pdd-cli 0.0.237__tar.gz → 0.0.239__tar.gz

{pdd_cli-0.0.237 → pdd_cli-0.0.239}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pdd-cli
-Version: 0.0.237
+Version: 0.0.239
 Summary: PDD (Prompt-Driven Development) Command Line Interface
 Author: Greg Tanaka
 Author-email: glt@alumni.caltech.edu
@@ -65,7 +65,7 @@ Requires-Dist: twine; extra == "dev"
 Requires-Dist: httpx==0.28.1; extra == "dev"
 Dynamic: license-file
 
-.. image:: https://img.shields.io/badge/pdd--cli-v0.0.237-blue
+.. image:: https://img.shields.io/badge/pdd--cli-v0.0.239-blue
    :alt: PDD-CLI Version
 
 .. image:: https://img.shields.io/badge/Discord-join%20chat-7289DA.svg?logo=discord&logoColor=white&link=https://discord.gg/Yp4RTh8bG7
@@ -142,7 +142,7 @@ After installation, verify:
 
    pdd --version
 
-You'll see the current PDD version (e.g., 0.0.237).
+You'll see the current PDD version (e.g., 0.0.239).
 
 Getting Started with Examples
 -----------------------------

{pdd_cli-0.0.237 → pdd_cli-0.0.239}/README.md

@@ -1,6 +1,6 @@
 # PDD (Prompt-Driven Development) Command Line Interface
 
-![PDD-CLI Version](https://img.shields.io/badge/pdd--cli-v0.0.237-blue) [![Discord](https://img.shields.io/badge/Discord-join%20chat-7289DA.svg?logo=discord&logoColor=white)](https://discord.gg/Yp4RTh8bG7)
+![PDD-CLI Version](https://img.shields.io/badge/pdd--cli-v0.0.239-blue) [![Discord](https://img.shields.io/badge/Discord-join%20chat-7289DA.svg?logo=discord&logoColor=white)](https://discord.gg/Yp4RTh8bG7)
 
 ## Introduction
 
@@ -362,7 +362,7 @@ For proper model identifiers to use in your custom configuration, refer to the [
 
