guardian-framework 0.1.163 → 0.1.164

package/dist/cli.js

@@ -3206,7 +3206,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.163", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.164", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/dist/exports.js

@@ -1991,7 +1991,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.163", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.164", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "guardian-framework",
-	"version": "0.1.163",
+	"version": "0.1.164",
 	"description": "Token-optimized agentic framework scaffolder with pi-first architecture",
 	"type": "module",
 	"main": "dist/exports.js",

package/templates/pi/preflight_report.json

@@ -1,5 +1,5 @@
 {
-  "timestamp": "2026-11-13T20:44:26Z",
+  "timestamp": "2026-11-13T21:11:04Z",
   "mode": "all",
   "stages_run": [],
   "summary": {

package/templates/pi/scripts/freeze.sh

@@ -16,13 +16,14 @@
 #   freeze.sh status  [--root DIR]
 #   freeze.sh list    [--root DIR]
 #   freeze.sh next    [--root DIR]   # next module eligible to freeze, in order
+#   freeze.sh unfreeze --module <m> --reason "<why>" [--root DIR]
 #
 # Exit: 0 pass · 1 verification failed · 2 usage/state error
 # ============================================================================
 set -uo pipefail
 
 CMD="${1:-}"; shift || true
-MODULE=""; ROOT_OPT=""; BASE="main"; JSON_OUT=0; COMMIT=""
+MODULE=""; ROOT_OPT=""; BASE="main"; JSON_OUT=0; COMMIT=""; REASON=""
 
 while [ $# -gt 0 ]; do
 	case "$1" in
@@ -31,6 +32,7 @@ while [ $# -gt 0 ]; do
 	--base) BASE="${2:-main}"; shift 2 ;;
 	--commit) COMMIT="${2:-}"; shift 2 ;;
 	--json) JSON_OUT=1; shift ;;
+	--reason) REASON="${2:-}"; shift 2 ;;
 	*) echo "unknown argument: $1" >&2; exit 2 ;;
 	esac
 done
@@ -54,15 +56,15 @@ usage() {
 }
 
 case "$CMD" in
-verify | record | status | list | next) ;;
+verify | record | status | list | next | unfreeze) ;;
 *) usage; exit 2 ;;
 esac
 
-exec python3 - "$CMD" "$ROOT" "$GIT_TOP" "$STATE" "$MODULE" "$BASE" "$JSON_OUT" "$COMMIT" <<'PY'
+exec python3 - "$CMD" "$ROOT" "$GIT_TOP" "$STATE" "$MODULE" "$BASE" "$JSON_OUT" "$COMMIT" "$REASON" <<'PY'
 import json, os, re, subprocess, sys
 from datetime import datetime, timezone
 
-cmd, root, git_top, state_path, module, base, json_out, commit = sys.argv[1:9]
+cmd, root, git_top, state_path, module, base, json_out, commit, reason = sys.argv[1:10]
 json_out = json_out == "1"
 
 MODS = os.path.join(root, ".pi", "architecture", "modules")
@@ -391,6 +393,31 @@ def verify(slug):
     checks.append(("red state", ok_red, f"{status}: {reason}"))
     ok_all &= ok_red
 
+    # 3b. static types — a frozen contract that does not type-check is a defect.
+    #     This is what caught `Invoice.record` shadowing `AggregateRoot.record`
+    #     (a classmethod factory hiding the event recorder) inside a frozen module.
+    pyproject = read(os.path.join(root, "pyproject.toml"))
+    has_mypy_cfg = ("[tool.mypy]" in pyproject
+                    or os.path.exists(os.path.join(root, "mypy.ini"))
+                    or "[mypy]" in read(os.path.join(root, "setup.cfg")))
+    mypy = os.path.join(root, ".venv", "bin", "mypy")
+    # dedupe: for a slug without hyphens both candidates are the same path, and
+    # passing it twice makes mypy report "Duplicate module named …"
+    pkg_dirs = sorted({d for d in (os.path.join(root, "src", slug),
+                                   os.path.join(root, "src", slug.replace("-", "_")))
+                       if os.path.isdir(d)})
+    if has_mypy_cfg and pkg_dirs and (os.path.exists(mypy) or os.path.exists("/usr/bin/env")):
+        try:
+            tc = subprocess.run([mypy if os.path.exists(mypy) else "mypy", *pkg_dirs],
+                                cwd=root, capture_output=True, text=True, timeout=600)
+            ok_tc = tc.returncode == 0
+            tail = [l for l in (tc.stdout or "").splitlines() if ": error:" in l][:3]
+            checks.append(("type check", ok_tc,
+                           "mypy clean" if ok_tc else "mypy errors: " + " | ".join(tail)))
+            ok_all &= ok_tc
+        except Exception as e:
+            checks.append(("type check", True, f"skipped ({e})"))
+
     # 4b. recorded evidence must still hold (spec: a contract change means
     #     the module is no longer frozen and must be re-frozen).
     st_rec = load_state()
@@ -519,6 +546,31 @@ if cmd == "next":
     print("no eligible module: every module is frozen/implemented or blocked by an unfrozen dependency")
     raise SystemExit(1)
 
+if cmd == "unfreeze":
+    if not module:
+        print("usage: freeze.sh unfreeze --module <m> --reason \"why\"", file=sys.stderr)
+        raise SystemExit(2)
+    if not reason:
+        print("refusing to unfreeze without a reason: a contract change must be recorded",
+              file=sys.stderr)
+        raise SystemExit(2)
+    slug = slugify(module)
+    st = load_state()
+    e = entry(st, slug)
+    if not e:
+        print(f"{slug} is not recorded — nothing to unfreeze", file=sys.stderr)
+        raise SystemExit(2)
+    history = e.get("history") or []
+    if e.get("evidence"):
+        history.append({"evidence": e["evidence"], "state": e.get("state"),
+                        "unfrozenAt": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+                        "reason": reason})
+    set_entry(st, slug, state="unfrozen", contractFrozen=False, evidence=None, history=history)
+    save_state(st)
+    print(f"unfrozen: {slug} — {reason}")
+    print("Re-run Phase A for the changed contract, then record again.")
+    raise SystemExit(0)
+
 # ── commands ────────────────────────────────────────────────────────────────
 if cmd == "list":
     st = load_state()