pumuki 6.3.295 → 6.3.297

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [6.3.297] - 2026-05-19
+
+- `PUMUKI-INC-157`: staged no-code/documentation/repin scopes no longer fail the skills contract with `EVIDENCE_SKILLS_PLATFORMS_UNDETECTED`. When the effective staged scope has no iOS, Android, backend or frontend code paths, platform skills are reported as `NOT_APPLICABLE` instead of blocking, while code-bearing slices keep the hard skills gate.
+
+## [6.3.296] - 2026-05-19
+
+- `PUMUKI-INC-156`: follow-up after RuralGo replay. Broad SwiftUI findings are now considered non-actionable even when they include a `primary_node` if that node spans many lines. Only a bounded AST/node range can hard-block a staged diff; file-level brownfield SwiftUI debt remains advisory for the atomic slice.
+
 ## [6.3.295] - 2026-05-19
 
 - `PUMUKI-INC-156`: staged PRE_WRITE/PRE_COMMIT no longer blocks an atomic iOS slice with broad file-level SwiftUI skill findings that expose dozens of lines without a precise AST node introduced by the diff. Precise AST/skills findings still block in every severity when they intersect changed lines; broad brownfield file debt is retained as advisory with remediation demanding line/node-level evidence or a dedicated remediation slice.

package/VERSION

@@ -1 +1 @@
-6.3.294
+6.3.297

package/core/facts/detectors/text/ios.test.ts

@@ -8,6 +8,7 @@ import {
   findSwiftPresentationSrpMatch,
   collectSwiftModernizableXCTestSuiteLines,
   collectSwiftLegacyExpectationDescriptionLines,
+  collectSwiftMakeSUTWithoutMemoryTrackingLines,
   collectSwiftMixedTestingFrameworkLines,
   collectSwiftQuickNimbleLines,
   collectSwiftWaitForExpectationsLines,
@@ -78,6 +79,7 @@ import {
   hasSwiftEnvironmentObjectUsage,
   hasSwiftLowContrastStaticColorPairUsage,
   hasSwiftMainThreadBlockingSleepUsage,
+  hasSwiftMakeSUTWithoutMemoryTrackingUsage,
   hasSwiftMassiveViewControllerResponsibilityUsage,
   hasSwiftMagicNumberLayoutUsage,
   hasSwiftMixedTestingFrameworksUsage,
@@ -128,6 +130,7 @@ import {
   hasSwiftExplicitColorStaticMemberUsage,
   hasSwiftClosureBasedViewBuilderContentUsage,
   collectSwiftForceUnwrapLines,
+  collectSwiftUIKitManualFrameLayoutLines,
   collectSwiftWarningSuppressionLines,
   hasSwiftLargeConfigContextViewPropertyUsage,
   hasSwiftUiConditionalSameViewIdentityUsage,
@@ -147,6 +150,7 @@ import {
   hasSwiftXCTestAssertionUsage,
   hasSwiftXCTUnwrapUsage,
   hasSwiftUncheckedSendableUsage,
+  hasSwiftUIKitManualFrameLayoutUsage,
 } from './ios';
 
 test('hasSwiftForceUnwrap detecta force unwrap postfix en expresiones', () => {
@@ -1129,6 +1133,44 @@ struct ProfileView: View {
   assert.deepEqual(collectSwiftMagicNumberLayoutLines(constants), []);
 });
 
+test('hasSwiftUIKitManualFrameLayoutUsage detecta layout manual UIKit y preserva Auto Layout y SwiftUI frame', () => {
+  const source = `
+final class CheckoutView: UIView {
+  private let titleLabel = UILabel(frame: CGRect(x: 0, y: 0, width: 320, height: 44))
+
+  func layoutBadge() {
+    badgeView.frame = CGRect(x: 16, y: 16, width: 80, height: 32)
+  }
+}
+`;
+  const safe = `
+final class CheckoutView: UIView {
+  private let titleLabel = UILabel()
+
+  func installConstraints() {
+    titleLabel.translatesAutoresizingMaskIntoConstraints = false
+    NSLayoutConstraint.activate([
+      titleLabel.leadingAnchor.constraint(equalTo: leadingAnchor)
+    ])
+  }
+}
+
+struct CheckoutSwiftUIView: View {
+  var body: some View {
+    Text("Checkout").frame(maxWidth: .infinity)
+  }
+}
+
+let sample = "UILabel(frame: CGRect(x: 0, y: 0, width: 10, height: 10))"
+// badgeView.frame = CGRect(x: 0, y: 0, width: 10, height: 10)
+`;
+
+  assert.equal(hasSwiftUIKitManualFrameLayoutUsage(source), true);
+  assert.deepEqual(collectSwiftUIKitManualFrameLayoutLines(source), [3, 6]);
+  assert.equal(hasSwiftUIKitManualFrameLayoutUsage(safe), false);
+  assert.deepEqual(collectSwiftUIKitManualFrameLayoutLines(safe), []);
+});
+
 test('detectores de logging iOS detectan logs ad-hoc y PII en produccion', () => {
   const adHoc = `
 print(user.id)
@@ -2217,6 +2259,47 @@ final class BuyerOnboardingStringsTests: XCTestCase {
   assert.deepEqual(collectSwiftXCTUnwrapLines(brownfieldSpec), []);
 });
 
