tribunal-kit 9.2.6 → 9.2.7

package/.agent/scripts/architecture_extractor.js

@@ -1,753 +1,792 @@
-#!/usr/bin/env node
-/**
- * architecture_extractor.js — Tribunal Architecture Fact Extractor
- * ═════════════════════════════════════════════════════════════════════════════
- * Deterministic static analysis engine that extracts the full Tribunal
- * Architectural Fact Model (TAFM) directly from repository source code.
- *
- * Extracts:
- *   - Services, Modules, and Entry Points
- *   - HTTP / API Endpoints (Express, Next.js, Fastify, Hono, Koa)
- *   - Data Stores & Queries (Prisma, Drizzle, Mongoose, Sequelize, Raw SQL, Redis)
- *   - Message Queues & Events (BullMQ, RabbitMQ, Kafka, EventEmitters)
- *   - External Services (fetch, axios, Stripe, AWS SDK, Firebase, SendGrid)
- *   - Authentication Boundaries (JWT, next-auth, Passport, Clerk, bcrypt)
- *   - Call-graphs, Failure Modes (try/catch, timeouts, retries), and Trust Zones
- *
- * Emits: .agent/history/architecture-model.json with verifiable provenance & L1-L3 confidence.
- * Zero external dependencies.
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-const { GREEN, CYAN, BOLD, DIM, RESET, BOX, banner, timer, formatMs } = require('./_colors');
-
-// ── Default Exclusions ────────────────────────────────────────────────────────
-const EXCLUDED_DIRS = new Set([
-  'node_modules',
-  '.git',
-  '.next',
-  'dist',
-  'build',
-  'coverage',
-  '.agent',
-  '.agents',
-  'archify',
-  'artifacts',
-  'target',
-]);
-
-const SUPPORTED_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.go', '.rs']);
-
-// ── Helpers ───────────────────────────────────────────────────────────────────
-function getSha256(content) {
-  return crypto.createHash('sha256').update(content).digest('hex');
-}
-
-function normalizePosixPath(filePath) {
-  return filePath.replace(/\\/g, '/');
-}
-
-function walkRepository(dir, rootDir = dir, results = []) {
-  if (!fs.existsSync(dir)) return results;
-  let entries;
-  try {
-    entries = fs.readdirSync(dir, { withFileTypes: true });
-  } catch (_e) {
-    return results;
-  }
-
-  for (const entry of entries) {
-    const fullPath = path.join(dir, entry.name);
-    const relPath = normalizePosixPath(path.relative(rootDir, fullPath));
-
-    if (entry.isDirectory()) {
-      if (!EXCLUDED_DIRS.has(entry.name) && !entry.name.startsWith('.')) {
-        walkRepository(fullPath, rootDir, results);
-      }
-    } else if (entry.isFile()) {
-      const ext = path.extname(entry.name).toLowerCase();
-      if (SUPPORTED_EXTS.has(ext)) {
-        results.push({ fullPath, relPath, ext });
-      }
-    }
-  }
-  return results;
-}
-
-// ── Extraction Patterns ───────────────────────────────────────────────────────
-const ROUTE_DETECTORS = [
-  {
-    regex: /(?:app|router|server)\.(get|post|put|patch|delete|all)\s*\(\s*['"`]([^'"`]+)['"`]/gi,
-    framework: 'express_or_fastify',
-  },
-  {
-    regex: /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(/g,
-    framework: 'nextjs_app_router',
-  },
-  {
-    regex: /\.(get|post|put|patch|delete)\s*\(\s*['"`](\/[^'"`]*)['"`]/gi,
-    framework: 'hono_or_elysia',
-  },
-];
-
-const DATASTORE_DETECTORS = [
-  {
-    regex: /prisma\.(\w+)\.(findMany|findUnique|findFirst|create|update|delete|upsert|aggregate|groupBy|count)\s*\(/g,
-    engine: 'postgres_prisma',
-    kind: 'datastore',
-  },
-  {
-    regex: /(?:db|drizzle)\.(select|insert|update|delete)\s*\(/g,
-    engine: 'sql_drizzle',
-    kind: 'datastore',
-  },
-  {
-    regex: /\.(query|execute|raw|sql)\s*\(\s*['"`]?\s*(SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|TRUNCATE)/gi,
-    engine: 'raw_sql',
-    kind: 'datastore',
-  },
-  {
-    regex: /(?:redis|ioredis|createClient)\s*\(/gi,
-    engine: 'redis_cache',
-    kind: 'cache',
-  },
-  {
-    regex: /(?:redis|client|redisClient|kv)\.(?:get|set|del|hget|hset|expire|incr|lpush|rpush|publish|subscribe)\s*\(|\.(?:hget|hset|expire|incr|lpush|rpush)\s*\(/g,
-    engine: 'redis_ops',
-    kind: 'cache',
-  },
-];
-
-const QUEUE_DETECTORS = [
-  {
-    regex: /new\s+(?:Queue|Worker|QueueScheduler)\s*\(\s*['"`](\w+)['"`]/g,
-    engine: 'bullmq',
-    kind: 'queue',
-  },
-  {
-    regex: /(?:amqplib|amqp\.connect)\s*\(/g,
-    engine: 'rabbitmq',
-    kind: 'queue',
-  },
-  {
-    regex: /new\s+Kafka\s*\(/g,
-    engine: 'kafka',
-    kind: 'queue',
-  },
-  {
-    regex: /\.(?:emit|on|once)\s*\(\s*['"`]([\w:.-]+)['"`]/g,
-    engine: 'event_emitter',
-    kind: 'event_bus',
-  },
-];
-
-const EXTERNAL_SERVICE_DETECTORS = [
-  {
-    regex: /(?:fetch|axios|got|ky|ofetch)\s*\(\s*['"`]?(https?:\/\/[^'"`\s,)]+)/gi,
-    type: 'http_client',
-  },
-  {
-    regex: /new\s+(?:AWS\.)?(?:S3|DynamoDB|SQS|SNS|Lambda|SES|CloudWatch)\s*\(/g,
-    type: 'aws_sdk',
-  },
-  {
-    regex: /@aws-sdk\/client-(\w+)/g,
-    type: 'aws_sdk',
-  },
-  {
-    regex: /(?:stripe|Stripe)\s*\(/g,
-    type: 'stripe_payments',
-  },
-  {
-    regex: /(?:sendgrid|twilio|resend)\s*/gi,
-    type: 'messaging_saas',
-  },
-];
-
-const AUTH_DETECTORS = [
-  {
-    regex: /(?:jwt|jsonwebtoken)\.(?:sign|verify|decode)\s*\(/g,
-    authKind: 'jwt',
-  },
-  {
-    regex: /(?:NextAuth|getServerSession|auth\(\)|getSession)\s*\(/g,
-    authKind: 'next_auth',
-  },
-  {
-    regex: /passport\.(?:authenticate|use|initialize)\s*\(/g,
-    authKind: 'passport',
-  },
-  {
-    regex: /(?:bcrypt|argon2)\.(?:hash|compare|verify)\s*\(/g,
-    authKind: 'password_hashing',
-  },
-  {
-    regex: /(?:clerkMiddleware|currentUser|ClerkProvider)\s*/g,
-    authKind: 'clerk',
-  },
-];
-
-const IMPORT_DETECTOR = /(?:import\s+(?:[\w*\s{},]+)\s+from\s+['"`]([^'"`]+)['"`]|require\s*\(\s*['"`]([^'"`]+)['"`]\))/g;
-
-// ── Architecture Extractor Class ──────────────────────────────────────────────
-class ArchitectureExtractor {
-  constructor(repoRoot = process.cwd()) {
-    this.repoRoot = path.resolve(repoRoot);
-    this.entities = new Map();
-    this.relations = new Map();
-    this.trustBoundaries = new Map();
-    this.failurePaths = [];
-    this.contradictions = [];
-  }
-
-  registerEntity(entity) {
-    if (!this.entities.has(entity.id)) {
-      this.entities.set(entity.id, entity);
-    } else {
-      const existing = this.entities.get(entity.id);
-      if (entity.sources && entity.sources.length) {
-        existing.sources = [...(existing.sources || []), ...entity.sources];
-      }
-    }
-    return this.entities.get(entity.id);
-  }
-
-  registerRelation(relation) {
-    const key = `${relation.sourceId}->${relation.targetId}:${relation.relationType}`;
-    if (!this.relations.has(key)) {
-      this.relations.set(key, { id: `rel.${crypto.createHash('md5').update(key).digest('hex').slice(0, 10)}`, ...relation });
-    } else {
-      const existing = this.relations.get(key);
-      if (relation.evidence) {
-        existing.evidence = [...(existing.evidence || []), ...relation.evidence];
-      }
-    }
-    return this.relations.get(key);
-  }
