pumuki 6.3.174 → 6.3.176

package/VERSION

@@ -1 +1 @@
-v6.3.174
+v6.3.176

package/core/facts/detectors/text/ios.test.ts

@@ -27,6 +27,7 @@ import {
   hasSwiftModernizableXCTestSuiteUsage,
   hasSwiftAssumeIsolatedUsage,
   hasSwiftCoreDataLayerLeakUsage,
+  hasSwiftSwiftDataLayerLeakUsage,
   hasSwiftNonisolatedUnsafeUsage,
   hasSwiftNSManagedObjectAsyncBoundaryUsage,
   hasSwiftNSManagedObjectBoundaryUsage,
@@ -618,6 +619,44 @@ struct DetailView: View {
   assert.equal(hasSwiftCoreDataLayerLeakUsage(ignored), false);
 });
 
+test('hasSwiftSwiftDataLayerLeakUsage detecta SwiftData fuera de infraestructura', () => {
+  const source = `
+import SwiftData
+
+struct DetailView: View {
+  @Environment(\\.modelContext) private var modelContext
+  @Query(sort: \\TodoModel.title) private var todos: [TodoModel]
+}
+
+final class DetailUseCase {
+  private let container: ModelContainer
+  private let context: ModelContext
+  private let descriptor = FetchDescriptor<TodoModel>()
+}
+
+@Model
+final class TodoModel {
+  var title: String
+}
+`;
+  const ignored = `
+import Foundation
+
+struct DetailView: View {
+  let selectedID: Todo.ID?
+}
+
+final class DetailUseCase {
+  func execute() async throws -> [Todo] { [] }
+  private let predicate: Predicate<Todo>?
+  private let sort = SortDescriptor(\\Todo.title)
+}
+`;
+
+  assert.equal(hasSwiftSwiftDataLayerLeakUsage(source), true);
+  assert.equal(hasSwiftSwiftDataLayerLeakUsage(ignored), false);
+});
+
 test('hasSwiftNSManagedObjectStateLeakUsage detecta fugas a SwiftUI state y ViewModels', () => {
   const source = `
 final class TodoEntity: NSManagedObject {}

package/core/facts/detectors/text/ios.ts

@@ -800,6 +800,13 @@ export const hasSwiftCoreDataLayerLeakUsage = (source: string): boolean => {
   );
 };
 
+export const hasSwiftSwiftDataLayerLeakUsage = (source: string): boolean => {
+  return hasSwiftSanitizedRegexMatch(
+    source,
+    /\bimport\s+SwiftData\b|@\s*Query\b|@\s*Model\b|\b(?:ModelContext|ModelContainer|FetchDescriptor)\b|\.modelContext\b/g
+  );
+};
+
 export const hasSwiftNSManagedObjectStateLeakUsage = (source: string): boolean => {
   const typeDeclarations = parseSwiftTypeDeclarations(source);
   if (typeDeclarations.length === 0) {

package/core/facts/extractHeuristicFacts.ts

@@ -630,6 +630,7 @@ const textDetectorRegistry: ReadonlyArray<TextDetectorRegistryEntry> = [
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftNSManagedObjectBoundaryUsage, ruleId: 'heuristics.ios.core-data.nsmanagedobject-boundary.ast', code: 'HEURISTICS_IOS_CORE_DATA_NSMANAGEDOBJECT_BOUNDARY_AST', message: 'AST heuristic detected NSManagedObject in a shared boundary.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftNSManagedObjectAsyncBoundaryUsage, ruleId: 'heuristics.ios.core-data.nsmanagedobject-async-boundary.ast', code: 'HEURISTICS_IOS_CORE_DATA_NSMANAGEDOBJECT_ASYNC_BOUNDARY_AST', message: 'AST heuristic detected NSManagedObject in an async boundary.' },
   { platform: 'ios', pathCheck: isIOSApplicationOrPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftCoreDataLayerLeakUsage, ruleId: 'heuristics.ios.core-data.layer-leak.ast', code: 'HEURISTICS_IOS_CORE_DATA_LAYER_LEAK_AST', message: 'AST heuristic detected Core Data APIs leaking into application/presentation code.' },
+  { platform: 'ios', pathCheck: isIOSApplicationOrPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftSwiftDataLayerLeakUsage, ruleId: 'heuristics.ios.swiftdata.layer-leak.ast', code: 'HEURISTICS_IOS_SWIFTDATA_LAYER_LEAK_AST', message: 'AST heuristic detected SwiftData APIs leaking into application/presentation code.' },
   { platform: 'ios', pathCheck: isIOSApplicationOrPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftNSManagedObjectStateLeakUsage, ruleId: 'heuristics.ios.core-data.nsmanagedobject-state-leak.ast', code: 'HEURISTICS_IOS_CORE_DATA_NSMANAGEDOBJECT_STATE_LEAK_AST', message: 'AST heuristic detected NSManagedObject leaking into SwiftUI state or a ViewModel.' },
 
