septum 0.1.6 → 0.1.8

package/src/cli/templates/hooks.ts

@@ -6,7 +6,7 @@ export const SEPTUM_HOOKS_CONFIG = {
         "hooks": [
           {
             "type": "command",
-            "command": "sh -c 'HOOK=\"$(git rev-parse --show-toplevel 2>/dev/null)/.agents/hooks/septum-pre-write.sh\"; if [ -f \"$HOOK\" ]; then exec \"$HOOK\"; else exit 0; fi'",
+            "command": "sh -c 'ROOT=\"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\"; if [ -f \"$ROOT/.gemini/hooks/septum-pre-write.sh\" ]; then exec \"$ROOT/.gemini/hooks/septum-pre-write.sh\"; elif [ -f \"$ROOT/.agents/hooks/septum-pre-write.sh\" ]; then exec \"$ROOT/.agents/hooks/septum-pre-write.sh\"; else exit 0; fi'",
             "timeout": 10,
           },
         ],
@@ -18,7 +18,7 @@ export const SEPTUM_HOOKS_CONFIG = {
         "hooks": [
           {
             "type": "command",
-            "command": "sh -c 'HOOK=\"$(git rev-parse --show-toplevel 2>/dev/null)/.agents/hooks/septum-post-write.sh\"; if [ -f \"$HOOK\" ]; then exec \"$HOOK\"; else exit 0; fi'",
+            "command": "sh -c 'ROOT=\"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\"; if [ -f \"$ROOT/.gemini/hooks/septum-post-write.sh\" ]; then exec \"$ROOT/.gemini/hooks/septum-post-write.sh\"; elif [ -f \"$ROOT/.agents/hooks/septum-post-write.sh\" ]; then exec \"$ROOT/.agents/hooks/septum-post-write.sh\"; else exit 0; fi'",
             "timeout": 15,
           },
         ],
@@ -38,13 +38,13 @@ fi
 
 # Delegate directly to Septum's active 3-gate hook engine
 if command -v bun >/dev/null 2>&1 && [ -f "$ROOT_DIR/bin/septum.ts" ]; then
-  exec bun run "$ROOT_DIR/bin/septum.ts" hook pre-write
+  exec bun run "$ROOT_DIR/bin/septum.ts" hook pre-write "$@"
 elif command -v septum >/dev/null 2>&1; then
-  exec septum hook pre-write
+  exec septum hook pre-write "$@"
 elif [ -f "$ROOT_DIR/node_modules/.bin/septum" ]; then
-  exec "$ROOT_DIR/node_modules/.bin/septum" hook pre-write
+  exec "$ROOT_DIR/node_modules/.bin/septum" hook pre-write "$@"
 elif command -v bunx >/dev/null 2>&1; then
-  exec bunx septum hook pre-write
+  exec bunx septum hook pre-write "$@"
 fi
 
 exit 0

package/src/cli/templates/rules.ts

@@ -8,14 +8,14 @@ export const SEPTUM_RULES_TEMPLATE = `# Septum Bounded-Context, Anti-Duplication
 
 Sebelum membuat class, fungsi, method, tipe, atau variabel/konstanta baru di file backend:
 1. **Periksa Peta Domain & Koneksi File (Compact Mode < 400 Token):**
-   Panggil \`septum_get_domain_catalog({ domain: "<nama_domain>", detail_level: "compact" })\` (atau tanpa \`domain\` untuk *Macro Semantic Map*).
+   Panggil \`septum_domain({ action: "catalog", domain: "<nama_domain>", detail_level: "compact" })\` (atau tanpa \`domain\` untuk *Macro Semantic Map*).
    * Perhatikan daftar simbol eksisting (\`class\`, \`interface\`, \`struct\`, \`function\`, \`type\`, \`constant\`, \`variable\`) beserta \`line_span\`-nya.
    * Perhatikan \`connections.imports_from\` (file mana saja yang diimpor oleh file tersebut) dan \`connections.imported_by_count\` (berapa file lain yang bergantung padanya).
-   * Jika membutuhkan daftar signature method lengkap pada satu file, panggil \`septum_get_symbol({ symbol: "<NamaSimbol>" })\` atau \`septum_get_domain_catalog({ domain: "<nama_domain>", detail_level: "full", file_filter: "<nama_file>" })\`.
+   * Jika membutuhkan daftar signature method lengkap pada satu file, panggil \`septum_symbol({ action: "inspect", query: "<NamaSimbol>" })\`.
 2. **Cari Simbol Lintas-Domain Sebelum Membuat Baru:**
-   Panggil \`septum_locate_symbol({ query: "<kata_kunci>" })\` untuk memastikan fungsi/helper/class yang ingin dibuat belum ada di codebase.
+   Panggil \`septum_symbol({ action: "locate", query: "<kata_kunci>" })\` untuk memastikan fungsi/helper/class yang ingin dibuat belum ada di codebase.
 3. **Kunci Scope pada Fitur Aktif:**
-   Jika mengerjakan fitur terdaftar, panggil \`septum_get_feature_context({ feature_key: "<nama_fitur>" })\`:
+   Jika mengerjakan fitur terdaftar, panggil \`septum_feature({ action: "get", feature_key: "<nama_fitur>" })\`:
    * **Patuhi \`allowed_touchpoints\`:** Jangan memodifikasi file di luar daftar touchpoint fitur aktif.
    * **Gunakan ulang \`reuse_symbols\`:** Wajib mengimpor dan memakai kembali simbol yang terdaftar di \`reuse_symbols\`.
 
