septum 0.1.4 → 0.1.5

package/src/cli/templates/skill.ts

@@ -1,69 +1,69 @@
-export const SEPTUM_MAP_SKILL_TEMPLATE = `---
-name: septum-map
-description: Framework-agnostic codebase discovery, architectural domain mapping, and bounded-context initialization for Septum. Uses AI reasoning to map unknown project topologies (JS/TS, PHP, Python, Go), auto-registers bounded contexts into Septum's SQLite catalog, and enforces deterministic architectural boundaries.
----
-
-# \`septum-map\` — Framework-Agnostic Semantic Discovery & Bounded-Context Initialization
-
-> **Prinsip Utama:** AI Agent berperan sebagai *The Architect* untuk membedah topologi arsitektur proyek apa pun tanpa terikat pada framework tertentu, merumuskan batas bounded-context, dan mendaftarkannya langsung ke database deterministik (.septum/septum.db via septum_register_domain) agar AI coding berikutnya tidak mengalami context poisoning atau over-editing.
-
----
-
-## 1. Landasan Riset & Filosofi Desain
-
-Skill ini berakar langsung pada riset rekayasa perangkat lunak terkemuka:
-1. **Software Reflexion Models (Murphy, Notkin, & Sullivan, IEEE TSE):**
-   Membedakan model arsitektur tingkat tinggi yang dirancang (*high-level intention*) dengan implementasi fisik di kode sumber. Septum mendeteksi *Divergences* (pelanggaran baru) dan *Absences* sebelum kode di-merge.
-2. **Eliminasi Over-Editing (SWE-bench, RepoCoder - NeurIPS / ICLR):**
-   Akar kegagalan agen AI terbesar adalah mengedit file di luar lokus tugas (*local scope myopia*). \`septum-map\` menetapkan *bounded context* dan *allowed touchpoints* sejak awal.
-3. **Principle of Least Privilege & Object-Capabilities (Miller):**
-   Agen hanya diberikan kapabilitas membaca dan mengubah file dalam domain/fitur aktif, memangkas *blast radius* kesalahan hingga mendekati nol.
-4. **Hybrid Defense (SynCode / NeMo Guardrails):**
-   Probabilistic AI digunakan untuk penalaran awal (*discovery & blueprinting*), sementara eksekusi dan penegakannya 100% deterministik (*Tree-sitter WASM, SQLite WAL, Pre-Commit Hooks*).
-
----
-
-## 2. Kapan Wajib Menggunakan (Trigger Moments)
-
-> [!NOTE] Zero-Config Default (\`septum init\`)
-> Untuk mayoritas proyek (library kecil/menengah, layered monolith standar, MVC, CLI, MCP tools), pengguna atau agen **cukup menjalankan \`septum init\`** di terminal. Perintah \`septum init\` secara default berjalan 100% otomatis tanpa wawancara manual (zero-config heuristic auto-detect & auto-ingest).
-
-Gunakan alur 4 langkah skill ini HANYA saat:
-1. Memetakan domain bisnis kustom / modular DDD enterprise yang kompleks di mana batasan dependency non-standar perlu disepakati bersama Tech Lead.
-2. Memetakan ulang domain bisnis setelah terjadi refactoring arsitektur besar (*re-mapping*).
-3. Mengonfigurasi sesi fitur baru (\`features\` session) untuk mengunci daftar file yang boleh dimodifikasi (*allowed_touchpoints*) dan simbol yang wajib dipakai ulang (*reuse_symbols*).
-4. Pengguna secara eksplisit meminta konsultasi desain domain boundary interaktif.
-
----
-
-## 3. Alur Kerja 4 Langkah (The 4-Step Discovery Lifecycle)
-
-### Langkah 1: Topological Scan (Maksimal 2 Tool Call)
-Analisis karakteristik proyek secara framework-agnostic:
-1. **Periksa Manifest & Config Root:**
-   * JS/TS: \`package.json\`, \`tsconfig.json\` (baca dependencies, path aliases).
-   * PHP: \`composer.json\` (baca \`autoload.psr-4\`, framework dependencies).