 ## Version
 
-Current version: 0.0.237
+Current version: 0.0.239
 
 To check your installed version, run:
 ```
@@ -864,7 +864,7 @@ Options:
 - `--skip-verify`: Skip the functional verification step
 - `--skip-tests`: Skip unit test generation and fixing
 - `--target-coverage FLOAT`: Desired code coverage percentage (default is 90.0)
-- `--dry-run`: Display real-time sync analysis instead of running sync operations. For no-argument project-wide sync, this prints the dependency-ordered module list and estimated cost without executing any module syncs. For single-module sync, it performs the same state analysis as a normal sync run but without acquiring exclusive locks or executing operations.
+- `--dry-run`: Display real-time sync analysis instead of running sync operations. For no-argument project-wide sync, this prints the dependency-ordered module list and estimated cost without executing any module syncs, plus a single compact roll-up of modules outside the Tier 1 (`generate` / `auto-deps`) scope — bucketed by reason (e.g. `Out of Tier 1 scope: 42 example, 31 test, 18 verify, 12 update, 74 no-prompt fixture`) instead of one warning line per skipped entry. When zero modules are stale, the `0 stale module(s)` fragment is rendered in green so the success signal is visually unambiguous. Actionable architecture-graph warnings (ambiguous or unresolved cross-arch dependencies) are still printed individually in yellow. For single-module sync, it performs the same state analysis as a normal sync run but without acquiring exclusive locks or executing operations. Passing the top-level `pdd --verbose` flag (see above) restores the legacy per-module enumeration after the compact roll-up — one yellow warning line per module outside the Tier 1 scope — for debugging.
 - `--one-session / --no-one-session`: Run sync in a single agentic session instead of separate sessions for each step. Cannot be combined with `--skip-tests` or `--skip-verify`.
 - `--no-steer`: Disable interactive steering of sync operations.
 - `--steer-timeout FLOAT`: Timeout in seconds for steering prompts (default: 8.0).
@@ -2412,7 +2412,7 @@ Options:
 - `--git`: Use git history to find the original code file, eliminating the need for the `INPUT_CODE_FILE` argument.
 - `--extensions EXTENSIONS`: In repository-wide mode, filter the update to only include files with the specified comma-separated extensions (e.g., `py,js,ts`).
 - `--simple`: Use the legacy 2-stage LLM update process instead of the default agentic mode. Useful when agentic CLIs are not available or for faster updates.
-- `--sync-metadata`: After the prompt update, run the shared metadata-sync orchestrator so prompt PDD tags, `architecture.json` entries, run reports, and fingerprint state are reconciled in one step. Works in single-file, regeneration, and repo modes. Without this flag, behavior is unchanged and metadata layers must be reconciled with separate commands. **Scope note:** the `tags` stage currently *preserves* existing PDD tags and only *seeds* tags from the matching `architecture.json` entry when a prompt has none — LLM-first **refresh** of stale-but-present tags is tracked at issue [#870](https://github.com/promptdriven/pdd/issues/870) and is not invoked by this orchestrator. When a prompt has zero PDD tags AND no architecture entry, the `tags` stage reports `skipped` (never `ok`) so operators see honest status. On any stage `failed`, `pdd update --sync-metadata` exits non-zero so CI auto-heal does not treat a half-finalized update as healed.
+- `--sync-metadata`: After the prompt update, run the shared metadata-sync orchestrator so prompt PDD tags, `architecture.json` entries, run reports, and fingerprint state are reconciled in one step. Works in single-file, regeneration, and repo modes. **Fingerprint note:** default single-file/regeneration `pdd update <code>` already finalizes the per-target fingerprint (`.pdd/meta/<basename>_<language>.json`) on success, and logs a skip reason when finalization is intentionally bypassed; `--sync-metadata` does not gate that behavior. Without this flag, the broader prompt-tag/architecture/run-report orchestrator is not run and those layers must be reconciled with separate commands. **Scope note:** the `tags` stage currently *preserves* existing PDD tags and only *seeds* tags from the matching `architecture.json` entry when a prompt has none — LLM-first **refresh** of stale-but-present tags is tracked at issue [#870](https://github.com/promptdriven/pdd/issues/870) and is not invoked by this orchestrator. When a prompt has zero PDD tags AND no architecture entry, the `tags` stage reports `skipped` (never `ok`) so operators see honest status. On any stage `failed`, `pdd update --sync-metadata` exits non-zero so CI auto-heal does not treat a half-finalized update as healed.
 
 Example (Metadata Sync):
 ```bash
@@ -2745,8 +2745,9 @@ Options:
 - `--fixer ROLE`: Fixer role for `--review-loop` (for example, `claude`). The fixer must be different from the reviewer unless `--review-only` is used.
 - `--reviewers ROLES`: Legacy comma-separated review-loop role order, interpreted as `reviewer,fixer` (default: `codex,claude`).
 - `--reviewer-fallback ROLE`: Optional secondary reviewer role to invoke once if the primary reviewer cannot complete (for example, because of auth, network, sandbox, or CLI failures). The fallback must resolve to a role different from the reviewer and fixer; if it succeeds, it becomes the active reviewer for the remaining loop and the superseded primary's row in the final report is annotated `(optional, superseded by <fallback>)` so downstream verdict adapters drop the failed primary from the required-reviewer set and resolve to `ship_degraded` instead of `unknown`.
+- `--fixer-fallback ROLE`: Optional secondary fixer role to invoke once if the primary fixer cannot complete (for example, Claude Code subscription-tier `credential-limit` failures). Role aliases are normalized so `claude` and `anthropic` resolve to the same identity; the fallback must resolve to a role different from the active fixer, the active reviewer, AND the originally configured reviewer (so `--reviewer codex --reviewer-fallback gemini --fixer-fallback codex` is skipped even after gemini takes over reviewing). Before the fallback runs the worktree is reset so the primary fixer's partial edits do not leak; on success the fallback takes over as the active fixer for the remaining rounds.
 - `--max-review-rounds INT`: Maximum primary-reviewer/fixer rounds (default: 5).
-- `--max-review-cost FLOAT`: Maximum review-loop LLM cost in USD (default: 10.0).
+- `--max-review-cost FLOAT`: Maximum review-loop LLM cost in USD (default: 50.0).
 - `--max-review-minutes FLOAT`: Maximum review-loop wall-clock minutes (default: 90.0).
 - `--blocking-severities LIST`: Comma-separated severity names used for review-loop reporting and prompt guidance (default: `blocker,critical,medium`). The fixer still receives every valid reviewer finding.
 - `--continue-on-reviewer-limit`: Report provider, rate, context-window, timeout, auth, network, sandbox, permission, and non-zero-exit reviewer failures as `degraded` instead of `failed`. Degraded reviewers are still not clean unless a configured fallback reviewer completes successfully and takes over as the active reviewer.
@@ -3512,7 +3513,7 @@ PDD can be integrated into various development workflows. Here are the conceptua
 4. Stage and commit healed files with a descriptive message — partial metadata state (any stage reporting `failed`) blocks the commit/checkpoint in PR mode. `skipped` is permitted for legitimate cases (no `architecture.json`, unregistered modules, LLM-first tag generation pending #870) and does not block.
 5. Push changes to the current branch
 
