1 ]; then
+    pass "Partial layers detected ($LAYER_COUNT of 4)"
+else
+    warn "No Clean Architecture layers detected"
+fi
+
+# ============================================================================
+# Step 2: Domain ring — must have zero external imports
+# ============================================================================
+echo ""
+echo "--- Domain Ring: No External Dependencies ---"
+if [ -n "$DOMAIN_DIR" ]; then
+    BAD_IMPORTS=0
+    for f in $(find "$DOMAIN_DIR" -name "*.java" 2>/dev/null); do
+        # Check for imports from outside domain
+        while IFS= read -r line; do
+            if echo "$line" | grep -qE "^(import\s+)([a-zA-Z0-9_.]+);$" 2>/dev/null; then
+                # Extract the package root (first 2-3 segments)
+                IMPORT_PKG=$(echo "$line" | sed 's/import \(.*\);/\1/' | cut -d'.' -f1-3 2>/dev/null)
+                FILE_PKG=$(grep "^package " "$f" 2>/dev/null | sed 's/package \(.*\);/\1/' | cut -d'.' -f1-3 2>/dev/null)
+                if [ -n "$IMPORT_PKG" ] && [ -n "$FILE_PKG" ] && [ "$IMPORT_PKG" != "$FILE_PKG" ]; then
+                    # Check if import is from a different layer
+                    IMPORT_LAYER=$(echo "$IMPORT_PKG" | rev | cut -d'.' -f1 | rev)
+                    if [ "$IMPORT_LAYER" != "domain" ] && [ "$IMPORT_LAYER" != "model" ] && [ "$IMPORT_LAYER" != "validation" ]; then
+                        # Skip Java/Spring standard library imports
+                        if echo "$IMPORT_PKG" | grep -qE "^(java\.|javax\.|org\.springframework\.|org\.slf4j\.|com\.fasterxml\.)"; then
+                            continue
+                        fi
+                        if [ "$ARCH_MODE" = "strict" ]; then
+                            fail "Domain layer import from '$IMPORT_LAYER': ${f#./}"
+                        else
+                            warn "Domain layer import from '$IMPORT_LAYER': ${f#./} (allowed in simplified mode)"
+                        fi
+                        BAD_IMPORTS=$((BAD_IMPORTS + 1))
+                    fi
+                fi
+            fi
+        done < "$f"
+    done
+    if [ "$BAD_IMPORTS" -eq 0 ]; then
+        pass "Domain ring has no external dependencies (clean)"
+    fi
+else
+    pass "No domain ring detected, skipping"
+fi
+
+# ============================================================================
+# Step 3: Application ring — only depends on domain
+# ============================================================================
+echo ""
+echo "--- Application Ring: Only Depends on Domain ---"
+if [ -n "$APP_DIR" ]; then
+    BAD_IMPORTS=0
+    for f in $(find "$APP_DIR" -name "*.java" 2>/dev/null); do
+        while IFS= read -r line; do
+            if echo "$line" | grep -qE "import\s+.*\.(infrastructure|web|interfaces|controller|repository)\." 2>/dev/null; then
+                # Skip Java/Spring standard imports
+                if echo "$line" | grep -qE "import\s+(java\.|javax\.|org\.springframework\.|org\.slf4j\.)"; then
+                    continue
+                fi
+                fail "Application layer imports from non-domain layer: ${f#./}"
+                echo "     $line"
+                BAD_IMPORTS=$((BAD_IMPORTS + 1))
+            fi
+        done < "$f"
+    done
+    if [ "$BAD_IMPORTS" -eq 0 ]; then
+        pass "Application ring only depends on domain (clean)"
+    fi
+else
+    pass "No application ring detected, skipping"
+fi
+
+# ============================================================================
+# Step 4: Infrastructure ring — depends on domain + application only
+# ============================================================================
+echo ""
+echo "--- Infrastructure Ring: Only Depends on Domain + Application ---"
