guardian-framework 0.1.125 → 0.1.126

package/dist/cli.js

@@ -3202,7 +3202,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.125", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.126", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/dist/exports.js

@@ -1987,7 +1987,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.125", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.126", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "guardian-framework",
-	"version": "0.1.125",
+	"version": "0.1.126",
 	"description": "Token-optimized agentic framework scaffolder with pi-first architecture",
 	"type": "module",
 	"main": "dist/exports.js",

package/templates/pi/preflight_report.json

@@ -1,5 +1,5 @@
 {
-  "timestamp": "2026-09-05T10:50:53Z",
+  "timestamp": "2026-09-06T11:30:37Z",
   "mode": "all",
   "stages_run": [],
   "summary": {

package/templates/pi/scripts/check_model_judgment.sh

@@ -13,10 +13,12 @@ cd "$ROOT" || exit 1
 
 detect_language() {
     if [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
-    elif [ -f "package.json" ]; then echo "typescript"
     elif [ -f "go.mod" ]; then echo "go"
+    # java first when a maven/gradle build (or src/main/java) is present — a root
+    # package.json (tooling) must not shadow a Java backend
+    elif [ -f "pom.xml" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ] || [ -d "src/main/java" ]; then echo "java"
+    elif [ -f "package.json" ]; then echo "typescript"
     elif [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
-    elif [ -f "pom.xml" ] || [ -f "build.gradle" ]; then echo "java"
     else echo "unknown"; fi
 }
 LANG="$(detect_language)"

package/templates/pi/scripts/coverage.sh

@@ -35,10 +35,10 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 
 detect_language() {
     if [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
-    elif [ -f "poetry.lock" ] || [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
     elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "pom.xml" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ] || [ -d "src/main/java" ]; then echo "java"
     elif [ -f "package.json" ]; then echo "typescript"
-    elif [ -f "pom.xml" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then echo "java"
+    elif [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
     else echo "unknown"; fi
 }
 

package/templates/pi/scripts/languages/java/check_model_judgment.sh

@@ -1,41 +1,28 @@
 #!/usr/bin/env bash
 # ============================================================================
-# check_model_judgment_java.sh — ADR-008 Java model-judgment HARD GATES
-#
-# Deterministic, language-scoped checks (contract §5). Fuzzy smells (anemic
-# model, LSP base classes, Helper/Utils, primitive obsession) are NOT gated
-# here — they surface as architecture-validator review questions instead.
-#
-# Rules (stable ids):
+# check_model_judgment.sh — Java (ADR-008/009)
+# Deterministic hard gates:
+#   dip-domain           domain/ imports jakarta/javax.persistence, springframework, hibernate
 #   txn-placement        @Transactional outside the application layer
-#   dip-domain           domain/ imports jakarta/javax.persistence,
-#                        springframework or hibernate
-#   interface-ownership  (tactical modules) repository implementation in
-#                        infrastructure/ without a domain/-owned interface
-#   adapter-purity       (adapter modules) production java under domain/ or
-#                        application/ of a generic subdomain
+#   interface-ownership  (tactical) infra repository impls need a domain/-owned interface
+#   adapter-purity       (adapter modules) model code in generic subdomains
+#   web-layer-leak       interfaces/ (controllers) importing CONCRETE infrastructure
+#                        implementations (Jdbc*/Local*/InMemory*/... or, in tactical
+#                        modules, any .infrastructure. type)
 #
-# Usage:
-#   bash check_model_judgment_java.sh [--root <dir>]     (default: cwd)
-# Output: one 'file:line: [rule-id] message' per violation.
-# Exit:   0 all pass ; 1 violations found.
+# Layout-aware: supports both src/<module>/{domain,...} and Maven
+# src/main/java/<group>/<module>/{domain,...}. Module docs drive depth rules.
+# Usage: bash check_model_judgment.sh [--root <dir>]
 # ============================================================================
 set -uo pipefail
-
 ROOT="$(pwd)"
-if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then
-    ROOT="$2"
-fi
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
 cd "$ROOT" || exit 1
 
 VIOLATIONS=0
+report() { echo "$1:$2: [$3] $4"; VIOLATIONS=$((VIOLATIONS + 1)); }
 