-**Metadata Finalization**: The CI auto-heal `update` branch and the preflight drift-heal path both call the same `run_metadata_sync` orchestrator that `pdd update --sync-metadata` uses, so all three workflows share one finalization surface. The orchestrator runs in a fixed order — prompt → tags → architecture → run-report cleanup → fingerprint last. **Within `run_metadata_sync`** a `failed` upstream stage gates every later write-bearing stage (architecture, run_report, fingerprint), so a tags failure cannot drag architecture or fingerprint state out of sync. `skipped` upstream (no `architecture.json`, unregistered modules, LLM-first tag refresh pending #870) is acceptable and does not gate later stages. **The orchestrator is not transactional across stages**: if e.g. tags + architecture succeed and fingerprint then fails, the prompt and `architecture.json` writes have already landed on disk and `run_metadata_sync` itself does not roll them back. End-to-end rollback for a failing module is handled by the CI auto-heal layer — on a sync failure, `pdd.ci_drift_heal` calls `_revert_prompt_file` and the module-scoped `_snapshot_metadata_state_for(drift)` / `_restore_metadata_state_for(snapshot)` pair (which captures this module's `architecture.json` bytes + `.pdd/meta/<basename>_<language>.json` pre-sync and writes them back on failure, never touching other modules' state). A repo-scoped `git restore -- .pdd` / `git restore -- architecture.json` is explicitly NOT used because in a multi-module push-to-main heal it would wipe earlier successful modules' writes from the same run; the legacy `_cleanup_metadata_artifacts` symbol is kept only as a no-op import shim. The combined invariant: `git add -A` on push-to-main cannot publish a failed module's partial metadata alongside another module's successful heal. The combined invariant: auto-heal never commits a half-synced state, and preflight never leaves stale fingerprints after a successful update.
+**Metadata Finalization**: The CI auto-heal `update` branch and the preflight drift-heal path both call the same `run_metadata_sync` orchestrator that `pdd update --sync-metadata` uses, so all three workflows share one finalization surface. The orchestrator runs in a fixed order — prompt → tags → architecture → run-report cleanup → fingerprint last. **Within `run_metadata_sync`** a `failed` upstream stage gates every later write-bearing stage (architecture, run_report, fingerprint), so a tags failure cannot drag architecture or fingerprint state out of sync. `skipped` upstream (no `architecture.json`, unregistered modules, LLM-first tag refresh pending #870) is acceptable and does not gate later stages. **The orchestrator is not transactional across stages**: if e.g. tags + architecture succeed and fingerprint then fails, the prompt and `architecture.json` writes have already landed on disk and `run_metadata_sync` itself does not roll them back. End-to-end rollback for a failing module is handled by the CI auto-heal layer — on a sync failure, `pdd.ci_drift_heal` calls `_revert_prompt_file` and the module-scoped `_snapshot_metadata_state_for(drift)` / `_restore_metadata_state_for(snapshot)` pair (which captures this module's `architecture.json` bytes + `.pdd/meta/<basename>_<language>.json` pre-sync and writes them back on failure, never touching other modules' state). A repo-scoped `git restore -- .pdd` / `git restore -- architecture.json` is explicitly NOT used because in a multi-module push-to-main heal it would wipe earlier successful modules' writes from the same run; the legacy `_cleanup_metadata_artifacts` symbol is kept only as a no-op import shim. **Staging is scoped, not blanket** — `commit_and_push` runs `git add -u` for tracked updates plus explicit per-module pathspecs (computed from each `DriftInfo`'s `prompt_path`/`code_path`/`example_path`/`test_path` and `_operation_log_metadata_relpaths(basename, language)`), filters out gitignored paths via `git check-ignore`, and adds `project_dependencies.csv` only when a healed module ran `auto-deps`; `git add -A` is explicitly rejected because it sweeps unrelated `.pdd/meta/*.json` fingerprints from out-of-scope modules into the heal commit (issue #1021) and could publish a failed module's partial metadata alongside another module's successful heal. The combined invariant: auto-heal never commits a half-synced state, and preflight never leaves stale fingerprints after a successful update.
 