-
-  scan() {
-    const files = walkRepository(this.repoRoot, this.repoRoot);
-
-    // Initialize Default Trust Zones
-    this.initDefaultTrustBoundaries();
-
-    // Pass 1: Extract module entities and file contents
-    const fileDataMap = new Map();
-    for (const file of files) {
-      let content;
-      try {
-        content = fs.readFileSync(file.fullPath, 'utf8');
-      } catch (_e) {
-        continue;
-      }
-      const lines = content.split('\n');
-      const hash = getSha256(content);
-      fileDataMap.set(file.relPath, { ...file, content, lines, hash });
-
-      // Register Module Entity
-      const entityId = `mod.${file.relPath.replace(/[^a-zA-Z0-9_.-]/g, '_')}`;
-      const isTest = file.relPath.includes('test') || file.relPath.includes('spec');
-      const isRoute = file.relPath.includes('route') || file.relPath.includes('api') || file.relPath.includes('controllers');
-      const isSkill = file.relPath.startsWith('skills/') || file.relPath.startsWith('.agents/skills/');
-
-      this.registerEntity({
-        id: entityId,
-        kind: isRoute ? 'endpoint' : isTest ? 'test_suite' : 'module',
-        name: path.basename(file.relPath),
-        scope: path.dirname(file.relPath),
-        role: isSkill ? 'Skill Template / Resource' : isRoute ? 'API Route Handler' : isTest ? 'Test Suite' : 'Internal Component',
-        tags: [isTest ? 'test' : isSkill ? 'skill' : 'core', path.extname(file.relPath).replace('.', '')],
-        trustZone: isRoute ? 'dmz_gateway' : 'internal_service',
-        sources: [
-          {
-            file: file.relPath,
-            startLine: 1,
-            endLine: Math.min(lines.length, 50),
-            contentHash: hash.substring(0, 16),
-            extractionMethod: 'ast_visitor',
-            confidence: 'L1',
-            verified: true,
-            verifiedAt: new Date().toISOString(),
-          },
-        ],
-        blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.1 },
-        confidence: 'L1',
-        temporalState: 'current',
-      });
-    }
-
-    // Pass 2: Extract Architectural Features & Relationships
-    for (const [relPath, fileInfo] of fileDataMap.entries()) {
-      const sourceEntityId = `mod.${relPath.replace(/[^a-zA-Z0-9_.-]/g, '_')}`;
-      const { content, lines } = fileInfo;
-
-      // 1. Analyze Imports & Internal Call Dependencies
-      IMPORT_DETECTOR.lastIndex = 0;
-      let impMatch;
-      while ((impMatch = IMPORT_DETECTOR.exec(content)) !== null) {
-        const importTarget = impMatch[1] || impMatch[2];
-        if (importTarget && importTarget.startsWith('.')) {
-          // Local import
-          const resolvedRel = normalizePosixPath(
-            path.relative(this.repoRoot, path.resolve(path.dirname(fileInfo.fullPath), importTarget))
-          );
-          // Try finding matching file
-          const targetKey = Array.from(fileDataMap.keys()).find(
-            (k) => k === resolvedRel || k.startsWith(resolvedRel + '.') || k === resolvedRel + '/index.js' || k === resolvedRel + '/index.ts'
-          );
-
-          if (targetKey) {
-            const targetEntityId = `mod.${targetKey.replace(/[^a-zA-Z0-9_.-]/g, '_')}`;
-            const lineNum = content.slice(0, impMatch.index).split('\n').length;
-            this.registerRelation({
-              sourceId: sourceEntityId,
-              targetId: targetEntityId,
-              relationType: 'imports',
-              protocol: 'In-Memory Module',
-              evidence: [
-                {
-                  file: relPath,
-                  startLine: lineNum,
-                  endLine: lineNum,
-                  symbol: importTarget,
-                  snippet: lines[lineNum - 1]?.trim(),
-                  contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                  extractionMethod: 'ast_visitor',
-                  confidence: 'L1',
-                  verified: true,
-                  verifiedAt: new Date().toISOString(),
-                },
-              ],
-              confidence: 'L1',
-            });
-          }
-        }
-      }
-
-      // 2. Analyze API Routes (JS/TS web endpoints)
-      if (['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs'].includes(fileInfo.ext)) {
-        for (const detector of ROUTE_DETECTORS) {
-          detector.regex.lastIndex = 0;
-          let routeMatch;
-          while ((routeMatch = detector.regex.exec(content)) !== null) {
-            const method = routeMatch[1]?.toUpperCase() || 'GET';
-            const endpointPath = routeMatch[2] || `/${relPath.replace(/^src\//, '').replace(/\.[^.]+$/, '')}`;
-            const lineNum = content.slice(0, routeMatch.index).split('\n').length;
-
-            const endpointEntityId = `endpoint.${method.toLowerCase()}.${endpointPath.replace(/[^a-zA-Z0-9_.-]/g, '_')}`;
-            this.registerEntity({
-              id: endpointEntityId,
-              kind: 'endpoint',
-              name: `${method} ${endpointPath}`,
-              scope: relPath,
-              role: `Public/Internal Endpoint (${detector.framework})`,
-              tags: ['api', method.toLowerCase()],
-              trustZone: 'dmz_gateway',
-              sources: [
-                {
-                  file: relPath,
-                  startLine: lineNum,
-                  endLine: Math.min(lineNum + 10, lines.length),
-                  snippet: lines[lineNum - 1]?.trim(),
-                  contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                  extractionMethod: 'ast_visitor',
-                  confidence: 'L1',
-                  verified: true,
-                  verifiedAt: new Date().toISOString(),
-                },
-              ],
-              blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.2 },
-              confidence: 'L1',
-              temporalState: 'current',
-            });
-
-            this.registerRelation({
-              sourceId: endpointEntityId,
-              targetId: sourceEntityId,
-              relationType: 'routes_to',
-              protocol: 'HTTP',
-              evidence: [
-                {
-                  file: relPath,
-                  startLine: lineNum,
-                  endLine: lineNum,
-                  snippet: lines[lineNum - 1]?.trim(),
-                  contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                  extractionMethod: 'ast_visitor',
-                  confidence: 'L1',
-                  verified: true,
-                  verifiedAt: new Date().toISOString(),
-                },
-              ],
-              confidence: 'L1',
-            });
-          }
-        }
-      }
-
-      // 3. Analyze Data Stores (Prisma, SQL, Redis)
-      for (const detector of DATASTORE_DETECTORS) {
-        detector.regex.lastIndex = 0;
-        let dbMatch;
-        while ((dbMatch = detector.regex.exec(content)) !== null) {
-          const lineNum = content.slice(0, dbMatch.index).split('\n').length;