@@ -26,11 +26,11 @@ Sebelum membuat class, fungsi, method, tipe, atau variabel/konstanta baru di fil
 1. **Cek Dampak Simbol (\`inbound_callers\`):**
    Sebelum mengubah parameter/return signature atau menghapus class/fungsi/method publik, wajib panggil:
    \`\`\`json
-   septum_get_symbol_impact({ "symbol": "NamaClassAtauFungsi" })
+   septum_symbol({ "action": "impact", "query": "NamaClassAtauFungsi" })
    \`\`\`
    Periksa seluruh \`inbound_callers\` (termasuk *named imports* lintas file) agar tidak memutus kontrak file pemanggil.
 2. **Telusuri Vertical Slice (Default Depth 5, Max Depth 8):**
-   Gunakan \`septum_trace_vertical_slice({ query: "<route|command|handler>", max_depth: 5 })\` (naikkan hingga \`max_depth: 8\` untuk alur Event/Job/Queue berlapis) guna memahami rantai eksekusi dari Ingress hingga Repository/Entity.
+   Gunakan \`septum_slice({ query: "<route|command|handler>", max_depth: 5 })\` (naikkan hingga \`max_depth: 8\` untuk alur Event/Job/Queue berlapis) guna memahami rantai eksekusi dari Ingress hingga Repository/Entity.
 
 ---
 
@@ -38,13 +38,13 @@ Sebelum membuat class, fungsi, method, tipe, atau variabel/konstanta baru di fil
 
 1. **Sebelum Menulis Import Lintas-Domain (\`write_to_file\` / \`replace_file_content\`):**
    \`\`\`json
-   septum_check_boundary({
+   septum_boundary({
      "file_path": "path/ke/file.ts",
      "proposed_imports": ["../other-domain/service"],
      "feature_key": "opsional_feature_key"
    })
    \`\`\`
 2. **Audit Menyeluruh & Deteksi Siklus (\`circular_dependency\`):**
-   Jalankan \`septum_check_boundary({ scope: "staged" })\` atau \`septum_check_boundary({ scope: "all" })\` setelah menyelesaikan perubahan multi-file. Jika status \`rejected\` (\`forbidden_dependency\`, \`disallowed_dependency\`, \`touchpoint_violation\`, atau \`circular_dependency\`), batalkan/perbaiki arsitektur import sebelum melakukan commit.
+   Jalankan \`septum_boundary({ scope: "staged" })\` atau \`septum_boundary({ scope: "all" })\` setelah menyelesaikan perubahan multi-file. Jika status \`rejected\` (\`forbidden_dependency\`, \`disallowed_dependency\`, \`touchpoint_violation\`, atau \`circular_dependency\`), batalkan/perbaiki arsitektur import sebelum melakukan commit.
 `;
 

package/src/cli/templates/skill.ts

@@ -20,22 +20,15 @@ description: Framework-agnostic codebase discovery, multi-language AST symbol &
 
 ---
 
-## 2. Referensi Cepat 12 Tool MCP Septum (Standardized \`snake_case\` Contracts)
+## 2. Referensi Cepat 5 Unified Tools MCP Septum (Standardized \`snake_case\` Contracts)
 