-   * Python: \`pyproject.toml\`, \`requirements.txt\`, \`setup.py\` (baca modules & framework).
-   * Go: \`go.mod\` (baca module path).
-2. **Petakan Direktori Tingkat Atas:**
-   Identifikasi apakah proyek menggunakan pola:
-   * *Domain-Driven / Vertical Slice:* \`src/domains/\`, \`app/Domain/\`, \`features/\`.
-   * *Layered / Clean Architecture:* \`core/\`, \`infrastructure/\`, \`application/\`, \`interfaces/\`.
-   * *Framework Conventional:* NestJS modules, Laravel app folders, FastAPI routers, Next.js route groups.
-
-### Langkah 2: Semantic Blueprint Drafting & Domain Boundary Formulation
-Rumuskan spesifikasi domain dengan prinsip **Contract & Invariants (Bukan Prosedural)**:
-* **\`root\`:** Direktori fisik domain (gunakan path kanonikal).
-* **\`allowed_dependencies\`:** Domain mana saja yang sah diimpor (inbound whitelist).
-* **\`forbidden_dependencies\`:** Domain yang dilarang keras diimpor (outbound blacklist).
-* **\`archetypes\`:** Pola glob penamaan layer (\`service: "*Service.*"\`, \`model: "*Model.*"\`).
-
-### Langkah 3: Human-in-the-Loop Approval Gate
-Tampilkan ringkasan domain boundary yang dirumuskan kepada pengguna / Tech Lead untuk disetujui atau disesuaikan sebelum didaftarkan.
-
-### Langkah 4: Deterministic Registration & Ingestion
-Setelah disetujui:
-1. Daftarkan domain secara langsung via tool MCP \`septum_register_domain(domain_name, root, ...)\` dengan opsi \`ingest_now: true\`.
-2. Atau jalankan CLI \`septum ingest\` untuk mengekstrak seluruh simbol AST dan menyimpannya ke database SQLite \`.septum/septum.db\`.
-3. Pastikan hook pre-commit terpasang aktif di \`.git/hooks/pre-commit\`.
-`;
+export const SEPTUM_MAP_SKILL_TEMPLATE = `---
+name: septum-map
+description: Framework-agnostic codebase discovery, architectural domain mapping, and bounded-context initialization for Septum. Uses AI reasoning to map unknown project topologies (JS/TS, PHP, Python, Go), auto-registers bounded contexts into Septum's SQLite catalog, and enforces deterministic architectural boundaries.
+---
+
+# \`septum-map\` — Framework-Agnostic Semantic Discovery & Bounded-Context Initialization
+
+> **Prinsip Utama:** AI Agent berperan sebagai *The Architect* untuk membedah topologi arsitektur proyek apa pun tanpa terikat pada framework tertentu, merumuskan batas bounded-context, dan mendaftarkannya langsung ke database deterministik (.septum/septum.db via septum_register_domain) agar AI coding berikutnya tidak mengalami context poisoning atau over-editing.
+
+---
+
+## 1. Landasan Riset & Filosofi Desain
+
+Skill ini berakar langsung pada riset rekayasa perangkat lunak terkemuka:
+1. **Software Reflexion Models (Murphy, Notkin, & Sullivan, IEEE TSE):**
+   Membedakan model arsitektur tingkat tinggi yang dirancang (*high-level intention*) dengan implementasi fisik di kode sumber. Septum mendeteksi *Divergences* (pelanggaran baru) dan *Absences* sebelum kode di-merge.
+2. **Eliminasi Over-Editing (SWE-bench, RepoCoder - NeurIPS / ICLR):**
+   Akar kegagalan agen AI terbesar adalah mengedit file di luar lokus tugas (*local scope myopia*). \`septum-map\` menetapkan *bounded context* dan *allowed touchpoints* sejak awal.
+3. **Principle of Least Privilege & Object-Capabilities (Miller):**
+   Agen hanya diberikan kapabilitas membaca dan mengubah file dalam domain/fitur aktif, memangkas *blast radius* kesalahan hingga mendekati nol.
