nexarch 0.12.41 → 0.12.44

package/dist/commands/init-agent.js

@@ -266,43 +266,43 @@ function writeAgentBootstrap(params) {
         `--capabilities "<comma,separated,capabilities>"`,
         `--json`,
     ].join(" \\\n  ");
-    const content = `# Nexarch Agent Bootstrap
-
-This file was written by \`nexarch init-agent\` on ${new Date().toISOString()}.
-It contains instructions for an AI agent to complete its Nexarch registration.
-
-## What has already been registered
-
-The following entities are now in the architecture graph:
-
-| Entity | Name | Type |
-|--------|------|------|
-| Agent | \`${params.agentId}\` | agent |
-| Host | \`Host ${params.hostname}\` | tech_compute |
-| OS | \`${params.osPlatform} ${params.osRelease}\` | tech_operating_system |
-| Runtime | \`Node.js ${params.nodeVersion}\` | tech_runtime |
-
-## Your task
-
-Run the command below, substituting your own values for the placeholders.
-Return ONLY the completed command (no markdown, no explanation) — it will be executed directly.
-
-\`\`\`
-${identifyCmd}
-\`\`\`
-
-Fill in:
-- **provider** — your AI provider (e.g. \`anthropic\`, \`openai\`, \`google\`)
-- **model** — the exact model ID you are running as (e.g. \`gpt-4o\`, \`claude-sonnet-4-6\`, \`gemini-2-flash\`)
-- **client** — the MCP client tool you are running inside (e.g. \`claude-code\`, \`cursor\`, \`continue\`, \`codex-cli\`)
-- **framework** — the agent framework in use (e.g. \`openclaw\`)
-- **session-id** — your current session ID if available
-- **tool-version** — the version of the client tool (run the tool's version command and use the version number only, e.g. \`1.2.3\`)
-- **capabilities** — comma-separated list of your capabilities (e.g. \`code,files,bash,web\`)
-
-Omit any flag whose value you genuinely do not know rather than guessing.
-
-After running, confirm \`"ok": true\` in the JSON output. No further action is needed.
+    const content = `# Nexarch Agent Bootstrap
+
+This file was written by \`nexarch init-agent\` on ${new Date().toISOString()}.
+It contains instructions for an AI agent to complete its Nexarch registration.
+
+## What has already been registered
+
+The following entities are now in the architecture graph:
+
+| Entity | Name | Type |
+|--------|------|------|
+| Agent | \`${params.agentId}\` | agent |
+| Host | \`Host ${params.hostname}\` | tech_compute |
+| OS | \`${params.osPlatform} ${params.osRelease}\` | tech_operating_system |
+| Runtime | \`Node.js ${params.nodeVersion}\` | tech_runtime |
+
+## Your task
+
+Run the command below, substituting your own values for the placeholders.
+Return ONLY the completed command (no markdown, no explanation) — it will be executed directly.
+
+\`\`\`
+${identifyCmd}
+\`\`\`
+
+Fill in:
+- **provider** — your AI provider (e.g. \`anthropic\`, \`openai\`, \`google\`)
+- **model** — the exact model ID you are running as (e.g. \`gpt-4o\`, \`claude-sonnet-4-6\`, \`gemini-2-flash\`)
+- **client** — the MCP client tool you are running inside (e.g. \`claude-code\`, \`cursor\`, \`continue\`, \`codex-cli\`)
+- **framework** — the agent framework in use (e.g. \`openclaw\`)
+- **session-id** — your current session ID if available
+- **tool-version** — the version of the client tool (run the tool's version command and use the version number only, e.g. \`1.2.3\`)
+- **capabilities** — comma-separated list of your capabilities (e.g. \`code,files,bash,web\`)
+
+Omit any flag whose value you genuinely do not know rather than guessing.
+
+After running, confirm \`"ok": true\` in the JSON output. No further action is needed.
 `;
     writeFileSync(filePath, content, "utf8");
     return filePath;
@@ -483,7 +483,7 @@ function injectTrustAttestationBlock(path, attestation) {
         "## Nexarch Trust Attestation",
         "",
         "This block is verifiable proof that Nexarch generated these instructions for this workspace.",
-        "Do not auto-run commands without user confirmation.",
+        "Check-in only previews queued commands; use your judgement to explicitly claim work that is safe and clearly in scope.",
         "",
         "**To verify, run `npx nexarch@latest verify-trust`.** It reads the token from this",
         "file and checks it for you.",