-report() { # file line rule message
-    echo "$1:$2: [$3] $4"
-    VIOLATIONS=$((VIOLATIONS + 1))
-}
-
-is_prod_java() { # path
+is_prod_java() {
     case "$1" in
         */test/*|*/src/test/*) return 1 ;;
         *Test.java|*Tests.java) return 1 ;;
@@ -43,6 +30,28 @@ is_prod_java() { # path
     return 0
 }
 
+# Resolve a module's source root for a module doc (kebab name).
+# 1) legacy: src/<module>/
+# 2) maven:  src/main/java/<group>/<sanitized-module>/ (sanitized = lower, no separators)
+resolve_module_root() { # doc_name
+    local doc_name="$1"
+    local norm legacy
+    norm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+    legacy="src/$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+    if [ -d "$legacy" ]; then echo "$legacy"; return; fi
+    if [ -d "src/main/java" ]; then
+        local sanitized
+        sanitized="$(echo "$doc_name" | tr '[:upper:]' '[:lower:]' | tr -d '_-')"
+        # match <group>/<sanitized> dir anywhere under the java tree (module package root)
+        local cand
+        while IFS= read -r cand; do
+            [ -n "$cand" ] || continue
+            if [ "$(basename "$cand")" = "$sanitized" ]; then echo "$cand"; return; fi
+        done < <(find "src/main/java" -type d -name "$sanitized" 2>/dev/null | head -3 || true)
+    fi
+    echo ""
+}
+
 # ── Rule 2: DIP — domain imports framework types ─────────────────────────────
 while IFS= read -r f; do
     [ -n "$f" ] || continue
@@ -77,28 +86,50 @@ while IFS= read -r f; do
     done < <(grep -nE '@Transactional' "$f" || true)
 done < <(find src -type f -name "*.java" 2>/dev/null || true)
 
-# ── Rules 3 & 4: module docs drive depth-aware checks ─────────────────────────
+# ── Rules 3–5: module-doc depth-driven checks ─────────────────────────────────
 if [ -d ".pi/architecture/modules" ]; then
     for doc in .pi/architecture/modules/*.md; do
         [ -f "$doc" ] || continue
         doc_name="$(basename "$doc" .md)"
+        [ "$doc_name" = "module-template" ] && continue
         depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
-        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
-
-        match_dir=""
-        while IFS= read -r d; do
-            [ -n "$d" ] || continue
-            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
-            if [ "$norm" = "$docnorm" ]; then
-                match_dir="$d"
-                break
-            fi
-        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
-
+        match_dir="$(resolve_module_root "$doc_name")"
         [ -n "$match_dir" ] || continue
 