-          const storeId = `datastore.${detector.engine}`;
-
-          this.registerEntity({
-            id: storeId,
-            kind: detector.kind === 'cache' ? 'cache' : 'datastore',
-            name: detector.engine.toUpperCase(),
-            scope: 'storage',
-            role: `${detector.kind === 'cache' ? 'Ephemeral In-Memory Cache' : 'Persistent Relational/NoSQL Database'}`,
-            tags: ['persistence', detector.engine],
-            trustZone: 'isolated_datastore',
-            sources: [
-              {
-                file: relPath,
-                startLine: lineNum,
-                endLine: lineNum,
-                snippet: lines[lineNum - 1]?.trim(),
-                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                extractionMethod: 'ast_visitor',
-                confidence: 'L1',
-                verified: true,
-                verifiedAt: new Date().toISOString(),
-              },
-            ],
-            blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.7 },
-            confidence: 'L1',
-            temporalState: 'current',
-          });
-
-          this.registerRelation({
-            sourceId: sourceEntityId,
-            targetId: storeId,
-            relationType: detector.kind === 'cache' ? 'reads' : 'writes',
-            protocol: detector.engine.includes('redis') ? 'Redis-RESP' : 'SQL-Wire',
-            evidence: [
-              {
-                file: relPath,
-                startLine: lineNum,
-                endLine: lineNum,
-                snippet: lines[lineNum - 1]?.trim(),
-                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                extractionMethod: 'ast_visitor',
-                confidence: 'L1',
-                verified: true,
-                verifiedAt: new Date().toISOString(),
-              },
-            ],
-            confidence: 'L1',
-          });
-        }
-      }
-
-      // 4. Analyze Message Queues & Event Busses
-      for (const detector of QUEUE_DETECTORS) {
-        detector.regex.lastIndex = 0;
-        let qMatch;
-        while ((qMatch = detector.regex.exec(content)) !== null) {
-          const queueName = qMatch[1] || detector.engine;
-          const lineNum = content.slice(0, qMatch.index).split('\n').length;
-          const qEntityId = `queue.${detector.engine}.${queueName}`;
-
-          this.registerEntity({
-            id: qEntityId,
-            kind: detector.kind === 'event_bus' ? 'event_bus' : 'queue',
-            name: `${detector.engine}: ${queueName}`,
-            scope: 'async-broker',
-            role: 'Asynchronous Job Queue / Message Channel',
-            tags: ['messaging', detector.engine],
-            trustZone: 'internal_service',
-            sources: [
-              {
-                file: relPath,
-                startLine: lineNum,
-                endLine: lineNum,
-                snippet: lines[lineNum - 1]?.trim(),
-                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                extractionMethod: 'ast_visitor',
-                confidence: 'L1',
-                verified: true,
-                verifiedAt: new Date().toISOString(),
-              },
-            ],
-            blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.4 },
-            confidence: 'L1',
-            temporalState: 'current',
-          });
-
-          this.registerRelation({
-            sourceId: sourceEntityId,
-            targetId: qEntityId,
-            relationType: content.includes('.on(') || content.includes('.subscribe(') ? 'subscribes' : 'publishes',
-            protocol: detector.engine,
-            evidence: [
-              {
-                file: relPath,
-                startLine: lineNum,
-                endLine: lineNum,
-                snippet: lines[lineNum - 1]?.trim(),
-                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                extractionMethod: 'ast_visitor',
-                confidence: 'L1',
-                verified: true,
-                verifiedAt: new Date().toISOString(),
-              },
-            ],
-            confidence: 'L1',
-          });
-        }
-      }
-
-      // 5. Analyze External Services (Third-Party SaaS & Clouds)
-      for (const detector of EXTERNAL_SERVICE_DETECTORS) {
-        detector.regex.lastIndex = 0;
-        let extMatch;
-        while ((extMatch = detector.regex.exec(content)) !== null) {
-          const lineNum = content.slice(0, extMatch.index).split('\n').length;
-          const serviceName = extMatch[1] || detector.type;
-          const extEntityId = `ext.${crypto.createHash('md5').update(serviceName).digest('hex').slice(0, 8)}`;
-
-          this.registerEntity({
-            id: extEntityId,
-            kind: 'external_api',
-            name: serviceName.length > 35 ? serviceName.slice(0, 32) + '...' : serviceName,
-            scope: 'third_party',
-            role: `External Third-Party Service (${detector.type})`,
-            tags: ['external', detector.type],
-            trustZone: 'external_untrusted',
-            sources: [
-              {
-                file: relPath,
-                startLine: lineNum,
-                endLine: lineNum,
-                snippet: lines[lineNum - 1]?.trim(),
-                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                extractionMethod: 'ast_visitor',
-                confidence: 'L1',
-                verified: true,
-                verifiedAt: new Date().toISOString(),
-              },
-            ],
-            blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.3 },
-            confidence: 'L1',
-            temporalState: 'current',
-          });
-
-          // Check for Failure Resilience (try/catch, timeout, retry)
-          const surroundingContext = lines.slice(Math.max(0, lineNum - 5), Math.min(lines.length, lineNum + 5)).join('\n');
-          const hasTryCatch = surroundingContext.includes('try') || surroundingContext.includes('.catch');
-          const hasTimeout = surroundingContext.includes('timeout') || surroundingContext.includes('AbortController');
-
-          this.registerRelation({
-            sourceId: sourceEntityId,
-            targetId: extEntityId,
-            relationType: 'calls',
-            protocol: 'HTTPS',
-            evidence: [
-              {
-                file: relPath,
-                startLine: lineNum,
-                endLine: lineNum,
-                snippet: lines[lineNum - 1]?.trim(),
-                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                extractionMethod: 'ast_visitor',
-                confidence: 'L1',
-                verified: true,
-                verifiedAt: new Date().toISOString(),
-              },
-            ],
-            confidence: 'L1',
-            failureMode: {
-              hasTimeout,
-              hasRetry: surroundingContext.includes('retry'),