 **Usage:**
 ```bash
@@ -3561,6 +3562,11 @@ For detailed command examples for each workflow, see the respective command docu
 - `pull_request_target` (opened / synchronize / reopened / ready_for_review): heals only modules changed by the PR and pushes a `chore: auto-heal …` commit back to the PR branch.
 - `issue_comment` with a `/heal` command on a PR by an authorized collaborator: same as above, on demand.
 
+Generated internal PRs authored by `prompt-driven-github[bot]` are trusted as
+the autonomous pdd-issue App identity for the `pull_request_target` heal path.
+Other PR authors and all `/heal` comment requesters must pass the `pdd_cloud`
+collaborator check before Cloud Build is dispatched.
+
 There is no push-to-main trigger. Drift on `main` is healed by the next PR that touches the affected modules.
 
 **Loop prevention**: Auto-heal commits start with `chore: auto-heal …`; the Cloud Build step short-circuits when the triggering commit subject matches that prefix, so the heal cannot retrigger itself.

{pdd_cli-0.0.237 → pdd_cli-0.0.239}/pdd/agentic_change_orchestrator.py

@@ -1013,6 +1013,15 @@ def _preflight_drift_heal(
                 if not quiet:
                     console.print(f"   [green]✓[/green] healed {drift.basename}")
             else:
+                combined_output = f"{result.stdout or ''}\n{result.stderr or ''}"
+                if (
+                    "metadata finalization failed" in combined_output
+                    or "metadata staging verification failed" in combined_output
+                    or "[metadata-sync]" in combined_output
+                ):
+                    raise RuntimeError(
+                        f"preflight metadata finalization failed for {drift.basename}"
+                    )
                 failed.append(drift.basename)
                 if not quiet:
                     tail = result.stderr.strip().splitlines()[-1:] or ["(no stderr)"]
@@ -1026,6 +1035,8 @@ def _preflight_drift_heal(
                 console.print(
                     f"   [red]✗[/red] heal timed out for {drift.basename}"
                 )
+        except RuntimeError:
+            raise
         except Exception as exc:
             failed.append(drift.basename)
             if not quiet:

{pdd_cli-0.0.237 → pdd_cli-0.0.239}/pdd/agentic_checkup.py

@@ -321,8 +321,9 @@ def run_agentic_checkup(
     reviewer: Optional[str] = None,
     fixer: Optional[str] = None,
     reviewer_fallback: Optional[str] = None,
+    fixer_fallback: Optional[str] = None,
     max_review_rounds: int = 5,
-    max_review_cost: float = 10.0,
+    max_review_cost: float = 50.0,
     max_review_minutes: float = 90.0,
     require_all_reviewers_clean: bool = True,
     continue_on_reviewer_limit: bool = False,
@@ -349,6 +350,10 @@ def run_agentic_checkup(
             reviewer first pass and do not invoke the fixer or push changes.
         reviewer_fallback: Optional secondary reviewer role to try once when
             the primary reviewer cannot complete.
+        fixer_fallback: Optional secondary fixer role to try once when the
+            primary fixer cannot address the reviewer's findings (e.g. a
+            subscription-tier credential is exhausted). Must differ from
+            both the primary fixer and the active reviewer.
 
     Returns:
         Tuple of (success, message, total_cost, model_used).
@@ -452,6 +457,7 @@ def run_agentic_checkup(
             reviewer=reviewer,
             fixer=fixer,
             reviewer_fallback=reviewer_fallback,
+            fixer_fallback=fixer_fallback,
             review_only=review_only,
             max_rounds=max_review_rounds,
             max_cost=max_review_cost,

{pdd_cli-0.0.237 → pdd_cli-0.0.239}/pdd/agentic_common.py

@@ -388,6 +388,26 @@ _PERMANENT_ERROR_CLASSES: Tuple[Tuple[str, Tuple[str, ...]], ...] = (
             r"model\s+not\s+found(?!\s+in\s+provider)",
         ),
     ),
+    (
+        # Issue (this PR): Claude Code subscription-tier weekly limit ("You've
+        # hit your limit · resets [TIME]"). Distinct from API-tier 429 because
+        # the reset window is hours-to-days, not seconds-to-minutes — retrying
+        # on the 60s rate-limit floor wastes minutes. Stable token
+        # `credential-limit` lets pdd_cloud's OAuth-token waterfall detect this
+        # and rotate to a different credential instead of retrying the dead one.
+        "credential-limit",
+        (
+            # Proximity + time-token guard. Requires "hit your limit" and
+            # "resets" within 40 chars (typical envelope is "... limit ·
+            # resets May 18, 11pm (UTC) ...") AND requires a time-token
+            # OR delimiter immediately after "resets" so distant prose