+test('hasSwiftMakeSUTWithoutMemoryTrackingUsage detecta specs con makeSUT sin trackForMemoryLeaks', () => {
+  const source = `
+import XCTest
+
+final class BuyerAuthScreenTests: XCTestCase {
+  func testRendersTitle() {
+    let sut = makeSUT()
+    XCTAssertNotNil(sut)
+  }
+
+  private func makeSUT() -> BuyerAuthScreen {
+    BuyerAuthScreen()
+  }
+}
+`;
+  const safe = `
+import XCTest
+
+final class BuyerAuthScreenTests: XCTestCase {
+  func testRendersTitle() {
+    let sut = makeSUT()
+    XCTAssertNotNil(sut)
+  }
+
+  private func makeSUT() -> BuyerAuthScreen {
+    let sut = BuyerAuthScreen()
+    trackForMemoryLeaks(sut)
+    return sut
+  }
+}
+
+let sample = "makeSUT() without trackForMemoryLeaks"
+// private func makeSUT() -> Sample { Sample() }
+`;
+
+  assert.equal(hasSwiftMakeSUTWithoutMemoryTrackingUsage(source), true);
+  assert.deepEqual(collectSwiftMakeSUTWithoutMemoryTrackingLines(source), [6, 10]);
+  assert.equal(hasSwiftMakeSUTWithoutMemoryTrackingUsage(safe), false);
+  assert.deepEqual(collectSwiftMakeSUTWithoutMemoryTrackingLines(safe), []);
+});
+
 test('hasSwiftMixedTestingFrameworksUsage detecta mezcla XCTestCase y Testing/@Test', () => {
   const mixedSuite = `
 import XCTest

package/core/facts/detectors/text/ios.ts

@@ -1701,6 +1701,17 @@ export const hasSwiftNSLayoutConstraintUsage = (source: string): boolean => {
   });
 };
 
+export const collectSwiftUIKitManualFrameLayoutLines = (source: string): readonly number[] => {
+  const manualFramePattern =
+    /\b(?:UIView|UIStackView|UILabel|UIButton|UIImageView|UITableView|UICollectionView|UIScrollView|UITextField|UITextView|UIViewController)\s*\(\s*frame\s*:\s*CGRect\s*\(|\.\s*frame\s*=\s*CGRect\s*\(/g;
+
+  return collectSwiftRegexLines(source, manualFramePattern);
+};
+
+export const hasSwiftUIKitManualFrameLayoutUsage = (source: string): boolean => {
+  return collectSwiftUIKitManualFrameLayoutLines(source).length > 0;
+};
+
 export const hasSwiftUntypedNavigationLinkDestinationUsage = (source: string): boolean => {
   const swiftSource = sanitizeSwiftSourceForMultilineRegex(source);
   const destinationParameterPattern = /\bNavigationLink\s*\([^)]*\bdestination\s*:/;
@@ -1832,6 +1843,19 @@ const hasSwiftBrownfieldXCTestQualityPattern = (source: string): boolean => {
   return /\bmakeSUT\s*\(/.test(sanitized) && /\btrackForMemoryLeaks\s*\(/.test(sanitized);
 };
 