-              hasCircuitBreaker: surroundingContext.includes('circuitBreaker') || surroundingContext.includes('opossum'),
-              fallbackTarget: hasTryCatch ? 'handled_exception' : undefined,
-            },
-          });
-        }
-      }
-
-      // 6. Analyze Authentication Boundaries
-      for (const detector of AUTH_DETECTORS) {
-        detector.regex.lastIndex = 0;
-        let authMatch;
-        while ((authMatch = detector.regex.exec(content)) !== null) {
-          const lineNum = content.slice(0, authMatch.index).split('\n').length;
-          const authEntityId = `auth.${detector.authKind}`;
-
-          this.registerEntity({
-            id: authEntityId,
-            kind: 'identity_provider',
-            name: `Auth: ${detector.authKind.toUpperCase()}`,
-            scope: 'security',
-            role: 'Authentication & Session Token Verification',
-            tags: ['security', 'auth', detector.authKind],
-            trustZone: 'dmz_gateway',
-            sources: [
-              {
-                file: relPath,
-                startLine: lineNum,
-                endLine: lineNum,
-                snippet: lines[lineNum - 1]?.trim(),
-                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                extractionMethod: 'ast_visitor',
-                confidence: 'L1',
-                verified: true,
-                verifiedAt: new Date().toISOString(),
-              },
-            ],
-            blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.8 },
-            confidence: 'L1',
-            temporalState: 'current',
-          });
-
-          this.registerRelation({
-            sourceId: sourceEntityId,
-            targetId: authEntityId,
-            relationType: 'authenticates',
-            protocol: 'Crypto-Token',
-            evidence: [
-              {
-                file: relPath,
-                startLine: lineNum,
-                endLine: lineNum,
-                snippet: lines[lineNum - 1]?.trim(),
-                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
-                extractionMethod: 'ast_visitor',
-                confidence: 'L1',
-                verified: true,
-                verifiedAt: new Date().toISOString(),
-              },
-            ],
-            confidence: 'L1',
-          });
-        }
-      }
-    }
-
-    // Populate Trust Zone Members
-    for (const entity of this.entities.values()) {
-      const zone = this.trustBoundaries.get(entity.trustZone);
-      if (zone && !zone.members.includes(entity.id)) {
-        zone.members.push(entity.id);
-      }
-    }
-
-    return this.buildModel();
-  }
-
-  initDefaultTrustBoundaries() {
-    const boundaries = [
-      {
-        id: 'public_untrusted',
-        name: 'Public Untrusted Zone',
-        tier: 'public_untrusted',
-        enforcesAuth: false,
-        members: [],
-        ingressRules: [{ allowedSources: ['*'] }],
-      },
-      {
-        id: 'dmz_gateway',
-        name: 'DMZ & API Gateway',
-        tier: 'dmz_gateway',
-        enforcesAuth: true,
-        authMethod: 'jwt',
-        members: [],
-        ingressRules: [{ allowedSources: ['public_untrusted'] }],
-      },
-      {
-        id: 'internal_service',
-        name: 'Internal Service Mesh',
-        tier: 'authenticated_service',
-        enforcesAuth: true,
-        members: [],
-        ingressRules: [{ allowedSources: ['dmz_gateway', 'internal_service'] }],
-      },
-      {
-        id: 'isolated_datastore',
-        name: 'Isolated Persistent Datastore',
-        tier: 'isolated_datastore',
-        enforcesAuth: true,
-        members: [],
-        ingressRules: [{ allowedSources: ['internal_service'] }],
-      },
-      {
-        id: 'external_untrusted',
-        name: 'External Third-Party APIs',
-        tier: 'public_untrusted',
-        enforcesAuth: false,
-        members: [],
-        ingressRules: [{ allowedSources: ['internal_service'] }],
-      },
-    ];
-
-    for (const b of boundaries) {
-      this.trustBoundaries.set(b.id, b);
-    }
-  }
-
-  buildModel() {
-    const entitiesArr = Array.from(this.entities.values());
-    const relationsArr = Array.from(this.relations.values());
-    const trustArr = Array.from(this.trustBoundaries.values());
-
-    return {
-      schemaVersion: 1,
-      engine: 'tribunal-architecture-intelligence',
-      generatedAt: new Date().toISOString(),
-      repositoryRoot: this.repoRoot,
-      summary: {
-        totalEntities: entitiesArr.length,
-        totalRelations: relationsArr.length,
-        totalTrustZones: trustArr.length,
-        endpointsCount: entitiesArr.filter((e) => e.kind === 'endpoint').length,
-        datastoresCount: entitiesArr.filter((e) => e.kind === 'datastore' || e.kind === 'cache').length,
-        queuesCount: entitiesArr.filter((e) => e.kind === 'queue' || e.kind === 'event_bus').length,
-        externalServicesCount: entitiesArr.filter((e) => e.kind === 'external_api').length,
-      },
-      entities: entitiesArr,
-      relationships: relationsArr,
-      trustBoundaries: trustArr,
-      contradictions: this.contradictions,
-    };
-  }
-
-  save(outputPath) {
-    const defaultPath = path.join(this.repoRoot, '.agent', 'history', 'architecture-model.json');
-    const dest = outputPath || defaultPath;
-    fs.mkdirSync(path.dirname(dest), { recursive: true });
-    const model = this.buildModel();
-    fs.writeFileSync(dest, JSON.stringify(model, null, 2), 'utf8');
-    return dest;
-  }
-}
-
-// ── Standalone CLI ────────────────────────────────────────────────────────────
-if (require.main === module) {
-  const t = timer();
-  const repoRoot = process.argv[2] || process.cwd();
-  console.log(banner('Tribunal Architecture Fact Extractor (TAFE)'));
-  console.log(`  ${CYAN}Scanning repository:${RESET} ${repoRoot}`);
-
-  const extractor = new ArchitectureExtractor(repoRoot);
-  const model = extractor.scan();
-  const savedPath = extractor.save();
-
-  console.log(`  ${GREEN}${BOX.check} Fact Extraction Complete${RESET} in ${formatMs(t())}`);
-  console.log(`  ${DIM}Entities:${RESET}       ${BOLD}${model.summary.totalEntities}${RESET}`);
-  console.log(`  ${DIM}Relationships:${RESET}  ${BOLD}${model.summary.totalRelations}${RESET}`);
-  console.log(`  ${DIM}Endpoints:${RESET}      ${BOLD}${model.summary.endpointsCount}${RESET}`);
-  console.log(`  ${DIM}Data Stores:${RESET}    ${BOLD}${model.summary.datastoresCount}${RESET}`);
-  console.log(`  ${DIM}Saved Model:${RESET}    ${CYAN}${savedPath}${RESET}\n`);
-}
-
-module.exports = {
-  ArchitectureExtractor,
-  walkRepository,
-};
+#!/usr/bin/env node
+/**
+ * architecture_extractor.js — Tribunal Architecture Fact Extractor
+ * ═════════════════════════════════════════════════════════════════════════════
+ * Deterministic static analysis engine that extracts the full Tribunal
+ * Architectural Fact Model (TAFM) directly from repository source code.