+            # like "if you hit your limit, nothing resets automatically"
+            # does NOT classify as credential-limit. Without the time
+            # token, any sentence stringing both phrases together would
+            # short-circuit the rate-limit retry path on benign text.
+            r"hit\s+your\s+limit[^\n]{0,40}?\bresets?\b\s*(?:[·:|\-]|in\s|at\s|on\s|\d|jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)",
+        ),
+    ),
     (
         # Issue #1072: quota exhaustion (permanent even when 429 is present)
         "quota",

{pdd_cli-0.0.237 → pdd_cli-0.0.239}/pdd/agentic_sync.py

@@ -36,7 +36,11 @@ from .architecture_include_validation import (
     validate_prompt_contract_context,
 )
 from .sync_graph_order_consistency import warnings_for_arch_vs_include_sync_order
-from .architecture_registry import extract_modules, find_project_root as _find_project_root
+from .architecture_registry import (
+    extract_modules,
+    find_architecture_for_project,
+    find_project_root as _find_project_root,
+)
 from .construct_paths import (
     _detect_context_from_basename,
     _extract_prefix_from_prompts_dir,
@@ -421,12 +425,23 @@ class GlobalSyncAnalysis(NamedTuple):
 
     modules_to_sync: List[str]
     module_cwds: Dict[str, Path]
+    module_targets: Dict[str, str]
     estimated_cost: float
     module_operations: Dict[str, List[str]]
     skipped_modules: List[str]
     all_modules: List[str]
 
 
+class GlobalSyncModule(NamedTuple):
+    """Scoped global-sync module identity."""
+
+    key: str
+    basename: str
+    cwd: Path
+    architecture_path: Path
+    entry: Dict[str, Any]
+
+
 def _architecture_module_basenames(architecture: List[Dict[str, Any]]) -> List[str]:
     """Return syncable architecture module basenames, preserving declaration order."""
     basenames: List[str] = []
@@ -441,6 +456,58 @@ def _architecture_module_basenames(architecture: List[Dict[str, Any]]) -> List[s
     return basenames
 
 
+def _architecture_sync_modules(project_root: Path) -> Tuple[List[GlobalSyncModule], List[Dict[str, Any]], Path]:
+    """Return architecture modules with cwd scope preserved."""
+    arch_files = find_architecture_for_project(project_root)
+    if not arch_files:
+        return [], [], project_root / "architecture.json"
+
+    raw_modules: List[Tuple[str, Path, Path, Dict[str, Any]]] = []
+    architecture: List[Dict[str, Any]] = []
+    seen: set[Tuple[Path, str]] = set()
+
+    for arch_path in arch_files:
+        try:
+            data = json.loads(arch_path.read_text(encoding="utf-8"))
+        except (json.JSONDecodeError, OSError):
+            continue
+
+        arch_dir = arch_path.parent
+        for entry in extract_modules(data):
+            basename = _basename_from_architecture_filename(entry.get("filename", ""))
+            if not basename:
+                continue
+            dedupe_key = (arch_path.resolve(), basename)
+            if dedupe_key in seen:
+                continue
+            seen.add(dedupe_key)
+            architecture.append(entry)
+            # Consult _resolve_module_cwd so a nested .pddrc whose context owns
+            # this basename wins over the arch file's own directory. The
+            # resolver scans subdirectories of arch_dir for .pddrc files and
+            # falls back to arch_dir when no nested config claims the basename.
+            cwd = _resolve_module_cwd(basename, arch_dir)
+            raw_modules.append((basename, cwd, arch_path, entry))
+
+    counts: Dict[str, int] = {}
+    for basename, _, _, _ in raw_modules:
+        counts[basename] = counts.get(basename, 0) + 1
+
+    modules: List[GlobalSyncModule] = []
+    for basename, cwd, arch_path, entry in raw_modules:
+        if counts[basename] > 1:
+            try:
+                rel_scope = arch_path.parent.resolve().relative_to(project_root.resolve()).as_posix()
+            except (OSError, ValueError):
+                rel_scope = arch_path.parent.as_posix()
+            key = f"{rel_scope or '.'}:{basename}"
+        else:
+            key = basename
+        modules.append(GlobalSyncModule(key, basename, cwd, arch_path, entry))
+
+    return modules, architecture, arch_files[0]
+
+
 def _prompt_contract_errors_for_module(
     basename: str,
     cwd: Path,
@@ -578,7 +645,7 @@ def _resolve_module_sync_context(
 
 
 def _analyze_global_sync_modules(
-    modules: List[str],
+    modules: List[GlobalSyncModule],
     project_root: Path,
     *,
     quiet: bool = False,
@@ -590,29 +657,33 @@ def _analyze_global_sync_modules(
     """Tier 1 global sync analysis: fingerprint-scan all architecture modules."""
     modules_to_sync: List[str] = []
     module_cwds: Dict[str, Path] = {}