+4. **Hybrid Defense (SynCode / NeMo Guardrails):**
+   Probabilistic AI digunakan untuk penalaran awal (*discovery & blueprinting*), sementara eksekusi dan penegakannya 100% deterministik (*Tree-sitter WASM, SQLite WAL, Pre-Commit Hooks*).
+
+---
+
+## 2. Kapan Wajib Menggunakan (Trigger Moments)
+
+> [!NOTE] Zero-Config Default (\`septum init\`)
+> Untuk mayoritas proyek (library kecil/menengah, layered monolith standar, MVC, CLI, MCP tools), pengguna atau agen **cukup menjalankan \`septum init\`** di terminal. Perintah \`septum init\` secara default berjalan 100% otomatis tanpa wawancara manual (zero-config heuristic auto-detect & auto-ingest).
+
+Gunakan alur 4 langkah skill ini HANYA saat:
+1. Memetakan domain bisnis kustom / modular DDD enterprise yang kompleks di mana batasan dependency non-standar perlu disepakati bersama Tech Lead.
+2. Memetakan ulang domain bisnis setelah terjadi refactoring arsitektur besar (*re-mapping*).
+3. Mengonfigurasi sesi fitur baru (\`features\` session) untuk mengunci daftar file yang boleh dimodifikasi (*allowed_touchpoints*) dan simbol yang wajib dipakai ulang (*reuse_symbols*).
+4. Pengguna secara eksplisit meminta konsultasi desain domain boundary interaktif.
+
+---
+
+## 3. Alur Kerja 4 Langkah (The 4-Step Discovery Lifecycle)
+
+### Langkah 1: Topological Scan (Maksimal 2 Tool Call)
+Analisis karakteristik proyek secara framework-agnostic:
+1. **Periksa Manifest & Config Root:**
+   * JS/TS: \`package.json\`, \`tsconfig.json\` (baca dependencies, path aliases).
+   * PHP: \`composer.json\` (baca \`autoload.psr-4\`, framework dependencies).
+   * Python: \`pyproject.toml\`, \`requirements.txt\`, \`setup.py\` (baca modules & framework).
+   * Go: \`go.mod\` (baca module path).
+2. **Petakan Direktori Tingkat Atas:**
+   Identifikasi apakah proyek menggunakan pola:
+   * *Domain-Driven / Vertical Slice:* \`src/domains/\`, \`app/Domain/\`, \`features/\`.
+   * *Layered / Clean Architecture:* \`core/\`, \`infrastructure/\`, \`application/\`, \`interfaces/\`.
+   * *Framework Conventional:* NestJS modules, Laravel app folders, FastAPI routers, Next.js route groups.
+
+### Langkah 2: Semantic Blueprint Drafting & Domain Boundary Formulation
+Rumuskan spesifikasi domain dengan prinsip **Contract & Invariants (Bukan Prosedural)**:
+* **\`root\`:** Direktori fisik domain (gunakan path kanonikal).
+* **\`allowed_dependencies\`:** Domain mana saja yang sah diimpor (inbound whitelist).
+* **\`forbidden_dependencies\`:** Domain yang dilarang keras diimpor (outbound blacklist).
+* **\`archetypes\`:** Pola glob penamaan layer (\`service: "*Service.*"\`, \`model: "*Model.*"\`).
+
+### Langkah 3: Human-in-the-Loop Approval Gate
+Tampilkan ringkasan domain boundary yang dirumuskan kepada pengguna / Tech Lead untuk disetujui atau disesuaikan sebelum didaftarkan.
+
+### Langkah 4: Deterministic Registration & Ingestion
+Setelah disetujui:
+1. Daftarkan domain secara langsung via tool MCP \`septum_register_domain(domain_name, root, ...)\` dengan opsi \`ingest_now: true\`.
+2. Atau jalankan CLI \`septum ingest\` untuk mengekstrak seluruh simbol AST dan menyimpannya ke database SQLite \`.septum/septum.db\`.
+3. Pastikan hook pre-commit terpasang aktif di \`.git/hooks/pre-commit\`.