+if [ -n "$INFRA_DIR" ]; then
+    BAD_IMPORTS=0
+    for f in $(find "$INFRA_DIR" -name "*.java" 2>/dev/null); do
+        while IFS= read -r line; do
+            if echo "$line" | grep -qE "import\s+.*\.(web|interfaces|controller)\." 2>/dev/null; then
+                if echo "$line" | grep -qE "import\s+(java\.|javax\.|org\.springframework\.|org\.slf4j\.)"; then
+                    continue
+                fi
+                fail "Infrastructure imports from web layer: ${f#./}"
+                echo "     $line"
+                BAD_IMPORTS=$((BAD_IMPORTS + 1))
+            fi
+        done < "$f"
+    done
+    if [ "$BAD_IMPORTS" -eq 0 ]; then
+        pass "Infrastructure ring has no web layer imports (clean)"
+    fi
+else
+    pass "No infrastructure ring detected, skipping"
+fi
+
+# ============================================================================
+# Step 5: Web/Interfaces ring — only depends on application
+# ============================================================================
+echo ""
+echo "--- Web Ring: Only Depends on Application ---"
+if [ -n "$WEB_DIR" ]; then
+    BAD_IMPORTS=0
+    for f in $(find "$WEB_DIR" -name "*.java" 2>/dev/null); do
+        while IFS= read -r line; do
+            if echo "$line" | grep -qE "import\s+.*\.(infrastructure|repository)\." 2>/dev/null; then
+                if echo "$line" | grep -qE "import\s+(java\.|javax\.|org\.springframework\.|org\.slf4j\.)"; then
+                    continue
+                fi
+                fail "Web layer imports from infrastructure/repository: ${f#./}"
+                echo "     $line"
+                BAD_IMPORTS=$((BAD_IMPORTS + 1))
+            fi
+        done < "$f"
+    done
+    if [ "$BAD_IMPORTS" -eq 0 ]; then
+        pass "Web ring has no infrastructure/repository imports (clean)"
+    fi
+else
+    pass "No web ring detected, skipping"
+fi
+
+# ============================================================================
+# Step 6: Dependency direction summary
+# ============================================================================
+echo ""
+echo "--- Dependency Direction Summary ---"
+echo ""
+echo "  Domain/  → nothing outside domain"
+echo "  Application/ → domain/ only"
+echo "  Infrastructure/ → domain/ + application/"
+echo "  Web/ → application/ only"
+echo ""
+
+# ============================================================================
+# Summary
+# ============================================================================
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}Spring architecture validation passed.${NC}"
+exit 0

package/templates/pi/scripts/languages/java/validate-tests.sh

@@ -0,0 +1,159 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-tests.sh — Java (Maven/Gradle)
+# ============================================================================
+set -euo pipefail
+
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Test Validation (Java)"
+echo "============================================"
+echo ""
+
+# Detect build tool
+BUILD_TOOL=""
+if [ -f "pom.xml" ]; then
+    BUILD_TOOL="maven"
+elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+    BUILD_TOOL="gradle"
+fi
+
+# ---------------------------------------------------------------------------
+# Unit Tests
+# ---------------------------------------------------------------------------
+echo "--- Unit Tests ---"
+if [ -d "src/test" ] || [ -d "src/test/java" ]; then
+    if [ -z "$BUILD_TOOL" ]; then
+        warn "No build tool detected, skipping unit tests"
+    elif [ "$BUILD_TOOL" = "maven" ] && command -v mvn &>/dev/null; then
+        if mvn test -q -Dtest="*Test" 2>/dev/null; then
+            pass "Unit tests passed (mvn test)"