 | Tool MCP | Parameter Utama (\`snake_case\`) | Fungsi & Kapan Digunakan |
 |---|---|---|
-| **\`septum_get_domain_catalog\`** | \`{ domain?, detail_level?: "compact"\\|"full", archetype_filter?, file_filter? }\` | Tanpa \`domain\`: menampilkan *Macro Semantic Map* seluruh proyek. Dengan \`domain\`: menampilkan daftar file, \`connections\` (\`imports_from\`, \`imported_by_count\`), dan simbol di domain tersebut (\`compact\` default < 400 token). |
-| **\`septum_locate_symbol\`** | \`{ query, domain?, limit?: 10 }\` | Mencari lokasi file dan baris (\`line_start\`-\`line_end\`) dari class, fungsi, method (\`Class::method\`), struct, atau konstanta. |
-| **\`septum_get_symbol\`** | \`{ symbol, domain?, include_dependencies?: true }\` | Mengekstrak detail kontrak simbol: signature, \`exact_range\`, \`dependencies_injected\`, \`outbound_calls\`, \`sibling_methods\`, dan \`connected_files\`. |
-| **\`septum_get_symbol_impact\`** | \`{ symbol }\` | Menghitung *blast radius* (\`inbound_callers\`, \`total_dependents\`, \`risk_level\`) termasuk pelacakan *named imports* lintas file sebelum mengubah signature. |
-| **\`septum_trace_vertical_slice\`** | \`{ query, max_depth?: 5 }\` | Menelusuri alur eksekusi end-to-end (\`Ingress ➔ Validation ➔ Controller ➔ Service ➔ Repository ➔ Entity\`). \`max_depth\` default \`5\`, rentang \`1..8\` (gunakan \`6..8\` untuk deep trace Event/Job/Queue). |
-| **\`septum_check_boundary\`** | \`{ file_path?, file_paths?, proposed_imports?, feature_key?, scope?: "file"\\|"all"\\|"staged"\\|"domain", domain? }\` | **Pre-Write:** memvalidasi \`proposed_imports\` pada \`file_path\`. **Macro Audit:** panggil dengan \`{ scope: "all" }\` atau \`{ scope: "staged" }\` untuk mengaudit seluruh batas domain & *circular dependencies*. |
-| **\`septum_get_symbol_hotspots\`** | \`{ domain?, min_lines?: 30, min_nesting?, kind?, limit?: 30, sort_by?: "risk_score" }\` | Mengidentifikasi fungsi/class paling kompleks berdasarkan \`risk_score\` (\`line_count\` $\\times$ \`nesting_depth\`). |
-| **\`septum_get_feature_context\`** | \`{ feature_key? }\` | Mengambil konteks fitur aktif (\`allowed_touchpoints\`, \`reuse_symbols\`, input/output contract). |
-| **\`septum_clear_feature_context\`** | \`{}\` | Melepaskan kunci sesi fitur aktif di \`.septum/session.json\`. |
-| **\`septum_register_domain\`** | \`{ domain, root, description?, allowed_dependencies?, forbidden_dependencies?, archetypes?, ingest_now?: true }\` | Mendaftarkan atau memperbarui bounded-context domain langsung ke SQLite SSOT (\`.septum/septum.db\`). |
-| **\`septum_register_feature\`** | \`{ feature_key, domain, description?, allowed_touchpoints?, reuse_symbols?, input_contract?, output_contract? }\` | Mendaftarkan kontrak fitur baru ke SQLite SSOT dan mengaktifkan sesi *touchpoint lock*. |
-| **\`septum_get_environment_topology\`** | \`{ resolve?, resolveNode?, refresh? }\` | Memetakan 6-layer topologi infrastruktur (\`EDGE\`, \`GATEWAY\`, \`HOST\`, \`RUNTIME\`, \`STORAGE\`, \`TELEMETRY\`) beserta invarian lintas-layer. |
+| **\`septum_domain\`** | \`{ action?: "catalog"\\|"register"\\|"topology", domain?, detail_level?: "compact"\\|"full", archetype_filter?, file_filter?, root?, allowed_dependencies?, forbidden_dependencies?, ingest_now?, resolve?, resolve_node? }\` | Mengelola arsitektur makro, topologi domain, pendaftaran bounded-context, dan plane infrastruktur 6-layer. Default \`action: "catalog"\` (< 400 token). |
+| **\`septum_symbol\`** | \`{ action?: "locate"\\|"inspect"\\|"impact"\\|"hotspots", query?, symbol?, domain?, include_dependencies?: true, min_lines?: 30, min_nesting?, sort_by?: "risk_score", limit?: 10 }\` | Unified Symbol Engine: mencari simbol (\`locate\`), inspeksi detail kontrak & signature (\`inspect\`), hitung blast radius & pemanggil (\`impact\`), atau isolasi fungsi kompleks & SRP smell (\`hotspots\`). |
+| **\`septum_slice\`** | \`{ query, max_depth?: 5 }\` | Menelusuri alur eksekusi end-to-end (\`Ingress ➔ Validation ➔ Controller ➔ Service ➔ Repository ➔ Entity\`). \`max_depth\` default \`5\`, rentang \`1..8\` (gunakan \`6..8\` untuk deep trace Event/Job/Queue). |
+| **\`septum_boundary\`** | \`{ scope?: "file"\\|"all"\\|"staged"\\|"domain", file_path?, file_paths?, proposed_imports?, feature_key?, domain? }\` | Pre-flight boundary check memvalidasi \`proposed_imports\` sebelum menulis file, serta audit repo-wide atau git-staged untuk mencegah pelanggaran batas domain dan *circular dependency*. |
+| **\`septum_feature\`** | \`{ action?: "get"\\|"lock"\\|"release", feature_key?, domain?, allowed_touchpoints?, reuse_symbols?, force? }\` | Mengelola konteks fitur: ambil detail fitur (\`get\`), kunci sesi touchpoint di \`.septum/session.json\` (\`lock\`), atau lepaskan kunci sesi (\`release\`). |
 
 ---
 
@@ -47,8 +40,8 @@ description: Framework-agnostic codebase discovery, multi-language AST symbol &
 Gunakan alur 4 langkah ini saat merancang domain baru, melakukan *re-mapping* arsitektur, atau mengunci kontrak fitur:
 