+ *
+ * Extracts:
+ *   - Services, Modules, and Entry Points
+ *   - HTTP / API Endpoints (Express, Next.js, Fastify, Hono, Koa)
+ *   - Data Stores & Queries (Prisma, Drizzle, Mongoose, Sequelize, Raw SQL, Redis)
+ *   - Message Queues & Events (BullMQ, RabbitMQ, Kafka, EventEmitters)
+ *   - External Services (fetch, axios, Stripe, AWS SDK, Firebase, SendGrid)
+ *   - Authentication Boundaries (JWT, next-auth, Passport, Clerk, bcrypt)
+ *   - Call-graphs, Failure Modes (try/catch, timeouts, retries), and Trust Zones
+ *
+ * Emits: .agent/history/architecture-model.json with verifiable provenance & L1-L3 confidence.
+ * Zero external dependencies.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { GREEN, CYAN, BOLD, DIM, RESET, BOX, banner, timer, formatMs } = require('./_colors');
+
+// ── Default Exclusions ────────────────────────────────────────────────────────
+const EXCLUDED_DIRS = new Set([
+  'node_modules',
+  '.git',
+  '.next',
+  'dist',
+  'build',
+  'coverage',
+  '.agent',
+  '.agents',
+  'archify',
+  'artifacts',
+  'target',
+]);
+
+const SUPPORTED_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.go', '.rs']);
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+function getSha256(content) {
+  return crypto.createHash('sha256').update(content).digest('hex');
+}
+
+function normalizePosixPath(filePath) {
+  return filePath.replace(/\\/g, '/');
+}
+
+function walkRepository(dir, rootDir = dir, results = []) {
+  if (!fs.existsSync(dir)) return results;
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch (_e) {
+    return results;
+  }
+
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    const relPath = normalizePosixPath(path.relative(rootDir, fullPath));
+
+    if (entry.isDirectory()) {
+      if (!EXCLUDED_DIRS.has(entry.name) && !entry.name.startsWith('.')) {
+        walkRepository(fullPath, rootDir, results);
+      }
+    } else if (entry.isFile()) {
+      const ext = path.extname(entry.name).toLowerCase();
+      if (SUPPORTED_EXTS.has(ext)) {
+        results.push({ fullPath, relPath, ext });
+      }
+    }
+  }
+  return results;
+}
+
+// ── Extraction Patterns ───────────────────────────────────────────────────────
+const ROUTE_DETECTORS = [
+  {
+    regex: /(?:app|router|server)\.(get|post|put|patch|delete|all)\s*\(\s*['"`]([^'"`]+)['"`]/gi,
+    framework: 'express_or_fastify',
+  },
+  {
+    regex: /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(/g,
+    framework: 'nextjs_app_router',
+  },
+  {
+    regex: /\.(get|post|put|patch|delete)\s*\(\s*['"`](\/[^'"`]*)['"`]/gi,
+    framework: 'hono_or_elysia',
+  },
+];
+
+const DATASTORE_DETECTORS = [
+  {
+    regex:
+      /prisma\.(\w+)\.(findMany|findUnique|findFirst|create|update|delete|upsert|aggregate|groupBy|count)\s*\(/g,
+    engine: 'postgres_prisma',
+    kind: 'datastore',
+  },
+  {
+    regex: /(?:db|drizzle)\.(select|insert|update|delete)\s*\(/g,
+    engine: 'sql_drizzle',
+    kind: 'datastore',
+  },
+  {
+    regex:
+      /\.(query|execute|raw|sql)\s*\(\s*['"`]?\s*(SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|TRUNCATE)/gi,
+    engine: 'raw_sql',
+    kind: 'datastore',
+  },
+  {
+    regex: /(?:redis|ioredis|createClient)\s*\(/gi,
+    engine: 'redis_cache',
+    kind: 'cache',
+  },
+  {
+    regex:
+      /(?:redis|client|redisClient|kv)\.(?:get|set|del|hget|hset|expire|incr|lpush|rpush|publish|subscribe)\s*\(|\.(?:hget|hset|expire|incr|lpush|rpush)\s*\(/g,
+    engine: 'redis_ops',
+    kind: 'cache',
+  },
+];
+
+const QUEUE_DETECTORS = [
+  {
+    regex: /new\s+(?:Queue|Worker|QueueScheduler)\s*\(\s*['"`](\w+)['"`]/g,
+    engine: 'bullmq',
+    kind: 'queue',
+  },
+  {
+    regex: /(?:amqplib|amqp\.connect)\s*\(/g,
+    engine: 'rabbitmq',
+    kind: 'queue',
+  },
+  {
+    regex: /new\s+Kafka\s*\(/g,
+    engine: 'kafka',
+    kind: 'queue',
+  },
+  {
+    regex: /\.(?:emit|on|once)\s*\(\s*['"`]([\w:.-]+)['"`]/g,
+    engine: 'event_emitter',
+    kind: 'event_bus',
+  },
+];
+
+const EXTERNAL_SERVICE_DETECTORS = [
+  {
+    regex: /(?:fetch|axios|got|ky|ofetch)\s*\(\s*['"`]?(https?:\/\/[^'"`\s,)]+)/gi,
+    type: 'http_client',
+  },
+  {
+    regex: /new\s+(?:AWS\.)?(?:S3|DynamoDB|SQS|SNS|Lambda|SES|CloudWatch)\s*\(/g,
+    type: 'aws_sdk',
+  },
+  {
+    regex: /@aws-sdk\/client-(\w+)/g,
+    type: 'aws_sdk',
+  },
+  {
+    regex: /(?:stripe|Stripe)\s*\(/g,
+    type: 'stripe_payments',
+  },
+  {
+    regex: /(?:sendgrid|twilio|resend)\s*/gi,
+    type: 'messaging_saas',
+  },
+];
+
+const AUTH_DETECTORS = [
+  {
+    regex: /(?:jwt|jsonwebtoken)\.(?:sign|verify|decode)\s*\(/g,
+    authKind: 'jwt',
+  },
+  {
+    regex: /(?:NextAuth|getServerSession|auth\(\)|getSession)\s*\(/g,
+    authKind: 'next_auth',
+  },
+  {
+    regex: /passport\.(?:authenticate|use|initialize)\s*\(/g,
+    authKind: 'passport',
+  },
+  {
+    regex: /(?:bcrypt|argon2)\.(?:hash|compare|verify)\s*\(/g,
+    authKind: 'password_hashing',
+  },
+  {
+    regex: /(?:clerkMiddleware|currentUser|ClerkProvider)\s*/g,
+    authKind: 'clerk',
+  },
+];
+
+const IMPORT_DETECTOR =
+  /(?:import\s+(?:[\w*\s{},]+)\s+from\s+['"`]([^'"`]+)['"`]|require\s*\(\s*['"`]([^'"`]+)['"`]\))/g;
+
+// ── Architecture Extractor Class ──────────────────────────────────────────────
+class ArchitectureExtractor {
+  constructor(repoRoot = process.cwd()) {
+    this.repoRoot = path.resolve(repoRoot);
+    this.entities = new Map();
+    this.relations = new Map();
+    this.trustBoundaries = new Map();
+    this.failurePaths = [];
+    this.contradictions = [];
+  }
+
+  registerEntity(entity) {
+    if (!this.entities.has(entity.id)) {
+      this.entities.set(entity.id, entity);
+    } else {
+      const existing = this.entities.get(entity.id);
+      if (entity.sources && entity.sources.length) {
+        existing.sources = [...(existing.sources || []), ...entity.sources];
+      }
+    }
+    return this.entities.get(entity.id);
+  }
+
+  registerRelation(relation) {
+    const key = `${relation.sourceId}->${relation.targetId}:${relation.relationType}`;
+    if (!this.relations.has(key)) {
+      this.relations.set(key, {
+        id: `rel.${crypto.createHash('md5').update(key).digest('hex').slice(0, 10)}`,
+        ...relation,
+      });
+    } else {
+      const existing = this.relations.get(key);
+      if (relation.evidence) {
+        existing.evidence = [...(existing.evidence || []), ...relation.evidence];
+      }
+    }
+    return this.relations.get(key);
+  }
+
+  scan() {
+    const files = walkRepository(this.repoRoot, this.repoRoot);
+
+    // Initialize Default Trust Zones
+    this.initDefaultTrustBoundaries();
+
+    // Pass 1: Extract module entities and file contents
+    const fileDataMap = new Map();
+    for (const file of files) {
+      let content;
+      try {
+        content = fs.readFileSync(file.fullPath, 'utf8');
+      } catch (_e) {