+export const collectSwiftMakeSUTWithoutMemoryTrackingLines = (source: string): readonly number[] => {
+  const sanitized = sanitizeSwiftSourceForMultilineRegex(source);
+  if (!/\bmakeSUT\s*\(/.test(sanitized) || /\btrackForMemoryLeaks\s*\(/.test(sanitized)) {
+    return [];
+  }
+
+  return collectSwiftRegexLines(source, /\bmakeSUT\s*\(/g);
+};
+
+export const hasSwiftMakeSUTWithoutMemoryTrackingUsage = (source: string): boolean => {
+  return collectSwiftMakeSUTWithoutMemoryTrackingLines(source).length > 0;
+};
+
 export const hasSwiftLegacyXCTestImportUsage = (source: string): boolean => {
   if (!hasSwiftXCTestImportUsage(source)) {
     return false;

package/core/facts/extractHeuristicFacts.ts

@@ -778,6 +778,7 @@ const textDetectorRegistry: ReadonlyArray<TextDetectorRegistryEntry> = [
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftMassiveViewControllerResponsibilityUsage, ruleId: 'heuristics.ios.architecture.massive-view-controller.ast', code: 'HEURISTICS_IOS_ARCHITECTURE_MASSIVE_VIEW_CONTROLLER_AST', message: 'AST heuristic detected a UIViewController with direct infrastructure/data access; move data access behind application/domain boundaries.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftNonIBOutletImplicitlyUnwrappedOptionalUsage, ruleId: 'heuristics.ios.safety.non-iboutlet-iuo.ast', code: 'HEURISTICS_IOS_SAFETY_NON_IBOUTLET_IUO_AST', message: 'AST heuristic detected an implicitly unwrapped optional outside IBOutlet wiring; explicit optionals or initialization guarantees remain the preferred baseline.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftMagicNumberLayoutUsage, locateLines: TextIOS.collectSwiftMagicNumberLayoutLines, primaryNode: (lines) => ({ kind: 'call', name: 'SwiftUI layout numeric literal', lines }), relatedNodes: (lines) => [{ kind: 'property', name: 'replacement: named metric constant or design token', lines }], why: 'Inline numeric layout literals hide design intent and make visual remediation dependent on scanning the whole view body.', impact: 'Pixel-perfect slices can be blocked without a concrete node unless the finding points to the exact spacing, frame or padding call to fix.', expected_fix: 'Move repeated or meaningful layout numbers into named constants or design tokens, or use relative layout APIs when the number encodes screen geometry.', ruleId: 'heuristics.ios.maintainability.magic-number-layout.ast', code: 'HEURISTICS_IOS_MAINTAINABILITY_MAGIC_NUMBER_LAYOUT_AST', message: 'AST heuristic detected SwiftUI layout magic numbers; named constants or design tokens remain the preferred baseline.' },
+  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUIKitManualFrameLayoutUsage, locateLines: TextIOS.collectSwiftUIKitManualFrameLayoutLines, primaryNode: (lines) => ({ kind: 'call', name: 'UIKit manual frame CGRect layout', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: Auto Layout constraints or SwiftUI relative layout', lines }], why: 'Manual UIKit frames hard-code geometry instead of using Auto Layout constraints or SwiftUI relative layout, so the layout cannot adapt reliably to devices, Dynamic Type or localization.', impact: 'Pixel-perfect work can regress across screens because fixed CGRect values bypass constraint solving and produce file-level ambiguity unless the exact frame node is reported.', expected_fix: 'Replace UIView(frame: CGRect(...)) and .frame = CGRect(...) layout with Auto Layout anchors/NSLayoutConstraint, UIStackView constraints, or SwiftUI relative layout where the screen is SwiftUI-first.', ruleId: 'heuristics.ios.uikit.manual-frame-layout.ast', code: 'HEURISTICS_IOS_UIKIT_MANUAL_FRAME_LAYOUT_AST', message: 'AST heuristic detected UIKit manual frame layout; use Auto Layout constraints or SwiftUI relative layout.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftAdHocLoggingUsage, ruleId: 'heuristics.ios.logging.adhoc-print.ast', code: 'HEURISTICS_IOS_LOGGING_ADHOC_PRINT_AST', message: 'AST heuristic detected print/debugPrint/dump/NSLog/os_log usage in iOS production code.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftSensitiveLoggingUsage, ruleId: 'heuristics.ios.logging.sensitive-data.ast', code: 'HEURISTICS_IOS_LOGGING_SENSITIVE_DATA_AST', message: 'AST heuristic detected sensitive data in an iOS logging call.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftHardcodedSensitiveStringUsage, locateLines: TextIOS.collectSwiftHardcodedSensitiveStringLines, primaryNode: (lines) => ({ kind: 'property', name: 'hardcoded sensitive Swift string', lines }), relatedNodes: (lines) => [{ kind: 'property', name: 'replacement: Keychain, secure config or environment-specific secret source', lines }], why: 'Sensitive strings assigned directly to token/password/secret properties create static production secrets and cannot be rotated safely.', impact: 'Credentials or identifiers can leak through source, binaries, logs or screenshots and block release until the concrete assignment is removed.', expected_fix: 'Read sensitive values from Keychain, secure configuration, injected environment or a repository-approved secret provider. Keep user-facing copy in localization assets, not sensitive variables.', ruleId: 'heuristics.ios.security.hardcoded-sensitive-string.ast', code: 'HEURISTICS_IOS_SECURITY_HARDCODED_SENSITIVE_STRING_AST', message: 'AST heuristic detected hardcoded sensitive Swift string; Keychain, secure config or environment-specific secrets remain the preferred baseline.' },

