FE-1322: Generate Petrinaut architecture docs from in-code annotations

.github/workflows/lint.yml

@@ -231,6 +231,22 @@ jobs:
           mise run doc:dependency-diagram
           git --no-pager diff --exit-code --color '**/docs/dependency-diagram.mmd'
 
+      - name: Validate Petrinaut architecture docs
+        if: ${{ success() || failure() }}
+        run: |
+          ## Builds the architecture bundle and reports on the annotations it
+          ## reads: unannotated files, undeclared layers, dead `@entryPoint`s,
+          ## and dependency rules the import graph violates. The bundle itself is
+          ## build output and is discarded. Needs no `d2`: nothing is rendered.
+          if ! yarn workspace @local/petrinaut-arch-docs lint:arch-docs; then
+            echo ''
+            echo ''
+            echo 'ℹ️ ℹ️ ℹ️'
+            echo 'Fix the annotations reported above. See libs/@local/petrinaut-arch-docs/README.md.'
+            echo 'ℹ️ ℹ️ ℹ️'
+            exit 1
+          fi
+
       - name: Run yarn lint:constraints
         if: ${{ success() || failure() }}
         run: |

AGENTS.md

@@ -107,6 +107,32 @@ When you change UI or behaviour in the petrinaut packages (`libs/@hashintel/petr
 
 If a change ships without doc updates, call that out in your summary so the user can decide whether to follow up.
 
+### Petrinaut architecture docs
+
+Distinct from the user guide above: the **architecture** docs describe the shape of the code for the people (and agents) working on it. They are generated from annotations in the source by `@local/petrinaut-arch-docs`, and CI fails when they drift.
+
+The architecture is declared **next to the code it describes** — never in a central mapping file:
+
+- `@layerRoot <id>` plus `@role <one line>` in a doc comment on a folder's primary file declares a layer. That pair is the whole declaration; everything else is optional. Prefer this — it needs no new file.
+- A folder's `README.md` frontmatter (`layer` and `role`, optionally `name`, `entryPoints`, `boundaries`, `invariants`) does the same, and the prose below becomes that layer's page. Use it when the folder has real prose to carry, or when no single file is the obvious host.
+- `@boundary <kind> — <note>`, `@invariant <text>` and `@entryPoint <specifier>` in any file's doc comments attach facts to the specific code that upholds them.
+- Files with no annotation inherit from the nearest declaring ancestor, so only ~40 declarations cover ~400 files. Do not annotate every file.
+
+The generated docs are **build output and are not committed** — there is nothing to regenerate before pushing. Only the annotations are versioned.
+
+When you change structure in `libs/@hashintel/petrinaut-core` or `libs/@hashintel/petrinaut`, you MUST:
+
+1. Add a declaration if you introduce a folder that is a genuinely new architectural unit — a new boundary or a distinct responsibility, not merely a new directory.
+2. Update the affected `@boundary`/`@invariant` annotations if you change what they claim. These are claims CI and reviewers rely on; an invariant that is no longer true is worse than none.
+
+Verify with `yarn workspace @local/petrinaut-arch-docs lint:arch-docs`, which fails on unannotated files, undeclared ancestors, dead `@entryPoint`s and rule violations. To read the docs, `turbo run doc:architecture --filter @local/petrinaut-arch-docs` writes the bundle to `libs/@local/petrinaut-arch-docs/bundle/` (git-ignored).
+
+Full reference: `libs/@local/petrinaut-arch-docs/README.md`. Browse the docs with `turbo run dev --filter @apps/petrinaut-docs`, which regenerates the bundle first — run it through Turborepo, since the package script alone skips that. For a quick read of the whole architecture, generate the bundle and open `libs/@local/petrinaut-arch-docs/bundle/architecture.md` — the entire model in one file.
+
+Hand-written MDX in `libs/@local/petrinaut-arch-docs/content/` is optional. Add a page there for reasoning an import graph cannot express; the system works with that directory absent.
+
+Give such a page `attachTo: <layer id>` in its frontmatter and it nests inside the generated tree beneath that layer, rather than sitting in a separate section — that is how the simulation deep-dives are wired. Link between pages with `[text](layer:core.simulation.engine)` or `[text](doc:simulation/memory-model)`; relative paths break when a page's `attachTo` changes, and unresolved targets fail CI.
+
 ## Contextual Rules
 