+`;

package/src/core/boundary/evaluator.ts

@@ -1,210 +1,232 @@
-import type { BoundaryViolation } from "../../types/index.ts";
-import type { ValidatedSeptumConfig } from "../config/schema.ts";
-import { ConfigLoader } from "../config/loader.ts";
-import type { SeptumRepository } from "../database/repository.ts";
-import { ModuleResolver } from "../resolver/module-resolver.ts";
-
-export class BoundaryEvaluator {
-  private repo: SeptumRepository;
-  private resolver: ModuleResolver;
-
-  constructor(repo: SeptumRepository, resolver?: ModuleResolver) {
-    this.repo = repo;
-    this.resolver = resolver ?? new ModuleResolver(process.cwd(), repo);
-  }
-
-  public getResolver(): ModuleResolver {
-    return this.resolver;
-  }
-
-  public evaluate(
-    filePath: string,
-    proposedImports: string[] = [],
-    featureKey?: string,
-    config?: ValidatedSeptumConfig
-  ): BoundaryViolation[] {
-    const activeConfig = config ?? ConfigLoader.loadFromDatabaseOrDefaults();
-    const violations: BoundaryViolation[] = [];
-
-    if (featureKey) {
-      violations.push(...this.checkFeatureTouchpoints(featureKey, filePath, activeConfig));
-    }
-
-    if (proposedImports.length > 0) {
-      violations.push(...this.checkProposedChanges(filePath, proposedImports, activeConfig));
-    }
-
-    return violations;
-  }
-
-  public auditCodebase(config: ValidatedSeptumConfig): BoundaryViolation[] {
-    const violations: BoundaryViolation[] = [];
-    const allDependencies = this.repo.getAllDependenciesWithDomains();
-
-    for (const dep of allDependencies) {
-      const targetDomain = this.resolveTargetDomain(dep.target, config, dep.source_file);
-      if (!targetDomain || targetDomain === dep.source_domain) {
-        continue;
-      }
-
-      const sourceDomainConfig = config.domains[dep.source_domain];
-      if (!sourceDomainConfig) {
-        continue;
-      }
-
-      const forbidden = sourceDomainConfig.forbidden_dependencies ?? [];
-      const allowed = sourceDomainConfig.allowed_dependencies ?? [];
-
-      // 1. Explicit forbidden check
-      if (forbidden.includes(targetDomain)) {
-        violations.push({
-          file: dep.source_file,
-          line: dep.line_number,
-          source_domain: dep.source_domain,
-          target_domain: targetDomain,
-          imported_target: dep.target,
-          rule: "forbidden_dependency",
-          message: `Forbidden cross-domain dependency detected: '${dep.source_domain}' is strictly prohibited from importing domain '${targetDomain}'.`,
-        });
-        continue;
-      }
-
-      // 2. Strict enforcement allowed check
-      if (config.settings.enforcement === "strict" && !allowed.includes(targetDomain)) {
-        violations.push({
-          file: dep.source_file,
-          line: dep.line_number,
-          source_domain: dep.source_domain,
-          target_domain: targetDomain,
-          imported_target: dep.target,
-          rule: "disallowed_dependency",
-          message: `Disallowed dependency: '${targetDomain}' is not declared in allowed_dependencies for domain '${dep.source_domain}'.`,
-        });
-      }
-    }
-
-    return violations;
-  }
-
-  public checkProposedChanges(
-    sourceFilePath: string,
-    proposedImports: string[],
-    config: ValidatedSeptumConfig
-  ): BoundaryViolation[] {
-    const violations: BoundaryViolation[] = [];
-    const sourceDomain = this.resolveSourceDomain(sourceFilePath, config);
-
-    if (!sourceDomain) {
-      return violations;
-    }
-
-    const sourceDomainConfig = config.domains[sourceDomain];
-    if (!sourceDomainConfig) {
-      return violations;
-    }
-
-    const forbidden = sourceDomainConfig.forbidden_dependencies ?? [];
-    const allowed = sourceDomainConfig.allowed_dependencies ?? [];
-
-    for (const statement of proposedImports) {
