guardian-framework 0.1.162 → 0.1.163

package/dist/cli.js

@@ -3206,7 +3206,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.162", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.163", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/dist/exports.js

@@ -1991,7 +1991,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.162", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.163", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "guardian-framework",
-	"version": "0.1.162",
+	"version": "0.1.163",
 	"description": "Token-optimized agentic framework scaffolder with pi-first architecture",
 	"type": "module",
 	"main": "dist/exports.js",

package/templates/pi/preflight_report.json

@@ -1,5 +1,5 @@
 {
-  "timestamp": "2026-11-13T20:21:08Z",
+  "timestamp": "2026-11-13T20:44:26Z",
   "mode": "all",
   "stages_run": [],
   "summary": {

package/templates/pi/scripts/freeze.sh

@@ -245,6 +245,13 @@ def find_tests(slug):
                 if not re.search(r"\.(py|ts|rs|go|java)$", f):
                     continue
                 low = os.path.join(dp, f).lower()
+                if "__pycache__" in low:
+                    continue
+                # Only actual test files: conftest.py, _fixtures.py and
+                # __init__.py are support, not suites (they made counts lie).
+                stem = f.rsplit(".", 1)[0]
+                if not (stem.startswith("test_") or stem.endswith("_test") or stem in ("tests", "test")):
+                    continue
                 if slug in low or slug.replace("-", "") in low.replace("-", ""):
                     hits.append(os.path.join(dp, f))
         if hits:
@@ -337,6 +344,8 @@ def verify(slug):
     sig_files = []
     for d in src_dirs:
         for dp, _dn, fs in os.walk(d):
+            if "__pycache__" in dp:
+                continue
             sig_files += [os.path.join(dp, f) for f in fs if re.search(r"\.(py|ts|java|rs|go)$", f)]
     ok_sigs = bool(sig_files)
     checks.append(("frozen signatures", ok_sigs, f"{len(sig_files)} source file(s)" if ok_sigs else f"no src/{slug}/"))
@@ -382,6 +391,62 @@ def verify(slug):
     checks.append(("red state", ok_red, f"{status}: {reason}"))
     ok_all &= ok_red
 
+    # 4b. recorded evidence must still hold (spec: a contract change means
+    #     the module is no longer frozen and must be re-frozen).
+    st_rec = load_state()
+    ent = entry(st_rec, slug)
+    if ent.get("state") == "frozen" and (ent.get("evidence") or {}).get("commit"):
+        ev = ent["evidence"]
+        sha = ev["commit"]
+        base_ref = ev.get("branch") or base
+        # realpath both sides: on macOS /tmp is a symlink to /private/tmp, and a
+        # symlinked project dir made relpath produce ../../../tmp/... so git saw
+        # a path outside the repo and reported "no changes".
+        rel = os.path.relpath(os.path.realpath(root), os.path.realpath(git_top))
+        prefix = "" if rel == "." else f"{rel}/"
+
+        on_base = subprocess.run(
+            ["git", "-C", git_top, "merge-base", "--is-ancestor", sha, base_ref],
+            capture_output=True).returncode == 0
+        checks.append(("recorded commit", on_base,
+                       f"{sha[:8]} is an ancestor of {base_ref}" if on_base
+                       else f"{sha[:8]} is NOT an ancestor of {base_ref}"))
+        ok_all &= on_base
+
+        missing = [p for p in (ev.get("contracts") or []) if not os.path.exists(os.path.join(root, p))]
+        checks.append(("evidence files", not missing,
+                       "recorded contract/test files exist" if not missing
+                       else "missing: " + ", ".join(missing)))
+        ok_all &= not missing
+
+        def changed_since(paths):
+            """Files changed since the freeze — committed OR uncommitted.
+
+            `git diff <sha> -- <paths>` compares the recorded commit against the
+            WORKING TREE, so it catches both later commits and local edits.
+            Diffing commit-to-commit silently ignored uncommitted tampering.
+            """
+            if not paths:
+                return []
+            args = ["git", "-C", git_top, "diff", "--name-only", sha, "--"]
+            args += [f"{prefix}{p}" for p in paths]
+            out = subprocess.run(args, capture_output=True, text=True).stdout.strip()
+            if os.environ.get("GUARDIAN_FREEZE_DEBUG"):
+                print(f"DEBUG changed_since args={args} out={out!r}", file=sys.stderr)
+            return [l for l in out.splitlines() if l.strip()]
+
+        contract_changes = changed_since(ev.get("contracts") or [])
+        checks.append(("contracts unchanged", not contract_changes,
+                       "contracts unchanged since the freeze" if not contract_changes
+                       else "changed after the freeze — re-freeze: " + ", ".join(contract_changes)))
+        ok_all &= not contract_changes
+
+        test_changes = changed_since(ev.get("tests") or [])
+        checks.append(("tests unchanged", not test_changes,
+                       "frozen test files unchanged" if not test_changes
+                       else "tests changed after the freeze — re-freeze: " + ", ".join(test_changes[:3])))
+        ok_all &= not test_changes
+
     # 5. dependencies frozen/implemented
     bad_deps = []
     st = load_state()
@@ -472,8 +537,8 @@ if cmd == "list":
 
 if cmd == "status":
     if not module:
-        print("usage: freeze.sh status --module <m>", file=sys.stderr)
-        raise SystemExit(2)
+        # no module given: same as list
+        cmd = "list"
     slug = slugify(module)
     st = load_state()
     e = entry(st, slug)