   // Android

package/core/rules/presets/heuristics/ios.test.ts

@@ -3,7 +3,7 @@ import test from 'node:test';
 import { iosRules } from './ios';
 
 test('iosRules define reglas heurísticas locked para plataforma ios', () => {
-  assert.equal(iosRules.length, 42);
+  assert.equal(iosRules.length, 43);
 
   const ids = iosRules.map((rule) => rule.id);
   assert.deepEqual(ids, [
@@ -48,6 +48,7 @@ test('iosRules define reglas heurísticas locked para plataforma ios', () => {
     'heuristics.ios.core-data.nsmanagedobject-boundary.ast',
     'heuristics.ios.core-data.nsmanagedobject-async-boundary.ast',
     'heuristics.ios.core-data.layer-leak.ast',
+    'heuristics.ios.swiftdata.layer-leak.ast',
     'heuristics.ios.core-data.nsmanagedobject-state-leak.ast',
   ]);
 
@@ -137,6 +138,10 @@ test('iosRules define reglas heurísticas locked para plataforma ios', () => {
     byId.get('heuristics.ios.core-data.layer-leak.ast')?.then.code,
     'HEURISTICS_IOS_CORE_DATA_LAYER_LEAK_AST'
   );
+  assert.equal(
+    byId.get('heuristics.ios.swiftdata.layer-leak.ast')?.then.code,
+    'HEURISTICS_IOS_SWIFTDATA_LAYER_LEAK_AST'
+  );
   assert.equal(
     byId.get('heuristics.ios.core-data.nsmanagedobject-state-leak.ast')?.then.code,
     'HEURISTICS_IOS_CORE_DATA_NSMANAGEDOBJECT_STATE_LEAK_AST'

package/core/rules/presets/heuristics/ios.ts

@@ -743,6 +743,24 @@ export const iosRules: RuleSet = [
       code: 'HEURISTICS_IOS_CORE_DATA_LAYER_LEAK_AST',
     },
   },
+  {
+    id: 'heuristics.ios.swiftdata.layer-leak.ast',
+    description: 'Detects SwiftData APIs leaking into iOS application or presentation layers.',
+    severity: 'WARN',
+    platform: 'ios',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ios.swiftdata.layer-leak.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected SwiftData APIs leaking into application/presentation code.',
+      code: 'HEURISTICS_IOS_SWIFTDATA_LAYER_LEAK_AST',
+    },
+  },
   {
     id: 'heuristics.ios.core-data.nsmanagedobject-state-leak.ast',
     description: 'Detects NSManagedObject leaking into SwiftUI state or ViewModel state.',

package/docs/codex-skills/core-data-expert.md

@@ -1,12 +1,13 @@
-# Core Data Expert
+# Core Data + SwiftData Expert
 
-Use this skill when auditing or implementing Core Data code that must remain safe across contexts, layers, and async boundaries.
+Use this skill when auditing or implementing Core Data or SwiftData code that must remain safe across contexts, layers, and async boundaries.
 
 ## Focus areas
 
 - ✅ Prefer `NSManagedObjectID` or mapped DTO/domain models over passing `NSManagedObject` across boundaries.
 - ✅ Avoid returning or accepting `NSManagedObject` in async APIs that cross actor or context boundaries.
 - ✅ Keep Core Data orchestration inside infrastructure or repository layers instead of presentation or application code.
+- ✅ Keep SwiftData orchestration (`ModelContext`, `ModelContainer`, `@Query`, `@Model`) inside infrastructure or repository layers instead of application or presentation code in enterprise Clean Architecture.
 - ✅ Make context ownership explicit and keep merge boundaries controlled.
 - ✅ Treat managed objects as context-scoped references, not as portable domain entities.
 