 ### Langkah 1: Topological & Connectivity Scan (Maksimal 2 Tool Call)
-1. Panggil \`septum_get_domain_catalog({})\` untuk memeriksa *Telescope View* dan daftar domain yang terdaftar.
-2. Panggil \`septum_get_domain_catalog({ domain: "<target>", detail_level: "compact" })\` untuk memetakan file, simbol yang sudah ada, dan koneksi \`imports_from\` / \`imported_by_count\`.
+1. Panggil \`septum_domain({ action: "catalog" })\` untuk memeriksa *Telescope View* dan daftar domain yang terdaftar.
+2. Panggil \`septum_domain({ action: "catalog", domain: "<target>", detail_level: "compact" })\` untuk memetakan file, simbol yang sudah ada, dan koneksi \`imports_from\` / \`imported_by_count\`.
 
 ### Langkah 2: Perumusan Kontrak Domain & Anti-Duplikasi Simbol
 * **\`domain\` & \`root\`:** Nama domain dan direktori kanonikalnya.
@@ -56,10 +49,10 @@ Gunakan alur 4 langkah ini saat merancang domain baru, melakukan *re-mapping* ar
 * **\`reuse_symbols\`:** Daftar class, service, repository, atau konstanta eksisting yang **wajib digunakan kembali** agar agen tidak membuat kode duplikat.
 
 ### Langkah 3: Registrasi Deterministik ke SQLite SSOT
-1. Gunakan \`septum_register_domain({ domain, root, allowed_dependencies, forbidden_dependencies, ingest_now: true })\` untuk menyimpan batas domain.
-2. Gunakan \`septum_register_feature({ feature_key, domain, allowed_touchpoints, reuse_symbols })\` untuk mengunci fokus pengerjaan fitur.
+1. Gunakan \`septum_domain({ action: "register", domain, root, allowed_dependencies, forbidden_dependencies, ingest_now: true })\` untuk menyimpan batas domain.
+2. Gunakan \`septum_feature({ action: "lock", feature_key, domain, allowed_touchpoints, reuse_symbols })\` untuk mengunci fokus pengerjaan fitur.
 
 ### Langkah 4: Verifikasi Boundary & Siklus Dependensi
-Jalankan \`septum_check_boundary({ scope: "all" })\` (atau CLI \`septum check --staged\`) untuk memastikan 0 pelanggaran batas domain dan 0 *circular dependency*.
+Jalankan \`septum_boundary({ scope: "all" })\` (atau CLI \`septum check --staged\`) untuk memastikan 0 pelanggaran batas domain dan 0 *circular dependency*.
 `;
 

package/src/cli/ui/prompts.ts

@@ -0,0 +1,122 @@
+import * as readline from "node:readline";
+import type { HarnessOption } from "../scaffold/harness-config.ts";
+
+const RESET = "\x1b[0m";
+const BOLD = "\x1b[1m";
+const DIM = "\x1b[2m";
+const CYAN = "\x1b[36m";
+const GREEN = "\x1b[32m";
+const YELLOW = "\x1b[33m";
+const HIDE_CURSOR = "\x1b[?25l";
+const SHOW_CURSOR = "\x1b[?25h";
+
+export async function promptSelectHarnesses(options: HarnessOption[]): Promise<string[]> {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    // Non-interactive fallback (CI/scripts/piped): return default selections
+    return options.filter((o) => o.selectedByDefault).map((o) => o.id);
+  }
+
+  const selected = new Set<string>(
+    options.filter((o) => o.selectedByDefault).map((o) => o.id)
+  );
+  let cursor = 0;
+
+  process.stdout.write(HIDE_CURSOR);
+
+  function render(firstTime: boolean = false) {
+    if (!firstTime) {
+      // Move up by number of options + header lines
+      readline.moveCursor(process.stdout, 0, -(options.length + 2));
+    }
+
+    readline.clearLine(process.stdout, 0);
+    console.log(
+      `${CYAN}◇${RESET}  ${BOLD}Select AI Agent Harnesses for this project:${RESET} ${DIM}(Space: toggle, Enter: confirm, 'a': all)${RESET}`
+    );
+    readline.clearLine(process.stdout, 0);
+    console.log(`${CYAN}│${RESET}`);
+
+    for (let i = 0; i < options.length; i++) {
+      const opt = options[i];
+      const isCurrent = i === cursor;
+      const isChecked = selected.has(opt.id);
+
+      const pointer = isCurrent ? `${CYAN}❯${RESET}` : " ";
+      const box = isChecked ? `${GREEN}[●]${RESET}` : `${DIM}[○]${RESET}`;
+      const name = isCurrent ? `${BOLD}${opt.name}${RESET}` : opt.name;
+      const file = `${DIM}(${opt.targetFile})${RESET}`;
+
+      readline.clearLine(process.stdout, 0);
+      console.log(`${CYAN}│${RESET}  ${pointer} ${box} ${name.padEnd(26)} ${file}`);
+    }
+  }
+
+  render(true);
+
+  return new Promise<string[]>((resolve) => {
+    readline.emitKeypressEvents(process.stdin);
+    const wasRaw = process.stdin.isRaw;
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+
+    const onKeypress = (str: string, key: readline.Key) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        process.exit(130);
+      }
+
+      if (key.name === "up" || key.name === "k") {
+        cursor = (cursor - 1 + options.length) % options.length;
+        render();
+      } else if (key.name === "down" || key.name === "j") {
+        cursor = (cursor + 1) % options.length;
+        render();
+      } else if (key.name === "space") {
+        const id = options[cursor].id;
+        if (selected.has(id)) {
+          selected.delete(id);
+        } else {
+          selected.add(id);
+        }
+        render();
+      } else if (str === "a" || str === "A") {
+        if (selected.size === options.length) {
+          selected.clear();
+        } else {
+          for (const opt of options) selected.add(opt.id);
+        }
+        render();
+      } else if (key.name === "return" || key.name === "enter") {
+        cleanup();
+        // Clear prompt display and print finalized selection summary
+        readline.moveCursor(process.stdout, 0, -(options.length + 2));
+        for (let i = 0; i < options.length + 2; i++) {
+          readline.clearLine(process.stdout, 0);
+          readline.moveCursor(process.stdout, 0, 1);
+        }
+        readline.moveCursor(process.stdout, 0, -(options.length + 2));
+
+        const names = options
+          .filter((o) => selected.has(o.id))
+          .map((o) => o.name)
+          .join(", ");
+        console.log(
+          `${GREEN}✓${RESET}  ${BOLD}Configured AI Harnesses:${RESET} ${names || `${YELLOW}None (skipped)${RESET}`}`
+        );
+        console.log(`${CYAN}│${RESET}`);
+
+        resolve(Array.from(selected));
+      }
+    };
+
+    function cleanup() {
+      process.stdin.removeListener("keypress", onKeypress);
+      process.stdin.setRawMode(wasRaw);
+      process.stdin.pause();
+      process.stdout.write(SHOW_CURSOR);
+    }
+
+    process.stdin.on("keypress", onKeypress);
+  });
+}
+

