guardian-framework 0.1.145 → 0.1.146

package/dist/cli.js

@@ -3206,7 +3206,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.145", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.146", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/dist/exports.js

@@ -1991,7 +1991,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.145", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.146", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "guardian-framework",
-	"version": "0.1.145",
+	"version": "0.1.146",
 	"description": "Token-optimized agentic framework scaffolder with pi-first architecture",
 	"type": "module",
 	"main": "dist/exports.js",

package/templates/pi/extensions/architect-lib/generators.ts

@@ -692,8 +692,15 @@ run_stage "11" "${moduleId}_proofing" \\
  */
 export function moduleHasRuntimeIntegration(cwd: string, moduleId: string): boolean {
 	const doc = readModuleDoc(cwd, moduleId);
-	if (!doc) return false;
-	return /^#{2,3}\s+(Integration|Runtime|Dispatch|Wiring|.*Dispatch.*)/im.test(doc);
+	// Unconditional: every module that ships code must be installed in the
+	// application shell. Previously this was gated on the module doc having an
+	// Integration/Runtime heading, so a doc without that heading silently
+	// skipped wiring — the "implemented but never wired" gap (ADR-009).
+	// Only an explicit opt-out in the doc removes the deliverable.
+	if (doc && /^.{0,80}(not wired by design|bootstrap only|no runtime integration|not part of the runtime)/im.test(doc)) {
+		return false;
+	}
+	return true;
 }
 
 export function generateRuntimeIntegrationMarkdown(

package/templates/pi/extensions/architect.ts

@@ -635,7 +635,7 @@ export default function architectExtension(pi: ExtensionAPI) {
 								items: existingIssues,
 								steps: [
 									{ name: "implement", prompt: ".pi/prompts/issue-implementation-series.md", acceptance: { type: "validator", validators: ["ci"] } },
-									{ name: "validate", acceptance: { type: "validator", validators: ["ci", "tests", "security"] } },
+									{ name: "validate", acceptance: { type: "validator", validators: ["ci", "tests", "security", "wiring"] } },
 									{ name: "create-mr", prompt: ".pi/prompts/epic-closeout.md", acceptance: { type: "none" } },
 									{ name: "merge", prompt: ".pi/prompts/epic-closeout.md", acceptance: { type: "validator", validators: ["ci", "canonical"] } },
 								],
@@ -697,7 +697,7 @@ export default function architectExtension(pi: ExtensionAPI) {
 							items,
 							steps: [
 								{ name: "implement", prompt: ".pi/prompts/issue-implementation-series.md", acceptance: { type: "validator", validators: ["ci"] } },
-								{ name: "validate", acceptance: { type: "validator", validators: ["ci", "tests", "security"] } },
+								{ name: "validate", acceptance: { type: "validator", validators: ["ci", "tests", "security", "wiring"] } },
 								{ name: "create-mr", prompt: ".pi/prompts/epic-closeout.md", acceptance: { type: "none" } },
 								{ name: "merge", prompt: ".pi/prompts/epic-closeout.md", acceptance: { type: "validator", validators: ["ci", "canonical"] } },
 							],
@@ -924,7 +924,7 @@ export default function architectExtension(pi: ExtensionAPI) {
 					items,
 					steps: [
 						{ name: "implement", prompt: ".pi/prompts/issue-implementation-series.md", acceptance: { type: "validator", validators: ["ci"] } },
-						{ name: "validate", acceptance: { type: "validator", validators: ["ci", "tests", "security"] } },
+						{ name: "validate", acceptance: { type: "validator", validators: ["ci", "tests", "security", "wiring"] } },
 						{ name: "create-mr", prompt: ".pi/prompts/epic-closeout.md", acceptance: { type: "none" } },
 						{ name: "merge", prompt: ".pi/prompts/epic-closeout.md", acceptance: { type: "validator", validators: ["ci", "canonical"] } },
 					],

package/templates/pi/extensions/pipeline.ts

@@ -43,6 +43,8 @@ const VALIDATOR_SCRIPTS: Record<string, string> = {
 	architecture: ".pi/scripts/validate-architecture.sh",
 	canonical: ".pi/scripts/validate-canonical.sh",
 	integration: ".pi/scripts/validate-integration.sh",
+	// ADR-009: implemented modules must be INSTALLED in the composition root
+	wiring: ".pi/scripts/check_composition_root.sh",
 };
 