-      const targetDomain = this.resolveTargetDomain(statement, config, sourceFilePath);
-      if (!targetDomain || targetDomain === sourceDomain) {
-        continue;
-      }
-
-      if (forbidden.includes(targetDomain)) {
-        violations.push({
-          file: sourceFilePath,
-          line: 1,
-          source_domain: sourceDomain,
-          target_domain: targetDomain,
-          imported_target: statement,
-          rule: "forbidden_dependency",
-          message: `Illegal import blocked: Domain '${sourceDomain}' is strictly forbidden from importing domain '${targetDomain}'.`,
-        });
-      } else if (config.settings.enforcement === "strict" && !allowed.includes(targetDomain)) {
-        violations.push({
-          file: sourceFilePath,
-          line: 1,
-          source_domain: sourceDomain,
-          target_domain: targetDomain,
-          imported_target: statement,
-          rule: "disallowed_dependency",
-          message: `Unlisted domain dependency: '${targetDomain}' must be explicitly added to allowed_dependencies before domain '${sourceDomain}' can import it.`,
-        });
-      }
-    }
-
-    return violations;
-  }
-
-  public resolveSourceDomain(filePath: string, config: ValidatedSeptumConfig): string | null {
-    return this.resolver.resolveSourceDomain(filePath, config);
-  }
-
-  public resolveTargetDomain(
-    targetStatement: string,
-    config: ValidatedSeptumConfig,
-    sourceFilePath?: string
-  ): string | null {
-    return this.resolver.resolveTargetDomain(targetStatement, sourceFilePath, config);
-  }
-
-  public checkFeatureTouchpoints(
-    featureKey: string,
-    targetFilePath: string,
-    config: ValidatedSeptumConfig
-  ): BoundaryViolation[] {
-    const violations: BoundaryViolation[] = [];
-    const features = config.features ?? {};
-    const featureConfig = features[featureKey];
-
-    if (!featureConfig) {
-      violations.push({
-        file: targetFilePath,
-        line: 1,
-        source_domain: "unknown",
-        target_domain: "unknown",
-        imported_target: targetFilePath,
-        rule: "unknown_feature",
-        message: `Feature '${featureKey}' is not defined in septum configuration.`,
-      });
-      return violations;
-    }
-
-    const normalizedTarget = targetFilePath.replace(/\\/g, "/").replace(/^\.\//, "");
-    const allowedTouchpoints = featureConfig.allowed_touchpoints.map((tp) =>
-      tp.replace(/\\/g, "/").replace(/^\.\//, "")
-    );
-
-    const isAllowed = allowedTouchpoints.some((pattern) => {
-      if (pattern.endsWith("/**")) {
-        const prefix = pattern.slice(0, -3);
-        return normalizedTarget.startsWith(prefix);
-      }
-      if (pattern.endsWith("/*")) {
-        const prefix = pattern.slice(0, -2);
-        return normalizedTarget.startsWith(prefix);
-      }
-      return (
-        normalizedTarget === pattern ||
-        normalizedTarget.endsWith("/" + pattern) ||
-        pattern.endsWith("/" + normalizedTarget)
-      );
-    });
-
-    if (!isAllowed) {
-      violations.push({
-        file: targetFilePath,
-        line: 1,
-        source_domain: featureConfig.domain,
-        target_domain: "unknown",
-        imported_target: targetFilePath,
-        rule: "touchpoint_violation",
-        message: `Scope violation: File '${targetFilePath}' is outside the declared allowed_touchpoints for feature '${featureKey}'. Permitted: [${allowedTouchpoints.join(", ")}].`,
-      });
-    }
-
-    return violations;
-  }
-}
+import type { BoundaryViolation } from "../../types/index.ts";
+import type { ValidatedSeptumConfig } from "../config/schema.ts";
+import { ConfigLoader } from "../config/loader.ts";
+import type { SeptumRepository } from "../database/repository.ts";
+import { ModuleResolver } from "../resolver/module-resolver.ts";
+
+export class BoundaryEvaluator {