+        else
+            fail "Unit tests failed (mvn test)"
+        fi
+    elif [ "$BUILD_TOOL" = "gradle" ] && command -v gradle &>/dev/null; then
+        if gradle test --tests "*Test" -q 2>/dev/null; then
+            pass "Unit tests passed (gradle test)"
+        else
+            fail "Unit tests failed (gradle test)"
+        fi
+    elif [ "$BUILD_TOOL" = "maven" ] && [ -f "mvnw" ]; then
+        if ./mvnw test -q -Dtest="*Test" 2>/dev/null; then
+            pass "Unit tests passed (./mvnw test)"
+        else
+            fail "Unit tests failed (./mvnw test)"
+        fi
+    elif [ "$BUILD_TOOL" = "gradle" ] && [ -f "gradlew" ]; then
+        if ./gradlew test --tests "*Test" -q 2>/dev/null; then
+            pass "Unit tests passed (./gradlew test)"
+        else
+            fail "Unit tests failed (./gradlew test)"
+        fi
+    else
+        warn "No build tool executable available for unit tests"
+    fi
+else
+    pass "No test directory (src/test) found, skipping tests"
+fi
+
+# ---------------------------------------------------------------------------
+# Integration Tests
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Integration Tests ---"
+if [ -d "src/test" ]; then
+    if [ -z "$BUILD_TOOL" ]; then
+        pass "No build tool detected, skipping integration tests"
+    elif [ "$BUILD_TOOL" = "maven" ] && command -v mvn &>/dev/null; then
+        if mvn test -q -Dtest="*IT" 2>/dev/null; then
+            pass "Integration tests passed (mvn test -Dtest=*IT)"
+        else
+            fail "Integration tests failed"
+        fi
+    elif [ "$BUILD_TOOL" = "gradle" ] && command -v gradle &>/dev/null; then
+        if gradle test --tests "*IT" -q 2>/dev/null; then
+            pass "Integration tests passed (gradle test --tests *IT)"
+        else
+            fail "Integration tests failed"
+        fi
+    elif [ "$BUILD_TOOL" = "maven" ] && [ -f "mvnw" ]; then
+        if ./mvnw test -q -Dtest="*IT" 2>/dev/null; then
+            pass "Integration tests passed (./mvnw test)"
+        else
+            fail "Integration tests failed"
+        fi
+    elif [ "$BUILD_TOOL" = "gradle" ] && [ -f "gradlew" ]; then
+        if ./gradlew test --tests "*IT" -q 2>/dev/null; then
+            pass "Integration tests passed (./gradlew test)"
+        else
+            fail "Integration tests failed"
+        fi
+    else
+        warn "No build tool executable available for integration tests"
+    fi
+else
+    pass "No src/test directory, skipping integration tests"
+fi
+
+# ---------------------------------------------------------------------------
+# Coverage
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Coverage ---"
+if [ -n "$BUILD_TOOL" ]; then
+    if [ -f "pom.xml" ] && grep -q "jacoco" pom.xml 2>/dev/null; then
+        if command -v mvn &>/dev/null; then
+            COVERAGE_OUTPUT=$(mvn jacoco:report -q 2>&1 || true)
+            if [ -f "target/site/jacoco/index.html" ]; then
+                COVERAGE_PCT=$(grep -oP 'Total.*?([0-9]+)%' target/site/jacoco/index.html 2>/dev/null | grep -oP '[0-9]+' | head -1 || echo "")
+                if [ -n "$COVERAGE_PCT" ] && [ "$COVERAGE_PCT" -ge 80 ]; then
+                    pass "Coverage: ${COVERAGE_PCT}% (≥ 80%)"
+                elif [ -n "$COVERAGE_PCT" ]; then
+                    fail "Coverage: ${COVERAGE_PCT}% (< 80%)"
+                else
+                    warn "Coverage report generated but percentage not detected"
+                fi
+            else
+                warn "JaCoCo report not found at target/site/jacoco/"
+            fi
+        fi
+    elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+        if grep -q "jacoco" build.gradle build.gradle.kts 2>/dev/null; then