package/src/core/boundary/evaluator.ts

@@ -1,4 +1,4 @@
-import { posix } from "node:path";
+import { posix, relative, resolve, isAbsolute } from "node:path";
 import type { BoundaryViolation } from "../../types/index.ts";
 import type { ValidatedSeptumConfig } from "../config/schema.ts";
 import { ConfigLoader } from "../config/loader.ts";
@@ -105,7 +105,8 @@ export class BoundaryEvaluator {
       target: string;
       statement: string;
       is_external: boolean;
-    }>
+    }>,
+    relevantFiles?: ReadonlySet<string>
   ): BoundaryViolation[] {
     const violations: BoundaryViolation[] = [];
     const allDependencies = preloadedDeps ?? this.repo.getAllDependenciesWithDomains();
@@ -158,6 +159,7 @@ export class BoundaryEvaluator {
     };
 
     type EdgeMeta = {
+      files: Set<string>;
       file: string;
       line: number;
       source_domain: string;
@@ -182,6 +184,7 @@ export class BoundaryEvaluator {
         }
         if (!outMap.has(targetDomain)) {
           outMap.set(targetDomain, {
+            files: new Set([dep.source_file]),
             file: dep.source_file,
             line: dep.line_number,
             source_domain: dep.source_domain,
@@ -189,6 +192,7 @@ export class BoundaryEvaluator {
             target: dep.target,
           });
         }
+        outMap.get(targetDomain)!.files.add(dep.source_file);
       }
 
       // 2. File-to-file edge
@@ -201,6 +205,7 @@ export class BoundaryEvaluator {
         }
         if (!outMap.has(targetFile)) {
           outMap.set(targetFile, {
+            files: new Set([dep.source_file]),
             file: dep.source_file,
             line: dep.line_number,
             source_domain: dep.source_domain,
@@ -245,6 +250,8 @@ export class BoundaryEvaluator {
               if (cycleStartIndex !== -1) {
                 const cycleNodes = stack.slice(cycleStartIndex);
                 const sig = canonicalizeCycle(cycleNodes);
+                const cycleEdges = cycleNodes.map((source, index) => graph.get(source)?.get(cycleNodes[(index + 1) % cycleNodes.length]));
+                if (relevantFiles && !cycleEdges.some(edge => edge && [...edge.files].some(file => relevantFiles.has(file)))) continue;
                 if (!reportedCycles.has(sig)) {
                   reportedCycles.add(sig);
                   const firstNode = cycleNodes[0];
@@ -378,39 +385,28 @@ export class BoundaryEvaluator {
       return violations;
     }
 