+  private repo: SeptumRepository;
+  private resolver: ModuleResolver;
+
+  constructor(repo: SeptumRepository, resolver?: ModuleResolver) {
+    this.repo = repo;
+    this.resolver = resolver ?? new ModuleResolver(process.cwd(), repo);
+  }
+
+  public getResolver(): ModuleResolver {
+    return this.resolver;
+  }
+
+  public evaluate(
+    filePath: string,
+    proposedImports: string[] = [],
+    featureKey?: string,
+    config?: ValidatedSeptumConfig
+  ): BoundaryViolation[] {
+    const activeConfig = config ?? ConfigLoader.loadFromDatabaseOrDefaults();
+    const violations: BoundaryViolation[] = [];
+
+    if (featureKey) {
+      violations.push(...this.checkFeatureTouchpoints(featureKey, filePath, activeConfig));
+    }
+
+    if (proposedImports.length > 0) {
+      violations.push(...this.checkProposedChanges(filePath, proposedImports, activeConfig));
+    }
+
+    return violations;
+  }
+
+  public auditCodebase(config: ValidatedSeptumConfig): BoundaryViolation[] {
+    const violations: BoundaryViolation[] = [];
+    const allDependencies = this.repo.getAllDependenciesWithDomains();
+
+    for (const dep of allDependencies) {
+      const targetDomain = this.resolveTargetDomain(dep.target, config, dep.source_file);
+      if (!targetDomain || targetDomain === dep.source_domain) {
+        continue;
+      }
+
+      const sourceDomainConfig = config.domains[dep.source_domain];
+      if (!sourceDomainConfig) {
+        continue;
+      }
+
+      const forbidden = sourceDomainConfig.forbidden_dependencies ?? [];
+      const allowed = sourceDomainConfig.allowed_dependencies ?? [];
+
+      // 1. Explicit forbidden check
+      if (forbidden.includes(targetDomain)) {
+        violations.push({
+          file: dep.source_file,
+          line: dep.line_number,
+          source_domain: dep.source_domain,
+          target_domain: targetDomain,
+          imported_target: dep.target,
+          rule: "forbidden_dependency",
+          message: `Forbidden cross-domain dependency detected: '${dep.source_domain}' is strictly prohibited from importing domain '${targetDomain}'.`,
+        });
+        continue;
+      }
+
+      // 2. Strict enforcement allowed check
+      if (config.settings.enforcement === "strict" && !allowed.includes(targetDomain)) {
+        violations.push({
+          file: dep.source_file,
+          line: dep.line_number,
+          source_domain: dep.source_domain,
+          target_domain: targetDomain,
+          imported_target: dep.target,
+          rule: "disallowed_dependency",
+          message: `Disallowed dependency: '${targetDomain}' is not declared in allowed_dependencies for domain '${dep.source_domain}'.`,
+        });
+      }
+    }
+
+    return violations;
+  }
+
+  public checkProposedChanges(
+    sourceFilePath: string,
+    proposedImports: string[],
+    config: ValidatedSeptumConfig
+  ): BoundaryViolation[] {
+    const violations: BoundaryViolation[] = [];
+    const sourceDomain = this.resolveSourceDomain(sourceFilePath, config);
+
+    if (!sourceDomain) {
+      violations.push({
+        file: sourceFilePath,
+        line: 1,
+        source_domain: "unmapped",
+        target_domain: "unknown",
+        imported_target: "",
+        rule: "unmapped_domain",
+        message: `File '${sourceFilePath}' does not belong to any declared bounded context. Boundary integrity cannot be enforced.`,
+      });
+      return violations;
+    }
+
+    const sourceDomainConfig = config.domains[sourceDomain];
+    if (!sourceDomainConfig) {
+      return violations;
+    }
+
+    const forbidden = sourceDomainConfig.forbidden_dependencies ?? [];
+    const allowed = sourceDomainConfig.allowed_dependencies ?? [];
+
+    for (const statement of proposedImports) {
+      const targetDomain = this.resolveTargetDomain(statement, config, sourceFilePath);