package/core/rules/presets/heuristics/ios.test.ts

@@ -3,7 +3,7 @@ import test from 'node:test';
 import { iosRules } from './ios';
 
 test('iosRules define reglas heurísticas locked para plataforma ios', () => {
-  assert.equal(iosRules.length, 105);
+  assert.equal(iosRules.length, 106);
 
   const ids = iosRules.map((rule) => rule.id);
   assert.deepEqual(ids, [
@@ -35,6 +35,7 @@ test('iosRules define reglas heurísticas locked para plataforma ios', () => {
     'heuristics.ios.architecture.swinject.ast',
     'heuristics.ios.architecture.massive-view-controller.ast',
     'heuristics.ios.maintainability.magic-number-layout.ast',
+    'heuristics.ios.uikit.manual-frame-layout.ast',
     'heuristics.ios.safety.non-iboutlet-iuo.ast',
     'heuristics.ios.logging.adhoc-print.ast',
     'heuristics.ios.logging.sensitive-data.ast',
@@ -155,6 +156,10 @@ test('iosRules define reglas heurísticas locked para plataforma ios', () => {
     byId.get('heuristics.ios.maintainability.warning-suppression.ast')?.then.code,
     'HEURISTICS_IOS_MAINTAINABILITY_WARNING_SUPPRESSION_AST'
   );
+  assert.equal(
+    byId.get('heuristics.ios.uikit.manual-frame-layout.ast')?.then.code,
+    'HEURISTICS_IOS_UIKIT_MANUAL_FRAME_LAYOUT_AST'
+  );
   assert.equal(
     byId.get('heuristics.ios.swiftui.onchange-task.ast')?.then.code,
     'HEURISTICS_IOS_SWIFTUI_ONCHANGE_TASK_AST'

package/core/rules/presets/heuristics/ios.ts

@@ -520,6 +520,25 @@ export const iosRules: RuleSet = [
       code: 'HEURISTICS_IOS_MAINTAINABILITY_MAGIC_NUMBER_LAYOUT_AST',
     },
   },
+  {
+    id: 'heuristics.ios.uikit.manual-frame-layout.ast',
+    description: 'Detects UIKit manual frame CGRect layout in iOS presentation code.',
+    severity: 'WARN',
+    platform: 'ios',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ios.uikit.manual-frame-layout.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message:
+        'AST heuristic detected UIKit manual frame layout; use Auto Layout constraints or SwiftUI relative layout.',
+      code: 'HEURISTICS_IOS_UIKIT_MANUAL_FRAME_LAYOUT_AST',
+    },
+  },
   {
     id: 'heuristics.ios.safety.non-iboutlet-iuo.ast',
     description: 'Detects implicitly unwrapped optionals outside IBOutlet wiring.',

package/integrations/config/skillsDetectorRegistry.ts

@@ -167,6 +167,10 @@ const registryByRuleId: Record<string, SkillsDetectorBinding> = {
     heuristicDetector('ios.maintainability.magic-number-layout', [
       'heuristics.ios.maintainability.magic-number-layout.ast',
     ]),
+  'skills.ios.guideline.ios.auto-layout-nslayoutconstraint': heuristicDetector(
+    'ios.uikit.manual-frame-layout',
+    ['heuristics.ios.uikit.manual-frame-layout.ast']
+  ),
   'skills.ios.guideline.ios.prohibido-print-y-logs-ad-hoc': heuristicDetector(
     'ios.logging.adhoc-print',
     ['heuristics.ios.logging.adhoc-print.ast']

package/integrations/gate/evaluateAiGate.ts

@@ -542,6 +542,14 @@ const hasWorktreeCodePlatforms = (params: {
   );
 };
 