 CRITICAL: For the files referenced below, use your Read tool to load it on a need-to-know basis, ONLY when relevant to the SPECIFIC task at hand:

apps/petrinaut-docs/.gitignore

@@ -0,0 +1,11 @@
+# Copied from the architecture bundle by scripts/sync-bundle.mjs. The bundle in
+# libs/@local/petrinaut-arch-docs/bundle is the committed artefact; this is a
+# build input derived from it.
+src/content/docs/
+src/content/diagrams/
+src/content/components/
+public/architecture.md
+public/architecture.json
+
+dist/
+.astro/

apps/petrinaut-docs/LICENSE-APACHE.md

@@ -0,0 +1,189 @@
+# Apache License
+
+_Version 2.0, January 2004_
+_&lt;<http://www.apache.org/licenses/>&gt;_
+
+### Terms and Conditions for use, reproduction, and distribution
+
+#### 1. Definitions
+
+“License” shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+“Licensor” shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+“Legal Entity” shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, “control” means **(i)** the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or **(ii)** ownership of fifty percent (50%) or more of the
+outstanding shares, or **(iii)** beneficial ownership of such entity.
+
+“You” (or “Your”) shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+“Source” form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+“Object” form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+“Work” shall mean the work of authorship, whether in Source or Object form, made
+available under the License, as indicated by a copyright notice that is included
+in or attached to the work (an example is provided in the Appendix below).
+
+“Derivative Works” shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works
+shall not include works that remain separable from, or merely link (or bind by
+name) to the interfaces of, the Work and Derivative Works thereof.
+
+“Contribution” shall mean any work of authorship, including the original version
+of the Work and any modifications or additions to that Work or Derivative Works
+thereof, that is intentionally submitted to Licensor for inclusion in the Work
+by the copyright owner or by an individual or Legal Entity authorized to submit
+on behalf of the copyright owner. For the purposes of this definition,
+“submitted” means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems, and
+issue tracking systems that are managed by, or on behalf of, the Licensor for
+the purpose of discussing and improving the Work, but excluding communication
+that is conspicuously marked or otherwise designated in writing by the copyright
+owner as “Not a Contribution.”
+
+“Contributor” shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+#### 2. Grant of Copyright License
+
+Subject to the terms and conditions of this License, each Contributor hereby
+grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
+irrevocable copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the Work and such
+Derivative Works in Source or Object form.
+
+#### 3. Grant of Patent License
+
+Subject to the terms and conditions of this License, each Contributor hereby
+grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
+irrevocable (except as stated in this section) patent license to make, have
+made, use, offer to sell, sell, import, and otherwise transfer the Work, where
+such license applies only to those patent claims licensable by such Contributor
+that are necessarily infringed by their Contribution(s) alone or by combination
+of their Contribution(s) with the Work to which such Contribution(s) was
+submitted. If You institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work or a
+Contribution incorporated within the Work constitutes direct or contributory
+patent infringement, then any patent licenses granted to You under this License
+for that Work shall terminate as of the date such litigation is filed.
+
+#### 4. Redistribution
+
+You may reproduce and distribute copies of the Work or Derivative Works thereof
+in any medium, with or without modifications, and in Source or Object form,
+provided that You meet the following conditions:
+
+- **(a)** You must give any other recipients of the Work or Derivative Works a copy of
+  this License; and
+- **(b)** You must cause any modified files to carry prominent notices stating that You
+  changed the files; and
+- **(c)** You must retain, in the Source form of any Derivative Works that You distribute,
+  all copyright, patent, trademark, and attribution notices from the Source form
+  of the Work, excluding those notices that do not pertain to any part of the
+  Derivative Works; and
+- **(d)** If the Work includes a “NOTICE” text file as part of its distribution, then any
+  Derivative Works that You distribute must include a readable copy of the
+  attribution notices contained within such NOTICE file, excluding those notices
+  that do not pertain to any part of the Derivative Works, in at least one of the
+  following places: within a NOTICE text file distributed as part of the
+  Derivative Works; within the Source form or documentation, if provided along
+  with the Derivative Works; or, within a display generated by the Derivative
+  Works, if and wherever such third-party notices normally appear. The contents of
+  the NOTICE file are for informational purposes only and do not modify the
+  License. You may add Your own attribution notices within Derivative Works that
+  You distribute, alongside or as an addendum to the NOTICE text from the Work,
+  provided that such additional attribution notices cannot be construed as
+  modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction, or
+distribution of Your modifications, or for any such Derivative Works as a whole,
+provided Your use, reproduction, and distribution of the Work otherwise complies
+with the conditions stated in this License.
+
+#### 5. Submission of Contributions
+
+Unless You explicitly state otherwise, any Contribution intentionally submitted
+for inclusion in the Work by You to the Licensor shall be under the terms and
+conditions of this License, without any additional terms or conditions.
+Notwithstanding the above, nothing herein shall supersede or modify the terms of
+any separate license agreement you may have executed with Licensor regarding
+such Contributions.
+
+#### 6. Trademarks
+
+This License does not grant permission to use the trade names, trademarks,
+service marks, or product names of the Licensor, except as required for
+reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+#### 7. Disclaimer of Warranty
+
+Unless required by applicable law or agreed to in writing, Licensor provides the
+Work (and each Contributor provides its Contributions) on an “AS IS” BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,
+including, without limitation, any warranties or conditions of TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are
+solely responsible for determining the appropriateness of using or
+redistributing the Work and assume any risks associated with Your exercise of
+permissions under this License.
+
+#### 8. Limitation of Liability
+
+In no event and under no legal theory, whether in tort (including negligence),
+contract, or otherwise, unless required by applicable law (such as deliberate
+and grossly negligent acts) or agreed to in writing, shall any Contributor be
+liable to You for damages, including any direct, indirect, special, incidental,
+or consequential damages of any character arising as a result of this License or
+out of the use or inability to use the Work (including but not limited to
+damages for loss of goodwill, work stoppage, computer failure or malfunction, or
+any and all other commercial damages or losses), even if such Contributor has
+been advised of the possibility of such damages.
+
+#### 9. Accepting Warranty or Additional Liability
+
+While redistributing the Work or Derivative Works thereof, You may choose to
+offer, and charge a fee for, acceptance of support, warranty, indemnity, or
+other liability obligations and/or rights consistent with this License. However,
+in accepting such obligations, You may act only on Your own behalf and on Your
+sole responsibility, not on behalf of any other Contributor, and only if You
+agree to indemnify, defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason of your
+accepting any such warranty or additional liability.
+
+_END OF TERMS AND CONDITIONS_
+
+### APPENDIX: Apply the Apache License to a specific file
+
+To apply the Apache License to an individual file, attach the following notice.
+The text should be enclosed in the appropriate comment syntax for the file
+format.
+
+    Copyright © 2025–, HASH
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.