@@ -21,4 +22,5 @@ Use this skill when auditing or implementing Core Data code that must remain saf
 - ❌ Passing `NSManagedObject` through service, use-case, or presentation boundaries.
 - ❌ Async APIs that return `NSManagedObject` directly.
 - ❌ Using `CoreData`, `@FetchRequest`, `managedObjectContext`, or persistence containers directly in application/presentation code.
+- ❌ Using SwiftData contexts, containers, queries, or persistence models directly in application or presentation code when the repo requires Clean Architecture boundaries.
 - ❌ Leaking context-scoped managed objects into SwiftUI state or view models.

package/docs/rule-packs/ios.md

@@ -49,4 +49,4 @@
 - No XCTest-only `XCTestCase` suites that are directly modernizable to `import Testing` + `@Test`, and no mixed `XCTestCase`/`Testing` suites without explicit compatibility reason
 - No `String(format:)` and no `UIScreen.main.bounds` in SwiftUI presentation/layout paths
 - No `ForEach(...indices...)`, no user-facing `contains()` filters instead of `localizedStandardContains()`, and no avoidable `GeometryReader` / `fontWeight(.bold)` patterns in modern SwiftUI paths
-- No Core Data APIs in iOS `Application` / `Presentation` paths, and no `NSManagedObject` escaping into SwiftUI state or ViewModels
+- No Core Data or SwiftData APIs in iOS `Application` / `Presentation` paths, and no `NSManagedObject` escaping into SwiftUI state or ViewModels

package/docs/validation/ios-avdlee-parity-matrix.md

@@ -22,7 +22,7 @@ Artefacto contractual de `phase10-avdlee-parity-closure`.
 | `swift-concurrency` | `ios-concurrency-guidelines` | `skills.ios.no-dispatchqueue`, `skills.ios.no-dispatchgroup`, `skills.ios.no-dispatchsemaphore`, `skills.ios.no-operation-queue`, `skills.ios.no-task-detached`, `skills.ios.no-unchecked-sendable`, `skills.ios.no-preconcurrency`, `skills.ios.no-nonisolated-unsafe`, `skills.ios.no-assume-isolated` | `integrations/config/__tests__/iosAvdleeParity.test.ts`, `core/facts/detectors/text/ios.test.ts`, `core/facts/__tests__/extractHeuristicFacts.test.ts`, `core/rules/presets/heuristics/ios.test.ts`, `integrations/config/__tests__/skillsDetectorRegistry.test.ts`, `integrations/config/__tests__/skillsMarkdownRules.test.ts` | `skills.sources.json`, `skills.lock.json`, `integrations/config/skillsCompilerTemplates.ts`, `integrations/config/skillsDetectorRegistry.ts`, `integrations/evidence/buildEvidence.ts` |
 | `swiftui-expert-skill` | `ios-swiftui-expert-guidelines` | `skills.ios.no-observable-object`, `skills.ios.no-legacy-swiftui-observable-wrapper`, `skills.ios.no-passed-value-state-wrapper`, `skills.ios.no-navigation-view`, `skills.ios.no-foreground-color`, `skills.ios.no-corner-radius`, `skills.ios.no-tab-item`, `skills.ios.no-on-tap-gesture`, `skills.ios.no-string-format`, `skills.ios.no-foreach-indices`, `skills.ios.no-contains-user-filter`, `skills.ios.no-geometryreader`, `skills.ios.no-font-weight-bold`, `skills.ios.no-scrollview-shows-indicators`, `skills.ios.no-sheet-is-presented`, `skills.ios.no-legacy-onchange`, `skills.ios.no-uiscreen-main-bounds` | `integrations/config/__tests__/iosAvdleeParity.test.ts`, `core/facts/detectors/text/ios.test.ts`, `core/facts/detectors/text/iosSwiftUiModernizationSnapshot.test.ts`, `core/facts/__tests__/extractHeuristicFacts.test.ts`, `core/rules/presets/heuristics/ios.test.ts`, `integrations/config/__tests__/skillsDetectorRegistry.test.ts`, `integrations/config/__tests__/skillsMarkdownRules.test.ts` | `skills.sources.json`, `skills.lock.json`, `assets/rule-packs/ios-swiftui-modernization-v1.json`, `assets/rule-packs/ios-swiftui-modernization-v2.json`, `integrations/config/skillsCompilerTemplates.ts`, `integrations/config/skillsDetectorRegistry.ts`, `integrations/evidence/buildEvidence.ts` |
 | `swift-testing-expert` | `ios-swift-testing-guidelines` | `skills.ios.prefer-swift-testing`, `skills.ios.no-xctassert`, `skills.ios.no-xctunwrap`, `skills.ios.no-wait-for-expectations`, `skills.ios.no-legacy-expectation-description`, `skills.ios.no-mixed-testing-frameworks` | `integrations/config/__tests__/iosAvdleeParity.test.ts`, `core/facts/detectors/text/ios.test.ts`, `core/facts/__tests__/extractHeuristicFacts.test.ts`, `core/rules/presets/heuristics/ios.test.ts`, `integrations/config/__tests__/skillsDetectorRegistry.test.ts`, `integrations/config/__tests__/skillsMarkdownRules.test.ts` | `skills.sources.json`, `skills.lock.json`, `integrations/config/skillsCompilerTemplates.ts`, `integrations/config/skillsDetectorRegistry.ts`, `integrations/evidence/buildEvidence.ts` |
-| `core-data-expert` | `ios-core-data-guidelines` | `skills.ios.no-nsmanagedobject-boundary`, `skills.ios.no-nsmanagedobject-async-boundary`, `skills.ios.no-core-data-layer-leak`, `skills.ios.no-nsmanagedobject-state-leak` | `integrations/config/__tests__/iosAvdleeParity.test.ts`, `core/facts/detectors/text/ios.test.ts`, `core/facts/__tests__/extractHeuristicFacts.test.ts`, `core/rules/presets/heuristics/ios.test.ts`, `integrations/config/__tests__/skillsDetectorRegistry.test.ts`, `integrations/config/__tests__/skillsMarkdownRules.test.ts` | `skills.sources.json`, `skills.lock.json`, `integrations/config/skillsCompilerTemplates.ts`, `integrations/config/skillsDetectorRegistry.ts`, `integrations/evidence/buildEvidence.ts` |
+| `core-data-expert` | `ios-core-data-guidelines` | `skills.ios.no-nsmanagedobject-boundary`, `skills.ios.no-nsmanagedobject-async-boundary`, `skills.ios.no-core-data-layer-leak`, `skills.ios.no-nsmanagedobject-state-leak`, `skills.ios.no-swiftdata-layer-leak` | `integrations/config/__tests__/iosAvdleeParity.test.ts`, `core/facts/detectors/text/ios.test.ts`, `core/facts/__tests__/extractHeuristicFacts.test.ts`, `core/rules/presets/heuristics/ios.test.ts`, `integrations/config/__tests__/skillsDetectorRegistry.test.ts`, `integrations/config/__tests__/skillsMarkdownRules.test.ts` | `skills.sources.json`, `skills.lock.json`, `integrations/config/skillsCompilerTemplates.ts`, `integrations/config/skillsDetectorRegistry.ts`, `integrations/evidence/buildEvidence.ts` |
 