+const hasEffectiveChangedCodePlatforms = (params: {
+  changedPaths: ReadonlyArray<string>;
+  requiredPlatforms: ReadonlyArray<PreWriteSkillsPlatform>;
+}): boolean =>
+  params.changedPaths.some((filePath) =>
+    params.requiredPlatforms.some((platform) => isPlatformPath(platform, filePath))
+  );
+
 const toLockRequiredPlatforms = (
   requiredLock: SkillsLockV1 | undefined
 ): ReadonlyArray<PreWriteSkillsPlatform> => {
@@ -792,6 +800,25 @@ const toSkillsContractAssessment = (params: {
   skillsEnforcement: SkillsEnforcementResolution;
 }): AiGateSkillsContractAssessment => {
   const requiredPlatforms = toLockRequiredPlatforms(params.requiredLock);
+  const effectiveChangedPaths = collectPreWriteEffectiveChangedPaths(params.repoRoot);
+  const hasEffectiveChangedPaths = effectiveChangedPaths.length > 0;
+  const hasEffectiveCodePlatforms = hasEffectiveChangedCodePlatforms({
+    changedPaths: effectiveChangedPaths,
+    requiredPlatforms,
+  });
+  const isNoCodeEffectiveScope =
+    requiredPlatforms.length > 0 && hasEffectiveChangedPaths && !hasEffectiveCodePlatforms;
+
+  if (isNoCodeEffectiveScope) {
+    return {
+      stage: params.stage,
+      enforced: false,
+      status: 'NOT_APPLICABLE',
+      detected_platforms: [],
+      requirements: [],
+      violations: [],
+    };
+  }
 
   if (params.evidenceResult.kind !== 'valid') {
     return {
@@ -841,7 +868,7 @@ const toSkillsContractAssessment = (params: {
   const explicitlyDetectedPlatforms = toDetectedSkillsPlatforms(params.evidenceResult.evidence.platforms);
   const inferredPlatforms = toCoverageInferredPlatforms(coverage);
   const repoTreeDetectedPlatforms =
-    params.stage !== 'PRE_WRITE' && requiredPlatforms.length > 0
+    params.stage !== 'PRE_WRITE' && requiredPlatforms.length > 0 && !hasEffectiveChangedPaths
       ? toRepoTreeDetectedPlatforms({
           repoRoot: params.repoRoot,
           platforms: requiredPlatforms,
@@ -871,13 +898,16 @@ const toSkillsContractAssessment = (params: {
 
   if (requiredPlatforms.length > 0 && detectedPlatforms.length === 0) {
     if (
-      params.stage === 'PRE_WRITE'
-      && (
+      (
         pendingChanges === 0
-        || !hasWorktreeCodePlatforms({
-          repoRoot: params.repoRoot,
-          requiredPlatforms,
-        })
+        || !hasEffectiveCodePlatforms
+        || (
+          params.stage === 'PRE_WRITE'
+          && !hasWorktreeCodePlatforms({
+            repoRoot: params.repoRoot,
+            requiredPlatforms,
+          })
+        )
       )
     ) {
       return {

package/integrations/git/runPlatformGate.ts

@@ -203,8 +203,12 @@ const isBroadFileLevelFinding = (finding: Finding): boolean => {
   if (findingLines.length <= BROAD_BROWNFIELD_FINDING_LINES_THRESHOLD) {
     return false;
   }
+  const nodeLines = [
+    ...normalizeFindingLines(finding.primary_node?.lines),
+    ...(finding.related_nodes ?? []).flatMap((node) => normalizeFindingLines(node.lines)),
+  ];
   const hasPreciseNode =
-    typeof finding.primary_node !== 'undefined' || (finding.related_nodes?.length ?? 0) > 0;
+    nodeLines.length > 0 && nodeLines.length <= BROAD_BROWNFIELD_FINDING_LINES_THRESHOLD;
   return !hasPreciseNode;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.295",
+  "version": "6.3.297",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {

package/skills.lock.json

@@ -1,7 +1,7 @@
 {
   "version": "1.0",
   "compilerVersion": "1.0.0",
-  "generatedAt": "2026-05-14T09:20:03.683Z",
+  "generatedAt": "2026-05-19T16:39:15.905Z",
   "bundles": [
     {
       "name": "android-guidelines",