apps/petrinaut-docs/LICENSE-MIT.md

@@ -0,0 +1,21 @@
+# MIT License
+
+Copyright © 2025–, HASH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

apps/petrinaut-docs/LICENSE.md

@@ -0,0 +1,3 @@
+# License
+
+Licensed under either of the [Apache License, Version 2.0](LICENSE-APACHE.md) or [MIT license](LICENSE-MIT.md) at your option.

apps/petrinaut-docs/README.md

@@ -0,0 +1,66 @@
+# `@apps/petrinaut-docs`
+
+Renders the Petrinaut architecture bundle as a browsable [Starlight](https://starlight.astro.build)
+site.
+
+**Run it through Turborepo**, which is what knows the site needs a freshly
+generated bundle:
+
+```sh
+turbo run dev --filter @apps/petrinaut-docs     # browse at http://localhost:4321
+turbo run build --filter @apps/petrinaut-docs   # static output in dist/
+```
+
+`yarn workspace @apps/petrinaut-docs dev` runs the package script directly and
+skips the task graph, so it renders whatever was last synced.
+
+## This app owns no content
+
+Every page comes from the bundle generated by `@local/petrinaut-arch-docs`.
+`scripts/sync-bundle.mjs` copies that bundle into `src/content/`; generating it
+is the generator's own `doc:architecture` task, which `sync:bundle` declares as a
+dependency. The bundle is build output and is not committed.
+
+`build`, `lint:tsc` and `dev` all depend on one shared `sync:bundle` rather than
+each running it — they used to call it themselves, which raced when Turborepo ran
+them concurrently on the same directories.
+
+That separation is deliberate. The bundle has to render in a host that did not
+generate it — hash.dev is the other one — so this site is a test of the bundle's
+portability as much as a way to read it. Anything that only works here is a bug
+in the bundle.
+
+To change what the docs say, change the annotations in the Petrinaut source or
+the authored pages in `libs/@local/petrinaut-arch-docs/content/`. Anything run
+through Turborepo picks the change up; to regenerate the bundle on its own:
+
+```sh
+turbo run doc:architecture --filter @local/petrinaut-arch-docs
+```
+
+## Why the bundle is copied rather than read in place
+
+Pointing Astro's `glob` loader at the bundle directory works for `astro build`,
+but not for `astro dev`: in dev, Astro resolves an MDX page's relative image
+paths against the project root, so `../diagrams/core.svg` cannot be found.
+Copying sidesteps that, and matches what an embedding host does anyway.
+
+The copied directories (`src/content/docs`, `src/content/diagrams`) are
+gitignored, as is the bundle they come from. Nothing generated is versioned.
+
+## Notes on configuration
+
+Authored pages are optional. When `content/` in the generator package is empty
+or absent, there is no authored home page, so `/` redirects to the generated
+architecture overview instead.
+
+`trailingSlash: "never"` and `build.format: "file"` are load-bearing, not
+stylistic. The bundle's inter-page links are relative and assume a page's slug
+maps to a URL with no trailing slash; serving `/architecture/core/` instead would
+resolve those links one level too deep.
+
+`installConfig.hoistingLimits` nests this app's dependencies rather than hoisting
+them. Astro's generated prerender entry resolves `cookie` from this app's build
+output, which would otherwise reach the root-hoisted `cookie@0.7.2` that
+`express` pins and fail on a missing `parseCookie` export. Nesting keeps Astro on
+its own `cookie@2.x` without changing hoisting for the rest of the monorepo.