+            if command -v gradle &>/dev/null; then
+                COVERAGE_OUTPUT=$(gradle jacocoTestReport -q 2>&1 || true)
+                pass "Coverage report generated (check build/reports/jacoco/)"
+            fi
+        fi
+    else
+        warn "JaCoCo not configured in build file, skipping coverage"
+    fi
+else
+    warn "No build tool detected, skipping coverage"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}Test validation passed.${NC}"
+exit 0

package/templates/pi/scripts/languages/python/validate-architecture.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# validate-architecture.sh — Python
+set -euo pipefail
+
+# Activate Poetry venv if available
+if [ -f "poetry.lock" ] && command -v poetry &>/dev/null; then
+    POETRY_ENV=$(poetry env info --path 2>/dev/null || true)
+    if [ -n "$POETRY_ENV" ] && [ -f "$POETRY_ENV/bin/activate" ]; then
+        source "$POETRY_ENV/bin/activate"
+    fi
+fi
+
+SRC_DIR="${1:-src}"
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Architecture Validation (Python)"
+echo "============================================"
+
+# Layer structure
+echo "--- Layer Structure ---"
+if [ -d "$SRC_DIR" ]; then
+    HAS_DOMAIN=$(find "$SRC_DIR" -type d -name "domain" 2>/dev/null | head -1)
+    HAS_INFRA=$(find "$SRC_DIR" -type d -name "infrastructure" 2>/dev/null | head -1)
+    if [ -n "$HAS_DOMAIN" ] && [ -n "$HAS_INFRA" ]; then
+        pass "Domain and infrastructure layers present"
+    elif [ -n "$HAS_DOMAIN" ]; then
+        pass "Domain layer present (infrastructure added incrementally)"
+    else
+        pass "Source tree initialized"
+    fi
+else
+    fail "Missing source directory: $SRC_DIR"
+fi
+
+# Canonical references
+echo ""
+echo "--- Canonical References ---"
+if [ -d ".pi/architecture/modules" ]; then
+    MODULE_COUNT=$(find .pi/architecture/modules -name "*.md" 2>/dev/null | wc -l | tr -d ' ')
+    pass "Canonical architecture documents found ($MODULE_COUNT modules)"
+else
+    warn "No canonical architecture directory found"
+fi
+
+# Domain models
+echo ""
+echo "--- Domain Models ---"
+DOMAIN_FILES=$(find "$SRC_DIR" -path "*/domain/*.py" 2>/dev/null | wc -l | tr -d ' ')
+if [ "$DOMAIN_FILES" -gt 0 ]; then
+    pass "Domain model files found ($DOMAIN_FILES files)"
+else
+    warn "No domain model files found yet"
+fi
+
+# Dependency direction
+echo ""
+echo "--- Dependency Direction ---"
+DOMAIN_INFRA_IMPORTS=$(find "$SRC_DIR" -path "*/domain/*.py" -exec grep -l "from.*infrastructure" {} + 2>/dev/null | wc -l | tr -d ' ')
+if [ "$DOMAIN_INFRA_IMPORTS" -eq 0 ]; then
+    pass "Domain layer has no infrastructure dependencies (clean architecture)"
+else
+    warn "Domain imports from infrastructure ($DOMAIN_INFRA_IMPORTS references)"
+fi
+
+# Error handling
+echo ""
+echo "--- Error Handling ---"
+ERROR_COUNT=$(grep -r "class.*Error" "$SRC_DIR" 2>/dev/null | wc -l | tr -d ' ')
+if [ "$ERROR_COUNT" -gt 0 ]; then
+    pass "Custom exception classes defined ($ERROR_COUNT found)"
+else
+    warn "Consider defining custom exception classes"
+fi
+
+# Typed models
+echo ""
+echo "--- Typed Models ---"
+MODEL_COUNT=$(grep -r "@dataclass" "$SRC_DIR" 2>/dev/null | wc -l | tr -d ' ')
+if [ "$MODEL_COUNT" -gt 0 ]; then
+    pass "Typed dataclass models found ($MODEL_COUNT definitions)"
+else
+    warn "No dataclass models found"
+fi
+
+# Summary
+echo ""
+echo "============================================"
+echo "  Passed: ${GREEN}${PASS_COUNT}${NC}  Failed: ${RED}${#ERRORS[@]}${NC}"
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    for err in "${ERRORS[@]}"; do echo "  - $err"; done
+    exit 1
+fi
+echo -e "${GREEN}Architecture validation passed.${NC}"
+exit 0