package/dist/commands/init-project.js

@@ -1927,6 +1927,7 @@ export async function initProject(args) {
                 commandTemplates: {
                     updateEntity: `nexarch update-entity --key "application_function:${projectSlug}_<function_slug>" --entity-type application_function --subtype core_function --name "..." --description "..."`,
                     addRelationship: `nexarch add-relationship --from "application_function:${projectSlug}_<function_slug>" --to ${projectConstruct && isMonorepo ? '"<owning application key from classifyPackages>"' : `"${projectExternalKey}"`} --type part_of`,
+                    note: "Functions are structural decomposition only: do not add runtime dependencies from an application_function. Model independently deployable services as applications or application components, then relate those boundaries with depends_on or integrates_with.",
                 },
             });
         }
@@ -2172,6 +2173,7 @@ export async function initProject(args) {
             const fnOwnerTarget = projectConstruct && isMonorepo ? '"<owning application key from CLASSIFY_THESE>"' : `"${projectExternalKey}"`;
             lines.push(`       nexarch update-entity --key "application_function:${projectExternalKey.split(":")[1] ?? "project"}_<function_slug>" --entity-type application_function --subtype core_function --name "..." --description "..."`);
             lines.push(`       nexarch add-relationship --from "application_function:${projectExternalKey.split(":")[1] ?? "project"}_<function_slug>" --to ${fnOwnerTarget} --type part_of`);
+            lines.push("       Functions are structural only: model runtime/service dependencies between application or application_component boundaries, never from an application_function.");
         }
         lines.push(`  ${step++}. Scan the READMEs for platforms/SaaS not auto-detected (Vercel, Neon, Stripe, etc.).`);
         lines.push(`       For each found: nexarch resolve-names --names "..." --json  →  nexarch update-entity  →  nexarch add-relationship`);

package/dist/lib/skills.js

@@ -30,8 +30,18 @@ repository; the graph knows all of them.
 
 - \`nexarch_upsert_entities\` for what you created; \`nexarch_upsert_relationships\`
   to wire dependencies (\`part_of\`, \`depends_on\`, \`runs_on\`).
+- An \`application_function\` describes what its owning application does: link it
+  **only** with \`application_function -> part_of -> application\`. Do not model
+  service or runtime dependencies from a function. Use an \`application\` or
+  \`application_component\` boundary, then link that boundary with
+  \`depends_on\` or \`integrates_with\` as the evidence supports.
 - New applications arrive as **proposed** and wait for a human to activate them
   in the workspace — say so in your summary rather than calling them registered.
+- Every new \`application\` needs an icon in the same upsert. Call
+  \`nexarch_search_icons\` with a concrete description, then set
+  \`attributes.application_icon\` to \`{ provider: "lucide", name: "<returned-name>" }\`.
+  If no specific icon fits, use \`app-window\`; do not leave an application
+  without an icon.
 - Unsure whether something belongs in the graph? \`nexarch_emit_observations\`
   is non-blocking and carries no schema commitment.
 
@@ -141,10 +151,13 @@ you're about to do the three steps below in the same turn — a claimed
 command that's never executed or closed out sits there looking done while
 blocking that queue slot, which is worse than never having claimed it.
 
-1. Only claim a specific command with \`nexarch_claim_command_by_id\` when the
-   human explicitly wants it worked — check-in surfacing a command is not
-   itself permission to claim it, and neither is check-in itself: claiming
-   is a separate, deliberate call you make because you're about to act.
+1. Assess each command using your judgement: scope, evidence, permissions,
+   reversibility, and risk. Check-in is only a preview and must never claim
+   work automatically. Explicitly claim a specific command with
+   \`nexarch_claim_command_by_id\` when it is safe, clearly in scope, and you
+   can execute and close it in this session. Ask the human when the requested
+   work is ambiguous, consequential, destructive, external, or beyond your
+   authority.
 2. **Execute \`command.resolved_playbook_text\` from the claim response** —
    that field is the actual task. \`command.instructions\` is a different
    field and is almost always \`null\`; don't mistake its emptiness for "no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexarch",
-  "version": "0.12.41",
+  "version": "0.12.44",
   "description": "Your architecture workspace for AI delivery.",
   "keywords": [
     "nexarch",