-    const normalizedTarget = targetFilePath.replace(/\\/g, "/").replace(/^\.\//, "");
+    const root = this.resolver.getProjectRoot();
+    const normalizedTarget = relative(root, resolve(root, targetFilePath.replace(/\\/g, "/"))).replace(/\\/g, "/");
     const allowedTouchpoints = featureConfig.allowed_touchpoints.map((tp) =>
-      tp.replace(/\\/g, "/").replace(/^\.\//, "")
+      isAbsolute(tp) ? relative(root, tp).replace(/\\/g, "/") : posix.normalize(tp.replace(/\\/g, "/"))
     );
 
     const domainCfg = config.domains[featureConfig.domain];
     const domainRoot = domainCfg?.root ? domainCfg.root.replace(/\\/g, "/").replace(/^\.\//, "") : "";
 
-    const isAllowed = allowedTouchpoints.some((pattern) => {
+    const matches = (pattern: string): boolean => {
       if (pattern.endsWith("/**")) {
-        const prefix = pattern.slice(0, -3);
-        return normalizedTarget.startsWith(prefix);
+        return normalizedTarget.startsWith(pattern.slice(0, -3) + "/");
       }
       if (pattern.endsWith("/*")) {
-        const prefix = pattern.slice(0, -2);
-        return normalizedTarget.startsWith(prefix);
+        const prefix = pattern.slice(0, -2) + "/";
+        return normalizedTarget.startsWith(prefix) && !normalizedTarget.slice(prefix.length).includes("/");
       }
-      if (normalizedTarget === pattern) return true;
-
-      if (
-        domainRoot &&
-        (normalizedTarget === `${domainRoot}/${pattern}` ||
-          normalizedTarget.startsWith(`${domainRoot}/${pattern}`))
-      ) {
-        return true;
-      }
-
-      if (pattern.includes("/") && normalizedTarget.endsWith("/" + pattern)) {
-        return true;
-      }
-
-      return false;
-    });
+      return normalizedTarget === pattern;
+    };
+    const isAllowed = allowedTouchpoints.some(pattern =>
+      matches(pattern) || Boolean(domainRoot && matches(posix.normalize(`${domainRoot}/${pattern}`)))
+    );
 
     if (!isAllowed) {
       violations.push({

package/src/core/boundary/staged-auditor.ts

@@ -0,0 +1,50 @@
+import { RESOURCE_LIMITS } from "../resources/limits.ts";
+import { execFileSync } from "node:child_process";
+import { resolve } from "node:path";
+import type { BoundaryViolation } from "../../types/index.ts";
+import type { ValidatedSeptumConfig } from "../config/schema.ts";
+import { ASTParserEngine } from "../parser/tree-sitter.ts";
+import type { SeptumRepository } from "../database/repository.ts";
+import type { BoundaryEvaluator } from "./evaluator.ts";
+
+export async function auditStagedFiles(
+  evaluator: BoundaryEvaluator,
+  config: ValidatedSeptumConfig,
+  workspaceRoot: string,
+  featureKey?: string,
+  repo?: SeptumRepository
+): Promise<{ files: string[]; violations: BoundaryViolation[] }> {
+  const output = execFileSync("git", ["diff", "--cached", "--name-only", "--diff-filter=ACMR", "-z"], {
+    cwd: workspaceRoot, encoding: "utf-8", timeout: 5000, maxBuffer: 10 * 1024 * 1024,
+  });
+  const files = output.split("\0").filter(Boolean);
+  const deletedOutput = execFileSync("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], {
+    cwd: workspaceRoot, encoding: "utf-8", timeout: 5000, maxBuffer: 10 * 1024 * 1024,
+  });
+  const deleted = deletedOutput.split("\0").filter(Boolean);
+  const violations: BoundaryViolation[] = [];
+  if (featureKey) for (const file of deleted) violations.push(...evaluator.checkFeatureTouchpoints(featureKey, file, config));
+  const stagedDependencies: ReturnType<SeptumRepository["getAllDependenciesWithDomains"]> = [];
+  const parser = new ASTParserEngine();
+  for (const file of files) {
+    if (featureKey) violations.push(...evaluator.checkFeatureTouchpoints(featureKey, file, config));
+    if (!ASTParserEngine.isSourceFile(file) || !evaluator.resolveSourceDomain(file, config)) continue;
+    const size = Number(execFileSync("git", ["cat-file", "-s", `:${file}`], {cwd:workspaceRoot,encoding:"utf8",timeout:5000,maxBuffer:1024}));
+    if (!Number.isFinite(size) || size > RESOURCE_LIMITS.sourceBytes) throw new Error(`Staged source exceeds resource limit: '${file}'.`);
+    const content = execFileSync("git", ["show", `:${file}`], {
+      cwd: workspaceRoot, encoding: "utf-8", timeout: 5000, maxBuffer: RESOURCE_LIMITS.sourceBytes + 1,
+    });
+    const parsed = await parser.parseFile(resolve(workspaceRoot, file), content);
+    if (parsed.status === "unsupported" || parsed.status === "degraded") {
+      throw new Error(`Cannot reliably parse staged file '${file}': ${parsed.status}.`);
+    }
+    for (const dependency of parsed.dependencies) {
+      stagedDependencies.push({ source_file: file, source_domain: evaluator.resolveSourceDomain(file, config)!, target: dependency.target, statement: dependency.statement, line_number: dependency.line_number, is_external: dependency.is_external });
+      violations.push(...evaluator.checkProposedChanges(file, [dependency.target], config).map(violation => ({ ...violation, line: dependency.line_number })));
+    }
+  }
+  const staged = new Set([...files, ...deleted]);
+  const baseline = (repo?.getAllDependenciesWithDomains() || []).filter(dependency => !staged.has(dependency.source_file));
+  violations.push(...evaluator.detectCircularDependencies(config, [...baseline, ...stagedDependencies], staged));
+  return { files: Array.from(staged), violations };
+}