+        continue;
+      }
+      const lines = content.split('\n');
+      const hash = getSha256(content);
+      fileDataMap.set(file.relPath, { ...file, content, lines, hash });
+
+      // Register Module Entity
+      const entityId = `mod.${file.relPath.replace(/[^a-zA-Z0-9_.-]/g, '_')}`;
+      const isTest = file.relPath.includes('test') || file.relPath.includes('spec');
+      const isRoute =
+        file.relPath.includes('route') ||
+        file.relPath.includes('api') ||
+        file.relPath.includes('controllers');
+      const isSkill =
+        file.relPath.startsWith('skills/') || file.relPath.startsWith('.agents/skills/');
+
+      this.registerEntity({
+        id: entityId,
+        kind: isRoute ? 'endpoint' : isTest ? 'test_suite' : 'module',
+        name: path.basename(file.relPath),
+        scope: path.dirname(file.relPath),
+        role: isSkill
+          ? 'Skill Template / Resource'
+          : isRoute
+            ? 'API Route Handler'
+            : isTest
+              ? 'Test Suite'
+              : 'Internal Component',
+        tags: [
+          isTest ? 'test' : isSkill ? 'skill' : 'core',
+          path.extname(file.relPath).replace('.', ''),
+        ],
+        trustZone: isRoute ? 'dmz_gateway' : 'internal_service',
+        sources: [
+          {
+            file: file.relPath,
+            startLine: 1,
+            endLine: Math.min(lines.length, 50),
+            contentHash: hash.substring(0, 16),
+            extractionMethod: 'ast_visitor',
+            confidence: 'L1',
+            verified: true,
+            verifiedAt: new Date().toISOString(),
+          },
+        ],
+        blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.1 },
+        confidence: 'L1',
+        temporalState: 'current',
+      });
+    }
+
+    // Pass 2: Extract Architectural Features & Relationships
+    for (const [relPath, fileInfo] of fileDataMap.entries()) {
+      const sourceEntityId = `mod.${relPath.replace(/[^a-zA-Z0-9_.-]/g, '_')}`;
+      const { content, lines } = fileInfo;
+
+      // 1. Analyze Imports & Internal Call Dependencies
+      IMPORT_DETECTOR.lastIndex = 0;
+      let impMatch;
+      while ((impMatch = IMPORT_DETECTOR.exec(content)) !== null) {
+        const importTarget = impMatch[1] || impMatch[2];
+        if (importTarget && importTarget.startsWith('.')) {
+          // Local import
+          const resolvedRel = normalizePosixPath(
+            path.relative(
+              this.repoRoot,
+              path.resolve(path.dirname(fileInfo.fullPath), importTarget),
+            ),
+          );
+          // Try finding matching file
+          const targetKey = Array.from(fileDataMap.keys()).find(
+            k =>
+              k === resolvedRel ||
+              k.startsWith(resolvedRel + '.') ||
+              k === resolvedRel + '/index.js' ||
+              k === resolvedRel + '/index.ts',
+          );
+
+          if (targetKey) {
+            const targetEntityId = `mod.${targetKey.replace(/[^a-zA-Z0-9_.-]/g, '_')}`;
+            const lineNum = content.slice(0, impMatch.index).split('\n').length;
+            this.registerRelation({
+              sourceId: sourceEntityId,
+              targetId: targetEntityId,
+              relationType: 'imports',
+              protocol: 'In-Memory Module',
+              evidence: [
+                {
+                  file: relPath,
+                  startLine: lineNum,
+                  endLine: lineNum,
+                  symbol: importTarget,
+                  snippet: lines[lineNum - 1]?.trim(),
+                  contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                  extractionMethod: 'ast_visitor',
+                  confidence: 'L1',
+                  verified: true,
+                  verifiedAt: new Date().toISOString(),
+                },
+              ],
+              confidence: 'L1',
+            });
+          }
+        }
+      }
+
+      // 2. Analyze API Routes (JS/TS web endpoints)
+      if (['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs'].includes(fileInfo.ext)) {
+        for (const detector of ROUTE_DETECTORS) {
+          detector.regex.lastIndex = 0;
+          let routeMatch;
+          while ((routeMatch = detector.regex.exec(content)) !== null) {
+            const method = routeMatch[1]?.toUpperCase() || 'GET';
+            const endpointPath =
+              routeMatch[2] || `/${relPath.replace(/^src\//, '').replace(/\.[^.]+$/, '')}`;
+            const lineNum = content.slice(0, routeMatch.index).split('\n').length;
+
+            const endpointEntityId = `endpoint.${method.toLowerCase()}.${endpointPath.replace(/[^a-zA-Z0-9_.-]/g, '_')}`;
+            this.registerEntity({
+              id: endpointEntityId,
+              kind: 'endpoint',
+              name: `${method} ${endpointPath}`,
+              scope: relPath,
+              role: `Public/Internal Endpoint (${detector.framework})`,
+              tags: ['api', method.toLowerCase()],
+              trustZone: 'dmz_gateway',
+              sources: [
+                {
+                  file: relPath,
+                  startLine: lineNum,
+                  endLine: Math.min(lineNum + 10, lines.length),
+                  snippet: lines[lineNum - 1]?.trim(),
+                  contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                  extractionMethod: 'ast_visitor',
+                  confidence: 'L1',
+                  verified: true,
+                  verifiedAt: new Date().toISOString(),
+                },
+              ],
+              blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.2 },
+              confidence: 'L1',
+              temporalState: 'current',
+            });
+
+            this.registerRelation({
+              sourceId: endpointEntityId,
+              targetId: sourceEntityId,
+              relationType: 'routes_to',
+              protocol: 'HTTP',
+              evidence: [
+                {
+                  file: relPath,
+                  startLine: lineNum,
+                  endLine: lineNum,
+                  snippet: lines[lineNum - 1]?.trim(),
+                  contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                  extractionMethod: 'ast_visitor',
+                  confidence: 'L1',
+                  verified: true,
+                  verifiedAt: new Date().toISOString(),
+                },
+              ],
+              confidence: 'L1',
+            });
+          }
+        }
+      }
+
+      // 3. Analyze Data Stores (Prisma, SQL, Redis)
+      for (const detector of DATASTORE_DETECTORS) {
+        detector.regex.lastIndex = 0;
+        let dbMatch;
+        while ((dbMatch = detector.regex.exec(content)) !== null) {
+          const lineNum = content.slice(0, dbMatch.index).split('\n').length;