+    module_targets: Dict[str, str] = {}
     module_operations: Dict[str, List[str]] = {}
     skipped_modules: List[str] = []
     estimated_cost = 0.0
     effective_budget = budget if budget is not None else 10.0
     effective_coverage = target_coverage if target_coverage is not None else 90.0
 
-    for basename in modules:
-        cwd = _resolve_module_cwd(basename, project_root)
-        module_cwds[basename] = cwd
+    for module in modules:
+        key = module.key
+        basename = module.basename
+        cwd = module.cwd
+        module_cwds[key] = cwd
+        module_targets[key] = basename
 
         try:
             context_name, prompts_dir, lang_to_path = _resolve_module_sync_context(
                 basename, cwd
             )
         except Exception as exc:
-            modules_to_sync.append(basename)
-            module_operations[basename] = [
+            modules_to_sync.append(key)
+            module_operations[key] = [
                 f"analysis-error: {exc}; queued for sync as safe fallback"
             ]
             continue
 
         if not lang_to_path:
-            skipped_modules.append(f"{basename}: no syncable prompt file found")
+            skipped_modules.append(f"{key}: no syncable prompt file found")
             continue
 
         operations: List[str] = []
@@ -644,28 +715,34 @@ def _analyze_global_sync_modules(
                 estimated_cost += float(decision.estimated_cost or 0.0)
             elif decision.operation not in _GLOBAL_SYNC_NOOP_OPERATIONS:
                 skipped_modules.append(
-                    f"{basename}: {language} requires {decision.operation}; "
+                    f"{key}: {language} requires {decision.operation}; "
                     "outside Tier 1 prompt-staleness scope"
                 )
 
         if needs_sync:
-            modules_to_sync.append(basename)
-            module_operations[basename] = operations
+            modules_to_sync.append(key)
+            module_operations[key] = operations
 
     if not quiet:
         skipped_count = len(modules) - len(modules_to_sync)
+        stale_count = len(modules_to_sync)
+        if stale_count == 0:
+            stale_fragment = f"[green]0 stale module(s)[/green]"
+        else:
+            stale_fragment = f"{stale_count} stale module(s)"
         console.print(
-            f"[bold]Global sync analysis:[/bold] {len(modules_to_sync)} stale "
-            f"module(s), {skipped_count} already synced or skipped."
+            f"[bold]Global sync analysis:[/bold] {stale_fragment}, "
+            f"{skipped_count} already synced or skipped."
         )
 
     return GlobalSyncAnalysis(
         modules_to_sync=modules_to_sync,
         module_cwds=module_cwds,
+        module_targets=module_targets,
         estimated_cost=estimated_cost,
         module_operations=module_operations,
         skipped_modules=skipped_modules,
-        all_modules=modules,
+        all_modules=[module.key for module in modules],
     )
 
 
@@ -683,15 +760,163 @@ def _dependency_ordered_modules(
     return ordered
 
 
+def _build_scoped_global_dep_graph(
+    modules: List[GlobalSyncModule],
+    target_keys: List[str],
+    project_root: Path,
+) -> Tuple[Dict[str, List[str]], List[str]]:
+    """Build a dependency graph for scoped global-sync module keys.
+
+    Dep resolution proceeds in two passes:
+
+    1. Same-architecture scope: prefer a module declared in the same
+       architecture.json as the depending module.
+    2. Cross-architecture fallback: if no same-arch match exists, look across
+       all loaded modules by basename. An unambiguous match (exactly one
+       module across all archs with that basename) is accepted to preserve
+       the prior combined-architecture behaviour. Ambiguous cross-arch
+       basenames (multiple matches) emit a warning and drop the edge.
+    """
+    target_set = set(target_keys)
+    module_by_key = {module.key: module for module in modules}
+    key_by_scope_basename = {
+        (module.architecture_path.resolve(), module.basename): module.key
+        for module in modules
+    }
+    # Global basename index used for unambiguous cross-arch fallback.
+    keys_by_basename: Dict[str, List[str]] = {}
+    for module in modules:
+        keys_by_basename.setdefault(module.basename, []).append(module.key)
+    graph: Dict[str, List[str]] = {key: [] for key in target_keys}
+    warnings: List[str] = []
+
+    for key in target_keys:
+        module = module_by_key.get(key)
+        if module is None:
+            continue
+        deps = module.entry.get("dependencies", [])
+        if not isinstance(deps, list):
+            continue
+        for dep in deps:
+            dep_basename = _basename_from_architecture_filename(str(dep))
+            if not dep_basename:
+                continue
+            dep_key = key_by_scope_basename.get(
+                (module.architecture_path.resolve(), dep_basename)
+            )
+            if dep_key is None:
+                # Same-architecture lookup missed. Fall back to a global
+                # basename lookup so cross-arch edges (preserved by the old
+                # combined-architecture builder) still resolve when the
+                # basename is unambiguous across the loaded modules.
+                candidate_keys = keys_by_basename.get(dep_basename, [])
+                if len(candidate_keys) == 1:
+                    dep_key = candidate_keys[0]
+                elif len(candidate_keys) > 1:
+                    warnings.append(
+                        f"combined architecture data under {project_root}: "
+                        f"module '{key}' declares ambiguous cross-arch "
+                        f"dependency '{dep}' (basename '{dep_basename}' "
+                        f"matches multiple modules: "
+                        f"{', '.join(sorted(candidate_keys))}); "
+                        "edge omitted from schedule"
+                    )
+                    continue
+                else:
+                    warnings.append(
+                        f"combined architecture data under {project_root}: "
+                        f"module '{key}' declares unresolved dependency "
+                        f"'{dep}'; no module with that filename in the same "
+                        "architecture scope; edge omitted from schedule"
+                    )
+                    continue
+            if dep_key == key:
+                continue
+            if dep_key in target_set:
+                graph[key].append(dep_key)
+            else:
+                warnings.append(
+                    f"combined architecture data under {project_root}: module "
+                    f"'{key}' depends on '{dep_key}' (via '{dep}'), which is not "
+                    "in the sync target set; edge omitted from schedule"
+                )
+
+    return graph, warnings
+
+
+_SKIPPED_BUCKET_ORDER: Tuple[str, ...] = (
+    "example",
+    "test",
+    "verify",
+    "update",
+    "fix",
+    "crash",
+    "no-prompt fixture",
+    "other",
+)
+_SKIPPED_OPERATION_BUCKETS: Tuple[str, ...] = (
+    "example",
+    "test",
+    "verify",
+    "update",
+    "fix",
+    "crash",
+)
+
+
+def _bucket_skipped_reasons(skipped_modules: List[str]) -> Dict[str, int]:
+    """Bucket skipped-module entries by reason for the dry-run roll-up.
+
+    Entries flagged "no syncable prompt file found" go into `no-prompt fixture`;
+    entries shaped "{key}: {language} requires {operation}; outside Tier 1 ..."
+    bucket by `operation` when it matches a known Tier-1-out-of-scope op,
+    otherwise into `other`.
+    """
+    buckets: Dict[str, int] = {name: 0 for name in _SKIPPED_BUCKET_ORDER}
+    for entry in skipped_modules:
+        lower = entry.lower()
+        if "no syncable prompt file found" in lower:
+            buckets["no-prompt fixture"] += 1
+            continue
+        matched = False
+        for op in _SKIPPED_OPERATION_BUCKETS:
+            if f"requires {op}" in lower:
+                buckets[op] += 1
+                matched = True
+                break
+        if not matched:
+            buckets["other"] += 1
+    return buckets
+
+
+def _format_skipped_bucket_summary(skipped_modules: List[str]) -> Optional[str]:
+    """Return a stable single-line roll-up of skipped buckets, or None if empty."""
+    if not skipped_modules:
+        return None
+    buckets = _bucket_skipped_reasons(skipped_modules)
+    parts = [
+        f"{count} {name}"
+        for name in _SKIPPED_BUCKET_ORDER
+        if (count := buckets.get(name, 0)) > 0
+    ]
+    if not parts:
+        return None
+    return "Out of Tier 1 scope: " + ", ".join(parts)
+
+
 def _print_global_sync_plan(
     analysis: GlobalSyncAnalysis,
     ordered_modules: List[str],
     warnings: List[str],
     budget: Optional[float] = None,
+    verbose: bool = False,
 ) -> None:
     """Render a concise global sync dry-run plan."""
     console.print("[bold]Global sync dry run:[/bold]")
-    console.print(f"  Tier 1 (prompt staleness): {len(ordered_modules)} module(s) stale")
+    if len(ordered_modules) == 0:
+        console.print("  Tier 1 (prompt staleness): [green]0 module(s) stale[/green]")
+    else:
+        console.print(f"  Tier 1 (prompt staleness): {len(ordered_modules)} module(s) stale")
     console.print(f"  Total architecture modules scanned: {len(analysis.all_modules)}")