package/src/core/config/loader.ts

@@ -65,20 +65,23 @@ export class ConfigLoader {
   public static loadFromRepository(repo: SeptumRepository): ValidatedSeptumConfig {
     const config = ConfigLoader.getDefaultConfig();
     if (repo && typeof repo.getAllDomains === "function") {
-      try {
-        const rows = repo.getAllDomains();
-        for (const r of rows) {
-          config.domains[r.name] = {
-            root: r.root_path,
-            allowed_dependencies: JSON.parse(r.allowed_deps_json || "[]"),
-            forbidden_dependencies: JSON.parse(r.forbidden_deps_json || "[]"),
-            archetypes: JSON.parse(r.archetypes_json || "{}"),
-          };
-        }
-      } catch {
-        // Fallback gracefully to default config
+      const rows = repo.getAllDomains();
+      for (const row of rows) {
+        config.domains[row.name] = {
+          root: row.root_path,
+          allowed_dependencies: JSON.parse(row.allowed_deps_json || "[]"),
+          forbidden_dependencies: JSON.parse(row.forbidden_deps_json || "[]"),
+          archetypes: JSON.parse(row.archetypes_json || "{}"),
+        };
       }
     }
+
+    if (typeof repo?.getMeta === "function") {
+      const features = repo.getMeta("features_json");
+      if (features) config.features = JSON.parse(features);
+      const settings = repo.getMeta("settings_json");
+      if (settings) Object.assign(config.settings, JSON.parse(settings));
+    }
     return config;
   }
 
@@ -95,20 +98,14 @@ export class ConfigLoader {
           )
           .get("domains");
 
-        if (tables) {
-          const rows = db.query<any, []>("SELECT * FROM domains").all();
-          for (const r of rows) {
-            config.domains[r.name] = {
-              root: r.root_path,
-              allowed_dependencies: JSON.parse(r.allowed_deps_json || "[]"),
-              forbidden_dependencies: JSON.parse(r.forbidden_deps_json || "[]"),
-              archetypes: JSON.parse(r.archetypes_json || "{}"),
-            };
-          }
+        try {
+          if (tables) Object.assign(config, ConfigLoader.loadFromRepository(new SeptumRepository(db)));
+          config.settings.db_path = dbPath;
+        } finally {
+          db.close();
         }
-        db.close();
       } catch {
-        // Fallback gracefully to default config
+        throw new Error(`Cannot load Septum configuration from '${dbPath}'.`);
       }
     }
 

package/src/core/database/client.ts

@@ -41,4 +41,12 @@ export class SeptumDatabase {
   public transaction<T>(fn: () => T): T {
     return this.db.transaction(fn)();
   }
+
+  public checkpoint(): void {
+    try {
+      this.db.run("PRAGMA wal_checkpoint(PASSIVE);");
+    } catch {
+      // Ignore if locked or busy
+    }
+  }
 }

package/src/core/database/repositories/dependency.repository.ts

@@ -1,5 +1,5 @@
 import * as fs from "node:fs";
-import { dirname, join, posix } from "node:path";
+import { dirname, join, posix, resolve } from "node:path";
 import type { Database } from "bun:sqlite";
 import type {
   ExtractedDependency,
@@ -249,7 +249,10 @@ export class DependencyRepository {
     );
   }
 
-  public getSymbolImpact(symbolQuery: string): GetSymbolImpactResponse {
+  public getSymbolImpact(
+    symbolQuery: string,
+    options: { domain?: string; workspaceRoot?: string } = {}
+  ): GetSymbolImpactResponse {
     const trimmed = symbolQuery.trim();
     if (!trimmed) {
       return {
@@ -258,7 +261,7 @@ export class DependencyRepository {
         warning: "Empty symbol query provided.",
         impact_summary: {
           total_dependents: 0,
-          risk_level: "low",
+          risk_level: "unknown",
           affected_files_count: 0,
         },
         inbound_callers: [],
@@ -277,15 +280,75 @@ export class DependencyRepository {
       targetMethod = parts[1];
     }
 