 // ── Helpers ──
@@ -1443,7 +1445,7 @@ function buildSteps(stepNames: string[]): StepConfig[] {
 		},
 		validate: {
 			name: "validate",
-			acceptance: { type: "validator", validators: ["ci", "tests", "security"] },
+			acceptance: { type: "validator", validators: ["ci", "tests", "security", "wiring"] },
 		},
 		"create-mr": {
 			name: "create-mr",

package/templates/pi/preflight_report.json

@@ -1,5 +1,5 @@
 {
-  "timestamp": "2026-11-07T13:17:56Z",
+  "timestamp": "2026-11-07T13:24:59Z",
   "mode": "all",
   "stages_run": [],
   "summary": {
@@ -8,7 +8,7 @@
     "failed": 1,
     "skipped": 12
   },
-  "duration_seconds": 0,
+  "duration_seconds": 1,
   "results": [
   {
     "name": "check_mr_traceability.sh",

package/templates/pi/scripts/check_composition_root.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_composition_root.sh — implemented modules must be INSTALLED in the app
+# ============================================================================
+# ADR-009 gap: "referenced outside the module" is not "wired into the runtime".
+# A service can be imported by one stray helper and still never be registered in
+# the composition root — the app boots and the feature does not exist.
+#
+# This check asserts, per implemented module, that the app shell references it:
+#   python  : FastAPI include_router / container build / app.add_*
+#   java    : Spring @Bean / @ComponentScan / new *Configuration / @Import
+#   typescript: app.use( / router registration / createRouter / bootstrap
+#   go      : handler registration / mux.Handle / router.Register
+#   rust    : router/handler registration in main or app module
+#
+# Exemptions: modules whose doc declares "not wired by design" or bootstrap-only.
+# Usage: bash .pi/scripts/check_composition_root.sh [--root <dir>] [--strict]
+# Exit:  0 all implemented modules installed; 1 unwired module(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+ARGS=("$@")
+for ((i=0;i<${#ARGS[@]};i++)); do
+	case "${ARGS[$i]}" in
+		--root) ROOT="${ARGS[$((i+1))]:-$ROOT}" ;;
+	esac
+done
+cd "$ROOT" || exit 1
+
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+echo "============================================"
+echo "  Composition Root (implemented = installed)"
+echo "============================================"
+
+# ── language + app shell candidates ──────────────────────────────────────────
+LANG_NAME=""
+[ -f guardian-manifest.json ] && LANG_NAME=$(python3 -c "import json;print(json.load(open('guardian-manifest.json')).get('language',''))" 2>/dev/null || true)
+echo "Language: ${LANG_NAME:-unknown}"
+
+SHALLS=()
+case "$LANG_NAME" in
+	python|nextjs|angular|typescript)
+		while IFS= read -r f; do SHALLS+=("$f"); done < <(find src app -maxdepth 4 -type f \( -name "app.py" -o -name "main.py" -o -name "__main__.py" -o -name "server.ts" -o -name "main.ts" -o -name "index.ts" \) 2>/dev/null | grep -vE "test|spec" | head -6)
+		COVER_PATTERN="include_router|add_router|app\.use\(|createRouter|register_module|build_container|@Module"
+		;;
+	java)