     console.print(f"  Estimated cost: ${analysis.estimated_cost:.2f}")
     if budget is not None:
@@ -714,8 +939,13 @@ def _print_global_sync_plan(
     for warning in warnings:
         console.print(f"[yellow]Warning: {warning}[/yellow]")
 
-    for skipped in analysis.skipped_modules:
-        console.print(f"[yellow]Warning: {skipped}[/yellow]")
+    if analysis.skipped_modules:
+        summary = _format_skipped_bucket_summary(analysis.skipped_modules)
+        if summary is not None:
+            console.print(f"  [dim]{summary}[/dim]")
+        if verbose:
+            for skipped in analysis.skipped_modules:
+                console.print(f"[yellow]Warning: {skipped}[/yellow]")
 
 
 def run_global_sync(
@@ -736,8 +966,8 @@ def run_global_sync(
 ) -> Tuple[bool, str, float, str]:
     """Run project-wide Tier 1 global sync from architecture.json."""
     project_root = _find_project_root(Path.cwd())
-    architecture, arch_path = _load_architecture_json(project_root)
-    if architecture is None:
+    all_modules, architecture, arch_path = _architecture_sync_modules(project_root)
+    if not architecture:
         return (
             False,
             f"No architecture.json found under {project_root}.",
@@ -745,7 +975,6 @@ def run_global_sync(
             "global-sync",
         )
 
-    all_modules = _architecture_module_basenames(architecture)
     if not all_modules:
         return (
             False,
@@ -764,18 +993,20 @@ def run_global_sync(
         target_coverage=target_coverage,
     )
 
-    dep_result = build_dep_graph_from_architecture_data(
-        architecture,
+    dep_graph, dep_warnings = _build_scoped_global_dep_graph(
+        all_modules,
         analysis.modules_to_sync,
-        source_name=f"combined architecture data under {project_root}",
+        project_root,
     )
     ordered_modules = _dependency_ordered_modules(
-        analysis.modules_to_sync, dep_result.graph
+        analysis.modules_to_sync, dep_graph
     )
 
     if dry_run:
         if not quiet:
-            _print_global_sync_plan(analysis, ordered_modules, dep_result.warnings, budget)
+            _print_global_sync_plan(
+                analysis, ordered_modules, dep_warnings, budget, verbose=verbose
+            )
         return (
             True,
             f"Global sync dry run: {len(ordered_modules)} module(s) would sync.",
@@ -801,13 +1032,13 @@ def run_global_sync(
             "global-sync",
         )
 
-    for warning in dep_result.warnings:
+    for warning in dep_warnings:
         if not quiet:
             console.print(f"[yellow]Warning: {warning}[/yellow]")
 
     runner = AsyncSyncRunner(
         basenames=ordered_modules,
-        dep_graph=dep_result.graph,
+        dep_graph=dep_graph,
         sync_options={
             "total_budget": budget,
             "skip_verify": skip_verify,
@@ -825,6 +1056,7 @@ def run_global_sync(
         verbose=verbose,
         issue_url=None,
         module_cwds=analysis.module_cwds,
+        module_targets=analysis.module_targets,
         initial_cost=0.0,
     )
     success, message, cost = runner.run()
@@ -946,6 +1178,13 @@ def _resolve_module_cwd(basename: str, project_root: Path) -> Path:
        they match everything and should not claim ownership of unrelated modules.
     2. Fall back to project_root (which may have its own root .pddrc).
     """
+    root_has_prompt = False
+    try:
+        _, _, root_lang_to_path = _resolve_module_sync_context(basename, project_root)
+        root_has_prompt = bool(root_lang_to_path)
+    except Exception:
+        root_has_prompt = False
+
     # 1. Scan subdirectories for .pddrc files (max depth 2)
     best_match: Optional[Path] = None
     best_depth = -1
@@ -962,10 +1201,11 @@ def _resolve_module_cwd(basename: str, project_root: Path) -> Path:
                     if _is_catchall_match(basename, config):
                         continue
                     candidate_dir = pddrc_path.parent
-                    if _is_broad_basename_glob_match(basename, config, detected) and not (
-                        _prompt_exists_for_context(candidate_dir, config, detected, basename)
-                    ):
-                        continue
+                    if _is_broad_basename_glob_match(basename, config, detected):
+                        if root_has_prompt:
+                            continue
+                        if not _prompt_exists_for_context(candidate_dir, config, detected, basename):
+                            continue
                     candidate_depth = len(candidate_dir.relative_to(project_root).parts)
                     if candidate_depth > best_depth:
                         best_match = candidate_dir