+      if (!targetDomain || targetDomain === sourceDomain) {
+        continue;
+      }
+
+      if (forbidden.includes(targetDomain)) {
+        violations.push({
+          file: sourceFilePath,
+          line: 1,
+          source_domain: sourceDomain,
+          target_domain: targetDomain,
+          imported_target: statement,
+          rule: "forbidden_dependency",
+          message: `Illegal import blocked: Domain '${sourceDomain}' is strictly forbidden from importing domain '${targetDomain}'.`,
+        });
+      } else if (config.settings.enforcement === "strict" && !allowed.includes(targetDomain)) {
+        violations.push({
+          file: sourceFilePath,
+          line: 1,
+          source_domain: sourceDomain,
+          target_domain: targetDomain,
+          imported_target: statement,
+          rule: "disallowed_dependency",
+          message: `Unlisted domain dependency: '${targetDomain}' must be explicitly added to allowed_dependencies before domain '${sourceDomain}' can import it.`,
+        });
+      }
+    }
+
+    return violations;
+  }
+
+  public resolveSourceDomain(filePath: string, config: ValidatedSeptumConfig): string | null {
+    return this.resolver.resolveSourceDomain(filePath, config);
+  }
+
+  public resolveTargetDomain(
+    targetStatement: string,
+    config: ValidatedSeptumConfig,
+    sourceFilePath?: string
+  ): string | null {
+    return this.resolver.resolveTargetDomain(targetStatement, sourceFilePath, config);
+  }
+
+  public checkFeatureTouchpoints(
+    featureKey: string,
+    targetFilePath: string,
+    config: ValidatedSeptumConfig
+  ): BoundaryViolation[] {
+    const violations: BoundaryViolation[] = [];
+    const features = config.features ?? {};
+    const featureConfig = features[featureKey];
+
+    if (!featureConfig) {
+      violations.push({
+        file: targetFilePath,
+        line: 1,
+        source_domain: "unknown",
+        target_domain: "unknown",
+        imported_target: targetFilePath,
+        rule: "unknown_feature",
+        message: `Feature '${featureKey}' is not defined in septum configuration.`,
+      });
+      return violations;
+    }
+
+    const normalizedTarget = targetFilePath.replace(/\\/g, "/").replace(/^\.\//, "");
+    const allowedTouchpoints = featureConfig.allowed_touchpoints.map((tp) =>
+      tp.replace(/\\/g, "/").replace(/^\.\//, "")
+    );
+
+    const domainCfg = config.domains[featureConfig.domain];
+    const domainRoot = domainCfg?.root ? domainCfg.root.replace(/\\/g, "/").replace(/^\.\//, "") : "";
+
+    const isAllowed = allowedTouchpoints.some((pattern) => {
+      if (pattern.endsWith("/**")) {
+        const prefix = pattern.slice(0, -3);
+        return normalizedTarget.startsWith(prefix);
+      }
+      if (pattern.endsWith("/*")) {
+        const prefix = pattern.slice(0, -2);
+        return normalizedTarget.startsWith(prefix);
+      }
+      if (normalizedTarget === pattern) return true;
+
+      if (
+        domainRoot &&
+        (normalizedTarget === `${domainRoot}/${pattern}` ||
+          normalizedTarget.startsWith(`${domainRoot}/${pattern}`))
+      ) {
+        return true;
+      }
+
+      if (pattern.includes("/") && normalizedTarget.endsWith("/" + pattern)) {
+        return true;
+      }
+
+      return false;
+    });
+
+    if (!isAllowed) {
+      violations.push({
+        file: targetFilePath,
+        line: 1,
+        source_domain: featureConfig.domain,
+        target_domain: "unknown",
+        imported_target: targetFilePath,
+        rule: "touchpoint_violation",
+        message: `Scope violation: File '${targetFilePath}' is outside the declared allowed_touchpoints for feature '${featureKey}'. Permitted: [${allowedTouchpoints.join(", ")}].`,
+      });
+    }
+
+    return violations;
+  }
+}