+		while IFS= read -r f; do SHALLS+=("$f"); done < <(find src/main/java -maxdepth 10 -type f \( -name "*Application.java" -o -name "*Configuration.java" -o -name "*Config.java" \) 2>/dev/null | head -8)
+		COVER_PATTERN="@Bean|@ComponentScan|@Import|@EnableAutoConfiguration|@SpringBootApplication"
+		;;
+	go)
+		while IFS= read -r f; do SHALLS+=("$f"); done < <(find . -maxdepth 4 -type f -name "main.go" 2>/dev/null | head -4)
+		COVER_PATTERN="http.Handle|mux.Handle|router.Register|\.Use\(|RegisterRoutes"
+		;;
+	rust)
+		while IFS= read -r f; do SHALLS+=("$f"); done < <(find . -maxdepth 4 -type f -name "main.rs" 2>/dev/null | grep -v target | head -4)
+		COVER_PATTERN="\.route\(|Router::new|add_route|register_handler|\.merge\("
+		;;
+esac
+
+if [ "${#SHALLS[@]}" -eq 0 ]; then
+	echo ""
+	if [ "$LANG_NAME" = "python" ] || [ "$LANG_NAME" = "typescript" ]; then
+		echo -e "${RED}❌ FAIL${NC} no application shell found (expected src/**/app.py|main.py or app.use/bootstrap)"
+		exit 1
+	fi
+	echo "no application shell detected for $LANG_NAME — skipping"
+	exit 0
+fi
+
+echo "App shell(s): ${SHALLS[*]}"
+SHELL_TEXT=$(cat "${SHALLS[@]}" 2>/dev/null)
+
+# ── modules that claim implementation ────────────────────────────────────────
+MODS=()
+if [ -d .pi/architecture/modules ]; then
+	while IFS= read -r f; do
+		b=$(basename "$f" .md)
+		[ "$b" = "module-template" ] && continue
+		# Skip docs that explicitly declare they are not runtime-installed.
+		grep -qiE "not wired by design|bootstrap only|no runtime integration|not part of the runtime" "$f" && continue
+		MODS+=("$b")
+	done < <(find .pi/architecture/modules -name "*.md" -type f | sort)
+fi
+
+if [ "${#MODS[@]}" -eq 0 ]; then
+	echo "no module docs — skipping"
+	exit 0
+fi
+
+UNWIRED=0
+for m in "${MODS[@]}"; do
+	# normalize: identity-access -> identity_access, identityaccess
+	norm=$(echo "$m" | tr -d '_-' )
+	matched=0
+	# 1) shell text mentions the module (router import, container build, bean, etc.)
+	if echo "$SHELL_TEXT" | grep -qiE "(^|[^a-z0-9])${m//-/[-_ ]}($|[^a-z0-9])"; then matched=1; fi
+	if [ "$matched" -eq 0 ] && echo "$SHELL_TEXT" | grep -qi "$norm"; then matched=1; fi
+	# 2) shell imports a file from the module package (language-agnostic)
+	if [ "$matched" -eq 0 ]; then
+		while IFS= read -r sh; do
+			if grep -qE "(from|import)\s+[\"']?${m//-/[_ ]}|${norm}" "$sh" 2>/dev/null; then matched=1; break; fi
+		done < <(printf '%s\n' "${SHALLS[@]}")
+	fi
+	# 3) the shell has at least one registration call AND imports the module (covered above)
+	if [ "$matched" -eq 0 ]; then
+		echo -e "${RED}❌ FAIL${NC} ${m}: implemented but NOT installed in the app shell (${SHALLS[0]})"
+		UNWIRED=$((UNWIRED+1))
+	fi
+done
+
+if [ "$UNWIRED" -eq 0 ]; then
+	echo ""
+	echo -e "${GREEN}✅ PASS${NC} all ${#MODS[@]} module(s) installed in the composition root"
+	exit 0
+fi
+echo ""
+echo -e "${RED}❌ FAIL${NC} ${UNWIRED}/${#MODS[@]} module(s) implemented but never wired into the app"
+echo "   Fix: register the module in ${SHALLS[0]} (router/bean/handler/container) and"
+echo "        add an end-to-end test through the public entrypoint."
+exit 1