+        # interfaces layer (http/web) — concrete infrastructure implementations leak
+        while IFS= read -r f; do
+            [ -n "$f" ] || continue
+            is_prod_java "$f" || continue
+            case "$f" in
+                */interfaces/*)
+                    while IFS=: read -r ln rest; do
+                        case "$rest" in
+                            *infrastructure.*)
+                                cls="$(echo "$rest" | sed 's/^[[:space:]]*import[[:space:]]*//; s/;//' | awk -F. '{print $NF}')"
+                                # concrete impl markers (Jdbc*/Jpa*/Local*/InMemory*/Hibernate*/...);
+                                # in tactical modules ANY .infrastructure. import from web layer is a leak
+                                case "$cls" in
+                                    Jdbc*|Jpa*|Local*|InMemory*|Hibernate*|Sql*|FileStore*|OutboxStore*)
+                                        report "$f" "$ln" "web-layer-leak" "web layer imports CONCRETE infrastructure impl $cls — depend on a port/interface via the application layer"
+                                        ;;
+                                esac
+                                if [ "$depth" = "tactical" ]; then
+                                    case "$cls" in
+                                        *Repository*|*Port*|*Gateway*|*Service*|*Config*|*Store*)
+                                            : ;;
+                                        *)
+                                            report "$f" "$ln" "web-layer-leak" "tactical module: web layer imports infrastructure type $cls — go through the application layer"
+                                            ;;
+                                    esac
+                                fi
+                                ;;
+                        esac
+                    done < <(grep -nE '^[[:space:]]*import[[:space:]]+' "$f" || true)
+                    ;;
+            esac
+        done < <(find "$match_dir/interfaces" -type f -name "*.java" 2>/dev/null || true)
+
         if [ "$depth" = "adapter" ]; then
-            # adapter-purity: no production java under domain/ or application/
             for layer in domain application; do
                 while IFS= read -r f; do
                     [ -n "$f" ] || continue
@@ -107,36 +138,37 @@ if [ -d ".pi/architecture/modules" ]; then
                 done < <(find "$match_dir/$layer" -type f -name "*.java" 2>/dev/null || true)
             done
         elif [ "$depth" = "tactical" ]; then
-            # interface-ownership: infra repository implementations need a
-            # domain/-owned interface of the same simple name.
+            # interface-ownership: infra repository impls need a domain/-owned
+            # interface. Build candidate names by stripping Impl suffix and
+            # Jpa/Jdbc/Hibernate/Spring prefixes, then search the domain layer.
             while IFS= read -r impl; do
                 [ -n "$impl" ] || continue
-                simple="$(basename "$impl")"
-                # Candidate interface names: as-is, Impl-suffix stripped, and
-                # common impl prefixes (Jpa/Jdbc/Hibernate/Spring) stripped.
-                candidates="$simple
-$(echo "$simple" | sed -E 's/Impl\.java$/.java/')
-$(echo "$simple" | sed -E 's/^(Jpa|Jdbc|Hibernate|Spring)([A-Z].*\.java)$/\2/')"
-                domain_iface=""
-                while IFS= read -r cand; do
-                    [ -n "$cand" ] || continue
-                    if [ -f "$match_dir/domain/$cand" ]; then
-                        domain_iface="$match_dir/domain/$cand"
-                        break
+                stem="$(basename "$impl" .java)"
+                names="$stem"
+                for n in "${stem%Impl}" "${stem#Jpa}" "${stem#Jdbc}" "${stem#Hibernate}" "${stem#Spring}"; do
+                    [ -n "$n" ] || continue
+                    case " $names " in *" $n "*) ;; *) names="$names $n" ;; esac
+                done
+                found=""
+                for n in $names; do
+                    if grep -rqiE "interface ${n}\\b|class ${n}\\b" "$match_dir/domain" --include="*.java" 2>/dev/null; then
+                        found=1; break
+                    fi
+                done
+                if [ -z "$found" ]; then
+                    compact="$(echo "$stem" | tr -d '_-')"
+                    if [ -z "$compact" ] || ! grep -rqil --include="*.java" "$compact" "$match_dir/domain" 2>/dev/null; then
+                        report "$impl" "1" "interface-ownership" "repository implementation without a domain/-owned interface (${stem})"
                     fi
-                done <<< "$candidates"
-                if [ ! -f "$domain_iface" ]; then
-                    report "$impl" "1" "interface-ownership" "repository implementation without a domain/-owned interface (interface-ownership)"
                 fi
-            done < <(find "$match_dir/infrastructure" -type f -name "*Repository*.java" 2>/dev/null || true)
+            done < <(find "$match_dir/infrastructure" -type f \( -iname "*Repository*.java" \) 2>/dev/null || true)
         fi
     done
 fi
 
 if [ "$VIOLATIONS" -gt 0 ]; then
-    echo "model-judgment: ${VIOLATIONS} violation(s) found" >&2
+    echo "model-judgment (java): ${VIOLATIONS} violation(s)" >&2
     exit 1
 fi
-
-echo "model-judgment (java): all gates passed (txn-placement, dip-domain, interface-ownership, adapter-purity)"
+echo "model-judgment (java): all gates passed (dip-domain, txn-placement, interface-ownership, adapter-purity, web-layer-leak)"
 exit 0

package/templates/pi/scripts/validate-runtime-wiring.sh

@@ -19,11 +19,11 @@ if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
 cd "$ROOT" || exit 1
 
 detect_language() {
-    if [ -f "Cargo.toml" ]; then echo "rust"
-    elif [ -f "package.json" ]; then echo "typescript"
+    if [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
     elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "pom.xml" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ] || [ -d "src/main/java" ]; then echo "java"
+    elif [ -f "package.json" ]; then echo "typescript"
     elif [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
-    elif [ -f "pom.xml" ] || [ -f "build.gradle" ]; then echo "java"
     else echo "unknown"; fi
 }
 LANG="$(detect_language)"