Layer Guard

Renderer

Executor

Step-by-Step Check Procedure

1. Identify the file's layer — check the file path (e.g., src/parser/, src/renderer/, src/executor/).
2. Scan imports — verify no cross-layer imports violate the call flow (CLI Layer calls Parser, which hands off to Renderer, which hands off to Executor). Imports must never skip layers or flow in reverse (e.g., Parser must not import from Executor).
3. Apply the checklist above for the identified layer.
4. Check the ValidatedCommand boundary — ensure Parser outputs it and Renderer/Executor consume it; raw YAML must not cross this boundary.
5. Check for side effects in Renderer — any fs, fetch, process.env, or Math.random call inside the Renderer is a violation.
6. Check for LLM API calls outside Executor — search for openai, fetch (to LLM endpoints), or SDK client usage in Parser or Renderer files.

Automated Check (Approach γ)

Note: scripts/check-layers.sh will be added in a future iteration (Approach γ) to automate steps 2–6 above. Once available, run it as part of your pre-commit check:

bash scripts/check-layers.sh

Pass / Fail Criteria

• Pass: All checklist items for the relevant layer are satisfied; no cross-layer violations found.
• Fail: Any forbidden action is present in a layer, or a cross-layer import violates the dependency direction.