 ## Skill absorbida por snapshot
 

package/integrations/config/skillsDetectorRegistry.ts

@@ -143,6 +143,9 @@ const registryByRuleId: Record<string, SkillsDetectorBinding> = {
   'skills.ios.no-core-data-layer-leak': heuristicDetector('ios.core-data.layer-leak', [
     'heuristics.ios.core-data.layer-leak.ast',
   ]),
+  'skills.ios.no-swiftdata-layer-leak': heuristicDetector('ios.swiftdata.layer-leak', [
+    'heuristics.ios.swiftdata.layer-leak.ast',
+  ]),
   'skills.ios.no-nsmanagedobject-state-leak': heuristicDetector(
     'ios.core-data.nsmanagedobject-state-leak',
     ['heuristics.ios.core-data.nsmanagedobject-state-leak.ast']

package/integrations/lifecycle/policyReconcile.ts

@@ -117,6 +117,9 @@ const tryApplyPolicyAutofix = (params: {
   }
 
   const preWriteStage = params.report.stages.PRE_WRITE;
+  const preCommitStage = params.report.stages.PRE_COMMIT;
+  const prePushStage = params.report.stages.PRE_PUSH;
+  const ciStage = params.report.stages.CI;
   const signatures = {
     PRE_WRITE: createPolicyAsCodeSignature({
       stage: 'PRE_COMMIT',
@@ -125,9 +128,27 @@ const tryApplyPolicyAutofix = (params: {
       hash: preWriteStage.hash,
       version: '1.0',
     }),
-    PRE_COMMIT: params.report.stages.PRE_COMMIT.signature,
-    PRE_PUSH: params.report.stages.PRE_PUSH.signature,
-    CI: params.report.stages.CI.signature,
+    PRE_COMMIT: createPolicyAsCodeSignature({
+      stage: 'PRE_COMMIT',
+      source: toContractSource(preCommitStage.source),
+      bundle: preCommitStage.bundle,
+      hash: preCommitStage.hash,
+      version: '1.0',
+    }),
+    PRE_PUSH: createPolicyAsCodeSignature({
+      stage: 'PRE_PUSH',
+      source: toContractSource(prePushStage.source),
+      bundle: prePushStage.bundle,
+      hash: prePushStage.hash,
+      version: '1.0',
+    }),
+    CI: createPolicyAsCodeSignature({
+      stage: 'CI',
+      source: toContractSource(ciStage.source),
+      bundle: ciStage.bundle,
+      hash: ciStage.hash,
+      version: '1.0',
+    }),
   };
   if (!signatures.PRE_COMMIT || !signatures.PRE_PUSH || !signatures.CI) {
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.174",
+  "version": "6.3.176",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {

package/skills.lock.json

@@ -1,7 +1,7 @@
 {
   "version": "1.0",
   "compilerVersion": "1.0.0",
-  "generatedAt": "2026-05-12T18:32:01.654Z",
+  "generatedAt": "2026-05-12T19:46:23.268Z",
   "bundles": [
     {
       "name": "android-guidelines",
@@ -5644,8 +5644,20 @@
       "name": "ios-core-data-guidelines",
       "version": "1.0.0",
       "source": "file:vendor/skills/core-data-expert/SKILL.md",
-      "hash": "0f4f9e67e60990dea6f946d09b8d7314d759d8cb03a0a3806a172818e84cc31e",
+      "hash": "d91f2cad6499310a4299b39593d47f40a507299a0562c21bc64aad9b5d27c66f",
       "rules": [
+        {
+          "id": "skills.ios.guideline.ios-core-data.keep-swiftdata-orchestration-modelcontext-modelcontainer-query-model-i",
+          "description": "Keep SwiftData orchestration (ModelContext, ModelContainer, @Query, @Model) inside infrastructure or repository layers instead of application or presentation code in enterprise Clean Architecture.",
+          "severity": "WARN",
+          "platform": "ios",
+          "sourceSkill": "ios-core-data-guidelines",
+          "sourcePath": "vendor/skills/core-data-expert/SKILL.md",
+          "confidence": "MEDIUM",
+          "locked": true,
+          "evaluationMode": "DECLARATIVE",
+          "origin": "core"
+        },
         {
           "id": "skills.ios.guideline.ios-core-data.make-context-ownership-explicit-and-keep-merge-boundaries-controlled",
           "description": "Make context ownership explicit and keep merge boundaries controlled.",
@@ -5694,6 +5706,18 @@
           "evaluationMode": "DECLARATIVE",
           "origin": "core"
         },
+        {
+          "id": "skills.ios.guideline.ios-core-data.using-swiftdata-contexts-containers-queries-or-persistence-models-dire",
+          "description": "Using SwiftData contexts, containers, queries, or persistence models directly in application or presentation code when the repo requires Clean Architecture boundaries.",
+          "severity": "ERROR",
+          "platform": "ios",
+          "sourceSkill": "ios-core-data-guidelines",
+          "sourcePath": "vendor/skills/core-data-expert/SKILL.md",
+          "confidence": "HIGH",
+          "locked": true,
+          "evaluationMode": "DECLARATIVE",
+          "origin": "core"
+        },
         {
           "id": "skills.ios.no-core-data-layer-leak",
           "description": "Keep Core Data orchestration inside infrastructure or repository layers; avoid Core Data APIs in application or presentation code.",

package/vendor/skills/core-data-expert/SKILL.md

@@ -1,12 +1,13 @@
-# Core Data Expert
+# Core Data + SwiftData Expert
 
-Use this skill when auditing or implementing Core Data code that must remain safe across contexts, layers, and async boundaries.
+Use this skill when auditing or implementing Core Data or SwiftData code that must remain safe across contexts, layers, and async boundaries.
 
 ## Focus areas
 
 - ✅ Prefer `NSManagedObjectID` or mapped DTO/domain models over passing `NSManagedObject` across boundaries.
 - ✅ Avoid returning or accepting `NSManagedObject` in async APIs that cross actor or context boundaries.
 - ✅ Keep Core Data orchestration inside infrastructure or repository layers instead of presentation code.
+- ✅ Keep SwiftData orchestration (`ModelContext`, `ModelContainer`, `@Query`, `@Model`) inside infrastructure or repository layers instead of application or presentation code in enterprise Clean Architecture.
 - ✅ Make context ownership explicit and keep merge boundaries controlled.
 - ✅ Treat managed objects as context-scoped references, not as portable domain entities.
 
@@ -21,3 +22,4 @@ Use this skill when auditing or implementing Core Data code that must remain saf
 - ❌ Passing `NSManagedObject` through service, use-case, or presentation boundaries.
 - ❌ Async APIs that return `NSManagedObject` directly.
 - ❌ Leaking context-scoped managed objects into SwiftUI state or view models.
+- ❌ Using SwiftData contexts, containers, queries, or persistence models directly in application or presentation code when the repo requires Clean Architecture boundaries.