+          const storeId = `datastore.${detector.engine}`;
+
+          this.registerEntity({
+            id: storeId,
+            kind: detector.kind === 'cache' ? 'cache' : 'datastore',
+            name: detector.engine.toUpperCase(),
+            scope: 'storage',
+            role: `${detector.kind === 'cache' ? 'Ephemeral In-Memory Cache' : 'Persistent Relational/NoSQL Database'}`,
+            tags: ['persistence', detector.engine],
+            trustZone: 'isolated_datastore',
+            sources: [
+              {
+                file: relPath,
+                startLine: lineNum,
+                endLine: lineNum,
+                snippet: lines[lineNum - 1]?.trim(),
+                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                extractionMethod: 'ast_visitor',
+                confidence: 'L1',
+                verified: true,
+                verifiedAt: new Date().toISOString(),
+              },
+            ],
+            blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.7 },
+            confidence: 'L1',
+            temporalState: 'current',
+          });
+
+          this.registerRelation({
+            sourceId: sourceEntityId,
+            targetId: storeId,
+            relationType: detector.kind === 'cache' ? 'reads' : 'writes',
+            protocol: detector.engine.includes('redis') ? 'Redis-RESP' : 'SQL-Wire',
+            evidence: [
+              {
+                file: relPath,
+                startLine: lineNum,
+                endLine: lineNum,
+                snippet: lines[lineNum - 1]?.trim(),
+                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                extractionMethod: 'ast_visitor',
+                confidence: 'L1',
+                verified: true,
+                verifiedAt: new Date().toISOString(),
+              },
+            ],
+            confidence: 'L1',
+          });
+        }
+      }
+
+      // 4. Analyze Message Queues & Event Busses
+      for (const detector of QUEUE_DETECTORS) {
+        detector.regex.lastIndex = 0;
+        let qMatch;
+        while ((qMatch = detector.regex.exec(content)) !== null) {
+          const queueName = qMatch[1] || detector.engine;
+          const lineNum = content.slice(0, qMatch.index).split('\n').length;
+          const qEntityId = `queue.${detector.engine}.${queueName}`;
+
+          this.registerEntity({
+            id: qEntityId,
+            kind: detector.kind === 'event_bus' ? 'event_bus' : 'queue',
+            name: `${detector.engine}: ${queueName}`,
+            scope: 'async-broker',
+            role: 'Asynchronous Job Queue / Message Channel',
+            tags: ['messaging', detector.engine],
+            trustZone: 'internal_service',
+            sources: [
+              {
+                file: relPath,
+                startLine: lineNum,
+                endLine: lineNum,
+                snippet: lines[lineNum - 1]?.trim(),
+                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                extractionMethod: 'ast_visitor',
+                confidence: 'L1',
+                verified: true,
+                verifiedAt: new Date().toISOString(),
+              },
+            ],
+            blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.4 },
+            confidence: 'L1',
+            temporalState: 'current',
+          });
+
+          this.registerRelation({
+            sourceId: sourceEntityId,
+            targetId: qEntityId,
+            relationType:
+              content.includes('.on(') || content.includes('.subscribe(')
+                ? 'subscribes'
+                : 'publishes',
+            protocol: detector.engine,
+            evidence: [
+              {
+                file: relPath,
+                startLine: lineNum,
+                endLine: lineNum,
+                snippet: lines[lineNum - 1]?.trim(),
+                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                extractionMethod: 'ast_visitor',
+                confidence: 'L1',
+                verified: true,
+                verifiedAt: new Date().toISOString(),
+              },
+            ],
+            confidence: 'L1',
+          });
+        }
+      }
+
+      // 5. Analyze External Services (Third-Party SaaS & Clouds)
+      for (const detector of EXTERNAL_SERVICE_DETECTORS) {
+        detector.regex.lastIndex = 0;
+        let extMatch;
+        while ((extMatch = detector.regex.exec(content)) !== null) {
+          const lineNum = content.slice(0, extMatch.index).split('\n').length;
+          const serviceName = extMatch[1] || detector.type;
+          const extEntityId = `ext.${crypto.createHash('md5').update(serviceName).digest('hex').slice(0, 8)}`;
+
+          this.registerEntity({
+            id: extEntityId,
+            kind: 'external_api',
+            name: serviceName.length > 35 ? serviceName.slice(0, 32) + '...' : serviceName,
+            scope: 'third_party',
+            role: `External Third-Party Service (${detector.type})`,
+            tags: ['external', detector.type],
+            trustZone: 'external_untrusted',
+            sources: [
+              {
+                file: relPath,
+                startLine: lineNum,
+                endLine: lineNum,
+                snippet: lines[lineNum - 1]?.trim(),
+                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                extractionMethod: 'ast_visitor',
+                confidence: 'L1',
+                verified: true,
+                verifiedAt: new Date().toISOString(),
+              },
+            ],
+            blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.3 },
+            confidence: 'L1',
+            temporalState: 'current',
+          });
+
+          // Check for Failure Resilience (try/catch, timeout, retry)
+          const surroundingContext = lines
+            .slice(Math.max(0, lineNum - 5), Math.min(lines.length, lineNum + 5))
+            .join('\n');
+          const hasTryCatch =
+            surroundingContext.includes('try') || surroundingContext.includes('.catch');
+          const hasTimeout =
+            surroundingContext.includes('timeout') ||
+            surroundingContext.includes('AbortController');
+
+          this.registerRelation({
+            sourceId: sourceEntityId,
+            targetId: extEntityId,
+            relationType: 'calls',
+            protocol: 'HTTPS',
+            evidence: [
+              {
+                file: relPath,
+                startLine: lineNum,
+                endLine: lineNum,
+                snippet: lines[lineNum - 1]?.trim(),
+                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                extractionMethod: 'ast_visitor',
+                confidence: 'L1',
+                verified: true,
+                verifiedAt: new Date().toISOString(),