-    // 1. Look up target symbol in symbols joined with files to find its defining file_path & stem
-    const targetSymRows = this.db
-      .query<{ name: string; file_path: string }, [string, string, string, string]>(
-        `SELECT s.name, f.path AS file_path
-         FROM symbols s
-         JOIN files f ON s.file_id = f.id
-         WHERE s.name = ? OR s.name = ? OR s.name LIKE ? OR s.name LIKE ?`
-      )
-      .all(trimmed, targetContainer, `${targetContainer}::%`, `%::${targetContainer}`);
+    // 1. Look up target symbol in symbols joined with files and optionally domains
+    let targetSymRows: Array<{ name: string; file_path: string }>;
+    if (targetMethod) {
+      let methodSql = `
+        SELECT s.name, s.signature, f.path AS file_path
+        FROM symbols s
+        JOIN files f ON s.file_id = f.id
+      `;
+      const methodParams: any[] = [];
+      if (options.domain) {
+        methodSql += ` JOIN domains dom ON f.domain_id = dom.id WHERE LOWER(dom.name) = LOWER(?) AND `;
+        methodParams.push(options.domain);
+      } else {
+        methodSql += ` WHERE `;
+      }
+      methodSql += ` (s.name = ? OR s.name = ? OR (s.name = ? AND s.kind = 'method')) `;
+      methodParams.push(trimmed, `${targetContainer}::${targetMethod}`, targetMethod);
+      targetSymRows = this.db.query<{ name: string; signature: string; file_path: string }, any[]>(methodSql).all(...methodParams)
+        .filter(row => {
+          if (row.name !== targetMethod) return true;
+          // Go indexes bare method names; the receiver in its signature proves identity.
+          const receiver = row.signature.match(/^func\s*\(\s*(?:[A-Za-z_]\w*\s+)?\*?([A-Za-z_]\w*)(?:\[[^\]]+\])?\s*\)/);
+          return receiver?.[1] === targetContainer;
+        });
+
+      if (targetSymRows.length === 0) {
+        return {
+          target_symbol: trimmed,
+          found_in_index: false,
+          warning: `Symbol '${trimmed}' was not found in Septum index${options.domain ? ` for domain '${options.domain}'` : ""}. Method does not exist.`,
+          impact_summary: {
+            total_dependents: 0,
+            risk_level: "unknown",
+            affected_files_count: 0,
+          },
+          inbound_callers: [],
+        };
+      }
+    } else {
+      let containerSql = `
+        SELECT s.name, f.path AS file_path
+        FROM symbols s
+        JOIN files f ON s.file_id = f.id
+      `;
+      const containerParams: any[] = [];
+      if (options.domain) {
+        containerSql += ` JOIN domains dom ON f.domain_id = dom.id WHERE LOWER(dom.name) = LOWER(?) AND `;
+        containerParams.push(options.domain);
+      } else {
+        containerSql += ` WHERE `;
+      }
+      containerSql += ` (s.name = ? OR s.name = ? OR s.name LIKE ? OR s.name LIKE ?) `;
+      containerParams.push(trimmed, targetContainer, `${targetContainer}::%`, `%::${targetContainer}`);
+      targetSymRows = this.db.query<{ name: string; file_path: string }, any[]>(containerSql).all(...containerParams);
+
+      if (targetSymRows.length === 0) {
+        return {
+          target_symbol: trimmed,
+          found_in_index: false,
+          warning: `Symbol '${trimmed}' was not found in Septum index${options.domain ? ` for domain '${options.domain}'` : ""}.`,
+          impact_summary: {
+            total_dependents: 0,
+            risk_level: "unknown",
+            affected_files_count: 0,
+          },
+          inbound_callers: [],
+        };
+      }
+    }
 
     const definingFiles = new Set<string>(
       targetSymRows.map((r) => r.file_path.replace(/\\/g, "/"))
@@ -415,8 +478,9 @@ export class DependencyRepository {
     if (targetMethod) {
       for (const filePath of uniqueCallerFiles) {
         try {
-          if (fs.existsSync(filePath)) {
-            const content = fs.readFileSync(filePath, "utf-8");
+          const fullPath = options.workspaceRoot ? resolve(options.workspaceRoot, filePath) : filePath;
+          if (fs.existsSync(fullPath)) {
+            const content = fs.readFileSync(fullPath, "utf-8");
             const lines = content.split(/\r?\n/);
             for (let i = 0; i < lines.length; i++) {
               const line = lines[i];
@@ -463,7 +527,7 @@ export class DependencyRepository {
     const foundInIndex = targetSymRows.length > 0 || depRows.length > 0;
     const warning = foundInIndex
       ? undefined
-      : `Symbol '${trimmed}' was not found in Septum index (neither in declared symbols nor tracked dependencies). Risk assessment defaults to low (0 callers) due to unindexed status.`;
+      : `Symbol '${trimmed}' was not found in Septum index (neither in declared symbols nor tracked dependencies). Risk cannot be assessed without index evidence.`;
 
     return {
       target_symbol: trimmed,
@@ -471,7 +535,7 @@ export class DependencyRepository {
       warning,
       impact_summary: {
         total_dependents: inboundCallers.length,
-        risk_level: riskLevel,
+        risk_level: foundInIndex ? riskLevel : "unknown",
         affected_files_count: affectedFiles.size,
       },
       inbound_callers: inboundCallers,