+              },
+            ],
+            confidence: 'L1',
+            failureMode: {
+              hasTimeout,
+              hasRetry: surroundingContext.includes('retry'),
+              hasCircuitBreaker:
+                surroundingContext.includes('circuitBreaker') ||
+                surroundingContext.includes('opossum'),
+              fallbackTarget: hasTryCatch ? 'handled_exception' : undefined,
+            },
+          });
+        }
+      }
+
+      // 6. Analyze Authentication Boundaries
+      for (const detector of AUTH_DETECTORS) {
+        detector.regex.lastIndex = 0;
+        let authMatch;
+        while ((authMatch = detector.regex.exec(content)) !== null) {
+          const lineNum = content.slice(0, authMatch.index).split('\n').length;
+          const authEntityId = `auth.${detector.authKind}`;
+
+          this.registerEntity({
+            id: authEntityId,
+            kind: 'identity_provider',
+            name: `Auth: ${detector.authKind.toUpperCase()}`,
+            scope: 'security',
+            role: 'Authentication & Session Token Verification',
+            tags: ['security', 'auth', detector.authKind],
+            trustZone: 'dmz_gateway',
+            sources: [
+              {
+                file: relPath,
+                startLine: lineNum,
+                endLine: lineNum,
+                snippet: lines[lineNum - 1]?.trim(),
+                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                extractionMethod: 'ast_visitor',
+                confidence: 'L1',
+                verified: true,
+                verifiedAt: new Date().toISOString(),
+              },
+            ],
+            blastRadius: { directDependents: 0, transitiveDependents: 0, riskScore: 0.8 },
+            confidence: 'L1',
+            temporalState: 'current',
+          });
+
+          this.registerRelation({
+            sourceId: sourceEntityId,
+            targetId: authEntityId,
+            relationType: 'authenticates',
+            protocol: 'Crypto-Token',
+            evidence: [
+              {
+                file: relPath,
+                startLine: lineNum,
+                endLine: lineNum,
+                snippet: lines[lineNum - 1]?.trim(),
+                contentHash: getSha256(lines[lineNum - 1] || '').substring(0, 16),
+                extractionMethod: 'ast_visitor',
+                confidence: 'L1',
+                verified: true,
+                verifiedAt: new Date().toISOString(),
+              },
+            ],
+            confidence: 'L1',
+          });
+        }
+      }
+    }
+
+    // Populate Trust Zone Members
+    for (const entity of this.entities.values()) {
+      const zone = this.trustBoundaries.get(entity.trustZone);
+      if (zone && !zone.members.includes(entity.id)) {
+        zone.members.push(entity.id);
+      }
+    }
+
+    return this.buildModel();
+  }
+
+  initDefaultTrustBoundaries() {
+    const boundaries = [
+      {
+        id: 'public_untrusted',
+        name: 'Public Untrusted Zone',
+        tier: 'public_untrusted',
+        enforcesAuth: false,
+        members: [],
+        ingressRules: [{ allowedSources: ['*'] }],
+      },
+      {
+        id: 'dmz_gateway',
+        name: 'DMZ & API Gateway',
+        tier: 'dmz_gateway',
+        enforcesAuth: true,
+        authMethod: 'jwt',
+        members: [],
+        ingressRules: [{ allowedSources: ['public_untrusted'] }],
+      },
+      {
+        id: 'internal_service',
+        name: 'Internal Service Mesh',
+        tier: 'authenticated_service',
+        enforcesAuth: true,
+        members: [],
+        ingressRules: [{ allowedSources: ['dmz_gateway', 'internal_service'] }],
+      },
+      {
+        id: 'isolated_datastore',
+        name: 'Isolated Persistent Datastore',
+        tier: 'isolated_datastore',
+        enforcesAuth: true,
+        members: [],
+        ingressRules: [{ allowedSources: ['internal_service'] }],
+      },
+      {
+        id: 'external_untrusted',
+        name: 'External Third-Party APIs',
+        tier: 'public_untrusted',
+        enforcesAuth: false,
+        members: [],
+        ingressRules: [{ allowedSources: ['internal_service'] }],
+      },
+    ];
+
+    for (const b of boundaries) {
+      this.trustBoundaries.set(b.id, b);
+    }
+  }
+
+  buildModel() {
+    const entitiesArr = Array.from(this.entities.values());
+    const relationsArr = Array.from(this.relations.values());
+    const trustArr = Array.from(this.trustBoundaries.values());
+
+    return {
+      schemaVersion: 1,
+      engine: 'tribunal-architecture-intelligence',
+      generatedAt: new Date().toISOString(),
+      repositoryRoot: this.repoRoot,
+      summary: {
+        totalEntities: entitiesArr.length,
+        totalRelations: relationsArr.length,
+        totalTrustZones: trustArr.length,
+        endpointsCount: entitiesArr.filter(e => e.kind === 'endpoint').length,
+        datastoresCount: entitiesArr.filter(e => e.kind === 'datastore' || e.kind === 'cache')
+          .length,
+        queuesCount: entitiesArr.filter(e => e.kind === 'queue' || e.kind === 'event_bus').length,
+        externalServicesCount: entitiesArr.filter(e => e.kind === 'external_api').length,
+      },
+      entities: entitiesArr,
+      relationships: relationsArr,
+      trustBoundaries: trustArr,
+      contradictions: this.contradictions,
+    };
+  }
+
+  save(outputPath) {
+    const defaultPath = path.join(this.repoRoot, '.agent', 'history', 'architecture-model.json');
+    const dest = outputPath || defaultPath;
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    const model = this.buildModel();
+    fs.writeFileSync(dest, JSON.stringify(model, null, 2), 'utf8');
+    return dest;
+  }
+}
+
+// ── Standalone CLI ────────────────────────────────────────────────────────────
+if (require.main === module) {
+  const t = timer();
+  const repoRoot = process.argv[2] || process.cwd();
+  console.log(banner('Tribunal Architecture Fact Extractor (TAFE)'));
+  console.log(`  ${CYAN}Scanning repository:${RESET} ${repoRoot}`);
+
+  const extractor = new ArchitectureExtractor(repoRoot);
+  const model = extractor.scan();
+  const savedPath = extractor.save();
+
+  console.log(`  ${GREEN}${BOX.check} Fact Extraction Complete${RESET} in ${formatMs(t())}`);
+  console.log(`  ${DIM}Entities:${RESET}       ${BOLD}${model.summary.totalEntities}${RESET}`);
+  console.log(`  ${DIM}Relationships:${RESET}  ${BOLD}${model.summary.totalRelations}${RESET}`);
+  console.log(`  ${DIM}Endpoints:${RESET}      ${BOLD}${model.summary.endpointsCount}${RESET}`);
+  console.log(`  ${DIM}Data Stores:${RESET}    ${BOLD}${model.summary.datastoresCount}${RESET}`);
+  console.log(`  ${DIM}Saved Model:${RESET}    ${CYAN}${savedPath}${RESET}\n`);
+}
+
+module.exports = {
+  ArchitectureExtractor,
+  walkRepository,
+};